Develop Bugs

system.img Download?

So I am trying to follow the instructions found on the wiki (I'd like to it but the forums are preventing me from posting URLs at the moment) for installing Android on my HTC AT&T Tilt device and I was wondering, where do I download the system.img for Android from? I've been searching around online and cannot find it anywhere...
Many Thanks,
~Jeff

www.androidonhtc.com should have everything for your device
more specifically http://www.androidonhtc.com/wiki/Latest_Builds_(Kaiser) for kaiser http://www.androidonhtc.com/wiki/Latest_Builds_(Polaris) for polaris and http://www.androidonhtc.com/wiki/Latest_Builds_(Vogue) for vogue

R3TR3C said:
should have everything for your device
Click to expand...
Click to collapse
Thanks, I had downloaded the files from that page. It was just confusing because the step by step reads like you need to download a system.img from somewhere when this file in generated when you install Android. Got it loading... Now on to figuring out why it won't boot!
~Jeff

JeffHoogland said:
Thanks, I had downloaded the files from that page. It was just confusing because the step by step reads like you need to download a system.img from somewhere when this file in generated when you install Android. Got it loading... Now on to figuring out why it won't boot!
~Jeff
Click to expand...
Click to collapse
What do you mean when you say "won't boot"? Does your phone show the Linux logo and rolling text, does it show a boot logo animation. Give us some hints and we'll try and sort this out for you.
edit: I see you started another thread, I guess you are working out your issues in that one instead.

binlabin said:
edit: I see you started another thread, I guess you are working out your issues in that one instead.
Click to expand...
Click to collapse
Yea, sorry. One issue for one thread. Keeps things more organized.
~Jeff

linux logo and scolling txt
well, i will hijack her thread since i am at that point.
i did follow the wiki and downloaded the files for the kaiser. i looked at the files and noticed a zimage but no system img file. do i need to compile the package on my linux box then put it on the sd card to run the haret file?

System.IMG/SQSH is deprecated. Use a androidinstall.tar build such as myn warm android. Everything there work including BT and camera.

As thebulletfromhell said, the system.img/sqsh file method of installing Android is now very outdated, and the more mature builds are using the Androidinstall.tar method, this method has several advantages, a menu driven installer, easier updating, greater stability, less problems caused by mis-matched rootfs/system/zimage files.
The two main builds at the moment are; Myns Warm Donut : http://forum.xda-developers.com/showthread.php?t=619980
And Polyrhythmics Eclair 2.1 : http://forum.xda-developers.com/showthread.php?t=600154
Both of these are probably the best supported and most widely used ports to Kaiser hardware.
There are other builds of course, but as a newer user of android I'd recommend these two first.

Hello. I had some troubles running Android on my HTC TyTN II.
The system boots but I see on the console an error message saying "can't find system.img" or something similar.
I downloaded the latest versions of everything but androidinstall.tar is not enough.

i have same problem

Its due to the kernel's Sys & Data boot parameters. Just use any of the newer kernels which carry support for both NAND and SD

[ThinkTank] Obtaining Perma-Root Discussion

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
In order to keep the Root Progress thread as clean as possible, I took Kenny's advice and created a new thread. So to bring others up to speed, the Galaxy Note 4 variants from AT&T and Verizon have a root, but it's only temporary and resets after a reboot. Also system write is inconsistent.
This thread is for people to share and discuss their ideas and theories of how to make our temp root into a permanent root. Don't be afraid to share or ask any questions you may have because this is the place for them here. Now let's get brainstorming!​

Continuous "Custom padlock" on bootup
Well I'll join in...
Not sure if it's worth mentioning, but I've successfully got my phone to continuously have the "Custom" message on my bootup screen and I enabled Factory Mode which is enabled at each boot. I managed to edit the /efs/FactoryApp enabling "Factory Mode" and changing some file permissions and not have the system restore the changes to the /efs/FactoryApp folder. When I edited it earlier pressing the power button caused a complete shut down, so I was hoping this was progress, but now pressing the power button brings up the power menu like normal. Is this partition handled differently or is this any progress? Can someone with more knowledge of the system file system comment on this?

CJ74753 said:
Well I'll join in...
Not sure if it's worth mentioning, but I've successfully got my phone to continuously have the "Custom" message on my bootup screen and I enabled Factory Mode which is enabled at each boot. I managed to edit the /efs/FactoryApp enabling "Factory Mode" and not have the system restore the changes to the /efs/FactoryApp folder. When I edited it earlier pressing the power button caused a complete shut down, so I was hoping this was progress. Is this partition handled differently or is this any progress? Can someone with more knowledge of the system file system comment on this?
Click to expand...
Click to collapse
Anything is worth mentioning. It's interesting. I've just got my Note 4 warranty replacement yesterday so I'm timid to tinkering with it just yet. On my previous Note 4 I wiped out the EFS while playing in one of those "secret menus' LoL.
My thoughts on how-to obtain permanent root: We'll obviously make use of the temp root from KingRoot, then my idea (if feasible/logical) is to find the flag/eFuse and modify the result or expected result to keep it from reverting back. Now if it's dependent on an eFuse it may not be feasible if it's blown from the factory to lock the bootloader, but if it's like Dan Rosenbergs @djrbliss findings then the eFuse may be blown to unlock the bootloader. It's been a while since I read his findings so I may not be 100% accurate but it makes more sense the first method from a security point-of-view.
Now this was all before dmverity was introduced into KitKat 4.4.4 I believe, so things probably have changed for the worse in our case. I wonder where the weakest link is? I say this because obviously Qualcomm is great at securing their high-level chain of commands lately, but with the Droid Turbo gaining root(same SoC) then I have to believe that a kernel exploit is possible permanently and our road block is Sammy's software. Now with that being said, how tough can their software really be if their flagship S6 (Exynos) was just rooted? BTW good job @idler1984 on that! So you see where I'm going with this right? There's got to be a hole somewhere in Sammy's software after the bootloader, I just don't have a full overview of the boot process as far as where the Qualcomm bootloader hands off to kernel, then to Samsung's KNOX or activation lock etc etc...
Speaking of KNOX (Just rambling here) but has anyone who has used KingRoot ensured that they have turned KNOX and Activation Lock off? That would be funny is that's all it took to retain root

CJ74753 said:
Well I'll join in...
Not sure if it's worth mentioning, but I've successfully got my phone to continuously have the "Custom" message on my bootup screen and I enabled Factory Mode which is enabled at each boot. I managed to edit the /efs/FactoryApp enabling "Factory Mode" and changing some file permissions and not have the system restore the changes to the /efs/FactoryApp folder. When I edited it earlier pressing the power button caused a complete shut down, so I was hoping this was progress, but now pressing the power button brings up the power menu like normal. Is this partition handled differently or is this any progress? Can someone with more knowledge of the system file system comment on this?
Click to expand...
Click to collapse
Don't read too much into the custom message you can trip that a variety of ways even before now.

dagolith said:
Don't read too much into the custom message you can trip that a variety of ways even before now.
Click to expand...
Click to collapse
Well my main point here is that I edited the Factory Mode flag to enabled and was able to force the system to keep it set by editing the file permissions. While this don't work with all the files/folders this might be something to look at. I only wish I understood the file system more so I knew if we could possibly keep the system from restoring apps and removing root.

Here is a message I sent Droid.Ninja az I did not want to clog up the other thread with stupid ideas. But, that has been taken care of by others and their talking about off topic stuff. Any way here is a partial quote of what I sent him a few days ago. I hope that there is something useful here.
Jaytronics said:
Kingroot obtains Root. Be it temporary but Root non the less. Now, from my understanding, the device are trying to install the su binary while booted? Now, I know that and this may not matter. But after Kingroot has done its thing, SuperSU can not be utilized. But, what I have found is, that if hitting the SuperSU icon during Kingroot process. It, the SuperSU app has the ability to be activated. Now, when trying to install it's SU binary. It fails. Is this due to the system not having full R-W-E?
Separate idea. So, Root is temp partly because the RAM gets wiped at boot? That is easy to understand. Would there be a temporary way to energize that location before reboot to keep the Root state? I say this because some apps like Xposed need a reboot to work properly. Now whIle being energized could it be possible to back read the binaries that are trying to write to it from the bootloader as it gives off its authentication key or keys? I know absolutely nothing in regards to this stuff. I am guessing and thinking with pseudo logic. So, please don't think me an idiot. One last thing. I want to learn this stuff. I learn best by doing and experimenting. Could you in form me of the tools that you and other devices are using to try and achieve this? I want to dive head first into this stuff. And no, I don't care if I damage my phone. I will just purchase another one when needed. If need be. I hope in some small way I may have helped out. Last thing, would you know where to get a schematic of the board layout and possibly the pinout of components? Ok, I'm done now. By the way, I am not on the AT&T Note 4. I am a Verizon customer. Wish I was not. But, it is almost unfathomable to give up much unlimited data lines. So, I'm stuck with Evilrizon until they rip this away from me.
Click to expand...
Click to collapse

Jaytronics said:
1. Kingroot obtains Root. Be it temporary but Root non the less. Now, from my understanding, the device are trying to install the su binary while booted? Now, I know that and this may not matter. But after Kingroot has done its thing, SuperSU can not be utilized. But, what I have found is, that if hitting the SuperSU icon during Kingroot process. It, the SuperSU app has the ability to be activated. Now, when trying to install it's SU binary. It fails. Is this due to the system not having full R-W-E?
2. Separate idea. So, Root is temp partly because the RAM gets wiped at boot? That is easy to understand. Would there be a temporary way to energize that location before reboot to keep the Root state? I say this because some apps like Xposed need a reboot to work properly. Now whIle being energized could it be possible to back read the binaries that are trying to write to it from the bootloader as it gives off its authentication key or keys? I know absolutely nothing in regards to this stuff. I am guessing and thinking with pseudo logic. So, please don't think me an idiot. One last thing
3. I want to learn this stuff. I learn best by doing and experimenting. Could you in form me of the tools that you and other devices are using to try and achieve this? I want to dive head first into this stuff. And no, I don't care if I damage my phone. I will just purchase another one when needed. If need be. I hope in some small way I may have helped out. Last thing, would you know where to get a schematic of the board layout and possibly the pinout of components? Ok, I'm done now. By the way, I am not on the AT&T Note 4. I am a Verizon customer. Wish I was not. But, it is almost unfathomable to give up much unlimited data lines. So, I'm stuck with Evilrizon until they rip this away from me..
Click to expand...
Click to collapse
1. I've not used King Root yet as I'm on Lollipop so I can't comment on that issue, maybe someone else can add their experience.
2. From what I've been reading the system reverts back to the original state, which leads me to wonder if there is a backup of the system/partition elsewhere that is uses to compare or uses if there's any modification done to it? Xposed needs a reboot because it initializes in boot up.
3. Learn ADB in and out. One of the best Tools you could use. Give up on the unlimited data, it's overrated :good:

ZPaul2Fresh8 said:
2. From what I've been reading the system reverts back to the original state, which leads me to wonder if there is a backup of the system/partition elsewhere that is uses to compare or uses if there's any modification done to it? Xposed needs a reboot because it initializes in boot up.
Click to expand...
Click to collapse
From what I understand we never get to touch the actual file system of the system. This explains the bootup process of Android http://www.androidenea.com/2009/06/android-boot-process-from-power-on.html So upon bootup it copies the system data into RAM. Some how there must be a way to edit this and force the memory to write to the actual partition like how an update would have to do. This is why I was curious about my editing the /efs and making the changes stick by changing the file permissions.

ZPaul2Fresh8 said:
1. I've not used King Root yet as I'm on Lollipop so I can't comment on that issue, maybe someone else can add their experience.
2. From what I've been reading the system reverts back to the original state, which leads me to wonder if there is a backup of the system/partition elsewhere that is uses to compare or uses if there's any modification done to it? Xposed needs a reboot because it initializes in boot up.
3. Learn ADB in and out. One of the best Tools you could use. Give up on the unlimited data, it's overrated :good:
Click to expand...
Click to collapse
in answer to #2, there is two possible explainations for this:
1. those reporting that the system reverts are actually see the "Updated" apks in the /data/app not the actual apks they deleted from /system/app or /system/priv-app. (I'm also on 5.0 so cant test this theory)
2. Samsung is using an initramfs or modified version of it, this would explain the complete revert to stock and possibly even the loss of root as the /system partition is "loaded" into ram and that is where all modifications are being written to including root so once the device reboots ram is cleared and reloaded from the mmcblk0xx firmware partition. (there have been conflicting reports of actual system files reverting).

Are there any Devs that are good at reading and writing binary? I'm thinking that if someone was to make a mock OTA update file and attempt to load it and could read the processors I/O, then it would be possible to find the signature keys. Also, use the current OTA as it allows the OS to move back to KK. I wonder how fast I could learn ADB and binary. Lol!
Sent from my SM-N900V

Jaytronics said:
Are there any Devs that are good at reading and writing binary? I'm thinking that if someone was to make a mock OTA update file and attempt to load it and could read the processors I/O, then it would be possible to find the signature keys. Also, use the current OTA as it allows the OS to move back to KK. I wonder how fast I could learn ADB and binary. Lol!
Sent from my SM-N900V
Click to expand...
Click to collapse
I can guarentee you 100% you won't get they keys there is a reason the bootloader has not been crackdx since the note 2 these are not something that can be so easily obtained
Sent From The EDGE

Question. I am still on lolipop so i haven't tried but seeing as android is basically linux. When we obtain root even though its temp can we or has anyone tried mounting all the partitions in /dev to other location to see whats what and whats editable? I would think as root you could just mount and edit the system partition. Assuming you can find which partition is actually the system part.
Sent from my SAMSUNG-SM-N910A using XDA Free mobile app

cstayton said:
in answer to #2, there is two possible explainations for this:
1. those reporting that the system reverts are actually see the "Updated" apks in the /data/app not the actual apks they deleted from /system/app or /system/priv-app. (I'm also on 5.0 so cant test this theory)
2. Samsung is using an initramfs or modified version of it, this would explain the complete revert to stock and possibly even the loss of root as the /system partition is "loaded" into ram and that is where all modifications are being written to including root so once the device reboots ram is cleared and reloaded from the mmcblk0xx firmware partition. (there have been conflicting reports of actual system files reverting).
Click to expand...
Click to collapse
I don't believe I am just seeing the "Updated" apks, such as Evernote. I can do anything I want, but upon reboot that bloat is back. Any idea how the /efs partition isn't restored if you change file permissions to 0644?

delete this if it does help with anything but i was listening to an podcast and they were talking about root and they used an camera app to help install su apk like i said just remember hearing something about it
keep up the good work guys!

CJ74753 said:
I don't believe I am just seeing the "Updated" apks, such as Evernote. I can do anything I want, but upon reboot that bloat is back. Any idea how the /efs partition isn't restored if you change file permissions to 0644?
Click to expand...
Click to collapse
my guess (just speculation at this point) is that the only partition that is :Handled" by the initramfs methods (if that truly is the case) is the system partition (I believe it is mmcblkp026 not sure tho) this would likely make sense due to the fact that if the /EFS partition was also hadled then making changes thru "Secret codes" would also be replaced on reboot meaning that if you borked your IMIE all it would take to fix it is a reboot and from experience we know this is not the case.

Jaytronics said:
Are there any Devs that are good at reading and writing binary? I'm thinking that if someone was to make a mock OTA update file and attempt to load it and could read the processors I/O, then it would be possible to find the signature keys. Also, use the current OTA as it allows the OS to move back to KK. I wonder how fast I could learn ADB and binary. Lol!
Sent from my SM-N900V
Click to expand...
Click to collapse
Your theory is sound and does (to some extent bare a little further research):
Now to explain what i mean by further research: I have been developing ROMS since the early days of Windows mobile (long before android or iPhones) the original process of packaging and pushing a "ROM" to the mobile device involved several binary edits as you had to move your custom ROM into the exact location within the install package, part of the other issue is that your ROM had to be the EXACT same number of bytes as the OEM thus preventing you from adding to stock unless you removed the exact same number of bytes from your build.
Now as far as the theory being sound here is my explanation for that:
IF (and it's a big IF) we were to compare for instance the BL from a Tmobile note4 to that of ours and determine exactly (and I mean EXACTLY) where the binary portion was that contained the "Keys" and that portion was EXACTLY the same byte size then "In Theory" we could insert the "Keys" from our BL into the Tmobile BL and flash it on our device which since the keys would be correct would not balk at doing so.
Now for the explanation as to why this wont work:
In order to insert our keys into the Tmo BL they litteraly would have to be byte for byte identical or every single byte in the entire BL would be offset and this would in turn cause the flash to fail. And in the event it didn't fail the BL memory space would be offset by the exact same number of bytes and would likely brick your device.

cstayton said:
my guess (just speculation at this point) is that the only partition that is :Handled" by the initramfs methods (if that truly is the case) is the system partition (I believe it is mmcblkp026 not sure tho) this would likely make sense due to the fact that if the /EFS partition was also hadled then making changes thru "Secret codes" would also be replaced on reboot meaning that if you borked your IMIE all it would take to fix it is a reboot and from experience we know this is not the case.
Click to expand...
Click to collapse
The strange thing is if you edit /efs/FactoryApp with permission 0775,which is default, pressing the power button causes the phone to completely shut off, no power menu is shown. Changing it to 0644 yields a working power menu, but selecting any of the files to edit shows each file is blank. But I don't understand the fs enough to know a lot so I was just throwing that piece of information out there.

CJ74753 said:
I don't believe I am just seeing the "Updated" apks, such as Evernote. I can do anything I want, but upon reboot that bloat is back. Any idea how the /efs partition isn't restored if you change file permissions to 0644?
Click to expand...
Click to collapse
cstayton said:
in answer to #2, there is two possible explainations for this:
1. those reporting that the system reverts are actually see the "Updated" apks in the /data/app not the actual apks they deleted from /system/app or /system/priv-app. (I'm also on 5.0 so cant test this theory)
2. Samsung is using an initramfs or modified version of it, this would explain the complete revert to stock and possibly even the loss of root as the /system partition is "loaded" into ram and that is where all modifications are being written to including root so once the device reboots ram is cleared and reloaded from the mmcblk0xx firmware partition. (there have been conflicting reports of actual system files reverting).
Click to expand...
Click to collapse
I'm on 4.4.4
I froze all the bloat after the very first boot. Later, after successfully running kingroot, i used root explorer to go in and delete the apks and their associated odex files - both in system/app and system/priv-app. After a reboot, it was all there again.
Running Adaway to put a new hosts file in system/etc also restored the original hosts file after reboot. I was hoping files in system/etc would be more modifiable, but apparently not as Dr. Ketans sound mod apks that modify mixer_paths.xml also reverts.
The only thing that has worked for me is Dr. Ketan's sdcard fix, that allows to write to sdcard in kitkat. That is the only item that has stuck for me of the things I have tried.

jeepers007 said:
I'm on 4.4.4
I froze all the bloat after the very first boot. Later, after successfully running kingroot, i used root explorer to go in and delete the apks and their associated odex files - both in system/app and system/priv-app. After a reboot, it was all there again.
Running Adaway to put a new hosts file in system/etc also restored the original hosts file after reboot. I was hoping files in system/etc would be more modifiable, but apparently not as Dr. Ketans sound mod apks that modify mixer_paths.xml also reverts.
The only thing that has worked for me is Dr. Ketan's sdcard fix, that allows to write to sdcard in kitkat. That is the only item that has stuck for me of the things I have tried.
Click to expand...
Click to collapse
this would definetly point to the initramfs scenario meaning in order for root to "Stick" we would need modifications to kingsroot or whatever perm root method is used to write directly to the mmcblkxx partition rather than the /system folder (which is nothing more than volatile RAM space.)

Same case for me, any changes made were reverted on reboot. I used King to temp root, removed all traces of knox, then actually attempted to convert and install SuperSu but it would not install. Just said that the install failed and to try again.

[Q] Root available for ASUS MeMO Pad 10 (ME103K)?

Greetings!
First of all, I am sorry if this is on the wrong section of the forum. Nevertheless i've tried few rooting applications which are stated to be compatible with this ME103K model, but with no results.. Also many fake sites trying to lure you to purchase something.
Is there anyone who could provide me information on how to root my ASUS ME103K tablet? Should I also try every rooting application available out there or is this useless? Can I verify if they are compatible without all the way installing and running them on the device? (Sorry don't know much about this stuff =)! )
Thank you very much in advance

I rooted ME103K on my own - by compiling a custom kernel
Executive summary: Go to youtube and watch video with ID "gqubgQjqfHw" (I can't post links yet, sorry! ) - or search Youtube for "Rooting MemoPAD10 (ME103K) with my custom compiled kernel"
Analysis:
I hated the fact that my recently purchased MemoPAD10 (ME103K) tablet had no open process to allow me to become root. I don't trust the closed-source one-click root apps that use various exploits, and require communicating with servers in.... China. Why would they need to do that? I wonder...
I therefore decided this was a good opportunity for me to study the relevant documentation and follow the steps necessary to build an Android kernel for my tablet. I then packaged my custom-compiled kernel into my custom boot image, and the video shows how I boot from it and become root in the process.
Note that I didn't burn anything in my tablet - it's a 'tethered' root, it has no side-effects.
If you are a developer, you can read in detail about the steps I had to take to modify the kernel (and su.c) and become root - by reading the questions (and answers!) that I posted in the Android StackExchange forum ( can't post links yet, see the video description in Youtube ).
If you are not a developer, you can download my custom boot image from the link below - but note that this means you are trusting me to not do evil things to your tablet as my kernel boots and my /sbin/su is run
Honestly, I haven't done anything weird - I just wanted to run a debootstrapped Debian in my tablet, and succeeded in doing so. But I am also worried about the cavalier attitude I see on the web about rooting your devices - if you want to be truly safe, you must either do what I did (and recompile the kernel yourself) or absolutely trust the person that gives it to you. I do wish Google had forced a UI-accessible "become root" option in Android, just as Cyanogen does (sigh).
The image I created and used in the video to boot in rooted mode, is available from the link show in the Youtube video details.
Enjoy!

ttsiodras said:
Executive summary: Go to youtube and watch video with ID "gqubgQjqfHw" (I can't post links yet, sorry! ) - or search Youtube for "Rooting MemoPAD10 (ME103K) with my custom compiled kernel"
Analysis:
I hated the fact that my recently purchased MemoPAD10 (ME103K) tablet had no open process to allow me to become root. I don't trust the closed-source one-click root apps that use various exploits, and require communicating with servers in.... China. Why would they need to do that? I wonder...
I therefore decided this was a good opportunity for me to study the relevant documentation and follow the steps necessary to build an Android kernel for my tablet. I then packaged my custom-compiled kernel into my custom boot image, and the video shows how I boot from it and become root in the process.
Note that I didn't burn anything in my tablet - it's a 'tethered' root, it has no side-effects.
If you are a developer, you can read in detail about the steps I had to take to modify the kernel (and su.c) and become root - by reading the questions (and answers!) that I posted in the Android StackExchange forum ( can't post links yet, see the video description in Youtube ).
If you are not a developer, you can download my custom boot image from the link below - but note that this means you are trusting me to not do evil things to your tablet as my kernel boots and my /sbin/su is run
Honestly, I haven't done anything - I just wanted to run a deboot-strapped Debian in my tablet. But I am also worried about the cavalier attitude I see on the web about rooting your devices - if you want to be truly safe, you must either do what I did (and recompile the kernel yourself) or absolutely trust the person that gives it to you. I do wish Google had forced a UI-accessible "become root" option in Android, just as Cyanogen does (sigh).
The image I created and used in the video to boot in rooted mode, is available from the link show in the Youtube video details.
Enjoy!
Click to expand...
Click to collapse
Hello ttsiodras,
I had the same problem as OP and didn't want to go the "chinese route" either, especially since there seem to be conflicting reports on whether it works on the ME103k or not so I tried your solution - with mixed results...
Disclaimer: I'm totally new to Android (colour me unpleasantly surprised) and have little experience in Linux, so for further reference I would consider myself an advanced noob. Please keep this in mind when evaluating my claims or judging what I have done so far or am capable of doing by myself in the future.
What I did:
- become developer in the ME103k by tapping the system build repeatedly, then allowing debugging via USB
- use ADB to boot into the bootloader
- use fastboot to boot your boot.rooted.img
What happened:
- I did get root access
- the tab now always boots into the bootloader, even when told via ADB or fastboot to boot normally or into recovery. Pushing buttons etc doesn't seem to work either
- my attempts to do a recovery via the vanilla Asus method has failed due to the same fact that boot never gets past fastboot
Since you claimed in your description that there would be no side-effects since it is a tethered root I am somewhat puzzled as to what exactly happened. From what I understand - which admittedly isn't a lot - what should have happened is that your boot image is loaded, giving me root access until the next reboot without changing anything about the default boot process or image. I read somewhere else that this is how people test out different kernels with fastboot before deciding on which one they want to use on their devices. The whole boot process being changed and corrupted in a way that makes the tablet non-rebootable without having the cable and an adb- and fastboot-capable machine nearby is not really what I would have expected going by your description.
Of course it is entirely possible (and probably even rather likely) that I got something wrong along the way or there is a simple fix to my problem I am not aware of.
As for possible steps maybe you or someone else in the forum could point me to a way to return my tablet to factory settings before risking damaging it beyond repair. I'm assuming that it should be possible and rather straightforward to recover the original setup with the firmware provided by Asus (downloaded the newest version from the homepage) but to be honest I'm a bit scared to go ahead with it before knowing for sure how to do this safely.
One thing seems certain: I won't be able to do it the way Asus says I should unless I can somehow get into normal or recovery boot modes again. I do however still have root access and am able to run fastboot and ADB including shell on the tablet, so it should be possible.
I would certainly appreciate any help very much
Thanks

drsiegberterne said:
. . . From what I understand - which admittedly isn't a lot - what should have happened is that your boot image is loaded, giving me root access until the next reboot without changing anything about the default boot process or image. I read somewhere else that this is how people test out different kernels with fastboot before deciding on which one they want to use on their devices.
Click to expand...
Click to collapse
Your understanding is correct - that's exactly what should have happened.
I can assure you that the kernel I compiled is formed from the Asus sources with the 2 patches I made that have *nothing* to do with the bootloader - they patch the way that the kernel allows dropping privileges and thus allowing root level access.
Something else must have happened - did you by any chance "burn" the image? i.e. `(DONT DO THIS) fastboot flash boot boot.rooted.img` instead of `fastboot boot boot.rooted.img`?
I did not advocate for burning precisely because it is unpredictable - manufactures sometimes require signing images with their private keys before allowing a boot image to boot (AKA "locked bootloaders") which means that any attempt to burn may lead to weird configurations. . .
If you did burn it, maybe you can try burning the original "boot.img" from the Asus OTA (Over the Air) update .zip file (avaible as a big download at the ASUS site - "UL-K01E-WW-12.16.1.12-user.zip" )
I know of no way to help you with the current state of your tablet, except to "ease the pain" by saying that rebooting to fastboot is always "recoverable" - you can always boot into my own (rooted) kernel or the original (from the ASUS .zip file) with `fastboot boot <whatever_image>`. No "harm" can happen from this - as you correctly said, it's the way to try new kernels and images.
UPDATE - after more reverse engineering:
I had a look into the contents of the boot loader running inside the ME103K, and I am pretty sure that if you execute this at fastboot...
# fastboot oem reset-dev_info
# fastboot reboot
... you will get back to normal, un-tethered bootings of your ME103K.
Thanassis.

ttsiodras said:
Your understanding is correct - that's exactly what should have happened.
I can assure you that the kernel I compiled is formed from the Asus sources with the 2 patches I made that have *nothing* to do with the bootloader - they patch the way that the kernel allows dropping privileges and thus allowing root level access.
Something else must have happened - did you by any chance "burn" the image? i.e. `(DONT DO THIS) fastboot flash boot boot.rooted.img` instead of `fastboot boot boot.rooted.img`?
I did not advocate for burning precisely because it is unpredictable - manufactures sometimes require signing images with their private keys before allowing a boot image to boot (AKA "locked bootloaders") which means that any attempt to burn may lead to weird configurations. . .
If you did burn it, maybe you can try burning the original "boot.img" from the Asus OTA (Over the Air) update .zip file (avaible as a big download at the ASUS site - "UL-K01E-WW-12.16.1.12-user.zip" )
I know of no way to help you with the current state of your tablet, except to "ease the pain" by saying that rebooting to fastboot is always "recoverable" - you can always boot into my own (rooted) kernel or the original (from the ASUS .zip file) with `fastboot boot <whatever_image>`. No "harm" can happen from this - as you correctly said, it's the way to try new kernels and images.
Thanassis.
Click to expand...
Click to collapse
Hi Thanassis,
thanks for your quick reply and your efforts. I'm actually around 85% sure I did not flash the image but since I had no Linux on my computer at the time (I know shame on me) I used a Mac and the command line was a bit different. Since I had never used ADB or fastboot I relied on some guide that explained how to even get into the bootloader and might have gotten something wrong.
On the other hand I later read out the commands I used in the Mac shell and couldn't find anything other than the things I should have done and described earlier, so as far as I can tell this all should never have happened. It may be interesting to point out here that the "stuck in fastboot" mode happened immediately after the first time I loaded your kernel and I most definitely just wrote fastboot boot boot.rooted.img at that point.
As for fixing the problem now it's not only about the inconvenience of the whole thing. I also later (after I was already stuck in fastboot mode) installed some apps for helping me manage privileges of different apps (xposed framework and xprivacy) which turned out to not be compatible in some way or another. So now not only is my tablet not booteable in a normal way but its also cluttered with even more useless stuff than before and I would really like to just reset it before thinking about any other possibilities.
If I flash boot the original ASUS boot image found in the file you described and which i dowloaded already, shouldn't that fix the problem if I accidentally did flash your boot image? Or will there be even more trouble?
Alternatively isn't there a manual way to flash the whole zipped recovery image or am I misunderstanding what this ASUS file actually contains?
And which of the two options is safer to try first or in other words - which one might break the tablet once and for all?
Thanks again and sorry for my incompetence

drsiegberterne said:
Hi Thanassis,
If I flash boot the original ASUS boot image found in the file you described and which i dowloaded already, shouldn't that fix the problem if I accidentally did flash your boot image? Or will there be even more trouble?
. . .
Alternatively isn't there a manual way to flash the whole zipped recovery image or am I misunderstanding what this ASUS file actually contains?
. . .
Thanks again and sorry for my incompetence
Click to expand...
Click to collapse
No, don't be sorry We are all either choosing to learn in this world (i.e. make mistakes and learn from them), or choose to remain stuck in ignorance. I applaud your efforts in properly rooting the tablet. . .
To the point - remember, you are root now ; whatever apps you installed, you can definitely uninstall them. You don't necessarily need to wipe it.
If you do want to, I'd suggest booting in recovery and doing it the normal way that Asus recommends. Since you said "buttons don't work", you may want to try using the original recovery .img - i.e. "fastboot boot recovery.img". I'd love to suggest a link from ASUS, but they don't host it (which is bad - they really should) - so instead go to "goo" dot "gl" slash "noegkY" - this will point you to a discussion where a kind soul is sharing his ME103K recovery.img.
Booting from the recovery will allow you to install the ASUS OTA update - and probably try cleaning cache partition, etc
Good luck!

ttsiodras said:
No, don't be sorry We are all either choosing to learn in this world (i.e. make mistakes and learn from them), or choose to remain stuck in ignorance. I applaud your efforts in properly rooting the tablet. . .
To the point - remember, you are root now ; whatever apps you installed, you can definitely uninstall them. You don't necessarily need to wipe it.
If you do want to, I'd suggest booting in recovery and doing it the normal way that Asus recommends. Since you said "buttons don't work", you may want to try using the original recovery .img - i.e. "fastboot boot recovery.img". I'd love to suggest a link from ASUS, but they don't host it (which is bad - they really should) - so instead go to "goo" dot "gl" slash "noegkY" - this will point you to a discussion where a kind soul is sharing his ME103K recovery.img.
Booting from the recovery will allow you to install the ASUS OTA update - and probably try cleaning cache partition, etc
Good luck!
Click to expand...
Click to collapse
The problem here is that he doesn't seem to have the same version as on my tablet. I have the newest version with Lollipop while this seems to be at least a couple of patches earlier with a completely different version of Android. Won't I risk breaking things even more if I try to apply this - as in trying to recover a recovery that is not on my tablet since certainly the recovery.img doesn't contain all the information needed since it's only 10 MB.
As you can probably guess the whole discussion in your link about what part of the system is broken and how to fix it goes right over my head. It also seems like they did not find a satisfactory solution in the end (short of sending the tablet to ASUS). As you can imagine I'm at quite a loss what to try and what not out of fear to make things worse. At least for now I can still use the tablet to do the things I need it to do.
Thanks for your help anyway, I will try to read up more on the topic and decide what to do next.

drsiegberterne said:
The problem here is that he doesn't seem to have the same version as on my tablet. I have the newest version with Lollipop while this seems to be at least a couple of patches earlier with a completely different version of Android. Won't I risk breaking things even more if I try to apply this - as in trying to recover a recovery that is not on my tablet since certainly the recovery.img doesn't contain all the information needed since it's only 10 MB.
Thanks for your help anyway, I will try to read up more on the topic and decide what to do next.
Click to expand...
Click to collapse
I understand how you feel - your tablet is operational now (OK, with the annoyance that you need to boot it in "tethered mode") - so you rightfully fear that you may mess things up with further steps.
Just to clarify something - the recovery img is something that works on its own ; it has no dependency on what kind of Android image is installed in the /system partition.
If you do decide to do it, "fastboot boot recovery.img" will bring you to a spartan menu, showing options that allow you to apply an update (i.e. the ASUS update you downloaded!), clean the /cache partition, etc.
Choose "install update from SD card" (use volume up/down to choose, power btn to select), and navigate to your SD card, where you will have placed the big .zip file from ASUS.
The recovery process will begin, and your tablet will be "wiped" with the image from ASUS. Reboot, and be patient while the tablet boots up - it will be just like the first time you started it (i.e. install from scratch).
Whatever you decide - good luck!

ttsiodras said:
I understand how you feel - your tablet is operational now (OK, with the annoyance that you need to boot it in "tethered mode") - so you rightfully fear that you may mess things up with further steps.
Just to clarify something - the recovery img is something that works on its own ; it has no dependency on what kind of Android image is installed in the /system partition.
If you do decide to do it, "fastboot boot recovery.img" will bring you to a spartan menu, showing options that allow you to apply an update (i.e. the ASUS update you downloaded!), clean the /cache partition, etc.
Choose "install update from SD card" (use volume up/down to choose, power btn to select), and navigate to your SD card, where you will have placed the big .zip file from ASUS.
The recovery process will begin, and your tablet will be "wiped" with the image from ASUS. Reboot, and be patient while the tablet boots up - it will be just like the first time you started it (i.e. install from scratch).
Whatever you decide - good luck!
Click to expand...
Click to collapse
Okay, a little update from the battlefront:
I tried the recovery image and did get into the menu, however the recovery failed with the same two error messages as in your earlier link ("footer is wrong" and "signature verification failed"). My output from fastboot getvar all is also very similar to the one from that guy except I have a different bootloader version than him (3.03).
Another thing I noticed is that if I boot the standard boot.img found in the ASUS zip it will recognize the internal sdcard normally, however when I boot your rooted image the internal memory doesn't seem to be recognized, at least not through the pre-installed file manager. Downloading a file to the internal storage also failed while rooted but all the apps and the OS itself so far seem totally unaffected otherwise.
My last resort at the moment is the fastboot flash boot boot.img but I have little hope it would change anything since in the thread you linked they proposed just that and if it had worked they probably would have mentioned it.
Can it theoretically break the tablet even more? I would hate to have to send it in because I completely bricked it...

drsiegberterne said:
Okay, a little update from the battlefront:
Another thing I noticed is that if I boot the standard boot.img found in the ASUS zip it will recognize the internal sdcard normally, however when I boot your rooted image the internal memory doesn't seem to be recognized.
Click to expand...
Click to collapse
Not the case for me - everything works fine (including internal and external sdcard), so it's definitely not my kernel causing this.
drsiegberterne said:
My last resort at the moment is the fastboot flash boot boot.img but I have little hope it would change anything since in the thread you linked they proposed just that and if it had worked they probably would have mentioned it.
Can it theoretically break the tablet even more? I would hate to have to send it in because I completely bricked it...
Click to expand...
Click to collapse
Flashing is always dangerous (from what you've said, I actually theorize that you did, actually, flash already...)
I doubt this will solve the boot issue, to be honest - if I were you, I'd continue to boot tethered (with my image when you need root access, and (maybe) the Asus image when you don't). Myself, I always boot my own bootimage, since I have zero problems with it, and it allows me to run a complete Debian distro in a chroot (thus making my tablet a full-blown UNIX server - e.g. I run privoxy on it to filter all stupid ads in all apps on the tablet, etc).
No matter what you decide, good luck!
Thanassis.

ttsiodras said:
Not the case for me - everything works fine (including internal and external sdcard), so it's definitely not my kernel causing this.
Flashing is always dangerous (from what you've said, I actually theorize that you did, actually, flash already...)
I doubt this will solve the boot issue, to be honest - if I were you, I'd continue to boot tethered (with my image when I need root access, and (maybe) the Asus image when I don't). Myself, I always boot my own bootimage, since I have zero problems with it, and it allows me to run a complete Debian distro in a chroot (thus making my tablet a full-blown UNIX server - e.g. I run privoxy on it to filter all stupid ads in all apps on the tablet, etc).
No matter what you decide, good luck!
Thanassis.
Click to expand...
Click to collapse
I already tried to flash the original boot.img yesterday but it didn't change anything as you correctly assumed so I guess for now there is nothing more to do. I might write to the Asus support and maybe send the tablet in if it is free of charge for me (which I doubt). The only other option is to spend the next months to get sufficiently versed in Android to actually fix the problems myself but even for that I would probably need some files or source code from Asus. I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to.
Getting these Android devices like buying a hammer that can't hammer things in on Sundays.

drsiegberterne said:
I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to
Click to expand...
Click to collapse
I share the sentiment - it's really sad.

Undoing the tethered root
drsiegberterne said:
I already tried to flash the original boot.img yesterday but it didn't change anything as you correctly assumed so I guess for now there is nothing more to do. I might write to the Asus support and maybe send the tablet in if it is free of charge for me (which I doubt). The only other option is to spend the next months to get sufficiently versed in Android to actually fix the problems myself but even for that I would probably need some files or source code from Asus. I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to.
Getting these Android devices like buying a hammer that can't hammer things in on Sundays.
Click to expand...
Click to collapse
Hi drsiegberterne - I had a look into the contents of the boot loader running inside the ME103K, and I am pretty sure that if you execute this at fastboot...
# fastboot oem reset-dev_info
# fastboot reboot
... you will get back to normal, un-tethered bootings of your ME103K.
Hope this solves your problem!
Kind regards,
Thanassis.

2016 version (new fingerprint scanner, combined sim/sd)

Hey guys,
It seems more and more people are receiving the new version of the P8000:
- Stock Android 6
- New fingerprint scanner that is moved slightly higher and is able to unlock phone from screen-off (I confirm this is working)
- Sim 2 is combined with the micro-sd (I haven't tried whether you can have them both in at the same time)
- Somethings new about the display, since people are reporting errors with it after flashing older roms.
Warning: do NOT flash other roms. We have no way to unbrick the soft bricks yet!
---
Other topics that refer to this version:
http://forum.xda-developers.com/elephone-p8000/general/rom-p8000-t3431571
http://forum.xda-developers.com/elephone-p8000/help/stock-rom-p8000b-t3434477
http://forum.xda-developers.com/elephone-p8000/general/p8000-version-announced-t3346848
---
For development:
- The phone does not come pre-rooted. We have no way to flash custom recovery yet. Any tips for getting root? I've tried such tools as Kingo and vRoot, they don't work.
- We need the blocks file (scatter file) for SP Flash Tools. MTKDroidTools reports "unknown rom structure". Any help? Would love to start working on this.
Looking forward to hearing from others who have this version/who can help me with these questions.
Thanks!
Emile

Nice! Can you provide a dump from /system and /boot maybe?

BlueFlame4 said:
Nice! Can you provide a dump from /system and /boot maybe?
Click to expand...
Click to collapse
I would, if I knew how to. Any pointers?

Emileh said:
I would, if I knew how to. Any pointers?
Click to expand...
Click to collapse
Sure thing. On a rooted device, go into adb shell.
Then use "mount" command to check which partitions are mounted. One should be "/dev/block/platform/mtk-msdc.0/by-name/system" or similar. Use "dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/storage/emulated/0/system.img bs=1M" to dump the system to the internal sdcard to the file "system.img". If adb complains that bs=1M is an invalid option, try again without that one. A system dump can take some time where you will not get any feedback, so be patient there
Do the same for boot. So "/dev/block/platform/mtk-msdc.0/by-name/boot" should be the way to go for the path. I cannot tell the definite pathes on Android 6.0 but I am rather sure they are more or less like this.
If you run into troubles, just ask

BlueFlame4 said:
Sure thing. On a rooted device, go into adb shell.
Then use "mount" command to check which partitions are mounted. One should be "/dev/block/platform/mtk-msdc.0/by-name/system" or similar. Use "dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/storage/emulated/0/system.img bs=1M" to dump the system to the internal sdcard to the file "system.img". If adb complains that bs=1M is an invalid option, try again without that one. A system dump can take some time where you will not get any feedback, so be patient there
Do the same for boot. So "/dev/block/platform/mtk-msdc.0/by-name/boot" should be the way to go for the path. I cannot tell the definite pathes on Android 6.0 but I am rather sure they are more or less like this.
If you run into troubles, just ask
Click to expand...
Click to collapse
Thank you for your great instructions! The problem is that we've yet to achieve root on this device. We don't have a custom recovery for this version of the P8000 yet and other 'standard' methods of rooting don't work for me.
(I'm pretty solid in shell, so I'll do this afterwards, but I guess root is actually the first step).
// Edit to say: it does not come pre-rooted

Since the elephone support on facebook didn't realize there are two different versions of the P8000 available, I still need a ROM to unbrick my phone.

flo1k said:
Since the elephone support on facebook didn't realize there are two different versions of the P8000 available, I still need a ROM to unbrick my phone.
Click to expand...
Click to collapse
Ok, we know that, but doesn't really help us
Can you write them an e-mail?

I will do
Edit: OK, see if there will be an answer.

Thank you flo1k!

I have e-mailed as well, and would like to post on the Elephone forum, but don't seem to have access (because of minimum post count, I guess)
Anyone willing to ask for a ROM for the new P8000 on the forum there?

ROM Dump
@BlueFlame4
I can provide ROM dump in two versions:
1) a dump from adress 0000 0000 to 9d80 0000 (apr. 2.5 GB in one file)
2) a readback generated with the scatter.txt of the 'old' 5.1 stock ROM (apr. 2.8 GB seperated in 23 files)

FrauHofrat said:
@BlueFlame4
I can provide ROM dump in two versions:
1) a dump from adress 0000 0000 to 9d80 0000 (apr. 2.5 GB in one file)
2) a readback generated with the scatter.txt of the 'old' 5.1 stock ROM (apr. 2.8 GB seperated in 23 files)
Click to expand...
Click to collapse
The second choice looks promising

Maybe a stupid question
where shall I upload the files - any preferred webspace?
I'm uploading the files - because they contain my NVRAM I send the link as PM as soon as the upload is finished

FrauHofrat said:
Maybe a stupid question
where shall I upload the files - any preferred webspace?
I'm uploading the files - because they contain my NVRAM I send the link as PM as soon as the upload is finished
Click to expand...
Click to collapse
Are you sure we're talking about the same version of the P8000? Cause as far as I know there isn't 5.1 available for this version... Right?
Just checking thank you for your help in any case!! Really looking forward to it.
// edit: ah, you just used the old scatter file. But does that one work for this version?

Emileh said:
Are you sure we're talking about the same version of the P8000? Cause as far as I know there isn't 5.1 available for this version... Right?
Click to expand...
Click to collapse
No, there is only one Firmware available - the mysterious P8000_6.0_20160516.
Btw, this Phone contains a new mainboard model "K06TS-L-V2.0.3" - the 'old' mainboard is moder "K05T...."
// edit: ah, you just used the old scatter file. But does that one work for this version?
Click to expand...
Click to collapse
No, it doesn't work resp. the phone boots with this firmware, but the LCD-driver is the wrong one - the display only shows coloured lines and blurry spots. And there are probabely some more bugs ....

FrauHofrat said:
No, there is only one Firmware available - the mysterious P8000_6.0_20160516.
Btw, this Phone contains a new mainboard model "K06TS-L-V2.0.3" - the 'old' mainboard is moder "K05T...."
No, it doesn't work resp. the phone boots with this firmware, but the LCD-driver is the wrong one - the display only shows coloured lines and blurry spots. And there are probabely some more bugs ....
Click to expand...
Click to collapse
But if the phone boots with the firmware, doesnt that mean that the scatter file of the regular P8000 works? Since it flashes the firmware correctly.

The problem is that I was not able to flash the 'readback files' to the faulty phone.
When selecting 'Only Download' at SP-Flashtool I got the error "PMT... must be download"
When selecting 'Firmware Upgrade" I got some BROM error code
In both cases I used the same scatter,txt which I used to 'readback' the firmware from the working phone
Actually I have to correct my statement in post #15:
I flashed the faulty phone with the last 5.1 stock ROM (160711) - with this stock ROM the phone boots up but LCD (and probably more things) is not working.

I have actually gotten alot further
You have the use the scatter.txt from Android 6.0, which works perfectly fine. I have been able to extract boot.img, system.img and recovery.img that way (using Readback in SP Flash Tools)
Which ones do you need?
They probably flash fine (only thing I've flashed so far are custom recoveries, and although my ported PhilZ starts, I havent gotten it to mount anything.)
A little warning: don't use anything that has anything to do with Android 5.1. Those scatter files don't work

These are great news!
"Which ones do you need?"
Probably all of them

Ok this contains the scatter file, preloader, system.img, boot.img and stock recovery.img
https://ehaffmans.stackstorage.com/index.php/s/uKGKCir0BociydU
You need SP Flash Tools v5, select the scatter file first, then deselect everything, and only select these 4 and manually select the correct files.
Btw, the name of the preloader file is wrong, don't worry. It came from this phone
I am of course not responsible for anything!
Can you guys please confirm this doesn't contain anything personal? Like personal files or IMEI or something. Thanks!

Modifying OOS 5.0.3? Help!

As far as I understand, there are 2 ways to modify OOS 5.0.3:
1. Install the OS, then root, make changes on the phone itself, etc.
2. Unpack the OS zip file, make changes, repack, and install it.
I really want to make the second option work, and instead I'm pulling my hair out, confused, frustrated. I create a custom version of OOS, then use TWRP to 100% wipe the stock OOS, install mine, and when I reboot - it's still stock! WHAT. THE. FFFFFFFFFF
Okay, using sdat2img, img2simg, and img2sdat to unpack and repack system.new.dat works fine. In between unpacking and repacking, I'm making tons of changes, including:
Code:
REMOVE VENDOR APKs
-------------------
reserve/OPForum/
reserve/OPNote/
reserve/SoundRecorder/
reserve/Weather/
reserve/YuloreFramework/
Code:
REMOVE APPS from /app/
-------------------
app/Account app/BookmarkProvider app/CalendarGoogle app/Chrome app/CompanionDeviceManager app/DiracManager app/Drive app/Duo app/EasterEgg app/EngSpecialTest app/Gmail2 app/GoogleContactsSyncAdapter app/GoogleExtShared app/GooglePrintRecommendationService app/GoogleTTS app/LatinImeGoogle app/LogKitSdService app/Maps app/OemAutoTestServer app/OEMLogKit app/OPBackup app/OPBugReportLite app/OpenWnn app/OPSocialNetworkHub app/PartnerBookmarksProvider app/talkback app/WebViewGoogle app/YouTube
Code:
REMOVE APPS from /priv-app/
-------------------
app/DiracAudioControlService app/GmsCore app/GoogleBackupTransport app/GoogleExtServices app/GoogleFeedback app/GoogleOneTimeInitializer app/GooglePackageInstaller app/GooglePartnerSetup app/GoogleServicesFramework app/Phonesky app/Tag app/Velvet
I run my custom image through img2simg and img2sdat, I zip up my new system.new.dat, system.patch.dat, system.transfer.list along with the other standard files from the original zip (boot.img, firmware-update, META-INF, RADIO).
Then I use TWRP to format data, reboot into TWRP, advanced wipe everything. I even plain jane rebooted the phone to confirm there's absolutely nothing left but TWRP.
Then I install my custom OS, reboot, go through the new user setup, and - all the apps I removed are still there! Calendar, Chrome, Drive, Duo, Gmail, etc - and they all work. This makes no sense. What am I missing here? If deleting them in /app and /priv-app does nothing, where are the apps hiding?

This is going to sound really crazy, but rather than spend the time doing this why don't you just root and delete said apps? Its not like you aren't 2/3 of the way there or anything:cyclops:

I saw you start many threats about making oxygen os even more light without apps/gapps/services etc. I would like an oxygen ROM so clean like lineage, only the base. Good luck with this as I am fun of microg/googless stuff.
Sent from my ONEPLUS 5T

vagkoun83 said:
I saw you start many threats about making oxygen os even more light without apps/gapps/services etc. I would like an oxygen ROM so clean like lineage, only the base. Good luck with this as I am fun of microg/googless stuff.
Click to expand...
Click to collapse
I hope you mean threads
Yes, I plan to release my builds ... but first I need to figure out what's going wrong, and then I need to extensively test it on my 5T. If successful, it'll be available as a download. I already bought a domain. Fingers crossed.

Threads yes! What do you want to succeed?
Sent from my ONEPLUS 5T

vagkoun83 said:
Threads yes! What do you want to succeed?
Click to expand...
Click to collapse
Sorry, I don't understand the question. This is the problem I'm trying to solve:
ClinicalTrack said:
Then I install my custom OS, reboot, go through the new user setup, and - all the apps I removed are still there! Calendar, Chrome, Drive, Duo, Gmail, etc - and they all work. This makes no sense. What am I missing here? If deleting them in /app and /priv-app does nothing, where are the apps hiding?
Click to expand...
Click to collapse

ClinicalTrack said:
Sorry, I don't understand the question. This is the problem I'm trying to solve:
Click to expand...
Click to collapse
Yes I read the OP and I don't have the knowledge to help, but I ask you about the main reasons you want to do that. Its about battery, privacy or what?
Sent from my ONEPLUS 5T

Maybe if you're not used to modify ROM you should not release anything to public before you figure out what's happening.
Cause this situation is impossible with the steps you described.
Are you sure you're flashing the right thing ? Zipping the right system.new.dat ?
Also do not delete stuff without knowing what they do. DiracAudioControlService is a mandatory component if you're using stock audio OnePlus driver...

vagkoun83 said:
but I ask you about the main reasons you want to do that. Its about battery, privacy or what?
Click to expand...
Click to collapse
100% privacy/security.
funnoam said:
Maybe if you're not used to modify ROM you should not release anything to public before you figure out what's happening.
Cause this situation is impossible with the steps you described.
Are you sure you're flashing the right thing ? Zipping the right system.new.dat ?
Also do not delete stuff without knowing what they do. DiracAudioControlService is a mandatory component if you're using stock audio OnePlus driver...
Click to expand...
Click to collapse
See above where I mentioned "extensive testing".
"Maybe if you're not used to modify ROM you should not release"
Not helpful.
"Maybe if you're not used to modify ROM you should keep experimenting, keep learning, how can I help?"
Helpful. Android is brand new to me, I literally sold my iPhone 7 two weeks ago. There is so little documentation online concerning the Android filesystem, it's drowned out by millions of posts about themes. I don't have all the answers, that's why I'm here asking questions.

ClinicalTrack said:
Helpful. Android is brand new to me, I literally sold my iPhone 7 two weeks ago. There is so little documentation online concerning the Android filesystem, it's drowned out by millions of posts about themes. I don't have all the answers, that's why I'm here asking questions.
Click to expand...
Click to collapse
So I suggest you get familiar with the Android ecosystem/filesystem/experience before attempting to remove important system/data/framework pieces from your ROM.
You're removing every OnePlus app and every Google App from the ROM. What will happen ?
First, I'm pretty sure it won't boot or if it boot the experience will be so terrible with missing features.
Like I said, do not touch the Dirac framework, or if you do make sure you have some generic sound driver from Qualcomm included or it won't work. I'm not even sure about that last part as I'm not too familiar with the DSP chipset inside the 5T. But Dirac is mandatory.
Second, if you do not install any google framework replacement like microg you will have a very poor android experience. Most apps rely on this framework to run.
Third, you'll find out soon that many people on XDA have absolutely no idea of what they're doing when the installation guide is not totally explicit and can end with a total mess when trying to install unofficial rom/theme/app. In the future, do not release anything that can make device unbootable or broken. Android is very complex and while it might work on some phone, it can break some other due to multiple configurations on the same phone model.
Hope this was helpful, wish you all the luck. Don't hesitate to ask for technical stuff if I can help.

funnoam said:
Don't hesitate to ask for technical stuff if I can help.
Click to expand...
Click to collapse
Okay, do you know why in /firmware-update/NON-HLOS.bin, the 4G LTE modem firmware, there are files for alipay? And how can I unpack / more closely examine them?
Code:
alipay.b00
alipay.b01
alipay.b02
alipay.b03
alipay.b04
alipay.b05
alipay.b06
alipay.b07
alipay.mdt
Code:
ELF(44(4 ( 0xyxy????dd????????/88????????>??
UMB?1??^d0U?-??w.bdl?0?c??tj7?v?dEIP??)??j6?̾ս
ٞ??%7?5:cA;?R??~?v??.???$??1`?6}??旙:cA;?R??~?v??.???$??1`?6}????-9?? ? ?G9?i?T7?`1G??x??Cm?
?ȪK?vC???????S??)[email protected]?fsm?%[email protected]??vS???
?77V?6^?θ?<??b??k?sc6???,??s,?Z?S7??$?ҹ?^:٫D% ?ֹ?O? ɨ?#1?U????Rߓ???+r?ߛ??????%[email protected]?H?޹-??o?Q?X$)?U?d3??Q? ?o?5??]???X?tk3?K|Ʊ?(??
,C????L???`?#J?Q??C?P?;rn?Č????V?3?-=?????
9?/?e?9}Ւa??k?>??J?0?$0?ܠ0= *?H??
00?
0 `?He?0 *?H??
`?He? 01
0 UUS1
0 CA10U San Diego10U
CDMA Technologies10U
380128152634Z0??1OMM Attestation CA0
0 UUS1USecTools Test User10U San Diego10U
SecTools10U
California1"0 U
01 000000000000000C SW_ID1"0 U
02 300200002A7041DB HW_ID10U
04 2A70 OEM_ID10U
05 00000128 SW_SIZE10U
06 41DB MODEL_ID10U
07 0001 SHA2561"0 U
03 0000000000000002 DEBUG1#0!U
08 0000000000000111 APP_ID1&0$U
?0? *?H?? 13 0001 IN_USE_SOC_HW_VERSION0?"0
?Ӂ??? :????c?E*r
?<?E? ??r2??*?\%^<O׼?j$?=?u???
?{4!d??Ǫ???.w??/0? ?zd:?Z)Kd??9???G??
??u_GP?[`b7??gQ-?ҁ????i?ς?.??O̿\?\3?lp???}?OT2??Ϝ|q?
t
V2?1???d?ZX?p v????ҍE?VҠ?j~??[?VHo?,??
[email protected]?????)p???t??>0<0U#0?n/Hj??F??{D??Q$?Ř0
U00
U?0= *?H??
00?
0 `?He?0 *?H??
`?He? ???B?M???R?e????O?g?C??}5?4??CizY?Y??v???C:g0HN??R????Oֺo+{j?o?\?N??)ͰI"???V????ȡd?+4"?0?|>TH?C?w̚褹Q??]??Ժ3????
?P???X??Эp?Cd?p?
??p7?V??hX???>n? ?ɰ_??_?4??s???*^??0>?q???!?%X.????Cq6j??4?d?)???(h??8?o?C$?Y??w??P??,?0?(0??0= *?H??
00?
0 `?He?0 *?H??
`?He? 0n1
0 UUS1
0 CA10SANDIEGO1
0
U
OEM1U
General OEM rootca10U
361202061551Z01 OEM ROOT CA0
0 UUS1
0 CA10U San Diego10U
CDMA Technologies10U
?0?LCOMM*?H??UALCOMM Attestation CA0?"0
?????^??E?59?q???[֚[email protected]????.?>??
??jD?r?V??/??S?$y??G???G͏#???怟\?qܛ[email protected]!?m???5?=:UC~85???Q?aM?#?{?????
?4?_N?O?YA7kHx?aѩ'G?!S??3?ݑW?oa?u??'K??`xc?1??F??g?i?t????ㆎp?NΌ?e?N?bA???n???????????N?&>??`0^0U#0sԳ???:[email protected]??0Un/Hj??F??{D??Q$?Ř00?0
U0= *?H??
00?
0 `?He?0 *?H??
`?He? ?
?3˯u??6?!?(8%9jم~??]?MøN?׳-?w?_??&G??χ????F3T ?ʱ
?O#?ML[Q\????ϞV?ƒ???4??*???K???ৌ?c??:?ﴧ?:?=?8?eU??g??T???J????H??K1#?B??8Sje???4?2???-4?o??.?R?{??B&? ]??{M?tW;?cTS?f^?
[email protected]?F>Ӧ0??0???0= *?H?? ??G?R????5??`??y?Fe?|??%?WD????
00?
0 `?He?0 *?H??
`?He? 0n1
0 UUS1
0 CA10SANDIEGO1
0
U
OEM1U
General OEM rootca10U
361202061259Z0n1 OEM ROOT CA0
0 UUS1
0 CA10SANDIEGO1
0
U
OEM1U
General OEM rootca10U
?0? *?H?? OEM ROOT CA0?"0
????*O?ӽ??/??j6H?m6w????Ծq????????ݽZs݀??B9????>?UD?J?c?!kV???? /????IF?-j+????!,?d?JEX'??4???tK????????Q?K_?lx??J?<?????})?=?R??lqс]?????'4????o???=J?????(0?l5??\+M"?̋??2?:7??????oYogc?<0:0sԳ???:[email protected]??0
U0?0
U0= *?H??
00?
0 `?He?0 *?H??
`?He? ?=?v>?#??8?Wͭ8?v?h?????Oր?{pX̲=?ue??ra+jMSU??W8
[>?>??)???*a??,?`E??? }??a?wշ?a?̪?Ǻ?c{????l?l˘??s}?w??=`ä?_??K??G?d5)??#A(;{x_
??x????'???/???M?????;O?*??+"y?i??;?`[email protected]???}?M???{??9)_o&?
???E?b???Z4?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

ClinicalTrack said:
Okay, do you know why in /firmware-update/NON-HLOS.bin, the 4G LTE modem firmware, there are files for alipay? And how can I unpack / more closely examine them?
Click to expand...
Click to collapse
You can't unpack binary files. You don't have the source code so you're stuck with this bunch of binary crap you're seeing. Only OnePlus can tell you what's going on in there own modem firmware.
I'm guessing OnePlus and alipay are related but it's mainly for chinese users as nobody use alipay except china.
Also are you trying to decode every firmware files ? Cause unless you really know what you're looking for, you'll get nothing by opening some binary files in text mode. You'll need some ARM disassembler and really high knowledges to understand what's going on.
You can also take the phone apart and see through every chip inside with an x-ray machine and map this ****, like when we take apart the chip inside consoles to create some accurate emulators. Else, it's just bunch of qualcomm and oneplus obscure stuff.

funnoam said:
You can't unpack binary files. You don't have the source code so you're stuck with this bunch of binary crap you're seeing. Only OnePlus can tell you what's going on in there own modem firmware.
I'm guessing OnePlus and alipay are related but it's mainly for chinese users as nobody use alipay except china.
Also are you trying to decode every firmware files ? Cause unless you really know what you're looking for, you'll get nothing by opening some binary files in text mode. You'll need some ARM disassembler and really high knowledges to understand what's going on.
You can also take the phone apart and see through every chip inside with an x-ray machine and map this ****, like when we take apart the chip inside consoles to create some accurate emulators. Else, it's just bunch of qualcomm and oneplus obscure stuff.
Click to expand...
Click to collapse
That might be good enough for you, but it's not good enough for me. I want to know. You said you're here to help, but you're not helping. Why are you replying in this thread if all you can do is discourage me? Move on.

ClinicalTrack said:
That might be good enough for you, but it's not good enough for me. I want to know. You said you're here to help, but you're not helping. Why are you replying in this thread if all you can do is discourage me? Move on.
Click to expand...
Click to collapse
So by telling you the truth and being realistic about what you can do and can't with this files I'm discouraging you ?
Sorry for being honest pal. You say you're new to this world so I'm helpfully letting you know that these are the files nobody can decrypt except OnePlus. Like if you try to read the iPhone firmware modem source code.
Read my last 3 posts again. You'll see a bunch of helpful info on the system framework, the Dirac audio framework and more. Please do not focus only on one little thing when trying to learn a topic as this behaviour can be discouraging for you
Also, OxygenOS without any OnePlus components or app is called AOSP (more or less). If you want to build your own custom ROM by removing essential system framework, just start over with some fresh AOSP, you'll have the freedom to do basically everything this way. (helpful info!!)

funnoam said:
So by telling you the truth and being realistic about what you can do and can't with this files I'm discouraging you ? Sorry for being honest pal. You say you're new to this world so I'm helpfully letting you know that these are the files nobody can decrypt except OnePlus.
Click to expand...
Click to collapse
Ever heard of the Allegory of the Cave? You're living it.
And for the record, BIN files are easily mounted and read in linux. The AliPay files I pointed out above are ELF files, not BIN files, and I discovered those can also be read, to a certain extent, with linux android-sdk tools. You should try learning something before telling others it's impossible, "pal".

ClinicalTrack said:
Ever heard of the Allegory of the Cave? You're living it.
And for the record, BIN files are easily mounted and read in linux. The AliPay files I pointed out above are ELF files, not BIN files, and I discovered those can also be read, to a certain extent, with linux android-sdk tools. You should try learning something before telling others it's impossible, "pal".
Click to expand...
Click to collapse
https://en.m.wikipedia.org/wiki/Executable_and_Linkable_Format
You misunderstood me when I'm talking about binary files. Never said anything about BIN files actually.
These ELF files are binary files. They include pre-compiled code. You can read the header but can't decrypt the program.
BIN files can be anything, from raw data to binary, encrypted or not, etc.
You should try reading my posts again, can be useful.

I'm making progress. It turns out the 5T keeps a copy of OxygenOS hidden on the system, unaffected by TWRP wipes. Of course! When I install my custom OS, it doesn't like that, and instead makes a copy of this untouchable backup, and installs that.
By random chance, after a complete wipe, I took a look at TWRP's backup feature. Lo and behold, there's a 3072MB partition called "System Image". I was able to create a backup of the partition, the file is called system_image.emmc.win and I'm just now exploring it.
More updates as I make progress.

Are you formatting system before the install?

ClinicalTrack said:
I'm making progress. It turns out the 5T keeps a copy of OxygenOS hidden on the system, unaffected by TWRP wipes. Of course! When I install my custom OS, it doesn't like that, and instead makes a copy of this untouchable backup, and installs that.
By random chance, after a complete wipe, I took a look at TWRP's backup feature. Lo and behold, there's a 3072MB partition called "System Image". I was able to create a backup of the partition, the file is called system_image.emmc.win and I'm just now exploring it.
More updates as I make progress.
Click to expand...
Click to collapse
"System Image" & "System" in TWRP make a backup of the same partition, in a different file format. One backup the image of the system partition (like an ISO) the other compress all the files in /system in one single file.
I've never heard of a "secret" OxygenOS hidden on the system, TWRP doesn't do this at all by the way, so it's not taking place when you install it.
It sounds interesting tho, can you tell us the version / firmware of this unaffected OxygenOS ?

ClinicalTrack said:
I'm making progress. It turns out the 5T keeps a copy of OxygenOS hidden on the system, unaffected by TWRP wipes. Of course! When I install my custom OS, it doesn't like that, and instead makes a copy of this untouchable backup, and installs that.
By random chance, after a complete wipe, I took a look at TWRP's backup feature. Lo and behold, there's a 3072MB partition called "System Image". I was able to create a backup of the partition, the file is called system_image.emmc.win and I'm just now exploring it.
More updates as I make progress.
Click to expand...
Click to collapse
Hmm, this might explain why I can't seem to keep an altered system partition (with Cerberus app on it)
Thread here: https://forum.xda-developers.com/oneplus-5t/help/factory-resetting-doesnt-rooting-magisk-t3753065
Please keep us updated and give us more info