Develop Bugs

Preemptive Attack on ROM's

I think the Incredible introduced Android to many people, and without insulting anyone, I think a lot of these people are first timers to rooting, Linux, etc... so we have lot of "unseasoned" people with itchy trigger fingers, and root
Considering that the reflash looks like it will be released any day/minute now, there are some things that I wanted to start a discussion on. Some of these may be answered at the time of the release by unrevoked... but none the less I'm going to start:
1) Koush's recovery has nandroid. I think that someone (maybe me when I get off of work) should write up a quick write up on how to use nandroid to back up your system/use it to flash new roms
2) I think that Koush's Rom Manager will work with our phones, not to mention that i really like it . There should be a quick post on what this is, and how to use this.
For all of the "seasoned" people in here, before posting "this in unnecessary, this already has been done for other phones, etc....": If you're going to post, please post something relevant and educational for people instead, or just request that the thread be closed. NO FLAME PLEASE. I realize that this thread is for the more "noob" person.
"Noobs", please don't fill this thread with "junk", please post questions only if you feel they are relevant
**Mods, if you feel that this thread is unnecessary, please delete it.**

reserved
reserved for later

Excellent thread, thanks for the start looking forward to some useful information to absorb

Seconded
I am about as far from a computer/tech n00b as you can get, but I am extremely new to android. I would certainly welcome a primer of this nature.

Moderately seasoned nerd, but the incredible is my first smart phone. I absolutely welcome a "first-timers" thread with regards to rooting / tweaking this phone.
A preemptive thanks is definitely deserved, especially the level of drama I saw while trolling in the forums here, more-so over the past few weeks, and while some of the unfortunate "false starts" that always invariably occur with a startup of this nature.
Again, a heart-felt thank-you, and I really look forward to learning a new process on a completely different platform. I continue to eagerly await a streamlined process, especially one that I can learn from, and violate more to tweak my experience.
Feel free if I can provide any help / support from here.

HyperTension said:
Again, a heart-felt thank-you, and I really look forward to learning a new process on a completely different platform. I continue to eagerly await a streamlined process, especially one that I can learn from, and violate more to tweak my experience.
Feel free if I can provide any help / support from here.
Click to expand...
Click to collapse
I would just replicate what's been done in other android devices' forums: A ROM Bible and a Complete Rooting How-To, and get 'em both stickied. Check out the Dream forum for good examples. I would help if asked

Good point
rynosaur said:
I would just replicate what's been done in other android devices' forums: A ROM Bible and a Complete Rooting How-To, and get 'em both stickied. Check out the Dream forum for good examples. I would help if asked
Click to expand...
Click to collapse
I will search XDA tonight, and provide links to "help" guides in either the first post *edited* or make a new thread. Good point, no need to re-invent the wheel. However, a sticky thread in this particular forum is probably needed.
Thanks,

Thanks for making a thread like this. Even though this is my first smart phone, I have a good amount of experience with similar things so I've picked up on most of it relatively quickly.
I was able to obtain a beta copy of the recovery flash tool from hanging around the IRC chat and was able to get my ClockworkMod Recovery up and running.
I have one question about nandroid though; I was able to backup the majority of my files but when it gets to the final step of backing up sd-ext it gives me a message saying "No sd-ext found" and that it cannot be backed up. What exactly is the sd-ext and is it essential to have backed up before I start installing ROMs?

JTCGiants56 said:
I have one question about nandroid though; I was able to backup the majority of my files but when it gets to the final step of backing up sd-ext it gives me a message saying "No sd-ext found" and that it cannot be backed up. What exactly is the sd-ext and is it essential to have backed up before I start installing ROMs?
Click to expand...
Click to collapse
It means you don't have an ext format partition and thus it wasn't backed up. Which is exactly how it should be right now.

heavensblade23 said:
It means you don't have an ext format partition and thus it wasn't backed up. Which is exactly how it should be right now.
Click to expand...
Click to collapse
Thanks for clearing that up.

JTCGiants56 said:
"No sd-ext found"
Click to expand...
Click to collapse
Better get us a Spoiler and find out if your source was running CM5.0.7/8 or Froyo on their DI -- "sd-ext" is the new way (via Cyanogen) of doing/mounting apps2sd

Don't think so. Koush wrote the recovery, koush works on cm. Probably wrote into the recovery,nandroid, to look for it and back it up. Notice that his didn't find anything?
-------------------------------------
Sent via the XDA Tapatalk App

dreamersipaq said:
Don't think so. Koush wrote the recovery, koush works on cm. Probably wrote into the recovery,nandroid, to look for it and back it up. Notice that his didn't find anything?
Click to expand...
Click to collapse
Of course, that's the problem, a recovery that presupposes the CM way of ext-fs/apps2sd presupposes someone was using a ROM that requires it otherwise, that recovery isn't recommended AT ALL, because nandroid, fix permissions, etc all look to the wrong place for ~/app, /app-s, ~dalvik, etc . . . non-CM/pre-5.0.x ROMs do things differently with EXT, if at all. See what I'm getting at?

Eh, say what you will...
rynosaur said:
Of course, that's the problem, a recovery that presupposes the CM way of ext-fs/apps2sd presupposes someone was using a ROM that requires it otherwise, that recovery isn't recommended AT ALL, because nandroid, fix permissions, etc all look to the wrong place for ~/app, /app-s, ~dalvik, etc . . . non-CM/pre-5.0.x ROMs do things differently with EXT, if at all. See what I'm getting at?
Click to expand...
Click to collapse
I love what koush has done with the Cyan port... So if his recovery works best with it, then so be it.... Though if he could update the recovery to look for both places that's be great too

dreamersipaq said:
I love what koush has done with the Cyan port... So if his recovery works best with it, then so be it.... Though if he could update the recovery to look for both places that's be great too
Click to expand...
Click to collapse
I know Firerat over on Dream is good at writing switches to make appropriate exceptions for different SPLs, apps2sd and partitions schemes. If push come to shove we could ask him for suggestions. And I awfully concerned because A) I don't like modding without nandroids and B) I prefer Amon-RA's recoveries and his options for CM5/non-CM Roms

New Thread
http://forum.xda-developers.com/showthread.php?t=709220
This can be closed or locked.

Kernel Source

Hello,
Im not sure if anyone was aware, but the source code for the kernel is available from the Acer website. Im not sure if this would help with the dev of roms or cracking the bootloader. Thought I would throw it out there.
Its available on the Acer support page under the A100, and is around 100mb

mvan4310 said:
Hello,
Im not sure if anyone was aware, but the source code for the kernel is available from the Acer website. Im not sure if this would help with the dev of roms or cracking the bootloader. Thought I would throw it out there.
Its available on the Acer support page under the A100, and is around 100mb
Click to expand...
Click to collapse
Yeah, I saw that. Doesn't make a difference though, we need a unlocked bootloader before a custom kernel we can make with that is useful.

Back in my Xperia x10 days they were able to find a way to crash the stock kernel and were able to load custom kernels with a locked bootloader. Its probably not feasible considering it was a much older kernel version and from a different manufacturer...but one can only hope right? lol

Don't know if it helps, but the thunderbolt also came with a locked bootloader and devs figured out how to flash a custom kernel. The custom was also locked but supported what they needed it to. It was flashed with the same process as our flashing updates manually. Maybe some of the tbolt devs could help?
Sent from my A100 using Tapatalk

We could do a custom rom that through 2nd-init, but so far its been an uphill battle trying to figure it out. I'm not a kernel developer, but I've done some work modifying and working with cm7 kernels but nothing to this scale.
I do know that we wouldnt be able to change the kernel on this device or a modified recovery because there's some checking going on with the checksum of the disk images.

@crossix
Have you seen this thread in the Nook Tablet forums?
They found a way around the the bootloader problem.

I was thinking the above. Maybe we can make a work around through the kernal code. I havnt done programming on this low of a level but can scan through to see if and what checks there are and if there are any loopholes... I like to think they have a backdoor somewhere in there...

Excuse me, I was wrong. The tbolt with its locked bootloader was solved a little differently. I think what they did was flash an entirely different bootloader to it. One that was still encrypted but unlocked. Don't know if that's possible in this case but thought it was something to mention.
Sent from my LG-VM670 using Tapatalk

Maybe we should talk to nemith and fattire and they may have some suggestions. I am no where shilled at this level of development to talk intelligently to them. My development skills lie in the .Net field and at the application level. So I am not much help.

@painter... i have been looking through the nook forums that you referred to and i certyainly think that this is possible route to go with the a100. this is also way above my skillset, however i will be more than happy to do what i can if there are any developers interested. i have been doing alot of research into the locked bootloader and this is the most promising news that i have heard so far. I wish we could get more devs interested in this little tablet because it has great potential if we could get past the bootloader.

What Ill do later is download the code again, had before, but accidentally deleted it, and look through some of the more important code to see what can be found. Why would Acer put up the source code if there isnt a way to alter the kernel? Seems counter-intuitive to put it up without a purpose...

here is some info on 2nd init, if anyone smarter than me is interested in having a look.....good luck!..... http://cvpcs.org/blog/2011-06-14/2nd-init._what_it_is_and_how_it_works

mvan4310 said:
What Ill do later is download the code again, had before, but accidentally deleted it, and look through some of the more important code to see what can be found. Why would Acer put up the source code if there isnt a way to alter the kernel? Seems counter-intuitive to put it up without a purpose...
Click to expand...
Click to collapse
Because they have to, its required by gpl to make the source public. Just because they make it public, doesnt mean that it'll compile properly though. But, in this case it does compile cleanly and with it we could probably take bits and pieces of cwm for the a500 and get it to work (their gpl version not thor's recovery). How to do that tough with our current encrypted recovery I dunno.
I looked at the thread and it definitely looks like something doable but what offset would we use and how would we tell the boot partition to go look for a custom recovery when we cant even open it to alter its contents since it and the recovery partitions are both encrypted.
If you make a image of either partition using dd and try to mount it and read its contents you see gibberish rather then editable files in the images. might be able to poke at it with a hex editor, but that's beyond my skill level.
Sent from my MB860 using XDA App

Im still in the extraction process, and it is a rather large image. Its around 500mb compressed. I can take a look into it, but cant make any promises that Ill find anything at all. I understand the gpl and whatnot, and the partitions being encrypted, and am just hoping that somewhere in the kernel is a clue as to what is being done that can help us along the way to cracking this thing.
I didnt think of this until now, but is the newer A500 encrypted? If s, maybe we can find the difference between the older and the newer version somehow and see what they are using. Just a thought, could be completely wrong.

from what I understood (I could be completely wrong though) one of the newest updates that brought the a500 up to 3.2.1 changed their encryption method so itsmagic (their security hole) no longer worked. The work around for that was to downgrade to 3.2 and install cwm / itsmagic and them flash a recovery 3.2.1 image.
Sent from my MB860 using XDA App

Hmm, Not sure. Ill look around. Im still trying to root my tab, have been unsuccessful thus far, and about 3 hours into trying..

is there any benefit in opening the device and sniffing around? I know the bootloader's encrypted but some of it might not be? That's how GeoHot found the first iPhone unlock exploit; by shorting two pins or something?
I also know it's possible to read NAND chips with an Arduino to some extent. I dunno, just talking out loud...

Never thought of finding a way through the hardware itself. I have never opened my Acer, probably wont. I have a Chromebook and they only way to install another OS on it was to flip a switch and pop the cover off, since it has a button thats enabled with the case on that prevents writing to specific portions and whatnot... Good thought. Maybe someone will look into this further.

A100 teardown
http://www.techrepublic.com/blog/it...eardown-lots-of-tech-crammed-into-7-case/3028
Sent from my PG86100 using Tapatalk

I think its very nifty that it has an expansion slot for a cellular chip. All the specs I can find on the 3g a101 show it as having half the RAM. Wonder what it would take to pop a 3g chip in there and get it working. :-\ You would probably have to flash the firmware from the 101 to get it to see the chip...

Wild speculation

I don't have the experience to know if this is possible, which is why I ask because I'm curious. I post here because I want devs to see it, and think "that could work" or "idiot"
As we know the defy bootloader will probably never be unlocked, now I was thinking would it not be possible to somehow isolate the bootloader from a rom, and run some kind of virtual one in a seperate partition to run a fully custom kernel? It's probably crazy but I'm dying to know what people think, don't be too hard on me I have no coding experience :/ however all opinions are welcome I think anything is possible
Sent from the real world by hacking into the matrix

I don't want that this will become another dead Bootloader-Hacking-Thread but I want to give you an answer with the facts:
1) There currently is no known way to execute code before booting the kernel because everything is well protected though signing code.
2) The only way to boot a kernel after kernel-boot are tools like kexec or 2ndboot. But a phone's RIL is a heavy stone on that way because it's not that easy to reinitialize this part of hardware and without RIL a phone is useless. The main-developers canceled this project due to this reason.
Other "non-phone"-devices with locked bootloader (like Sony's google-tv) are using this method without problems.
3) You can use kexec/2ndboot to load a full bootloader instead of an kernel only, too. But because we don't have the source we would have to reverse engineer it to disable the signature check of the kernel otherwise you would load another useless protected bootloader This was also an project but I don't think it's still alive...
Additional note: You can't directly flash a modified bootloader because our chipset has built-in OMAP3-security features. This means the CPU will only boot signed Code from NAND.
You can find many helpful information about this topic on this page:
http://and-developers.com/partitions:cdt#cdt_table_of_droid_x

Thanks that clarifies things quite a bit, however I mean loading not just a second kernel but a WHOLE bootloader that would handle the phones entire functions independently, or is it completely hardwired so its impossible for something to override it? (Sorry if you have already answered in the above). Another thing, has noone tried to compile custom fixed sbf? Maybe the bootloader could be replaced that way? In software almost anything done can be undone in some way, although perhaps this is the rare case where it isn't
Sent from the real world by hacking into the matrix

I edited my post to have everything at one place.
I hope this answers your questions.

The bootloader is like the bios in a pc (actually is part of the bios), it's what initializes the device and loads the rest of the code. to load it again or another one you had to reinitialize the device. the issue with the RIL is that when reset or restarted it "panics" and resets the whole device (I think, read it somewhere).
also the second unlocked bootloader that you want to load does not exist anyway.
it's better to just help the developers with bug reports and testing than daydream.
sorry mate!

m11kkaa said:
I edited my post to have everything at one place.
I hope this answers your questions.
Click to expand...
Click to collapse
So its all been tried before, damn! XD at least the devs here have done a fine job of making good roms even with this limitation, guess I will do my research before I buy my next phone as I love playing with roms, the more custom, the better
Sent from the real world by hacking into the matrix

[XYBOARD][RECOVERY] Funding for Dev to create Recovery/Rom

I would like to know how many forum members would be willing to donate funds to any developer willing to seriously work at creating a recovery program and maybe one rom for the Xyboard 10.1 4G/LTE device.
I realize the bootloader is still locked, but devs have managed to bypass the bootloader on other devices using some very creative thinking. The bootloader on my Droid Razr is still locked, but we have Safestrap, CWM
There is also a member i saw that would be willing to donate a xyboard for testing.
I would be willing to donate $100 towards this project.
We need to show the manufacturers that our platform is truely OPEN SOURCE?

so, here we meet again, chumboy
well i'm in, offering 50$ for unlock/bypass

nchantmnt said:
so, here we meet again, chumboy
well i'm in, offering 50$ for unlock/bypass
Click to expand...
Click to collapse
welcome! hey again.
fair amount of views, not many investors.
surprised, it's verizon's main tablet that has 4g (besides the galaxy tab 10.1 which i heard is discontinued).
patience.

I would get in on this. I have actually been trying to figure out Hash's safestrap to see how it is replicated for different devices.
Sent from my Droid3 using xda app-developers app

I know it can be done...it's just a matter of interest. Is some dev interested in spending time to figure it out.
we have recovery for many, many devices whose bootloaders are locked.
SafeStrap would be great....or TWRP.
So far, we have $150 available for anyone who creates a recovery. Come 'n git it, devs!

why not create a simmilar thread at xoomforums.com... guess the most of interested useres aren't reading much @ XDA since atm there is no development going on for this device.
if you do so, just be sure to link to each other thread, list the users & amount and sync those two threads in their first post like:
"chumboy (xda/xoomforums) - 100$
nchantmnt (xda/xoomforums ) - 50
.....
hopefully many many more
_____
total funds until 28th of Sept - 150$
ill try and see if i can get some users @ androild-hilfe.de to join in
maybe u know of some other forums as well
cheers

25 from me if the recovery will working for international xoom2 too.

Hello guys,
i want to help you to get a custom recovery for your XOOM2,
because i´ve long waited for a cwm that could be used on my phone - Motoluxe XT615.
And i got sick of all those devs out there who don´t want to help us to make it even easier.
So my mates and me tired a lot together. Finally a chinese developer team got it.
So i hope i can charge my knowledge with you.
My first few questions are:
- Any tries of implementing 2nd init?
- Which type of internal storage (MTD, EMMC)?
- Locked bootloader (realy think so )?
- Can you upload the init.* script in the root of your phone?
I hope you have rootaccess

luxxx123 said:
Hello guys,
i want to help you to get a custom recovery for your XOOM2,
because i´ve long waited for a cwm that could be used on my phone - Motoluxe XT615.
And i got sick of all those devs out there who don´t want to help us to make it even easier.
So my mates and me tired a lot together. Finally a chinese developer team got it.
So i hope i can charge my knowledge with you.
My first few questions are:
- Any tries of implementing 2nd init?
- Which type of internal storage (MTD, EMMC)?
- Locked bootloader (realy think so )?
- Can you upload the init.* script in the root of your phone?
-and yes we have root
I hope you have rootaccess
Click to expand...
Click to collapse
for 2nd init i really lack the knowledge of how to do this, but atm trying to get to know more about it. is this even working on ics?
internal storage should be mtd if i'm not totally wrong...
the bootloader is locked, we are sure about that and about the init... will upload it for you later... first got to recharge^^
what kind of approach is it that you have in mind? i may lack the knowledge about bootstrapping etc, but i'm eger to learn

nchantmnt said:
for 2nd init i really lack the knowledge of how to do this, but atm trying to get to know more about it. is this even working on ics?
internal storage should be mtd if i'm not totally wrong...
the bootloader is locked, we are sure about that and about the init... will upload it for you later... first got to recharge^^
what kind of approach is it that you have in mind? i may lack the knowledge about bootstrapping etc, but i'm eger to learn
Click to expand...
Click to collapse
The 2nd init should not be a problem. Internal storage is /mnt/sdcard/ external drive can be loaded on /mnt/usbdisk_1.0/
The bootloader is locked, Motorola has not released this yet. However, I did decode a file that had the agreement for unlocking the bootloader so this leads me to believe it will happen in the future.
My knowledge of bootstrapping is limited as well but I do know that if Motorola's system catches anything of another system trying to run, it will reject it and either bootloop or reboot. The secret is in the boot stage not interacting with factory boot at all.

wow...you guys are talking way over my head. i understand somewhat, but at this time, i can't contribute anything but funding.
and emotional support !!!
let me know what a non-coder like myself can do to help you.
so far, we have $175 available to dev who creates recovery.

Devs,
Just want to make sure you dev's are working on the Xyboard 10.1" with LTE connectivity and not just the wifi only device.
It's the Xyboard MZ617 7444.

Realy guys i don´t want your money
On my phone we got a CWM recovery via hijacking battery_charger.
That means when your phone is of and connect it to any kind of power supply it normaly starts this huge battery loading animation.
We simlinked this battery_charger script to a folder that excutes the CWM.
So everytime i shutdown the phone and connect it to powersupply i´ll enter CWM.
I´m quite sure this will work on your tablet, too.
I just can help you with this kind. When your aim is to get a real 2nd Init i can´t help you,
because there my knowledge ends too.
But for beginning i think it would be nice to have any kind of custom recovery, or?
To beginn i realy need the init scripts guys. Open your filebrowser and go to internal storage root, there they should be.

Sorry was abroad for some days
Yes, any kind of custom recovery would be nice. Here you go with the init.
Any information on how you are going to do this would be nice so we can alter this to our needs (thinking about some bootloader to choose weather to load cwm or automatic just charge after some seconds would be nice)
What are the limits of this way? Guess we will not be able to flash kernels, right?

First off, sorry for double-posting
having read myself enough into 2nd init i guess there will be no way to get this running on our xoom2/xyboard models, as the devices need to be running some froyo-kernel to get this working. Maybe even a tweaked gingerbread-kernel can be used for 2nd init, but it should not be possible with honeycomb or even ics. So i guess our best bet is to concentrate on the option luxxx123 is going to give us.

Wow...interest seems to be picking up! That's great.
the Xyboard is really a pretty good tablet.
What you guys are discussing is slightly over my head so i'll just lurk and help when i can.

The kernel version is 3.0.8 Does froyo go into the 3's? I thought it stopped at 2.6.
Sent from my Droid3 using xda app-developers app

Youre right... Froyo stopped at 2.6 but if i recall it correctly the hijack of 2nd init doesnt work with newer kernel versions. But i would be glad if i was wrong here
Gesendet von meinem XOOM 2 mit Tapatalk 2

I tried pulling the 2nd init and hijack from my Droid 3 which has Hash's Safestrap. I customized a few things for my Xyboard and put the files in place but it put it into a bootloop. You just may be right.
Sent from my Droid3 using xda app-developers app

I'll save you guy some trouble, boostrap and safestrap won't work, bootstrap hijack method will not work, bootstrap is open source and you can find all the stuff on github by koush, safe strap by hashofcode will not work, it utilizes the same hijack binaries of bootstrap, this is also open source on his github,
Both can be built from the source, with the recovery files build from cm9 or cm7 .
I have built the recovery and the bootstrap they simply do not work.
That said i have gotten rid of my two (I even at one point offered to send one of mine to a known developer, not one took me up on the offer that's why I learned how to do it myself.
Now someone here brought up a way that peaked my interest, syslinking the charge while battery off script to a custom script to boot into a custom recovery' (cwm or twrp) this seems like the most likely at this could be done.
Someone with some time could find the script in question and post it I'm sure myself or someone else could get something going.
Sent from my Nexus 7 using Tapatalk 2

[Question] Modding out hboot?

I was wondering has anyone tried decompiling our hboot and tryig to see if we can re size our portion sizes? Other phones such as the nexus one i believe has a modified hboot(blackrose) that allows resizing htc hero has a nice mod as well called firerat. Patches both recovery and boot.img to allow more size to data or system as needed(set by user). If i have the time & money to buy a test monkey i will be trying to decompile it.
Sent from my rooted GameBoy Advance! ^¬^

Decompiling is disassembly generally. Some decompilers can go back to the source code but it's not the original source and usually harder to read. Also, if you do something wrong in HBOOT you will likely brick your phone.
The correct word is partition not portion.
Maybe if you're interested you can ask the devs who did it. It sounds complicated and very risky. I think a safer option would be to create .img files on the emmc or sdcard storage and tell the ramdisk to boot from there. Boot Manager already accomplishes this and can multi boot ROMs but it hasn't been worked on since the ICS days. I think the devs of that project have said that someone could pick up on it and continue. It doesn't work on Jellybean but that's ideally the smartest concept, though the img method seems to be a bit slower.
Another option is LVM which I mentioned a while back and didn't get around to trying out.
This thread talks about it
http://forum.xda-developers.com/showthread.php?p=26164523
That above looks interesting but the users will also have to be technical enough to be able to create the LVM partitions themselves and set up their system enough to flash a ROM for it. It requires a modified boot.img and recovery.