Android Smart TV Box M6 - AML8726-MX - G18REF - XBMC Native Linux - Hints - Upgrading, Modifying and Unlocking

Hi guys,
I don't have access to ROM forum yet so I posted a thread here. My intention is to clarify the process of flashing native Linux with XBMC to this box.
The reference thread is:
http://forum.xda-developers.com/showthread.php?t=2418029
What started my doubts was the information on checking the MTD layout before proceeding with the update. I have checked mine via ssh and it is different from what is posted on the above thread.
Mine is:
Code:
dev: size erasesize name
mtd0: 00800000 00200000 "bootloader"
mtd1: 00400000 00200000 "ubootenv"
mtd2: 00800000 00200000 "logo"
mtd3: 00800000 00200000 "aml_logo"
mtd4: 00800000 00200000 "recovery"
mtd5: 00800000 00200000 "boot"
mtd6: 40600000 00200000 "system"
mtd7: 20000000 00200000 "cache"
mtd8: 10000000 00200000 "backup"
mtd9: 18c600000 00200000 "userdata"
which is same as the author's of this thread:
http://forum.xda-developers.com/showthread.php?t=2492843
I have also checked the contents of the zip file from the first cited thread (the "updater-script" file in particular) and it looks like the only MTD partitions that are modified are: boot, system and logo.
I want to build the system myself from sources using what is already available on the Internet (probably using croniccorey's repo).
That being said, my questions are:
1. Is it safe to update the box to Native Linux? Are mtd0 (bootloader) and mtd4 (recovery) partitions left intact during update? If so, there should be no risk of bricking the device.
2. How is booting to recovery done? What I have already found is that the detection of the pressed-during-power-on button is done in the bootloader phase. So if the bootloader stays at mtd0 of the NAND flash and I accidentaly erease that partition, I brick the device with no chance to get to recovery mode. Am I right?
3. Does AM8726-MX try to boot from other than default devices if NAND boot fails? If so, It would be possible to copy U-boot to SD card and start from there. I can't find the processor's datasheet neither the schematics of G18ref board.
4. Is there a way to find the offset of a particular MTD partition in running system with no source knowledge? Using cat /proc/mtd I only get partition sizes. Partitions may follow each other with unused space in between, so if my real MTD layout differs from what I have in the updated system, I may have troubles (e.x. I may overwrite the recovery partition writing to boot partition)
5. From the config file of G18ref board:
https://github.com/CoreTech-Develop...ter/arch/arm/configs/meson6_g18_mx2_defconfig
and the board configuration file:
https://github.com/CoreTech-Development/mx-common/blob/master/arch/arm/mach-meson6/board-m6g18.c
I can see that some NOR flash is used (CONFIG_AMLOGIC_SPI_NOR=y). If so, what about the fact that my bootloader has a partition on NAND (mtd0). Or maybe mtd0 and mtd1 belong to NOR flash and the rest (mtd2..9) are NAND partitions?
I am confused. Would appreciate help.
Regards, ak_dev.

So far I have found the answers for:
4. Is there a way to find the offset of a particular MTD partition in running system with no source knowledge? Using cat /proc/mtd I only get partition sizes. Partitions may follow each other with unused space in between, so if my real MTD layout differs from what I have in the updated system, I may have troubles (e.x. I may overwrite the recovery partition writing to boot partition)
Click to expand...
Click to collapse
Simply by finding it in dmesg, for example:
Code:
dmesg | grep -C 20 mtd
I have tried finding the info in /sys, but it looks like there is no offset information there
5. From the config file of G18ref board:
and the board configuration file:
I can see that some NOR flash is used (CONFIG_AMLOGIC_SPI_NOR=y). If so, what about the fact that my bootloader has a partition on NAND (mtd0). Or maybe mtd0 and mtd1 belong to NOR flash and the rest (mtd2..9) are NAND partitions?
Click to expand...
Click to collapse
No signs of SPI NOR flash in the system yet...
From dmesg, I can see that mtd0 and mtd1 are created on same NAND as other partitions.
But another question arised.
dmesg reports:
Code:
[ [email protected]] Creating 9 MTD partitions on "B revision NAND 8GiB MT29F64G08CBABA":
(...)
[ [email protected]] 0x000002400000-0x000002c00000 : "recovery"
(...)
But in the board-m6g18.c file there is a definition for recovery partition:
Code:
{
.name = "recovery",
.offset = 64*SZ_1M+40*SZ_1M,
.size = 8*SZ_1M,
}
64*SZ_1M+40*SZ_1M = 0x6800000
Why the offsets don't match? Wrong board config file? Don't think so...
And still, I can't find answers to other questions...

Related

Nexus One Splash Screen for g1/g2

Here's the original Nexus One Splash Screen:
480x800
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
and then Resized for g1/g2:
340x480
And this is the RGB565 ready to flashed:
download link
http://www.4shared.com/file/213326515/b1d4eba2/mysplash.html
to install:
Copy mysplash.rgb565 in your tools directory
go in dos with start-execute-cmd
go in your tools dir (ex. cd c:/android/tools/)
then put the device in fastboot mode
Back+Power
and give this command on dos prompt
Code:
fastboot flash splash1 mysplash.rgb565
Bye !
Thanks! My splashscreen is so awesome now, not annoyingly bright anymore.
Awesome! I love it! I really needed something to replace that annoying bright MyTouch splash screen! Thanks!
once it says OKAY do I just restart the device?
Also, how do I make my own Splash image?
just want to say thanks. I now finally understand fastbooting splash1 files now. Plus I love this splash instead of that bright ass one.
Solved my issue. Love it. Now to get the boot screen.
no tools
(noob question probably): I don't have a android/tools directory in my sdcard can i just make a new android folder and then inside make a tools folder then drag mysplash.rgb565 in there then go on the cmd and
C:/users/(username)>
C:/Users/(username)> cd g:/android/tools/
then go on then go on flashboot mode and type the command you gave me
(main problem is not having android/tools in my sd root sorry for adding unnecessary comments )
so do you have to have a new spl to change the boot screen? or can i use the default mt3g spl and still change it?
So... When I do the whole "fastboot flash ...", the only way I can get the flashboot executable to run is to include ./ in front of it like so: <./fastboot flash splash1 mysplash.rgb565>
I'm not sure if this is normal. I am running terminal on a mac, if that makes a difference.
In any case the reason I ask is because when I run the command, it fails.
This is terminal's printout:
<sending 'splash1' (300 KB)... FAILED (remote: not allow)>
Any suggestions? I'm in fastboot USB and I DO have root access/superuser permissions, so I can't think of what to do. Thanks in advance.
Semi_Interested said:
So... When I do the whole "fastboot flash ...", the only way I can get the flashboot executable to run is to include ./ in front of it like so: <./fastboot flash splash1 mysplash.rgb565>
I'm not sure if this is normal. I am running terminal on a mac, if that makes a difference.
Click to expand...
Click to collapse
Yes, that's normal for *NIX. You normally need ./ if the command doesn't reside in your $PATH. You would modify it in your .bashrc file:
Code:
export PATH=$PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games:[B]/newSDKpath[/B]
Semi_Interested said:
In any case the reason I ask is because when I run the command, it fails.
This is terminal's printout:
<sending 'splash1' (300 KB)... FAILED (remote: not allow)>
Any suggestions? I'm in fastboot USB and I DO have root access/superuser permissions, so I can't think of what to do. Thanks in advance.
Click to expand...
Click to collapse
This probably means you have the original SPL, which doesn't allow writing images using fastboot. You can either replace the SPL, or use the flash_image command (included with rooted phones). Copy your mysplash.rgb565 to the SDcard, then use the ADB tool to get a shell on the phone...
Code:
[[email protected]] ~/sdk $./adb
# flash_image [I]partition[/I] /sdcard/file.img
To see what partitions there are, type
Code:
# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 05a00000 00020000 "system"
mtd4: 05000000 00020000 "cache"
mtd5: 127c0000 00020000 "userdata"
(These are, BTW, the names of the backup files created by Nandroid.) Not shown on this list are the two G1 partitions, splash1 (displayed first) and splash2 (right after it). The Android animation uses an XML file, I think.
As for fastboot, if you do use it, there's an excellent cheatsheet here. There is also an ADB for Dummies post.
Windows Vista 64bit prompts me for Android 1.0 drivers when I go into fastboot. I tried through the New hardware wizard to point to both the android x64 and usb_drivers folder but received errors. I take it this really isn't for the MyTouch without the 3.5mm jack?
unexpectedKing said:
(noob question probably): I don't have a android/tools directory in my sdcard can i just make a new android folder and then inside make a tools folder then drag mysplash.rgb565 in there then go on the cmd and
C:/users/(username)>
C:/Users/(username)> cd g:/android/tools/
then go on then go on flashboot mode and type the command you gave me
(main problem is not having android/tools in my sd root sorry for adding unnecessary comments )
Click to expand...
Click to collapse
Forget the sd card
You need to install the android SDK on your computer, 'cd' to the tools directory then issues the fastboot commands.
Lianthe said:
Windows Vista 64bit prompts me for Android 1.0 drivers when I go into fastboot. I tried through the New hardware wizard to point to both the android x64 and usb_drivers folder but received errors. I take it this really isn't for the MyTouch without the 3.5mm jack?
Click to expand...
Click to collapse
No, the drivers are simply failing to install. I honestly can't remember how it got them working on Vista x64 but it did take some trial and error.
If you have a Mac anywhere in your house install the SDK on there, it doesn't require any drivers to be set up.
Thanks for your reply AdrianK, I figured it out. I disconnected the phone, did the old copy-and-paste of the usb drivers into the android-sdk folder, then reconnected the phone and typed the path to that folder. Viola! Vista immediately began installing them.
Semi_Interested said:
So... When I do the whole "fastboot flash ...", the only way I can get the flashboot executable to run is to include ./ in front of it like so: <./fastboot flash splash1 mysplash.rgb565>
I'm not sure if this is normal. I am running terminal on a mac, if that makes a difference.
In any case the reason I ask is because when I run the command, it fails.
This is terminal's printout:
<sending 'splash1' (300 KB)... FAILED (remote: not allow)>
Any suggestions? I'm in fastboot USB and I DO have root access/superuser permissions, so I can't think of what to do. Thanks in advance.
Click to expand...
Click to collapse
hello
follow this link
http://forum.xda-developers.com/showthread.php?t=529019
but be careful it can brick your device!
Sorry, I'm kind of a noob. But does this work on the latest stable 6.0.0 CM without any problems?
can somebody please link the file to this thread via xda download? i cannot download at school. much appreciated
heyy do u think u can helpme wihh this?? im kinda new at doing this kind of stuff :/
MarkitosWay117 said:
heyy do u think u can helpme wihh this?? im kinda new at doing this kind of stuff :/
Click to expand...
Click to collapse
Erm... yes? Go ahead...
voxluna said:
Yes, that's normal for *NIX. You normally need ./ if the command doesn't reside in your $PATH. You would modify it in your .bashrc file:
Code:
export PATH=$PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games:[B]/newSDKpath[/B]
This probably means you have the original SPL, which doesn't allow writing images using fastboot. You can either replace the SPL, or use the flash_image command (included with rooted phones). Copy your mysplash.rgb565 to the SDcard, then use the ADB tool to get a shell on the phone...
Code:
[[email protected]] ~/sdk $./adb
# flash_image [I]partition[/I] /sdcard/file.img
To see what partitions there are, type
Code:
# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 05a00000 00020000 "system"
mtd4: 05000000 00020000 "cache"
mtd5: 127c0000 00020000 "userdata"
(These are, BTW, the names of the backup files created by Nandroid.) Not shown on this list are the two G1 partitions, splash1 (displayed first) and splash2 (right after it). The Android animation uses an XML file, I think.
As for fastboot, if you do use it, there's an excellent cheatsheet here. There is also an ADB for Dummies post.
Click to expand...
Click to collapse
is it possible to do it with the 1.33.0013d?

AutoRoot Failed - now phone consantly resets, cant charge, and cant see SD card

So I just got a brand new HTC Evo replacement because my old one had power button issues.
I tried using Universal AutoRoot 2.5. CMD closed and I got this output:
"------------ AutoRoot.bat Begin - v2.5 - Tue 06/07/2011 23:33:14.63 ------------
Params=1'' 2'' 3'' 4'' 5'' 6''
Working Directory is 'C:\Users\Mark\Desktop\AutoRoot_v2.5\'. Admin='true'
Clearing Temp Files...
The directory name is invalid.
---------
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
---------
Phone SN is HT15AHL06321
PING ADB State Changed '1' out of '0'. ADB State is 'device' expected 'device'
Checking MTD configuration...
dev: size erasesize name
mtd0: 00c00000 00020000 "wimax"
mtd1: 000a0000 00020000 "misc"
mtd2: 00480000 00020000 "recovery"
mtd3: 00300000 00020000 "boot"
mtd4: 15e00000 00020000 "system"
mtd5: 0a000000 00020000 "cache"
mtd6: 1aba0000 00020000 "userdata"
'check.bat mtd' returned 'old'
MTD data being saved for phone 'HT15AHL06321'
'dev: size erasesize name mtd0: 00c00000 00020000 "wimax" mtd1: 000a0000 00020000 "misc" mtd2: 00480000 00020000 "recovery" mtd3: 00300000 00020000 "boot" mtd4: 15e00000 00020000 "system" mtd5: 0a000000 00020000 "cache" mtd6: 1aba0000 00020000 "userdata" '
EVO Branding 'sprint'
Firmware version '3.70.651.1'
Version Major '3'
Version Minor '70'
Battery is at 70 percent.
Checking for root...
UID is 'shell'
Installing exploit...
pkg: /data/local/tmp/AutoRoot.apk
Success
1593 KB/s (767044 bytes in 0.470s)
adb: Product directory not specified; use -p or define ANDROID_PRODUCT_OUT
Sending Intent...
Starting: Intent { act=android.intent.action.MAIN cmp=com.autoroot.getroot/.getroot }
Checking for root...
UID is 'Got Root!'
Checking for needed files...
Pushing res\mtd-eng.img to /sdcard/mtd-eng.img...
1570 KB/s (655360 bytes in 0.407s)
Pushing res\URFSOFF.zip to /sdcard/URFSOff.zip...
1255 KB/s (225014 bytes in 0.175s)
Pushing res\URFSON.zip to /sdcard/URFSOn.zip...
1159 KB/s (225551 bytes in 0.190s)
Dumping WiMAX partition...
rm failed for -s, Read-only file system
1522 KB/s (12582912 bytes in 8.070s)
WiMAX partition saved as 'HT15AHL06321_wimax.img'
Backing up Apps...
pull: building file list...
0 files pulled. 0 files skipped.
The system cannot find the path specified.
Flashing misc partition...
mtd: read all-zero block at 0x00000000; skipping
mtd: not writing bad block at 0x00080000
error writing misc: No space left on device
Rebooting in to bootloader...
Verifying bootloader status...
hBoot version '2.10.0001'
Version Major '2'
Version Minor '10'
Bootloader shows Firmware version 'ECHO'
Version Major 'ECHO'
Version Minor '' "
----------------------------------------
Now everytime i try to use my phone while it's on:
It doesnt charge while its on
I cant see SD card within the stock ROM
Phone constantly resets after about a minute
However in bootloader i can see the SD card, and the phone charges while its off. I ran the 3.70 RUU which went smoothly, however it did not fix anything =/
Any other ideas? is there a reason why my AutoRoot failed? I've rooted many HTC evo's and never had this problem/problems.
bigblueshock said:
So I just got a brand new HTC Evo replacement because my old one had power button issues.
I tried using Universal AutoRoot 2.5. CMD closed and I got this output:
"------------ AutoRoot.bat Begin - v2.5 - Tue 06/07/2011 23:33:14.63 ------------
Params=1'' 2'' 3'' 4'' 5'' 6''
Working Directory is 'C:\Users\Mark\Desktop\AutoRoot_v2.5\'. Admin='true'
Clearing Temp Files...
The directory name is invalid.
---------
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
INFO: No tasks are running which match the specified criteria.
---------
Phone SN is HT15AHL06321
PING ADB State Changed '1' out of '0'. ADB State is 'device' expected 'device'
Checking MTD configuration...
dev: size erasesize name
mtd0: 00c00000 00020000 "wimax"
mtd1: 000a0000 00020000 "misc"
mtd2: 00480000 00020000 "recovery"
mtd3: 00300000 00020000 "boot"
mtd4: 15e00000 00020000 "system"
mtd5: 0a000000 00020000 "cache"
mtd6: 1aba0000 00020000 "userdata"
'check.bat mtd' returned 'old'
MTD data being saved for phone 'HT15AHL06321'
'dev: size erasesize name mtd0: 00c00000 00020000 "wimax" mtd1: 000a0000 00020000 "misc" mtd2: 00480000 00020000 "recovery" mtd3: 00300000 00020000 "boot" mtd4: 15e00000 00020000 "system" mtd5: 0a000000 00020000 "cache" mtd6: 1aba0000 00020000 "userdata" '
EVO Branding 'sprint'
Firmware version '3.70.651.1'
Version Major '3'
Version Minor '70'
Battery is at 70 percent.
Checking for root...
UID is 'shell'
Installing exploit...
pkg: /data/local/tmp/AutoRoot.apk
Success
1593 KB/s (767044 bytes in 0.470s)
adb: Product directory not specified; use -p or define ANDROID_PRODUCT_OUT
Sending Intent...
Starting: Intent { act=android.intent.action.MAIN cmp=com.autoroot.getroot/.getroot }
Checking for root...
UID is 'Got Root!'
Checking for needed files...
Pushing res\mtd-eng.img to /sdcard/mtd-eng.img...
1570 KB/s (655360 bytes in 0.407s)
Pushing res\URFSOFF.zip to /sdcard/URFSOff.zip...
1255 KB/s (225014 bytes in 0.175s)
Pushing res\URFSON.zip to /sdcard/URFSOn.zip...
1159 KB/s (225551 bytes in 0.190s)
Dumping WiMAX partition...
rm failed for -s, Read-only file system
1522 KB/s (12582912 bytes in 8.070s)
WiMAX partition saved as 'HT15AHL06321_wimax.img'
Backing up Apps...
pull: building file list...
0 files pulled. 0 files skipped.
The system cannot find the path specified.
Flashing misc partition...
mtd: read all-zero block at 0x00000000; skipping
mtd: not writing bad block at 0x00080000
error writing misc: No space left on device
Rebooting in to bootloader...
Verifying bootloader status...
hBoot version '2.10.0001'
Version Major '2'
Version Minor '10'
Bootloader shows Firmware version 'ECHO'
Version Major 'ECHO'
Version Minor '' "
----------------------------------------
Now everytime i try to use my phone while it's on:
It doesnt charge while its on
I cant see SD card within the stock ROM
Phone constantly resets after about a minute
However in bootloader i can see the SD card, and the phone charges while its off. I ran the 3.70 RUU which went smoothly, however it did not fix anything =/
Any other ideas? is there a reason why my AutoRoot failed? I've rooted many HTC evo's and never had this problem/problems.
Click to expand...
Click to collapse
Well, I unfortunately don't have any experience with the Auto Root method. Hopefully xHausx will chime in here. Out of curiosity, your replacement phone did indeed have 2.2 on it, right? Because if it was updated to the OTA 2.3.3 that root method won't work. What is your software and hboot version?
Perhaps try running the RUU again?
I believe there is a thread around by Calkulin which addresses the issue of the phone not reading the sd card and not charging. I will see if I can dig that up for you. Good luck.
EDIT: Here is that thread by calkulin. I'm not sure if this will be able to help you out or not, but you can go through it anyways. When you boot to your bootloader, does it show S on or S off? What is the version number?
Flashing misc partition...
mtd: read all-zero block at 0x00000000; skipping
mtd: not writing bad block at 0x00080000
error writing misc: No space left on device
Click to expand...
Click to collapse
Your phone had some bad blocks there, that's strange for a new one. I can help you try to fix it but tbh your best bet is to run the 3.70 ruu and take it back for another. Otherwise odds are it'll start doing this again somewhere down the line.
xHausx said:
Your phone had some bad blocks there, that's strange for a new one. I can help you try to fix it but tbh your best bet is to run the 3.70 ruu and take it back for another. Otherwise odds are it'll start doing this again somewhere down the line.
Click to expand...
Click to collapse
Thanks Haus. Yea very odd... It's a brand new sealed 0004 model. I hope it's just luck of the straw. I'm going to head back to sprint later and get it replaced again. I just hope not all the new 0004's are like this. They dont have any refurbs in stock so they had to send me a brand new one.
bigblueshock said:
Thanks Haus. Yea very odd... It's a brand new sealed 0004 model. I hope it's just luck of the straw. I'm going to head back to sprint later and get it replaced again. I just hope not all the new 0004's are like this. They dont have any refurbs in stock so they had to send me a brand new one.
Click to expand...
Click to collapse
You should be good with another one, I've only had maybe 4 or 5 people have this happen before and up until now they were all refurbs. Just luck of the draw I guess.
edit: btw that speedtest result is sick, I would love to have a ping like that
The phone had stock 3.70 2.2 froyo. Phone is s-on with 2.10 bootloader, never got that far to get it s off
And yeah, too bad i just graduated from school, no more 100mbit pipe for me, was nice while it lasted
bigblueshock said:
The phone had stock 3.70 2.2 froyo. Phone is s-on with 2.10 bootloader, never got that far to get it s off
And yeah, too bad i just graduated from school, no more 100mbit pipe for me, was nice while it lasted
Click to expand...
Click to collapse
2.10 bootloader should work, it is the 2.19 one i believe that is locked.
So sprint swapped out the phone at the store. I'm pretty excited, he gave me a brand new White evo =)
I got home and autoroot worked flawlessly! Thanks again Haus for all your support and easy rooting techniques.
I'm not sure if this is the possible reason for my old phone bricking like that, but I'd like to share some knowledge.
My original 0004 model that sprint sent me was brand new, as well as the white evo 0004 sprint gave me was also brand new. While attempting to root the first replacement, 'check.bat mtd' returned 'old'. The second replacement white evo returned as "new". Not that i think it matters, but they both came with 2.10 bootloader and 3.70 base.
I have a strange feeling the first replacement had new block size, but for some reason a bug marked it as having the old block size. I just dont see how a brand new just made 0004 evo would have the old block size.
Could this have been the culprit?

[Q]How to get boot.img and recovery.img

Hi.
I'd like to get boot.img and recovery.img from my Acro(Arc)
I read this 'how to'.
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images
But I could not get same result.
Please tell me how to get it.
Recovery & boot are held on the same partition. So there is only one "boot.img".
Sent from my R800i using Tapatalk
Thank you.
I understood it.
But I can't find that partition.
Code:
~ # cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 13880000 00020000 "system"
mtd1: 00a00000 00020000 "appslog"
mtd2: 0e100000 00020000 "cache"
mtd3: 17c00000 00020000 "userdata"
How is it done?

Is there an easy way to unpack system.img and modify it?

I am using ubuntu 12.04.
I am trying following step.
1. compile yaffs2 kernel module and insmod yaffs2multi.ko
2. Simulate NAND
sudo modprobe mtd
sudo modprobe mtdblock
# Simulate a 1024MB 2048-byte erase-block sized MTD device backed by a file on disk,
sudo modprobe nandsim first_id_byte=0xec second_id_byte=0xd3 third_id_byte=0x51 fourth_id_byte=0x95
cat /proc/mtd
dev: size erasesize name
mtd0: 00400000 00020000 "mtdram test device"
mtd1: 40000000 00020000 "NAND simulator partition 0"
3. dd if=./system.img of=/dev/mtdblock1
4. mount sytem.img
mount -t yaffs2 /dev/mtdblock1 /tmp/system
ls /tmp/system/
lost+found
But there are no files in /tmp/system/.
What's wrong?
Is there an easy way to unpack system.img and modify it?

[GUIDE][RECOVERY] Rooting Guide + TWRP 2.8.7.0 Download (Beta)

Disclaimer: You must be S-OFF and on the latest update in order to do the following. This is because the current build of TWRP requires you to flash it to the boot partition, TWRP will not work as a normal recovery (ie flashing it to the recovery partition).
There is currently no known way to S-OFF without using an unlocking device such as a JTAG or something like XTC2Clip. Sunshine will likely work if you are able to obtain root, but there is no known method of obtaining root via an exploit for the Butterfly 3 at the moment.
To check if you are S-OFF, power off the device then hold Power + Volume Down. This will boot into Download Mode where you can view if you are S-OFF or not. I am not sure if you're required to also have your bootloader unlocked in order to root, but one individual I helped was not able to root without it.
Note: If you decide to unlock your bootloader, please be aware that it will reset your device to factory settings as well as delete all photos, music, videos and any other files you have saved to your internal storage. Please move what you can to your SD card or your PC if you are not willing to lose these files.
The following command will unlock your bootloader via fastboot:
Code:
fastboot oem unlock
TWRP Information:
Team Win Recovery Project 2.x, or twrp2 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
CHANGELOG for 2.8.7.0:
-Initial ground work for software drawn keyboard (_that)
-Fix handling of wiping internal storage on datamedia devices (xuefer)
-Allow DataManager to set and read values from the system properties (xuefer)
-Fix crash when taking screenshots on arm64 devices (xuefer)
-Fix error message after an ORS script completes (Dees_Troy)
-Fix crashes / error when creating encrypted backups (_that, Dees_Troy)
-Add system read only option -- more details below (Dees_Troy)
-Add resize2fs and GUI option to run resize2fs (Dees_Troy)
-Fix crash loop caused by empty lines in AOSP recovery command file (_that)
-Prevent duplicate page overlays such as multiple lock screens (mdmower)
Additional Notes:
We will consider this a "beta" build as it is not used in the manner you would normally use it on other devices. The touch screen will not function if you try to flash this as a standard recovery. It will, however, fully function when flashed to the boot partition. Please take caution when flashing anything to your boot partition!
The Github for this build of TWRP can be found here.
More information can be found on the official TWRP website here.
Rooting Your Phone:
Please download the files found at the bottom of this thread. You WILL require a PC for this. Please be sure you have the latest fastboot drivers installed for your device. The generic fastboot drivers should function as well. Fastboot drivers can be found here.
Step 1:
Download the files found at the bottom of this thread. "b3 recovery.zip" contains everything you will need for this process, minus the SuperSU zip (which can also be found at the bottom of this thread).
Step 2:
Extract the contents of "b3 recovery.zip" into a folder. Place the SuperSU zip somewhere on your device, either on an SD Card or in the internal storage.
Step 3:
Power off your device completely without a USB cable plugged in. Next, hold Power + Volume Down until you boot into "Download Mode". Once you are in "Download Mode", plug your phone into your computer via USB.
Step 4:
Open Command Prompt as Administrator in the folder you extracted the contents of "b3 recovery.zip" to. Type the following command to verify that your phone is connected to fastboot:
Code:
fastboot devices
If nothing shows up, or it says "OFFLINE", please make sure your fastboot drivers are properly installed. You will not be able to continue if your device is not connected.
Step 5:
Type the following command:
Code:
fastboot flash boot b3twrp.img
This should successfully flash TWRP to your boot partition. Now type the following command:
Code:
fastboot reboot
Assuming everything went well, you should now have booted into TWRP.
Step 6:
Note: It is highly recommended that you do a full backup of your device before continuing. This will ensure that you are able to restore your device should anything go wrong and it will also allow you to receive OTA updates in the future.
Now that you are in TWRP, install/flash the SuperSU zip you placed on your device. Once it has completed, wipe your cache. Now reboot into "Download Mode".
Step 7:
Once you are back in "Download Mode", type the following command:
Code:
fastboot flash boot stockboot.img
It should flash successfully. Reboot your device.
Assuming everything went well, you should now be rooted! The initial boot will take some time and you may notice some slowdown at first but rest assured that your phone is fine and will function normally.
Downloads:
Fastboot/ADB, TWRP and stock boot image: b3 recovery.zip
SuperSU-v2.46.zip
Credits:
A big thanks and props to @tomkins0752 and @boa19861105 for getting this build of TWRP working for our phones. Without them, we would not have root.
If anyone has any suggestions or sees any issue with this post, please let me know and I will correct any errors.
DarkRazorZ said:
Disclaimer: You must be S-OFF and on the latest update in order to do the following. This is because the current build of TWRP requires you to flash it to the boot partition, TWRP will not work as a normal recovery (ie flashing it to the recovery partition).
There is currently no known way to S-OFF without using an unlocking device such as a JTAG or something like XTC2Clip. Sunshine will likely work if you are able to obtain root, but there is no known method of obtaining root via an exploit for the Butterfly 3 at the moment.
To check if you are S-OFF, power off the device then hold Power + Volume Down. This will boot into Download Mode where you can view if you are S-OFF or not. I am not sure if you're required to also have your bootloader unlocked in order to root, but one individual I helped was not able to root without it.
Note: If you decide to unlock your bootloader, please be aware that it will reset your device to factory settings as well as delete all photos, music, videos and any other files you have saved to your internal storage. Please move what you can to your SD card or your PC if you are not willing to lose these files.
The following command will unlock your bootloader via fastboot:
Code:
fastboot oem unlock
TWRP Information:
Team Win Recovery Project 2.x, or twrp2 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.
CHANGELOG for 2.8.7.0:
-Initial ground work for software drawn keyboard (_that)
-Fix handling of wiping internal storage on datamedia devices (xuefer)
-Allow DataManager to set and read values from the system properties (xuefer)
-Fix crash when taking screenshots on arm64 devices (xuefer)
-Fix error message after an ORS script completes (Dees_Troy)
-Fix crashes / error when creating encrypted backups (_that, Dees_Troy)
-Add system read only option -- more details below (Dees_Troy)
-Add resize2fs and GUI option to run resize2fs (Dees_Troy)
-Fix crash loop caused by empty lines in AOSP recovery command file (_that)
-Prevent duplicate page overlays such as multiple lock screens (mdmower)
Additional Notes:
We will consider this a "beta" build as it is not used in the manner you would normally use it on other devices. The touch screen will not function if you try to flash this as a standard recovery. It will, however, fully function when flashed to the boot partition. Please take caution when flashing anything to your boot partition!
The Github for this build of TWRP can be found here.
More information can be found on the official TWRP website here.
Rooting Your Phone:
Please download the files found at the bottom of this thread. You WILL require a PC for this. Please be sure you have the latest fastboot drivers installed for your device. The generic fastboot drivers should function as well. Fastboot drivers can be found here.
Step 1:
Download the files found at the bottom of this thread. "b3 recovery.zip" contains everything you will need for this process, minus the SuperSU zip (which can also be found at the bottom of this thread).
Step 2:
Extract the contents of "b3 recovery.zip" into a folder. Place the SuperSU zip somewhere on your device, either on an SD Card or in the internal storage.
Step 3:
Power off your device completely without a USB cable plugged in. Next, hold Power + Volume Down until you boot into "Download Mode". Once you are in "Download Mode", plug your phone into your computer via USB.
Step 4:
Open Command Prompt as Administrator in the folder you extracted the contents of "b3 recovery.zip" to. Type the following command to verify that your phone is connected to fastboot:
Code:
fastboot devices
If nothing shows up, or it says "OFFLINE", please make sure your fastboot drivers are properly installed. You will not be able to continue if your device is not connected.
Step 5:
Type the following command:
Code:
fastboot flash boot b3twrp.img
This should successfully flash TWRP to your boot partition. Now type the following command:
Code:
fastboot reboot
Assuming everything went well, you should now have booted into TWRP.
Step 6:
Note: It is highly recommended that you do a full backup of your device before continuing. This will ensure that you are able to restore your device should anything go wrong and it will also allow you to receive OTA updates in the future.
Now that you are in TWRP, install/flash the SuperSU zip you placed on your device. Once it has completed, wipe your cache. Now reboot into "Download Mode".
Step 7:
Once you are back in "Download Mode", type the following command:
Code:
fastboot flash boot stockboot.img
It should flash successfully. Reboot your device.
Assuming everything went well, you should now be rooted! The initial boot will take some time and you may notice some slowdown at first but rest assured that your phone is fine and will function normally.
Downloads:
Fastboot/ADB, TWRP and stock boot image: b3 recovery.zip
SuperSU-v2.46.zip
Credits:
A big thanks and props to @tomkins0752 and @boa19861105 for getting this build of TWRP working for our phones. Without them, we would not have root.
If anyone has any suggestions or sees any issue with this post, please let me know and I will correct any errors.
Click to expand...
Click to collapse
htc htv31 (butterfly 3 japan)
s-off, super cid, unlockbootloader ok by xtc2clip.
flash twrp.img ok, boot to recovery mode, twrp 2.8.7.0 (BOA-Butterfly3)
.. but i can't touch/swipe..
how to fix ?
_log_
C:\Documents and Settings\Admin\My Documents\b3 recovery>cmd
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Admin\My Documents\b3 recovery>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_b3uhl
(bootloader) version: 1.0
(bootloader) imei: 357763---
(bootloader) version-main: 1.03.970.7
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PL210000
(bootloader) cid: 11111111
all:
finished. total time: 0.016s
C:\Documents and Settings\Admin\My Documents\b3 recovery>fastboot flash recovery
b3twrp.img
target reported max download size of 800000000 bytes
sending 'recovery' (36744 KB)...
OKAY [ 2.953s]
writing 'recovery'...
(bootloader) HOSD CL#561421
(bootloader) [email protected]
(bootloader) [email protected]%
(bootloader) Update partition OK
(bootloader) [email protected]
OKAY [ 2.859s]
finished. total time: 5.812s
C:\Documents and Settings\Admin\My Documents\b3 recovery>adb shell
error: device not found
C:\Documents and Settings\Admin\My Documents\b3 recovery>adb shell
adb server is out of date. killing...
* daemon started successfully *
~ # ←[6ncat /proc/partitions
cat /proc/partitions
major minor #blocks name
179 0 30535680 mmcblk0
179 1 16 mmcblk0p1
179 2 4096 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 40960 mmcblk0p5
179 6 2015 mmcblk0p6
179 7 256 mmcblk0p7
179 8 24255 mmcblk0p8
179 9 512 mmcblk0p9
179 10 2048 mmcblk0p10
179 11 96 mmcblk0p11
179 12 2048 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 10240 mmcblk0p14
179 15 10240 mmcblk0p15
259 0 1024 mmcblk0p16
259 1 1024 mmcblk0p17
259 2 1024 mmcblk0p18
259 3 1024 mmcblk0p19
259 4 1024 mmcblk0p20
259 5 1024 mmcblk0p21
259 6 1024 mmcblk0p22
259 7 1024 mmcblk0p23
259 8 1024 mmcblk0p24
259 9 1536 mmcblk0p25
259 10 60417 mmcblk0p26
259 11 20480 mmcblk0p27
259 12 1 mmcblk0p28
259 13 1844 mmcblk0p29
259 14 3243 mmcblk0p30
259 15 22528 mmcblk0p31
259 16 10240 mmcblk0p32
259 17 1024 mmcblk0p33
259 18 1536 mmcblk0p34
259 19 1536 mmcblk0p35
259 20 20480 mmcblk0p36
259 21 30720 mmcblk0p37
259 22 256 mmcblk0p38
259 23 16 mmcblk0p39
259 24 64 mmcblk0p40
259 25 1024 mmcblk0p41
259 26 1 mmcblk0p42
259 27 8 mmcblk0p43
259 28 512 mmcblk0p44
259 29 128 mmcblk0p45
259 30 1024 mmcblk0p46
259 31 10 mmcblk0p47
259 32 1281 mmcblk0p48
259 33 512 mmcblk0p49
259 34 2048 mmcblk0p50
259 35 20480 mmcblk0p51
259 36 256 mmcblk0p52
259 37 128 mmcblk0p53
259 38 128 mmcblk0p54
259 39 128 mmcblk0p55
259 40 128 mmcblk0p56
259 41 128 mmcblk0p57
259 42 128 mmcblk0p58
259 43 128 mmcblk0p59
259 44 128 mmcblk0p60
259 45 8192 mmcblk0p61
259 46 10240 mmcblk0p62
259 47 12316 mmcblk0p63
259 48 65536 mmcblk0p64
259 49 65536 mmcblk0p65
259 50 65536 mmcblk0p66
259 51 262144 mmcblk0p67
259 52 4587520 mmcblk0p68
259 53 24641536 mmcblk0p69
259 54 296960 mmcblk0p70
259 55 20480 mmcblk0p71
259 56 61440 mmcblk0p72
179 16 4096 mmcblk0rpmb
~ # ←[6ncat /proc/emmc
cat /proc/emmc
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 00100000 00000200 "pmic"
mmcblk0p5: 02800000 00000200 "dummy"
mmcblk0p6: 001f7c00 00000200 "reserve_1"
mmcblk0p7: 00040000 00000200 "mfg"
mmcblk0p8: 017afc00 00000200 "pg2fs"
mmcblk0p9: 00080000 00000200 "rpm"
mmcblk0p10: 00200000 00000200 "tz"
mmcblk0p11: 00018000 00000200 "sdi"
mmcblk0p12: 00200000 00000200 "hyp"
mmcblk0p13: 00100000 00000200 "aboot"
mmcblk0p14: 00a00000 00000200 "tool_diag"
mmcblk0p15: 00a00000 00000200 "sp1"
mmcblk0p16: 00100000 00000200 "ddr"
mmcblk0p17: 00100000 00000200 "rfg_0"
mmcblk0p18: 00100000 00000200 "rfg_1"
mmcblk0p19: 00100000 00000200 "rfg_2"
mmcblk0p20: 00100000 00000200 "rfg_3"
mmcblk0p21: 00100000 00000200 "rfg_4"
mmcblk0p22: 00100000 00000200 "rfg_5"
mmcblk0p23: 00100000 00000200 "rfg_6"
mmcblk0p24: 00100000 00000200 "rfg_7"
mmcblk0p25: 00180000 00000200 "fsg"
mmcblk0p26: 03b00400 00000200 "radio"
mmcblk0p27: 01400000 00000200 "adsp"
mmcblk0p28: 00000400 00000200 "limits"
mmcblk0p29: 001cd000 00000200 "camera"
mmcblk0p30: 0032ac00 00000200 "reserve_2"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00a00000 00000200 "ramdump"
mmcblk0p33: 00100000 00000200 "misc"
mmcblk0p34: 00180000 00000200 "modem_st1"
mmcblk0p35: 00180000 00000200 "modem_st2"
mmcblk0p36: 01400000 00000200 "fataldevlog"
mmcblk0p37: 01e00000 00000200 "devlog"
mmcblk0p38: 00040000 00000200 "pdata"
mmcblk0p39: 00004000 00000200 "control"
mmcblk0p40: 00010000 00000200 "extra"
mmcblk0p41: 00100000 00000200 "cdma_record"
mmcblk0p42: 00000400 00000200 "fsc"
mmcblk0p43: 00002000 00000200 "ssd"
mmcblk0p44: 00080000 00000200 "sensor_hub"
mmcblk0p45: 00020000 00000200 "sec"
mmcblk0p46: 00100000 00000200 "abootbak"
mmcblk0p47: 00002800 00000200 "cir_img"
mmcblk0p48: 00140400 00000200 "local"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 00200000 00000200 "cpe"
mmcblk0p51: 01400000 00000200 "carrier"
mmcblk0p52: 00040000 00000200 "skylink"
mmcblk0p53: 00020000 00000200 "rfg_8"
mmcblk0p54: 00020000 00000200 "rfg_9"
mmcblk0p55: 00020000 00000200 "rfg_10"
mmcblk0p56: 00020000 00000200 "rfg_11"
mmcblk0p57: 00020000 00000200 "rfg_12"
mmcblk0p58: 00020000 00000200 "rfg_13"
mmcblk0p59: 00020000 00000200 "rfg_14"
mmcblk0p60: 00020000 00000200 "rfg_15"
mmcblk0p61: 00800000 00000200 "absolute"
mmcblk0p62: 00a00000 00000200 "battery"
mmcblk0p63: 00c07000 00000200 "reserve"
mmcblk0p64: 04000000 00000200 "hosd"
mmcblk0p65: 04000000 00000200 "boot"
mmcblk0p66: 04000000 00000200 "recovery"
mmcblk0p67: 10000000 00000200 "cache"
mmcblk0p68: 18000000 00000200 "system"
mmcblk0p69: e0000000 00000200 "userdata"
mmcblk0p70: 12200000 00000200 "apppreload"
mmcblk0p71: 01400000 00000200 "nfc_record"
mmcblk0p72: 03c00000 00000200 "cota"
~ # ←[6n
C:\Documents and Settings\Admin\My Documents\b3 recovery>
The recovery has to be flashed to the boot partition. This is mentioned in the disclaimer at the beginning of the post. The b3 recovery zip contains the stock boot.img for the latest update so you can flash it after you are done with the recovery. Please back up your boot.img if you are not on the latest update.
@@.............................
boa19861105 said:
@@.............................
Click to expand...
Click to collapse
Where? When?!
I have tried three times with your method strictly, but there is no change at all with this phone. There is still no supersu. Could you tell me why？
HTV31 s-off by xtc2
wumilun said:
I have tried three times with your method strictly, but there is no change at all with this phone. There is still no supersu. Could you tell me why？
HTV31 s-off by xtc2
Click to expand...
Click to collapse
There's no "SuperSU Install" or SuperSU app? I would say try installing it from the Play Store to see if that fixes anything but it should be working fine after flashing the SuperSU binary.
DarkRazorZ said:
Disclaimer: You must be S-OFF and on the latest update in order to do the following. This is because the current build of TWRP requires you to flash it to the boot partition, TWRP will not work as a normal recovery (ie flashing it to the recovery partition).
There is currently no known way to S-OFF without using an unlocking device such as a JTAG or something like XTC2Clip. Sunshine will likely work if you are able to obtain root, but there is no known method of obtaining root via an exploit for the Butterfly 3 at the moment.
.
Click to expand...
Click to collapse
Hey buddy, tried all process just as you describe, all went ok, no errors, all as you mentioned, but at the end my device still says Not Rooted.
Only thing I didnt, do is unlock bootloader via HTC as I was not able to do it but Im S-OFF.
HTCDev error> Error Code: 170.
Error Reason: CID Not Allowed.
Any light is welcome.
Thanks
orb3000 said:
Hey buddy, tried all process just as you describe, all went ok, no errors, all as you mentioned, but at the end my device still says Not Rooted.
Only thing I didnt, do is unlock bootloader via HTC as I was not able to do it but Im S-OFF.
HTCDev error> Error Code: 170.
Error Reason: CID Not Allowed.
Any light is welcome.
Thanks
Click to expand...
Click to collapse
I'm not sure why this issue is occurring for some but not others. A few of us our rooted via this method.
You can't use HTCDev to unlock the bootloader, you have to unlock your bootloader via fastboot.
DarkRazorZ said:
I'm not sure why this issue is occurring for some but not others. A few of us our rooted via this method.
You can't use HTCDev to unlock the bootloader, you have to unlock your bootloader via fastboot.
Click to expand...
Click to collapse
Have read more and will need to change my CID via fastboot, then I am able to unlock via HTC, as i am not sure how to unlock via fastboot.
Arigato for your answer
orb3000 said:
Have read more and will need to change my CID via fastboot, then I am able to unlock via HTC, as i am not sure how to unlock via fastboot.
Arigato for your answer
Click to expand...
Click to collapse
If you type "oem unlock bootloader" in fastboot mode it should prompt you to unlock, very easy to do. Either way, unlocking your bootloader will wipe your phone's contents though so make sure you back everything up first
DarkRazorZ said:
If you type "oem unlock bootloader" in fastboot mode it should prompt you to unlock, very easy to do. Either way, unlocking your bootloader will wipe your phone's contents though so make sure you back everything up first
Click to expand...
Click to collapse
Actually used the command [fastboot oem writecid 11111111] and all went ok! Now rooted.
You may want to include that info on your first post
Many thanks
orb3000 said:
Actually used the command [fastboot oem writecid 11111111] and all went ok! Now rooted.
You may want to include that info on your first post
Many thanks
Click to expand...
Click to collapse
I'll add it. So unlocking your bootloader made root work?
DarkRazorZ said:
I'll add it. So unlocking your bootloader made root work?
Click to expand...
Click to collapse
Exactly, after unlock bootloader your guide works perfect!
If compiled from boa19861105 source on github, TWRP is now fully functioning for the Butterfly 3.
I could not compile it with error.
I don't know much about Linux.
Can anyone upload img file?
Makefile:795: *** multiple target patterns. Stop.
Hi, any kind soul able to share their backup of the HTV31 stock recovery? My phone was already rooted when I got it with no backup of the stock recovery so I have no way to get OTA updates :'(
Hi there, I've been trying to unlock the bootloader via fastboot when phone is in download mode but none of the commands worked for me... adb devices shows that my phone is connected.
I've tried:
- fastboot oem writecid 11111111
- oem unlock bootloader
- fastboot oem unlock
- fastboot flashing unlock
Keep getting FAILED <remote: unknown command>
Many thanks in advance
Edit: also tried in bootloader mode, and nothing.
Edit: when trying fastboot oem unlock when phone is switched on to normal mode, I'm stuck on <waiting for device>
If I'm not mistaken, you actually only need an unlocked bootloader.
An unlocked bootloader will give you r/w access of the boot, system and recovery partitions.
r/w access of the boot partition is needed for this guide.
S-off is not needed to get boot partition r/w access.
So that is why some people couldn't get it working without an unlocked bootloader.
I hope someone can confirm this!
still not rooted
Hi,
I am very new to this forum, so thank you all for your time and guidance.
I have a HTV31SWA. From the download mode I see that I am locked, S-OFF, with CID 11111111 (I suppose I have the bootloader unlocked). The OS is 1.11.970.1.
I have tried to follow the guide below, I am successfull in all the steps (at least, I get no errors) but I get not root access. Actually I am stricly following the guide steps so I do not understand what I can do more. Any help would be very much appreciated.
Actually the phone comes with restrictions in the GPS activation, wifi thetering and other limitation. That's why it is vital to me to get the root access!
Thank you very much.
DarkRazorZ said:
Disclaimer: You must be S-OFF and on the latest update in order to do the following. This is because the current build of TWRP requires you to flash it to the boot partition, TWRP will not work as a normal recovery (ie flashing it to the recovery partition).
There is currently no known way to S-OFF without using an unlocking device such as a JTAG or something like XTC2Clip. Sunshine will likely work if you are able to obtain root, but there is no known method of obtaining root via an exploit for the Butterfly 3 at the moment.
To check if you are S-OFF, power off the device then hold Power + Volume Down. This will boot into Download Mode where you can view if you are S-OFF or not. I am not sure if you're required to also have your bootloader unlocked in order to root, but one individual I helped was not able to root without it.
Note: If you decide to unlock your bootloader, please be aware that it will reset your device to factory settings as well as delete all photos, music, videos and any other files you have saved to your internal storage. Please move what you can to your SD card or your PC if you are not willing to lose these files.
The following command will unlock your bootloader via fastboot:
Code:
fastboot oem unlock
TWRP Information:
Team Win Recovery Project 2.x, or twrp2 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.
CHANGELOG for 2.8.7.0:
-Initial ground work for software drawn keyboard (_that)
-Fix handling of wiping internal storage on datamedia devices (xuefer)
-Allow DataManager to set and read values from the system properties (xuefer)
-Fix crash when taking screenshots on arm64 devices (xuefer)
-Fix error message after an ORS script completes (Dees_Troy)
-Fix crashes / error when creating encrypted backups (_that, Dees_Troy)
-Add system read only option -- more details below (Dees_Troy)
-Add resize2fs and GUI option to run resize2fs (Dees_Troy)
-Fix crash loop caused by empty lines in AOSP recovery command file (_that)
-Prevent duplicate page overlays such as multiple lock screens (mdmower)
Additional Notes:
We will consider this a "beta" build as it is not used in the manner you would normally use it on other devices. The touch screen will not function if you try to flash this as a standard recovery. It will, however, fully function when flashed to the boot partition. Please take caution when flashing anything to your boot partition!
The Github for this build of TWRP can be found here.
More information can be found on the official TWRP website here.
Rooting Your Phone:
Please download the files found at the bottom of this thread. You WILL require a PC for this. Please be sure you have the latest fastboot drivers installed for your device. The generic fastboot drivers should function as well. Fastboot drivers can be found here.
Step 1:
Download the files found at the bottom of this thread. "b3 recovery.zip" contains everything you will need for this process, minus the SuperSU zip (which can also be found at the bottom of this thread).
Step 2:
Extract the contents of "b3 recovery.zip" into a folder. Place the SuperSU zip somewhere on your device, either on an SD Card or in the internal storage.
Step 3:
Power off your device completely without a USB cable plugged in. Next, hold Power + Volume Down until you boot into "Download Mode". Once you are in "Download Mode", plug your phone into your computer via USB.
Step 4:
Open Command Prompt as Administrator in the folder you extracted the contents of "b3 recovery.zip" to. Type the following command to verify that your phone is connected to fastboot:
Code:
fastboot devices
If nothing shows up, or it says "OFFLINE", please make sure your fastboot drivers are properly installed. You will not be able to continue if your device is not connected.
Step 5:
Type the following command:
Code:
fastboot flash boot b3twrp.img
This should successfully flash TWRP to your boot partition. Now type the following command:
Code:
fastboot reboot
Assuming everything went well, you should now have booted into TWRP.
Step 6:
Note: It is highly recommended that you do a full backup of your device before continuing. This will ensure that you are able to restore your device should anything go wrong and it will also allow you to receive OTA updates in the future.
Now that you are in TWRP, install/flash the SuperSU zip you placed on your device. Once it has completed, wipe your cache. Now reboot into "Download Mode".
Step 7:
Once you are back in "Download Mode", type the following command:
Code:
fastboot flash boot stockboot.img
It should flash successfully. Reboot your device.
Assuming everything went well, you should now be rooted! The initial boot will take some time and you may notice some slowdown at first but rest assured that your phone is fine and will function normally.
Downloads:
Fastboot/ADB, TWRP and stock boot image: b3 recovery.zip
SuperSU-v2.46.zip
Credits:
A big thanks and props to @tomkins0752 and @boa19861105 for getting this build of TWRP working for our phones. Without them, we would not have root.
If anyone has any suggestions or sees any issue with this post, please let me know and I will correct any errors.
Click to expand...
Click to collapse

Categories

Resources