Develop Bugs

[REQUEST] Stock System Dump DJ20 & DL17

Similar to Adrynalyne's post, I would greatly appreciate anyone that could do this. What I am looking for is a dump from a completely stock system, the only requirement is that you be rooted. So, if ANYONE has a completely stock Continuum and would be willing to do this, that would be great. It would also be good to get this from both DJ20 and DL17 if possible, but even getting it from just one of the two would be great. Here are the steps to produce the files.
This is easiest to do via adb.
As root (#)
To backup the .lfs partition
Code:
dd if=/dev/block/stl6 of=/sdcard/param.lfs bs=4096
To backup the kernel parition:
Code:
dd if=/dev/block/bml7 of=/sdcard/zImage bs=4096
To backup the recovery partition:
Code:
dd if=/dev/block/bml8 of=/sdcard/recovery.bin bs=4096
To backup the system partition:
Code:
dd if=/dev/block/stl9 of=/sdcard/factoryfs.rfs bs=4096
To backup the dbdata partition:
Code:
dd if=/dev/block/stl10 of=/sdcard/dbdata.rfs bs=4096
To backup the cache partition:
Code:
dd if=/dev/block/stl11 of=/sdcard/cache.rfs bs=4096
Once you have the files, zip them together and upload them to a sharing site (Dropbox, MediaFire, Megaupload, personal webhost, etc.) and post a link to them. If you don't want the link in the public, feel free to PM me a link to download the file. Once we have these, it will be much easier to do development work, especially with the voodoo kernel. Thank you to anyone that follows this and sends files.
EDIT: Received stock DJ20, which is a definite plus. Now for DL17

is it possible to grab these from a non-activated continuum?
I still have that phone that won't boot if you end up with something you'd like to try... for now..buddy's leg is broken and he's not moving around too much right now.. plus he's been playing on a droid X...

dottat said:
is it possible to grab these from a non-activated continuum?
I still have that phone that won't boot if you end up with something you'd like to try... for now..buddy's leg is broken and he's not moving around too much right now.. plus he's been playing on a droid X...
Click to expand...
Click to collapse
It is possible as far as I know. The only thing this really requires is root access, the phone being activated shouldn't really do anything to the file dump. If you'd like to try to resurrect the dead phone, I'll be posting up a DJ20 Odin file later tonight or tomorrow morning that should hopefully work to fix it if all that is dead is the file system structure.

Yah,
it if nearly impossible to brick the galaxy s phones (as long as you see the samsung logo even for a second), because we can use odin.. The only problem is getting the files to flash to fix it xP
Dottat: since you are not using this phone, may you please allow us to use this device for our sake? We need a device to send to the devs
Please man, it would be much appreciated and, you would eventually get it back, so no worries <3

Well... this phone is due back to the carrier (surprised they haven't called for it yet).... so at this point i would just like to prove proof of concept on the recovery piece. Download mode is all this phone will do so i'll be curious to see where we get with the odin imnuts is posting tonight..

imnuts said:
Similar to Adrynalyne's post, I would greatly appreciate anyone that could do this. What I am looking for is a dump from a completely stock system, the only requirement is that you be rooted. So, if ANYONE has a completely stock Continuum and would be willing to do this, that would be great. It would also be good to get this from both DJ20 and DL17 if possible, but even getting it from just one of the two would be great. Here are the steps to produce the files.
This is easiest to do via adb.
As root (#)
To backup the .lfs partition
Code:
dd if=/dev/block/stl6 of=/sdcard/param.lfs bs=4096
To backup the kernel parition:
Code:
dd if=/dev/block/bml7 of=/sdcard/zImage bs=4096
To backup the recovery partition:
Code:
dd if=/dev/block/bml8 of=/sdcard/recovery.bin bs=4096
To backup the system partition:
Code:
dd if=/dev/block/stl9 of=/sdcard/factoryfs.rfs bs=4096
To backup the dbdata partition:
Code:
dd if=/dev/block/stl10 of=/sdcard/dbdata.rfs bs=4096
To backup the cache partition:
Code:
dd if=/dev/block/stl11 of=/sdcard/cache.rfs bs=4096
Once you have the files, zip them together and upload them to a sharing site (Dropbox, MediaFire, Megaupload, personal webhost, etc.) and post a link to them. If you don't want the link in the public, feel free to PM me a link to download the file. Once we have these, it will be much easier to do development work, especially with the voodoo kernel. Thank you to anyone that follows this and sends files.
EDIT: Received stock DJ20, which is a definite plus. Now for DL17
Click to expand...
Click to collapse
Unable to dump . Keep getting this error with each block.

sdcard
sdcard not sdram

PZ PZ
I have a DL17 I want to root the phone but i dont want to make my phone un-returnable if something were to happen to it. so My question is what does Verizon consider illegal software. Does this mean root and all Available after market roms. is it the same as buying a new car on loan and putting after market parts Rather.?

remotehunger said:
I have a DL17 I want to root the phone but i dont want to make my phone un-returnable if something were to happen to it. so My question is what does Verizon consider illegal software. Does this mean root and all Available after market roms. is it the same as buying a new car on loan and putting after market parts Rather.?
Click to expand...
Click to collapse
rooting does void your carrier warranty...but not your samsung warranty...
however if you unroot/return to stock before returning your phone for whatever reason thats fine, they wouldnt know
*if* you brick your phone (nearly impossible to do with odin files) and try and return after a mod/rom gone bad....thats a big no-no...and the reason carriers/oems are locking down devices.
read up on rooting and the pros/cons before diving in...but for the most part if you are careful...its safe

I know how I know how I'm pretty experienced I have rooted 5 phones including hero cdma a droid erris to touch pro 2 2 different carriers also some minor a developing a bit but the only thing is I don't wanna have to send it samsung is something
Sent from my SCH-I400 using XDA App

if something does go wrong because accidents do happen I just wanna make sure that the phone is
unrootable and that there are available stock odin files but other then that I would be more than happy to dump for you guys and I could possibly help with the dip in developing as well give me your instant messenger or phone number so we can get together
Sent from my SCH-I400 using XDA App
EDIT: i must've been high LOL!

i was wondering if anyone knows where i can get all of these as i sorta repartitioned the phone and lost everything on it. i can get it into download mode just fine just im missing alot of peices. it loads the factory.rfs fine but i think the bootloader is gone. i even managed to get it into clockwork but since the boot partition is kinda messed up it wont boot into anything else. since theres not a factory firmware that i can find im sorta stuck

Nexus stuck on loading screen?

I've just flashed the boot.img and system.img from Peter Alfonso:
http://www.peteralfonso.com/2011/11/download-100-stock-fastboot-images-for.html
Boot.img worked fine after the reboot. I've flashed the system.img now and its been on the pretty colours screen for a good few minutes.
Anyone got any ideas? Trying to unroot my device

Anyone :'(
Sent from my iPad 2 using Tapatalk

Can someone please upload their system.img so I can flash it.
Sent from my iPad 2 using Tapatalk

I believe your problem is that those images are for the VZW LTE version and the build.prop is telling the system to use the LTE ril and you have a GSM radio. There may be other discrepancies as well between versions. Check to development forum for a GSM system and
boot image that you can fastboot to restore your phone.

cellzealot said:
I believe your problem is that those images are for the VZW LTE version and the build.prop is telling the system to use the LTE ril and you have a GSM radio. There may be other discrepancies as well between versions. Check to development forum for a GSM system and
boot image that you can fastboot to restore your phone.
Click to expand...
Click to collapse
They are for a GSM version I believe aren't they. I cant find a system.img anywhere

I think I was wrong, I read about updating the VZW images when its released and got confused sorry.
Not sure why it might have hosed your phone. Have you tried reflashing it in fastboot?

cellzealot said:
I think I was wrong, I read about updating the VZW images when its released and got confused sorry.
Not sure why it might have hosed your phone. Have you tried reflashing it in fastboot?
Click to expand...
Click to collapse
yep. I did ./fastboot flash system system.img
Just gets in a loop on the loading screen

Could I flash the CWM image in fastboot and install the modaco rom? Would that work?

Theoretically, yes it should, but I was hesitant to suggest something like that because we weren't sure what caused the issue to begin with. If you are willing to give it a shot and have already resigned yourself to losing your warranty, then it seems worth a try.
At this point, the safest thing would be to wait until an OTA update is pushed out and it will either fix everything or give you a clearer chance at getting it replaced under warranty.
Not a very satisfying answer, sorry.

cellzealot said:
Theoretically, yes it should, but I was hesitant to suggest something like that because we weren't sure what caused the issue to begin with. If you are willing to give it a shot and have already resigned yourself to losing your warranty, then it seems worth a try.
At this point, the safest thing would be to wait until an OTA update is pushed out and it will either fix everything or give you a clearer chance at getting it replaced under warranty.
Not a very satisfying answer, sorry.
Click to expand...
Click to collapse
The issue occured when i flashed the system.img. The boot.img from his package worked fine.
I can only get the device into fastboot it seems, so I cant adb push the ROM to the device anyway :'(

http://forum.xda-developers.com/showthread.php?t=1352347
Did you try downloading the images from that thread? They may work better for you since they were pulled from a UK device.

Do you mean the DD image? I was a bit weary as it was 600mb .img file and a normal system.img is 250mb
Not entirely sure what that is and don't want to make it worse. Also, not sure what the zip file is either
Sent from my iPad 2 using Tapatalk

Evostance said:
Do you mean the DD image? I was a bit weary as it was 600mb .img file and a normal system.img is 250mb
Not entirely sure what that is and don't want to make it worse. Also, not sure what the zip file is either
Sent from my iPad 2 using Tapatalk
Click to expand...
Click to collapse
It's probably a sparse image judging from the size of it. If it compresses down to a normal size when you zip it you will know if my guess was correct.
Not sure how you would flash those though, other than using dd to write them back.

blunden said:
It's probably a sparse image judging from the size of it. If it compresses down to a normal size when you zip it you will know if my guess was correct.
Not sure how you would flash those though, other than using dd to write them back.
Click to expand...
Click to collapse
He has put
cd dump
adb pull /system system
## Edited /META-INF/com/google/android/update-script with:
## show_progress 0.1 0
##
## copy_dir PACKAGE:system SYSTEM:
## set_perm_recursive 0 0 0755 0644 SYSTEM:app
## show_progress 0.1 10
##
## Zip system and META-INF folders into gnsys.zip
## Signed using testsign.jar
So the system is in gnsys.zip and fasboot can flash system via a zip I take it.
I have no idea how to use dd either :/

Evostance said:
He has put
cd dump
adb pull /system system
## Edited /META-INF/com/google/android/update-script with:
## show_progress 0.1 0
##
## copy_dir PACKAGE:system SYSTEM:
## set_perm_recursive 0 0 0755 0644 SYSTEM:app
## show_progress 0.1 10
##
## Zip system and META-INF folders into gnsys.zip
## Signed using testsign.jar
So the system is in gnsys.zip and fasboot can flash system via a zip I take it.
I have no idea how to use dd either :/
Click to expand...
Click to collapse
If it's an update.zip is has to be flashed using recovery, a custom recovery in this case since the signature will be changed or incorrect.
My dd comment was referring to what parts of the emmc you should set as the output. Using dd in general is not a problem, even though one should always be careful when using it.

Rather than try to cobble together a solution, I think it's probably best to wait until someone posts a proper system image or an official set of stock images is made available. While I believe it could very well work and should, I just think its safer to try to restore it with known good images, especially since you haven't done anything that extreme yet and the fix should be very simple.
That is the frustrating part because all you need is the right set of images to restore.
Edit: /system is about 643MBs when you use dd to make an image and mmcblk0p10 is the /system partition
I am generally all for DIY solutions but without a safety net of stock images this early, when an official solution is likely to be made available shortly, I recommend waiting.

OK cheers guys.
Won't the OTA just have part of a system rather than the lock?
I've got in contact with Pete so might try see of we can solve that. If not, hopefully patch will be out before Wednesday so I can flash and send back.
Failing that I'll have to hope someone accepts it anyway
Sent from my HTC Desire HD using Tapatalk

How to backup your modem.

There is a modem for the optimus G here:
http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
but it is from firmware 10b. You may want to try if it works better than your firmware. In this case, it is better if you make a backup of your current modem firmware, so you can go back to your version. Here I will write instructions to backup your modem, so you can restore it if you need.
Probably some of you know this already and feel like these are old news, but maybe we can build a modem firmware library.
You need root and a way to make an adb connection to your phone. If you cannot use adb, you can always use a terminal emulator on your phone, but this makes it a bit harder to type the commands. Also, this is for people who understand what they are doing. If after reading the tutorial you don't understand what the commands do, please don't try it. Or at least don't make me responsible if your phone bricks. Here we go.
NON NEEDED STEPS: This steps are here to show why this works.
1-Connect to your phone by adb.
2- On the terminal type :
Code:
mount
You'll see the following (amongst other things):
Code:
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:radio_efs_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
This means that the partition containing the firmware is /dev/block/platform/msm_sdcc.1/by-name/modem and it is mounted at /firmware.
NEEDED STEPS
1- Connect by adb
2- On the terminal type
Code:
su
Check if confirmation is needed on the phone screen. If needed, accept.
3-
On the terminal type:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
4-You will receive the following after some seconds:
Code:
131072+0 records in
131072+0 records out
67108864 bytes transferred in 29.959 secs (2240023 bytes/sec)
5-Type
Code:
exit
exit
adb pull /sdcard/modem.img
6-Now you have your backup.
HOW TO PACK THIS BACKUP FOR FLASH:
1-Download the file: cwm-lgog_e975-europe-10b_modem.zip from http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
2-Open the zip file and replace the existing modem.img with your file
3-Rename the file to something meaningful, like cwm-lgog_e975-europe-10f_modem.zip
After these steps, you should be able to flash any modem, knowing that you can go back to your old version.
You can upload the packed files here, so we can have a library. I will upload the modem from european 10f version here. I tested it and it works correctly, but I won't take any responsibility for what you do with this file.
Good luck.
All this info is obtained from examining the houstonn LGOG modem flasher from team codefire, so all thanks go to them. Thanks.

Very nice tutorial man. It will help newbies like me to back up and restore our modem.img, especially those who have F180* phones that wants or being converted to E975. Nice job. :good:

Nice,i'll add this to the Freaking Annoying Questions.
Sent from Asylum via LG E975/smart phones,dumb people.

Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app

You should be able to backup your e977 modem following this tutorial.
renatonolo said:
Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app
Click to expand...
Click to collapse

could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.

sonty said:
could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.
Click to expand...
Click to collapse
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
I can, however, tell you how to backup it:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc.img
Can I ask why you need that?

dapaua said:
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
Can I ask why you need that?
Click to expand...
Click to collapse
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.

Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.

dapaua said:
Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.
Click to expand...
Click to collapse
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version

jumper8 said:
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version
Click to expand...
Click to collapse
Thanks.
You are totally right, this partition is not a filesystem. And it is mostly empty, it's all zeros except for some bytes. Most of it are text strings, but there are some small binary parts.
I think the 0x8800 - 0x8824 part is the original firmware version.
I wouldn't touch that partition, seems too dangerous .

dapaua said:
I wouldn't touch that partition, seems too dangerous .
Click to expand...
Click to collapse
freegee touches it. I see it made a backup and the difference is that it changed some bytes to 0 (offsets 0x40-0x52), then wrote ANDROID-BOOT at offset 0x4000. the rest is the same. it seems there's nothing like a crc so basically I could write whatever I want in that version field. the bad part is that as an user you'll never know what modem version you have since its version is not stored on the modem partition. I wonder who came up with this system and what was he thinking.
thanks for the clarification. offtopic over .

sonty said:
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.
Click to expand...
Click to collapse
Some time ago I had the same issue. I solved it by modifying binary data on the misc partition. I was done this only on CM10.1 (F180K). I don’t know if it will work on other custom rom especially stock one.
Today I’ve done this one more time for preparation the following procedure. Maybe some one will use it on the future.
STEPS:
0. Backup the misc partition with your recovery. I was used CWM Advance Edition PhilZ Touch 5:
Backup and Restore-> Custom Backup and Restore->Custom Backup Job->Backup misc (*)
I’m not sure if all CWMs version support misc partition backup. TWRP not support it right now.
1. Dump the misc partition to /sdcard.
Code:
adb wait-for-device
adb root
adb shell "dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc_orig.img"
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 6.539 secs (2565715 bytes/sec)
2. Pull the image to your PC
Code:
adb pull /sdcard/misc_orig.img misc_orig.img
3. Edit downloaded image file by your favorite hex editor (e.g. Notepad++ with Hex-Editor plugin)
Find both baseband name strings (mine were on offset 0x8800 and 0x9000) and change them (CM10.1 use the last one to set gsm.version.baseband in file /system/bin/fetch-swv).
REMEMBER:
- Do not use regular text editor (like Notepad or vi) – they can add some extra characters to the file.
- If possible try to modify only bytes responsible for original baseband name. If the new name is shorter, simply put spaces char (0x20) to clear unwanted chars. If you need to put the longer name, be careful. I don’t know the max size for this string. There are dozens of zeros behind the baseband name on my image file. So, for testing I added extra 20 Bytes text. The new baseband name was shown without problem.
4. Push the modified image file to your phone
Code:
adb push misc_orig.img /sdcard/misc_mod.img
Check if size of the original and modified files are equal.
5. Write the modified image to the misc partition
Code:
adb shell "dd if=/sdcard/misc_mod.img of=/dev/block/platform/msm_sdcc.1/by-name/misc "
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 4.183 secs (4010809 bytes/sec)
6. Reboot your phone
DONE.

Hi all,
I just create a .zip to backup your modem / baseband / radio with your recovery (CWM / TWRP...)

ok as a newbie i cant figure out how to back up modem using adb... but after reading stuff what i did :
downloaded "Android Terminal Emulator" from playstore
open emulator in phone wrote as u mentioned :
su
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
after some seconds this came out :
131072+0 records in
131072+0 records out
67108864 bytes transferred in 15.229 secs
then :
exit
exit
after that i checked sdcard but there was no img file...
then i open file manager from the phone and there it was my precious :laugh:
size = 64mb... is it normal?
anyway .. made a new folder "modem" copied the img file into modem folder (using file manger) again connected the phone to pc copied the modem folder on my desktop...
hope it will help new guys here like me :good:

after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:

pedro5148 said:
after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:
Click to expand...
Click to collapse
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4

akahroba said:
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4
Click to expand...
Click to collapse
I already did that, did not work out ...
any more solution?

pedro5148 said:
I already did that, did not work out ...
any more solution?
Click to expand...
Click to collapse
Get back to JB and wait for your midel update

Back to JB I recovered the IMEI, but I have no carrier signal.
So do the root with towelroot, unlock custom recovery with FreeGee, do I back up EFS, and when I restart the machine it loses the IMEI.
So I install the modem and E97710b.kdz for E97710b model recover EFS and nothing happens, still no sign of the operator ...
---------- Post added at 02:22 PM ---------- Previous post was at 02:22 PM ----------
akahroba said:
Get back to JB and wait for your midel update
Click to expand...
Click to collapse
even going back to JB, I continued without the modem

Sucessfully flashed 98.18.78 recovery into Locked 98.30.1

I understand it is currently not possible to unlock a Razr M with 98.18.94 or 98.30.1 OTA. Never the less, I had been trying to restore a previous VooDoo root that I deleted before the last OTA. Through the experimenting, I screwed up the flash on my phone, and recovering it, I found something that might be interesting.
As others pointed out, downgrading does not work. Flashboot gives various errors. When I screwed up my file system, I was able to flash from 98.18.94 (which I had) to 98.30.1 (which was the only download I could find) using RSD Lite. I was lucky it worked. And since I have been able to experiment and keep flashing 98.30.1 over and over.
I would like to report that in my experiments, I noticed an interesting fact about the recovery.img:
I am able to flash stock 98.18.78 recovery to my phone running 98.30.1.
I have verified the recovery.img contents are not the same, according to a WinMerge file compare, they are ~10% the same
When I try to flash twrp or cwm recovery, the only fastboot error is to the effect "wrong partition size".
The size of .78 and 98.30.1 recovery are the same, 10,485,760 bytes
On the other hand, if I try to flash the .78 system.img fastboot, or use RSD lite to flash .78, I see different security related errors on the phone's fastboot screen- none of which mention partition size. Of course, this is related to the Locked Bootloader I have.
What I wonder is, since the error for the recovery.img is not a security related one, but one of size, and the fact that it took recovery from .78- I wonder if a cwm or twrp made to be the same size as stock Moto recovery, would it be able to sneak in?
Right now my Razr M has gone from 98.18.94 to 98.30.1 with a 98.18.78 recovery. And I'm working ok.
I am not a professional Android Dev. But I am going to do the research and try to modify a cwm type recovery to match the size of a Moto recovery, and see what happens.
I invite anyone with real experience to contribute.
Bryan

bryanwieg said:
What did you say?
Click to expand...
Click to collapse
Well I hope you have something here!
We need someone like jbaumert or Phil3759 to chime in here.

aviwdoowks said:
Well I hope you have something here!
We need someone like jbaumert or Phil3759 to chime in here.
Click to expand...
Click to collapse
I have already found that if I take the OTA recovery and unpackbootimg and then mkbootimg without changing anything.. it recompiles down to aprox 5mb, which is different than the size it started from Moto.
So I am looking at if the size is set in how the img is compiled.

30.1 and .94 are the same updates, just different system versions. As for the other stuff, I'm not even sure what to say. I'm with Avi on this, I definitely would like to see what a dev has to say.

New Philz coming BTW.
http://forum.xda-developers.com/showpost.php?p=48881182&postcount=2003
Others could ask for the padded up Philz or at least Quote my post.
http://forum.xda-developers.com/showpost.php?p=48886733&postcount=2004

aviwdoowks said:
New Philz coming BTW.
http://forum.xda-developers.com/showpost.php?p=48881182&postcount=2003
Others could ask for the padded up Philz or at least Quote my post.
http://forum.xda-developers.com/showpost.php?p=48886733&postcount=2004
Click to expand...
Click to collapse
I found out via a hex editor, both files have empty data insert after the same point, with certificate data at the end, and it winds up making each file the same size. The data before the 'empty data' in each file is mostly different bits.
My current problem is that when I decompile an img, and recompile it, it's bigger, meaning that I cannot insert the 'empty data' at the same point they did.

bryanwieg said:
I found out via a hex editor, both files have empty data insert after the same point, with certificate data at the end, and it winds up making each file the same size. The data before the 'empty data' in each file is mostly different bits.
My current problem is that when I decompile an img, and recompile it, it's bigger, meaning that I cannot insert the 'empty data' at the same point they did.
Click to expand...
Click to collapse
They are both signed with the 128, or more, bit code. Which is what makes this a such a Loooooong shot.

aviwdoowks said:
They are both signed with the 128, or more, bit code. Which is what makes this a such a Loooooong shot.
Click to expand...
Click to collapse
Well, you'r right on the money. I appended data to a CWM recovery the same as Moto did to thiers, including the certificate at the end.
I didn't get a partition size error this time, but I did get a 'Failed to hab check for recovery'.
Granted, I didn't manage to place the 'empty data' at the same point in the file as the stock roms did. Other than that, it must be the certificate.

bryanwieg said:
What I wonder is, since the error for the recovery.img is not a security related one, but one of size, and the fact that it took recovery from .78- I wonder if a cwm or twrp made to be the same size as stock Moto recovery, would it be able to sneak in?
Click to expand...
Click to collapse
No, because it first checks the size (or whether it's a valid image at all) and if the size is correct, it checks the signature.

I found that I can put recovery all the way back to 98.15.66. I haven't tried further back due to kernel version.
I tried to then apply an update ZIP to something pre 98.30.1, and it passed validation (woohoo), but if failed an assert that checked the version in the props. (cry)
I wish there was something in the older recoveies we could exploit.

Really glad to see someone is still trying to find some sort of exploit for this device in it's updated state, it seemed like everyone had completely given up on it. My girlfriend recently grabbed a used Razr M to use for a while but it's fully updated, and I would love to be able to root it for her. I'll be following this thread to see if anything comes of this recovery downgrading

I'm pretty sure you can edit the props from what I can remember.
Sent from my XT907 using xda app-developers app

bryanwieg said:
I found that I can put recovery all the way back to 98.15.66. I haven't tried further back due to kernel version.
I tried to then apply an update ZIP to something pre 98.30.1, and it passed validation (woohoo), but if failed an assert that checked the version in the props. (cry)
I wish there was something in the older recoveies we could exploit.
Click to expand...
Click to collapse
You can use root eplorer free to extract the single img from the 404 or 411 xml.zips
---------- Post added at 10:44 AM ---------- Previous post was at 10:39 AM ----------
Here http://sbf.droid-developers.org/phone.php?device=8
---------- Post added at 10:48 AM ---------- Previous post was at 10:44 AM ----------
The razr hd (2), atrix hd, photon Q all use a recovery w/ same key. Git to work man!

Re:
So, it is RSD that is keeping it from flashing, would the bootloader(locked) boot a recovery partition that isn't signed? Has anybody tried to dd the recovery partition? I will grab a TWRP dd recovery image if you guys have an interest in trying that.
It would still require root and either a terminal emulator or adb shell.

815turbo said:
So, it is RSD that is keeping it from flashing, would the bootloader(locked) boot a recovery partition that isn't signed? Has anybody tried to dd the recovery partition? I will grab a TWRP dd recovery image if you guys have an interest in trying that.
It would still require root and either a terminal emulator or adb shell.
Click to expand...
Click to collapse
Am I alone here now?
Does anyone with a locked boot loader want to try this? I could create a windows shell script to make it easier if that's the worry.

I am willing to try it out. Win 7 64bit... pass me needed staf to flash it
Sent from my XT907 using xda app-developers app

please do
815turbo said:
Am I alone here now?
Does anyone with a locked boot loader want to try this? I could create a windows shell script to make it easier if that's the worry.
Click to expand...
Click to collapse
sure do, i'm on win8, but also had win xp, how can i do it? what to download, what to execute? i can adb shell i think. i've survived from bricked before the screen said "flash failure".

benya274 said:
sure do, i'm on win8, but also had win xp, how can i do it? what to download, what to execute? i can adb shell i think. i've survived from bricked before the screen said "flash failure".
Click to expand...
Click to collapse
I'll post it in just a few minutes. I will also post the required commands and we'll be backing up current recovery. If it fails, it should be no problem to restore your backed up recovery.
Download TWRP image on your phone from: titanroms.com/upload/rec.img
Please get to an adb prompt and run these commands:
su
cd /sdcard
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/recbak1.img
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/recbak2.img
Please ensure that both copies are 10MB. The dd command should end by saying "10485760 Bytes Copied" on all of the "dd" commands.
Now, you should have two backups of the recovery partition and the TWRP Image you downloaded from here all on your sdcard.
You can follow with these commands AFTER your backup has completed.
cp /sdcard/Download/rec.img /sdcard/rec.img
dd if=/sdcard/rec.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=twrprecbak.img
mount -o remount,rw /system
mv /system/etc/install-recovery.sh /system/etc/install-recovery.bak
mv /system/recovery-from-boot.p /system/recovery-from-boot.bak
reboot recovery
In the event of a failed attempt at this you can run the following from adb:
su
cd /sdcard/
dd if=/sdcard/recbak1.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
Give me a holler if you don't understand this well. Good luck, guys.

I am gonna try it out tomorrow,i dont have time to do it tonight cause i need to go to work. My pc on work does not have internet connection I will keep u guys posted on any progress.
Sent from my XT907 using xda app-developers app

Just wanted to say I flashed the old ICS recovery to mine using fastboot commands but it didn't get me very far though.if I then try and flash the corresponding blur zip from recovery it just says invalid signature. Was trying to find a way to downgrade so I could get rooted..
Sent from my XT907 using Tapatalk

How to do a full binary backup via Send_command?

Hi!
I want to start modifying the modem of the LG G4 (h815 SEA) with QPST and i want to make a full emmc backup before doing that.
Can i use the same command used for backup system and create a system.img, used in the rooting method? ( dd if=/dev/block/mmcblk0 bs=8192 skip=55296 count=529920 of=/data/media/0/system.img ) .
Why in this command is a "skip" option set for the first 55269 blocks? For full backup i should not use the skip option? This backups the EFS/imei/bootloader of the phone too?
if i dont use the skip option, i will be able to recover that full backup after an error even with that blocks backupped?
Thanks and happy new year for everyone

bumpity bump bump.
At least someone tell my why are backups skipping those blocks! haha