Extracting the N2 root filesystem and adding rc.local
These instructions assume using a linux console.
The root filesystem lives in a u-boot/PPCboot ramdisk. These instructions tell you how to extract it.
Boot your nt with the "rooted forever" sdcard while connected with usb.
Make a copy of the boot partition. After this you may reboot your nt normally.
$ tar -cf boot.tar boot/
$ tar xvf boot.tar
$ cd boot
Extract the uRamdisk file. first 64 bytes is the u-boot header, we need to skip it.
$ dd if=URamdisk bs=64 skip=1 of=ramdisk.gz
ramdisk.gz now contains the root file system.
Copy ramdisk.gz to a work directory, then extract it:
gunzip -v ramdisk.gz
cpio -iv < ramdisk
The root file system will populate your work dir. Delete the ramdisk file. You can now make changes to the root file system.
The change I'm going to make is a simple one: adding the ability to run an rc.local file at boot.
edit the init.rc file in your work directory, adding at the bottom:
Code:
service rclocal /etc/rc.local
enabled
user root
oneshot
rebuilding the uRamdisk file is simple, once you know how (thanks to JesusFreke for pointing me in the right direction). cd into your working directory, issue these commands:
Code:
find . -regex "./.*"| cpio -ov -H newc | gzip > ../ramdisk.gz
mkimage -A ARM -T RAMDisk -n Image -d ../ramdisk.gz ../uRamdisk
A script with the the commands above is attached. Also attached is a rooted uRamdisk with the rc.local ability already build in. To replace the uRamdisk file, boot with your "Rooted Forever" sdcard, and copy the uRamdisk file to the nook's boot directory.
What's this good for? That's up to you. I'm using it to automatically start dropbear so I can ssh in my Nooks and also use rsync to keep them synced with my ebook library. This is also one of the steps in building a kernel for the Nook ST.
jocala said:
Extracting the N2 root filesystem and adding rc.local
These instructions assume using a linux console.
The root filesystem lives in a u-boot/PPCboot ramdisk. These instructions tell you how to extract it.
Boot your nt with the "rooted forever" sdcard while connected with usb.
Make a copy of the boot partition. After this you may reboot your nt normally.
$ tar -cf boot.tar boot/
$ tar xvf boot.tar
$ cd boot
Extract the uRamdisk file. first 64 bytes is the u-boot header, we need to skip it.
$ dd if=URamdisk bs=64 skip=1 of=ramdisk.gz
ramdisk.gz now contains the root file system.
Copy ramdisk.gz to a work directory, then extract it:
gunzip -v ramdisk.gz
cpio -iv < ramdisk
The root file system will populate your work dir. Delete the ramdisk file. You can now make changes to the root file system.
The change I'm going to make is a simple one: adding the ability to run an rc.local file at boot.
edit the init.rc file in your work directory, adding at the bottom:
Code:
service rclocal /etc/rc.local
enabled
user root
oneshot
rebuilding the uRamdisk file is simple, once you know how (thanks to JesusFreke for pointing me in the right direction). cd into your working directory, issue these commands:
Code:
find . -regex "./.*"| cpio -ov -H newc | gzip > ../ramdisk.gz
mkimage -A ARM -T RAMDisk -n Image -d ../ramdisk.gz ../uRamdisk
A script with the the commands above is attached. Also attached is a rooted uRamdisk with the rc.local ability already build in. To replace the uRamdisk file, boot with your "Rooted Forever" sdcard, and copy the uRamdisk file to the nook's boot directory.
What's this good for? That's up to you. I'm using it to automatically start dropbear so I can ssh in my Nooks and also use rsync to keep them synced with my ebook library. This is also one of the steps in building a kernel for the Nook ST.
Click to expand...
Click to collapse
dd if=URamdisk bs=64 skip=1 of=ramdisk.gz
Click to expand...
Click to collapse
"uRamdisk" instead of "URamdisk"
Thanks again.
Things you will need:
Cygwin- http://www.cygwin.com/setup.exe
ADB- http://developer.android.com/sdk/index.html
Loki Patch source- https://github.com/djrbliss/loki
These are the steps i took to compile and use loki_patch.
I will assume you have the android sdk setup and ready, I will assume your SDK is under c:/AndroidSDK(this is how mine is setup)
Pulling aboot.img using adb:
You can copy cmd.exe into the folder where adb is located and run it from there so you do not have to navigate to the folder manually, or just run cmd.exe and navigate to the adb folder, for me it is c:\AndroidSDK\sdk\platform-tools.
Once you are in your adb file path and your phone is connected and in debug mode follow these instructions to pull aboot.img from your phone.
Original instructions from djrbliss here https://github.com/djrbliss/loki
[email protected]:~$ adb shell
[email protected]:/ $ su
[email protected]:/ # dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/data/local/tmp/aboot.img
[email protected]:/ # chmod 644 /data/local/tmp/aboot.img
[email protected]:/ # exit
[email protected]:/ $ exit
[email protected]:~$ adb pull /data/local/tmp/aboot.img
3293 KB/s (2097152 bytes in 0.621s)
Now you should have the file aboot.img in the platform-tools folder(where the adb.exe file is located)
Copy this file to your desktop so you know where it is.
Installing gcc with Cygwin:
Original Instructions came from here http://www.eecg.utoronto.ca/~aamodt/ece242/cygwin.html
Step 0: Download and run the cygwin installer.
Step 1: Select “Install from Internet”
Step 2: Install to default location
Step 3: Use default local package directory (click next)
Step 4: Use whatever internet connection settings (click next)
Step 5: Select a mirror (use the one already selected, click next)
Step 6 (a): In the “Select Packages” expand “Devel”:
Step 6 (b): Select gcc, gdb, and make
Step 7: click next and follow the rest of the installation instructions.
Ok, now that gcc is installed we can compile the loki_patch source to make the executable.
Go here https://github.com/djrbliss/loki
You should see a file called loki_patch.c, click this link and it will open and you can see all the code.
Select the code from top to bottom and right click, copy.
Now right click on your desktop and select new> text file.
Open this text file and paste the code into it, go to file and save as loki_patch.c (make sure you have your file extensions turned on so you can save this as a c source and not a txt file).
We should now have a file called loki_patch.c on the desktop, keep it there for now.
Open up windows explorer and navigate to the following:
c:\cygwin\home\<username>\
(You will see a few files and a kitchen folder)
Create a new folder in here called compile.
Now, let's go back to the desktop and copy loki_patch.c and aboot.img and paste those into the compile folder you just created.
Go ahead and run cygwin.
Now we need to change directories, so let's type the following:
cd compile
We should now be in the compile folder.
Lets compile this code so we can use it, type the following command:
gcc loki_patch.c -o loki_patch
We should now have a file in the compile folder called loki_patch.exe( windows added this .exe, the file extension can be left alone or deleted)
Now you need a boot.img file to patch, grab one from a rom or kernal and copy this into the compile folder.
Once all the files are in the compile folder run the following command to patch the boot.img file:
./loki_patch boot aboot.img boot.img boot.lok
We should now have a boot.lok file in the compile folder, hope this helps and i hope i didnt leave anything out, i will try and update this with screen shots later.
Nice work..thanks
C13v3r0n3 first link is Broken: Cygwin, my friend!!
TheAxman said:
Nice work..thanks
Click to expand...
Click to collapse
And that's why you guys rock because that's all greek to me.
"If you ain't first yer last"
Sent from my rockin ATT S4
I am doing R&D on FOTA(Firmware Update Over the Air) using Nexus 7-Wifi(grouper). For which I followed the following steps.
1. Downloaded the android source from source.android.com for v 4.2.2_r1 and v 4.3_r1
2. Downloaded the binaries for grouper, extract it to my source folder.
3. Then I compiled the source code using following commands.
i. source build/envsetup.sh
ii. lunch full_grouper-userdebug
iii. make -j8 dist
4. After few tries, I had success in compiling the source for Nexus 7(grouper).
5. I got following files in $out/source_4.2.2/dist folder
-----------------------------------------------
adb*
android-common-carousel.jar
android-common.jar
android-info.txt
android-support-v13.jar
android-support-v4.jar
android-support-v7-gridlayout.jar
build.prop
com.android.nfc_extras.jar
fastboot*
full_grouper-apps-eng.root.zip
full_grouper-emulator-eng.root.zip
full_grouper-img-eng.root.zip
full_grouper-ota-eng.root.zip
full_grouper-symbols-eng.root.zip
full_grouper-target_files-eng.root.zip
gpl_source.tgz
guava.jar
installed-files.txt
jsr305.jar
mkbootfs*
mkbootimg*
mkyaffs2image*
mp4parser.jar
package-stats.txt
ramdisk.img
signapk.jar
vendor_owner_info.txt
-----------------------------------------------
6. Then I generated my own keys using /development/tools/make_key tool for media, testkey, releasekey, shared, platform.
Assume my keys are locate at /keys folder.
7. Then I created a signed target zip file using following command.
/source/build/tools/releasetools/sign_target_files_apks -v -p ../host/linux-x86 -d /keys full_grouper-target_files-eng.root.zip signed_target_files.zip
8. From signed target zip file I create
/source/build/tools/releasetools/img_from_target_files -v -p ../host/linux-x86 signed_target_files.zip signed_img_from_target_files.zip
9. Then I flashed the signed_img_from_target_files.zip using fastboot command using the following script:
----------------------------------------------------------------------
fastboot oem unlock
fastboot erase boot
fastboot erase cache
fastboot erase recovery
fastboot erase system
fastboot erase userdata
fastboot reboot-bootloader
sleep 10
fastboot -w update signed_img_from_target_files.zip
----------------------------------------------------------------------
10. The device gets flashed well and is working, but I am getting an log while flashing in which it is unable to find boot.sig, system.sig and recovery.sig
11. Now the otacerts.zip file contains a testkey which is not the one that I signed it with.
file located at "/system/etc/security/otacerts.zip" on device.
12. Now since the otacerts.zip is signed with the default key it gives a mismatch error which I tried to flash an OTA update which is signed by the my custom key.
Now my doubt is:
How can I add boot.sig, recovery.sig and system.sig to signed_img_from_target_files.zip?
Is there anything I am doing wrong?
Does the recovery checks the current ROM keys from "/system/etc/security/otacerts.zip"?
What is the correct procedure to sign the OTA update?
i am posting this reply just for people who are looking for help too,
you need to explicitly define "BUILD_SECURE := true" in your device make file so that android/build/core/Makefile will use device/*/$(TARGET_DEVICE)/releasekey.x509.pem for OTA_PUBLIC_KEYS
Hi,
I made a tutorial explaining how to compile the ouya's kernel from scratch.
I made this tutorial because I needed to enable the nfs protocol versions 3 and 4 to use file shares from my Synology NAS. The ouya's kernel enabled by default only comes with version 2 and i had problems to mount my NFS shares.
Let's start. my english is not very good then ignore the grammatical errors.
Let's first download the required files. I'm on the premise that you have an ubuntu linux installed on your machine.
*** DOWNLOAD OUYA FIRMWARE ***
1. Open your browser and type:
https://devs.ouya.tv/api/firmware_builds
2. Search for a string like this:
http://cds.t2z5c2q6.hwcdn.net/ota/RC-OUYA-1.2.1084-r1_ota.zip (this is the latest version of ouya firmware)
3. Download it:
$ wget http://cds.t2z5c2q6.hwcdn.net/ota/RC-OUYA-1.2.1084-r1_ota.zip
2. Create a directory an put the file there:
$ mkdir ouyafiles
4. unzip it:
$ unzip RC-OUYA-1.2.1084-r1_ota.zip
5. Now you have a lot of files and directories. We need only one. The name of file is: boot.img. We need to unzip this file to retrieve the ramdisk file that will be needed along with the compiled kernel. For this we need to download the following perl script:
$ wget http://www.enck.org/tools/split_bootimg_pl.txt
5. Rename the script and change the permissions to execute:
$ mv split_bootimg_pl.txt split_bootimg.pl
$ chmod 755 split_bootimg.pl
6. Run this command to unpack the file:
$ ./split_bootimg.pl boot.img
7. Now you have 2 files: boot.img-kernel and boot.img-ramdisk.gz. We only need the boot.img-ramdisk.gz. Lets unzip this again and rename the unzipped file:
$ gzip -dc ../boot.img-ramdisk.gz | cpio -i
$ mv boot.img-ramdisk ramdisk
8. OK. Now you have this file. We will use it later in the tutorial.
*** DOWNLOAD ANDROID NDK ***
1. Open the Browser and paste this URL: http://developer.android.com/tools/sdk/ndk/index.html
2. Download the Linux 64-bit (x86) package file:
$ wget http://dl.google.com/android/ndk/android-ndk-r9d-linux-x86_64.tar.bz2
3. Unzip it:
$ tar -jxvf android-ndk-r9d-linux-x86_64.tar.bz2
4. Rename the unzipped directory to "ndk":
$ mv android-ndk-r9d ndk
5. Load the environment variables:
$ export CROSS_COMPILE=/your_home_directory/ndk/toolchains/arm-linux-androideabi-4.6/prebuilt/linux-x86_64/bin/arm-linux-androideabi-
$ export ARCH=arm
Obs.: (remember the /your_home_directory/ is the default home directory that you user in linux uses to work).
*** DOWNLOAD THE OUYA KERNEL SOURCE ***
1. Open your browser and go to this URL:
https://github.com/ouya/ouya_1_1-kernel
2. In the right side of the page you will have a download button called "Download ZIP". Click and Download it.
3. Unpack it and rename the unzipped directory to "kernel"
4. Maybe the /kernel/drivers/pci/Kconfig file will corrupt before unzip the file. Kconfig is a symbolic link. Remove it and Download again using the command inside the kernel/drivers/pci/ directory:
$ wget https://raw.githubusercontent.com/ouya/ouya_1_1-kernel/master/drivers/pci/Kconfig
6. Now you have the default ouya kernel for compile!
*** RECOVER .CONFIG FILE FROM OUYA ***
1. You need to retrieve a file that is in ouya. To retrieve the file you need install the package android-tools-adb. use the following command:
$ sudo apt-get install android-tools-adb
2. Now you have to connect your ouya via usb. By default your ouya don't enable adb. You need to go to DEVELOPMENT screen on your ouya and enable “ADB: ON”.
3. Fine. Now test if the adb is connecting. Try this commands:
$ adb start-server
$ adb devices (this will show something like this “1234567890ABCDEF device”)
PS.: if no devices appears... you need to search in the internet about “how to use adb to connect android devices”
4. Now you will pull the config file:
$ adb pull /proc/config.gz config.gz (this will pull config.gz to your computer)
5. Unzip it and copy to kernel directory:
$ gunzip config.gz
$ cp config /your_home_directory/kernel/.config
6. Now your kernel is ready to compile. We're ensuring that the standards are consistent settings. From now on it is your responsibility to enable and disable kernel configurations.
*** REBUILDING KERNEL ***
1. Go to Kernel Directory:
$ cd /your_home_directory/kernel/
2. Make sure to run the environment variables CROSS_COMPILE and ARCH described above in the tutorial.
$ export CROSS_COMPILE=/your_home_directory/ndk/toolchains/arm-linux-androideabi-4.6/prebuilt/linux-x86_64/bin/arm-linux-androideabi-
$ export ARCH=arm
3. Use this command to change some settings:
$ make menuconfig
4. Use this command to build the kernel after you change your new settings:
$ make
5. Some warnings will display in your console... its normal.
6. if the process run ok you 'll have a bzImage file under the directory kernel/arch/arm/boot
7. copy this file to the same directory where you store the ramdisk file.
*** UPLOAD THE NEW KERNEL AND THE RAMDISK TO OUYA ***
1. You will need to install the fastboot on linux using this command:
$ apt-get install android-tools-fastboot
2. Now you have to reboot your device in bootloader mode:
$ adb reboot-bootloader
3. You can check if you devices enters in this mode using this command:
$ fastboot devices
4. If it works. You can upload your new kernel and the default ramdisk:
$ fastboot flash:raw boot ./zImage ./ramdisk
The system should now boot with your custom kernel installed!
*** DOWNLOAD OUYA FIRMWARE ***
$ mv boot.img-ramdisk ramdisk
Click to expand...
Click to collapse
Why do we need this? Can't we simply copy it from an existing OUYA machine?
ndk/toolchains/arm-linux-androideabi-4.6/prebuilt/linux-x86_64/bin/arm-linux-androideabi-
Click to expand...
Click to collapse
The current android-ndk-r10e only has androideabi-4.8 and androideabi-4.9. Can I use them, too?
Edit: I got an error ("unknown CPU architecture") with android-ndk-r10e and arm-linux-androideabi-4.8 so I used android-ndk-r9d with arm-linux-androideabi-4.6, and that worked.
6. if the process run ok you 'll have a bzImage file
Click to expand...
Click to collapse
It's actually a zImage file (without the b).
Thank you so much for the tutorial!
This procedure supplements what was posted on 2ch.
this procedure is for firmware v3.3.18 or less.
If your firmware is v3.3.20, you may be able to downgrade to v3.3.18 with the procedure described at the end of this post.
for necessary files, download from the follwoing URL.
hZtZtpsZ://wZwZwZ.axfc.net/u/3777377
Z←remove
(PASS Z581KL) (差分＝Difference，キーワード＝KEYWORD，ダウンロード＝Download，こちら＝HERE，cacheに置くもの＝Things to put in the cache)
1.extract boot image
turn on debug mode.
then, reboot recovery mode.
Code:
$ adb reboot recovery
after that, mount the system using the terminal volume button and the power button.
Code:
$ adb push dirtycow /tmp/
$ adb push run-as /tmp/
$ adb shell
[email protected]_1:/ $ cd /tmp
[email protected]_1:/tmp $ chmod 777 dirtycow
[email protected]_1:/tmp $ chmod 777 run-as
[email protected]_1:/tmp $ ./dirtycow ./run-as /system/bin/run-as
[email protected]_1:/tmp $ run-as
[email protected]_1:/tmp # dd if=/dev/block/mmcblk0p41 of=/tmp/boot.img
[email protected]_1:/tmp # chmod 777 /tmp/boot.img
[email protected]_1:/tmp # exit
[email protected]_1:/tmp $ exit
transfer boot.img to PC.
Code:
$ adb pull /tmp/boot.img ./
2.unpacking the boot.img
"mkbootimg_tools-master" is useful because it outputs log of ramdisk size.
(However, binary "mkbootfs" and "mkbootimg" are 32-bit versions.
if your environment is 64-bit, you need to bring 64-bit binaries from CarlivImageKitchen64 etc)
for example, using mkbootimg_tools-master looks like this:
Code:
$ ./mkboot bootimg_source/boot.img bootimg_output
Unpack & decompress bootimg_source/boot.img to bootimg_output
kernel : kernel
ramdisk : ramdisk
page size : 2048
kernel size : 29041019
[COLOR="Red"]ramdisk size : 2924316 <- refer to this value later[/COLOR]
base : 0x80000000
kernel offset : 0x00008000
ramdisk offset : 0x01000000
tags offset : 0x00000100
cmd line : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk vmalloc=256M build_version=3
ramdisk is gzip format.
Unpack completed.
directories after unpacking boot.img looks like this:
bootimg_output
|--ramdisk
|--kernel
`--others(img_info,ramdisk.packed,etc)
3.install SuperSU manually
overwrite the contents of "initrd差分.7z" under directory "ramdisk".
("su" is an empty directory, but also to put it under "ramdisk")
(for "sbin", you only need to add launch_daemon.sh without deleting the existing files)
(permissions on files/directories should be the same as original or other file/directories)
4.repacking the boot.img
for example, using mkbootimg_tools-master looks like this:
Code:
$ ./mkboot bootimg_output boot_patched.img
mkbootimg from bootimg_output/img_info.
kernel : kernel
ramdisk : new_ramdisk
page size : 2048
kernel size : 29041019
ramdisk size : 2924316
base : 0x80000000
kernel offset : 0x00008000
ramdisk offset : 0x01000000
tags offset : 0x00000100
cmd line : console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk vmalloc=256M build_version=3
ramdisk is gzip format.
Repack image utility by [email protected]
Check and add the kernel
Check and add the ramdisk
Build the new image
'boot_patched.img' successfully repacked
Kernel size: 29041019, [COLOR="Magenta"][COLOR="Red"]new ramdisk size: 2924316[/COLOR][/COLOR], test_patched.img: 31969280.
test_patched.img has been created.
...
at this time, it is necessary to adjust so that the value of "new ramdisk size" becomes
the same value as "ramdisk size" when unpack.
if the size of "ramdisk" is different from when unpacked, Z581KL will not start.
therefore, deleting unnnecessary files stored under ramdisk/res/images/charger and adding dummy files.
(the difference of about several bytes seems to be no problem)
(once wrong boot.img is written, Z581KL will no start until you write the original boot.img)
however, the size of the original boot.img and the modified boot.img can be different.
(in my environment, the original boot.img was about 67MB, while the modifyed boot.img was
about 32MB)
5.insert modified boot.img
using dirtycow, adb push, and dd, insert the modified boot.img into the /dev/block/mmcblk0p41
also, put "su.img" and "SuperSU.apk" in /cache
then,reboot Z581KL.
"Verification Error" is always displayed when starting up, but if you wait for a while
it will start normally.
that's all.
**********************
Firmware downgrade procedure
1. your firmware is v3.3.20.0
2. download firmware from asus's support page. (UL-P008-WW-3.3.18.0-user.zip)
3. rename the zip file ( UL-P008-WW-3.3.18.0-user.zip -> UL-P008-WW-5.3.9.0-user.zip )
4. Place the zip file in an arbitrary directory on the SD card and insert this SD card into Z581KL
5. The update dialog is displayed as it is ( or it is displayed when restarted )
If the firmware is v 5 or higher (currently v 5.3.9.0 is published),
this procedure may indicate an error and the downgrade may fail.
In that case, for now I have no choice but to give up ...
I am sorry if my comment sounds unprofessional. Can you express steps 2-5 in a vulgar manner. Is mkbootimg a tool? ttps://forum.xda-developers.com/android/software-hacking/development-mkbootimg-tools-t2895954
I am experiencing permission denied while performing: adb pull /tmp/boot.img ./
i.imgur.com/TSO0v1g.png
About mkbootimg it is right.
Download all files with ZIP from GitHub's "Clone or download" button described in that URL.
About "adb pull" command, sorry.
Before doing it, you need to change the permissions of boot.img to 777.
[email protected]_1:/tmp # dd if=/dev/block/mmcblk0p41 of=/tmp/boot.img
[email protected]_1:/tmp # chmod 777 /tmp/boot.img
[email protected]_1:/tmp # exit
[email protected]_1:/tmp $ exit
By the way, I would like you to tell me.
Is there a procedure like this that you successfully downgraded the firmware?
1. your firmware is v3.3.20.0
2. download firmware from asus's support page. (UL-P008-WW-3.3.18.0-user.zip)
3. rename the zip file ( UL-P008-WW-3.3.18.0-user.zip -> UL-P008-WW-5.3.9.0-user.zip )
4. Place the zip file in an arbitrary directory on the SD card and insert this SD card into Z581KL
5. The update dialog is displayed as it is ( or is it displayed when restarted? )
yamada_2501 said:
By the way, I would like you to tell me.
Is there a procedure like this that you successfully downgraded the firmware?
1. your firmware is v3.3.20.0
2. download firmware from asus's support page. (UL-P008-WW-3.3.18.0-user.zip)
3. rename the zip file ( UL-P008-WW-3.3.18.0-user.zip -> UL-P008-WW-5.3.9.0-user.zip )
4. Place the zip file in an arbitrary directory on the SD card and insert this SD card into Z581KL
5. The update dialog is displayed as it is ( or is it displayed when restarted? )
Click to expand...
Click to collapse
Correct. This is exactly what I've done. My factory firmware was v3.3.20.0. I downloaded the 3.3.18.0 firmware from ASUS website and rename it to the 5.3.9.0 firmware. I was able to downgrade the system using the standard procedures.
---------- Post added at 04:11 AM ---------- Previous post was at 03:55 AM ----------
yamada_2501 said:
About mkbootimg it is right.
Download all files with ZIP from GitHub's "Clone or download" button described in that URL.
About "adb pull" command, sorry.
Before doing it, you need to change the permissions of boot.img to 777.
[email protected]_1:/tmp # dd if=/dev/block/mmcblk0p41 of=/tmp/boot.img
[email protected]_1:/tmp # chmod 777 /tmp/boot.img
[email protected]_1:/tmp # exit
[email protected]_1:/tmp $ exit
Click to expand...
Click to collapse
Thank you. I was able to successfully pull that boot.img. However, is there any mkbootimg alternative for windows. It seems like a linux system tool.
---------- Post added at 04:20 AM ---------- Previous post was at 04:11 AM ----------
yamada_2501 said:
About mkbootimg it is right.
Download all files with ZIP from GitHub's "Clone or download" button described in that URL.
About "adb pull" command, sorry.
Before doing it, you need to change the permissions of boot.img to 777.
[email protected]_1:/tmp # dd if=/dev/block/mmcblk0p41 of=/tmp/boot.img
[email protected]_1:/tmp # chmod 777 /tmp/boot.img
[email protected]_1:/tmp # exit
[email protected]_1:/tmp $ exit
Click to expand...
Click to collapse
I was able to find this post (ttps://forum.xda-developers.com/redmi-1s/general/guide-unpack-repack-kernel-t2908458). I am not sure if it work. Would you please verify and please post the steps. When I use this tool, I am getting a intrid folder instead of ramdisk folder as describe in your post. The link below is what I have. The red boxed files are the original files. Green arrowed file is the original boot.img
i.imgur.com/8d05Zis.png
Also, would you please provide the codes you used in step 5.
Update:
I was somehow able to push boot.img and the other two files in by modifying step 1's code. However, I think the boot.img I created has an error. Perhaps because of sizing error. I am not able to start the machine. Now, is stuck at fastboot options menu. How can I get back to the recovery menu and perhaps push the original boot.img back.
If you connect to the PC with the fastboot menu activated,
and execute the " fastboot reboot recovery " command on the PC,
will not you get to the recovery menu?
yamada_2501 said:
If you connect to the PC with the fastboot menu activated,
and execute the " fastboot reboot recovery " command on the PC,
will not you get to the recovery menu?
Click to expand...
Click to collapse
No, when I execute that command, it shows me a bunch of options as shown in the screenshot below.
i.imgur.com/ZJsh5Ub.png
Sorry, I can only think about this as other means....
1.Power off your device
2.pressing and holding Volume Down and Power Button at the same time
3.Boot in recovery mode
1.Power off your device
2.pressing and holding Volume Up and Power Button at the same time
3.Boot in Fast boot options menu
4.select "USB debug mode"
１．Boot in Fast boot options menu
2.Use fastboot command from PC to start Z581KL from original boot.img on PC
-> fastboot boot ./boot.img
yamada_2501 said:
Sorry, I can only think about this as other means....
1.Power off your device
2.pressing and holding Volume Down and Power Button at the same time
3.Boot in recovery mode
1.Power off your device
2.pressing and holding Volume Up and Power Button at the same time
3.Boot in Fast boot options menu
4.select "USB debug mode"
１．Boot in Fast boot options menu
2.Use fastboot command from PC to start Z581KL from original boot.img on PC
-> fastboot boot ./boot.img
Click to expand...
Click to collapse
The combination button will not get me to the recovery mode. USB debugging mode requires a OS system. I've been trying to flash/boot the original boot.img from my computer but it has some permission error.
i.imgur.com/rmK65Z9.png
Is it possible to get this permission error fix and flash or boot the original boot.img?
I already upgraded to Nougat 5.3.9.0. Could I downgrade to 3.3.18 without bricking it?
I could get blueborne to work on JP_V5.5.0_220170616.
But shell whose uid=bluetooth is seemingly useless for rooting...
Does anyone know how to get root from bluetooth shell?
is there any guide to flash a ww rom over operator rom?
thanks
How to insert the modified boot.img into the /dev/block/mmcblk0p41 by using dirtycow, adb push, and dd?
tomo_ward said:
How to insert the modified boot.img into the /dev/block/mmcblk0p41 by using dirtycow, adb push, and dd?
Click to expand...
Click to collapse
His original instruction left out commands to acquire permission to access boot.img. Read the reply threads between yamada and me. He addressed the instruction to acquire the permission. In order to insert the modified boot.img, you re-execute step 1, but instead of doing an adb pull on the last command of step 1, do an adb push.
However, the issue of this guide is the fact that you need to push the boot.img out, unpack and repack it. The risk of this is that the chance of you getting wrong modified size boot.img. There is no way to re-acquire permission to replace the wrong boot.img with the original one once you can't boot into the system; therefore, you end up with a Z581Kl that just do not boot. I had to send mine Z581KL back to factory in order to fix the effect.
If you are willing to take the risk and does success, please provide the boot.img you have successfully modified. That will definitely be a gospel.
thank you.
I'll try to get Root my Z581KL
Should I change file permission of patched_boot.img before run "dd" command?
[email protected]_1:/tmp # chmod 777 /tmp/patched_boot.img #Do I need?
[email protected]_1:/tmp # dd if=/tmp/patched_boot.img of=/dev/block/mmcblk0p41
Was anyone able to get a boot.img that works?
Cannot download the needed ZIP file.
Any backup?
Uqbar said:
Cannot download the needed ZIP file.
Any backup?
Click to expand...
Click to collapse
None has it any more?