Database Info

[HOW-TO] ROM-HACKING: init.rc ext2-auto-mount / ROM Signing / ROM Kitchen

AS MENTIONED IN THE INTRODUCTION TEXT THIS HAS ONLY BEEN TESTED ON AMON RA ROM 1.6.2 BUT SHOULD REALLY WORK ON ANY ROM THAT HAS NO EXT2 AUTO-MOUNT. AND YEAH THIS WHOLE PROCESS HAS BEEN DONE ON A 32a BOARD. FOR THOSE THAT TRY THIS ON OTHER ROMS LET ME KNOW HOW IT GOES.
I've searched and shuffled through the entire forum and made inquiries to ROM authors without much light being shed on this issue. I doubt I am the only one who has been looking for a way of doing this so I decided to do a small HOW-TO. Here I will explain step by step as to how you can implement a script to be part of your ROM that will auto mount an ext2 partition on boot up if such partition is present. I have included all the tools I've used in order to pull this off, and as the title suggests this has only been done on Amon Ra's latest 1.6.2 ROM. In order to follow these instructions you are expected to allready have set up an adb enviroment on your linux box and for the signing process to work you must have sun-java present, the gnu java wont work. And of course a microSD card with an ext2 partition
1. Download install.sh to your home directory
Code:
wget http://www.grindhouse.no/androidtools/install.sh
chmod a+x install.sh
2. Now execute the install.sh script which will create a directory to work in and download a tool and script package and unpack it.
Code:
./install.sh
When the install.sh script is done you need to move the mkbootimg preferebly to your tools directory of your SDK.
Code:
mv toolstomove/mkbootimg <path/to/sdk/tools/mkbootimg>
3. Unpack the RA1.6.2 ROM into a directory in your home dir. In this HOW-TO we will use directory name "ra1.6.2" as an example through out the entire process.
4. Copy the boot.img from ra1.6.2 to the ROM-cooker dir
Code:
cp $HOME/ra1.6.2/boot.img $HOME/ROM-cooker/boot.img
cd $HOME/ROM-cooker
5. Use unpack.pl to extract the ramdisk from the boot image. I've modified the script a little so it automates the entire process and decompresses the ramdisk to a directory
Code:
./unpack boot.img
6. Now you can either replace the init.rc file here with the one I've included in this package or you can add these lines by yourself. In wich case do the following
Code:
cd boot.img-ramdisk
pico init.rc
Press CTRL+w and then CTRL+t and input 27. hit enter. This will take you to line 27 of init.rc so you can add a line right before the init process remounts the rootfs in read-only mode. Add following line:
Code:
mkdir /sdext2 0771 system system
Now scroll down to the end of the init.rc file and add the following:
Code:
service mountsdext2 /system/bin/mountsd
user root
group root
oneshot
7. You have now edited (or replaced) your init.rc file and prepared it to execute a script on boot that will detect an ext2 partition and boot it if there is one to be found. Now you have to make the mountsd script a part of the ROM. Do the following:
Code:
cd $HOME/ROM-cooker
mv toolstomove/mountsd $HOME/ra1.6.2/system/bin/mountsd
rm -rf toolstomove
8. Now that the init.rc file is sorted out and mountsd has been placed in /system/bin of the ROM so it is time to re-pack the boot.img:
Code:
cd $HOME/ROM-cooker
./repack boot.img-kernel boot.img-ramdisk boot.img
rm $HOME/ra1.6.2/boot.img
mv boot.img $HOME/ra1.6.2/boot.img
9. Your ROM now has a new boot image with an updated init.rc and the /system/bin dir has the script needed to auto-mount the microsd ext2. Now you must re-zip the ROM and sign it. Do the following:
Code:
cd $HOME/ra1.6.2
zip -r update.zip *
mv update.zip $HOME/ROM-cooker/update.zip
cd $HOME/ROM-cooker
./sign.pl update.zip
10. The ROM is now signed and you now have a file called update-signed.zip. Connect the phone to your computer and execute thus:
Code:
./push update-signed.zip
11. Now you are ready to flash the modified ROM which will auto-mount an ext2 partition on your microSD. There is no need to wipe before flashing. If you have no prior experience with ROM flashing or whatever just backup your current install. If you're using OpenHOME or anything similar, nothing will be changed or damaged but if you're using MontAlbert's themes with the ROM you will have to flash them again after flashing this modified ROM.
Code:
adb reboot recovery
12. Flash from choose zip and of course choose update-signed.zip. Reboot. After the system boots up again you can now check whats what with either one of the commands:
Code:
[email protected]:~$ adb shell mount | grep sdext2
/dev/block/mmcblk0p2 on /sdext2 type ext2 (rw,noatime,nodiratime,errors=continue)
[email protected]:~/boot$ adb shell busybox df -h | grep sdext2
/dev/block/mmcblk0p2 893.7M 13.0K 846.0M 0% /sdext2
13. Voila! Your RA 1.6.2 ROM now detects and mounts your microSD ext2 partition on boot. Woohoo?
I hope the HOW-TO was easy reading and that you have succeeded in hacking up your ROM. I know that certain ROMs have this as a built-in function but Amon Ra's does not. But since alot of people including myself use his ROM because of the high speed and stability I thought I should contribute to his project and add a cool (and missed?) function to it.
Mind you that you can use the ROM-cooker set to further adjust and hack up the ROM as you see fit. Happy learning!

Very nice!
Now the question many people will ask : why would you automount ext2 if you don't use apps2sd ?

I personally have ubuntu on my ext2 And besides this approach can be used for a number of things, people who have had the need, or wanted to experiment with init.rc doing things on boot, the mountsd script can easily be altered to do what ever needed.
For me its been a learning curve finding these things out, so by sharing it I may spare some people breaking their backs over this whole init.rc thing. people may want to modify init.rc for whatever reason, so I'm sure people wont have a problem finding a way of putting this to use, and its a subject that isnt all that covered on the forum .. and hey .. at least they get a rom kitchen out of the whole shabang

Very interesting! Thank you.
I used your unpack-program to unpack a recovery-image. It seems to work fine. What I am trying to do is change the state the recovery-image returns the phone to. Would it be possible to just replace your mountsd-script with, for example, a script that installs apps? Or is there a better way to do what Im trying to achieve?
Cheers,
edit: I noticed that on the emulator it is sufficient to just place an apk-file in "data/app" to get it installed. Could it be possible that this is all I need a script to do? :O or could I hurt my poor phone by doing so you think?

sandis84 said:
edit: I noticed that on the emulator it is sufficient to just place an apk-file in "data/app" to get it installed. Could it be possible that this is all I need a script to do? :O or could I hurt my poor phone by doing so you think?
Click to expand...
Click to collapse
That's indeed all you need to do.

Hi!
So I tried to create a signed update.zip, but it failed. It didnt create a "update-script"-file, so my device refused to install it. I wrote my own "update-script"-file, but then it complained "no digest" for the file. How do I solve this?

post the contents of your script people might see whats up

so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together

sitimber said:
so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together
Click to expand...
Click to collapse
Says where its at in the first line : )
Code:
wget http://www.grindhouse.no/androidtools/install.sh
But now that I checked, I have to apologize, I see I have a missed payment with my hosting, I'll fix that within the day. Also sorry I havent been answering the few questions here I've been afk cause of surgery.

sitimber said:
post the contents of your script people might see whats up
Click to expand...
Click to collapse
well, I looked in another "update-script" file and found this:
assert compatible_with("0.2") == "true"
assert getprop("ro.product.device") == "dream" || getprop("ro.build.product") == "dream"
show_progress 0.5 0
write_radio_image PACKAGE:radio.img
show_progress 0.5 10
Click to expand...
Click to collapse
So I figured that nothing was essential other then the line "write_radio_image PACKAGE:radio.img". Also ofcourse I made sure it contained the name of my image-file instead of "radio.img". This gave me the "no digest" message, so now I feel unsure on how to create a working update.zip.
edit:
SOLVED! How silly of me. When you sign the update, a hash of each file is put in manifest.mf. Since I added the update-script after signing the file, ofcourse the digest(hash) was missing. Now everything works alot better and I can proceed... until I get stuck again
Cheers,
edit2:
Just to get a better understanding, what exactly does each line do here? Or where can I read about this?
Code:
service mountsdext2 /system/bin/mountsd
user root
group root
oneshot
edit3:
Ok, so I have experimentet, but I still dont manage to solve those last steps. I tried to edit init.rc and just add "mkdir /testdir 0000 system system" where the other directories were created. I then repacked it, zipped it, signed it, put it on my sdcard, started up a custom recovery, installed the update and rebooted. Everything seems to work fine. But when I start adb and check around, I dont see the "testdir"-directory. Also when I check in init.rc my line is gone. Do you guys have an idea of where I went wrong?

sitimber said:
so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together
Click to expand...
Click to collapse
it doesnot necesarily have to be linux ...you can also do it in windows using cygwin and dsxda's android rom kitchen

[GUIDE] Make your android device True Root! - by Napalm

[GUIDE] Make your android device True Root! - by Napalm​
I did this on my Nexus 7 but it should all still apply to most devices. You might need to follow different driver advice for other devices.
Pre-requirements:
Installation of the SDK platform-tools.
Have platform-tools directory of the SDK in your PATH environment variable (Google this if your unsure).
This was all done a Windows installation, but access to Linux will be required later on. Mac users might be able to get away with doing the Linux portions directly on there computer. Please let me know if your a Mac user and have had success with this and I will update the guide with details.
Step 1: Driver Installation (READ THIS, do not skip)
First I needed to update to the usb_driver from SDK and then modify the installation inf with the IDs for Nexus 7.
Browse to your SDK directory and futher into <SDK>\extras\google\usb_driver
Open android_winusb.inf in your favorite text editor.
Find the appropriate section Google.NTx86 if your on 32bit or Google.NTamd64 if your on 64bit (doesnt matter that your using intel chip). Now find the ";Google Nexus 7" line inside that section and you'll see a series of settings below. Add the following lines at the end of that block.
Code:
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_4E44&MI_01
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_D001
These are the identifiers for the Nexus 7 recovery and bootloader usb connections.
Step 2: Standard Root
Next you'll need access to the bootloader and recovery mode so follow this guide to unlock and "root" your device. http://forum.xda-developers.com/showthread.php?t=1741395
Here I've laid out the steps I did instead of the above. Remember this wipes your device and its internal memory completely, so backup your data.
All local work is done from the desktop, so when you first open a command prompt or if you close it and reopen it enter the following.
Code:
cd Desktop
Download CWM recovery image to Desktop. http://goo.im/devs/birdman/CWM-grouper-recovery.img
Download SuperSU CWM update zip to Desktop. http://forum.xda-developers.com/showthread.php?t=1538053
Go to Start or Start>Run and type in: cmd
Code:
cd Desktop
fastboot oem unlock
fastboot flash recovery CWM-grouper-recovery.img
adb reboot recovery
Now the device will reboot into recovery mode. If windows asks for drivers for the "new" usb connection direct the wizard to your <SDK>\extras\google\usb_driver. And the earlier modifications made in Step 1 should mean it installs the device and adb link.
Once drivers are installed and every is good go back to the command prompt, and type
Code:
adb devices
It should list your device with the word "recovery" next to it. If it doesn't then your device is not in recovery mode. Now enter in the following commands into the command prompt and it will make your devices CWM installation permanent.
Code:
adb shell
mount /system
cd /system
mv recovery-from-boot.p recovery-from-boot.bak
umount /system
exit
Now to install SuperSU. Tap "reboot system now" on the screen (if you dont see CWM, press the power button to show/hide it). Wait for the reboot. And then enter the following into the command prompt.
Code:
adb push CWM-SuperSU-v0.94.zip /sdcard
adb reboot recovery
Wait for reboot. You should see an image in the center of the screen. You might have to press the power button to toggle the visibility of the CWM menu. If you miss-tap on the screen, the power button acts like a back button and will return you to the previous menu screen.
Tap "install zip from sdcard" and then "choose zip from sdcard". Then select the CWM-SuperSU-v0.94.zip file (You may have to use the vol-up/down keys to highlight this if the file is listed off the bottom of the screen)
Let that install and then go back on the menus and choose "reboot system now".
Now if all is well after the reboot, if you run the following commands in command prompt.
Code:
adb shell
su
SuperSU might now prompt you on your devices screen to accept the root access, and then hopefully your command prompt should end in a # (this means you are root user 0). Now type exit twice to get back to the windows command prompt.
Now if you were to type "adb root" you will notice it tells you adbd is not able to go "full root". This will be solved in the next step. This is going to get complicated. You have been warned.
Step 3: True Rooting!
Now your device is "rooted". This is true, you now have a "su" binary installed and a visible app in the OS to manage super user privileges, but as a developer I want to be able to use things like "hierarchy viewer" on my live device. And have the room to do what I need to debug complex situations. So this is where True Root comes in. This essentially turns the device into a debug device that you would get direct from the manufacturer.
You may be able to get away with doing the following in a different way and you may not need to compile anything since fastboot has a boot flash option, but since I've never used this I've done it this way. If you prefer you can explore things in that direction, but be warned I've not tried it and so I have no idea if it would work.
Now for this step you will need access to a Linux installation. If you've never used Linux before don't be too afraid. But I am going to have to gloss over a few things. If you need further help on this step you will need to post in the topic and allow the community to advise on best pratices.
If you dont have access to a Linux installation or your newb to Linux then go here and follow the steps. It will add Linux to your PCs boot options and then you can go in and out of Linux when you need it. http://www.ubuntu.com/download/help/install-ubuntu-with-windows
Remember if your working on this step from a fresh Linux install like the above then you will probably want to install the android sdk for linux, at least enough to use adb from linux. This topic might help with this: http://forum.xda-developers.com/showthread.php?t=537508
Ok now from Linux follow along. You'll need git installed for this "apt-get install git".
We now need to compile the apps needed to modify our boot image. Details can be found here https://gist.github.com/1087757 but you might just want to follow my specific instructions.
Open a console window and type.
Code:
git clone https://android.googlesource.com/platform/system/core
cd core/libmincrypt
gcc -c *.c -I../include
ar rcs libmincrypt.a *.o
cd ../mkbootimg
gcc mkbootimg.c -o mkbootimg -I../include ../libmincrypt/libmincrypt.a
cd ../cpio
gcc mkbootfs.c -o mkbootfs -I../include
cd ../..
git clone https://github.com/beide/Bootimg-scripts.git
cd Bootimg-scripts
cp ../core/mkbootimg/mkbootimg ./
cp ../core/cpio/mkbootfs ./
Ok that has prapared the a Bootimg-scripts directory with the perl scripts we need and compiled binaries they use. Now make sure you have perl installed "apt-get install perl".
This is where things are going to split and it becomes your best guess as to how to proceed. I will show you the method I used from Windows. But if you have a installation of the SDK in Linux then you should be able to just open a new console and continue from here and ignore the bits I used to transfer files between Linux and Windows.
Back to the command console on Windows. We use adb to identify our boot partition and extract it.
Code:
adb shell cat /proc/partitions
You will now be presented with a list of paritions on your Nexus 7. Each block here for my device is 1K. So I'm looking down the list and I see one thats 8192 blocks, called "mmcblk0p2". Thats 8MB and I'm taking a educated guess that this is the boot partition, and for my Nexus 7 it is. (Note: if anyone has a better way of determining the boot parition please let me know).
Now we need to take a image of the partition. From here on out replace my partition device name in the commands below with yours if it differs.
Code:
adb shell
cat /dev/block/mmcblk0p2 > /sdcard/boot.img
exit
adb pull /sdcard/boot.img
Now if you want to confirm that this is the boot partition you will need to open the image file in your favorite hex editor and confirm the first bytes of the file are "ANDROID!" in ascii.
Now I FTP'd this image file over to my Linux box and into the Bootimg-scripts directory we created previously. If your following these steps from Linux then you should be able to open up the file manager and move the file into the folder.
Now back to Linux. We'll need to modify repack-bootimg.pl with a text editor of your choice. I leave this up to the reader. We need to modify line 19 the system call so that it starts with "./mkbootimg" rather than "mkbootimg". This is so perl fines mkbootimg in the local directory rather than anywhere else.
Now type in the linux console we had open in the Bootimg-scripts directory the following command.
Code:
perl ./unpack-bootimg.pl boot.img
ls -l
You should see boot.img-kernel.gz and boot.img-ramdisk.cpio.gz and a directory boot.img-ramdisk.
Open boot.img-ramdisk/default.prop in your favorite text editor and make the following adjustments.
ro.secure=1 should be edited to ro.secure=0 and ro.debuggable=0 should be ro.debuggable=1 and if you want ro.allow.mock.location can also be changed to 1 if you like.
Now we've made the required changes to our initrd (initial ramdisk) files we need to repack them to put back on the device.
Code:
perl ./repack-bootimg.pl boot.img-kernel.gz boot.img-ramdisk boot-debug.img
You will now have a new file called boot-debug.img. This contains our modified initial ramdisk. It will probably be smaller than the original. This is no concern as the original we copied was an image of the entire disk including the unused areas, where as the new image is only the data we need.
I now FTP'd this file back to my Windows machine, but as before if your doing this from Linux then you can just carry on.
We now need to flash this image file back onto the Nexus 7 replacing our current boot image. To do this we need to put the device into bootloader mode.
Back to your console/command window, and enter in.
Code:
adb reboot bootloader
Windows might want to install drivers and as before direct the wizard to <SDK>\extras\google\usb_driver.
Once your device is in bootloader mode. Go back to the console/command and enter in.
Code:
fastboot flash boot boot-debug.img
fastboot reboot
Now cross your fingers and hopefully you will get the boot loading animation and your device will get back to the Android launcher.
Now finally from your console/command window type in:
Code:
adb root
Hopefully if all is well it should reply with "adbd is already running as root". Now if you type in:
Code:
adb shell getprop ro.debuggable
It should tell you that its set to 1, meaning it is switched on.
Congratulations!! You have now True Rooted your device!.
You can now debug even system level apps, see log messages from all processes and logcat will now resolve all app names. Use Hierarchy Viewer on a live device instead of the horrible emulator. Do absolutely everything with your device that you want.
Happy hacking,
Napalm :good:

better late than never.....a thorough quide

Thanks for this guide.
Sent from my Nexus 7

Thanks.

Napalm2 said:
[GUIDE] Make your android device True Root! - by Napalm​
I did this on my Nexus 7 but it should all still apply to most devices. You might need to follow different driver advice for other devices.
Pre-requirements:
Installation of the SDK platform-tools.
Have platform-tools directory of the SDK in your PATH environment variable (Google this if your unsure).
This was all done a Windows installation, but access to Linux will be required later on. Mac users might be able to get away with doing the Linux portions directly on there computer. Please let me know if your a Mac user and have had success with this and I will update the guide with details.
Step 1: Driver Installation (READ THIS, do not skip)
First I needed to update to the usb_driver from SDK and then modify the installation inf with the IDs for Nexus 7.
Browse to your SDK directory and futher into <SDK>\extras\google\usb_driver
Open android_winusb.inf in your favorite text editor.
Find the appropriate section Google.NTx86 if your on 32bit or Google.NTamd64 if your on 64bit (doesnt matter that your using intel chip). Now find the ";Google Nexus 7" line inside that section and you'll see a series of settings below. Add the following lines at the end of that block.
Code:
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_4E44&MI_01
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_D001
These are the identifiers for the Nexus 7 recovery and bootloader usb connections.
Step 2: Standard Root
Next you'll need access to the bootloader and recovery mode so follow this guide to unlock and "root" your device. http://forum.xda-developers.com/showthread.php?t=1741395
Here I've laid out the steps I did instead of the above. Remember this wipes your device and its internal memory completely, so backup your data.
All local work is done from the desktop, so when you first open a command prompt or if you close it and reopen it enter the following.
Code:
cd Desktop
Download CWM recovery image to Desktop. http://goo.im/devs/birdman/CWM-grouper-recovery.img
Download SuperSU CWM update zip to Desktop. http://forum.xda-developers.com/showthread.php?t=1538053
Go to Start or Start>Run and type in: cmd
Code:
cd Desktop
fastboot oem unlock
fastboot flash recovery CWM-grouper-recovery.img
adb reboot recovery
Now the device will reboot into recovery mode. If windows asks for drivers for the "new" usb connection direct the wizard to your <SDK>\extras\google\usb_driver. And the earlier modifications made in Step 1 should mean it installs the device and adb link.
Once drivers are installed and every is good go back to the command prompt, and type
Code:
adb devices
It should list your device with the word "recovery" next to it. If it doesn't then your device is not in recovery mode. Now enter in the following commands into the command prompt and it will make your devices CWM installation permanent.
Code:
adb shell
mount /system
cd /system
mv recovery-from-boot.p recovery-from-boot.bak
umount /system
exit
Now to install SuperSU. Tap "reboot system now" on the screen (if you dont see CWM, press the power button to show/hide it). Wait for the reboot. And then enter the following into the command prompt.
Code:
adb push CWM-SuperSU-v0.94.zip /sdcard
adb reboot recovery
Wait for reboot. You should see an image in the center of the screen. You might have to press the power button to toggle the visibility of the CWM menu. If you miss-tap on the screen, the power button acts like a back button and will return you to the previous menu screen.
Tap "install zip from sdcard" and then "choose zip from sdcard". Then select the CWM-SuperSU-v0.94.zip file (You may have to use the vol-up/down keys to highlight this if the file is listed off the bottom of the screen)
Let that install and then go back on the menus and choose "reboot system now".
Now if all is well after the reboot, if you run the following commands in command prompt.
Code:
adb shell
su
SuperSU might now prompt you on your devices screen to accept the root access, and then hopefully your command prompt should end in a # (this means you are root user 0). Now type exit twice to get back to the windows command prompt.
Now if you were to type "adb root" you will notice it tells you adbd is not able to go "full root". This will be solved in the next step. This is going to get complicated. You have been warned.
Step 3: True Rooting!
Now your device is "rooted". This is true, you now have a "su" binary installed and a visible app in the OS to manage super user privileges, but as a developer I want to be able to use things like "hierarchy viewer" on my live device. And have the room to do what I need to debug complex situations. So this is where True Root comes in. This essentially turns the device into a debug device that you would get direct from the manufacturer.
You may be able to get away with doing the following in a different way and you may not need to compile anything since fastboot has a boot flash option, but since I've never used this I've done it this way. If you prefer you can explore things in that direction, but be warned I've not tried it and so I have no idea if it would work.
Now for this step you will need access to a Linux installation. If you've never used Linux before don't be too afraid. But I am going to have to gloss over a few things. If you need further help on this step you will need to post in the topic and allow the community to advise on best pratices.
If you dont have access to a Linux installation or your newb to Linux then go here and follow the steps. It will add Linux to your PCs boot options and then you can go in and out of Linux when you need it. http://www.ubuntu.com/download/help/install-ubuntu-with-windows
Remember if your working on this step from a fresh Linux install like the above then you will probably want to install the android sdk for linux, at least enough to use adb from linux. This topic might help with this: http://forum.xda-developers.com/showthread.php?t=537508
Ok now from Linux follow along. You'll need git installed for this "apt-get install git".
We now need to compile the apps needed to modify our boot image. Details can be found here https://gist.github.com/1087757 but you might just want to follow my specific instructions.
Open a console window and type.
Code:
git clone https://android.googlesource.com/platform/system/core
cd core/libmincrypt
gcc -c *.c -I../include
ar rcs libmincrypt.a *.o
cd ../mkbootimg
gcc mkbootimg.c -o mkbootimg -I../include ../libmincrypt/libmincrypt.a
cd ../cpio
gcc mkbootfs.c -o mkbootfs -I../include
cd ../..
git clone https://github.com/beide/Bootimg-scripts.git
cd Bootimg-scripts
cp ../core/mkbootimg/mkbootimg ./
cp ../core/cpio/mkbootfs ./
Ok that has prapared the a Bootimg-scripts directory with the perl scripts we need and compiled binaries they use. Now make sure you have perl installed "apt-get install perl".
This is where things are going to split and it becomes your best guess as to how to proceed. I will show you the method I used from Windows. But if you have a installation of the SDK in Linux then you should be able to just open a new console and continue from here and ignore the bits I used to transfer files between Linux and Windows.
Back to the command console on Windows. We use adb to identify our boot partition and extract it.
Code:
adb shell cat /proc/partitions
You will now be presented with a list of paritions on your Nexus 7. Each block here for my device is 1K. So I'm looking down the list and I see one thats 8192 blocks, called "mmcblk0p2". Thats 8MB and I'm taking a educated guess that this is the boot partition, and for my Nexus 7 it is. (Note: if anyone has a better way of determining the boot parition please let me know).
Now we need to take a image of the partition. From here on out replace my partition device name in the commands below with yours if it differs.
Code:
adb shell
cat /dev/block/mmcblk0p2 > /sdcard/boot.img
exit
adb pull /sdcard/boot.img
Now if you want to confirm that this is the boot partition you will need to open the image file in your favorite hex editor and confirm the first bytes of the file are "ANDROID!" in ascii.
Now I FTP'd this image file over to my Linux box and into the Bootimg-scripts directory we created previously. If your following these steps from Linux then you should be able to open up the file manager and move the file into the folder.
Now back to Linux. We'll need to modify repack-bootimg.pl with a text editor of your choice. I leave this up to the reader. We need to modify line 19 the system call so that it starts with "./mkbootimg" rather than "mkbootimg". This is so perl fines mkbootimg in the local directory rather than anywhere else.
Now type in the linux console we had open in the Bootimg-scripts directory the following command.
Code:
perl ./unpack-bootimg.pl boot.img
ls -l
You should see boot.img-kernel.gz and boot.img-ramdisk.cpio.gz and a directory boot.img-ramdisk.
Open boot.img-ramdisk/default.prop in your favorite text editor and make the following adjustments.
ro.secure=1 should be edited to ro.secure=0 and ro.debuggable=0 should be ro.debuggable=1 and if you want ro.allow.mock.location can also be changed to 1 if you like.
Now we've made the required changes to our initrd (initial ramdisk) files we need to repack them to put back on the device.
Code:
perl ./repack-bootimg.pl boot.img-kernel.gz boot.img-ramdisk boot-debug.img
You will now have a new file called boot-debug.img. This contains our modified initial ramdisk. It will probably be smaller than the original. This is no concern as the original we copied was an image of the entire disk including the unused areas, where as the new image is only the data we need.
I now FTP'd this file back to my Windows machine, but as before if your doing this from Linux then you can just carry on.
We now need to flash this image file back onto the Nexus 7 replacing our current boot image. To do this we need to put the device into bootloader mode.
Back to your console/command window, and enter in.
Code:
adb reboot bootloader
Windows might want to install drivers and as before direct the wizard to <SDK>\extras\google\usb_driver.
Once your device is in bootloader mode. Go back to the console/command and enter in.
Code:
fastboot flash boot boot-debug.img
fastboot reboot
Now cross your fingers and hopefully you will get the boot loading animation and your device will get back to the Android launcher.
Now finally from your console/command window type in:
Code:
adb root
Hopefully if all is well it should reply with "adbd is already running as root". Now if you type in:
Code:
adb shell getprop ro.debuggable
It should tell you that its set to 1, meaning it is switched on.
Congratulations!! You have now True Rooted your device!.
You can now debug even system level apps, see log messages from all processes and logcat will now resolve all app names. Use Hierarchy Viewer on a live device instead of the horrible emulator. Do absolutely everything with your device that you want.
Happy hacking,
Napalm :good:
Click to expand...
Click to collapse
can't find recovery-from-boot.p. Y?

5implelove said:
can't find recovery-from-boot.p. Y?
Click to expand...
Click to collapse
Try not to quote a post that big mate, makes navigation a pain

5implelove said:
can't find recovery-from-boot.p. Y?
Click to expand...
Click to collapse
That part is only for the Nexus 7, and if you are using a Nexus 7 with custom ROM then this file may not exist. If you are using stock on a Nexus 7 then the only other question is whether you have renamed/moved/deleted it before. Once you
Code:
cd /system
type
Code:
ls -l recovery*
and see if anything is listed.
Napalm

Where did you find the info for step one?
Sent from my Nexus 7 using Tapatalk 2

I worked it out. You can find your VID and PID from your unknown device in Device Manager. You have to right click the device > Properties > Details > Choose Hardware Ids from the list. Since the driver from Google supports the same interfaces for other devices we can assume it works with the Nexus 7. I made the modifications and it works. Below is a full list of IDs if anyone wants them.
Napalm
Code:
Nexus 7
USB\VID_18D1&PID_4E40 : fastboot
USB\VID_18D1&PID_D001 : adb-recovery
USB\VID_18D1&PID_4E42 : composite-adb-interface (with mtp)
USB\VID_18D1&PID_4E42&MI_00: mtp-composite
USB\VID_18D1&PID_4E42&MI_01: adb-composite
USB\VID_18D1&PID_4E44 : composite-adb-interface (with ptp)
USB\VID_18D1&PID_4E44&MI_00: mtp-composite
USB\VID_18D1&PID_4E44&MI_01: adb-composite
USB\VID_18D1&PID_4E41 : mtp-only
USB\VID_18D1&PID_4E43 : ptp-only
Galaxy Nexus
USB\VID_18D1&PID_4E30 : fastboot
USB\VID_18D1&PID_D001 : adb-recovery
USB\VID_04E8&PID_6860 : composite-adb-interface (with mtp)
USB\VID_04E8&PID_6860&MI_00: mtp-composite
USB\VID_04E8&PID_6860&MI_01: adb-composite
USB\VID_04E8&PID_6866 : composite-adb-interface (with ptp)
USB\VID_04E8&PID_6866&MI_00: ptp-composite
USB\VID_04E8&PID_6866&MI_01: adb-composite
USB\VID_04E8&PID_685C : mtp-only
USB\VID_04E8&PID_6865 : ptp-only

Great guide, but why not just post up the new initrd for people that don't want to do this? It looks as if its the same for all devices.

As requested. Attached are the compiled tools and modified scripts used and the original and modified boot partition image files for the Nexus 7 running Android 4.1.2.
Napalm

Update for Android 4.2
Attached is the original and modified boot partition image files for the Nexus 7 running Android 4.2.
You can update yours with the following:
Code:
adb reboot-bootloader
fastboot flash boot nakasi-jop40c-android42-boot-new.img
Napalm

Attached is the original and modified boot partition image files for the Nexus 7 GSM/HSPA+ running Android 4.2.1
You can update yours with the following:
Code:
adb reboot-bootloader
fastboot flash boot nakasig-jop40d-android421-boot-new.img
Napalm

Amazing !
Is it possible to post the same file for N7 4.2.1 Wifi version?
Thanks

JulienDev said:
Amazing !
Is it possible to post the same file for N7 4.2.1 Wifi version?
Thanks
Click to expand...
Click to collapse
If I'm not mistaken, they are the same for wifi and 3g versions?

Same as before.. just an update for Android 4.2.2... as per the previous posts.. no idea if the non-GSM variant has the same boot partition. If anyone can test please post.
Attached is the original and modified boot partition image files for the Nexus 7 GSM/HSPA+ running Android 4.2.2
You can update yours with the following:
Code:
adb reboot-bootloader
fastboot flash boot nakasig-jdq39-android422-boot-mod.img

Getting a No_Command error
Hi, I am trying to true root Android M on my Nexus 7 2012 Wifi edition. I followed the steps here and was able to create the boot.img with the ro.debuggable=1 and ro.secure=0. however if i flash this boot.img the device boots and gets stuck in a android bot with a Red ! (bang) triangle. and says No command.
Any idea how to get ro.debuggable on for Android M?

Backup your EFS-partition using tar and dd

This guide has been made with and for the i9505, but will most likely also work on other Galaxy S4-models.
Please be extra careful on models other than i9505 as the 'mmcblkXpXX' partition numbers might differ on your device. How to check this is written in the procedure.
As I could not find a procedure in this forum yet, I have made one myself.
Of course all of the below is 'USE AT YOUR OWN RISK'.
Requirements before you start
Install KIES software (and included driver) and connected your S4 atleast once (to see if it works)
Have ADB-executable available. It can be found in the ADT Bundle from Google. There are also much smaller packages with ADB-only which will work. I might create one myself later on and attach it to this thread..
Device is rooted and has busybox-installed (default with motochopper root method). Applications with a similar name in Play Store will allow you to install busybox manually.
Enable developer mode, go to Settings - More - Device-info - Tap 7 times on 'Build number' to unlock 'Developer options' in the previous screen. Then go to 'Developer options' and thick 'USB debugging'
Connect USB cable to your computer and smartphone with 'USB debugging' enabled
Preparations for both backup methods
Now open a ADB-shell, in Windows this would be: 'cmd' in Start-menu (or CTRL+R).
Change the directory to the ADT directory: sdk\platform-tools. In my case:
Code:
cd C:\Android\sdk\platform-tools
Then start the shell using adb:
Code:
adb shell
If you get the error:
'error: device offline'
Then, check your device and allow USB debugging for the presented device. Now try again the command 'adb shell'
If all goes well, you will see the following:
[email protected]:/ $
Now switch to root-user:
Code:
su -
It is possible that the phone now asks you to permit or deny root access. Of course, please permit.
When the switch succeeds, the '$' changes to '#', but you can also verify it by the id-command:
Code:
[email protected]:/ # id
id
uid=0(root) gid=0(root) context=u:r:shell:s0
If it shows root, all is fine.
Then, check with the following command if /efs is available and mounted:
Code:
mount | grep efs
It should show something like:
Code:
mount | grep efs
/dev/block/platform/msm_sdcc.1/by-name/efs /efs ext4 rw,seclabel,nosuid,nodev,no
atime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,errors=panic
,data=ordered 0 0
Backup method using TAR
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
Run the folowing command to backup the whole efs-partition (all the files available on the system):
Code:
tar -cvf /data/media/0/efs.tar /efs
Your output will look like this:
Code:
[email protected]:/ # tar -cvf /data/media/0/efs.tar /efs
tar -cvf /data/media/0/efs.tar /efs
tar: removing leading '/' from member names
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
This will add all files in /efs to the tar archive located on your internal memory as 'efs.tar'.
Now, the permissions of this tar are incorrect (for this location) so we have to correct them:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.tar
And the file permissions:
Code:
chmod 664 /data/media/0/efs.tar
Now, your tar-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.tar .
This will copy the efs.tar to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
Backup method using 'dd'
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
From the output of the earlier executed command 'mount | grep efs', you can get the path of the EFS partition. It start with '/dev/block/..' is the part which you can use to find the original partition on your device.
As you can see, in my case this is, and I do not expect it to be any different on your device:
/dev/block/platform/msm_sdcc.1/by-name/efs
To check which 'mmcblk' partition it is, we should check out this link:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
This will show you the mmcblk which is the EFS-partition:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
lrwxrwxrwx root root 1970-01-05 23:39 efs -> /dev/block/mmcblk0p10
As you can see, the actual partition in my case is:
Code:
/dev/block/mmcblk0p10
I expect that this is the same for all i9505-devices, but it's better safe to check it. On i9500-devices this might be a different number as they have a different partition-layout, that's why we're checking this. It is very important to save this location, also for future restores.
Now, to backup the partition using dd, run the following command, please make sure that the part directly after 'if=' is the partition you found using the 'ls -l' command. In my case '/dev/block/mmcblk0p10':
Code:
dd if=/dev/block/mmcblk0p10 of=/data/media/0/efs.img
When it finishes, it will show you something like:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This command reads the efs-partition, byte-by-byte to your internal memory, which you can transfer later on to your PC using ADB or MTP.
As the file created is owned by root:root and doesn't have the default permissions used for files at this location, it can be corrected with the following 2 commands:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.img
And the file permissions:
Code:
chmod 664 /data/media/0/efs.img
Now, your DD-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.img .
This will copy the efs.img to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
To restore the files
Now to restore the files, in case there is really a need to, like imei-number ****up or something with the MAC-address of your wifi, or whatever.. the following commands can be used:
Of course, once again. USE AT YOUR OWN RISK!!!! Do not use this if not really necessary, as there are risks involved in doing this.
To restore the tar-backup, open 'adb shell' and switch to root using 'su -'. Now, first switch to the root directory, which is most likely not needed, but just to make sure the files will be extracted to the right location:
Code:
cd /
Before executing the next command, I assume that you have the efs.tar file in the root-directory of your internal SD-card.
Now, extract the tar file:
Code:
tar -xvf /data/media/0/efs.tar
This will extract the efs.tar file back to it's original location. It will show you something like:
Code:
[email protected]:/ # tar -xvf /data/media/0/efs.tar
tar -xvf /data/media/0/efs.tar
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
Then reboot your phone normally and see if it works again as you would expect.
If you restored the TAR-backup succesfully, you do not need to restore the dd-image. But in case your tar did not work or your /efs is not mounted due to corruption (in recovery) you can try the dd-recovery instead.
PLEASE BE AWARE THAT YOU SHOULD BE SURE ABOUT THE LOCATION OF THE EFS-PARTITION. THIS LOCATION WAS FOUND USING the 'ls -al /dev/block/platform/msm_sdcc.1/by-name/efs'-COMMAND EARLIER DESCRIBED. If you do not know this location, there's a risk you are overwriting other partitions (MODEM, SYSTEM, RECOVERY, ETC).
If you are sure about the original location, /dev/block/mmcblk......, then use this path just straight after 'of='. On my device the partition is /dev/block/mmcblk0p10.
Code:
dd if=/data/media/0/efs.img of=/dev/block/mmcblk0p10
Output will be similar to:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This will read the efs.img and put it back in the original location.
NOTE 1: This thread gives you two options of backupping the EFS-partition. It is preferred to do both, better safe than sorry.
NOTE 2: Luckily, I have never had to restore any of the backups myself (not on this phone and not on earlier phones). This means that I was never able to test the restores, which counts for the most of us.
NOTE 3: DO NOT RESTORE unless you are really sure this will solve your issue. This will never resolve any lag or other problems with your rom.
NOTE 4: It is normal that the DD-file is much larger (10MB in size) as it also copies unused space and other meta-data of the partition.
NOTE 5: USE AT YOUR OWN RISK! Although the backup part is nearly riskless.
Note X: Feel free to thank me for this post.

Reservation for second post, just in case.

Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?

johan81 said:
Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?
Click to expand...
Click to collapse
Yes, zipping is easier but you will lose your permissions (owner and file permissions (changed via chown/chmod)) so it is actually not a good backup. The permissions/ownerships are backupped with the tar- and dd-backup.
The dd-file includes more than just the file; it also contains the partition meta-data, in case your filesystem got corrupted and it is not possible to recovery it.

Good job man.

EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546

shaq1907 said:
EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546
Click to expand...
Click to collapse
dont seem to work crashes out while backing up
working now with new update

anybody knows how to adb read the the entire partition table of the galaxy s4?

[GUIDE] How to fix the touchscreen in TWRP (Moto G 5G)

In this guide a describe how you can easily fix the touchscreen issue in TWRP for Moto G 5G.
Before providing the necessary steps, I would like to express my gratitude to the guys here, especially Andrew Hexen for providing the sources and instructions to build the TWRP for this great device.
Building the TWRP from source might result in a recovery without the touchscreen support. To fix that, you can follow these simple steps.
First, we need to extract the touchscreen drivers from the phone. To do this, you need to boot to TWRP. Connect your phone to your PC, open up the terminal and type:
Bash:
# reboot to bootloader
adb reboot bootloader
# boot to recovery
fastboot boot twrp.img
Wait for the phone to boot to recovery. If your phone uses password/PIN or other forms of protection you might have to decrypt the filesystem before proceeding. You can use OTG mouse to do that.
On your PC, in terminal type:
Bash:
adb pull "/vendor/lib/modules/" <path to where you want the modules folder to be pulled>
This will pull from the phone all the necessary drivers, among those are the drivers for the touchscreen. (Probably you could pull just the touchscreen driver, but to be sure I pulled everything.)
On you PC, use Android Kitchen to unpack the recovey image. I usually use the terminal to go to the Android Kitchen folder and I run:
Bash:
./unpacking.sh <path to your twrp.img>
Then go to ramdisk folder that was created by Android Kitchen
Bash:
cd ramdisk
and manually create the following folder:
Bash:
sudo mkdir -p vendor/lib/modules
Then copy the drivers you previously pulled from your phone to this folder:
Bash:
sudo cp <path to modules folder with drivers>/* vendor/lib/modules/
In the ramdisk folder open the init.rc file. We need to open it as su user. You can use:
Bash:
sudo gedit
and then open the file from the editor.
Find the following lines:
Code:
# Load properties, Android 6.0+, vendor init lives here
on load_persist_props_action
load_persist_props
and add a line after load_persist_props so that you get:
Code:
# Load properties, Android 6.0+, vendor init lives here
on load_persist_props_action
load_persist_props
start load_modules # this is the line you must add
Use Android Kitchen to repack the image:
Bash:
cd .. # to move back to the folder where Android Kitchen is
./repacking.sh
You'll get a file called image-new.img. That's your new recovery with a working touchscreen!
I'm sure there's a better way to do this so feedback is welcome.

I tired your method and completed with a newimage file, and flastboot booted off it. Still had touch problems, files attached. Vendor.zip was placed in ramdisk\vendor\lib\modules. Any ideas?
Thankyou
PS (edit): would anything needed to be added to ramdisk/vendor/manifest.xml?

Lostwon said:
I tired your method and completed with a newimage file, and flastboot booted off it. Still had touch problems, files attached. Vendor.zip was placed in ramdisk\vendor\lib\modules. Any ideas?
Thankyou
Click to expand...
Click to collapse
Lostwon said:
I tired your method and completed with a newimage file, and flastboot booted off it. Still had touch problems, files attached. Vendor.zip was placed in ramdisk\vendor\lib\modules. Any ideas?
Thankyou
PS (edit): would anything needed to be added to ramdisk/vendor/manifest.xml?
Click to expand...
Click to collapse
PPS I am trying this on the Moto G stylus xt2043-4. I just noticed thats not the phone you wrote this for, Im going to pull and umpack my stock recovery and compre that to the Twrp3.4 image and see whats missing .

GUIDE: Visible Midnight (Wingtech WTVIS01) Backup, Restore, Root, Bootloader-unlock and making partition's read-write.

So I've became the lucky owner of two of these devices, and after hosing one and having to rebuild from scratch I want to provide some helpful information on rooting, backing up the device and general info that may or may-not be needed! So let's start this party off right!
These commands posted are for the Linux terminal, add python if using windows or play with the command line of mtkclient to figure things out, I can't assume what everyone OS's are.......
1. get yourself mtkclient from here : https://github.com/bkerler/mtkclient
follow all the steps regarding setup regardless if on Linux or Windoze!
2. BACK-UP the Full device using mtkclient, doing so will save yourself a lot of aggravation that I endured during my endeavors! This will do a Full back-up of the device by partition and place in a single file for making restore painless.
Power OFF the phone
Issue the mtkclient command via Terminal
Code:
mtk rf flash.bin
HOLD VOL+ & VOL- and plug-in the USB-C, if done correctly the phone will go into brom.
Once done backing up ( Total Time is around 60 minutes or less ) we're going to issue the last command, this resets mtkclient safely)
Code:
mtk reset
2a. Restoring you're Device
Now we're going to issue THREE mtk commands, the first is, assuming you're working in the same directory you back-up the file to.
Code:
mtk wf flash.bin
Without un-plugging, issue the next to wipe all data for a full reset.
Code:
mtk e metadata,userdata,md_udc
followed by reset
Code:
mtk reset
In the extreme case I suffered, you need to let the phone die completely if unable to enter brom the normal way, once dead follow the process as if you just turned it off.
This situation came about while I began to figure out how to get twrp working on the device.
Total size of this back-up will be around 32GB, so store in a safe place.. Also, DO NOT SHARE THIS IMAGE WITH ANYONE!!!! It contains all of the phone's sensitive info (IMEI)

Now let's talk rooting with or without bootloader-unlocked.
The good new's about this device is we can use mtkclient to bypass unlocking the bootloader for flashing a rooted boot.img patched by Magisk, the bad new's is that the phone will default to boot_b and not the boot the root boot.img so unlocking the bootloader is a must.
adb install app-release.apk that is attached, this Magisk that is designed for mtk devices and frankly has worked the best for me, once installed we're going to back-up the stock boot with the following commands using mtkclient.
Code:
mtk r boot_a boot.img
mtk reset
this will be placed in you mtkclient directory and will need transferred to the storage for patching by the Magisk app. once done we will transfer the file back to our mtkclient directory.
boot once again back into brom and issue the command
Code:
mtk w boot_a magisk_patched.img
mtk reset
keep in mind that each patched boot.img will be named different so this is not a copy and paste thing currently.
however, if you want to install an already patched version of the boot.img you can download the attached boot.img, place into your mtkclient directory and issue this command
Code:
mtk w boot_a magisk_patched-23001_nx6U2.img
mtk reset
For bootloader-unlocking, just follow the read-me file for more in-depth instructions, however this will get you going regarding the unlock.
boot back into brom and issue the following commands, if done correctly the bootloader is now unlocked. However this is needed for simple root, just flash the attached boot.img
Code:
mtk da seccfg unlock
mtk e metadata,userdata,md_udc
mtk w vbmeta vbmeta.img.empty
mtk reset

This particular guide is addressing Super.img read-writable, focusing on making all partitions write-able for the reason updating the phone with GSI Images or just needing access to add / remove files on the phone.
I found this post most helpful regarding super.img, as i had issue at first understanding boot-loops at first. https://forum.xda-developers.com/t/...s-rw-in-super-partition.4120963/post-87112415
This is assuming you are now comfy with brom, familiar with using mtk and also on Linux.
I've already done all the work need for converting hex to dec, and is a start copy of my note's and the steps I took to get things working. I'll attach the file as well for off-line use if needed as well.
First we need to back-up the super.img from the brom using the following command with-in the mtkclient directory. make a copy of this before we begin and keep in a safe place!!!
Code:
mtk r super super.img
once done we will use this tool to break down the image's into readable partition's using linux.
[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition
Disclaimer: Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything...
forum.xda-developers.com
once you have your super.img placed into the new extracted directory, we're going to issue a command using terminal from said directory.
Code:
./superunpack.x64 super.img
next we're going to create THREE folders call system, vendor, product. ( Vendor & Product is optional if editing system only )
So lets start with system as most will only likely be editing that for rw access, so let's get down to it.
Code:
e2fsck -f system_a.ext4
resize2fs system_a.ext4 2G
e2fsck -y -E unshare_blocks system_a.ext4
e2fsck -fy system_a.ext4
sudo mount -t ext4 -o,rw system_a.ext4 system
now you're ready for system edits, once done we need to unmount the system using this command
Code:
sudo umount system
next we need to fix the system and resize it so we can add it back into the super.img following these commands.
Code:
e2fsck -fy system_a.ext4
resize2fs system_a.ext4 353376
once done we can use DD the system back into super,img, keep in mind this takes a very long time as it need to read the block and search for the offset that we're using.
Code:
dd if='system_a.ext4' of='super.img' bs=1 seek=2315255808 count=1447428096 conv=notrunc
once done we need to move the new super.img to our mtkclient folder, and flash using
Code:
mtk w super super.img
mtk reset
if done correctly it will boot with read / write access to the system partition.
again I've attached my notes that also include Vendor & Product to keep this thread to a minimum! however i will include partition sized and dd instruction here for vendor, product & system for short hand viewing on-line.
SYSTEM
e2fsck -fy system_a.ext4
resize2fs system_a.ext4 353376
dd if='system_a.ext4' of='super.img' bs=1 seek=2315255808 count=1447428096 conv=notrunc
PRODUCT
e2fsck -fy product_a.ext4
resize2fs product_a.ext4 461253
dd if='product_a.ext4' of='super.img' bs=1 seek=1048576 count=1889292288 conv=notrunc
VENDOR
e2fsck -fy vendor_a.ext4
resize2fs vendor_a.ext4 103509
dd if='vendor_a.ext4' of='super.img' bs=1 seek=1890582528 count=423972864 conv=notrunc

Last but not least, if anything this the most important part regarding Development.
Attached is the Project config make file, I've not currently tried to build this as I'm still digging into this device. However it is a nice Find as it has the build condition as well as the driver info.
some might recall this as a /proc/config.gz file but again we have no kernel source but clearly it's not impossible to build having all the info, but it's a long road.