EPST and /dev/smd Devices Research - EVO 4G Android Development

(This post will only make sense to developers)
SMD devices are the /dev/smd* character devices on Sense and cyanogenmod
Cyanogenmod 7 comes with /dev/smd0 and /dev/smd27
Sense comes with /dev/smd0, 1, 9, 19, 26 and 27
Their nodes are major number 254 minor number same as the number in the file. So, e.g. /dev/smd0 is a 254,0 node, and /dev/smd27 is a 254,27
0 and 19 are owned by radio, the rest are owned by root
what each appears to do...
0 : radio commands
1 : ??
9 : ?? opened by dmagent process
19 : prints out HTC_RMSL and HTC_ROTKSL when running ##DATA# as well as hex strings when connecting 4G
26 : prints out →→→→→→→→→→→→→→→→
27 : GPS/AGPS data
I was looking at these trying to figure out what GPSCLRX does. I think dmagent receives commands from the DM Service and possibly writes commands to these files (devices). I tried replacing each SMD file with a 'mkfifo', and catting from it, to see if GPSCLRX was sending commands there, but it didn't seem to show anything.
One can use strace to trace dmagent and e.g. get it going on cyanogenmod .. need to copy libs to /vendor/lib and then make a null device in /dev/smd9
adding the htc framework to BOOTCLASSPATH should get epst going, haven't had a chance to try it yet though. add main intents to the activites to be able to launch them.

gpsclrx is a gps cache clear command, you can dial ##gpsclrx# on a sense ROM and it wipes gps info clean. in fact, if you are having issues with gps locking on in cm7, you have to boot into a sense rom, use that command, then go back to a clean cm7 install.

timothydonohue said:
gpsclrx is a gps cache clear command, you can dial ##gpsclrx# on a sense ROM and it wipes gps info clean. in fact, if you are having issues with gps locking on in cm7, you have to boot into a sense rom, use that command, then go back to a clean cm7 install.
Click to expand...
Click to collapse
That is correct. Trying to figure out what it does exactly, so that functionality could be put in an app for CM7.

I can't translate any of that and I have no idea what that means. But definitely a good idea and what looks like a good start on getting GPSCLR functionality on CM.

timothydonohue said:
gpsclrx is a gps cache clear command, you can dial ##gpsclrx# on a sense ROM and it wipes gps info clean. in fact, if you are having issues with gps locking on in cm7, you have to boot into a sense rom, use that command, then go back to a clean cm7 install.
Click to expand...
Click to collapse
I went back to my CM7 nandroid with broken GPS, and well it wasnt broken anymore (after ##gpsclrx# on sense rom)

what im taking from this is he is trying to make it so u can keep running the CM7 and not have to flash the sense rom anymore. while im out to sea im trying to add this stuff also like u are.

There must be a way to access the "radio" from an app of some sort

Allegedly these guys have found some way to enable the EPST menu for AOSP, but I have yet to see that apk. It has been about a month and no update. They link to Github, and I have picked apart everything in the zip, but I have no idea what it all means/does. Maybe you can take a look and see if anything is there.

I could be wrong, but doesn't the GPS Status app perform the same function as GPSCLR outside of the EPST framework? If so, then that might be a clue. Of course, EPST support in ASOP ROMs would be better.

That app in the link will not necessarily allow EPST commands on CM. I plan to update that post tonight to clear things up...
Sent from my Evo

snandlal said:
There must be a way to access the "radio" from an app of some sort
Click to expand...
Click to collapse
There is now. http://cleanimport.xda/index.php?threads/1037075/

strung said:
(This post will only make sense to developers)
SMD devices are the /dev/smd* character devices on Sense and cyanogenmod
Cyanogenmod 7 comes with /dev/smd0 and /dev/smd27
Sense comes with /dev/smd0, 1, 9, 19, 26 and 27
Their nodes are major number 254 minor number same as the number in the file. So, e.g. /dev/smd0 is a 254,0 node, and /dev/smd27 is a 254,27
0 and 19 are owned by radio, the rest are owned by root
what each appears to do...
0 : radio commands
1 : ??
9 : ?? opened by dmagent process
19 : prints out HTC_RMSL and HTC_ROTKSL when running ##DATA# as well as hex strings when connecting 4G
26 : prints out →→→→→→→→→→→→→→→→
27 : GPS/AGPS data
I was looking at these trying to figure out what GPSCLRX does. I think dmagent receives commands from the DM Service and possibly writes commands to these files (devices). I tried replacing each SMD file with a 'mkfifo', and catting from it, to see if GPSCLRX was sending commands there, but it didn't seem to show anything.
One can use strace to trace dmagent and e.g. get it going on cyanogenmod .. need to copy libs to /vendor/lib and then make a null device in /dev/smd9
adding the htc framework to BOOTCLASSPATH should get epst going, haven't had a chance to try it yet though. add main intents to the activites to be able to launch them.
Click to expand...
Click to collapse
I am running a modified Savaged-Zen AOSP rom at the moment. Added EPST.apk and com.htc.framework.jar. I edited the init.rc file in the bootimage, added the com.htc.framework.jar to the BOOTCLASSPATH.
I created a shortcut to launch EPST (com.google.android.epst.EPST) and an still seeing the missing method error referencing parts from the htc framework jar.
I know launching EPST like that wont "work", point was only to see if including that jar in the init.rc would resolve the log errors about missing methods.
Is there something else needed to have that jar file loaded on boot?

strung said:
(This post will only make sense to developers)
SMD devices are the /dev/smd* character devices on Sense and cyanogenmod
Cyanogenmod 7 comes with /dev/smd0 and /dev/smd27
Sense comes with /dev/smd0, 1, 9, 19, 26 and 27
Their nodes are major number 254 minor number same as the number in the file. So, e.g. /dev/smd0 is a 254,0 node, and /dev/smd27 is a 254,27
0 and 19 are owned by radio, the rest are owned by root
what each appears to do...
0 : radio commands
1 : ??
9 : ?? opened by dmagent process
19 : prints out HTC_RMSL and HTC_ROTKSL when running ##DATA# as well as hex strings when connecting 4G
26 : prints out →→→→→→→→→→→→→→→→
27 : GPS/AGPS data
I was looking at these trying to figure out what GPSCLRX does. I think dmagent receives commands from the DM Service and possibly writes commands to these files (devices). I tried replacing each SMD file with a 'mkfifo', and catting from it, to see if GPSCLRX was sending commands there, but it didn't seem to show anything.
One can use strace to trace dmagent and e.g. get it going on cyanogenmod .. need to copy libs to /vendor/lib and then make a null device in /dev/smd9
adding the htc framework to BOOTCLASSPATH should get epst going, haven't had a chance to try it yet though. add main intents to the activites to be able to launch them.
Click to expand...
Click to collapse
I've tried to intercept /dev/smd traffic with a fifo before too, it just won't work. What *does* work is to use a pty instead. My rilspy project on gitorious does this. You could use that as an example to try these other devices. Actually my guess is that you only need to see the /dev/smd0 traffic, which my rilspy will show you. Install it on sense, run epst, see what commands it issued.
Sent from my FRX06+ TP2 using Tapatalk

Related

Possible backdoor loader?

Using Anycut, select Activity, and in there choose "Device info". This tells you all the build related info, and on the bottom there is a way to check for new builds depending on your "build type". Maybe if using the wifi IP settings forced it through a proxy, where we would sniff the request. Possibly see if there are builds (beta?) we could load, or redirect it to a custom build?
worldestroyer said:
Using Anycut, select Activity, and in there choose "Device info". This tells you all the build related info, and on the bottom there is a way to check for new builds depending on your "build type". Maybe if using the wifi IP settings forced it through a proxy, where we would sniff the request. Possibly see if there are builds (beta?) we could load, or redirect it to a custom build?
Click to expand...
Click to collapse
Great find
We should start a list... I will even keep all the data in a spread sheet if everyone can give me all the info
Build Description
Build ID
Build Date
Build Type
Build User
Build Host
Linux Kernal version
Baseband Version
RIL Impl version
Android ID
G1 back door updater
I have a G1 without the update... I also have adb shell access to it and succesfully ran bash and busybox on it. I know where all the partitions are in the filesystem (mtdblock1-5) and where the kernel resides (boot is mtdblock2).
When the upgrade comes out, I will sniff the packets and let you guys know (and possibly even put the upgrade file up for download somewhere).
Build Description
kila-user 1.0 TC4-RC19 109652
ota-rel-keys, release-keys
Build ID
TC4-RC19
Build Date
Sat Sep 13 00:11:34 PDT 2008
Build Type
user
Build User
android-build
Linux Kernel version
2.6.25-01828-g18ac882
[email protected] #1
Thu Sep 11 23:18:27 PDT 2008
Baseband Version
62.33.20.08H_1.22.12.28
RIL Impl version
HTC-RIL 1.0 (Aug 19 2008, 21"32:33)
damien667 said:
I have a G1 without the update... I also have adb shell access to it and succesfully ran bash and busybox on it. I know where all the partitions are in the filesystem (mtdblock1-5) and where the kernel resides (boot is mtdblock2).
When the upgrade comes out, I will sniff the packets and let you guys know (and possibly even put the upgrade file up for download somewhere).
Build Description
kila-user 1.0 TC4-RC19 109652
ota-rel-keys, release-keys
Build ID
TC4-RC19
Build Date
Sat Sep 13 00:11:34 PDT 2008
Build Type
user
Build User
android-build
Linux Kernel version
2.6.25-01828-g18ac882
[email protected] #1
Thu Sep 11 23:18:27 PDT 2008
Baseband Version
62.33.20.08H_1.22.12.28
RIL Impl version
HTC-RIL 1.0 (Aug 19 2008, 21"32:33)
Click to expand...
Click to collapse
The upgrade will download at various times... it will ask you to update after it has downloaded.
BTW I added two fields I forgot. Build Host (I am wondering if this is different for some and that is how they get updates) and Android ID (also wondering if this has to do with updates.)
Here is my info
Build Description
kila-user 1.0 TC4-RC19 109652
ota-rel-keys, release-keys
Build ID
TC4-RC19
Build Date
Sat Sep 13 00:11:34 PDT 2008
Build Type
user
Build User
android-build
Build Host
undroid13.corp.google.com
Linux Kernel version
2.6.25-01828-g18ac882
[email protected] #1
Thu Sep 11 23:18:27 PDT 2008
Baseband Version
62.33.20.08H_1.22.12.28
RIL Impl version
HTC-RIL 1.0 (Aug 19 2008, 21"32:33)
Android ID
200145da5528c72d
Important information vs useless information
What is useless information is the serial numbers or which machine built your ROM image.
What IS NOT useless, and VERY important, is the ip address and/or domain name where the update file is downloaded from as well as the location of said file on said server, as well as the file name itself.
With that information, we could technically cook our own updates to the firmware if we figure out how to build one, simulate the updating server on a local network, and spoof the phone into thinking it's receiving a legit update when it's actually putting a cooked update onto itself... no need for root access to update the phone!
I read that you will receive a text message with a "download now" button to proceed with the update... if this is true, I can capture the entire traffic sequence of said update and we can emulate it on a local network.
I've tried some preliminary tests using the AnyCut app to open the page to force a "check for updates" and see what server it connects to but could not sniff packets from my wired LAN to my wireless LAN... I will try to sniff the packets straight on my linux router next time and see if I can tell who the phone talks to to check for updates.
If anyone wants to help, that would be excellent.
damien667 said:
What is useless information is the serial numbers or which machine built your ROM image.
What IS NOT useless, and VERY important, is the ip address and/or domain name where the update file is downloaded from as well as the location of said file on said server, as well as the file name itself.
With that information, we could technically cook our own updates to the firmware if we figure out how to build one, simulate the updating server on a local network, and spoof the phone into thinking it's receiving a legit update when it's actually putting a cooked update onto itself... no need for root access to update the phone!
I read that you will receive a text message with a "download now" button to proceed with the update... if this is true, I can capture the entire traffic sequence of said update and we can emulate it on a local network.
I've tried some preliminary tests using the AnyCut app to open the page to force a "check for updates" and see what server it connects to but could not sniff packets from my wired LAN to my wireless LAN... I will try to sniff the packets straight on my linux router next time and see if I can tell who the phone talks to to check for updates.
If anyone wants to help, that would be excellent.
Click to expand...
Click to collapse
HTC is already telling people how to cook your own rom. I want to know how they go about deciding who gets the updates and when... are the build hosts all the same? or do they differ? is our ID sequential? does it mean something? At this point I don't think there is any useless info... we don't know enough about the entire process.
I will see what I can sniff in wireshark but I am not sure. I would really like to get my hands on a prerelease version and find out it's info.
HTC takes the Android SDK with kernel and rootfs, compiles it with the ARM toolchain, adds the proprietary t-mobile stuff, and makes an image to flash onto the phone. All of this information AND sourcecode is available from Google's GIT repository in the android SDK sourcecode. You can find it all here:
http://git.source.android.com/?p=platform/vendor/htc/dream.git;a=tree;h=refs/heads/master;hb=master
Since this phone goes through t-mobile, they are the ones who decide the updating process and order. According to their forums it's random.
http://forums.t-mobile.com/tmbl/board/message?board.id=87&thread.id=8855&view=by_date_ascending&page=1
The point is to get a back door into the root shell account so we can run whatever code we want on the phone as the root user... this will give us the ability to put a home-cooked android compilation on the phone if we so pleased.
Another way to do this is to figure out how the bootloader works on the phone and somehow tell it to boot up from a kernel in the sd card instead of the one in the ROM.
... I read that google was responsible for deploying the updates and that is why it is random. I think it is because they use your android ID not your IMEI or any other number. And I bet all our android ID's have similarities.
BTW... I ran the debug client and the FOTA is cancelled by the server. It then crashes. So I am guessing what we are doing isn't working. There must be something else.
I have my G1 connected over wifi to my network. Using Cain to arp poison and wireshark to sniff.
Sorry to say, but I saw this one coming...the "call home" is encrypted via TLS/SSL.
Mine was contacting Google at 74.125.19.102. I captured the ssl cert. You can get a copy of it here: http://rapidshare.com/files/158237323/74.125.19.102.crt.html
More info to come
I figured it would call google.... but google sends an abort to my device. I know what classes it uses to call home... maybe we can figure it out in there.
Caught something interesting. Apparently when it calls home, its gives google quite a bit of information. I have censored some of it, such as IMEI, serial number, etc
Code:
POST /checkin HTTP/1.1
Content-type: org/x-json
Content-Length: 271
Host: android.clients.google.com
Connection: Keep-Alive
User-Agent: Android-Checkin/1.0
{"imei":"***************","checkin":{"build":{"bootloader":"0.95.0000","serialno":"************","carrier":"tmobile","radio":"62.33.20.08H_1.22.12.28","revision":"128","id":"tmobile/kila/dream/trout:1.0/TC4-RC19/109652:user/ota-rel-keys,release-keys","product":"trout"}}}HTTP/1.1 200 OK
Date: Tue, 28 Oct 2008 05:01:58 GMT
X-Content-Type-Options: nosniff
Expires: Tue, 28 Oct 2008 05:01:58 GMT
Cache-Control: private, max-age=0
Content-Length: 102
Content-Type: text/html
Server: GFE/1.3
{"stats_ok":true,"time_msec":1225170118172,"intent":[{"action":"android.server.checkin.FOTA_CANCEL"}]}
I dont think this feature is going to help us. It just looks like a way for the phone to call home. Now if somebody can get a full capture of the update when its transferred, then we might have something useable.
I don't think we even need to sniff it... I just think we need to dump it from the device. My device has a file in its firmware folder... hmmm
neoobs said:
I don't think we even need to sniff it... I just think we need to dump it from the device. My device has a file in its firmware folder... hmmm
Click to expand...
Click to collapse
How did you find that out?
used ADB to browse my files
The checkin mentions keepalive, might this just be a keepalive for push services?
I don't like how it's sending all of the phone's info w/ just ssl. You could conceivably swipe someones IMEI and serial no. and send a keepalive, I wonder what you would start getting if you did that...
I would prefer a session key hashed w/ time w/ a public key from Google. That would do, right?
Whatever... This kind of bothers me.
I have the certs from my phone that I pulled. Wonder if that will help.
The data I got was not encrypted! There was some other information that was encrypted that I havent tried to crack.
Unless wireshark decrypted the data on the fly (which I dont think it did), the data I retrieved was NOT encrypted.
damien667 said:
HTC takes the Android SDK with kernel and rootfs, compiles it with the ARM toolchain, adds the proprietary t-mobile stuff, and makes an image to flash onto the phone. All of this information AND sourcecode is available from Google's GIT repository in the android SDK sourcecode. You can find it all here:
http://git.source.android.com/?p=platform/vendor/htc/dream.git;a=tree;h=refs/heads/master;hb=master
Since this phone goes through t-mobile, they are the ones who decide the updating process and order. According to their forums it's random.
http://forums.t-mobile.com/tmbl/board/message?board.id=87&thread.id=8855&view=by_date_ascending&page=1
The point is to get a back door into the root shell account so we can run whatever code we want on the phone as the root user... this will give us the ability to put a home-cooked android compilation on the phone if we so pleased.
Another way to do this is to figure out how the bootloader works on the phone and somehow tell it to boot up from a kernel in the sd card instead of the one in the ROM.
Click to expand...
Click to collapse
I am no linux guru......but why not write a backdoor into the kernel if we have the source?? I dont think i know C , nor linux system programing enough to do this...but it seems relatively easy.
or we could always wait for an exploit for the 2.6.25 kernel and then compile it for the android.
I would personally love to be able to use the nice andriod ui, but have the ability to pop a root shell and run all of the linux code i have come to love.

[Q] NokiaSU-8W bluetooth keyboard on lgp500?

Hi I have a lg p500 and Nokia su-8w don´t work for me on froyo 2.2 (amberhome-1.1)
but I test on with blueinput on lg gw620 froyo 2.2.1 and work without sync.
if you start adb logcat can you see this on lg p500 with froyo 2.2 :
I/BTL-IFS ( 2439): main_server_thread: [CTRL] Client connected (22)
I/BTL-IFS ( 2439): attach_client: multiclient index 0
I/BTL-IFS ( 2439): attach_client: ######## Attached client subsystem BTS (22) ##
######
I/BTL-IFS ( 2439): btl_if_notify_local_event: Notify local event BTLIF_SUBSYSTEM
_ATTACHED
D/ ( 2439): btlif_bts_api_ctrl_cb: btlif_bts_api_ctrl_cb : id BTLIF_SUBSY
STEM_ATTACHED (4112) on hdl 22
I/ ( 2439): btlif_rfc_ctrl_chan_attached: client attached ctrl handle 22
D/BTL-IFS ( 2439): send_registration_rsp: send_registration_rsp [0]
I/BTL-IFS ( 2439): send_ctrl_msg: [BTL_IFS CTRL] send BTLIF_REGISTER_SUBSYS_RSP
(CTRL) 2 pbytes (hdl 22)
E/BLZ20_WRAPPER( 2476): ##### ERROR : blz20_wrp_connect: protocol BTPROTO_L2CAP
not yet supported#####
E/BLZ20_WRAPPER( 2476): ##### ERROR : blz20_wrp_close: protocol BTPROTO_L2CAP no
t yet supported#####
I/BI::GUI ( 2476): Connect to (Nokia SU-8W) res=-2 (0=SUCCESS)
I think the problem is the l2cap protocol is not suported well on 2.2
Can anyone help me?
I thing this can solve update the aosp to 2.2.1 on lg p500.
If you can try Prime v2 ROM, it's 2.2.1
http://forum.xda-developers.com/showthread.php?t=881045
what BT stack does Prime use? I've asked LG and they told me, that the do not plan to support HID on Opimus One.
SUCCESS
Already I could have connected it but not with android I using the bluez tools:
here the steps(root needed):
in terminal or adb shell(wifi, usb generate problems):
echo 1 > /sys/class/rfkill/rfkill0/state
hciattach -n -s 115200 /dev/ttyHS0 any &sleep 5
hciconfig hci0 up
hcitool scan (for device address)
hidd --connect (device address in format 00:00:00:00:00:00)
great!
which rom do you use?
could work with this keyboard?
thanks
My ROM amberhome-1.1
I think yes working with this method teoricaly with all hid keyboards but i don't sure only have Nokia keyboard I don't try with other.
But dont power on the bluetooth with android frezze the phone.
Whem I have time develop an android apk.(comming soon)
Bye
Works even with Bluetooth mini keyboard! THANK YOU!!!!
cant wait it to get ready.
I also you amberhome 1.5 on my LG P500. And have a chinfai keyboard.
Perhaps curvin (maker of amberhome) could directly integrate it?
hello, i tried the above steps but when i start hciconfig it returns me that:
hcitool scan
Code:
link_image[1997]: failed to link hcitool
CANNOT LINK EXECUTABLE
it seems the hcitool executable doesn't want to run in my phone...
stock rom?
Trying on an Optimus T with stock ROM (v10l). hciconfig and/or hciattach gives a device not found error.
Will it be possible to get this working with just a kernel upgrade or is there something else needed?
Trying with a different kernel, I don't get the device error anymore, but connectbot says the shell disconnected after I run hidd. At any time after connecting hid0 if I try to do something bluetooth-related, such as turn bluetooth on if it was off, or scan for devices if it had already been on, the phone locks up. Sometimes it reboots in a minute or two after that, sometimes I have to pull the battery to get it to reboot so I can try again.
The kernel I am using at the moment is the "touchscreen issues" kernel.
CM7 - IT WORKS THERE LIKE A CHARM !
I had some conversation with LG earlier and they do not plan the HID support in their android phones.
Success at last
I have no intention currently changing my current stock (+rooted) software and risk losing functionality or stability - the 2.3.3 LG stock currently works perfectly. On the other hand, I'm using francos kernel, so I can have overclock and the tun module I'm planning to change those few lines of code into a simple app so I can easily activate my BT keyboard (sold on DX) quickly on the road. If I manage to do that, I might go ahead and create the ability to change the layout, so the keyboard(s) could be used to full potential. Probably will get some free time in the end of the month.
@ahvenas, so you are saying it works better with 2.3.3 LG stock than it did with 2.2.1?
HID BTKB for P500/P509 update ?
aaopt said:
Trying with a different kernel, I don't get the device error anymore, but connectbot says the shell disconnected after I run hidd. At any time after connecting hid0 if I try to do something bluetooth-related, such as turn bluetooth on if it was off, or scan for devices if it had already been on, the phone locks up. Sometimes it reboots in a minute or two after that, sometimes I have to pull the battery to get it to reboot so I can try again.
The kernel I am using at the moment is the "touchscreen issues" kernel.
Click to expand...
Click to collapse
kokesh said:
CM7 - IT WORKS THERE LIKE A CHARM !
I had some conversation with LG earlier and they do not plan the HID support in their android phones.
Click to expand...
Click to collapse
I'm currently using void#forever, does that mean HID BTKB works with CM7 for P500/P509 out of the box ? at least in your experience. Or do I still need to run those codes >> n00b alert <<
ahvenas said:
I have no intention currently changing my current stock (+rooted) software and risk losing functionality or stability - the 2.3.3 LG stock currently works perfectly. On the other hand, I'm using francos kernel, so I can have overclock and the tun module I'm planning to change those few lines of code into a simple app so I can easily activate my BT keyboard (sold on DX) quickly on the road. If I manage to do that, I might go ahead and create the ability to change the layout, so the keyboard(s) could be used to full potential. Probably will get some free time in the end of the month.
Click to expand...
Click to collapse
You guys got any news on the progress with creating the app ?
Thanks much!
patpads said:
I'm currently using void#forever, does that mean HID BTKB works with CM7 for P500/P509 out of the box ? at least in your experience. Or do I still need to run those codes >> n00b alert <<
Click to expand...
Click to collapse
I flashed mik's version of CM7, my cheapo bluetooth keyboard worked very well, even my WiiMote works also (with additional apps).
jomarx said:
I flashed mik's version of CM7, my cheapo bluetooth keyboard worked very well, even my WiiMote works also (with additional apps).
Click to expand...
Click to collapse
Thanks a bunch for the quick reply
1. Are you referring to this one:
http://forum.xda-developers.com/showthread.php?t=946354
If so how's the ROM compared to past ROMs you've used ? I read lots of people having problem with GPS either not working or failed to lock satellites.
2. Btw are you using P500 ? I have P509, should work though right? Sorry n00b has too many questions before proceding lol.
Terrific news though with HID BTKB working
3. Were the additional apps needed for the wiimote only, BTKB worked w/o any additional drivers ?
=================================
4. And while we're at it, I might as well ask you if this is correct procedure to switch to a new ROM
(1) nandroid/Backup&restore (using CWM) old ROM >> reboot
(2) Wipe every single thing wipe-able (data, cache, dalvik cache, batt stats)
& to be sure it's shiny clean use this:
http://forum.xda-developers.com/showpost.php?p=11785758&postcount=557
to wipe the system as well
>> reboot
(just to confirm, once rooted, always rooted, even after wiping all those right ? )
(3) Partition SD card so that it'd work well with Link2SD (unless there are better alternatives)
(3) flash mik's new CM7 port stable 6.5.8 >> reboot
(4) flash gapps >> reboot >> DONE.
(5) -optional- if GPS has issues back to recovery and flash this:
http://forum.xda-developers.com/showthread.php?t=1287931
Is there anything else you'd like to add ? please elaborate if you get a chance, much much appreciated

[Q]Need Android Gurus - Issues

Hi to everybody, I come from the BADA subforum, and there is a new project trying to port Android to samsung Wave phone.
Devs have some issues, we are in the last steps and here is a summary
will want to note that the kernel has been confirmed as able to boot into android homescreen when flashed though JTAG
we're modifying the init scripts to boot it from sdcard
the device is accessible from adb how ever the Android system services such as zygote are restart looping
i *think* i managed to execute standard boot on init.rc with adb interface, zygote and android services appear to be stuck in a restart loop:
http://code.google.com/p/badadroid/source/detail?r=192
EDIT: would like to note that while "VIBETONZ" is appearing on the log, the phone is not vibrating, nothing is appearing on the display either. If possible i'd like a check on my kernel sources Oleg. EDIT AGAIN: the phone does actually vibrate, my bad
line 3150ish you can see the zygote service and various others getting killed and restarting.
EDIT2: another debug log extracted using "adb bugreport" (very large, will want to download in order to view)
http://code.google.com/p/badadroid/source/detail?r=193
http://badadroid.googlecode.com/svn/trunk/adb logs/bugreportnb190511.log
EDIT3: it's possible that the restart loop is caused by lack of memory, this could be caused by the memory mapping of the current bootloader we're using, will have to ask rebellos and srg about that.
added a log to googlecode for procedure to boot kernel using init.rc with adb interface working ( i'm not exactly sure why this works) i may upload the zImage i'm using for this, but it'll only work if you partition your memory card in the correct layout and format.
http://code.google.com/p/badadroid/source/detail?r=194
http://code.google.com/p/badadroid/d...511v2&can=2&q=
Click to expand...
Click to collapse
We need some ideas, or whatever you can provide with your knowledge to help us in this project.
more info: http://forum.xda-developers.com/showthread.php?t=1012856&page=100
Thanks to everybody.
hi to everybody
need help, please!
anybody?
I will take a look later on this evening and see if I can tell anything.
Your kernel seems to work, most of your issues in the log that was posted in my thread come from the ramdisk and system build. Until you work at those for a bit, I don't think you're going to know where to place the blame for issues until you're clean.
For the VM crash loop:
Take all of the non critical apps and gapps out of /system/apps (stuff like vending, maps, touchwiz and so on.)
And see what you get. If you can't solve it that way, then try to do:
adb pull /dbdata/databases/com.android.providers.settings/settings.db settings.db
And see what you get. If its there, it's corrupt. If it isn't, check to make sure the directory is getting created. You can also get someone to pull settings.db from a similar device (i9000?) and try to push it to yours.
But that's only the first of your problems. You have some bad lines in init.rc (your rild daemon isn't configured correctly amongst other things), and a few things missing in /system/bin and /system/lib (calls to missing things). If you aren't using an extract of system.img from the sdk, you probably should. Then you can load in libs one at a time in a clean and controlled environment.
BTW: What Android system are you using? What device did it come from? If you built it from source, seriously, try using an emulator image first.
spacemoose1 said:
Your kernel seems to work, most of your issues in the log that was posted in my thread come from the ramdisk and system build. Until you work at those for a bit, I don't think you're going to know where to place the blame for issues until you're clean.
For the VM crash loop:
Take all of the non critical apps and gapps out of /system/apps (stuff like vending, maps, touchwiz and so on.)
And see what you get. If you can't solve it that way, then try to do:
adb pull /dbdata/databases/com.android.providers.settings/settings.db settings.db
And see what you get. If its there, it's corrupt. If it isn't, check to make sure the directory is getting created. You can also get someone to pull settings.db from a similar device (i9000?) and try to push it to yours.
But that's only the first of your problems. You have some bad lines in init.rc (your rild daemon isn't configured correctly amongst other things), and a few things missing in /system/bin and /system/lib (calls to missing things). If you aren't using an extract of system.img from the sdk, you probably should. Then you can load in libs one at a time in a clean and controlled environment.
BTW: What Android system are you using? What device did it come from? If you built it from source, seriously, try using an emulator image first.
Click to expand...
Click to collapse
It is possible it was not made clear, its a 2.2 stock ROM being ported from the Samsung Galaxy S to the Samsung Wave (formerly a BadaOS device). It is also being booted off of SD as apposed to OneNand. It uses a patched version of the SBL from the galaxy S but when Android is flashed to Nand it can boot fine (although problems are had initializing the Modem).
sabianadmin said:
It is possible it was not made clear, its a 2.2 stock ROM being ported from the Samsung Galaxy S to the Samsung Wave (formerly a BadaOS device). It is also being booted off of SD as apposed to OneNand. It uses a patched version of the SBL from the galaxy S but when Android is flashed to Nand it can boot fine (although problems are had initializing the Modem).
Click to expand...
Click to collapse
You need to compare logs from system booted from nand and from sd. Whatever errors are the same don't matter. Its the different ones that will tell you more.
But you're crashing right now because some line of code somewhere in your build is looking for a database and can't find it. If it doesn't do that when installed to nand, then your problem is that directories that the system creates to host configs and module parts aren't getting created at boot.
The modem issue, (if the error in logcat is the same whether the system booted or not, haven't seen both) looks to be a radio interface layer problem, your rild daemon isn't loading (check /system/bin/ for "rild") and make sure the line in init rc that starts it is correct.
spacemoose1 said:
some line of code somewhere in your build is looking for a database and can't find it.
Click to expand...
Click to collapse
It's a strange problem, as using the extracted system.img from the Android emulator as filesystem the above error disappears - with the same kernel/initramfs/init.rc (obviously other errors appear but the services seems to be stable).
I think we can forget the ril related errors now (I commented out the service in my build together with the DR daemon) as we have no modem driver yet ...

[SCRIPT]DataIconRemover for Huawei Ideos U8150 with Android 2.2.2

DataIconRemover​
by ScumpinatoS​
Screen​There aren't any screen because it works on a command line
What is it?​This script allows you to get rid of the annoying data icon present in the Latest 2.2.2 Android version of the Huawei Ideos U8150
Requirements​
- Windows 98 or above
- An Huawei Ideos U8150
- Admin rights (Vista/7)
- USB DEBUG ON
How to use?​
1. Download the Link at the end of the post
2. Double click on DataIconRemover.exe
3. Now the script is running
4. Choose the option that you want and the script will do everything
In the guided mode the script guides you trough the script telling you something about the command and how to use them It's good if you want to know how the script work or if you want to learn something about adb scripting
Now the download link:
DataIconRemover.exe
Enjoy and leave a feedback
Who wants the source code, ask to me in PM
IF YOU LIKE MY WORK, PLEASE THANK ME BY CLICKING THE THANKS BUTTON AND CONSIDER DONATE TO ME, EVEN 1$ IS GOOD, I'M JUST A STUDENT
PS: The website is still a work in progress XD
It's working. Thanks
You're welcome
*up*
Is this script useful?
Perfect! It's great!
Thank you for using my scripts
Hi, I can't seem to get the script to detect my phone. When I manually put the phone.apk in my apps using root explorer, I get no signal. Any ideas?
Have you the USB debug on? Anyway you can head over myppc.it/web/community because hamen88 has created an APP that remove the icon
ScumpinatoS said:
Have you the USB debug on? Anyway you can head over myppc.it/web/community because hamen88 has created an APP that remove the icon
Click to expand...
Click to collapse
Tried that now. Still not having much luck so far:
Your script: Doesnt' detect phone.
Manual override of phone.apk: Can't get reception
APP by hamen88: Doesn't do anything
Manually editing those 2 lines in the build.prop: MMS service constantly force closes (changing opta to 02 and optb to 0)
EDIT:
Since it seemed to be working with Droni-X, I copied most of the build prop from droniX into fusion (they seemed highly similar) and then made the above build prop change.
Finally the data icon is gone and nothing else is broken. I'll try and pinpoint the difference in the build.prop's that is causing this.
EDIT 2:
Seems Editing the following in the build.prop gets everything working nicely
Change the following to be:
ro.config.hw_opta=02
ro.config.hw_optb=0
and uncomment the following:
ro.config.hw_uaprof=http://wap1.huawei.com/uaprof/HuaweiU8180WCDMA.xml
ro.config.hw_browser_ua3g=http://wap1.huawei.com/uaprof/HuaweiU8180WCDMA.xml
ro.config.hw_browser_ua2g=http://wap1.huawei.com/uaprof/HuaweiU8180GPRS.xml
Probably don't have to uncomment all 3 but have done enough playing around whilst getting a force close every other second. So if anyone wants to work it out exactly, I've narrowed it down to those 3

[Q] Various android-related queries

I have managed to compile (from source) and install CM7.2 on my HTC dream, but my questions below are related to Android:
1. Is there a way to find out which packages (.apk) were installed on my system and if so, how do I do that?
2. Is there a way to find out each package dependencies (I need to figure out this as I am bent on removing the vast amount of guff installed on the phone - I won't need 90% of this stuff)?
3. Similarly to 2 above - is there a way to look at dependencies of a package not yet installed on my system (i.e. the .apk file)?
4. How do I actually remove a package for good from the system?
5. Similarly to 3 above, how do I actually install a package from within the root system - I know I can do this via adb, but is there a way to do this inside the, say, command line terminal?
6. Is there a way to alter (understand remove) certain program permissions which I could see "granted" to a particular program/package? I know there are various ways to look at these, but I wish to remove permissions I am not happy being granted to that particular program/package.
And one last a bit more advanced query: I would like to build a single package from the source tree and then install the resulting .apk file on my system.
Basically, I will try to upgrade a package with a new revision and add a few patches to the package source of my own before compiling it and building it again.
I usually build the whole lot (all packages + the rootfs image itself) with "mke bacon", but if I want to alter the source and build a single package how do I do that?
I am not very familiar with the Android make system, so I don't want to go heads-first into something and make a real mess of it.
Thanks a lot for any assistance given.
Small addition as apparently I cannot post a reply (too few posts) in this thread: http://forum.xda-developers.com/showthread.php?p=9055790#post9055790
Question to ezTerry (if he is reading this!): the advice given in that post above was absolutely splendid! I followed it religiously and it worked an absolute treat!
There is one exception though - I've LOST all of my IMEI, IMEI SV and Baseband information after applying these fixes. As soon as I installed the radio updates and then installed my newly-compiled kernel + CM7.2 (successfully!) I then checked the above fields from Settings and they were all gone!
After a while, the baseband, IMEI and IMEI SV appeared, but the IMEI and IMEI SV stuff have now different values than what I've had previously (I've had T-Mobile IMEI, now it appears that I was "assigned" O2 IMEI & IMEI SV values - very bizarre!).
Is this something I need worry about and (I don't yet have a sim card, but I plan to get one soon after I fix my phone), more importantly, how the hell do these IMEI numbers appeared on my phone - where did they came from?!
josh36 said:
Small addition as apparently I cannot post a reply (too few posts) in this thread: http://forum.xda-developers.com/showthread.php?p=9055790#post9055790
Question to ezTerry (if he is reading this!): the advice given in that post above was absolutely splendid! I followed it religiously and it worked an absolute treat!
There is one exception though - I've LOST all of my IMEI, IMEI SV and Baseband information after applying these fixes. As soon as I installed the radio updates and then installed my newly-compiled kernel + CM7.2 (successfully!) I then checked the above fields from Settings and they were all gone!
After a while, the baseband, IMEI and IMEI SV appeared, but the IMEI and IMEI SV stuff have now different values than what I've had previously (I've had T-Mobile IMEI, now it appears that I was "assigned" O2 IMEI & IMEI SV values - very bizarre!).
Is this something I need worry about and (I don't yet have a sim card, but I plan to get one soon after I fix my phone), more importantly, how the hell do these IMEI numbers appeared on my phone - where did they came from?!
Click to expand...
Click to collapse
Any takers?
@1 Check out the respective directories, i.e. for system apps /system/app
@2 Trial and Error, or someone might have made such a list for your device already
@3 No simple way, you would have to look through the decompiled code i guess
@4 Remove the apk from the folder (for example /system/app) and reboot your device, after wards you might have to clean up some extra folders, i.e. settings of that app. (you can use SD Maid from my signature for that)
@5 Some can just be installed the usual way, by opening it. Some .apk files have to be put in the system folders, afterswards reboot and the app should be "installed". To put those apps there use a rootcapable file explorer of your choice. To edit /system you will need to remount it as it is read only by default, you can do that through command line, but most good file explorers have an option for that.
@6 Yes thats possible, there was an app to do that, just not sure what it was called... It is very likely though, that those apps will not work correctly or just FC.
For the make system, if you just change a package, and build again, it will most likely just rebuild the changed files. I'm not so sure either though... damn make system can be pretty messy... and get upset real fast if you change something ;-).
Dark3n said:
@1 Check out the respective directories, i.e. for system apps /system/app
Click to expand...
Click to collapse
Yep, that indeed helped - I didn't realise that the .apk files are "intact" and do not behave in the "standard" (in Linux terms) way a "package" behaves - the app is "installed" as soon as .apk is placed in /data/app or /system/app. The PacketManager does the rest on reboot.
It also cleans up the mess "automagically" if I delete .apk file and reboot, which is nice.
Dark3n said:
@2 Trial and Error, or someone might have made such a list for your device already
Click to expand...
Click to collapse
Yeah, that's a real bugger - I can't see a way of finding the dependencies, but I haven't looked properly at "pm" (the Package Manager command line tool) - maybe I could use something there.
Dark3n said:
@6 Yes thats possible, there was an app to do that, just not sure what it was called... It is very likely though, that those apps will not work correctly or just FC.
Click to expand...
Click to collapse
A very simple example will issustrate my point - my calendar application is installed and needs some sort of GOOGLE_MAIL and access to the internet permissions, neither of which I am happy to grant, because 1) I won't be using online calendars; and 2) I won't use (google) mail.
The truth is, I deliberately did not install any google apps as I won't be using any of them - ever!
Now, every time I boot up and look at my log files with logcat I see a bunch of error messages that this application (the calendar) needs a bunch of permissions which do not exist (naturally, as I haven't installed a single google app on my phone).
So, I wish to wipe out these permissions from the calendar so that logcat is not filled with junk every time I start my phone.
As I already pointed out above, there are also some installed apps who are listed to "need" permissions I am not happy to grant - like the internet access to calendar for example (there are more apps, but I think you get the point).
Dark3n said:
For the make system, if you just change a package, and build again, it will most likely just rebuild the changed files. I'm not so sure either though... damn make system can be pretty messy... and get upset real fast if you change something ;-).
Click to expand...
Click to collapse
Yeah, that was my plan B - there must be another - easier - way though.
I wish to update a lot of stuff (I will be recompiling/refreshing existing packages as well as adding new things I developed for "standard" Linux), but with this Android make system I am blind - it is very different to what I am used to in the Linux world.
To top it all off, I can't post in any of the devs forums yet as I do not have 10 posts!
Further to my previous post - I just found out a superb article about stripping out Android and removing unnecessary packages from it - http://wiki.cyanogenmod.com/wiki/Barebones
It lists various dependencies and shows what could be deleted and what cannot be - what I wanted really.
My only remaining problem - at least for now - is the making of specific packages without building the whole image.

Categories

Resources