Database Info

Can't manage to modify the /system folder

I've been trying for a couple of days now to try and modify the /system folder because I want to edit the host file and delete standard .apk's. However I just can't get it to work and I don't understand why.
I got a rooted 2.2 legend with modaco stock htc sense rom.
Things I tried:
Root explorer: For some reason I can't write files to the folder. It always says there is not enough free space while there is something like 6mb available. Also, deleting files doesn't actually seem to work. Root exploreres says the files are deleted but after a reboot they are there again!
Also root explorer makes my phone reboot.
ADB: Basically the same thing. Also I don't get adb to work when i'm in recovery mode (red traingle screen, I used to have clockwork but even after trying to reflash the clockwork recovery that just doesn't show up anymore and gone fubar out of the blue....) and want to enter the /system folder.
Terminal app: Same thing as above.
All 3 make my phone reboot.
What am I doing wrong?

I don't use the same phone as you, but I think that /system is usually mounted as read only (ro). Some file managers can mount /system as read/write (rw). Or I think you can chmod /system to 777 in your terminal as su with the command chmod 777 /system. Also I think CWM has an option to mount /system as rw, but I may be wrong. If you chmod, remember to set it back. You'll need to know shell commands and how to read permissions from an ls -a -l command and reset them. Hope this helps.
Sent from my SAMSUNG-SGH-I897 using XDA App

[Q] Restoring stock recovery

Anyone know how I can restore to stock recovery? I rooted and flashed CWM recovery, but I need to restore to stock because I am having so many problems with random reboots that I see lots of people are also having problems with. I have downloaded the dump. If someone could tell what I need to do on would be extremely grateful.

Even on stock this thing has issues... Im gonna try and return it for a mytouch 4g instead....
Sent from my SGH-T839 using Tapatalk

Ace42 said:
Even on stock this thing has issues... Im gonna try and return it for a mytouch 4g instead....
Sent from my SGH-T839 using Tapatalk
Click to expand...
Click to collapse
That's my problem too, but I can't send it back until I get the stock recovery back. I installed CWM after I rooted.

see my next post for the 1 click

ehall2k7 said:
That's my problem too, but I can't send it back until I get the stock recovery back. I installed CWM after I rooted.
Click to expand...
Click to collapse
Me too, which is why I regret it now....I want a phone hat I less buggy, this thing crashes all the time which sucks. Also the phone won't get much faster since it doesn't have enough space for the galaxy s lagfix, which applies to this since it has rfs and not ext4 like it needs..
@person above, if we brick it then they would replace it, right? You would just need to do some "acting" in the store and play dumb with the rep, if you know what a mean.
Sent from my SGH-T839 using Tapatalk

I edited noobnl's one click uninstaller for epic4g with what i posted above.
Extreme warning: Untested! I do not know if it will work, use at your own risk. Possibility of bricking you!
This one click SHOULD
1. remove root and replace with original files
2. reflash stock bml8 over modified? one (I think CWM is bml8)
Theoretically it shouldnt brick you, but no guarantees.....
If anybody has the guts to test this let me know
updated to Here

http://forum.xda-developers.com/showthread.php?t=803682
that is the link to SuperOneClick its a Root app that you can also use to unroot the device.. i Haven't Received my other SK4G yet to test but it should work its universal and works on multiple phones.
hopefully those that have root can use this method to unroot

blu9987 said:
I edited noobnl's one click uninstaller for epic4g with what i posted above.
Extreme warning: Untested! I do not know if it will work, use at your own risk. Possibility of bricking you!
This one click SHOULD
1. remove root and replace with original files
2. reflash stock bml8 over modified? one (I think CWM is bml8)
Theoretically it shouldnt brick you, but no guarantees.....
If anybody has the guts to test this let me know and i'll post a thread in the dev forum
edit: updated the zip due to a silly error
edit2: in the off chance that you get "mount: operation not premitted" that means it failed to mount /system as rw and wont remove superuser. If you let it continue it will still flash over bml8 though. You can manually remove superuser another way. My phone was only permitting me to mount by
Code:
adb shell
su
(look on phone press allow for superuser popup)
remount rw
then removing all the files using these commands
Code:
adb shell rm /system/bin/joeykrim-root.sh (most likely not there this is old)
adb shell rm /system/bin/jk-su (same as above)
adb shell rm /etc/passwd (pretty sure this isnt here either)
adb shell rm /etc/group (same)
adb shell rm /system/bin/su
adb shell rm /system/xbin/su
adb shell rm /system/app/Superuser.apk
adb push playlogo /system/bin/playlogo
adb shell chmod 755 /system/bin/playlogo
adb shell rm /etc/resolv.conf
adb shell rm /system/bin/remount
adb shell rm /system/bin/busybox
Not saying that you'll have to do that could just be my phone since im on ext4 and such.
Click to expand...
Click to collapse
I'll try it out in the next few hours and let you know. I'm not worried if it bricks cuz I'm still in the 14 days to return it and have had nothing but problems with it random rebooting. I'll let you know. Thanks again.

ehall2k7 said:
I'll try it out in the next few hours and let you know. I'm not worried if it bricks cuz I'm still in the 14 days to return it and have had nothing but problems with it random rebooting. I'll let you know. Thanks again.
Click to expand...
Click to collapse
Just to give a heads up a bricked device will stay at the splash screen or may not even turn on, so it will be hard for them to know.I wish this phone was better, since I wanted I ever since I heard it was being remade by sammy.
Sent from my SGH-T839 using Tapatalk

blu9987 said:
I edited noobnl's one click uninstaller for epic4g with what i posted above.
Extreme warning: Untested! I do not know if it will work, use at your own risk. Possibility of bricking you!
This one click SHOULD
1. remove root and replace with original files
2. reflash stock bml8 over modified? one (I think CWM is bml8)
Theoretically it shouldnt brick you, but no guarantees.....
If anybody has the guts to test this let me know and i'll post a thread in the dev forum
edit: updated the zip due to a silly error
edit2: in the off chance that you get "mount: operation not premitted" that means it failed to mount /system as rw and wont remove superuser. If you let it continue it will still flash over bml8 though. You can manually remove superuser another way. My phone was only permitting me to mount by
Code:
adb shell
su
(look on phone press allow for superuser popup)
remount rw
then removing all the files using these commands
Code:
adb shell rm /system/bin/joeykrim-root.sh (most likely not there this is old)
adb shell rm /system/bin/jk-su (same as above)
adb shell rm /etc/passwd (pretty sure this isnt here either)
adb shell rm /etc/group (same)
adb shell rm /system/bin/su
adb shell rm /system/xbin/su
adb shell rm /system/app/Superuser.apk
adb push playlogo /system/bin/playlogo
adb shell chmod 755 /system/bin/playlogo
adb shell rm /etc/resolv.conf
adb shell rm /system/bin/remount
adb shell rm /system/bin/busybox
Not saying that you'll have to do that could just be my phone since im on ext4 and such.
Click to expand...
Click to collapse
I tried it and still no luck. Here is what I am seeing:
one click uninstaller based off of noobnl's
Press any key to continue . . .
copy and run the exploit (may take 2 minutes)
84 KB/s (0 bytes in 5392.000s)
2 KB/s (0 bytes in 88.000s)
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={2650, 2650}
[*] Searching for adb ...
[+] Found adb as PID 2390
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] [email protected] so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
remove joeykrim root method
mount: Operation not permitted
rm failed for /system/bin/joeykrim-root.sh, Read-only file system
rm failed for /system/bin/jk-su, Read-only file system
rm failed for /etc/passwd, Read-only file system
rm failed for /etc/group, Read-only file system
rm failed for /system/bin/su, Read-only file system
rm failed for /system/xbin/su, Read-only file system
rm failed for /system/app/Superuser.apk, Read-only file system
failed to copy 'playlogo' to '/system/bin/playlogo': Read-only file system
Unable to chmod /system/bin/playlogo: Read-only file system
rm failed for /etc/resolv.conf, Read-only file system
rm failed for /system/bin/remount, Read-only file system
rm failed for /system/bin/busybox, Read-only file system
copy recovery and flasher
384 KB/s (0 bytes in 313888.000s)
495 KB/s (0 bytes in 7864320.015s)
flashing recovery
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
open device file: Permission denied
bmldevice_get_size: bmldevice_open failed!src: /sdcard/bml8.bin
dst: /dev/block/bml8 partition size: 0x0
part_size: 0x0
reboot: Operation not permitted
wait 60 second
cleanup
done
Press any key to continue . . .
Do you think it would be possible to flash the bml8.bin with ODIN? I haven't tried to go into download mode but it should be possible seeing how its almost identical to the vibrant and it's made by samsung.

I wonder if this has a bootloader like htc devices where you can flash system images which have the stock recovery, or if the system dump has it, then we can do.. flash recovery /sdcard/xxx.img from term or adb or fastboot, which ever one.
Sent from my SGH-T839 using Tapatalk

you can try making your filesystem r/w before running it.. I dunno why its not mounting properly with adb...
you all have usb debugging enabled right?
Open up command prompt,
cd C:\path\to\uninstaller
adb shell
su
(check prompt on screen superuser)
mount -o remount,rw /dev/block/stl9 /system
then just click the run.bat while the first window is still open
Also before trying this try clearing data on superuser.apk on your phone
You can also try remounting to RW on your phone with like root explorer or terminal emulator... I honestly have no idea why adb keeps getting permission denied

blu9987 said:
you can try making your filesystem r/w before running it.. I dunno why its not mounting properly with adb...
you all have usb debugging enabled right?
Open up command prompt,
cd C:\path\to\uninstaller
adb shell
su
(check prompt on screen superuser)
remount rw
then just click the run.bat while the first window is still open
Also before trying this try clearing data on superuser.apk on your phone
You can also try remounting to RW on your phone with like root explorer or terminal emulator... I honestly have no idea why adb keeps getting permission denied
Click to expand...
Click to collapse
Okay so the original recovery is located on a different part, which CWM doesnt write to, allowing the old one to be used again using this method, correct?Just want to better understand how it works.

Ace42 said:
Okay so the original recovery is located on a different part, which CWM doesnt write to, allowing the old one to be used again using this method, correct?Just want to better understand how it works.
Click to expand...
Click to collapse
I'm pretty sure clockworkmod one click you guys used flashed CWM recovery to /dev/block/bml8 so this restores the original bml8 image
and heres a copy paste from the dump thread
Code:
bml4 1280 KB contains Sbl.bin (1310720 bytes) Secondary Boot Loader (loads the Linux kernel and passes the necessary arguments)
bml5 1280 KB contains Secondary Boot Loader (for recovery, ect)
bml8 7680 KB empty - on Epic 4G and Fascinate, contains recovery.bin
And since you all used the epic recovery flasher, i concluded that it probably flashed bml8 and that you just replace it with the stock bml8 ya?
Also the epic recovery flasher pushes recovery files into /system/bin which need to be removed and I realised that I didnt include that in the one click uninstaller *facepalm*

blu9987 said:
I'm pretty sure clockworkmod one click you guys used flashed CWM recovery to /dev/block/bml8 so this restores the original bml8 image
and heres a copy paste from the dump thread
Code:
bml4 1280 KB contains Sbl.bin (1310720 bytes) Secondary Boot Loader (loads the Linux kernel and passes the necessary arguments)
bml5 1280 KB contains Secondary Boot Loader (for recovery, ect)
bml8 7680 KB empty - on Epic 4G and Fascinate, contains recovery.bin
And since you all used the epic recovery flasher, i concluded that it probably flashed bml8 and that you just replace it with the stock bml8 ya?
Also the epic recovery flasher pushes recovery files into /system/bin which need to be removed and I realised that I didnt include that in the one click uninstaller *facepalm*
Click to expand...
Click to collapse
Oh I see, well I'll let you know how it turns out then.
Edit: In system /bin I have
-recovery(ukn file type)
-recoveryfiles(folder)
-recoveryres(folder)
Also these "bml" files are in /SYS/BLOCK <--according to root explorer
While /DEV/Block only shows "vold" folder, nvm term shows that bml is there

Ace42 said:
Oh I see, well I'll let you know how it turns out then.
Edit: In system /bin I have
-recovery(ukn file type)
-recoveryfiles(folder)
-recoveryres(folder)
Also these "bml" files are in /SYS/BLOCK <--according to root explorer
While /DEV/Block only shows "vold" folder, nvm term shows that bml is there
Click to expand...
Click to collapse
-recovery(ukn file type) comes with the stock system but the one click installer pushed over a modified one. Youd need to replace with the original...I'll add that into the uninstaller
-recoveryfiles(folder) is from the one click installer
-recoveryres(folder) is also from the one click installer
There is also
/system/xbin/remount
and
/system/xbin/busybox
and /system/bin/playlogo (which I already have in the uninstaller..the playlogo they use is what gives permanent root if i remember correctly)
It would be so much easier if somebody on 100% stock would gain temporary root using rageagainstthecage and root.sh and pull the images for a tar then we can put together a stock flash with factoryfs.rfs cache.fs intram.lfs recovery.bin boot.bin sbl.bin and modem.bin
If anyone is interested pm me and i'll give you the info you need on how to do it

blu9987 said:
-recovery(ukn file type) comes with the stock system but the one click installer pushed over a modified one. Youd need to replace with the original...I'll add that into the uninstaller
-recoveryfiles(folder) is from the one click installer
-recoveryres(folder) is also from the one click installer
There is also
/system/xbin/remount
and
/system/xbin/busybox
and /system/bin/playlogo (which I already have in the uninstaller..the playlogo they use is what gives permanent root if i remember correctly)
It would be so much easier if somebody on 100% stock would gain temporary root using rageagainstthecage and root.sh and pull the images for a tar then we can put together a stock flash with factoryfs.rfs cache.fs intram.lfs recovery.bin boot.bin sbl.bin and modem.bin
If anyone is interested pm me and i'll give you the info you need on how to do it
Click to expand...
Click to collapse
Thr thing is..I'm exchanging mines today so I will try what you said and then do a factory erase afterwards. If it leaves some files there's not much I can do, can you fix he uninstaller to add the other files today, ill really appreciate it.
Sent from my SGH-T839 using Tapatalk

Disregard this post i'll make something and put it up after portfolio is done in a few hours

I have attached a one click uninstaller for root, revised and will work. Just extract and run the run.bat
It should remove all root and reflash stock over clockworkmod!
If this works let me know and i'll post it in its own thread

Shameless triple post:
Anyone end up testing this? It would be highly beneficial if somebody could remove CWM and root, restore to stock, and follow some instructions to pull the necessary images to make an odin tar. I would do this myself but I don't have a sidekick. Or maybe once we get a working CWM make a pre-rooted odin flash

[Recovery Unofficial Clockword Mod] for SPH-D600 (Conquer 4g)

A working recovery for Samsung Conquer 4g!!!
Needs Root!
V. 5.0.2.7
1.Download the files below
2.Move flash_image (in the zip folder) and CWMR.img to your sd card
3.On your phone download root explorer
4.Move flash_image to /data/local using root explorer
5.Download a terminal Emulator on your phone
6.Open the terminal and put in:
Code:
$ su
# /data/local/flash_image recovery /sdcard/CWMR.img
7.Than to make sure it doesn't revert to stock recovery put in:
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock9 /system
to make sure its in rw mode put:
Code:
# mount | grep system
than:
Code:
# chmod 444 /system/etc/install-recovery.sh
(dont worry if you get an error not found some phones dont have this)
Credit goes to utankos over at rootwiki for creating the recovery.

Need some clarification
Perfect timing. I am just now starting to learn how to root my conquer 4g. I am having some issue locating this folder "/data/local/"
/data/local/flash_image recovery /sdcard/CWMR.img
I have installed the Root Browser - free version on my phone, but still not able to find the directory. Am I supposed to create the "local" folder within the /data folder?
Thanks.

yanxizao said:
Perfect timing. I am just now starting to learn how to root my conquer 4g. I am having some issue locating this folder "/data/local/"
/data/local/flash_image recovery /sdcard/CWMR.img
I have installed the Root Browser - free version on my phone, but still not able to find the directory. Am I supposed to create the "local" folder within the /data folder?
Thanks.
Click to expand...
Click to collapse
I have never ran into a problem like this but do so in the /data folder on your phone and sorry this has taken so long I haven't been on XDA for a while. Tell me if it works.

/data/local dir in root browser
Hi, in order to properly see the /data/local folder which is a hidden folder you need to access it as root. If you installed root browser before the phone wa rooted it already checked for root access and was denied. From then on it will run without root permissions. you need to gran it root access before you can access hidden folders the easiest way would be to erase the data of root browser in options|applications.
hope this helps.

Thanks for this, works great!

jhorton014 said:
Thanks for this, works great!
Click to expand...
Click to collapse
Actually I'm having difficulties getting the CWM recovery to be permanent. When I reboot it reverts back to stock recovery. I followed all of the instructions on the tutorial that you provided.

nvm

[Q] Simple adb question (or perhaps not?) Permission Denied

Hi all--in need of some help here--have been crusing the forums for three days and still hitting a brick wall...
Have a rooted (and minimally modded) Atrix 4g in serious need of a hard reset and all the pain that comes with as nearly every app force closes on startup.
Hoping to backup some of my data (contacts, SMS, etc), but unable to do so my usual way (an app, root explorer, or the like), so I'm attempting to use ADB pull to grab the .db files. I'm relatively comfortable with linux, but running into a problem with ro/rw permissions (I think).
have tried the following:
adb pull /data/...../mmssms.db (yields Permission Denied)
# cp /data/....mmssms.db (appears to copy, but no file in destination, and can't copy out of shell)
have been able to remount /system as rw, but not /data where the files are located.
Anybody have suggestions? I'd be most apprecative!

Copy the the files as superuser to your sdcard first and adb pull them from there.

Unfortunately, the whole reason I'm needing to reset is that every app (incl superuser accesses) force closes on start--no chance to move through the phone itself. Since the .db files are not in the usb-accessible file structure I'm thinking that ADB is the only way to access.
Does that make sense?

Hi, OP here--anybody else have a suggestion? Getting a little desperate here... Any thoughts would really be appreciated!

im assuming your accessing ADB via recovery?
You should be able to use su without superuser.apk's permission in that case - however, theoretically, you should not need to use su in recovery anyway.
you can try running
Code:
adb shell ls -l /data/data/*tele*/databases/mmssms.db
and see what you get permissions wise, maybe a chmod could fix it?
Otherwise you could try
Code:
adb shell mount -o remount,rw /data
Another alternative to cp and adb pull is cat
Code:
adb shell cat /path/to/mmssms.db > /path/to/destination-file.db
might copy remote mmssms.db to a local file, while
Code:
adb shell
cat /path/to/mmssms.db > /path/to/destination-file.db
exit
would copy remote to remote
Is /data mounted at all?
This is strange, you should have read access to everything, especially in recovery.
What phone and what recovery?
Its not something as simple as geting the URIs the wrong war round ('cmd local remote' vs 'cmd remote local')?

So, still tinkering... Will give it one last try before I call it quits and just wipe the bloody thing. So, your thoughts were spot on--its probably me missing something.
Quick data dump on progress to data:
Phone: Rooted Motorola Atrix running 2.2
no trouble accessing shell or via ADB
/data is mounted, though only in Read Only mode--can't seem to change, have tried several ways in various modes (shell, su, etc)
Permissions for mmssms.db are: -rw-rw---- radio radio
chmod 777 of the file yields: "Read-only file system," which makes sense since I can't seem to change /data... to rw
Tried to remount rw:
adb shell mount -o remount,rw /data
and
mount -o remount,rw -t yaffs2 /dev/block/mmcblk0p11 /system (for systeem
but get "Operation not permitted" in both cases.... UGH!
Hadn't thought of cat--great idea. Still no real joy however.
I seem to have managed a copy to /system, but can't seem to get it off the device or onto the SD card.
Thanks much for your help so far. Any final thoughts?

SO CLOSE!!!! (and yet...)
crags said:
Hadn't thought of cat--great idea. Still no real joy however.
I seem to have managed a copy to /system, but can't seem to get it off the device or onto the SD card.
Click to expand...
Click to collapse
SO FRUSTRATING!!!! so close, but not quite there--HELP!!!
As noted at the end above, have been able to copy the mmssms.db file to /system/ after remounting as RW
Can't seem to copy or pull off the device--still getting "Permission Denied" no matter which course I try!?!?!

It sounds as if your doing this while booted into the ROM, and (maybe) without su (root)?
su-ing might help, just type su and hit return to enter a root shell
alternatively, going in through recovery ('adb shell reboot recovery') might help as most recoveries ignore permission rules - make sure to mount the partitions your using though.
It almost sounds like the sdcard has no write permissions - you can get the NAND partitions to mount rw, but cant copy to the sdcard.
On my Desire, there is (at least) two mount points: /sdcard and /mnt/sdcard - maybe on your phone only one of your mount points has write permissions?
Otherwise i suggest going in via recovery. You can still use adb (will have to manually mount - 'mount /system' 'mount /date' and 'mount /sdcard' usually work, otherwise use the menu item in recovery )
When in recovery, and after mounting partitions/card, try adb pull, cp /sdcard and cat > sdcard (and if possible cat > computer) plus anything else i forgot (quite tired )
if these dont work something is messed up somewhere in the ROM, or likely kernel and so without ideas a reflash would be the only real solution :/
I did have a bare-minimum+apps recovery script (attached) which might be worth a read to see if your forgetting something obvious - it works on my desire

Backup your EFS-partition using tar and dd

This guide has been made with and for the i9505, but will most likely also work on other Galaxy S4-models.
Please be extra careful on models other than i9505 as the 'mmcblkXpXX' partition numbers might differ on your device. How to check this is written in the procedure.
As I could not find a procedure in this forum yet, I have made one myself.
Of course all of the below is 'USE AT YOUR OWN RISK'.
Requirements before you start
Install KIES software (and included driver) and connected your S4 atleast once (to see if it works)
Have ADB-executable available. It can be found in the ADT Bundle from Google. There are also much smaller packages with ADB-only which will work. I might create one myself later on and attach it to this thread..
Device is rooted and has busybox-installed (default with motochopper root method). Applications with a similar name in Play Store will allow you to install busybox manually.
Enable developer mode, go to Settings - More - Device-info - Tap 7 times on 'Build number' to unlock 'Developer options' in the previous screen. Then go to 'Developer options' and thick 'USB debugging'
Connect USB cable to your computer and smartphone with 'USB debugging' enabled
Preparations for both backup methods
Now open a ADB-shell, in Windows this would be: 'cmd' in Start-menu (or CTRL+R).
Change the directory to the ADT directory: sdk\platform-tools. In my case:
Code:
cd C:\Android\sdk\platform-tools
Then start the shell using adb:
Code:
adb shell
If you get the error:
'error: device offline'
Then, check your device and allow USB debugging for the presented device. Now try again the command 'adb shell'
If all goes well, you will see the following:
[email protected]:/ $
Now switch to root-user:
Code:
su -
It is possible that the phone now asks you to permit or deny root access. Of course, please permit.
When the switch succeeds, the '$' changes to '#', but you can also verify it by the id-command:
Code:
[email protected]:/ # id
id
uid=0(root) gid=0(root) context=u:r:shell:s0
If it shows root, all is fine.
Then, check with the following command if /efs is available and mounted:
Code:
mount | grep efs
It should show something like:
Code:
mount | grep efs
/dev/block/platform/msm_sdcc.1/by-name/efs /efs ext4 rw,seclabel,nosuid,nodev,no
atime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,errors=panic
,data=ordered 0 0
Backup method using TAR
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
Run the folowing command to backup the whole efs-partition (all the files available on the system):
Code:
tar -cvf /data/media/0/efs.tar /efs
Your output will look like this:
Code:
[email protected]:/ # tar -cvf /data/media/0/efs.tar /efs
tar -cvf /data/media/0/efs.tar /efs
tar: removing leading '/' from member names
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
This will add all files in /efs to the tar archive located on your internal memory as 'efs.tar'.
Now, the permissions of this tar are incorrect (for this location) so we have to correct them:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.tar
And the file permissions:
Code:
chmod 664 /data/media/0/efs.tar
Now, your tar-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.tar .
This will copy the efs.tar to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
Backup method using 'dd'
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
From the output of the earlier executed command 'mount | grep efs', you can get the path of the EFS partition. It start with '/dev/block/..' is the part which you can use to find the original partition on your device.
As you can see, in my case this is, and I do not expect it to be any different on your device:
/dev/block/platform/msm_sdcc.1/by-name/efs
To check which 'mmcblk' partition it is, we should check out this link:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
This will show you the mmcblk which is the EFS-partition:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
lrwxrwxrwx root root 1970-01-05 23:39 efs -> /dev/block/mmcblk0p10
As you can see, the actual partition in my case is:
Code:
/dev/block/mmcblk0p10
I expect that this is the same for all i9505-devices, but it's better safe to check it. On i9500-devices this might be a different number as they have a different partition-layout, that's why we're checking this. It is very important to save this location, also for future restores.
Now, to backup the partition using dd, run the following command, please make sure that the part directly after 'if=' is the partition you found using the 'ls -l' command. In my case '/dev/block/mmcblk0p10':
Code:
dd if=/dev/block/mmcblk0p10 of=/data/media/0/efs.img
When it finishes, it will show you something like:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This command reads the efs-partition, byte-by-byte to your internal memory, which you can transfer later on to your PC using ADB or MTP.
As the file created is owned by root:root and doesn't have the default permissions used for files at this location, it can be corrected with the following 2 commands:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.img
And the file permissions:
Code:
chmod 664 /data/media/0/efs.img
Now, your DD-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.img .
This will copy the efs.img to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
To restore the files
Now to restore the files, in case there is really a need to, like imei-number ****up or something with the MAC-address of your wifi, or whatever.. the following commands can be used:
Of course, once again. USE AT YOUR OWN RISK!!!! Do not use this if not really necessary, as there are risks involved in doing this.
To restore the tar-backup, open 'adb shell' and switch to root using 'su -'. Now, first switch to the root directory, which is most likely not needed, but just to make sure the files will be extracted to the right location:
Code:
cd /
Before executing the next command, I assume that you have the efs.tar file in the root-directory of your internal SD-card.
Now, extract the tar file:
Code:
tar -xvf /data/media/0/efs.tar
This will extract the efs.tar file back to it's original location. It will show you something like:
Code:
[email protected]:/ # tar -xvf /data/media/0/efs.tar
tar -xvf /data/media/0/efs.tar
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
Then reboot your phone normally and see if it works again as you would expect.
If you restored the TAR-backup succesfully, you do not need to restore the dd-image. But in case your tar did not work or your /efs is not mounted due to corruption (in recovery) you can try the dd-recovery instead.
PLEASE BE AWARE THAT YOU SHOULD BE SURE ABOUT THE LOCATION OF THE EFS-PARTITION. THIS LOCATION WAS FOUND USING the 'ls -al /dev/block/platform/msm_sdcc.1/by-name/efs'-COMMAND EARLIER DESCRIBED. If you do not know this location, there's a risk you are overwriting other partitions (MODEM, SYSTEM, RECOVERY, ETC).
If you are sure about the original location, /dev/block/mmcblk......, then use this path just straight after 'of='. On my device the partition is /dev/block/mmcblk0p10.
Code:
dd if=/data/media/0/efs.img of=/dev/block/mmcblk0p10
Output will be similar to:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This will read the efs.img and put it back in the original location.
NOTE 1: This thread gives you two options of backupping the EFS-partition. It is preferred to do both, better safe than sorry.
NOTE 2: Luckily, I have never had to restore any of the backups myself (not on this phone and not on earlier phones). This means that I was never able to test the restores, which counts for the most of us.
NOTE 3: DO NOT RESTORE unless you are really sure this will solve your issue. This will never resolve any lag or other problems with your rom.
NOTE 4: It is normal that the DD-file is much larger (10MB in size) as it also copies unused space and other meta-data of the partition.
NOTE 5: USE AT YOUR OWN RISK! Although the backup part is nearly riskless.
Note X: Feel free to thank me for this post.

Reservation for second post, just in case.

Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?

johan81 said:
Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?
Click to expand...
Click to collapse
Yes, zipping is easier but you will lose your permissions (owner and file permissions (changed via chown/chmod)) so it is actually not a good backup. The permissions/ownerships are backupped with the tar- and dd-backup.
The dd-file includes more than just the file; it also contains the partition meta-data, in case your filesystem got corrupted and it is not possible to recovery it.

Good job man.

EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546

shaq1907 said:
EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546
Click to expand...
Click to collapse
dont seem to work crashes out while backing up
working now with new update

anybody knows how to adb read the the entire partition table of the galaxy s4?