Database Info

Does anybody still run CM Recovery 1.3.1?

If you do, can you please do me a favor: Can you please copy the gzip executable to /sdcard and upload to this thread?
Boot into recovery and:
Code:
mount /sdcard
cp /sbin/gzip /sdcard/gzip

devsk said:
If you do, can you please do me a favor: Can you please copy the gzip executable to /sdcard and upload to this thread?
Boot into recovery and:
Code:
mount /sdcard
cp /sbin/gzip /sdcard/gzip
Click to expand...
Click to collapse
ignore sig. reflashed 1.3.1. when i cp /sbin/gzip /sdcard/gzip i get cannont stat /sbin/gzip no such file or directory
edit: i found gzip in /system/bin. just take off .txt extension.

Thanks for you efforts. But the problem is I need the static binary that was present in the 1.3.1. The one in /system/bin is a dynamic one and won't run (tried it already) in 1.4 recovery.
I need to figure out where did that static binary in 1.3.1 come from. That binary is 3 times faster in compressing than the one in busybox.

sorry i couldn't find it. did you try asking cyanogen?

david1171 said:
sorry i couldn't find it. did you try asking cyanogen?
Click to expand...
Click to collapse
He is on vacay until the weekend is over.

erissiva said:
He is on vacay until the weekend is over.
Click to expand...
Click to collapse
can you extract it from the update.zip?
i believe the link was
http://n0rp.chemlab.org/android/cm-recovery-1.3.1-signed.zip
edit: nvm its proly a .img inside. i believe theres an image unpacking tool out here, ill try and find it

B-man007 said:
can you extract it from the update.zip?
i believe the link was
http://n0rp.chemlab.org/android/cm-recovery-1.3.1-signed.zip
edit: nvm its proly a .img inside. i believe theres an image unpacking tool out here, ill try and find it
Click to expand...
Click to collapse
Thanks guys, you are awesome!

Hmm... [No Luck]
Devsk, I just scowered every recovery image that Cyanogen has released (using unpack.pl http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images) for the gzip file you mentioned, however, I saw no static-binary that you speak of.
(yes, I checked every image file, including the ones in the .zip update file that cyanogen released for 1.3.1)
I'm actually curious myself, and have begun searching JF's recovery images too... still no luck...
HOWEVER, and I'm not too keen on scowering... perhaps if you ask Cyanogen if he ever released a recovery image in one of his update.zip's... perhaps thats what you're looking for?! *ponders*
good luck! I think i'm going to check it out!

rikupw said:
Devsk, I just scowered every recovery image that Cyanogen has released (using unpack.pl http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images) for the gzip file you mentioned, however, I saw no static-binary that you speak of.
(yes, I checked every image file, including the ones in the .zip update file that cyanogen released for 1.3.1)
I'm actually curious myself, and have begun searching JF's recovery images too... still no luck...
HOWEVER, and I'm not too keen on scowering... perhaps if you ask Cyanogen if he ever released a recovery image in one of his update.zip's... perhaps thats what you're looking for?! *ponders*
good luck! I think i'm going to check it out!
Click to expand...
Click to collapse
when in recovery 1.3.1, what does 'which gzip' give you? I am not sure where that executable is being gotten but doing 'gzip -h' and 'busybox gzip -h' resulted in two different things in 1.3.1 but same in 1.4.
One question: is it safe to go back to 1.3.1 and switch back & forth? I need to figure where some of the executables are coming from and how come it can load the same dynamic executable in 1.3.1 but not in 1.4.

devsk said:
when in recovery 1.3.1, what does 'which gzip' give you? I am not sure where that executable is being gotten but doing 'gzip -h' and 'busybox gzip -h' resulted in two different things in 1.3.1 but same in 1.4.
One question: is it safe to go back to 1.3.1 and switch back & forth? I need to figure where some of the executables are coming from and how come it can load the same dynamic executable in 1.3.1 but not in 1.4.
Click to expand...
Click to collapse
yes, it is safe, the ONLY issue i've had is I cannot seem to be able to successfully edit a recovery.img and reflash it, it works, the only issue is I don' thave command I get the "A N D R O I D" when i try to use terminal at the recovery menu, (although everything works via adb)
I am on 1.4, I just downloaded ALL the Cyanogen.zips (I hope I don't overuse his bandwidth, I would feel so bad...) but I found no recovery images within his .zips,
try flashing a 1.3.1, (I'm not able to use my android phone, as I left it at work haha)
and trying which. just m ake sure you do a nandroid backup before you flash back to 1.3.1 (though I doubt it should make a difference)
Code:
IDEA!
try to mount all your partitions within the recovery command (from the phone, not adb).
type
# mount -a
(it'll error, don't worry its normal )
# exit
press enter, and then type "which gzip"
I think that its actually loading the /system/bin/gzip... which would make sense... but idk, can you give it a try?
*EDIT AGAIN*
ok, the reason for what I told you, is that I noticed that if you reset the terminal (exit, enter) its like re-adding the PATH to the shell, i guess? I'm still a wee bit new to linux, but I know how to search (or rather... scower)

Developer Analysis of Unrevoked Root Method

WARNING: Not responsible for any damage caused by experimenting with the information in this thread
I didn't see this information previously posted anywhere on here. Hope I don't get flamed!
Thanks to ZanzDroid!
My goal is to publish as much information as we're able to discover about the Unrevoked Root Apk which only contains one button and explains very very little while quite a bit happens behind the scene.
The Unrevoked creators, claim they don't want to explain how everything works because people will abuse the root exploit method they found.
I'd rather trust the EVO community to be open but responsible.
I've only figured out a few things and hope this thread will get the ball rolling. I'm hoping with some of the great developers here we can find out more!
Had some free time tonight.
Brief Technical ANALYSIS:
Stock EVO with the OTA update for .6 software and .05 radio
Installed the apk thru the browser, http://www.unrevoked.com/m.
After installing the app and clicking the Start button, 5-6 seconds later it reports, Rooted!
It appears the payload is dumped to /data/DxDrm .
Inside this directory there are three files
ls -l /data/DxDrm
-rwxrwxrwx app_84 app_84 439428 2010-06-09 18:37 unrevoked
-rwxrwxrwx app_84 app_84 177 2010-06-09 18:38 unrevoked.log
drwxr-xr-x root root 1980-01-08 23:35 fuse
unrevoked - looks like the actual rooting application (payload) compiled into a binary so its not text readable. there is where the secret magic happens. name is an active link to the actual binary the .apk installs. it would great if somebody could decompile this or reverse engineer it.
unrevoked.log - shows a brief log of the application running and reporting root status
fuse - is an empty directory, comes stock on the phone.
Since /system is still locked due to NAND protection, unrevoked creates a new directory inside of /data/local called bin-shadow.
This is basically a shadow of /system/bin plus a few extras unrevoked installs - busybox 1.15.2, su and flash_image binaries.
Any file placed into /data/local/bin-shadow appears to be in /system/bin .
A quick run of the mount command shows this as:
/dev/block/mtdblock6 /system/bin yaffs2 rw 0 0
please post any other TECHNICAL details you discover!
unrevoked.apk - application apk file
unrevoked - binary installed by .apk

i wondered where that shadow-bin folder came from and what it was. thanks for tracking that down!

Can you post/send over the unrevoked binary? (from /data/DxDRM not the apk, thx!)

f00kie said:
Can you post/send over the unrevoked binary? (from /data/DxDRM not the apk, thx!)
Click to expand...
Click to collapse
http://www.sdx-downloads.com/evo/uroot/unrevoked
that is the binary, updated the main post with it.
it would be great if this could be reverse engineered or decompile ...

joeykrim said:
http://www.sdx-downloads.com/evo/uroot/unrevoked
that is the binary, updated the main post with it.
it would be great if this could be reverse engineered or decompile ...
Click to expand...
Click to collapse
my atari won't run them but baksmali on a current machine is the tool . http://jf.andblogs.net/2010/04/03/yabbfr/ Anddroid architecture is symbolic, you get to see names, not registers.

willy900wonka said:
my atari won't run them but baksmali on a current machine is the tool . http://jf.andblogs.net/2010/04/03/yabbfr/ Anddroid architecture is symbolic, you get to see names, not registers.
Click to expand...
Click to collapse
Wont help much. The binary in the apk/res folder does the work.

Never used baksmali.. is this what you wanted?

npace said:
Wont help much. The binary in the apk/res folder does the work.
Click to expand...
Click to collapse
if that binary is the same as /data/DxDrm/unrevoked, then i agree, otherwise im hesitant to agree because before the .apk was released, they originally released a single binary which roots the phone.
a rough test i have off the top of my head would be something to the effect of ... i think the unrevoked binary from /data/DxDrm can be copied to the /sdcard, remove the .apk, copy the binary back to /data and run it. it should root the phone w/o the .apk being installed.

The baksmali I posted was from apk, the batch file I found to do it just pulled the information from the apk.
Has anyone done a quick binary compare on the two unrevoked.bin to see if they are the same? (I'm at work otherwise I'd do it)

Vinny75 said:
The baksmali I posted was from apk, the batch file I found to do it just pulled the information from the apk.
Has anyone done a quick binary compare on the two unrevoked.bin to see if they are the same? (I'm at work otherwise I'd do it)
Click to expand...
Click to collapse
just grabbed the unrevoked.bin from your unrevoked.apk and the unrevoked binary from /data/DxDrm i uploaded last night.
md5sums don't match. they might have modified the binary slightly to work inside the .apk or baksmali might have modified things.
unrevoked 27e3c38141ac479344a24006cc88c2b3
unrevoked.bin 47e7d517b972b1703c4a4dc630a4fc62
any idea, although not as technical would be to load both onto the phone and try running them from the command line and see if they give different output ?
now that we have two versions of the binary, it would be nice to find out what it does! decompiling / reverse engineering is not my specialty but hopefully somebody can provide some more insight?

If someone have the rom cooking environment and all installed, they could compile strace which would really help.
Another possibility is to install debian just like we did on the G1 when it first came out.
I tried that last night but I just need the ext2.ko module (again, a rom developer could provide that). It has to be compile for the specific kernel version, otherwise it wont work.
I dont have much time unfortunately

npace said:
If someone have the rom cooking environment and all installed, they could compile strace which would really help.
Another possibility is to install debian just like we did on the G1 when it first came out.
I tried that last night but I just need the ext2.ko module (again, a rom developer could provide that). It has to be compile for the specific kernel version, otherwise it wont work.
I dont have much time unfortunately
Click to expand...
Click to collapse
strace is included in busybox, right?
i have toast's supersonic kernel loaded and compiled, i could try and compile ext2.ko as a module (module compiling was after my main kernel day)? im not understanding how debian and ext2.ko further our efforts?

joeykrim said:
strace is included in busybox, right?
i have toast's supersonic kernel loaded and compiled, i could try and compile ext2.ko as a module (module compiling was after my main kernel day)? im not understanding how debian and ext2.ko further our efforts?
Click to expand...
Click to collapse
strace is not included in busybox. Or at least not in my busybox. If it were there, I would not have gone the debian route.
I just wanted to see if I can quickly run debian and do "apt-get install strace" then strace ./unrevoked.bin instead of having to cross-compile it for arm-eabi.

npace said:
strace is not included in busybox. Or at least not in my busybox. If it were there, I would not have gone the debian route.
I just wanted to see if I can quickly run debian and do "apt-get install strace" then strace ./unrevoked.bin instead of having to cross-compile it for arm-eabi.
Click to expand...
Click to collapse
i have the cross compile toolchain already setup for arm, but might not be the perfect processor match for the EVO. i dont have busybox source files with me, but let me grab them and see if i can compile it with strace ...
will post back with an update in a little bit! hope this works!
edit: strace is not part of busybox. NEXT! i'll see if i can grab the strace source and cross compile for the arm ... cross compiling was throwing errors which seemed like they might take a while to compile . NEXT!
grabbed the debian arm package - http://ftp.us.debian.org/debian/pool/main/s/strace/strace_4.5.14-2_arm.deb .
used a simple script to extract the .tgz from the .deb package
echo "#/bin/sh" > extract.sh
echo "ar p $1 data.tar.gz > `basename $1 .deb`.tgz" >> extract.sh
sh extract.sh strace_4.5.14-2_arm.deb
tar -zxvf strace_4.5.14-2_arm.tgz
the strace arm binary is put into usr/bin/strace and i've uploaded it here:
http://www.sdx-downloads.com/evo/tools/strace-arm.zip
hopefully this helps! let me know if this works or doesnt work and i'll go back to the drawing board on strace!

Used this method for my hero. Today I used it today to root 2 EVO's and I have to say this was an excellent root. I guess knowing the source would be great however I was burned last round of the hero updates when I lost root. You know someone from HTC was browsing these forums in order to figure out how to patch the exploits the devs had found. I just hope this exploit stays available for Froyo.

joeykrim said:
i have the cross compile toolchain already setup for arm, but might not be the perfect processor match for the EVO. i dont have busybox source files with me, but let me grab them and see if i can compile it with strace ...
will post back with an update in a little bit! hope this works!
edit: strace is not part of busybox. NEXT! i'll see if i can grab the strace source and cross compile for the arm ... cross compiling was throwing errors which seemed like they might take a while to compile . NEXT!
grabbed the debian arm package - http://ftp.us.debian.org/debian/pool/main/s/strace/strace_4.5.14-2_arm.deb .
used a simple script to extract the .tgz from the .deb package
echo "#/bin/sh" > extract.sh
echo "ar p $1 data.tar.gz > `basename $1 .deb`.tgz" >> extract.sh
sh extract.sh strace_4.5.14-2_arm.deb
tar -zxvf strace_4.5.14-2_arm.tgz
the strace arm binary is put into usr/bin/strace and i've uploaded it here:
http://www.sdx-downloads.com/joeykrim/evo/tools/strace-arm.zip
hopefully this helps! let me know if this works or doesnt work and i'll go back to the drawing board on strace!
Click to expand...
Click to collapse
I'm getting a 404 so I did the same:
I had forgotten about the debian-arm packages.
I used alien -t to convert it to tgz and upped it here:
http://bottomquark.org/android/strace
It doesnt run though and I think it's not the proper architecture
strace: 1: Syntax error: word unexpected (expecting ")")

npace said:
I'm getting a 404 so I did the same:
I had forgotten about the debian-arm packages.
I used alien -t to convert it to tgz and upped it here:
http://bottomquark.org/android/strace
It doesnt run though and I think it's not the proper architecture
strace: 1: Syntax error: word unexpected (expecting ")")
Click to expand...
Click to collapse
my mistake, link was wrong, fixed it.
ah another dead end...in the process earlier i got busybox to cross compile, but it has a nice make xconfig, dont think strace does...
ill try and devote some more time to getting the cross compiling setup and a working strace unless somebody else posts a working strace arm binary?

joeykrim said:
my mistake, link was wrong, fixed it.
ah another dead end...in the process earlier i got busybox to cross compile, but it has a nice make xconfig, dont think strace does...
ill try and devote some more time to getting the cross compiling setup and a working strace unless somebody else posts a working strace arm binary?
Click to expand...
Click to collapse
I'll go back to the debian route when I get a chance. It helps to have that running.
BTW, thanks a lot for all your work -- I have similar questions about everything you are currently pursuing!

npace said:
I'll go back to the debian route when I get a chance. It helps to have that running.
BTW, thanks a lot for all your work -- I have similar questions about everything you are currently pursuing!
Click to expand...
Click to collapse
good news, strace is part of the PC36IMG.zip. seems the userdebug version has quite a few developer tools in system/xbin. i've set them chmod 755 and setup root access on my ROM which is simple and clean.
if you dont want to load my ROM, you can setup the environment manually from recovery mode on a stock PC36IMG.zip, just chmod 4755 xbin/su and chmod 755 the xbin directory or just the strace binary.
hopefully this helps?

[LNX]Rhobuntu on HTC ELF 09-11-2010

Rhobuntu -- Ubuntu like Linux
Download: http://technetic.net/rhobuntu/downloads/HTC ELF/
(right click --> save target as)
1. Download latest build
2. Unzip to sdcard (7zip)
3. run haret.exe
Changlog:
new init-script (thanks AmiPro)
new startup.txt

I'll have a play on lunch - but I don't know if I have enough time, but thank you very much for linking this in!
If I do't have time on my lunch - I'll give it a go on my lunch!

Hello, Walter, and thank you for sharing this.
I´m fighting with my Elfin but I think Rhobuntu needs at least 1,6 GB of free space in the SD card.
So, with my 1GB card, I think I´m sold .
Greetings.

I am using HTC TOUCH GSM.
I have installed the Rhobuntu.
It opens up till the main screen and hangs..
no pointer movement and the screen resolution is too small..
I am not even able to scroll and see the full screen.
It hangs ..
need help..

i tried it but its mere of a beta stage

Let´s try
Thanks!!!

Hi Walter, wheather it will work with HTC TOUCH GSM???

jonnigin said:
I am using HTC TOUCH GSM.
I have installed the Rhobuntu.
It opens up till the main screen and hangs..
no pointer movement and the screen resolution is too small..
I am not even able to scroll and see the full screen.
It hangs ..
need help..
Click to expand...
Click to collapse
I have the same problem after starting the desktop and the icons bar on the botton, the device show the keyboard but I'm not able to move the cursor with the stylus.
please note that the device shows me only part of the keyboard, seem like that the resolution is wrong.
During the startup the font changes size. can be related to the wrong resolution??
No actions can be done with the sistem.
thanks and let me know if more information is need

This thread made me come up with a new prefix for these threads.
[LNX]
So put [LNX] in threads for Non Android Linux builds. So users can easily identify or search for specific threads.
Spread the word mate

With /dev/input/event3 it works well.
AmiPro wrote a new detection script for touchscreen.
Now Rhobuntu works on HTC ELF.

yo.. you know what is Elfin device code? i got to edit the startup.txt to make this LXDE runs on it. thanks!

Could you post your startup.txt?
Download for new init-script: http://rhobuntu.googlecode.com/files/init

Hello excuse, you could tell me how to replace the init file? I tried to follow the explanation at the beginning of the post, but I could not mount the file ubuntu.img, in any way. I tried with a live ubuntu, but it did not work. I tried to mount the. IMG file with magic disc but can not mount it. I guess not enough to replace the init file in the destination folder? I tried but during boot change the resolution, and the screen remains fixed on a keyboard in the middle where you can not interact. As was the case before ... Could you explain in detail how to replace the init file, or at least to run on the touch rhobuntu elf?If you want to write me a pm. Thanks
P.s. sorry for my bad English

nightly_shadow said:
yo.. you know what is Elfin device code? i got to edit the startup.txt to make this LXDE runs on it. thanks!
Click to expand...
Click to collapse
MTYPE 2372
http://forum.xda-developers.com/showpost.php?p=4440575&postcount=7

ste81x said:
Hello excuse, you could tell me how to replace the init file? I tried to follow the explanation at the beginning of the post, but I could not mount the file ubuntu.img, in any way. I tried with a live ubuntu, but it did not work. I tried to mount the. IMG file with magic disc but can not mount it. I guess not enough to replace the init file in the destination folder? I tried but during boot change the resolution, and the screen remains fixed on a keyboard in the middle where you can not interact. As was the case before ... Could you explain in detail how to replace the init file, or at least to run on the touch rhobuntu elf?If you want to write me a pm. Thanks
P.s. sorry for my bad English
Click to expand...
Click to collapse
Download Ubuntu LiveCD
http://www.ubuntu.com/
Run liveCD
- copy Ubuntu.img to the root of your harddisk (c:\ for example)
- open terminal
- open folder of Ubuntu.img (cd /media )
- mount Ubuntu.img ( sudo mount -o loop Ubuntu.img /mnt )
- run: sudo nautilus (FileManager)
- select "show hidden files"
- copy new init to /mnt
- close nautilus
- maybe you have to end the nautilus task in terminal with CTRL+C
- umount Ubuntu.img ( sudo umount /mnt )
- copy new init to /mnt

Thank you soo much!!!! Now Rhobuntu run well on my elf!!!!

Failed to find Ubuntu.img on SD Card
Hi,
Thanks for a good initiative. I've HTC Touch GSM (HTC ELF) (P3450) in India. I always keep changing OS on my mobile. I was waiting for Linux on it. I downloaded Rhobuntu and replaced the init in img file also replaced STARTUP.TXT and zimage file with the given one. Now when I start herat I get
1osetup: /dev/block/loop2: No such file or directory
Failed
Failed to find Ubuntu.img on SD Card.
/bin/sh: can't access tty: job control turned off
/#_
After the hash (#) the cursor keeps blinking.
Can you please help me what I have done wrong.
Gourav

gouravjoshi said:
Hi,
Thanks for a good initiative. I've HTC Touch GSM (HTC ELF) (P3450) in India. I always keep changing OS on my mobile. I was waiting for Linux on it. I downloaded Rhobuntu and replaced the init in img file also replaced STARTUP.TXT and zimage file with the given one. Now when I start herat I get
1osetup: /dev/block/loop2: No such file or directory
Failed
Failed to find Ubuntu.img on SD Card.
/bin/sh: can't access tty: job control turned off
/#_
After the hash (#) the cursor keeps blinking.
Can you please help me what I have done wrong.
Gourav
Click to expand...
Click to collapse
http://forum.xda-developers.com/wiki/index.php?title=Ubuntu_on_the_Rhodium#Installation
did you replaced the init file?

Thanks buddy, I managed to get it installed. Mistake was mine, I copied Ubuntu.img file in ubuntu directory. as i moved it out on storage card root, it got installed.
But after installation there was a big key board on screen which i managed to drage down with stylus. but what I feel is the resolution need to be changes as it is showing everything so big.
Also, I tried to make a call to this device, we get ring at device from which I was calling, but there was nothing on the device on which I install rhobuntu. also I could not make a call from here. Can you help me in these cases.
Found something while starting rhobuntu, you may be interested to know.
While starting rhobuntu from haret.exe at one point it shows starting ophono daemon something, where it says can't create signal descriptor file. is it helpful to resolve this issue?
Gourav

Hi,
Got installed the Rhobuntu can access it. Facing two issues on it as follows;
1. Phone function not working as ofono daemon says - can not create signal filedescriptor: Function not implemented
2. Resolution are not as per device.
Please anybody help me to get all this working.
Gourav

[Q] compiling htc one s android 4.2 on any rom really

Hello
I am having troubles getting my roms to compile. I keep getting the same error in each one. If someone could let me know what I am doing wrong that would be great. I am using linux ubuntu 12.10 and go through all the instructions on building the roms. Even on ones where it says that it is completely set up I get the same error. Here it is.
make: *** No rule to make target `/home/paulg/android/rootbox/out/target/product/ville/obj/lib/libmmjpeg.so', needed by `/home/paulg/android/rootbox/out/target/product/ville/obj/SHARED_LIBRARIES/camera.msm8960_intermediates/LINKED/camera.msm8960.so'. Stop.
I guess the solution would be to take the file from another rom and put it into the directory but there has to be another way to do this besides doing that.
I also have another error where it says the libril directory from hardware/lib/libril is conflictin with the direcory msm-8960-common/libril ( not excatly like that but close enough). To fix this I just erase the hardware/lib/libril directory and leave the msm8960-common intact and let it compile from there. I don't know if this is right or not. If someone knows this one let me know.
Thank you.
Paul

atrus5 said:
Hello
I am having troubles getting my roms to compile. I keep getting the same error in each one. If someone could let me know what I am doing wrong that would be great. I am using linux ubuntu 12.10 and go through all the instructions on building the roms. Even on ones where it says that it is completely set up I get the same error. Here it is.
make: *** No rule to make target `/home/paulg/android/rootbox/out/target/product/ville/obj/lib/libmmjpeg.so', needed by `/home/paulg/android/rootbox/out/target/product/ville/obj/SHARED_LIBRARIES/camera.msm8960_intermediates/LINKED/camera.msm8960.so'. Stop.
I guess the solution would be to take the file from another rom and put it into the directory but there has to be another way to do this besides doing that.
I also have another error where it says the libril directory from hardware/lib/libril is conflictin with the direcory msm-8960-common/libril ( not excatly like that but close enough). To fix this I just erase the hardware/lib/libril directory and leave the msm8960-common intact and let it compile from there. I don't know if this is right or not. If someone knows this one let me know.
Thank you.
Paul
Click to expand...
Click to collapse
Never mind I figured it out and compiled rootbox for Htc One S

atrus5 said:
Never mind I figured it out and compiled rootbox for Htc One S
Click to expand...
Click to collapse
What was your solution for the libmmjpeg.so error? I'm having the same problem for another device
Thanks,
Mike

mikshepard said:
What was your solution for the libmmjpeg.so error? I'm having the same problem for another device
Thanks,
Mike
Click to expand...
Click to collapse
You can get this file and all the other proprietary files by entering extract-files.sh from your device/devic_company/device_name directory from whatever rom you are trying to build. If you have done this then there should be a file that will automatically copy it or else you will have to copy it to the out/target/product/device_name/system/lib directory. You might want to also check that you have the correct manifest files in local_manifest for whatever device you are trying to build. usually there is a cm.dependencies file in the device/device_company/device_name directory that will tell you exactly what manifest to use. If you have any other questions let me know. I hope this helps.

atrus5 said:
You can get this file and all the other proprietary files by entering extract-files.sh from your device/devic_company/device_name directory from whatever rom you are trying to build. If you have done this then there should be a file that will automatically copy it or else you will have to copy it to the out/target/product/device_name/system/lib directory. You might want to also check that you have the correct manifest files in local_manifest for whatever device you are trying to build. usually there is a cm.dependencies file in the device/device_company/device_name directory that will tell you exactly what manifest to use. If you have any other questions let me know. I hope this helps.
Click to expand...
Click to collapse
oh wow, hahaha, I was in such a hurry, I completely missed that. I never used the extract-files.sh as all the proprietary files for my htc devices used to be hosted on github but recently got pulled due to a legal problem with the camera drivers. I had the files backed up on my old computer but forgot to copy them over to the new one. Wow, amateur mistake but one that would have taken me a while to catch. Many thanks man!!
-Mike

mikshepard said:
oh wow, hahaha, I was in such a hurry, I completely missed that. I never used the extract-files.sh as all the proprietary files for my htc devices used to be hosted on github but recently got pulled due to a legal problem with the camera drivers. I had the files backed up on my old computer but forgot to copy them over to the new one. Wow, amateur mistake but one that would have taken me a while to catch. Many thanks man!!
-Mike
Click to expand...
Click to collapse
No problem.
I had the same problem with ville. Got the files pulled so made up my own repo with all the files that are needed.

[q] Getting uncompressed Kernel from zImage?

Hello!
Device: i535PP
Kernel version: 3.4
Build date: July 22(futex(towelroot) patched)
So, I am trying to get the symbol table or whatever the heck it is.
I do not have root access, that is what I need the symbol table for > read about that here
So I can't do this the easy way of just open /proc/kallsyms
I have the zImage from boot.img.
I have kept reading on google ect that the most common type of compression used by Android kernels is gzip.
I have looked for the gzip magic numbers in a hex editor and also using hexdump/grep and dd.
I tried using binwalk zImage | head and it didn't see any gzip headers in the file, it found lzo and "pcrypt" or something like that but. I found the magic numbers for gzip... I did some googling and. I belive the whole "pcrypt" is because I had my device encrypted, and I had the OTA flash able rom on my and did all the extracting and Shia on my phone. I have since then decrypted the device and reextract everything.
I believe I am supposed to be after piggy.gz...
When I get the offset and use dd to skip to the beginning of the gzip header and save, I do gunzip piggy.gz and it says that it's corrupted. When I use a hex editor it's also corrupted...
Anyone who has done this before, mind helping me out?
I'll upload the zImage if needed.
Just don't go get the addresses yourself and post them here, I want to get some of the experience out of this
I will be more than happy to add to the list of thankyous/credits when it's all done and I test then make a release. I would also be able to port the exploit to other devices too.

I think I know why....
Probably messed it up when I tried going it on a pc I moved it back and forth via ftp... I didnt have a usb cable at the time.

If anyone wants to take a shot at this, please do. I will love you forever.

No clue what you're trying to do, but my ArchiKitchen should be able to split kernel into zImage and ramdisk, and also unpack the ramdisk, allow you to make changes, and repack it back. You can also replace zImage only if you wish... However, beware, invalid zImage may lead to brick.
You're interested in barebones project. Then you put boot.img in proper folder, restart kitchen, and unpack boot.img.
And if you're interested in decompressing zImage, then sorry, but you're doing it wrong, zImage is compressed binary, and you can't unpack the binary, even if you manage to decompress it.

@JustArchi
Well, thanks for getting me some info about that. But if I understand correctly, zImage is the kernel yes? From what I have read on boot it decompresses itself and copies it into memory. I am not really trying to modify anything, trying to get to the kernel symbols for a device that currently has not working rooting method I am aware of(i535pp on latest build...). Locked boot loader, signature verification of system.img.ext4 so no adding su binary and done. Futex is a no go, kernel compiled July 22. I am trying to port cve 4322 to the device from poc code by retme7 to get a root shell and go from there. If you know how I can go about doing that or point me to a tut, would be great.
Would this help? http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=I535pp

OpenSourcererSweg said:
@JustArchi
Well, thanks for getting me some info about that. But if I understand correctly, zImage is the kernel yes? From what I have read on boot it decompresses itself and copies it into memory. I am not really trying to modify anything, trying to get to the kernel symbols for a device that currently has not working rooting method I am aware of(i535pp on latest build...). Locked boot loader, signature verification of system.img.ext4 so no adding su binary and done. Futex is a no go, kernel compiled July 22. I am trying to port cve 4322 to the device from poc code by retme7 to get a root shell and go from there. If you know how I can go about doing that or point me to a tut, would be great.
Would this help? http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=I535pp
Click to expand...
Click to collapse
If device has locked bootloader, you won't be able to flash custom kernel you made anyway.
Otherwise, you just compile kernel from sources, get zImage, and combine it with the ramdisk through my kitchen.

JustArchi said:
If device has locked bootloader, you won't be able to flash custom kernel you made anyway.
Otherwise, you just compile kernel from sources, get zImage, and combine it with the ramdisk through my kitchen.
Click to expand...
Click to collapse
I am not trying to make a custom kernel. I am trying to extract information from the kernel required for exploitation. I am not even sure I am going about this correctly. I need to symbol table. I believe I ptmx_fops and perhaps a few other things... I have the src, anything valuable?

OpenSourcererSweg said:
I am not trying to make a custom kernel. I am trying to extract information from the kernel required for exploitation. I am not even sure I am going about this correctly. I need to symbol table. I believe I ptmx_fops and perhaps a few other things...
Click to expand...
Click to collapse
Stop it, you're talking nonsense. You won't achieve the thing you want in that way.

JustArchi said:
Stop it, you're talking nonsense. You won't achieve the thing you want in that way.
Click to expand...
Click to collapse
How do I go about making cve 2014 4322 work on my device?
I have been looking and looking...
You dont understand what not having root does to me....