[ROOT] LG Intuition & LG Spectrum ICS - Android Software/Hacking General [Developers Only]

Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
If you find this useful please follow me (jcase) on twitter ( https://twitter.com/teamandirc/ ).
Here you go, root for both the new LG Intuition and the LG Spectrum running ICS. The vulnerability is a simple permission bug allowing us to setup a symlink to local.prop (yes yet again). While the bug is the same, the procedure is slightly different, so I will have the instructions separate.
With the LG Intuition, they did seem to attempt to mitigate this attack. Not by setting correct permissions, but by dropping adbD to the shell user if it runs as root, even if ro.kernel.qemu=1 is set. They failed, they give us enough time to run one command before dropping the root privileges, in our case a script to root the phone.
LG Spectrum ICS Root (for the leaked ICS rom):
Expect this to be patched in the release rom. Leaked ICS rom has locked bootlaoders, ie no recovery at this point.
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
adb shell
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
adb reboot
adb wait-for-device remount
adb push su /system/xbin/su
adb shell
# chown 0.0 /system/xbin/su
# chmod 06755 /system/xbin/su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.

Thanks!
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!

LostCauseSPM said:
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
Click to expand...
Click to collapse
Which specific ICS version do you have, I had a couple different leaks to work with.

jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
build #: IMM76D
Still tweeking on it. Just updated all my drivers, too. I'm not a total newb, but I'm no pro, either.

jcase said:
Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo ‘ro.kernel.qemu=1’ > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
:crying:
Once rebooted, install Superuser from the market and enjoy.
Click to expand...
Click to collapse
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since

jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.

LostCauseSPM said:
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
Click to expand...
Click to collapse
add [email protected] to gltak and hit me up.

lahegry said:
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
Click to expand...
Click to collapse
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.

jcase said:
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
Click to expand...
Click to collapse
i don't think i'm fast enough, i just can't type faster than it kicks me off

lahegry said:
i don't think i'm fast enough, i just can't type faster than it kicks me off
Click to expand...
Click to collapse
Place the two commands into a batch file/shell script, or setup teamviewer and msg me on gtalk

so this is just I've come up with tonight, the exploit still fails line by line, so I made a batch file just for that command, and I think I may be misunderstanding that "adb mount - o" command you recomended.
Wow, this chrome is NOT liking this txt box, keeps jumping backwards for some reason. C'mon Google...

I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?

Try now, something was altering my post
arnshrty said:
I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?
Click to expand...
Click to collapse

Correction needed for Intuition
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:

krapman said:
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:
Click to expand...
Click to collapse
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?

/system/bin/sh su not found
any help with this was having an issue with the echo command but got past that but now it's giving me this error

davieslacker said:
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?
Click to expand...
Click to collapse
It's an amazing device I love it and im rooted. used the steps above and it worked. I am sure it will get jelly bean love eventually. No roms yet. But LG added a lot of customization to the device form what developers usually add as mods.

Will there be a single click method for root on the intuition. I can't seem to get this method to work

Exploit still works on the final version of ICS for the LG Spectrum
Just updated my phone. Couldn't wait for the OTA rollout, updated via the Verizon Wireless Update Util on my comp. Root worked no problem. Thanks again Jcase!

What did you update your phone to?
Sent from my VS950 4G using xda app-developers app

Related

What is wrong with my script - going crazy

so I'm new to scripting, and I have a TON of lg optimus S's to root for work. So I figured I'd write a script to make life easy. I know all the shell commands are correct as if I manually type everything in it works. What happens is it gets through gingerbreak exploit and when the prompt returns # - everything seems to go to hell.
Here is my script I am using. I'm using Kubuntu 11.04 writing it in Kate, name of my script is Script2 and I'm executing it in bash via $sh Script2
echo "removing TMP directory";adb shell rm -r /data/local/tmp
echo "creating TMP directory";adb shell mkdir /data/local/tmp
echo "pushing gingerbreak";adb push gingerbreak /data/local/tmp/gingerbreak
echo "CD TMP";adb shell cd /data/local/tmp
echo "CHMOD TMP";adb shell chmod 777 /data/local/tmp/*
echo "running gingerbreak";adb shell /data/local/tmp/gingerbreak &
sleep 32
adb shell mount -o remount,rw -t yaffs2 /dev/block/mtdblock5 /system
adb shell cat /sdcard/flash_image > /system/bin/flash_image
adb shell chmod 755 /system/bin/flash_image
adb shell mount -o remount,ro -t yaffs2 /dev/block/mtdblock5 /system
adb shell flash_image recovery /sdcard/xionia_cwma_12518.6.img
adb shell reboot recovery
I've tried with out sleep command and also with out "&" at the end of gingerbreak, and when I do that and it returns # it seems like no commands will work, even if I type them in it returns just a blank line with out #.
With that current script after sleep 32, it returns #, few seconds later it tries to mount and I get (including the end of gingerbreak exploit).
[!] dance forever my only one
# mount: Operation not permitted
Script2: 9: cannot create /system/bin/flash_image: Directory nonexistent
Unable to chmod /system/bin/flash_image Read-only file system
mount -o: permission denied
reboot: Operation not permitted
then it returns me to bash$
Thanks!
So something interesting, I've been playing with this for awhile, and I took everything out past the
adb shell /data/local/tmp/gingerbreak
it seems if I run it as
bash$ adb shell /data/local/tmp/gingerbreak
vs
bash$ adb shell
$ cd /data/local/tmp
$ ./gingerbreak
when # is returned, the first option won't take any commands its like it hangs, if I type out the next command it will just return a blank line with out $ or #, I have to forcibly end the process by CTRL+C and it will return me to bash, if I do the second option it works and I can enter the next command in and it takes and returns me to #. Anyone know why this is? I'm pretty sure this is the problem.
I would happily use the second option, but I'm not sure how to get the script to take any android shell commands without a "adb shell" infront. If anyone knows how to get around this, that would be awesome =)

Ways to root .29?

I've got some questions about rooting on a locked device, which I may as well fire away.
I'm on .17 DE and has got it setup nicely, so I don't want to go to .29 just to try things out, and if something goes wrong it's better if the tablet has got a boot manager installed so rescue flash is possible. So, if someone who knows what they're doing wants to unroot and try this out (or just tell me if anything is feasible) I believe many people (primarily not rooted .WW-people, but maybe all current ICS-device owners) would be very happy.
Q1 - In the "tweaks" post seanzscreams mentions there may be a way to push build.prop to /system/ at boot.
Wouldn't it be possible to create some root stuff to push and run, like
(pushsu.bat)
Code:
adb wait-for-device
adb push su /system/
run it, reboot tablet
create a shell script file for permissions (or some other mojo) and push it aswell:
(permsu.sh)
Code:
chown 0.0 /system/su
chmod 06755 /system/su
and then run:
(pushper.bat)
Code:
adb wait-for-device
adb push permsu.sh /system/
and finally run and reboot:
(setperms.bat)
Code:
adb wait-for-device
adb shell sh /system/permsu.sh
?
Q2 - wolf849 is doing some funky stuff to downgrade firmware where he's mounting stuff at /data/local/tmp and rebooting for (I assume) permissions to write to the "stuff".
Would it be possible to test these commands (modified to possibly work or break something) (mmcblk0p1 = /system on my device):
(in adb shell or something)
Code:
mv /data/local/tmp /data/local/tmp.bak
ln -s /dev/block/mmcblk0p1 /data/local/tmp
exit
Then reboot and see if /data/local/tmp is in fact /system mounted rw (ie "copy or push su"-able).
If the former wouldn't work because of symlinking rights maybe another approach would be a bat file, like
Code:
adb mv /data/local/tmp /data/local/tmp.bak
adb reboot
adb wait-for-device
adb ln -s /dev/block/mmcblk0p1 /data/local/tmp
adb reboot
Please don't try these suggestions if you don't know how to recover from possible bootloops or semibricks.
I would try them if I'd been unlocked and boot managered, but I'm out of luck if something goes wrong.

Panasonic Eluga Power P-07D

Greetings,
I have received my shiny new Eluga Power and I am wondering if anybody else has this device and if anybody has rooted there's?
Sent from my P-07D using xda premium
Edit: moved to Q&A, lets see if you can get some help but do search for your device.
First welcome...
Next time post in the Q&A section for questions. To better serve you do a search for your device and look in the Dev section for your model device...also you will find a Q&A section there, Thank you.
Btw ensure you read the forum rules.
Sent from a closet, at Arkham Asylum using Forum Runner.
ianford10 said:
Greetings,
I have received my shiny new Eluga Power and I am wondering if anybody else has this device and if anybody has rooted there's?
Sent from my P-07D using xda premium
Click to expand...
Click to collapse
Where did you get it from?HOw much? How's it first impression?
mixmaster said:
Where did you get it from?HOw much? How's it first impression?
Click to expand...
Click to collapse
Had to import it from a Japanese eBay store with a cost of £560 with delivery. First impressions of the phone are very good, nice big clear screen, batter life is okay considering the screen size, calls are crisp and clear, feels good in the hand to hold. Will have more info as I use it over the next couple of weeks
Sent from my P-07D using xda premium
Rooting P-07D success...
I was able to root my Panasonic Eluga Power (P-07D) you can check the screenshot below. As of the moment I am re-writing the steps for others so they can easily follow the instructions as this was written in Japanese (Thanks to http://sithxi.blog49.fc2.com/blog-entry-51.html and goroh_kun. Hopefully this would help others root there device just like me. The only main problem for me now is SIM unlock the device.
Panasonic Eluga Power rooting instructions...
As promised here are the steps: (This seems to look like a temporary root, as you will loose it once the device rebooted) But still it's a good primary step. For the source code it can be downloaded from here. Panasonic Eluga Power Source Code
goroh_kun
2012/10/18
root privileges acquisition & tomoyo released experimental version in
the p-07d
things to do
Run:
1. >adb restore p-07d.ab
I press OK authentication
After the restore is finished
2. Open another command prompt and type the following:
>adb shell
$cd /data/data/com.android.settings/a/
$ls -l -d
drwxrwxrwx system system a
- check directory called A exists, it is world readable, writable as
show above
3. $ ls -l
⇒ file00 〜 file99 check if files exists
Delete all file from file00 ~ file99
run the command below
4. >adb shell
$cd /data/data/com.android.settings/
$rm -r a/*
change permissions to 777 /persist
This is the tricky part as you need to to do this using two command prompt, one running the adb restore p-07d.ab while the other on the shell command running ln -s /persist a/file99 command.
5. First run: >adb restore p-07d.ab while it is restoring on the other command prompt run in shell $ ln-s / persist a/file99
6. Now lets check the permission to folder /persist by typing on the command prompt that is already in shell.
$ ls -l -d /persist
drwxrwxrwx system system persist <--(you should see this)
Now move on your other command prompt window and run the following commands. (you can download the needed file at this link
Then run the command below to push the files needed for rooting:
>adb push init.cne.rc /data/local/tmp
>adb push p07dgetroot /data/local/tmp
>adb push xsh /data/local/tmp/
>adb push libQ.so /persist
>adb shell rm /persist/init.cne.rc
>adb shell ln -s /data/local/tmp/init.cne.rc /persist/init.cne.rc
>adb reboot
The next step is kinda hard to understand and I qoute: "/persist at Startup directory of the recovery process because it will not be restored and persist the only symbolic links should be a basic /data/local/tmp to keep the change."
After re-move environment variable is changed to check (LD_PRELOAD= /presist/libQ.so and be sure it is).
7. > adb shell
$echo $LD_PRELOAD
/persist/libQ.so <--(you should see this)
8. To Unlock Tomoyo, follow this steps:
> adb shell
$ cat /data/local/tmp/p07dgetroot > /tmp/xsh
$ ls -l /tmp/xsh
-rw-rw-rw- shell shell xsh <--(you should see this)
Make sure that wirelss LAN is ON before doing the command below:
9. WLAN ON / TURN OFF WLAN / TURN ON WLAN (wait to be connected before typing the below command or you will have to do it again)
$ ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$ /tmp/xsh
/tmp/xsh
/tmp/.mem fd=3
read ret = 256
write ret = 256
At this stage, Tomoyo is now unlocked
10.
$rm /tmp/xsh
$cat /data/local/tmp/xsh > /tmp/xsh
11. WLAN ON / TURN OFF WLAN / TURN ON WLAN (wait to be connected before typing the below command or you will have to do it again)
$ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
12. $/tmp/xsh
$(precmd)[email protected]$HOSTNAME:${PWD:-?} $ <--(you should see
this)
Here is a shell with root privileges, so stand up and be able to work a variety. You can also install the su
13. $(precmd)[email protected]$HOSTNAME:${PWD:-?} $
$ mount -o remount,rw /system /system
$ chmod 777 /system/app/
$ chmod 777 /system/bin/
$ chmod 777 /system/xbin/
Open another command prompt:
adb push Superuser.apk /system/app/
adb push su /system/bin/
adb push busybox /system/xbin/
Go back to ($(precmd)[email protected]$HOSTNAME:${PWD:-?} $) window:
chown root.root /system/bin/su
chmod 6755 /system/bin/su
chmod 644 /system/app/Superuser.apk
chown root.shell /system/xbin/busybox
chmod 755 /system/xbin/busybox
chmod 755 /system/app/
chmod 755 /system/bin/
chmod 755 /system/xbin/
Verify root access by installing "Root Checker".
Note: each time you reboot your device you will need to run Tomoyo Unlock script to regain root access (Step 8 - 12) which I re-wrote below:
8. Tomoyo Unlock
> adb shell
$ cat /data/local/tmp/p07dgetroot > /tmp/xsh
$ ls -l /tmp/xsh
-rw-rw-rw- shell shell xsh <--(you should see this)
WLAN ON / OFF / ON
$ ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$ /tmp/xsh
/tmp/xsh
/tmp/.mem fd=3
read ret = 256
write ret = 256
At this stage, tomoyo is released
$rm /tmp/xsh
$cat /data/local/tmp/xsh > /tmp/xsh
WLAN ON / OFF / ON
$ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$/tmp/xsh
$(precmd)[email protected]$HOSTNAME:${PWD:-?} $ <---(you should end up here to regain root access, if not redo it again)
Proof:
ask questions
hi,
If it unlocked the device of sim by docomo, when i root it, the condition of unlock sim whether will cancel????
---------- Post added at 12:10 AM ---------- Previous post was at 12:06 AM ----------
dear zyper95,
Can you make the picture to show the process of root??
thank a lot
Panasonic P-07D
Hello, Someone tell me how to reset to factory settings "Android system recovery -> wipe data / factory reset -> Yes-delete all user data -> Please input password". What is the password to be entered? Help please.
Panasonic Eluga Power P-07D hard reset plz:crying::crying::crying:

[Q] ROOT For Noontec A9 ICS 4.0.4 Needed?

Hi, im new to this forum so please go easy guys....
I have a Noontec A9 that i have flashed with ICS 4.0.4 update_RK2918_Android4.0_DDR512M_456M_20120604.img
using RKBatchTool
Described in post #7 here:
http://forum.xda-developers.com/showthread.php?t=1526623The firmware is realy good BUT I cant get root access...
Tried installing superuser etc with no luck :'(
Does anyone know how to root this firmware or is there an alternitive rooted ICS 4.0.4 ROM out???
Verg0
Hi,
Not sure if I can help you with the root problem - but just wondering how you where you can get the ICS update as I can't seem to find this anywhere.
I've got root on the my Noontec A9 based on the previous firmware I installed but its only 2.3. Would much rather have ICS without root (although root is handy).
Thanks in advance.
bjingham said:
Hi,
Not sure if I can help you with the root problem - but just wondering how you where you can get the ICS update as I can't seem to find this anywhere.
I've got root on the my Noontec A9 based on the previous firmware I installed but its only 2.3. Would much rather have ICS without root (although root is handy).
Thanks in advance.
Click to expand...
Click to collapse
Read my top post there is a link to the thread its post number 7, i cant post external links as i dont have enough post counts
verg0 said:
Read my top post there is a link to the thread its post number 7, i cant post external links as i dont have enough post counts
Click to expand...
Click to collapse
Am wondering if there's any development for this? Post number 7 is meant for firmware v1.2.09 but mine is v1.2.10. Furthermore, will it upgrade to ICS? What about the performance since only got 512MB RAM?
So any update on ICS for this device? I dont want to rip apart my machine. Should be a way to do this with USB drive or SD media card.
damez2000 said:
So any update on ICS for this device? I dont want to rip apart my machine. Should be a way to do this with USB drive or SD media card.
Click to expand...
Click to collapse
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
jmatbastos said:
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
Click to expand...
Click to collapse
Thanks. Just used your method and got ICS rooted without opening the box. But the main reason for having this rooted is to have network drives mounted. Has anyone figured out a working cifs.ko configuration?
Noontec A9 ICS Problem
jmatbastos said:
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
Click to expand...
Click to collapse
Hi,
many thanks for all your hard work in colating this info. Could you help me please? I have upgraded to ICS on the A9, and whilst it looks good and no doubt offers more scope for usage, it doesn't agree with simple movie watching and You Tube, causiing audio slippage. I have tried to connect again to the pc but try as I might, the PC doesn't want to know. The device is essentially on it's own. Any ideas how to ressurect the old firmware? I have tried the two pin shorting methods to no avail.
Many thanks in advance.
mcpherson35 said:
Hi,
many thanks for all your hard work in colating this info. Could you help me please? I have upgraded to ICS on the A9, and whilst it looks good and no doubt offers more scope for usage, it doesn't agree with simple movie watching and You Tube, causiing audio slippage. I have tried to connect again to the pc but try as I might, the PC doesn't want to know. The device is essentially on it's own. Any ideas how to ressurect the old firmware? I have tried the two pin shorting methods to no avail.
Many thanks in advance.
Click to expand...
Click to collapse
1- Get Rom Toolbox from Google Play Store
2- Run Rom Toolbox > Rebooter > Reboot Bootloader
3 - RKBatchTool and RKAndroidTool will now detect the device and you can flash another firmware
4 - run "step four_ Install Firmware" from
noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip
to get back to Android 2.3

Cloning Pre-configured Android 8.1 Device / ROM

Hey guys,
Not sure if this is the correct place to post, but I am at my wits end and think I need a bit of help. I have been cloning devices on Android 7.1 without too much trouble, but something has changed in Android 8.1 which breaks things. Here is my setup:
Device: Xiaomi Redmi Note 4X 16GB, unlocked bootloader
OS: LineageOS 15.1 (Android 8.1)
My setup process is as follows:
Let stock ROM update (for latest firmware), unlock BL, flash TWRP, clean wipe, flash LineageOS + Gapps + Magisk
Skip through setup wizard, apply customisations (apps via APKs, launcher, settings, etc)
Clear Data for following:
com.google.android.gms.setup
Google App
Google Account Manager
Google Backup Transport
Google One Time Init
Google Partner Setup
Google Play Services
Google Play Services for Instant Apps
Google Play Store
Google Services framework
Reboot to TWRP
Connect to PC, run following ADB command: adb pull /data/system/users/0/settings_secure.xml
Open settings_secure.xml and delete "android_id" line
Push settings_secure.xml back to device: adb push settings_secure.xml /data/system/users/0/
Capture system image, flash onto other devices (either via TWRP backup or pushing system images via ADB)
Boot device, log into client Google account, done
Now this process used to work great on LineageOS 14.1 (Android 7.1), but now I get the following issues:
When adding a Google Account, it does not appear in Android device manager, but it appears in the list of devices in the Google Play Store? If I remove the account and then add it again it appears, but the issues below still occur.
Google's messaging / push system is broken. If I send a Hangouts message to my Google account, it won't appear until I open the app.
Any pre-installed apps won't appear in the "installed" list of apps in the play store, and therefore not update automatically until the user manually searches for the app in the Play Store and hits "update" (ugh).
I need to be deploying around 100 units over the next couple of months or so I need something that is scalable. I might be going around this the wrong way completely. I am not a ROM developer or programmer, just found something that has worked well in the past, so if I need to develop a ROM from scratch based on LineageOS I'll probably need to hire someone to do this for me as this is a bit beyond my current capabilities and time constraints. Let me know your thoughts! Thanks.
Android ID is same for many devices if you clone. That is really bad and can cause issues.
Rayman96 said:
Android ID is same for many devices if you clone. That is really bad and can cause issues.
Click to expand...
Click to collapse
I am deleting the Android ID from settings_secure.xml though. Unless it is somewhere else as well?
I'm still struggling with this problem. Is there anything else I can try? I googled this problem and the first result is this thread :/
stephendt0 said:
I'm still struggling with this problem. Is there anything else I can try? I googled this problem and the first result is this thread :/
Click to expand...
Click to collapse
Code:
adb shell settings delete secure android_id
adb shell settings delete secure advertising_id
adb shell settings delete secure bluetooth_address
adb shell settings put secure bluetooth_name 'YOURNAME'
adb shell settings put global device_name 'YOURNAME'
adb shell settings put global wifi_p2p_device_name 'YOURNAME'
The two IDs are then randomly regenerated. YOURNAME is any name of your choice.
rainman74 said:
Code:
adb shell settings delete secure android_id
adb shell settings delete secure advertising_id
adb shell settings delete secure bluetooth_address
adb shell settings put secure bluetooth_name 'YOURNAME'
adb shell settings put global device_name 'YOURNAME'
adb shell settings put global wifi_p2p_device_name 'YOURNAME'
The two IDs are then randomly regenerated. YOURNAME is any name of your choice.
Click to expand...
Click to collapse
Thanks for that. I believe I actually found their respective strings in settings_secure.xml:
<setting id="59" name="config_update_certificate"
<setting id="43" name="bluetooth_address"
And of course the Android ID. Once I deleted these, they auto-generated on the next boot, so I do this using ADB in TWRP.
I tried this and so far I'm not having any problems! Will report back if I experience any issues.
Another update - turn out that this is NOT enough. You will also want to clear data for the following apps (ideally just before shutting down the system and clearing android, bluetooth and config_update_certificate) to ensure that push notifications continue to work:
Com.google.android.gms.setup
Google App (not 100% sure if this is required, but I do it anyway)
Google Play Services
Google Play Store
Google Services framework
Reboot, clear your IDs, and then take your image. It should be OK after that, I think. I generally like to setup Hangouts on the device and then reboot, and let it sit for 5 minutes so its fully dozed before I send a test message.
Edit: STILL not working even after all this. Anyone else able to offer an explanation as to why push notifications is such an issue? This is becoming really difficult
stephendt0 said:
Another update - turn out that this is NOT enough. You will also want to clear data for the following apps (ideally just before shutting down the system and clearing android, bluetooth and config_update_certificate) to ensure that push notifications continue to work:
Com.google.android.gms.setup
Google App (not 100% sure if this is required, but I do it anyway)
Google Play Services
Google Play Store
Google Services framework
Reboot, clear your IDs, and then take your image. It should be OK after that, I think. I generally like to setup Hangouts on the device and then reboot, and let it sit for 5 minutes so its fully dozed before I send a test message.
Edit: STILL not working even after all this. Anyone else able to offer an explanation as to why push notifications is such an issue? This is becoming really difficult
Click to expand...
Click to collapse
ok, if you want to reset everything in a clone, proceed as follows:
Code:
adb shell su -c mount -o remount,rw /system
adb shell su -c rm /data/system/users/0/accounts.db
adb shell su -c rm /data/system/users/0/accounts.db-journal
adb shell su -c rm /data/system/users/0/photo.png
adb shell su -c rm /data/system/sync/accounts.xml
adb shell su -c rm /data/system/sync/pending.xml
adb shell su -c rm /data/system/sync/stats.bin
adb shell su -c rm /data/system/sync/status.bin
adb shell su -c pm clear com.android.packageinstaller
adb shell su -c pm clear com.android.providers.downloads
adb shell su -c pm clear com.android.vending
adb shell su -c pm clear com.google.android.backuptransport
adb shell su -c pm clear com.google.android.gms
adb shell su -c pm clear com.google.android.gsf
adb shell su -c mount -o remount,ro /system
Please also follow my instructions above for resetting the IDs before rebooting.
Google then recognizes a new device! Have fun :fingers-crossed:
rainman74 said:
ok, if you want to reset everything in a clone, proceed as follows:
Code:
adb shell su -c mount -o remount,rw /system
adb shell su -c rm /data/system/users/0/accounts.db
adb shell su -c rm /data/system/users/0/accounts.db-journal
adb shell su -c rm /data/system/users/0/photo.png
adb shell su -c rm /data/system/sync/accounts.xml
adb shell su -c rm /data/system/sync/pending.xml
adb shell su -c rm /data/system/sync/stats.bin
adb shell su -c rm /data/system/sync/status.bin
adb shell su -c pm clear com.android.packageinstaller
adb shell su -c pm clear com.android.providers.downloads
adb shell su -c pm clear com.android.vending
adb shell su -c pm clear com.google.android.backuptransport
adb shell su -c pm clear com.google.android.gms
adb shell su -c pm clear com.google.android.gsf
adb shell su -c mount -o remount,ro /system
Please also follow my instructions above for resetting the IDs before rebooting.
Google then recognizes a new device! Have fun :fingers-crossed:
Click to expand...
Click to collapse
OMG, I think that worked, thank you! I spent 5 hrs and stayed up to 3am trying to work this out with no luck, and this did the trick. To make things easier however, I morphed these commands into a dirty "one-liner" that saves entering each command.
Code:
adb shell settings delete secure android_id && adb shell settings delete secure advertising_id && adb shell settings delete secure bluetooth_address && adb shell settings put secure bluetooth_name 'Redmi Note 4' && adb shell settings put global device_name 'Redmi Note 4' && adb shell settings put global wifi_p2p_device_name 'Redmi Note 4' && adb shell su -c mount -o remount,rw /system && adb shell su -c rm /data/system/users/0/accounts.db && adb shell su -c rm /data/system/users/0/accounts.db-journal && adb shell su -c rm /data/system/users/0/photo.png && adb shell su -c rm /data/system/sync/accounts.xml && adb shell su -c rm /data/system/sync/pending.xml && adb shell su -c rm /data/system/sync/stats.bin && adb shell su -c rm /data/system/sync/status.bin && adb shell su -c pm clear com.android.packageinstaller && adb shell su -c pm clear com.android.providers.downloads && adb shell su -c pm clear com.android.vending && adb shell su -c pm clear com.google.android.backuptransport && adb shell su -c pm clear com.google.android.gms && adb shell su -c pm clear com.google.android.gsf && adb shell su -c mount -o remount,ro /system
I'm sure there is a more efficient way of stacking commands, but this worked. Replace "Redmi Note 4" with your actual device and reboot. I cleared data for any messaging apps and removed my Google account before I began, however.
stephendt0 said:
OMG, I think that worked, thank you! I spent 5 hrs and stayed up to 3am trying to work this out with no luck, and this did the trick. To make things easier however, I morphed these commands into a dirty "one-liner" that saves entering each command.
I'm sure there is a more efficient way of stacking commands, but this worked. Replace "Redmi Note 4" with your actual device and reboot. I cleared data for any messaging apps and removed my Google account before I began, however.
Click to expand...
Click to collapse
Perfect! You don't need to remove your Google account as the commands do this anyway
rainman74 said:
Perfect! You don't need to remove your Google account as the commands do this anyway
Click to expand...
Click to collapse
Quick update.
After a bit more testing, turns out that there were still a few things that needed clearing, particularly on different versions of Android (7.1). Also, I've noticed that a GSF ID can be generated before you get a chance to capture an image if you leave Wi-Fi enabled, so I've included that in the script. I've ended up with a .BAT file with the following:
Code:
echo on
adb shell settings delete secure android_id
adb shell settings delete secure advertising_id
adb shell settings delete secure bluetooth_address
adb shell su -c mount -o remount,rw /system
adb shell su -c svc wifi disable
adb shell su -c rm /data/system/users/0/accounts.db
adb shell su -c rm /data/system/users/0/accounts.db-journal
adb shell su -c rm /data/system/users/0/photo.png
adb shell su -c rm /data/system/users/0/settings_ssaid.xml
adb shell su -c rm /data/system/sync/accounts.xml
adb shell su -c rm /data/system/sync/pending.xml
adb shell su -c rm /data/system/sync/stats.bin
adb shell su -c rm /data/system/sync/status.bin
adb shell su -c pm clear com.google.android.ext.services
adb shell su -c pm clear com.google.android.ext.shared
adb shell su -c pm clear com.google.android.gsf.login
adb shell su -c pm clear com.google.android.onetimeinitializer
adb shell su -c pm clear com.android.packageinstaller
adb shell su -c pm clear com.android.providers.downloads
adb shell su -c pm clear com.android.vending
adb shell su -c pm clear com.google.android.backuptransport
adb shell su -c pm clear com.google.android.gms
adb shell su -c pm clear com.google.android.instantapps.supervisor
adb shell su -c pm clear com.google.android.gsf
adb shell su -c mount -o remount,ro /system
I have found that this works consistently across both LineageOS 14.1 and LineageOS 15.1 devices.
stephendt0 said:
OMG, I think that worked, thank you! I spent 5 hrs and stayed up to 3am trying to work this out with no luck, and this did the trick. To make things easier however, I morphed these commands into a dirty "one-liner" that saves entering each command.
Code:
adb shell settings delete secure android_id && adb shell settings delete secure advertising_id && adb shell settings delete secure bluetooth_address && adb shell settings put secure bluetooth_name 'Redmi Note 4' && adb shell settings put global device_name 'Redmi Note 4' && adb shell settings put global wifi_p2p_device_name 'Redmi Note 4' && adb shell su -c mount -o remount,rw /system && adb shell su -c rm /data/system/users/0/accounts.db && adb shell su -c rm /data/system/users/0/accounts.db-journal && adb shell su -c rm /data/system/users/0/photo.png && adb shell su -c rm /data/system/sync/accounts.xml && adb shell su -c rm /data/system/sync/pending.xml && adb shell su -c rm /data/system/sync/stats.bin && adb shell su -c rm /data/system/sync/status.bin && adb shell su -c pm clear com.android.packageinstaller && adb shell su -c pm clear com.android.providers.downloads && adb shell su -c pm clear com.android.vending && adb shell su -c pm clear com.google.android.backuptransport && adb shell su -c pm clear com.google.android.gms && adb shell su -c pm clear com.google.android.gsf && adb shell su -c mount -o remount,ro /system
I'm sure there is a more efficient way of stacking commands, but this worked. Replace "Redmi Note 4" with your actual device and reboot. I cleared data for any messaging apps and removed my Google account before I began, however.
Click to expand...
Click to collapse
YES, this did it. I cloned a kindle fire hdx using TWRP backup&restore and had to perform the action mentioned above in order to use both devices independetly.
ATTENTION!
Remember to change the values listed in stephendt0's example that were not part of the original code from rainman74:
- device_name: Equals the device type. E.g. adb shell settings put global device_name 'KFHDX'
- bluetooth_name: Hostname of the device seen in bluetooth.
- wifi_p2p_device_name: Hostname used for a p2p wifi network aka "ad hoc network". Not supported on all devices.

Categories

Resources