[Q] Modifying Samsung factoryfs.img - Android Software/Hacking General [Developers Only]

I have a Samsung Galaxy Player 70 Plus (YP-GB70D) which is sold in Korea only (got it secondhand from ebay). I cannot find any development of this player (or the Korean development team is not willing to share), particularly on installation of CWM. I would at least like to have this rooted. I did manage to find copies of the OEM firmware in TAR format.
I read about dsixda's Android Kitchen. I installed Virtualbox on my Windows 7 machine to run ubuntu 12. I successfully installed Kitchen and used it to modify my TAR firmware. However, I notice that the modified firmware is in ZIP format suitable for flashing with CWM (as I said there is no CWM for this player). I renamed this to "update.zip" and tried Samsung's 3e recovery, but it rejected it saying "verification fails".
Further research shows that I can unpack the factoryfs.img in the TAR firmware, and manually add su / superuser into the system folders, then repack it back into factoryfs.img and then the TAR firmware, and use ODIN or Heimdall to flash it to the player. I have also successfully installed EXT4_UTILS on ubuntu and used it to unpack the factoryfs.img into an ext4 image, and mounted the unpacked image using this command:
Code:
sudo mount -o loop output.img tempdir
Unfortunately, the mounted image only allows you to see the content of the image, and you cannot add / delete / change anything inside. I tried modifying the permission of the folder of the mounted image, but no luck.
When I look at the output from Kitchen and the mounted image, I notice they have all the identical system folders and files (except su and superuser added in the Kitchen output). Therefore, I copied the "system" folder from Kitchen output and repacked it into factoryfs.img with EXT4_UTILS, and replaced the original factoryfs.img of the OEM firmware with the modified version (I repacked the TAR using 7zip).
Unfortunately, when I flashed the modified TAR with ODIN (which detected the player without problem), it said "failed" and aborted. When I used Heimdall (which detected the player without problem), it gave me a "usblib error -12" message and aborted. I have tried unsintalling the "Samsung USB driver for mobile phone" and reinstalling the Heimdall driver from zadig.exe, but no luck.
My questions are:
(1) Is there a way to make the mounted ext4 image of the EXT4_UTILS read/writable, so that I can modify the content and add su / superuser to "bin"?
(2) Does ODIN check whether the firmware is original (OEM) or custom, and reject custom firmware? If not, why would my method of replacing the "system" folder of the original factoryfs.img with that from the Ktichen output fail?
Thanks for helping a noob out.

Related

Adding new commands to init.rc

I wanted to add some extra steps to my init.rc file but was unsuccessful. I was hoping someone could explain what I'm doing wrong or advise if there is a better way to do this.
I started by creating a new backup image using clockworkmod and then copied the boot.img file over to my host. I then used the steps as described in the thread "HOWTO: Unpack, Edit, and Re-Pack Boot Images" to unpack the contents and get the init.rc file. After adding the additional steps at the end, I packaged the boot.img file back up using mkbootfs and mkbootimg and then pushed the file to my sdcard. However, when I try to use "flash_image" to flash the new boot.img, I always get the error "error scanning partition". I don't think the problem is with the new boot.img file because I get the same error if I try to flash the original boot.img or even some non-existing file.
I also tried to simply replace the original boot.img file in my clockworkmod back up directory and do a standard restore, but that doesn't get past the "Viewsonic" logo screen. I assume that is because of some checksum issue.
Can anyone see my error or suggest and alternate method?
Thanks in advance

[Q] Adventures in Noob-land

So, I'm pretty much a noob to Android development, as all I know comes from reading root methods and flashing ROMs to first my Kindle Fire and now my Galaxy Tab 2. However, I've been doing research and decided to try to accomplish some stuff. My first task: fix CWM to access the internal SD card. So I began:
I began with the recovery.tar.md5 CWM image. After some research, I extracted recovery.img on my virtual Ubuntu installation.
Next, I set about to unpack recovery.img. Using the details here, I unpacked with unpack-bootimg.pl.
I entered the working directory and sought to find the file(s) where I could solve my problem. Two grabbed my attention: init.rc and recovery.fstab. I saw mount points in the latter and changed /sdcard to ext4 and mmcblk0p8 (which my exploration led me to believe was the internal sdcard). I added sd-ext as vfat and mmcblk1.
Then, with that edited, I went back to init.rc and added this to on init:
Code:
symlink /sd-ext /sdcard/External
Finally, satisfied with my experiment, I used repack-bootimg.pl to create editRecovery.img.
I used Ubuntu's context menu to create editRecovery.tar in Archive Manager.
Finally, back on Windows, I attempted to flash my file with Odin. At this point, my tablet gave an error about the firmware not upgrading properly. I flashed the original CWM with Odin and booted normally.
Now, I really had no idea what I was doing with this, simply using bits and pieces of info I gleaned online to try to figure it out. So, I'd like to know, where did I go wrong (at least, as the reason for the flash not working)? Anyone know how to do what I wish?

Help - unbrick using fastboot and files from update.zip?

I have bricked my kyobo ereader (gingerbread 2.3.5) but still have fastboot and limited adb (no shell commands since there is no valid system) access on the device.
I have various update.zips for the device but unfortunately these are installable only on a working system (via settings->privacy->updates) and I know of no way of installing the update.zip since there does not appear to be any custom recovery for this ebook reader and booting into recovery does not install the update.zip on the sdcard.
The update.zip for the Kyobo ereader contains boot.img, recovery.img and a system folder containing files and directories for the system partition (an example of an official update.zip is available from m.kyobobook.co.kr/mirasol/update.zip )
I have extracted the system folder on a ubuntu system and need to prepare a system.img file which may be flashed using fastboot. I have also changed owner of the extracted files to root:root and chmod 777 on all the executables in the extracted system folders. A complication is that I only have the windows qualcomm hsusb drivers for fastboot or adb to connect to a pc, so I must use a windows 7 notebook to flash the device (possibly precluding pushing the system folder files to the device since they don't have permission and owner settings in windows)
I have tried various tools to make a system.img including the native linux mkcramfs and tools suggested by various google searches such as mkfs.yaffs2.x86 and make_ext4fs. All these tools could prepare a system.img but unfortunately they have different sizes and I am not sure which img is the correct one. I have tried to flash the various system.img using both fastboot flash system system.img and also by adding the system.img to the update.zip (together with placeholders for the required android-info.txt but in all cases they do not any files onto the sytem partition (although fastboot does send the system.img successfully to the device and writes the 120~180MB img files in about 50-70seconds. I have tried using both the official boot.img and the rooted boot.img. I noticed that the device reboots twice after such flashing which may be because there is some protection from the official recovery.img which checks the system partition an erases it if it does not match.
My first 2 questions are general and the third is specific to my situation:
1. What is the correct tool to generate an android system.img file from the extracted update.zip's system folder on a linux system?
2. Any suggestions on how to flash an update.zip using fastboot or adb?
3. Are there any generic recovery.img which I could try to flash over the official recovery partition on the kyobo mirasol ereader?
Any suggestions anyone?

[ROOT] [i8160] [Ace2] Advanced rooting procedure WITHOUT increasing the Flash counter

SAMSUNG GALAXY ACE 2 i8160/i8160P
This could be complicated if you never used any Linux os, however with this method you can root your phone without increasing the flash counter.
Kernel, recovery, etc. will be the same as in original samsung roms, we will flash a modified (pre-rooted) system.img.
For prerooted system images and csc files see 2nd post!
Requirements:
Linux - Ubuntu 12 recommended (a virtual one will also do the job)
Windows with Odin for flashing
Patience
References:
Ext4Utils
Insipred by: Expert root method which does not increase the flash counter
First of all download your original rom from: http://www.sammobile.com/firmware/?page=3
1, Create a "samsung" directory on your linux filesystem -> "home/username" folder where username is your linux username.
2, Extract the downloaded firmware, then move system.img.md5 and cache.img.md5 to home/username/samsung dir.
(root_package.zip and ext4utils.zip also extract here)
3, Open a terminal window, and enter:
Code:
sudo mkdir /mnt/system
Type the root password and enter.
4, Now set current dir to samsung directory and mount the system image:
Code:
cd /home/username/samsung
mv system.img.md5 system.img.ext4
make
./simg2img system.img.ext4 system.img
sudo mount system.img /mnt/system
if you get error when executiong "make" type:
Code:
sudo apt-get install zlib1g-dev
5, The original system image has been mounted, now extract su binary and superuser.apk to samsung dir then, enter:
I suggest only su binary to include in /system, SuperUser can be installed later!
Code:
sudo cp su /mnt/system/bin/su
6, Now we have to adjust the permissions:
For SU binary:
Code:
sudo chown root:root /mnt/system/bin/su
sudo chmod 06755 /mnt/system/bin/su
For SuperUser app:
Code:
sudo chmod 644 /mnt/system/app/superuser.apk
7, Unmount the image:
Code:
sudo umount /mnt/system
or if it's not working:
Code:
sudo umount system.img
8, Now create md5 hashes:
Code:
md5sum -t system.img>>system.img
mv system.img system.img.md5
if you get "permission denied" first:
Code:
sudo chown username:username system.img
9, Create falshable tar and md5 hashes for odin package:
Code:
tar cf system_rooted.tar system.img.md5
md5sum -t system_rooted.tar>>system_rooted.tar
mv system_rooted.tar system_rooted.tar.md5
As you remember we copied the cache.img.md5 also, that's because we need to flash this as a separated CSC package.
10, Creating CSC package.
Code:
tar cf csc.tar cache.img.md5
md5sum -t csc.tar>>csc.tar
mv csc.tar csc.tar.md5
11, Now open Odin and select system_rooted.tar.md5 as PDA, and csc.tar as csc.
Check: Auto reboot and F. Reset Time.
Enjoy your rooted phone.
NOTES:
After flashing phone will boot in recovery mode to apply csc, then reboots automatically to normal mode.
If you download different rom than already have on the device first flash the unmodified samsung tar as PDA.
PRE-ROOTED ROMs
(Only modified system and csc - if Superuser not included download manually from Play store or install from sdcard)
PDA: XXLD8 | CSC: I8160DBTLD2 -> -> DOWNLOAD <-
Thanks to: powermetza
PDA: XXLD8 | CSC: XXLD3 | Product code: XEO -> Mirror 1 | Mirror 2
Thanks to: mastermid | szczepan2
For i8160P - Galaxy Ace 2 NFC model
PDA: I8160PXXLE6 | CSC: I8160PDBTLE5 -> Mirrors
Thanks to: soraxx
SuperUser FIX for pre-rooted rom (only if you have problems): View
FLASHING INSTRUCTIONS
0, Download odin from 1st post, extract the downloaded (pre-rooted) rom.
1, Open odin and select csc.tar.md5 (or something like that it's a smaller file max. 20 MB) as CSC.
2, Select the other file (possibly system.tar.md5 or pda.tar.md5, it's 500+ MB) as PDA.
3, Check, Auto reboot and F. Reset Time then start.
(of course first switch to download mode and connect the phone )
mount: must specify filesystem (this is error)
My OS - Linux Mint 13 with MATE, run natively.
I don't know what's the problem, the filesystem should be ext4, but in Ubuntu mounted without any errors.
any chance to reset counter? mine just rooted yesterday. damn
Thank you! It would be a good solution can be used under Windows ...
GT-I8160-ról küldve
@Szaby59
Three simple questions:
1. Can I use this method to cook pre-rooted ROM (that doesn't increase flash counter), but without samsungs bloatware? In other words: Can I somehow remove any APK that comes from samsung and still have valid warranty?
2. Did you tried this method with flash_counter=0 or did you already voided warranty and then NOT increased flash_counter?
3. Are both values "Custom Binary Download=NO" and "Current Binary: Samsung Official" still intact after this root method?
Anyway... Thank you for this... I was waiting for something like this since I bought I8160.
1, I think you can remove apps and modify some other things if you want I didn't test it but 99% it's possible (or you can remove aps later with root explorer from /system/app)
But for warranty purposes (removing root, restoring original apps) reflash the original unmodified samsung tar.
2-3, No, I didn't tried any other methods, the custom binary downloads is 0 (NO) and I have "Samsung Official".
I think the counter only observing kernel flashes, with this method the flash counter will be the same as before the flash.
Also I noticed when you reboot from adb or terminal to download mode it doesn't shows the odin mode... stuffs, only when you use the hardware keys (vol down+home+power). !Maybe! in this way we can flash a modified kernel but it's not 100% and first you need to root the phone somehow to enable "su reboot download" command.
By the way... There is no way to download the ROM from THIS site... Loading, loading, and... loading...
szczepan2 said:
By the way... There is no way to download the ROM from THIS site... Loading, loading, and... loading...
Click to expand...
Click to collapse
Login first -> blank screen -> go back and refresh > download firmware.
Do I need to create CSC file again if I want to flash back to stock-non rooted firmware? Or should I use stock PDA file only, without CSC?
Can you write down a simple "Going back to stock ROM procedure without touching Flash Counter". Many noobs (including me) would be grateful for complete solution.
Maybe the editing ROM is not working because it's Polish? I can't open it too with any archive manager...
arroyo said:
Do I need to create CSC file again if I want to flash back to stock-non rooted firmware? Or should I use stock PDA file only, without CSC?
Can you write down a simple "Going back to stock ROM procedure without touching Flash Counter". Many noobs (including me) would be grateful for complete solution.
Click to expand...
Click to collapse
Just flash back the original tar with all files as pda no csc or phone needed it's included in the tar.
@szczepan2: you can't use any know archiver to open img.md5 files.
For extracting the tar use winrar or 7zip.
Szaby59 said:
@szczepan2: you can't use any know archiver to open img.md5 files.
For extracting the tar use winrar or 7zip.
Click to expand...
Click to collapse
Ahh, got it. So if it impossible to open it, so how it's possible to mount it?
Ehh, i'm really angry because I can't root my phone... You use Ubuntu in VM or native? Or maybe LiveCD?
szczepan2 said:
Ahh, got it. So if it impossible to open it, so how it's possible to mount it?
Ehh, i'm really angry because I can't root my phone... You use Ubuntu in VM or native? Or maybe LiveCD?
Click to expand...
Click to collapse
I installed on a virtualbox virtual machine, (with 8 GB vhd) for mounting and rooting follow the steps from 1st post.
@Szaby59
I have also the problem that I need to specify type of mounting filesystem, but I have an idea.
If you are able to mount succesfuly system.img, then could you in console just type:
Code:
mount
It will give you the list with all mounted devices/images and their types - I would be grateful if you could check what type is /mnt/system.
Thanks in advance.
mastermid said:
@Szaby59
I have also the problem that I need to specify type of mounting filesystem, but I have an idea.
If you are able to mount succesfuly system.img, then could you in console just type:
Code:
mount
It will give you the list with all mounted devices/images and their types - I would be grateful if you could check what type is /mnt/system.
Thanks in advance.
Click to expand...
Click to collapse
It shows ext4 filesystem.
mastermid said:
@Szaby59
I have also the problem that I need to specify type of mounting filesystem, but I have an idea.
If you are able to mount succesfuly system.img, then could you in console just type:
Code:
mount
It will give you the list with all mounted devices/images and their types - I would be grateful if you could check what type is /mnt/system.
Thanks in advance.
Click to expand...
Click to collapse
cloudm33 samsung # mount -t ext4 system.img /mnt/system/
mount: Filesystem error, wrong superblock at /dev/loop0 etc.
Tutorial updated with additional tools and instructions.
Szaby59 said:
Tutorial updated with additional tools and instructions.
Click to expand...
Click to collapse
Can you upload also a pre-rooted rom?
For example the polish or the germany stock rom?
Thanks in advance!

[Q] Mod a tar.md5 into a pre-rooted one

Question for the more pro users/devs ... just crossed my mind ...
For example we have the XXDMH1 BTU (Android 4.2.2) ODIN firmware for the P3110 which can't be rooted through CF-Auto-Root - and unless the Search button failed me there's also no known "backdoor" to inject root. Therefore... taking apart the XXDMH1 to pre-root it and re-pack it for flashing ... is it _really_ as easy as (in Linux commandline terms) ...
tar xvf ~/Downloads/xxdmh1.tar.md5 -C ./xxdmh1
sudo mount ./xxdmh1/system.img -o loop -t ext4 /mnt
<extract SuperSU ZIP, inject required files into the image mounted at /mnt and adjusting file modes/permissions>
sudo umount /mnt
cd ./xxdmh1
tar cvf ../xxdmh1-rooted.tar .
cd ..
md5sum xxdma1-rooted.tar >> xxdma1-rooted.tar
mv xxdmh1-rooted.tar xxdmh1-rooted.tar.md5
... and flash with ODIN or do I look at from a completely wrong viewpoint?
Some input on the idea if that's the "magic sauce" to root the "unrootable XXDMH1 BTU" would be appreciated (in which case it could even be de-bloated from the get-go).
BoneWithABeagle said:
Question for the more pro users/devs ... just crossed my mind ...
For example we have the XXDMH1 BTU (Android 4.2.2) ODIN firmware for the P3110 which can't be rooted through CF-Auto-Root - and unless the Search button failed me there's also no known "backdoor" to inject root. Therefore... taking apart the XXDMH1 to pre-root it and re-pack it for flashing ... is it _really_ as easy as (in Linux commandline terms) ...
tar xvf ~/Downloads/xxdmh1.tar.md5 -C ./xxdmh1
sudo mount ./xxdmh1/system.img -o loop -t ext4 /mnt
<extract SuperSU ZIP, inject required files into the image mounted at /mnt and adjusting file modes/permissions>
sudo umount /mnt
cd ./xxdmh1
tar cvf ../xxdmh1-rooted.tar .
cd ..
md5sum xxdma1-rooted.tar >> xxdma1-rooted.tar
mv xxdmh1-rooted.tar xxdmh1-rooted.tar.md5
... and flash with ODIN or do I look at from a completely wrong viewpoint?
Some input on the idea if that's the "magic sauce" to root the "unrootable XXDMH1 BTU" would be appreciated (in which case it could even be de-bloated from the get-go).
Click to expand...
Click to collapse
I believe, but not sure that these files are signed and Odin will reject them if the signature is invalid. Correct me if i'm wrong, I haven't done Samsung stock firmware flashing in a while. At Sony's FTF files as example, there's no way to modify them because they are signed and cannot be flashed if the FTF is modified.
Joery360 said:
I believe, but not sure that these files are signed and Odin will reject them if the signature is invalid. Correct me if i'm wrong, I haven't done Samsung stock firmware flashing in a while.
Click to expand...
Click to collapse
I guess I'll give it a try then to see what ODIN has to tell me when trying to open a modded .tar.md5. I wasn't sure about the method itself ... it looks so ridiculously easy to mod the stock firmware (read: pre-root) it makes me wonder no one else thought about it to pre-root the XXDHM1 BTU firmware.
As for the signature: since we can flash Android Andi's various recoveries through ODIN I don't think that's a problem - or I fail to see the digital certificate when combing through the recovery tar.md5 with a hex-editor.
At Sony's FTF files as example, there's no way to modify them because they are signed and cannot be flashed if the FTF is modified.
Click to expand...
Click to collapse
Having dealt with Sony devices myself: Neppers, the FTFs are NOT signed! The only magic of a FTF is that it's a ZIP _WITHOUT_ compression. Just rename a .ftf to .ftf.zip or .zip and extract it ... you'll find the various baseband, kernel, loader, system, data, cache bits inside, all of course in Sony's highly annoying SIN file format. If you re-pack a FTF the only thing you need to be aware of is that you need to create a "store only" / "zero compression" ZIP, or flashtool will not accept the file.

Categories

Resources