Database Info

Allowing non market apps to be installed on locked down phones (backflip)

Hey guys,
My uncle works for Motorola and gave me a prototype phone (which I believe will be called the Motorola Sage, and it's model number is MB508. This thread isn't really about that, I can't post pictures because I don't want to get anyone in trouble). This phone is an AT&T phone, complete with AT&T startup screen, uninstallable AT&T apps and of course the inability to install non-market apps. Also it's running Android 2.1.
Now, I seem to have default root access to this phone. I'm assuming the file system is very similar to that of the Backflip (which I was previously using until I received this one). From what I've read and learned from poking around in /system/etc, non-market apps are blocked by two config files. These are:
/system/etc/motorola/com.android.providers.settings/secure.mkitso
Code:
# cat secure.mkitso
cat secure.mkitso
location_providers_allowed=network,gps
wifi_on=0
data_roaming=1
bluetooth_on=0
install_non_market_apps=0
usb_mass_storage_enabled=1
and
/system/etc/motorola/com.motorola.android.providers.settings/settings.mkitso
Code:
# cat settings.mkitso
cat settings.mkitso
mms_maximum_message_size=614400
auto_scan_on_flip=true
sms_pref_key_emailgateway_num=121
Single_Digit_Dial_Enabled=True
roaming_icon=0
dun_enable=1
force_only_market_apps=1
Bluetooth_Dun_Enabled=true
mms_x_wap_profile_url=http://uaprof.motorola.com/phoneconfi/MotoMB51/profile/MotoMB511.rdf
sms_pref_key_to_email=1
Okay, now it would seem that it's a simple matter of changing the values for "force_only_market_apps" to 0, and "install_non_market_apps" to 1. I did this, and let me quickly tell you how I did it.
- Make /system writable: mount -o remount,rw -t yaffs2 /dev/block/mtdblock4 /system
- Copy mkitso files to sdcard
- Edit mkitso files using Notepad++, changing the values as stated above
- Copy mkitso files back to their original directories
- chmod 644 to the files in order to keep their original permissions
- Make /system read only again: mount -o remount,ro -t yaffs2 /dev/block/mtdblock4 /system
- Restart the phone
However, this did not work, as I still get the warning when I try to install a non-market app.
I was wondering if anyone had any ideas on this, as when the Backflip gets rooted this is one thing that I'm sure we would like to know.

Have you tried adb install? I've heard that works on Backflops. You could download the app to your PC,and install it using "adb install PATH/TO/APP.APK"

Thanks, I know that I can use adb to install non market apps, but I was looking at how to change this setting on the phone. Since I have root on my phone, I figured it was possible.

Check out some of these terminal apps found in /system/bin/ directory of the backflip.Maybe they will help you.
Code:
modemlog
chown
check_prereq
dumpsys
qmuxd
rild
dd
port_bridge
installd
minipadut
vmstat
vold
ioctl
mm-audio-native-test
lsmod
id
mm-adec-omxamr-test
notify
getevent
hciattach
dhcpcd
service
cat
system_server
linker
mm-vdec-omxh264-test
mm-adec-omxevrc-test
wpa_supplicant
netstat
mm-adec-omxmp3-test
ls
wipe
iwpriv
stop
log
mm-vdec-omxmp4-test
top
bt_init
app_process
kill
dumpcrash
iwspy
tcmd_engine
sleep
port-bridge
input
chmod
flash_image
wfa_dut
monkey
dmesg
umount
dalvikvm
sh
sync
ptf
mm-jpeg-dec-test
ime
diag_klog
route
ln
batch
fuel_gauge
iwlist
bugreport
insmod
hcid
svc
rmmod
servicemanager
iwgetid
debuggerd
test_diag
am
renice
applypatch
ps
watchprops
sendevent
reboot
mount
mm-adec-omxQcelp13-test
pm
start
ping
busybox
toolbox
df
touchpad
mediaserver
setconsole
loc_api_app
setprop
logwrapper
rm
dvz
hd
ifconfig
rmdir
printenv
getprop
mm-venc-omx-test
fsck_msdos
iwconfig
iftop
bt_downloader
akmd2
sdptool
disp_util
mm-aenc-omxamr-test
newfs_msdos
gzip
cmp
iwevent
mv
smd
mmclog
mknod
mm-adspsvc-test
bt_test_exec
dexopt
date
set_grp_id
i2c
tcmd_sql
recovery
dumpstate
netcfg
surfaceflinger
mkdir
dbus-daemon
mm-adec-omxaac-test
schedtest
mm-jpeg-enc-test
logcat
mm-aenc-omxaac-test
schedtop
fmradio
EDIT:Also there does not seem to be a com.android.providers.settings in /system/etc/motorola/ only com.motorola.android.providers.settings and the file located in that directory is named secure.mkitso and the market app setting is set up like this:install_non_market_apps=0
So there is a slight difference in how the devices are set up and maybe a bit less security on the backflip =)

Thanks for your suggestion, but if you read above I changed the mkitso files without any changes in the behavior of the phone .

I was thinking that since I changed the settings files and they didn't do anything, maybe they will be applied during a hard reset. I'll try that sometime this weekend and report on the results.
The reason I'm asking for help is because I believe that once the Backflip gets rooted, we will need to know how to disable this setting.

I doubt you have root unless it came already rooted (you did make up some **** about a prototype) I honestly think this wont be a hard issue to tackle or work around when root is achieved on the Lackflip...yes I did Lackflip on purpose because of how crippled it is..so spend your time ANNONYMOUSLY sending www.endgadget.com some nice shiney pics of your supposed prototype codnamed:
"Motorola Sage"

I'm not sure why you're so aggressive, Honestly77. I'm able to "su" in shell and I'm able to modify files in the /system folder, so unless I'm mistaken (which I very well might be), then I believe I have root on the phone.
It is a prototype phone for testing, so it coming rooted isn't too farfetched at all.
When the Backflip does get rooted yes, this will be an easier issue to solve, but I'm trying now. If we're able to figure it out now then no time will have to be devoted to it when the Backflip is rooted.

Alright, I just did a hard reset and it activated a menu toggle under Settings -> Applications -> "Unknown Sources: Allow install of non-Market applications" which can be checked or unchecked.
To summarize, if you have root on your phone, edit secure.mkitso and settings.mkitso and change the variables, then you need to hard reset the phone.

hey met3ora, I too have a backflop, I am currently trying to sell my soul to obtain some sort of root or even simple control over the device, I have 2 questions for you...
1: using the config files and other software availible on this forum, would it be possible to obtain a workaround to be able to install apps from sd? I'm sure you are well aware that the backflip has no memory and won't even allow market apps to be installed via sd.
my second question (its ok if you don't want to answer as we will find out soon enough)
is: the moto sage, how does it compare to the backflip? no specifics needed just, is it better?
Iv'e seen the photos of the sage that appeared a couple weeks ago and it looks good, just incase we need it you should copy the system files as I'm sure the one AT&T will give us will be on lockdown as well. Thanks!

Honestly77 said:
I doubt you have root unless it came already rooted (you did make up some **** about a prototype) I honestly think this wont be a hard issue to tackle or work around when root is achieved on the Lackflip...yes I did Lackflip on purpose because of how crippled it is..so spend your time ANNONYMOUSLY sending www.endgadget.com some nice shiney pics of your supposed prototype codnamed:
"Motorola Sage"
Click to expand...
Click to collapse
THis thread is old but it still helped me with a bravo. Thanks OP.
And to this guy above, wtf, why be such a douche? You are also clearly an idiot or you would know that engineering models always have root.
Calling the OP a liar was way out of line and you should apologize.

[Q] Need help after rooting followed by reset, BADLY!!!!!!!

Okay, So I have a Samsung Admire running 2.3.4 and has a kernel of 2.6.35.7. Purchased 3 weeks ago. I rooted the phone and within a day I had lost the ability to make or receive calls. the phone app crashes every time.and I thought that I had deleted some vital file and thus ruined the phone. After a couple days and nights reading and experimenting I believe that that changing the screen density with Rom Toolbox from 160 to 167 is causing the app to fail. Now the problem is my inability to get rooted again, after resetting back to factory. Nothing I have tried will work and what may, seems baffling. I tried multiply times the original method that was successful, Admire_Root_Windows, Super one click, I tried running both from the SD card, I even downloaded a handful of Android Development programs because I read somewhere that I had to, I'm desperate here. I even came across this :
This was successful with: (I bought the phone 3 days ago)
Android: 2.3.4
Kernel: 2.6.35.7
You need a copy of su, and superuser. (If you have superone click, its all there, just run it adb from that directory)
adb shell "rm /data/log/dumpState_app_native.log 2>/dev/null"
adb shell "ln -s /data/local.prop /data/log/dumpState_app_native.log 2>/dev/null"
adb shell "app_process /dev/null"
REM This command may take a while.
adb shell "echo "ro.kernel.qemu=1" > /data/local.prop 2>/dev/null"
adb reboot
REM Device vibrates (kinda pulses) This is good.
adb wait-for-device
adb shell "rm /data/local.prop 2>/dev/null"
adb shell "rm /data/log/dumpState_app_native.log 2>/dev/null"
adb remount
Thats it, your device is rooted. Now to install the goodies...
adb push su /system/xbin/su
adb shell "chmod 4755 /system/xbin/su"
adb shell "ln -s /system/xbin/su /system/bin/su"
adb install Superuser.apk
Now, before anything else happens, I was having issues with full root. (Root checker claimed everything was fine.. titanium backup worked, but could not remove some crapware..) so at this point, you can go into /system/app and remove the Metro apks. I'd recommend clearing Dalvik cache after you're done as well.
adb reboot
That looks great but there are no instructions and in where does that get typed?
I will have to go buy another at some point tomorrow if I dont get this phone fixed. All I need to do is change the screen res back to 160 and I "think" it will be fine. Everything else runs like a champ. BTW, I do have a LG Optimus T / LG P509 running 2.2. maybe I can use it to fix the other. It's inactive and I have no plans to call tmobile and have it turned on. Please make your answers as though you are dealing with someone who's had a lobotomy, seriously.
How can I reroot?
Thanks,
Zeke

Well...Never mind, I managed to get it figured out...
Thanks,
Zeke

[Nook HD+] Nook HD and HD+ rooting instructions (now permanent)

How to root Nook HD+ (and Nook HD too, I guess).
(Thanks for some useful ideas to sparkym3: http://forum.xda-developers.com/member.php?u=4411543 )
(tested only on 2.0.0 version (as comes out of the box), also works on 2.0.2
Get one of the attached files: root_win.zip if you are on windows, or root_unix.tgz if you are on Linux or Mac.
unpack the file to some dir and run "makeroot" on Windows or "sh makeroot.sh" on Mac/Linux
After a couple of reboots you should be able to do
adb shell and issue a "su" command in the shell and get the root prompt (#).
Thanks to someone0 for his prior investigations here.
Known bugs:
Superuser.apk does not really install because package manager could not be contacted.
Oh, and I think you'll find this interesting too:

Hai.
Kind of a two-fer, eh?

I noticed that people see their Nook HDs restoring to factory settings after 8 unsuccessful reboots next time you boot after rooting, so possibly there's some extra check somewhere.
Very sneaky on the B&N side, I'd say.

Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.
I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...
OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.
Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.
My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.
Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.
Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.

roustabout said:
Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.
I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...
OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.
Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.
My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.
Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.
Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.
Click to expand...
Click to collapse
Do the new HD & HD+ still allow you boot from the external sd card ?

roustabout said:
Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.
I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...
OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.
Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.
My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.
Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.
Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.
Click to expand...
Click to collapse
if you put your books into /system/media, it will back them up to the cloud

Is it possible to push a new recovery with adb after rooting? The 8 failed boot repair is only possible with the stock recovery. But then again you may end up in an endless bootloop without it there to finish it's task. But maybe you can find and delete the trigger flag that starts the process.

leapinlar said:
Is it possible to push a new recovery with adb after rooting? The 8 failed boot repair is only possible with the stock recovery. But then again you may end up in an endless bootloop without it there to finish it's task. But maybe you can find and delete the trigger flag that starts the process.
Click to expand...
Click to collapse
stuff is best to be not mentioned. /sarcasm.....

recovery is signed, so it's not super easy to replace it with anything that would run.
The unsigned bootloader trick at the moment requires a boot from sdcard.

shouldn't step 8 & 9 be outside the code block?

verygreen:
I just want to thank you for your all your work on the Nook series. I've been using your "size-agnostic method ..." tools and process to run from the SD card on my Nook Color since you created the method, and now I'm excited to use your work on my new Nook HD+ (just received yesterday) !

just got mine and got an update notification. turned off wifi so it didnt complete.any word if it breaks root ir bootloader?

CWM is now possible too.

Something is interesting, eventhough mine originally got automatically updated to 2.0.2, but after the factory reset, it went back to 2.0.0. But for some weird reason I can't get root.
Maybe this will help, the build number is 2.0.0.1031.lithium01.ovation.rldp.s68403 with the manufactured date 10/22/2012
please compare mine to your.
I also rewrote your code into a batch file. You can double check it I guess.
Code:
@echo off
cls
@echo .
@echo wait for it
@echo .
adb devices
@echo .
@echo if you do not see you device listed above hit ctrl+c and exit the script
@echo then check adb on your PC and device then try again.
@echo .
@echo reroute /data/local/tmp
adb wait-for-devices shell rm -r /data/local/tmp
adb shell ln -s /data/ /data/local/tmp
@echo .
@echo Now rebooting
@echo .
adb reboot
@echo .
@echo waiting for reboot to finish and making directory /data/su
adb wait-for-devices shell mkdir /data/su
@echo uploading su
adb push su /data/su/
@echo uploading busybox
adb push busybox /data/su/
@echo uploading boot_complete_hoot
adb push boot_complete_hook.txt /data/boot_complete_hook.sh
adb shell chmod 755 /data/boot_complete_hook.sh /data/su/*
@echo .
@echo Now rebooting again
@echo .
adb reboot
@echo .
@echo waiting for reboot to finish and getting shell
adb wait-for-devices shell

someone0 said:
Something is interesting, eventhough mine originally got automatically updated to 2.0.2, but after the factory reset, it went back to 2.0.0. But for some weird reason I can't get root.
Maybe this will help, the build number is 2.0.0.1031.lithium01.ovation.rldp.s68403 with the manufactured date 10/22/2012
please compare mine to your.
I also rewrote your code into a batch file. You can double check it I guess.
Click to expand...
Click to collapse
so, when you run this, after the final adb shell, what are the permissions on /system/xbin/su?
run su and you should get the root prompt.

I don't get root prompt, su never get copied to /system/xbin/su
here is the list of my finding.
Code:
/data/
-rwxr-xr-x shell shell 167 2012-11-10 05:52 boot_complete_hook.sh
/data/su
-rwxr-xr-x shell shell 586212 2012-11-10 06:07 busybox
-rwxr-xr-x shell shell 22364 2012-11-10 06:07 su
/data/local
lrwxrwxrwx shell shell 2012-11-10 06:20 tmp -> /data/
cat boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
everything is in place and correct, but no dice. either boot_complete_hook.sh didn't get executed or it did but never get launched with root permission.

someone0 said:
I don't get root prompt, su never get copied to /system/xbin/su
here is the list of my finding.
Code:
/data/
-rwxr-xr-x shell shell 167 2012-11-10 05:52 boot_complete_hook.sh
/data/su
-rwxr-xr-x shell shell 586212 2012-11-10 06:07 busybox
-rwxr-xr-x shell shell 22364 2012-11-10 06:07 su
/data/local
lrwxrwxrwx shell shell 2012-11-10 06:20 tmp -> /data/
cat boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
everything is in place and correct, but no dice.
Click to expand...
Click to collapse
well, there should be more stuff in the shell file, you miss the final chown line: chmod 06755 /system/xbin/su

It did, I just didn't copy and paste the output correctly. But regardless, since the foulder /system/xbin don't have the su file, this mean as I suspected earlier, either it wasn't executed or lauched w/ root permission.

someone0 said:
It did, I just didn't copy and paste the output correctly. But regardless, since the foulder /system/xbin don't have the su file, this mean as I suspected earlier, either it wasn't executed or lauched w/ root permission.
Click to expand...
Click to collapse
check if your /system/bin/clrbootcount.sh calls /data/boot_complete_hook.sh

verygreen said:
check if your /system/bin/clrbootcount.sh calls /data/boot_complete_hook.sh
Click to expand...
Click to collapse
This is interesting, it look as if it won't launch the /data/boot_complete_hook.sh
Code:
cat /data/boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
chmod 06755 /system/xbin/su
[B][email protected]:/data $ /data/boot_complete_hook.sh
/data/boot_complete_hook.sh
/system/bin/sh: /data/boot_complete_hook.sh: No such file or directory
1|[email protected]:/data $
[/B]
Yub it does
Code:
cat clrbootcount.sh
#!/system/bin/sh
################################################################################
##
#
# File clrbootcount.sh
# Description Clear the bootcount variable to 0 on successful boot
#
##
# Run potential hook first.
[B]/data/boot_complete_hook.sh[/B]
# Zero the boot count
cat /system/etc/zerobootcnt > /bootdata/BootCnt

My Device IS IN The Factory Mode And I Cant Exit From It

hello guyz i am having a big problem that is my device in in factory mode and there isnt power menu and there isnot a lock screen i tried a lot of solutions but the big problem that my efs folder is empty and i havent any backup cause my device was bootlop on samsung screen so i flashed a ics rom via odin and all the backups i have it to jb i tried to restore a one and its the same please help me I tried To Flash A New frimware and the same

Search via Google >>> Note 10.1 factory mode xda

bilal.23 said:
hello guyz i am having a big problem that is my device in in factory mode and there isnt power menu and there isnot a lock screen i tried a lot of solutions but the big problem that my efs folder is empty and i havent any backup cause my device was bootlop on samsung screen so i flashed a ics rom via odin and all the backups i have it to jb i tried to restore a one and its the same please help me I tried To Flash A New frimware and the same
Click to expand...
Click to collapse
If you don`t have an efs backup, then unfortunately there is nothing you can do except sending it to a service center, happened to me almost 6 months ago, tried all options , nothing was successful, had to send it for repair.:crying:

bilal.23 said:
hello guyz i am having a big problem that is my device in in factory mode and there isnt power menu and there isnot a lock screen i tried a lot of solutions but the big problem that my efs folder is empty and i havent any backup cause my device was bootlop on samsung screen so i flashed a ics rom via odin and all the backups i have it to jb i tried to restore a one and its the same please help me I tried To Flash A New frimware and the same
Click to expand...
Click to collapse
Here is the exact solution for this problem which i have recently had!
You have to root your phone and install Terminal Emulator from Google Play.
Open terminal emulator and type as ;
su
rm /efs/FactoryApp/keystr
rm /efs/FactoryApp/factorymode
echo -n ON >> /efs/FactoryApp/keystr
echo -n ON >> /efs/FactoryApp/factorymode
chown 1000.1000 /efs/FactoryApp/keystr
chown 1000.1000 /efs/FactoryApp/factorymode
chmod 0744 /efs/FactoryApp/keystr
chmod 0744 /efs/FactoryApp/factorymode
reboot
You now should not see the that message anymore. Its because of an EFS corruption.
Hope it helps!!!

Boot starting TWRP instead of System

I recently chose, through the internal options of the cell phone, to restore the factory mode. After performing the procedure, the cell phone restarted directly to the TWRP screen. It turns out that now it has a default boot for TWRP and not for the system. I can still access my system, just as it was before, if I used the Factory Mode option in Bootloader. But in Factory Mode the cell phone has some limitations, such as not working the cellular network.
To simplify:
Reboot -> TWRP
Bootloader -> Start System -> TWRP
Bootloader -> Factory Mode -> System in Factory Mode
Is there any way to restore the boot to start the system instead of starting TWRP? Is this a possible solution?
I'm using a custom ROM Ressurection Remix v5.8.5 - Android 7.1 for XT1225, if it is necessary to change some internal configuration by Factory Mode.
I tried the solution below, which tries to fool the system and quit Factory Mode, but FactoryApp does not exist in the list of system applications.
Code:
rm /efs/FactoryApp/Keystr
rm /efs/FactoryApp/factorymode
echo –n ON >>/ efs/ FactoryApp/keystr
echo –n ON >> /efs /FactoryApp/factorymode
chown 1000.1000 /efs/ FactoryApp/keystr
chown 1000.1000 /efs/FactoryApp/factorymode
chmod 0744 /efs / FactoryApp /keystr
chmod 0744 /efs/ FactoryApp /factorymode
reboot

You need to install the latest modded TWRP from @bhb27.
https://androidfilehost.com/?w=files&flid=39562
Install, reboot twice, solved.
Other people have had that problem over the past year or so, and it's always because they are using older TWRP or "official" TWRP and not the latest @bhb27 modded TWRP.
Sent via open market LG US998 V30/V30+