[Q] Recovery: skip signature check - Other Tools & General Discussion

Hello,
I have actually a problem. I would like to modify the contenct of the recovery initrd in order to bypass signature check (similar as what is doing CWM or TWRP).
I can extract the whole system image, but i can't figure where are checked res/keys
I know i could create my own keys and sign update.zip in regard of them, but as i'm not able to see where it takes place, i'm surprized.
Perhaps it takes place in /system/bin/recovery script ?
Thank you for your help.

Related

Android app that roots your phone

Hi all I am putting together an android app that will making the rooting process much easier. This thread is discuss issues and suggestions with this app.
I have the app near done, the biggest problem is that I cannot format the sdcard as fat32. Is formatting to fat32 required. Why do we do this? What is the real need to do this?
I have not tested the app out yet, but so far this is how it has been put together. There is a main activity with textboxes that have the urls of the files needed to root (dreaimg.nbh, recovery.img, hardsplupdate.zip, JF_RC33update.zip) and there are buttons for each step in the process to download these necessary files and extract them if needed and put them on the sdcard and renaming them properly. You can change the urls to something else if needed.
so you click the first button it downloads the .nbh and puts it on the sdcard and then prompts the user to turn off, power+camera on, flash. when phone is on then reinstall this app and go to step 2 (because it would of been lost when flashed)
you click the second button it downloads recovery.img and hardsplupdate.zip. renames the files appropriately and puts them on the sd. it runs a script to do the recovery.img flash. It then prompts you to restart into recovery mode and gives the instructions on flashing the hardspl. and tells you to reopen this app when done
you click the third button it downloads the latest JF firmware (lets just say the RC33 flavor) puts it on the sdcard and renames it as update.zip. it prompts you to restart into recovery mode and do the flash.
Anybody see any possible problems with this logic? Also what do people think about maybe packing some of these files in the app instead of having them be downloaded?
Update: app is working http://allshadow.com/forum/viewtopic.php?f=9&t=5229
I am still looking for help to make it better.
I need devs to help make it nicer.
I am also looking for someone who's familiar with the update.zip package, to pack the radio, hardspl, and jf_rc33 all in one update file.
If anybody is interested in helping, PM me
I dont think its that big of a deal to format the card yourself, but why not make an app on the desktop that does some of the work for you, like formatting the card, then downloading and renaming the files needed to get started?
Packing the files into the app is going to make the app big. I like this whole idea though.
when you flash the .nbh it does a wipe on its own so one would need to re-download the app after that unless you can get it to stick somehow, i like the idea, is each button of the app just running a script? like to get the dreaimg.nbh have a script that runs:
"$wget [url to the .nbh file]
$echo 'please reboot your phone into SPL by holding the camera and power button'"
or did you have some other idea?
i like the idea but i am just not sure how easy this would be to code as i am just used to writing scripts that do everything for me.
or you could follow Kllian's advice and make a desktop program that does all this. i could easily write a script for linux that would do it, and a .bat file wouldn't be too hard either. you would just need to have adb and you could have the scipt/batch reboot the phone into recovery to do the flashing of each update.zip
pm me if you have an questions or would like me to write a script to do all this
tubaking182 said:
when you flash the .nbh it does a wipe on its own so one would need to re-download the app after that unless you can get it to stick somehow, i like the idea, is each button of the app just running a script?
Click to expand...
Click to collapse
tubaking brings up a good point.
I have an idea that possibly could resolve the "wiping" issue. What you do is, the initial app would be placed on the desktop (assume RC30). From here you'd downgrade the firmware to RC29.
The problem is though, the app you are scripting will be wiped. SO...
How about saving it on the SD temporarily.
THEN modifying the .nbh file to restore the <rooting app> to desktop (from SD)
Just throwing some stuff out there.
IF you need some help, hit me up.
if anyone knows how to convert a .sh bash script from linux to a .bat batch file for windows then i already have the script written, send me a PM to get it. or we could port it into java, but i don't know how to do that stuff. tomorrow i will upload my script onto 4shared and provide a link here as long as it works. keep in mind that i am on a linux machine and my script will not work in M$ windows. i don't know a damn thing about mac, so i have no idea if this will work or not for them.
my script is nearly completely automated, the only thing you need to do is hit ENTER a few dozen times, i will also write a completely automated one that sleeps rather than waits for you to hit enter, but it will take longer to run most likely since i will have to oversetimate the sleep time.
hopefully i can find a windows machine and learn what commands in the cmd are equal to the commands in my terminal
akapoor said:
tubaking brings up a good point.
I have an idea that possibly could resolve the "wiping" issue. What you do is, the initial app would be placed on the desktop (assume RC30). From here you'd downgrade the firmware to RC29.
The problem is though, the app you are scripting will be wiped. SO...
How about saving it on the SD temporarily.
THEN modifying the .nbh file to restore the <rooting app> to desktop (from SD)
Just throwing some stuff out there.
IF you need some help, hit me up.
Click to expand...
Click to collapse
modifying ,nbh files is no easy task, i tried it once and fortunately for many people GSLeon3 was able to help me fix my tilt. i think the .bat or .sh would be the easiest way to root your phone
Tubaking,
Send over the file you have. Ill work on converting it to a .bat, useable from windows.
Email : akapoor92_at_gmail.com
I should have it soon, but since its like 3:30am here, I'm off to bed. Haha
tubaking182 said:
modifying ,nbh files is no easy task, i tried it once and fortunately for many people GSLeon3 was able to help me fix my tilt. i think the .bat or .sh would be the easiest way to root your phone
Click to expand...
Click to collapse
Uh, you'd not only need to modify the nbh file, but you'd also need to sign it with the Google OTA keys - otherwise the phone will refuse to flash it.
If it were possible to create Google-signed nbh files we'd dispense with all this downgrading nonsense and just create an nbh of the latest JF firmware with root and directly flash that.
The issue is that until you've patched the recovery loader the phone won't flash anything that isn't signed by Google. The reason we can get around this is that there is a leaked signed file with the old firmware version, and that version happens to contain a vulnerability that you can use to get root access. Once you have root access you can reflash the recovery loader with a new one which accepts the test keys. At that point you can dispense with the hacks and begin directly flashing whatever you want.
In any case, rooting a phone is serious enough of a matter that we probably shouldn't be encouraging anybody who can download an app to do it. They should at least have some confidence in reading and following obscure instructions online, because of anything goes wrong later that is what they'll be doing...
Thanks for all your input. I have been trying to hold hand people through the root process and it is a real pain. Biggest issues are people not being able to unzip files correctly, rename files correctly, and the biggest thing is the recovery.img step and typing in the commands.
- .nbh cannot be patched because it is signed.
- yes my app will get wiped because of the .nbh flash. It does tell the user to reinstall this app once done with the .nbh step and then continue
- i prefer an android app, so people can do it without a computer and without having to install the sdk
- the app does not run a script to get the files. it uses some android sdk functions to download files. it does use the unzip linux command to unzip, not sure if this will work because of permissions, i may have to figure out how to do it from the sdk. the app does run a script to do the recovery.img step, during this step we should already have root so no issue there with permissions.
Biggest problem I see is Fat32 format I heard it is not absolutely necessary. Does anyone have any more information about why this needs to be done?
it IS necessary, you need the card formatted in order to do the NBH flash, after that you should be ok. most card come formatted in the box they came in so anyone that said they didn't need to format their card is lying because is was already formatted to fat 32
in the RC29 firmware is there a su command in /system/bin/ or are all commands run as root without having to call /system/bin/su ??
moussam said:
in the RC29 firmware is there a su command in /system/bin/ or are all commands run as root without having to call /system/bin/su ??
Click to expand...
Click to collapse
from what i've read, in the RC29 version andything you type on the home screen gets put through a root shell as well all on it's own
I have a feeling whoever makes this app is going to sell iot for a ridiculous price on the market
My script is written but requires the user to do certain things, later I hope to have it be completely automated after a certain point and it will be free. After I get it written in linux shell I will be converting it to use in windows. Expect my automated root to be available for download by the weekend.
I got the app pretty close to done. I hope to put something up tonight or tomorrow that you guys can test. I am not going to charge for this app, I want to give it for free so everybody can have root and a more rich experience.
The place were I am stuck right now is the unzipping of the DREAIMG.NBH file from its zip file after it is downloaded. I am using java.util.zip I am not sure if the problem is because the file is so big or if I am doing it wrong. does anyone have an android java unzip code snippet?
The app now downloads files for you and unzips them if needed. THere is an issue with the unzipping though, after around 25 MB of unzipping DREAIMG.NBH i get this error...
java.io.IOException at java.util.zip.InflaterInputStream.read(InflaterInputStream.java)
anybody have any suggestions? Is their not enough memory to unzip the files or something?
For now I am not going to let the .nbh file be zipped up. THe app instead will have to download the full uncompressed .nbh file.
So it is ready to be tested, if you want to try it out PM me, I do not want to just post it and have everybody use it until it has been tested more.
Good news the app works on downloading the .nbh file and then flashing you to RC29. It then successfully downloads the recovery.img and hardspl update.zip
I had someone testing it and when they ran the recovery script the mount command gave them mount: operation not permitted. Is this correct? I know without root it is supposed to give you mount: permission denied.
If this is correct the app is working, and I just need someone else to confirm.
Mike
Does anybody else want to help with the coding of this project? If so create an open-source repository and I will add the current source in there.

Need a little help with clockworks mod

HI ALL,
I have a few questions to ask ..
Most of these might have been asked all ready ... but it's morning and
still need my morning java ..
When installing the clockworks mod, does the update.zip and recovery dir
get add to the /sdcard dir?
An if so, does that mean .. when I press the power button and volume +
key. That will load the clockworks mod zip file?
Basically I'm looking for instructions step by step ..
I got the clockworks mod file and the tnt lite file. I basically want to
install the clockworks mod and then add tnt lite ..
That is how I take it from all the discussions, even though each time I get close to trying this out, another panic thread gets started from somebody that ran into issues.
Put the update.zip file under /sdcard, and the recovery dir/command file there as well, then pressing those buttons together seems to put the OS into a recovery mode where it is expecting to run the update.zip and recovery/command files, which then are able to modify the filesystem under root.
What complicates matters when doing roms, it appears, is the user data, and partitions that can get corrupted, and you have to free up cache/user data, and maybe even repartition sections of the filesystem to correct the issues. That is where I get a bit confused.
Somebody way more knowledgeable on this will step in shortly though and provide real help.
I fell stupid today ...
Most likely it's me ... I've tried to save files to the root of the directory
and it doesn't let me ... Am I missing something ? basically I'm trying to
copy clockwork mod to the " / " so I can install the clockwork mod ...
Any info would be helpful ....

[Q] how to push files onto phone with a zip?

Ok, let's pretend I know virtually nothing about the inner workings of android phones... Can someone explain in noob terms how I would make a zip file containing some system files that I could "push" onto my rooted phone through the rom-manager? I tried to make a simple zip with some files in it but it would not allow me to install it for some reason.
I've heard of things like this ADB or whatever it's called, or maybe I have to get the zip "signed"? I dunno. Please help a poor noob out. I tried searching for it but I don't even know the proper terms yet
Lets suppose you've followed some guide how-to make an installable zip.If You have installed Rom Manager then you should be able to install cwm just by 1 click (1st option in RM if I remeber) When its installed you simply reboot your phone into recovery(this depends on actuall phone) and there simply set something like "install signed zips only"
edit : im not sure if i get your problem well maybe you need just read FAQs about your phone in its section here.

[Q]Repacking boot.img (need help)

I was trying to learn about unpacking boot.img and tried to remove my initlogo.rle inside it since I do have a oemlogo.mbn (have 2 splash screens when booting). So I tried this tutorial on how to get that done in windows as I don't have a working Ubuntu as of now (although I still don't know how to do this the right way using Ubuntu). So I managed to unpack without errors, deleted initlogo.rle and repacked it without any errors. Then put the new boot.img inside an update.zip I made and flashed it into my phone. It was flashed successful. When I rebooted the system (from recovery) it was stucked at the oemlogo. Did I miss anything. My guess is that I didn't find out what my kernel base address is (don't know how to get it) and the script from the cygwin used a default address instead of the right one. So I tried to get my base address, unfortunately, I can't figure out how to do it. Can anyone help me out?

[Q] Extracting LG E400 stock files

Hello everyone,
I'm new to low-level Android hacking, so I guess I need some help.
What I am trying to do is getting the stock files from an LG E400, and modify 1-2 things, repack, flash, and see if it works for me.
My first step:
1) Rooting the LG E400
2) Flash CWM Recovery
3) Create a backup
4) Get boot.img from the backup.
So I have a boot.img (which I think is stock, because rooting does not modify the contents of the boot image as far as I know.)
After that, I followed this tutorial to extract the kernel and the ramdisk.
I used a hex editor for this. I saved the kernel and the ramdisk as separate files, and I tried to gunzip the ramdisk. That seemed to work. However, after that, when I try to run cpio on the file, I get a lot of "Malformed number" errors, and only two empty folders are extracted.
And that is where I'm stuck at.
Are the LG phone boot.img-s encrypted somehow? Am I doing something wrong?
If anyone can help me, I would be really grateful.
Thanks in advance

Categories

Resources