Database Info

Jailbreaking G1

breaking..ok, old news: RC30 (jailbreak fix)
http://www.tgdaily.com/content/view/40063/140

Curious about this. Im not in the know enough to do anything with root, but for all of you that have access, if others update, will they be able to use anything that you develop or create with access to root? hopefully....

I 'm wondering how can I prevent this. I'm in about the same boat as you honda. Root is a stranger to me... But, I'm sure it would suck if I get stuck out side of the loop :/

sonikamd said:
I 'm wondering how can I prevent this. I'm in about the same boat as you honda. Root is a stranger to me... But, I'm sure it would suck if I get stuck out side of the loop :/
Click to expand...
Click to collapse
If you look there is another thread where someone else posts what to do... although he hasn't got the files on the forum yet he is having some issues uploading them.

sonikamd said:
I 'm wondering how can I prevent this. I'm in about the same boat as you honda. Root is a stranger to me... But, I'm sure it would suck if I get stuck out side of the loop :/
Click to expand...
Click to collapse
JUST DON'T UPDATE TO RC30. It's that simple.
If you don't understand how to get root, just wait till someone (I would but haven't had time) makes a very detailed yet simple method.

Ah, I'm still running RC19 and have yet to experience Google's update process.
I thought the update was mandatory and done without user input, just a "congratulations, you phone is now a little slower!"
So we can just deny the update with the stock sw?

sonikamd said:
So we can just deny the update with the stock sw?
Click to expand...
Click to collapse
When you get the OTA update, it pops up a message window asking if you want to install. You say either say yes, or "not right now". I think it will keep bugging you to install, and possibly go ahead and automatically install it if you say "not right now" enough times. (I'm not positive about that.. I just remember seeing something like that when I was looking through the source for the updater app).

I think it works like Windows updates, it gives you option to update now or later and if neither is hit in a certain time it will install it automatically. I am going to test this when my update comes. I will hit Update later and see what it does. but i have read others comments saying they never seen the update now or later window and got the new version anyhow.

I'm on the train right now so someone else (or me) can post detailed directions. But if you get root and rename/remove /etc/security/otakeys.zip they (probably) can't update you automatically.
While that file is in place they might be able to upgrade without prompting (anyone want to search the code for info?)
UPDATE: They -can- forcibly update you: http://forum.xda-developers.com/showthread.php?goto=newpost&t=443328

google should wonder ppl do thing themselves...wen they have to come up with 3 update in less than a month....there always worried about security and not functionality..lol...i mean cmon i had to buy a new sdcard jus to get RC 29...cause it sure wasnt commin to me via OTA....i wonder wat i have to do to get RC 30..

SmartBrother90 said:
google should wonder ppl do thing themselves...wen they have to come up with 3 update in less than a month....there always worried about security and not functionality..lol...i mean cmon i had to buy a new sdcard jus to get RC 29...cause it sure wasnt commin to me via OTA....i wonder wat i have to do to get RC 30..
Click to expand...
Click to collapse
Correct spelling and punctuation may be a good place to start

sonikamd said:
Ah, I'm still running RC19 and have yet to experience Google's update process.
I thought the update was mandatory and done without user input, just a "congratulations, you phone is now a little slower!"
So we can just deny the update with the stock sw?
Click to expand...
Click to collapse
Well, I accepted RC29 and I've noticed the phone is faster and has better battery life.
I've also been very conservative with usage because I'm waiting to install and run apps from the SD card.

jailbreaking the t-mobile RC30 update
From what I have read so far it is not possible to re do the images on the G1 because of the RC30 patch from T-Mobile. Mainly because you do not have root, and the second because without root you can't remount the /system partition as RO.
adb allows you to mount the /system partition as RW. Would this not do the trick.
Code:
./adb shell
#mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/mtdblock3 /system yaffs2 ro 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/mmcblk0p1 /sdcard vfat ro,dirsync,nosuid,nodev,noexec,uid=1000,gid=1000,fmask=0711,dmask=0700,codepage=cp437,iocharset=iso8859-1,utf8 0 0
This was the out put that I got. Now to run the remount from adb.
Code:
adb remount
-
remount succeeded
now to make sure that this really worked.
Code:
./adb shell
-
# mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/mtdblock3 /system yaffs2 rw 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/mmcblk0p1 /sdcard vfat ro,dirsync,nosuid,nodev,noexec,uid=1000,gid=1000,fmask=0711,dmask=0700,codepage=cp437,iocharset=iso8859-1,utf8 0 0
as you can see the /system directory is not in rw mode and not ro mode.
To test to see if this is the case.
Code:
vi test.push (:wq)
adb push test.push /system
adb shell
# cd /system
# ls
test.push
lib
media
framework
fonts
etc
build.prop
bin
usr
sounds
recovery.img
app
lost+found
As we can see this did seem to work. I do not have a T-Mobile RC30. I have mine jailbroken already. with the steps that JesusFreke laid out.
I was wondering if it would be possible to do the same steps but with using adb to mount the fs in rw, and then using adb push to push the recovery.img to the device into the /system dir.
doing another push of the test.push file seems to take.
Code:
adb push test.push /system
vi test.push (i incerted the leter i)
adb push test.push /system
0 KB/s (2 bytes in 0.048s)
adb shell
# cat /system/test.push
i
#
So this might be the break that people are looking for that have the T-Mobile RC30. JesusFreke I know that you said that you have one with an RC30 from T-Mobile. Would you be willing to try this at the risk of bricking the phone? I know that is a $400 question, or anyone else for that matter.
If you do try it, please let me know the results. I have a friend, whos wife has the RC30 from T-Mobile. He is not willing to risk his wife's wrath.

It works on emulator.exe but will the live RC30 adb server accept remount? I notice that there are no references to remount in the official documentation. Alas I don't have any official RC30 G1 to test with.

Id bewilling to trythis right now. I have a Modded RC30 that I will update to the official RC30 that I am sending back anyways for defects. Anyone wanna tell me how to flash mine back to Official RC30 and Ill get to trying.

mouseclone said:
From what I have read so far it is not possible to re do the images on the G1 because of the RC30 patch from T-Mobile. Mainly because you do not have root, and the second because without root you can't remount the /system partition as RO.
adb allows you to mount the /system partition as RW. Would this not do the trick.
Code:
./adb shell
#mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/mtdblock3 /system yaffs2 ro 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/mmcblk0p1 /sdcard vfat ro,dirsync,nosuid,nodev,noexec,uid=1000,gid=1000,fmask=0711,dmask=0700,codepage=cp437,iocharset=iso8859-1,utf8 0 0
This was the out put that I got. Now to run the remount from adb.
Code:
adb remount
-
remount succeeded
now to make sure that this really worked.
Code:
./adb shell
-
# mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/mtdblock3 /system yaffs2 rw 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/mmcblk0p1 /sdcard vfat ro,dirsync,nosuid,nodev,noexec,uid=1000,gid=1000,fmask=0711,dmask=0700,codepage=cp437,iocharset=iso8859-1,utf8 0 0
as you can see the /system directory is not in rw mode and not ro mode.
To test to see if this is the case.
Code:
vi test.push (:wq)
adb push test.push /system
adb shell
# cd /system
# ls
test.push
lib
media
framework
fonts
etc
build.prop
bin
usr
sounds
recovery.img
app
lost+found
As we can see this did seem to work. I do not have a T-Mobile RC30. I have mine jailbroken already. with the steps that JesusFreke laid out.
I was wondering if it would be possible to do the same steps but with using adb to mount the fs in rw, and then using adb push to push the recovery.img to the device into the /system dir.
doing another push of the test.push file seems to take.
Code:
adb push test.push /system
vi test.push (i incerted the leter i)
adb push test.push /system
0 KB/s (2 bytes in 0.048s)
adb shell
# cat /system/test.push
i
#
So this might be the break that people are looking for that have the T-Mobile RC30. JesusFreke I know that you said that you have one with an RC30 from T-Mobile. Would you be willing to try this at the risk of bricking the phone? I know that is a $400 question, or anyone else for that matter.
If you do try it, please let me know the results. I have a friend, whos wife has the RC30 from T-Mobile. He is not willing to risk his wife's wrath.
Click to expand...
Click to collapse
The RC30 you have from JesusFreke gives the adb daemon root permissions. What you listed will not work on a Google RC30.

Koush said:
The RC30 you have from JesusFreke gives the adb daemon root permissions. What you listed will not work on a Google RC30.
Click to expand...
Click to collapse
Meaning that as soon as you type in adb shell and hit enter it will not even start the daemon?

Get official RC30 zip (here), use SignApk.jar from AndroidMod.zip (here) on it and place it in root of sdcard as update.zip. Reboot into recovery and Alt+S.

ballaholyk84 said:
Meaning that as soon as you type in adb shell and hit enter it will not even start the daemon?
Click to expand...
Click to collapse
Most likely it just gives the shell at $ instead of #.
Edit: gah, dyslexic.

Koush said:
The RC30 you have from JesusFreke gives the adb daemon root permissions. What you listed will not work on a Google RC30.
Click to expand...
Click to collapse
I was thinking that was just for the adb shell command. The adb remount is something that is in the helpfile from the SDK. Just typing in adb will give you the list of commands to use.
If not going though the shell how ever, did they disable all of adb's root privs? If you have one and try the remount and get a success, the adb still has root privies, just not on with the adb shell command.
Really this is just a thought. I wish that I really had a device to test it on.

/efs not mounted - need help from Linux experts and others rooted i580x users!!!

After a sleepy ODIN flash, using SPICA ops with G3 firmware => STUPID??? NO, not done yet , next ODIN flash segment, accidentally stick clear phone EFS via Debug options (DOUBLE CRAZY!!!) NOW i lost the precious IMEI and /efs partitions corrupted as well.
i've got the fixed nv_data.bin and both stl4.img and bml4.img from [email protected] (attached). Thanks for his kindness and supportive to the community!
But even with those i still can't fix the issue!!!! /efs did not mounted via mount command...
as in a GOOD G3, mount command result will be as below:
Code:
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/stl6 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0
/dev/block/stl7 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0
/dev/block/stl8 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0
[B]/dev/block/stl4 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0[/B]
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,f mask=0702,dmask=0602,allow_utime=0020,codepage=cp4 37,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
in my case the bold line just missing... so this is must be the problem.
I tried to do the same as SPICA's method as below:
Code:
$su
#dd if=/sdcard/bml4.img of=/dev/block/bml4
#reboot
It's OK then but...
Code:
$su
#dd if=/sdcard/stl4.img of=/dev/block/stl4
/dev/block/stl4: cannot open for write: Invalid agrument
With this error my /efs cannot be mount... and still missing from the mount command. I'm just a linux noob so pls help me out. How can i restore the stl4 partition properly???
My girlfriend now really mad at me due to she don't have her beloved phone this christmas already. OMG!!!!!
and to all rooted i580x user Pls kindly help compare your "good" /efs folder... maybe mine missing something???? due to one time Erase Phone EFS using Odin Debug Options.
Mine /efs now as below:
Code:
/efs/nv_data.bin
/efs/imei/.nvmac.info
/efs/.files/.dm33 (empty folder)
/efs/.files/.dx1 (empty folder)
/efs/.files/.mp301 (empty folder)
And if you can do adb shell, it'll be very kind of you by sharing your good backup stl4 and bml4 - for research purpose (those partitions did not content any of yours personal data - so PLS HELP!!!). Pls do the backup partions as below and share your img here if possible.
Code:
$su
#cat /dev/block/stl4 > /sdcard/efs_dev-block-stl4.img
#cat /dev/block/bml4 > /sdcard/efs_dev-block-bml4.img
TIA and Best Regards
P/S: when do the ls /dev/block/stl* the stl4 is there but cannot restore using the backup img. it's weird...
Code:
#ls /dev/block/stl*
/dev/block/stl1
/dev/block/stl10
/dev/block/stl2
/dev/block/stl3
/dev/block/stl4
/dev/block/stl5
/dev/block/stl6
/dev/block/stl7
/dev/block/stl8
/dev/block/stl9
same for bml4...

I suggest you remove the images.zip
This contains your IMEI, so anyone can clone it.

Szaby59 said:
I suggest you remove the images.zip
This contains your IMEI, so anyone can clone it.
Click to expand...
Click to collapse
This zip only bml4.img and stl4.img, the fixed nv_data.bin still inside the phone @ SAMSUNG SC . Now they still can not redo IMEI yet so i must find someway else.

kenblat said:
This zip only bml4.img and stl4.img, the fixed nv_data.bin still inside the phone @ SAMSUNG SC . Now they still can not redo IMEI yet so i must find someway else.
Click to expand...
Click to collapse
fixed ur phone yet? noob idea: can u try flashing but this time with the right ops?

were you able solve the problem? I am facing exactly same problem.

Rooting the LG Optimus 2x (P999) Wind Mobile

kk i am very desperate for help
i have been seeking help regarding rooting my optimus 2x for 2 months
heres the story:
i rooted my phone using superoneclick and everything worked out fine
then i flashed MIUI on my phone and it worked fine except the GPS was very slow
then i had flashed a recovery rom to go back to the stock Froyo
then i flashed Cyanogenmod 7.1 and it worked fine
i saw that MIUI had some new updates and that it was much better than Cyanogenmod in my opinion
So i went to ROM Manager and tried to reboot my phone into recovery but nothing happened at all
I've tried every way to boot into recovery but it goes to the stock recovery
I downloaded a root checker and it tells me my device is not rooted
now when i try to use superoneclick i get stuck
can any1 please help me
i've been posting in the superoneclick forum and no1 has been able to help me for 2 months

lol, use NVflash one click and flash CWM, you dont even need root, flash it then flash another rom.
if that doesnt work: factory reset, unroot, then re-root

Help me too!
I know this is going to sound incredibly dumb (and thats because i barley know anything about all of this stuff)
I've been trying to root my LG G2x for a couple days now, but it just wont work.
Ive followed all the steps to use superoneclick to root my device and the program works as far as i can tell. It finishes step 7 and gives me this message: "Killing ADB and restarting as root... enjoy!"
Unfortunately before i can even use my phone more messages start flowing out. I have absolutely no idea what any of it means, but the program and my phone both crash until i hard boot both so i would really appreciate any help!
This is the message i get: "$
$ export TEMPRANDOM=29169;export PS1=END:$TEMPRANDOM;/data/local/tmp/busybox mount -o rw,remount /system
mount: permission denied (are you root?)
END:29169export PS1=""
export TEMPRANDOM=92557;export PS1=END:$TEMPRANDOM;/data/local/tmp/busybox mount
rootfs on / type rootfs (ro,noatime)
tmpfs on /dev type tmpfs (rw,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
none on /acct type cgroup (rw,relatime,cpuacct)
tmpfs on /mnt/asec type tmpfs (rw,noatime,mode=755,gid=1000)
tmpfs on /mnt/obb type tmpfs (rw,noatime,mode=755,gid=1000)
none on /dev/cpuctl type cgroup (rw,relatime,cpu)
/dev/block/mmcblk0p1 on /system type ext3 (ro,noatime,data=ordered)
/dev/block/mmcblk0p7 on /data type ext3 (rw,relatime,data=ordered)
/dev/block/mmcblk0p2 on /cache type ext3 (rw,nosuid,nodev,noatime,data=ordered)
tmpfs on /mnt/extasec type tmpfs (rw,noatime,mode=755,gid=1000)
/dev/block/mmcblk0p6 on /nvdb type ext3 (rw,nosuid,nodev,relatime,data=ordered)
/dev/block/vold/179:8 on /mnt/sdcard type vfat (rw,dirsync,nosuid,nodev,noexec,noatime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/dev/block/vold/179:8 on /mnt/secure/asec type vfat (rw,dirsync,nosuid,nodev,noexec,noatime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
tmpfs on /mnt/sdcard/.android_secure type tmpfs (ro,relatime,size=0k,mode=000)
/dev/block/vold/179:17 on /mnt/sdcard/_ExternalSD type vfat (rw,dirsync,nosuid,nodev,noexec,noatime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/dev/block/vold/179:17 on /mnt/extsecure/extasec type vfat (rw,dirsync,nosuid,nodev,noexec,noatime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
tmpfs on /mnt/sdcard/_ExternalSD/.android_secure type tmpfs (ro,relatime,size=0k,mode=000)
END:92557export PS1=""
"

Yeap.. nvflash works. I tried the oneclick root. And got the same error as below... its a little complicated at first, because you have to do the steps onthe computer with the nvflash . After that i plugin the phone as thesteps and BOOM,no need to root, i am using a custom rom. Its fast my phone with two Dragon inside hell yeaaa....
Sent from my LG-P999 using XDA Premium App

chipis said:
Yeap.. nvflash works. I tried the oneclick root. And got the same error as below... its a little complicated at first, because you have to do the steps onthe computer with the nvflash . After that i plugin the phone as thesteps and BOOM,no need to root, i am using a custom rom. Its fast my phone with two Dragon inside hell yeaaa....
Sent from my LG-P999 using XDA Premium App
Click to expand...
Click to collapse
can u tell me exactly what u did? like step by step?

nydmt said:
can u tell me exactly what u did? like step by step?
Click to expand...
Click to collapse
Go to the root thread in my signature and then in that thread there is a link to the One Click Recovery Flasher using NVFlash. That thread is detailed, step by step and even has a link to a video. Not to be a smartass, but if you cannot follow that thread to install recovery on the phone then you should not be flashing roms on your phone. This is basic stuff you need to know and understand first or you are going to royally screw up your phone.

Cat Logs

Can Someone do this!!
Connect ur Tab & Start adb & Run following commands
adb shell
cat proc/partitions
cat proc/emmc
and Pm me the Output!

Sent
Sent from my GT-P5113 using Tapatalk 2

zapote21 said:
Sent
Click to expand...
Click to collapse
You beat me to it... My wife just got one of these - she's not interesting in rooting, etc., but I am (and may buy one) if the new model allows. Let me know if I can be of help.
Anyone know yet if the bootloader is unlocked/unlockable on this model?

LavaJoe said:
You beat me to it... My wife just got one of these - she's not interesting in rooting, etc., but I am (and may buy one) if the new model allows. Let me know if I can be of help.
Anyone know yet if the bootloader is unlocked/unlockable on this model?
Click to expand...
Click to collapse
Its Samsung. Odin is your friend...lol

One more
adb shell
adb mount

rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
/dev/block/mmcblk0p7 on /cache type ext4 (rw,nodev,noatime,nodiratime,barrier=1,data=ordered)

So is this good? Root or toot ?
Pp.
Delivered to you via microwave technology .

Stuck on screen with android and polyhedron spinning

Hi,
I tried flashing CM on my TF700 but failed. Now it's stuck on a screen with an android and a polyhedron spinning in its belly. I can access adb but not fastboot. "adb reboot bootloader" does nothing - it gets stuck there until I ^C it. Rebooting with the volume button just brings me to that screen again (I know how it works, I've done it in the past, but now it's broken). Do I have a very expensive paperweight?

Well, what did you do?
That screen is the stock recovery spinning it's wheels most likely. Did you flash a custom recovery? If so which one?
What bootloader are you running and what exactly did you do to get into this pickle?
You have adb in recovery?? Post a picture of your cmd window with 'adb devices'

I tried following this guide here:
https://forum.xda-developers.com/transformer-tf700/development/rom-cyanogenmod-12-0-t3006624
but I first accidentally tried flashing the zip from an older version of Clockwork Recovery that I had installed, and that gave errors. Then I realised what happened, flashed the newer recovery, and then tried flashing the zip. That was giving some errors about /cache but otherwise seemed to work. Then I rebooted and it was stuck in this state. Some other problem might be that I tried flashing without gapps - didn't want any gapps in my tablet, so I thought that flashing without those would have been fine.
Code:
> adb devices
List of devices attached
015d2d431f201e09 device
I even managed to get into adb shell:
Code:
~ # mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
tmpfs on /storage type tmpfs (rw,seclabel,relatime,mode=050,gid=1028)
tmpfs on /mnt/secure type tmpfs (rw,seclabel,relatime,mode=700)
tmpfs on /mnt/fuse type tmpfs (rw,seclabel,relatime,mode=775,gid=1000)
/dev/block/mmcblk0p2 on /cache type ext4 (rw,seclabel,nosuid,nodev,relatime,user_xattr,acl,barrier=1,data=ordered)
I can dd from /dev/zero into a file on / , but trying to dd anything from/to /dev/block/mmcblk0pX freezes until I reboot the tablet. I even tried to run "fdisk /dev/block/mmcblk0" but that also freezes. For /dev/block/mmcblk1 (my external microSD, I assume), fdisk works.

Ok, try this to kick the tablet back into the bootloader :
http://www.transformerforums.com/fo...my-transformer-tf700-boots-only-recovery.html
And then please give up on CWM recovery and CM as rom. They suck and are completely outdated.
Go for any of the Katkiss roms, latest version is Nougatella, and TWRP as recovery.
In between you may want to fastboot flash the stock blob just to get the tablet back to a known and working state, but that's up to you.

Thanks for your suggestion!
Bad news: it didn't work It rebooted to a state where the screen is off, "adb devices" and "fastboot devices" both detect nothing, but "lsusb" detects this:
Code:
Bus 001 Device 051: ID 0955:7030 NVidia Corp. Tegra 3 (recovery mode)
Any other ideas?
Also thanks for your suggestion regarding CWM/CM. As you can probably understand I've been out of touch for a few years (since I got my Fairphone, which comes Google-free), and now that I tried resurrecting the TF700, I went back to what I knew back then.

Sounds as if you killed it. Sorry.
You would have mentioned if you had generated your device specific nvflash blobs at some point to make it brick proof. If you didn't now is too late. RIP