Related
NabiRootXD v2
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This is a tool for rooting, installing Gapps(Play Store, etc), and adding custom TWRP recovery on Nabi XD. It's written as a windows command line batch file, and is based off NabiLab I made for Nabi2.
It was an adventure to say the least. I include some of the hurdles for those that want to duplicate the root process or just to place my thoughts "on paper" because of the 100's of posts I read from those that posted detailed information and allowed me to gain useful insight in how I could adapt things for the XD, and explain in one swoop to the many PM's I have received about "when will we see root on the XD" why it took so freaking long. Those that just want the program can continue to the Overview section.
What started as an interesting avenue was TWRP using the Nabi2 kernel was booting the NabiXD to TWRP without video. I thought it possible to dd the recovery, or boot kernel. Unfortunately it was unable to recognize internal storage as a block device and that ended that. Like a few devices on Android 4.1.1 and above the standard once click program using Bin4ry's ADB restore exploit doesn't work. It doesn't work for a couple of reasons, when restoring fakebackup.ab in locks up writing the first file, and even if it did work placing ro.kernel.qemu=1 in local.prop doesn't work because Jelly Bean doesn't parse any property files to set the ownership of adb daemon. Searching the file system I found su2 in the xbin directory. This was promising as it is the su program but renamed, also unfortunate was its permissions had no setuid bit set and while it was executable it would not change uid to 0. I then foolishly went down the path of nvflash(forced recovery). I attempted a few different avenues here to try and possibly get the SBK to unlock nvflash, that proved uneventful, especially without root access. I tried extracting what "could" be the key from the Nabi2 it hope it was reused. That lead no where, it would be awesome to have access to it for many other reasons but it turned out to be an exercise in learning but ultimately a waste of time. Then on to other Android exploits... Tried Samba, debugfs, and vfat exploit. All of those are either patched or I'm not skilled enough. I finally returned to looking at the ADB restore exploit.
The "tabletS" exploitation showed promise as it takes the avenue of installing /dev/sh vs ro.kernel. A side effect of the failed ADB restore bug was leaving a directory with full permissions. Bads3ctor had an interesting fakebackup.ab that was more reliable at making a directory or file that you simlinked have full permissions. Now you can step through the tabletS script more effectively where you couldn't before by manually setting permissions for files/directories you need by doing the restore for each file and directory you need. The script installs VPNfaker and backs up the /data/app directory, then creates a new app directory. This however will cause the NabiXD to rerun the initial kidsmode setup and breaks everything. You can dance around that by not rebooting, and VPN faker will still give you a Term app with system uid. From there you can't symlink the sysfs links properly to data/property but that can be worked around by moving and then removing files. Finally you can makedev /dev/sh and run su from /data/local/tmp. The end result is that the exploits and bugs found by others are adequate when strung together in the right order on the NabiXD just not the one click solutions provided on the forums, they needed some modifications and done by hand to figure out for the NabiXD
Here is a nice publication I found in my searches that is more layman terms for older root methods. http://www.sourceconference.com/publications/bos12pubs/android-modding-source.pdf
Overview
Video Overview of NabiRootXD - a video tutorial of the use of NabiRootXD.
-Root the Nabi XD
-Install Gapps(Play Store, etc)
-Make a stock backup of unrooted device
-Install stock, or TWRP recovery
-NabiLab patching system to install updates to this program
Version 2
-Fixed scripting error causing early exit
-Added 7z for patching system
Download
Read the installation section below to determine which version you want.
File names:
NabiRootXD.zip 96MB (Version 2)
Download
Download Mirror
Installation
NEW INSTALLS
1) Download NabiRootXD
NabiRootXD.zip 96MB
2) Extract the zip files to a location of your choosing. Run the NabiRootXD.bat file.
Prerequisites
1) Script is for Windows
2) ADB enabled in Android. Enter Mommy/Daddy mode. Open settings->developer options->put a check mark in USB debugging.
3) ADB and Fastboot driver. Most popular are the PDAnet drivers. You can get them here: PDAnet drivers
Usage
Obviously using this script on your NabiXD voids the warranty and I take no responsibility for the damage you cause.
MENU 1 - Root, Gapps, Recovery
Menu Option 1 - Install Root, Recovery and Gapps
This option is best used if you have a brand new Nabi. At this point you should have met the prerequisites of enabling ADB in Android. Follow directions, most sticking points are pressing the volume + and then pressing the volume - button twice and making sure recovery kernel is the one highlighted. After its complete you should have a rooted Nabi, with Gapps and a backup of your unmodified Nabi in the folder TWRP/BACKUPS/YOURSERIAL/stockunrooted on your device. Not a bad idea to copy this off the Nabi to your computer if you need to free space or have it in a second location.
Menu Option 2 - Install Root and Recovery
Same as above but doesn't install Gapps. Some people have trouble with option 1 taking the Gapps install, I personally have never experienced it but the option is this one, or I guess if you are an elite hacker that just wants root.
Menu Option 3 - Install Gapps
Same Gapps installed in the Option 1. Useful for re-installing Gapps. This is Jelly Bean Gapps dated 10/11/2012 without Google Search. This makes NO backup of you Nabi. You will have to already have installed TWRP.
Menu Option 4 - Install Root
Installs root. Nothing fancy here, and likely unneeded but here for completeness if you find yourself in a strange situation. One that comes to mind is that you have a stock backup which you restored and don't want to do another backup so you would just run this and the gapps install. It makes NO backup. You will have to already have installed TWRP.
MENU 2 - Install Recoveries
Menu Option 1 - Install TWRP 2.3.3.0 for Nabi Version 1.2.3
Installs TWRP 2.4.4.0. This is the latest at this time. It has a screen timeout, if the screen goes black touch the screen to wake the screen, it's not locked up.
Menu Option 2 - Install Stock Recovery
Installs stock recovery. This is useful for taking an OTA, or completely returning Nabi to stock.
Notes: TWRP installs are based off my work in this thread if you want to read more.
MENU 3 - Patch NabiLab
Menu Option 1 - Install Patch
For any updates to NabiRootXD this is where you can automatically load them. Basically you will download NabiPatchXD.zip and place the entire zip in the patch folder. No unzipping just the single file. Then run this option.
Credits - If you see these guys buy them a beer.
jzmtaylor - Original Nabi2 script that this is based off of.
Bin4ry, Bads3ctor, HEXcube, drjbliss - all the bugs/exploits needed to accomplish root
Dees_Troy - TWRP build tutorial
Eric Karz - TWRP Theming and rooting assistance
TeamWin - They are the guys that make TWRP possible
Weeee more Easter goodies haha.
thanks aicjofs
Sir can i use this tool for installing Gapps for unrooted Galaxy Tab 7.0+ (wifi)? bcoz i updated my tablet for Honeycomb to Ice creamsandwich (China Firmware), everything is fine except that i cant open google playstore...
first of huge thank-you.. who do i send a bear donation to as a thank-you
there is a possible bug or its just me when pressing the menu button it will pull up a search, or say Google with a white back ground only way to get out isto press home if a menu appears then pressing back produces the same results
srgsng25 said:
first of huge thank-you.. who do i send a bear donation to as a thank-you
there is a possible bug or its just me when pressing the menu button it will pull up a search, or say Google with a white back ground only way to get out isto press home if a menu appears then pressing back produces the same results
Click to expand...
Click to collapse
The gapps removes the problem in system/app/quicksearchbox.apk you can rename it toquicksearchbox.bak
only other way I can think of is some how playstore added it to data/app
rename com.google.android.googlequicksearchbox.apk to com.google.android.googlequicksearchbox.bak
hth
ps: thank the op he spent hours and hours to make this happen = sacrificed his free time
Thanks for the feedback.
Perhaps we should have used the 7/26/2012 gapps? http://goo.im/gapps/gapps-jb-20120726-signed.zip 10/11/2012 is suppose to be 4.1.1 backward compatible, but perhaps there are some bugs with it on XD. Flash over the top of the current one. It will leave behind /system/app/thinkfree.apk, /system/app/microbes.apk and /system/lib/libmicrobes_jni.so, which you could remove manually. Wipe caches.
How about GPS stuff? Is that working?
i was looking at gapps-jb-20120810-JRO03C-Formula84-Custom
it has some things that sort of work like maps/local/ latitude /
I don't think gps is working
Even in the productions test it fails .
could it be a permissions problem ? I have not tried 20120726 .
Eric Karz said:
i was looking at gapps-jb-20120810-JRO03C-Formula84-Custom
it has some things that sort of work like maps/local/ latitude /
I don't think gps is working
Even in the productions test it fails .
could it be a permissions problem ? I have not tried 20120726 .
Click to expand...
Click to collapse
Do we know that the GPS works at all?
aicjofs said:
Do we know that the GPS works at all?
Click to expand...
Click to collapse
with gapps installed it doesn't seem to work .
maybe we are going to need a edited gapps ?
I'm just going to remove Google Search for now. That is highly annoying, I was messing around with ways to fix it, and got it to open in apps when you press the settings button, I was previously only getting it when pressing back button.. I updated the downloads. Until we figure out the fix, it's just too troublesome.
cool that did the trick renaming the file i do have a really stupid question is there a hiden proxy setting that makes the tablet able to bypass our DNS security filters with open dns just curious
srgsng25 said:
cool that did the trick renaming the file i do have a really stupid question is there a hiden proxy setting that makes the tablet able to bypass our DNS security filters with open dns just curious
Click to expand...
Click to collapse
I don't know if there is a hidden proxy. I'm not sure of your question. You could try going to settings-wifi. Long press the name of the network and a pop up will come up. Modify network, show advanced options. There is the proxy and DNS, for DNS you have to be static. I think there is 4.4.4.4 in there by default, plus what your router gives out.
If you are talking about something more underground I think you could use a getprop in adb shell or term.apk. I know I have seen stuff in there for DNS, something like dhcp.wlan0.dns there is stuff in there about "change" too. Should be able to set if you "su" and do a setprop. That would only be good until reboot, but could help you trouble shoot. I think it's set here /system/etc/dhcpcd/dhcpcd-hooks/20-dns.conf, maybe not in Jellybean. Anyway those are places to look if it's more then in settings that you are looking for.
ok it seems that this might be a work around to the quick search problem
edit the buildprop and change
ro.sf.lcd_density=160
to
ro.sf.lcd_density=145
I tried 149,150,59 and 120
120 does seem to fix it also but the screen makes every thing look smaller and some may not like that .(I do)
also I had to install BusyBox in order to get a few things to work including
build prop Editor by Nathan Campos (this tool seems to be a good test app to see if you have proper permissions)
note that the swipe screen will be a bit smaller under 160
maybe some one can use this info to edit quick search box we wouldn't have to change anything?
i am trying to get this tablet to use my network opendns settings and web filters
Can someone direct me to where I can get a Vista MTP driver for the Navi XD? I installed PdaNet as instructed but the tool wont connect, and I have a yellow exclamation mark by MTP Device. Can't seem to find anything else online.
EDIT: After rebooting a few times, then disabling my firewall, the tool connected. Thanks for the awesome tool.
Looks like an OTA was released for the Nabi XD today that bumbs the Nabi XD up to version 1.3.5. I tried doing the stock recovery option but the NabiRootXD app just closes out after selecting it. I looked into the NabiRootXD.bat file and I noticed on line 483 that it says to "GOTO Install_4" which doesn't seem to exist. I believe it should actually say "GOTO Install_2".
After making this change I was able to restore to the stock recovery to perform the OTA.
Now once I tried to install the OTA it appeared to atart the installs and then fails with the dead android symbol about a third of the way through. No idea what the problem is now so I'll just wait for others to try this and see what their results are.
yup getting the dead droid
Reinstall TWRP and "Install" this to update. Have a backup. Should work if you have made no system modifications, except what NabiRootXD did.
Download
TWRP may or may not ask you to reinstall superuser.
Also working on a patch to fix the exiting error in script.
EDIT: New links for a version 2. Fixed scripting error and patch system error. Easier to just download the whole program again then for me to explain fixing the patching system manually.
OTA procedure
srgsng25 said:
yup getting the dead droid [
BOOT into TWRP and perform and system restore to pre-root image
reboot
download and install the OTA
reapply root and gapps
Click to expand...
Click to collapse
aicjofs said:
Reinstall TWRP and "Install" this to update. Have a backup. Should work if you have made no system modifications, except what NabiRootXD did.
Download
TWRP may or may not ask you to reinstall superuser.
Also working on a patch to fix the exiting error in script.
EDIT: New links for a version 2. Fixed scripting error and patch system error. Easier to just download the whole program again then for me to explain fixing the patching system manually.
Click to expand...
Click to collapse
Thanks for the update aicjofs! I'll test this out shortly and let you know how everything goes.
The Acer Iconia Toolkit is supporting following devices at the moment:
B1-A71
B1-710
B1-A710
B1-711
B1-720
A1-810
A1-811
A3-A10
Liquid S1
Only use these methods if you are sure the device cannot be rooted using a custom recovery from the following thread:
http://forum.xda-developers.com/andr...ax-b1-t2875894
Intel based devices will not be supported ever by this toolkit! Only Mediatek chips are supported!
At the moment the following features are available:
Root from scratch (Unix only / recommended)
Root with prerooted Image (see Download links at the bottom)
Unroot
Swap External <-> Internal SD
Odex ROM
Pull system.img.gz off your device
Download Acer Iconia Toolkit Latest Version
Older Versions:
v0.9.0
v0.8.5
v0.8.4
v0.8.3
v0.8.2
Thank you goes to:
FireDiamond, bullbrand, pawitp, alba81, sodaFR, MatrixDJ96, ak6, min-dfreak, Gilly10, agentdeep, nick_1964, sampod
and the testers
Acer Iconia B1-A71:
Unlock Bootloader
CWM update, that removes bloat
thx to FireDiamond
Apply the "Invalid Partition Error" fix before rooting!!!
To avoid unfixable bootloop, first apply this patch from Acer.
Install the APK, start it, click on FixG1PMT (no feedback) and uninstall afterwards. Good luck!
If you're rooting with prerooted system.img.gz here are the Downloads. Pick the one, fitting to the firmware installed on your tablet, otherwise you will get into bootloop!
RV03RC05:
Acer Firmware Update [mirror] [mirror + md5]
RV04RC04:
[system.img.gz] [mirror]
RV05RC05:
Acer Firmware Update [mirror1] [mirror2] [mirror3] [mirror4 + md5] [mirror5 + md5]
[system.img.gz]
RV02RC12:
system.img.gz
Acer Iconia B1-710 / B1-A710:
Unlock Bootloader (thx to FireDiamond and abstrkt1337)
RV04RC01:
system.img.gz [mirror1] [mirror2]
Stock system Images for B1-710 RV04RC01
Hamza91: stock, rooted
RV04RC01_PA_CA:
Stock and Rooted system image
Acer Iconia B1-711:
RV01RC04_WW_GEN1:
system.img.gz
Acer Iconia B1-720:
RV03RC01_WW_GEN1:
system.img.gz (thx to Hayastan)
RV07RC01_WW_GEN1:
system.img.gz (thx to Hayastan)
Acer Iconia A1-810:
Acer Firmwares
Modified XPosed Installer
RV03RC08:
system.img.gz
RV18RC07_WW_GEN1:
update.zip (about 4MB)
system.img.gz with /system RW workaround (MD5 = 214db984aee42ef0c05d1cfa43d193c1) (needs extra config and SuperSU instead of Superuser) [torrent] (see this post also)
RV21RC02_WW_GEN1:
update.zip
system.img.gz with /system RW workaround (needs extra config and SuperSU instead of Superuser) (see this post also)
RV21RC03_TWN:
system.img.gz with /system RW workaround (needs extra config and SuperSU instead of Superuser) (see this post also)
RV27RC02_PA_CA:
stock system.img.gz (rename to system.img.gz first!)
system.img.gz (rename to system.img.gz first!)
RV27RC03_WW_GEN1:
system.img.gz
stock system.img.gz
update.zip
RV18RC10_PA_CA:
system.img.gz with /system RW workaround (needs extra config and SuperSU instead of Superuser) (see this post also)
RV26RC06_PA_CUS1:
system.img.gz
Stock Images: (Workaround to unroot: Put the system.img.gz of your version into system_image and choose root option in toolkit)
RV03RC08:
system.img.gz
RV18RC07:
system.img.gz ( MD5=550ECDB192F5668264B11B1070F4B932 )
How to root from scratch
Acer Iconia A1-811:
RV01RC11_WW_GEN1:
Acer Firmware Update
RV02RC20:
system.img.gz rooted and stock (including xposed) (thx to konsolen!!)
RV02RC22_TWN_GEN1:
system.img.gz with /system RW workaround (needs extra config and SuperSU instead of Superuser) (see this post also)
Unbrick:
Stock Firmware RV01RC11 (copy on SD and flash from recovery)
Acer Iconia A3-A10:
A3-A10_RV05RC01_PA_CA:
stock system image
Your device not listed above?
Help us getting your device to work with the toolkit.
See this post how you can help.
Common
B1-A71 / B1-710 / B1-A710: Install this after rooting: Superuser App on Google Play Store
A1-810 / A1-811 / B1-711: Install this after rooting: SuperSU App on Google Play Store
Verify your root: Root Checker on Play Store
FAQ
Q: I'm stuck inside a bootloop after rooting!!!11
A1: The system.img.gz you applied, wasn't suiting to the firmware version installed on your tablet. Download latest Acer firmware update ( !!! if available !!!), copy it on a micro sd card, plug it into your Iconia, go to recovery by holding Volume up and Power button while device is turned off. Then choose apply update from sd card.
A2: If you cannot apply any Acer firmware, because you always get a partition error while installing, you should do a reboot after you get the error. A user reported that this made her/his device boot into Android again, showing the new version in settings -> info. Good luck
A3: If your device is really bricked you could try bring it back to life. Here you find help: link1, link2, link3, link4 (many thanks to Gilly10, drmad and Hamza91)
A4 (B1-A71, B1-710, B1-711 only): Unbrick
A5: If the A1 - A4 didn't help. Send back the device to Acer. Tell them you tried to apply an update from sd card and ended up in this bootloop. Sending device back to Acer over UPS is free. Good luck!
Q: Successfully rooted, but still no root after rebooting!
A: Have you installed Superuser App from Google Play Store?
(B1-A71 only)Q: Cannot update, always getting ERROR: - Invalid partition setting; 17: fat 238e8000:888e8000; Instalation aborted.
A: Download "Invalid Partition Error" Patch.
(B1-A71 only)Q: I applied update from RV05RC05 to RV05RC06 but still it shows RV05RC05.
A: There is no RV05RC06. It is the RV05RC05. It got on Acers Download section with a RV05RC06 named zip file. But the content is 100% equal to RV05RC05.
Q: Toolkit fails or crashes for any reason and I don't know what to do.
A: Run it again with parameter -d, e.g.: toolkit.exe -d and post the entire output here.
Q: Root from scratch on Linux doesn't work because of Error message: 'No such file or directory bin/posix/64/adb'
A: sudo apt-get install ia32-libs libstdc++6 libgcc1 zlib1g libncurses5 libsdl1.2debian
Q: Can i flash a custom recovery?
A: No, because bootloader is locked. You would brick your tablet.
Q: Are there Custom ROMs?
A: No, see answer above.
Q: Is my data wiped during root?
A: No.
Q: Do i lose root after factory reset or wipe date?
A: No.
Q: I get an error in Engineer mode entering telnet command.
A: If Swiftkey is installed / enabled try settings Google AOSP Keyboard as default.
Q: How can I start telnet server manually?
A: Try this.
What you can do with root:
Apply Supercharger V6 by zeppelinrox and significally speed up your tablet! [My small How-To]
Install Adaway, an ad-blocker for webbrowsers and apps containing ads.
Install ROM Toolbox and customize boot screen and other funny things.
Install Titanium Backup to Backup, Freeze, Uninstall any App and more.
Install Datasync to sync app data like save states between rooted devices.
What you can NOT do with root on these devices:
Change DPI
Flash Custom Recoveries
Flash Custom ROMs
Sources and Changelos @ github (thanks to nikagl)
Changelog:
v0.9.4
======
- Updated SuperSU to 2.46
- Removed Xposed APK
- Added Liquid S1 support!
v0.9.3
======
- Fix Xposed removal
- Wait longer for MTKLogger to press settings
- Add 811 and KK 810 and 811 to root from system.img
v0.9.2
======
- Removed Xposed till it works
- Add global for allatonce
v0.9.1
======
Added option to enable write access to external sdcard
Added comment for Xposed not working
Removed su delete command in invalid section
v0.9.0
======
- A1-811: Kitkat Support
- A1-xxx: Added proper su-binary
- Added timestamps
- Added descision for Superuser/Supersu
- Added selection for Xposed **not working yet**
- Added option to enable write access to external sdcard
- Added selection to continue automatically (also import the system instead of waiting for enter)
- Removed invalid quote and double exit command
- Added forward delete of characters to make sure Run command is empty
- Added some additional messages during the root process
v0.8.5
======
- A1-810: Fixed target directory for system image (no permissions for /cache directory since Kitkat)
- A1-810: Fixed root from scratch for Kitkat versions (thanks to Just_Another_N00b)
v0.8.4
======
- A1-810: Fixed root for Android Kitkat >= 4.4.2
- A1-810: Fixed abd devices id, changed sind Kitkat update
v0.8.3
======
- Fixed pulling system.img.gz from Windows
v0.8.2
======
- New: Supporting B1-720
v0.8.1
======
- A1-81x: Fixed missing read/write permissions for /system partition (thanks
to twu2!)
- All other devices: fixed missing path to su binary (thanks to arzakon.nn)
v0.8.0
======
- New: Pull system.img.gz from your tablet
- New: Supporting A3-A10
v0.7.8
======
- fixed Swap Internal to External for A1 and B1-710
v0.7.7
======
- Supporting Swap Internal to External for A1 and B1-710
- fixed bug in root from scratch: checking for /bin/su although it's not there
Full Changelog inside the Download.
Error "Permision denied"
entonjackson said:
Changelog:
v0.2.1
======
- Windows: Providing an .exe, so Python is no more needed for Windows users. But you could still use the Python script.
- Unix: Python3 compatibility fixes
v0.2.0
======
- supporting windows 64 and 32 bit (only for rooting with prerooted system.img.gz)
- Linux: added option to choose between 'Root from scratch' and 'Root from prerooted image'
- supporting all versions between python 2.7.4 and 3.3
v0.1.1
======
- supporting linux 64 AND 32bit
- instructions at the beginning
- make compatible to python 3.3
v0.1.0
======
- initial release, only supporting linux 64bit
Click to expand...
Click to collapse
Hi Thanks for your effor and sharing with us.
I got error "failed to copy system._image\system.image.gz to cache/system.image.gz , permission denied
can you give me solution.
thanks very much
cakadut said:
Hi Thanks for your effor and sharing with us.
I got error "failed to copy system._image\system.image.gz to cache/system.image.gz , permission denied
can you give me solution.
thanks very much
Click to expand...
Click to collapse
Windows or Linux?
edit: Ok i found the issue, I just fixed it and going to upload a new version this evening.
New version v0.2.2 is up.
entonjackson said:
New version v0.2.2 is up.
Click to expand...
Click to collapse
I thanks for your work.
I have one problem
failed to copy 'system_image\system.img.gz' to '/cache/system.img.gz': Permissio
n denied
Traceback (most recent call last):
File "easy_root_iconia_b1.py", line 724, in <module>
else:
File "easy_root_iconia_b1.py", line 26, in main
win_main(python3)
File "easy_root_iconia_b1.py", line 642, in win_main
out = p.stdout.readline()
File "subprocess.pyc", line 575, in check_output
subprocess.CalledProcessError: Command ' bin\windows\32\adb.exe push system_imag
e\system.img.gz /cache' returned non-zero exit status 1
Thanks for your futur help
sorry for my english
V0.2.2 still Error
entonjackson said:
New version v0.2.2 is up.
Click to expand...
Click to collapse
Dear Eaton,
after dowbload and run v0.2.2 , still found same problem.
No Progress bar during copy image.
and system shown
failed to copy 'system_image\system.img.gz' to '/cache/system.img.gz': Permissio
n denied
Traceback (most recent call last):
File "easy_root_iconia_b1.py", line 724, in <module>
else:
File "easy_root_iconia_b1.py", line 26, in main
win_main(python3)
File "easy_root_iconia_b1.py", line 642, in win_main
out = p.stdout.readline()
File "subprocess.pyc", line 575, in check_output
subprocess.CalledProcessError: Command ' bin\windows\32\adb.exe push system_imag
e\system.img.gz /cache' returned non-zero exit status 1
Note I am using windows 7.- 64 Bit
Regards,
I uploaded a new version where I added some commands that hopefully resolve the permissions issues.
The problem is, that I can't reproduce it.
Are you rooting the Iconia the first time? or did you already have root before?
Regarding the progress bar. It only appears when writing the system.img.gz
I have Windows 7 64 bit, btw.
entonjackson said:
I uploaded a new version where I added some commands that hopefully resolve the permissions issues.
The problem is, that I can't reproduce it.
Are you rooting the Iconia the first time? or did you already have root before?
Regarding the progress bar. It only appears when writing the system.img.gz
I have Windows 7 64 bit, btw.
Click to expand...
Click to collapse
Dear Enton,
Yes this is the first time B1 will rooting,
I will try again, and report to you,
Regards
cakadut said:
Dear Enton,
Yes this is the first time B1 will rooting,
I will try again, and report to you,
Regards
Click to expand...
Click to collapse
Dear Enton,
The Messages still same, I Attached the Error Pic.
Note :
Iconia B1-A71
ROM 16 GB
RAM 512 MB
Android Version : 4.1.2
Kernel Version : 3.4.0
Image Version : Acer_AV051_B1-A71_RV05RC05_WW_GEN1
Build Number : Acer_AV051_B1-A71_1.258.00_WW_GEN1
Regards,
cakadut said:
Dear Enton,
The Messages still same, I Attached the Error Pic.
Note :
Iconia B1-A71
ROM 16 GB
RAM 512 MB
Android Version : 4.1.2
Kernel Version : 3.4.0
Image Version : Acer_AV051_B1-A71_RV05RC05_WW_GEN1
Build Number : Acer_AV051_B1-A71_1.258.00_WW_GEN1
Regards,
Click to expand...
Click to collapse
I will try to fix it asap. The problem is, that I cannot reproduce it.
I assume that the chmod 777 /cache command that I do, before the adb push command fails with "Operation not permitted."
But this I still don't know how to fix. If someone knows, tell me!
error in v.0.2.3
Dear entonjackson,
thanks for your work and for the time you spend on it.
Unfortunately, I too have problems with the tool for Windows since version 0.2.0 and also with the latest version (0.2.3).
The error messages that I receive are identical (with the same line numbers) to those receiving cakadut in his last post.
I am trying to root Iconia for the first time.
I tried with Windows 7-32bit and Windows 7 64-bit.
My configuration:
Iconia B1-A71 8GB ROM, 512Mb ram
Android 4.1.2
kernel 3.4.0
Image version: Acer_AV051_B1-A71_RV04RC04_WW_GEN1
Build Number: Acer_AV051_B1-A71_1.174.00_WW_GE
I hope you can find the solution.
Thank you for sharing your work with us.
Just uploaded a new version. Could you please try again?
It's hard to fix for me, because I don't have the problem, so all I can do is try. Thanks for the patience!
****, I think i found the bug. Don't try 0.2.4 it won't work also.
foxterrier said:
Dear entonjackson,
thanks for your work and for the time you spend on it.
Unfortunately, I too have problems with the tool for Windows since version 0.2.0 and also with the latest version (0.2.3).
The error messages that I receive are identical (with the same line numbers) to those receiving cakadut in his last post.
I am trying to root Iconia for the first time.
I tried with Windows 7-32bit and Windows 7 64-bit.
My configuration:
Iconia B1-A71 8GB ROM, 512Mb ram
Android 4.1.2
kernel 3.4.0
Image version: Acer_AV051_B1-A71_RV04RC04_WW_GEN1
Build Number: Acer_AV051_B1-A71_1.174.00_WW_GE
I hope you can find the solution.
Thank you for sharing your work with us.
Click to expand...
Click to collapse
Ok, people. With pawitp's help I hopefully fixed the permissions bug.
The problem was, that i was trying to chmod the /cache directory directly from adb shell, which isn't possible. I forgot, that this needs to be done from telnet. So in 0.2.6 I'm setting permission with telnet. This should fix it!
Please report!
Good luck :fingers-crossed:
Dear ethon
hi ethon can u do tutorial video cause i can't found the directory for the "step 6 : go to go to connectivity -> CDS Inforamtion ->Network Utility " and Thnk You :good:
diskenz said:
hi ethon can u do tutorial video cause i can't found the directory for the "step 6 : go to go to connectivity -> CDS Inforamtion ->Network Utility " and Thnk You :good:
Click to expand...
Click to collapse
I will try to do a video tutorial, but it's very easy to do.
Download and install Ex Dialer & Contacts.
Launch the app.
Dial *#*#ENGMODE#*#*.
Swipe from right to left (to Connectivity). Then choose CDS Information and Network Utility.
There you paste this command: /data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234
stell no thing happen maybe i must upgrade to pro version ???
diskenz said:
stell no thing happen maybe i must upgrade to pro version ???
Click to expand...
Click to collapse
No.
Try to dial *#*#3646633#*#*
Else I don't know... this should work in any case...
entonjackson said:
Ok, people. With pawitp's help I hopefully fixed the permissions bug.
The problem was, that i was trying to chmod the /cache directory directly from adb shell, which isn't possible. I forgot, that this needs to be done from telnet. So in 0.2.6 I'm setting permission with telnet. This should fix it!
Please report!
Good luck :fingers-crossed:
Click to expand...
Click to collapse
Thanks entonjackson,
unfortunately with version 0.2.6 I can not get the ADB connection with the tablet. The message it gives me is:
"Trying to Establish ADB Connection (If this hangs, ADB Connection failed. CMD Shell Close and open a new one) ..."
and remains so without making the connection.
If I run the command 'adb devices' in another command line session, the device is seen correctly (0123456789ABCDEF device),
but when I run the new version (0.2.6) of the tool, the message is what I wrote above.
Thank you for your patience.
I cannot post to the developer forum as I have not had the requisite 10 posts.
I have been trying to modify /etc/vold.fstab (long story but a workaround for Quickoffice not seeing the SD card in the keyboard).
Even a seemingly simple modification to /etc/vold.fstab like placing the "dev_mount sdreader ......" line before the "dev_mount microsd ...." line
or even commenting out the "dev_mount microsd ...."
causes an error at reboot "Unfortunately, System UI has stopped" which essentially prevents any further use until I reflash of the system (I guess I could connect via USB and change the file back too).
This seems a strange error and I was wondering:
1. Is this Cromi-X specific (I had previously made changes to the file on JB 4.1 without issue)
2. Why this error anyway ?
3. Any suggestions / guidance on limitations to modifying this file
In the meantime - I'll try an init.d script to symlink the SD card to 'visible' directory (like /data/media/0/SD ?)
Kernel -> 3.1.10-10.6.1.14.4-that2+
Build -> TF700 Cromi-Xenogenesis 4.5 - 10.6.1.14.4/US DEODEX
Hi guys, I'm modified the resources in framework-res.apk on my Fire HD 8 2018 for enabling the features. All features has been disabled by the manufacturer Amazon so just modifying the resources such as bools.xml and integers.xml to enable all features.
The framework-res.apk in /system/framework/, the package name is android, the app name is System that renamed by Amazon, the original app name from stock AOSP is Android System
Features of modified framesork-res.apk:
-> Replaced the value of config_lowBatteryWarningLevel to 15 in res/values/integers.xml - to detect the low battery level to 15%
-> Replaced the value of config_longPressOnHomeBehavior to 2 in res/vales/integers.xml - to access the assist intent such as Google Assistant
-> Replaced false with true in res/values/bools.xml:
----> config_supportsMultiWindow - to make your Fire tablet to access the multi-window such as split-screen, freeform (resizable activity) and PiP for prevent kill the activities when in the background. Can be enable the resizable activity in developer options.
----> config_sustainedPerformanceModeSupported - to make your Fire tablet to access the sustained performance mode for make long-running apps and fast performance.
----> config_useRoundIcon - to make a circular app icon on your Fire tablet like a Google Pixel.
Requirements:
-> Rooted Fire HD 8 2018 running Fire OS 6.3.0.1, want to root from @xyz` or another link for new rooting method from @k4y0z
-> ADB for Windows, MacOS or Linux from Android SDK Manager
-> ADBD Insecure from @Chainfire: https://forum.xda-developers.com/showthread.php?t=1687590&page=27
-> Transferrable micro USB cable
-> Modded framework-res.apk under the post
WARNING
This is an experimental operations, can be got a boot-loop (brick) your Fire tablet after you accessing the invalid operations
Let's Get Started
1. Go to Settings -> Device Options -> About Fire tablet -> Serial Number and tap the several number until the Developer Options appears under About Fire tablet menu.
2. Go to Developer Option -> USB Debugging and enable it.
3. Connect your Fire tablet to your PC, Open Command Prompt or Microsoft PowerShell for Windows in your PC and approve the USB device
4. Verify the attached devices
Code:
adb devices
5. Remount the partition
Code:
adb remount
NOTE: If you got a result, Success or not, Do not run.
6. Push the modded framework-res.apk to /system/framwork/
Code:
adb push path/to/framework-res.apk /system/framwork/
7. Reboot your Fire tablet
Code:
adb reboot
8. Reset your launcher by clearing the app data in settings
Done! You have a modded framwork-res.apk on your Fire HD 8 2018. After booting your Fire tablet is completed, give a thanks and post the screenshot.
The Fire tablet is getting to boot-loop or brick, get the solution from @xyz`, this link or post the solution.
MOD EDIT: Link removed because in this cases of bricking or boot-looping. Link will be back after maintenance.
Updated in March 26, 2020
Being on nougat you are very lucky. You get to play with some other things like multi-window. I really wish the HD 10 would get a nougat update.
AmznUser444 Dev said:
. 5. Remount the partition
Click to expand...
Click to collapse
Doh, was hoping it was gonna be possible with the temp root solution! Now I gotta break out my Linux rig. Super excited for multi window!
AmznUser444 Dev said:
Hi guys, I'm modified the resources in framework-res.apk on my Fire HD 8 2018 for enabling the features. All features has been disabled by the manufacturer Amazon so just modifying the resources such as bools.xml and integers.xml to enable all features.
The framework-res.apk in /system/framework/, the package name is android, the app name is System that renamed by Amazon, the original app name from stock AOSP is Android System
Features of modified framesork-res.apk:
-> Replaced the value of config_lowBatteryWarningLevel to 15 in res/values/integers.xml - to detect the low battery level to 15%
-> Replaced the value of config_longPressOnHomeBehavior to 2 in res/vales/integers.xml - to access the assist intent such as Google Assistant
-> Replaced false with true in res/values/bools.xml:
----> config_supportsMultiWindow - to make your Fire tablet to access the multi-window such as split-screen, freeform (resizable activity) and PiP for prevent kill the activities when in the background. Can be enable the resizable activity in developer options.
----> config_sustainedPerformanceModeSupported - to make your Fire tablet to access the sustained performance mode for make long-running apps and fast performance.
----> config_useRoundIcon - to make a circular app icon on your Fire tablet like a Google Pixel.
Requirements:
-> Rooted Fire HD 8 2018 running Fire OS 6.3.0.1, want to root from @xyz`
-> ADB for Windows, MacOS and Linux from Android SDK Manager
-> Transferrable micro USB cable
-> Modded framework-res.apk under the post
WARNING
This is an experimental operations, can be got a boot-loop (brick) your Fire tablet after you accessing the invalid operations
Let's Get Started
1. Go to Settings -> Device Options -> About Fire tablet -> Serial Number and tap the several number until the Developer Options appears under About Fire tablet menu.
2. Go to Developer Option -> USB Debugging and enable it.
3. Connect your Fire tablet to your PC, Open Command Prompt or Microsoft PowerShell for Windows in your PC and approve the USB device
4. Verify the attached devices
Code:
adb devices
5. Remount the partition
Code:
adb remount
NOTE: If you got a result, Success or not, Do not run.
6. Push the modded framework-res.apk to /system/framwork/
Code:
adb push path/to/framework-res.apk /system/framwork/
7. Reboot your Fire tablet
Code:
adb reboot
8. Reset your launcher by clearing the app data in settings
Done! You have a modded framwork-res.apk on your Fire HD 8 2018. After booting your Fire tablet is completed, give a thanks and post the screenshot.
The Fire tablet is getting to boot-loop or brick, get the solution from @xyz`, this link or post the solution.
Download modded framework-res.apk from Google Drive link
Click to expand...
Click to collapse
Thanks. I tried this with my rooted Fire HD8 2018, but when I connect the tablet to Windows PC, it doesn't show up as a device on the PC. Instead, the Fire says it's connected to a low power charger.
CheapFire said:
Hi guys, I'm modified the resources in framework-res.apk on my Fire HD 8 2018 for enabling the features. All features has been disabled by the manufacturer Amazon so just modifying the resources such as bools.xml and integers.xml to enable all features.
The framework-res.apk in /system/framework/, the package name is android, the app name is System that renamed by Amazon, the original app name from stock AOSP is Android System
Features of modified framesork-res.apk:
-> Replaced the value of config_lowBatteryWarningLevel to 15 in res/values/integers.xml - to detect the low battery level to 15%
-> Replaced the value of config_longPressOnHomeBehavior to 2 in res/vales/integers.xml - to access the assist intent such as Google Assistant
-> Replaced false with true in res/values/bools.xml:
----> config_supportsMultiWindow - to make your Fire tablet to access the multi-window such as split-screen, freeform (resizable activity) and PiP for prevent kill the activities when in the background. Can be enable the resizable activity in developer options.
----> config_sustainedPerformanceModeSupported - to make your Fire tablet to access the sustained performance mode for make long-running apps and fast performance.
----> config_useRoundIcon - to make a circular app icon on your Fire tablet like a Google Pixel.
Requirements:
-> Rooted Fire HD 8 2018 running Fire OS 6.3.0.1, want to root from @xyz`
-> ADB for Windows, MacOS and Linux from Android SDK Manager
-> Transferrable micro USB cable
-> Modded framework-res.apk under the post
WARNING
This is an experimental operations, can be got a boot-loop (brick) your Fire tablet after you accessing the invalid operations
Let's Get Started
1. Go to Settings -> Device Options -> About Fire tablet -> Serial Number and tap the several number until the Developer Options appears under About Fire tablet menu.
2. Go to Developer Option -> USB Debugging and enable it.
3. Connect your Fire tablet to your PC, Open Command Prompt or Microsoft PowerShell for Windows in your PC and approve the USB device
4. Verify the attached devices
5. Remount the partition
NOTE: If you got a result, Success or not, Do not run.
6. Push the modded framework-res.apk to /system/framwork/
7. Reboot your Fire tablet
Thanks. I tried this with my rooted Fire HD8 2018, but when I connect the tablet to Windows PC, it doesn't show up as a device on the PC. Instead, the Fire says it's connected to a low power charger.
Click to expand...
Click to collapse
Use the transferrable USB cable, Enable USB Debugging in developer options and verify the attached devices
Code:
adb devices
So I tried to put this on my Fire HD 8 2018, but now my tablet is stuck booting up the OS.
Malonepwn said:
So I tried to put this on my Fire HD 8 2018, but now my tablet is stuck booting up the OS.
Click to expand...
Click to collapse
You going to have to extract your firmware from the zip and take the framework out of the system and manually put it back on your tablet through TWRP. Or you're going to have to reflash back to stock firmware and start all over again.
Sent from my Amazon KFSUWI using XDA Labs
I just flashed Lineage to it. I just thought I'd post in here to let people know there are potential issues with this modification.
Malonepwn said:
So I tried to put this on my Fire HD 8 2018, but now my tablet is stuck booting up the OS.
Click to expand...
Click to collapse
That happened to me, too. It took me a couple of tries - OK, maybe four LOL - going through steps 0-9 before I got it right. Once you can boot to TWRP with the volume down button you are most of the way there. From there you can reflash 6300 and Magisk. Good luck.
I can confirm that there are issues with this modification. I attempted to install this by replacing the file with a custom magisk module. This only resulted in the infinite booting OS problem that others above have described. After disabling the module, every single non-system app on my device lost permissions and had to be reinstalled.
Has anyone confirmed this working with LineageOS 14.1 on the HD8? I have tried a modded framework-res.apk and infinite loop for me too.
sd_dracula said:
Has anyone confirmed this working with LineageOS 14.1 on the HD8? I have tried a modded framework-res.apk and infinite loop for me too.
Click to expand...
Click to collapse
This would only apply to FireOS.
If you're running Lineage, why would you even bother with this?
If you're using the LineageOS custom ROM. Do not overwrite copy the modded framework-res.apk
The modded framework-res.apk for the Fire OS 6.3.0.1. We don't use 6300.zip from @xyz`
Coming Soon: Modded framework-res.apk for Fire OS 6.3.0.0 and 6.3.1.2
AmznUser444 Dev said:
If you're using the LineageOS custom ROM. Do not overwrite copy the modded framework-res.apk
The modded framework-res.apk for the Fire OS 6.3.0.1. We don't use 6300.zip from @xyz`
Coming Soon: Modded framework-res.apk for Fire OS 6.3.0.0
Click to expand...
Click to collapse
Kctucka said:
This would only apply to FireOS.
If you're running Lineage, why would you even bother with this?
Click to expand...
Click to collapse
Just wanted to enable tap to wake on the Fire HD8
AmznUser444 Dev said:
If you're using the LineageOS custom ROM. Do not overwrite copy the modded framework-res.apk
Click to expand...
Click to collapse
Then how to update the framework-res.apk for lineageOS with my edited one?
sd_dracula said:
Then how to update the framework-res.apk for lineageOS with my edited one?
Click to expand...
Click to collapse
I don't have a modded framework-res.apk for LineageOS. I'm in FireOS, I don't have a LineageOS ported.
Did this actually work for anyone? I'm on 6.3.0.1 stock rooted and replaced framework with this, now bootloop like others have reported. Any successful attempts?
I hope my TWRP backup is ok
Edit: TWRP backup restored but kept freezing on a blank screen a few seconds after boot. I don't know why though might have been something else, maybe Viper. Anyway had to reflash 6.3.0.0 and root and set the whole thing up again
wanting multi window and home google now for 6.3.1.4 please confirm it working with rooted 6.3.1.4
Hello, as there has been no answer, I pulled the apk from my device, decompiled with apktool and modified the values listed myself and recompiled with apktool.
I am not sure how to sign with the amazon key before pushing it to my device, can you help?
ameeno said:
Hello, as there has been no answer, I pulled the apk from my device, decompiled with apktool and modified the values listed myself and recompiled with apktool.
I am not sure how to sign with the amazon key before pushing it to my device, can you help?
Click to expand...
Click to collapse
Re-signing the APK will result in failure even on a rooted device especially when you're talking about the framework or any specific application signed by Amazon.
You have to open the original APK and the one you just recompiled in an archive manager like 7-Zip. Open them up as an archive side by side. Then take from the new APK the res folder and the resource file and drag them over to the original APK one by one. Then close both file managers. You can then use a root explorer to manually push the original APK back to the device. But you have to be quick and set the permissions quick. If you have custom recovery installed then you can do it manually through TWRP. If you use the app adbd-insecure, you can use 'adb remount' and then use ADB to push the APK.
I try to share my experience about this cheap phone (bought I think for 45€ : was the cheapest of the hypermarket, around 2019).
Here are some specs : https://www.gsmarena.com/wiko_sunny3-9733.php
First of all, this is a SPD (Spreadtrum) based device, not MTK (Mediatek). (Surely, it would have been easier on an MTK Wiko like the Jerry...)
My goal was to get root access and finally try to install a big-tech free system alternative.
I confess, I spent about one month on it. Here are my findings and the final result I could achieve.
Long story short : I could not get root (I'll explain it below). But I could "un-google" it as much as it is possible without breaking anything essential.
Here is the story and it's lessons learned, in a hopefully logical order.
1. Tried all (really all!) available "out of the box" rooting apps without any result.
2. However there is an "allow unlock bootloader" switch in the "developper settings" (once taped a couple of times on the "build" of the system menu...)
there was no way to really "unlock" it using any appliable fastboot command (tried really everything).
3. Magisk (latest or any other) could not patch the boot.img (or recovery.img).
As root access means the ability to get at some point a writable filesystem, and as this is mounted by boot/recovery.img, this is the key process here.
4. So I went to linux to modify them : tried again all dedicated tools to unpack, edit and repack the boot and recovery.img.
mkbootimg/unpacbootimg, abootimg, but it turns out, they don't repack the files in an acceptable way for this system.
Independently from change made or not (in some .rc file inside the ramdisk, initrd), those usual dedicated tools just cannot repack the file correctly, at least for this device.
Lastly, when I tried bootimg.exe (for windows) of "cofface" (https://github.com/cofface/android_bootimg/blob/master/bootimg.exe)
I could find out that it extracted an other file that abootimg and others was not even aware of : dt_image (binary having an SPRD header).
And this (avesome) tool is able to repack it with it.
But now, the new boot.img was 12Mo and not 36Mo as before. Turns out there is a huge empty (00 bytes) overlay, and a vbmeta (AVB) signature, somewhere at a precise place and at the end of the file.
So I completed and patched the file by a hex editor, to make it the same as the original one. (There were also some 2 "minor" diffs at the beginning of the file that I tried every combination with to make the device boot with it. No way.
I believe now, fdl2-sign.bin, one of the two mandatory required files to flash anything on the device (that gets allways flashed first), checks the signature of boot.img (and recovery.img), so a modification of these would need a brand new signature. (Tell me if I'm wrong: I'm not a pro) And I gave up at this point.
5. Before (understanding the above), I tried also by just changing system/vendor to make root tools available :
Mounted on Linux : strangely, when the filesystem was rebuilt by "make_ext4fs" the flashing crashed, but just unmounting it and then "img2simg" to get the android "spars" format, worked fine (despite for ex. the record of the mountpoint inside the file).
I tried to add all the necessary files (su, busybox, etc.) to "system "and "vendor"... retoutching everythig back to original time stamps, etc.etc.
but the loaded system denies access to all "new" files (and also to some others). Then I tried to change some "policies" files in /etc/selinux (like plat_sepolicy.cil), only trying to get how it works (I added some lines about my files taking as example a well authorized binary)... if ever the added binaries could be accessed even on a -ro filesystem. But nothing changed.
All file added or modified, such as a new bootanimation.zip, becomes "access denied" as well, despite adding them to policies files.
Same for some "new" sounds to media folder : they will be listed but not played (so you only get silenced wake-up instead .
6. After that I decided to un "big-tech"(BT) everything and replace as much (BT tracked) functions as possible by "clean" FOSS apps from F-Droid.
And this, at my surprise, I could get it through 100% (I believe).
The idea in short :
1 - make a clean firmware flush (perhaps with already reduced preinstalled apps)
2 - uninstall/deactivate on the device anything you want and can, replace needed default apps (by FOSS equivalent), especially the launcher(wiko app starter).
3 - edit system and vendor (on linux), delete unwanted apps (making according changes on some .xml control files doesn't change anything and only might cause problems: just deleting the packages seems enough here)
4 - then reflash only the modified system and vendor (reboot and see)
Now, for those who (I would like to say "hate" BT enough to accept loosing the shiny comfort they offer, but lets say) want to get rid of preinstalled privacy breaking BT apps, here is the howto : (with explanation for also the novice)
a) First, download the latest firmware update :
Wiko Mobile : Customer Area / Connection.
customer-world.wikomobile.com
b) Launch the app and push the start flushing button (play button). This will unpack the boundled .pac file into a temporary directory (into the app folder's "ImageFiles\_DownloadFilesE10_2C10D_0" : the suffix changes at each startup. Save this folder to somewhere else (because quiting the app will erase it).
c) Now you need to launch a linux OS, (that can of course access the saved rom files) mainly to mount and modify system.img and vendor.img.
I will detail this for the novice.
Basically, open any teminal, then install if its not yet done, the following needed tools :
sudo apt-get install e2fsprogs
sudo apt-get install android-tools-fsutils
to use Midnight Commander which will save you a lot of time, make also a
sudo apt-get install mc
Then "sudo mc".
Once in MC, do Ctrl+o to switch (back and forth) to command line
d) Uncompress the system+vendor image files, mount, modify, then umount and recompress them :
Uncompress by : "simg2img vendor.img vendor-whatever.img" (same with system.img)
Then (create some "sys", "ven" folders) and : "mount system-whateweryoucalledit.img sys -rw" (thats all, same for vendor).
It turns out, you can just easyly erase some apps (but not anything!) and they just won't be installed, or will "disappear" if they were...
You can delete already from system: in "app" and "priv-app" folders any Facebook related app or service, plus Youtube, Chrome, Gmail... Duo, Messages, TTS, Calendar, Maps. From vendor: Photos, Music, Contact (and also Chrome vendor overlays). Normally you could only deactivate them from the device, but that way they won't be present at all.
You can also edit /etc/prop.default, as follows, but honestly, I did not recognized anything really working, except the sys.usb config and mock.location (allowing fake gps position app).
ro.secure=0 ---> these 2 doesn't seem to do anything without a patched boot.img
security.perf_harden=0
ro.adb.secure=1 ---> needed, otherwise you won't get adb access dialog
ro.allow.mock.location=1 ---> allows fake gps app
ro.debuggable=0 ---> if 1: will just crash "developper settings" because of its defaults
persist.sys.usb.config=none ---> you will be free to set it
Do not try to "ro.adb.secure=0" because you just won't get confirmation box for trusted adb connection attempts and they just won't work!
Same, don't be tempted by "ro.debuggable=1" bacause you will not even be able to access "developper options" any more as its defaults will conflict with this setting an it will just crash over and over. I did it, I payed the price to start it over again...
Now, it seems, ro.secure=0 and security.perf_harden=0 does just nothing as well, without being able to modify boot.img first.
Changing eventually "ro.build.type=user" (in system/build.prop or anywhere else) to "eng" or to "userdebug" makes just the flashing operation to crash. (same by patching boot/recovery.img in hex mode (which looked attractive at first sight) but led to flush crash as well, mainly for the vbmeta thing I tried to describe above.
When finished, just "umount sys" and "umount ven"
Then recompress the files by "img2simg vendor-whatever.img vendor.img" (same with system).
(This first amputation and further, could be done perhaps later all at once, but thats how I did. Of course its about to avoid first installations but without breaking the setup process.)
e) Flash the new firmware to the device, replacing system and vendor.img by the modified files :
The modified files shouldn't be bigger than the original ones, at least not bigger than their size stated (in Mb) in the k120.xml (system:1400,vendor:300) but there is no reason anyway as after my experience all added files will become "access denied". (Should they become bigger than that you will have to change these values in k120.xml and re-pac them (using spd research tool, that will update k120.xml) before using them again, otherwise the flashing will fail.)
So now, get ready for the flashing:
Un mount the back cover of your Wiko Sunny 3, remove for a few seconds the battery, then replace it.
Now, here is something I had to figure out myself because there isn't anywhere a clear description of it, and this is foundamental to be able to flash :
First thing to do is to launch your flashing software, choose the pac file if necessary and push the action button to get ready for the device's connection.
You can wait some time, while the app unpacks the included .pac file. (spd factory/research tools lets you choose your pac file, the one downloaded refers to it only through its .ini file).
So pushing the "start flashing" still nothing happens, the flashing app (unpacks the pac file and) just waits for the devive to connect... This can last forever, don't worry.
Now, to be able to connect de device in service/flashing mode, it should NOT go into charging mode when you connect it.
Thats why, you have to connect the (computer) USB slot by pressing continuosly volume up on the device (after havig removed and reinserted the battery) AND wait until the app detects it and starts the transfer. Do not release the volume-up until it gets at least 3-4%. (Many guides speak about 3 sec or so, the only thing accurate is that the app starts effectively the transfer.) If you release it too quick, the phone goes into charging mode and the COM port used to flash closes, and you will need to repeat the operation.
(And of course you need all required drivers loaded previously. The driver for flashing is called SPRD or SPD Driver R4.20.4201: seems the latest)
If successful, the device gets rebooted.
---------
Here I'd like to ask some pros of XDA : what signal boots the device after flashing? Can it be reproduced without flashing? In other words, can we start/boot an extincted device by USB signal? If yes, how ?
---------
As the first-time setup launches, just decline/skip ewerything, most of all the final wiko/vendor offer (this keeps you safe from vendor commercial services). Just get to the home screen.
See what you have got.
f) Now, setup your anti big-tech privacy free environment. For example, deactivate google play including its service. (Yes, "big-tech haters" don't rely on this ;-)
To know where are the spies, I installed TrackerControl (version 2022.02.10 from F-droid) which gives enough info on that even without root. You will be surprised. There are "feedbacks" to google, to the vendor, and also to Microsoft, even without launching anything, just the wifi on. Even the caller app has trackers...
The best thing is that this (GPL) app lets you know what package causes the leak. You can just write them down, for later deletion.
It turns out, I could delete all of them (mainly from system.img, monted again on Linux) without that anything breaks.
I replaced the caller/dialer, calender, contact, everything, by new default apps. Replaced the Wiko launcher by the Fairphone launcher (from F-Droid).
I installed ungoogled chromium from https://github.com/wchen342/ungoogled-chromium-android/releases (chrome public). (Strangely could not install other browsers!). I replaced Google TTS by "eSpeak NG" (the final config is a little bit tough : have to download "espeak-ng-data" (voices) and push it to the "sdcard" then, slowly, it finds it and it works. (Well, ok, its not the fine google tts thats far the best actually, but its still a tts...) And yes, there is still the keyboard to tap keywords to look for. ;-)
g) When done, take and mount again the system.img file (you flashed) and take out what (following the list of tracker apps found by "TrackerControl", which are mainly (for me) : (for howto, see d) above)
/system/priv-app/phonesky // playstore : com.android.vending
/system/priv-app/GoogleDialerGo // contains trackers!
/system/priv-app/GmsCore // googleplayservices (yes it works without it)
/system/priv-app/WIKOSetupWizard
/system/priv-app/WIKOLauncher // easyly replaced (by Fairphone's 1/2/3)
/system/priv-app/WIKOInstaller
/system/priv-app/AppCloud // wiko appstarter (77 trackers)
/system/priv-app/SearchSpeachService // (google) tracker by definition
/system/priv-app/AntitheftPlugin
can be removed as well (and still some others, but its more wise to stop here, till it still works ;-)
NB : The 3 "Vital-app", probably commercial boudles, must be really present but they can be uninstalled cleanly (weather, smart-assistance, gaming).
Finally, enjoy your non-rooted, but privacy tuned Wiko Sunny 3, and install clean FOSS apps from F-Droid (or from elswhere).
One more thing: Its not because an app is "free and open source" that it won't track you : choose your apps carefully, observing all permissions they ask for.
For example, there isn't much acceptable explanation for a calculator to claim "full network access" or a game to be "launched at startup" or get "system configuration" rights.
And sadly, as we still do not have root access on this device, there isn't much control available on apps, permissions, network or system. But it is possible now to free it from big-tech trackers, as much as possible.
Of course, as usually in these cases, I cannot guarantie anything. It just worked for me like that (reproduced several times), and I think there is no reason that for anybody else it would produce a differet outcome.
Your comments are allways welcome.