Database Info

How-to- Root, Hack, and Flashing your G1/Dream Read first!!

Why should you root your Dream/G1?
You can install a full Linux distribution, like Debian.
You can run applications that require root, like Screenshot and Auto Rotate your Browser and or any other application.
You can install the latest Android build directly from the Android source tree.
Customize your boot image.
Create full backups of the state of your phone.
Create custom ROMs.
Install Applications to your SD Card to save space.
Use your phone as a tether to connect your computer/laptop to the internet.
Turn your phone into a wireless router that provides internet access.
Well, hopefully one of those reasons convinced you to get root access on your phone!
Preparing to Get Root on your Phone
Getting root on your phone involves exploiting a security hole that existed in an early version of Android. The versions with the security holes are known as RC19, RC28, and RC29 (or RC7 or lower for UK phones). As of RC30 (RC8 on UK), Google patched the security hole so that your phone can not be rooted (don't worry, we can still root it!).
To check your version, go to the Home Screen, click your menu button, choose "Settings", and then click "About phone". You will then see the following screen:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If you have US-RC30/UK-RC8 or higher, you will first need to downgrade your phone to a previous version. (Skip these steps otherwise)
Format your phone's SD card to FAT32 mode:
Hook your phone up to your computer using a USB cable and then wait for the notification to show up in your title bar of your phone.
Click the notification, and then click "Mount".
A new removable disk should show up on your computer. Right click it and select Format, and select FAT32 as the file system type.
Download and unzip the RC29 or RC7 image file. Copy the DREAIMG.nbh file to the SD card. (RC29 for US, RC7 is for UK)
Turn the device power off.
Hold Camera button, and press Power button to entry boot loader mode. You should see a gray/white screen with instructions to flash your phone with the update on your SD card. If you don't see that, make sure you followed the instructions properly.
As per the on-screen instructions, press the Power button to start upgrade procedure. DO NOT DO ANYTHING TO INTERRUPT THIS PROCESS.
After it is finished, perform the restart your phone.
Rooting your RC29 or lower phone:
On RC29 phones and lower, anything you type into your keyboard is also being run in a hidden console with root permissions. More information regarding that at the bottom of this post. But, to get root access, do the following:
Instructions:
Download recovery.img or the new version by Amon recovery-RA-dream-v1.5.2.img and copy it to your SD card (see the previous instructions on how to copy from your computer to your Phone's SD card).
Download the Hard SPL and copy the zip file to the SD card.
All files must be on the root of your SD card.
Restart your phone. Wait for your phone to start up fully and show the home screen.
After your phone starts up, hit the enter key twice, type "telnetd" and press enter. (Yes, it will start up a contact search, don't worry. Just type it.)
Download an Android "Telnet" application from the Market and connect to localhost.
If you connect successfully, you will have a root prompt "#".
Type the following into Telnet (these commands will give you root access easier in the future):
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery.img
cat recovery.img > /system/recovery.img
Now you have root!
What To Do Now That You Have Root
Now that you have root, you will want to apply "Hard SPL" to your phone. HardSPL is what will allow you to apply flash images from other regions (like UK on US phones, and vice versa), create full backups of your phone, install the latest build from the Android source, and usually resurrect your phone if it is "bricked". You have already downloaded the file to your SD card, so now you can apply it.
Power off your phone.
Start up in recovery mode by holding home and pressing power.
You will now enter recovery mode. You should see an exclamation.
If you do not see a menu on screen, press Alt-L to show the menu.
Press Alt-S to apply the update from the SD card.
After the update is complete, hold Home and press Back to restart.
And now, the last step! You are still running an old version of Android, but you want to upgrade to the latest and greatest update! You can do this, and not lose root by downloading modified versions of the updates.
First, choose a modified image from the list below:
ADP1.1: (md5: bacc58302e0b239d66c7bcc8db6c434b)
http://jf.odiness.com/v1.41/JFv1.41_ADP1.1_BuildEnvironment.tar.gz
http://android-dls.com/forum/index.php?f=24&t=241&rb_v=viewtopic
http://andblogs.net/2009/01/jesusfrekes-14-images-are-out/
RC33: (md5: f24b6c237775147cb4bc42efc2393973)
http://jf.odiness.com/v1.41/JFv1.41_RC33_BuildEnvironment.tar.gz
http://android-dls.com/forum/index.php?f=24&t=241&rb_v=viewtopic
http://andblogs.net/2009/02/new-rc33-based-images-from-jesusfreke/
RC8: (md5: de2d0d34adbb4015ee3aa5e4e7ca3c07)
http://jf.odiness.com/v1.41/JFv1.41_RC8_BuildEnvironment.tar.gz
http://android-dls.com/forum/index.php?f=24&t=241&rb_v=viewtopic
http://andblogs.net/2009/01/jesusfrekes-14-images-are-out/
Download the image.
Rename it to update.zip.
Copy it to your phone's SD card.
Turn your phone off.
Start up in recovery mode by holding Home and pressing Power.
Press alt-W to wipe your device. (You need to do this, or the device may hang at the flashing Android screen)
Press alt-S to apply the update.
And that's it! Remember to check the links up top to learn how to use root to do the advanced things I mentioned.

Rooting, Hacking, and Flashing your G1/Dream
Reserved for future posting

Wow this is great news keep the community updated. thanks man
EDIT:i just tested it my self!! your right this seems like root to me

Koush said:
I verified this by remounting the /system partition as read write and changing files around.
Click to expand...
Click to collapse
How did you do that?

Wow, good job!
I classify this as a major "oops" on Google's part...

humble said:
How did you do that?
Click to expand...
Click to collapse
mount -oremount,rw /dev/block/mtdblock3 /system
You can't remount that directory that unless you have root.
Use the dd command to copy stuff around (the cp command is not available). I should mention I'm a Windows guy, and am pretty clueless with Linux: my coworker figured the rest of this out once I got to a root prompt.
Incidentally, in the /system/bin directory there is a flash_image executable that changes the recovery.img used when you hard reset the device. I've noticed that I can run this without root access from a standard adb shell. Maybe we never needed to root the device after all... I think we can flash it without root access... I'm too scared to mess with that at all though.

i just rebooted from telnet!!! i must say this is cool
thanks dude I'm going to give it a run(not flashing) I'm scared too 428 and some change down the draine nooo

Yes!!! Now we dont even have to worry about the update.zip file!
Well, it still will be usefull for package updates.
I'm goin for the bootloader and pretty soon we'll be able to port Android to other HTC devices aswell.

Maybe this can be usefull its kind of old buthttp://benno.id.au/blog/2007/11/13/android-under-the-hood

well
i don't konw how safe it is but you can just chmod 777 files and access them through the glance file manager. can't open but you can copy and past them on the sd card and open from there. i wish i could figure out how to see them

i keep getting "Error running telnet: permission denied" in LogCat. any ideas ? i have rc29

hrm
i'm now getting Unable to chmod *******: Read-only file system across the board /////////////////nm i'm retarded

Koush said:
mount -oremount,rw /dev/block/mtdblock3 /system
Click to expand...
Click to collapse
If you want to edit anything, you have to remount it as read/write.

yeah i forgot i rebooted my phone, lol just trying to see if i can figure out how to change the view when you mount the sd card to show all files.

anyone with RC29 getting root access ?

yeah i am
not that i know what to do with it

can u describe the steps ? i keep getting Permission denied

anyone know where the boot code is so I can tell it to mount all folders as read write at boot?

quedijo said:
Yes!!! Now we dont even have to worry about the update.zip file!
Well, it still will be usefull for package updates.
I'm goin for the bootloader and pretty soon we'll be able to port Android to other HTC devices aswell.
Click to expand...
Click to collapse
Good news!
Hope someone can develop something for Universal!
Cheers to all,

neerhaj said:
can u describe the steps ? i keep getting Permission denied
Click to expand...
Click to collapse
http://android-dls.com/forum/index.php?f=15&t=151&rb_v=viewtopic
All the steps are laid out there. pterminal downloadable and all.

[Q] Help with Unlocking -weird things when trying to unlock Samsung Galaxy Gio

I bought my first smart phone Samsung Gio S5660M and tried to unlock it. I tried different ways but weird things happened and I don’t know what causes the problem. I was wondering whether the unlock code would change if I did something to the phone. Now the phone is still locked and I really need and appreciate your help.
First I used the method in the link: http://forum.xda-developers.com/showthread.php?t=1204705 to root and unlock the phone but was not able to finish it. The steps that I have completed are as follows:
To root the phone:
1. Download this file http://www.mediafire.com/download.php?jzvnlbhidsd5f6l
2. Copy root_gb_gio.zip to the root of the SD card and put the card in the phone
3. Shutdown the phone.
4. Put the phone in recovery Mode (press: Home button + Power button toghether)
5. In recovery mode, choose Install Update from SD-card using Vol. up / down key and press Home key to confirm
6. Search for the root_gb_gio.zip file on the SD-card and Press home key again to run the update
7. Reboot
8. Verify in the app folder if SuperUser app is installed properly
9. Reboot
Network Unlock (using ADB Shell from PC).
1. Download and install Samsung Kies to the PC from here: http://www.samsungapps.com/about/onPc.as, also install Samsung USB Driver
2. Download and install ADB which comes with Android SDK from: http://developer.android.com/sdk/index.html
-Go to the "Available Packages" Option on the left Menu
-Click on the "Refresh" Button on the bottom Right and wait until it finish
-From Items select the "Andoid SDK platform-tools, revision 6" Item
-Click the "Install Selected" button on the botton right and wait until it finish then close the Android SDK
3. Add the correct path
-Right-click on Computer Icon (on your Desktop) and select "Properties" from the menu,
-On My PC Properties select the "Advanced Options" Tab
-Click "Advanced System Settings"
-Click "Environment Variables"
-Highlight the "Path" Variable and click the "Edit"
-At the end of the line (and path) add the path: ;C:\Program Files\Android\android-sdk\platform-tools
4. Connect the phone to the computer via the USB cable
-Click on the start button and open the "Run" option, on Run type cmd.exe and press enter. A command prompt window popped out.
-Type the next text to access the ADB Shell: cd C:\Program Files\Android\android-sdk\platform-tools
-Type: adb shell
-Now in adb shell (and executing commands on the phone itself)
-Type the next command: su
-The superuser application popped up on the PHONE SCREEN (yes take a look at the phone screen) asking to allow root privileges to the adb shell. Choose Allow root access for the ADB shell on the phone.
-Type: cd /
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: cat /efs/mits/perso.txt
got a bunch of characters on the screen and a 8 digit number, the unlock code, which is 28572603
-Type: unmount /efs (It should umount /efs, but I typed it wrong)
5. Disconnect the USB cable from the phone
6.Turn the phone off and insert the SIM card
7. Turn on the phone
In the last step it should ask for the unlock code to unlock the phone, however, it didn’t ask for the unlock code. Instead there was a message: “Phone is SIM Corporate Locked” and there is nowhere to input any code.
When I typed “*#7465625#, the result is as follows: Network Lock [OFF], Network Subset Lock [OFF], SP Lock [OFF], CP Lock [ON]. Note that the corporate lock is on. But I could access menu with the foreign SIM card in the phone. When I tried to dial “*#7465625*638*28572603” or “#0111*28572603” with or without foreign SIM card, the message is always something like network not available (cannot recall the exact words). When I went to a FIDO kiosk for help (SIM card is from FIDO), they told me to unroot the phone so that the phone could ask for the unlock code.
I googled corporate lock/SPCK code on the Internet and there is such message: “In 1% of cases to unlock samsung SPCK code is need”, I called Samsung for help with SPCK code. The technical support in Samsung asked me to factory reset the phone by typing “*2767*3855#”. After the reset, the status of the locks were still the same as before, so is the message “Phone is SIM Corporate Locked”. Then Samsung told me that they don’t have SPCK code. I noticed that SuperUser icon was still on the menu after the factory reset.
A further search showed the unlock method of mapping image partition from: http://forum.xda-developers.com/showthread.php?t=1244695 and http://forum.xda-developers.com/showpost.php?p=17148825&postcount=334 (same method). When I went to Shell and typed “su”, not sure whether because of the factory reset or not, superuser or admin denied, so I redid the rooting by following the previous steps, but it only took a few seconds to finish it. Then the steps I followed were:
1, first, go to the command line of pc.(win xp "start->run->cmd" )
and type "cd\", now in the root of the hard drive (also tried cd \Program Files\Android\android-sdk\platform-tools)
2, second, type "adb shell".
3, after that, type "su".
4, then, type "cat /dev/bml5>/sdcard/bml5.img"
5, type twice "exit" to disconnect with gio.
6, type "adb pull /sdcard/bml5.img"
But there is an error message “remote object /sdcar/bml5.img does not exist". I just repeated the steps a few minutes ago to get a few screenshots:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(using cd \Program Files\Android\android-sdk\platform-tools)
(using cd \)
(a different error: so I used mount command)
I think at this point (cannot recall after the following tries or at this time) that I inserted a foreign SIM card, the phone began to show message “Network Locked”, took out the foreign SIM card, typed “*#7465625#", weird enough, the result changed to: Network Lock [ON], Network Subset Lock [OFF], SP Lock [OFF], CP Lock [OFF]. Corporate lock is gone but the network lock came back. I don’t know the reason – is that because I did factory reset?
I put the foreign SIM card back to the phone, input the unlock code generated earlier “28572603”, but it was not successful. I decided to go back to the first method (ADB shell from PC) to generate the unlock code again to see whether the result code is the same. However, weird gain, this time no code at all. I reproduced the screenshot a moment ago for the result (I had to cut the screen into two half):
The third method I tried is to unlock the phone by using Android Terminal Emulator, the steps were:
- In Android Market, download and install Android Terminal Emulator
- Boot up the Android Terminal Emulator application
-Using the on-screen keyboard, type su, allowed the permission from the prompt
-Type: cd /
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: cat /efs/mits/perso.txt
The desire result should be a bunch of characters on the screen and a 8 digit number. However, I didn’t get the desire result – it seems that the result is the same as using the first method after factory reset, here is the screenshot (it seems that the shot is incomplete, but I had a hard time to get even such an incomplete shot – the shell would exit when I tried to screenshot):
My questions are: why the same method cannot generate the same code? Is it because I did something to the phone, like factory reset? The unlock code will change because of the situation or it will always keep the same? Why I cannot see the bml5.img? Is it possible I damaged it by chance? I am also worried that now even if I buy uncode code from GSMLiberty, it would not work any more because of what I did to the phone. Is it possible so? What is my option now? (I tried the code once, so I still have another two chances to input unlock code). Is what has happened weird or there is a reason for that?
Thank you very much.

I also pulled the perso.txt file onto my PC and reviewed it in XVI32. It does not look like any of the files others mentioned (a lot of 00 or FF followed by a number). Attached here is perso.txt. Is my perso.txt corrupted? If yes, how can I recover it? Thanks.

As far as I know, you're the first person that's reported seeing a CP lock on this phone... One possibility is that this happened instead of plain old bricking when you mistyped the umount command the first time around.
Is your IMEI still intact?
Did you reboot the phone since your third attempt?
Did you by any chance keep the first perso.txt you cat'ed on your first attempt?
The suggestion below is at best a shot in the dark and could very well worsen the situation. With that out of the way...
If your IMEI is still intact, you could try booting in CWM, mounting /efs as rewritable, and upload the attached perso.txt, unmount efs and reboot. The file is simply my own perso.txt, from an unlocked 5660M, with your unlock code put in place of mine in a Unix line-ending aware editor. (Another, albeit riskier possibility would be to mount rewritable in the main OS and cat the file into place, then unmount and reboot.)
Good luck,
Darkshado

Thank you, Darkshado, for answering my questions.
Yes the IMEI is still intact. What is weird is that now CP is off and network lock is on after I don't know which operation - I thought it should be due to the factory reset, but after factory reset, the status was still CP [ON] and network lock [OFF]. The I did reroot. The phone was rebooted many times after each attempt, and I only input unlock code once so I still have another two chances.
No I didn't make a copy of the original perso.txt as I almost knew nothing when I first tried.
About unmount mistake, is it so severe if there is a typo? My thought was that mounting and unmounting just control access to the file. When we mount a file, we get access to the file. If we forget to unmount it, it leave a hole for others to access. Is my understanding right? If yes, the typo in unmount command for the first method should not be a big deal as I rebooted the phone after an probably unsuccessful unmount.
As to the perso.txt, what I guess is that the file perso.txt contains all the unlock codes and when we input unlock code from the screen, the system will compare the input code with the code in perso.txt. If they are the same, unlock succeeds, which is similar to using password when we login anywhere. Am I right?
I actually think that uploading your perso.txt mught be a solution. But before doing that, I think it is better to compare your perso.txt with another perso.txt from another phone to see whether the difference is only the unlock code. If yes, the solution will succeed. However, if the perso.txt files from different phones are quite different -like the location of the unlock code and other data that is not 00 or FF, there is a good chance that it's very risky. Do you have another perso.txt available? Or anybody in the forum has a perso.txt available to compare?
My other question is how useful is this perso.txt. If I delete it totally by chance and ask people to unlock the phone from hardware, will the system still operate normally?
I'm going to try to factory reset the phone and reroot again - My PC is in repair and I'll try after I get my PC back - to see whether perso.txt could be restored. Do you have bml5.img in your phone? I don't know why I don't have it on my phone. But from the forum, it looks like that the bml5.img is very similar to perso.txt, only 00 becomes FF or vice verse.
Thanks again for your help.

SPnewb said:
Thank you, Darkshado, for answering my questions.
Yes the IMEI is still intact. What is weird is that now CP is off and network lock is on after I don't know which operation - I thought it should be due to the factory reset, but after factory reset, the status was still CP [ON] and network lock [OFF]. The I did reroot. The phone was rebooted many times after each attempt, and I only input unlock code once so I still have another two chances.
Click to expand...
Click to collapse
That is very strange. What, if any, SIMs did you have in the phone when attempting the unlock at the different stages? Was the Fido SIM in at any time before trying to get an unlock code prompt?
As far as I know, the factory reset operation, at least when triggered from recovery, only wipes the /data and /cache partitions. Is anything done to NV items? I don't have any data to tell.
About unmount mistake, is it so severe if there is a typo? My thought was that mounting and unmounting just control access to the file. When we mount a file, we get access to the file. If we forget to unmount it, it leave a hole for others to access. Is my understanding right? If yes, the typo in unmount command for the first method should not be a big deal as I rebooted the phone after an probably unsuccessful unmount.
As to the perso.txt, what I guess is that the file perso.txt contains all the unlock codes and when we input unlock code from the screen, the system will compare the input code with the code in perso.txt. If they are the same, unlock succeeds, which is similar to using password when we login anywhere. Am I right?
Click to expand...
Click to collapse
Your understanding about mounting and unmounting is correct, but I am not certain that perso.txt is actually used by the phone to check the unlock code. It may also be written there for some other reasons...
The problem with our phones is that corruption has occurred by merely reading the stl5 partition the wrong way.
I actually think that uploading your perso.txt mught be a solution. But before doing that, I think it is better to compare your perso.txt with another perso.txt from another phone to see whether the difference is only the unlock code. If yes, the solution will succeed. However, if the perso.txt files from different phones are quite different -like the location of the unlock code and other data that is not 00 or FF, there is a good chance that it's very risky. Do you have another perso.txt available? Or anybody in the forum has a perso.txt available to compare?
My other question is how useful is this perso.txt. If I delete it totally by chance and ask people to unlock the phone from hardware, will the system still operate normally?
Click to expand...
Click to collapse
The idea of comparing some perso.txt files is good, but so far all the perso.txt files I've seen uploaded came from the Euro/Asia 5660 Gio, so we'd need files from a 5660M. They did look almost identical to mine though, with essentially a Bell network identifier at the beginning that wasn't present at all in theirs. One person with a 5660 also posted a before/after set, and the file does change a little after the unlock.
I've been reluctant to try too many things on my EFS partition, like deleting perso.txt to see how the phone reacts, for fear of bricking it.
I'm going to try to factory reset the phone and reroot again - My PC is in repair and I'll try after I get my PC back - to see whether perso.txt could be restored. Do you have bml5.img in your phone? I don't know why I don't have it on my phone. But from the forum, it looks like that the bml5.img is very similar to perso.txt, only 00 becomes FF or vice verse.
Thanks again for your help.
Click to expand...
Click to collapse
There are two "levels" you can access the partitions on the phone. stl is a higher level access, with which you can get correct RFS partitions for instance, while bml is a lower, block-level access. perso.txt is simply a file contained in stl5, also known as the /efs partition. You can read its contents in a round-about way via bml, but you wouldn't want to flash an /efs, /system/ or /data partition through bml.
Unlike reading stl5, reading bml5 has not caused anyone bricking so far. bml5 is sufficient to get the unlock code as well.
Good luck,
Darkshado

Hi Darkshado,
Thank you very much for your help.
Darkshado said:
That is very strange. What, if any, SIMs did you have in the phone when attempting the unlock at the different stages? Was the Fido SIM in at any time before trying to get an unlock code prompt?
Click to expand...
Click to collapse
The phone was locked to Bell, and my SIM card is from FIDO. I also got a Rogers SIM card for testing. When I rooted and generated teh code, I didn't have any SIM card in the phone. When I inserted Fido card after teh first attempt, I got the message " Phone is SIM Coperated locked" [i.e. when CP lock is On and other locks OFF], but I could still use the other functions of the phone. When the CP lock is OFF and Network lock is ON, I could not use the phoen at all because teh screen asked to input unlock code. If no input orcode is wrong, I cannot use the phone at all. Without SIM card, I could still use other functions of the phone.
As far as I know, the factory reset operation, at least when triggered from recovery, only wipes the /data and /cache partitions. Is anything done to NV items? I don't have any data to tell.
Click to expand...
Click to collapse
What is NV items? Can you tell me how I can tell where to see NV items?
Your understanding about mounting and unmounting is correct, but I am not certain that perso.txt is actually used by the phone to check the unlock code. It may also be written there for some other reasons...
Click to expand...
Click to collapse
I was wondering whether the perso.txt is like config file?
The problem with our phones is that corruption has occurred by merely reading the stl5 partition the wrong way.
Click to expand...
Click to collapse
perso.txt is simply a file contained in stl5, also known as the /efs partition. You can read its contents in a round-about way via bml, but you wouldn't want to flash an /efs, /system/ or /data partition through bml.
Click to expand...
Click to collapse
I cannot think of where I read the partition wriong other than I might hav etyped the wrong unmount for the first time followed by a reboot. I actually thinking of falshing the phone, but for the moment I have not read anything about flash yet and have no idea where to find the proper version of files to falsh.
When I pull the perso.txt to PC, I seemed to use the following method (my PC is still in repair so I cannot verify ):
-Type: adb shell
-Now in adb shell
-Type: su
- allow root privileges to the adb shell.
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: exit twice to exit shell
-Type: adb pull /efs/mits/perso.txt
-Type: adb shell (to go back to shell)
-Type: umount
Is there any risk with this method?
About perso.txt,
One person with a 5660 also posted a before/after set, and the file does change a little after the unlock.
Click to expand...
Click to collapse
I will try to see whether I could get some perso.txt files from anotehr forum (redflagdeals). Can you tell me where I can find the before/after set?
Thank you again very much.
Cathy

Hello Cathy,
One big piece of advice I can give you is to try and have a basic understanding of whatever command it is you're typing in an ADB shell.
The "cat" command can take one or many standard inputs (we'll stick to files for now) and output them to a standard output; in our case, the screen or another file.
Its one way of copying a file, or simply seeing its contents depending on where you send it.
With multiple files in the input, you're concatenating them before they get output.
I would not try the method in your last post AT ALL. You already have your code, and I see no reason why your current perso.txt would be of any use. It is a configuration file, it has to do with the various locks, but I wouldn't be able to tell you more. The way yours has been "corrupted" (I'm employing the term loosely here) may be the reason you've seen that CP lock appear. It may also have altered your Network unlock code in unforeseen ways.
I don't remember anyone trying to directly adb pull perso.txt from the /efs partition off a live phone. Do this at your own risk.
The problems we've seen occur are in all likelyhood due to interference between the modem firmware and the higher-level Android OS. That's why even normally "harmless" read commands have caused problems.
The dd command, as well as leaving /efs mounted on normal mode phone shutdown are constants in multiple bricking cases on the Gio and other similar Samsung phones like the Galaxy Ace and Mini.
The lower-level bml5 partition has been deemed safe to read with the dd command so far, even from a live phone.
Completely disable the modem firmware, like in recovery mode, and you can access, and even edit, the /efs partition in a relatively safe manner.
Something interesting happened as I began writing this: I don't know how or when this happened, but I somehow had relocked my phone to Bell!
I decided to try the lock status code you posted above and saw "Network Lock: ON" Slipping another SIM (an unactivated Koodo one) in my Gio prompted for the unlock code, which I typed and got a network unlocked message.
I took another look at the perso.txt file I had modified for you and recognized a number near the beginning: 302610 that's the Bell MNC! I rebooted in recovery, mounted /efs and adb pulled perso.txt again (safe because I was in recovery mode). The file has the exact same length, and a few differences visible in Winmerge or a hex editor of your choosing.
I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell.
You also asked about NV items: they're phone settings common to all Qualcomm cellular modem based cellphones. GSM and WCDMA antenna power and gain settings, factory test mode, IMEI, there are thousands.
In the case of the Gio, some are accessible off the EFS (stl5) partition in the /nvm/num/ directory. Others, like the IMEI unfortunately, are stored elsewhere in the phone, I don't know where. We can read all the settings by using two leaked Samsung programs, named QPST and QXDM respectively. We can edit some of them, but unless you know exactly what you're doing, this is an easy way to completely mess up a phone.
One last silly question: did you have a MicroSD memory card in the phone when you tried cat'ing bml5 to /sdcard on your second attempt?
Okay. I think there is a way to solve your unusual lock problems, try the following steps:
Get Odin here
Get the latest Odin-flashable Gio ClockworkMod-based recovery available on XDA.
Download the perso_Cathy.txt attached below.
Flash the CWM-based recovery to your phone.
Reboot in recovery mode and connect the phone to your computer.
In Windows Explorer, go to the directory you've saved perso_Cathy.txt, and shift+right-click on the directory. Open command line from here. (Otherwise, open a command line window and cd to that directory.)
adb shell (notice your shell is already # aka root)
mount -o nosuid,rw,nodev -t vfat /dev/block/stl5 /efs (notice we're mounting rewritable this time)
exit (this will take you back to the regular command line)
adb push perso_Cathy.txt /efs/mits/perso.txt (so we're pushing and renaming at the same time)
adb shell umount /efs (I doubt this is *really* necessary, but better safe than sorry. You can send single commands to the shell this way)
adb reboot
The phone should already be unlocked on reboot.
Good luck,
Darkshado

Hi Darkshado,
Thank you for your quick response.
Darkshado said:
One big piece of advice I can give you is to try and have a basic understanding of whatever command it is you're typing in an ADB shell.
Click to expand...
Click to collapse
That's good advice If I read the whole thread of unlocking first before I began unlocking, there might not have been problems. I began to unlock after reading a few postings. I used Linux long time ago, but obviously I could not recall anything now.
I would not try the method in your last post AT ALL. You already have your code, and I see no reason why your current perso.txt would be of any use. It is a configuration file, it has to do with the various locks, but I wouldn't be able to tell you more. The way yours has been "corrupted" (I'm employing the term loosely here) may be the reason you've seen that CP lock appear. It may also have altered your Network unlock code in unforeseen ways.
Click to expand...
Click to collapse
The code I had was got before the corrupted perso.txt. I had a strong feeling that the input unlock code will be compared with the code in perso.txt for unlocking, Otherwise if perso.txt is not useful any more, why when I input the initially generated unlock code, the unlocking is not successful. The CP lock is now OFF after the perso.txt is corrupted, though it is hard to judge whether CP is ON or not before perso.txt is corrupted because I got the unlock first then I saw CP was ON.
I don't remember anyone trying to directly adb pull perso.txt from the /efs partition off a live phone. Do this at your own risk.
Click to expand...
Click to collapse
Can you tell me what command you use to get perso.txt? From the info below it seems that you use the same or similar commands, but in the recovery mode instead of the normal mode, is it right?
I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell.
Click to expand...
Click to collapse
By editing perso.txt only?
One last silly question: did you have a MicroSD memory card in the phone when you tried cat'ing bml5 to /sdcard on your second attempt?
Click to expand...
Click to collapse
Yes, since I inserted the MicroSD card into the phone for rooting, I never took it out. But I can hardly imagine this will cause any problem.
I think there is a way to solve your unusual lock problems, try the following steps:
Get Odin here
Get Ingmar Steen's latest Gio ClockworkMod-based recovery here
Download the perso_Cathy.txt attached below.
Flash the CWM-based recovery to your phone.
Reboot in recovery mode and connect the phone to your computer.
In Windows Explorer, go to the directory you've saved perso_Cathy.txt, and shift+right-click on the directory. Open command line from here. (Otherwise, open a command line window and cd to that directory.)
adb shell (notice your shell is already # aka root)
mount -o nosuid,rw,nodev -t vfat /dev/block/stl5 /efs (notice we're mounting rewritable this time)
exit (this will take you back to the regular command line)
adb push perso_Cathy.txt /efs/mits/perso.txt (so we're pushing and renaming at the same time)
adb shell umount /efs (I doubt this is *really* necessary, but better safe than sorry. You can send single commands to the shell this way)
adb reboot
Click to expand...
Click to collapse
After a second thought, I decided not to flash the memory since I have little knowledge about it and the tools you mentioned here. As you suggest, I should know enough before doing it. So now, I was wondering whether it will solve the problem by just push the file perso_Cathy.txt in your above message to /efs/mits/perso.txt in recovery mode. What do you think? Another quesion is that I wish to back up all the files in the operating system before any more action. Can you tell me how to back up?
My PC is back but now I cannot even install androit SDK on the computer, so I have to bring it back for repair. So the next few days I probably would not be able to try anything, but once I try, I'll let you know the rsult.
Thank you very much.
Cathy

SPnewb said:
I had a strong feeling that the input unlock code will be compared with the code in perso.txt for unlocking
Click to expand...
Click to collapse
It most definitely is compared. From what I can tell, perso.txt contains all the SIM-lock information, status and codes.
Can you tell me what command you use to get perso.txt? From the info below it seems that you use the same or similar commands, but in the recovery mode instead of the normal mode, is it right?
Click to expand...
Click to collapse
Exactly. Recovery mode is what makes the whole thing safe. You need a rooted recovery to do it though.
There are two ways to get the actual perso.txt file off the phone: adb pull (directly or by cat'ing the file to the sd card beforehand) or dd'ing the stl5 partition and extracting perso.txt from it.
By editing perso.txt only?
Click to expand...
Click to collapse
Yes.
After a second thought, I decided not to flash the memory since I have little knowledge about it and the tools you mentioned here. As you suggest, I should know enough before doing it. So now, I was wondering whether it will solve the problem by just push the file perso_Cathy.txt in your above message to /efs/mits/perso.txt in recovery mode. What do you think?
Click to expand...
Click to collapse
I'm pretty confident it will solve the problem, otherwise I would not have gone to the trouble of writing these instructions and uploading the file for you.
Another quesion is that I wish to back up all the files in the operating system before any more action. Can you tell me how to back up?
Click to expand...
Click to collapse
Look here.
My PC is back but now I cannot even install androit SDK on the computer, so I have to bring it back for repair. So the next few days I probably would not be able to try anything, but once I try, I'll let you know the rsult.
Click to expand...
Click to collapse
What does the ADK installer say? If its complaining about not finding the JDK when you've already installed it, just it Back, and then Next. It will detect at that time and proceed with the installation. It's a known bug. Also, stick to JDK version 6 for the time being. Version 7 is so recent there might be some incompatibilities...
Thank you very much.
Click to expand...
Click to collapse
You're welcome.
Goodbye,
Darkshado

The phone is bricked now. What I did is: hole the HOme key while pressing the power key, the phone asked me whether to "reboot the system now" or "update from /sdcard" or "wipe /data XXX factory reset" (sth like factory reset) or "wipe /cach", I chose "reboot the system now". after that , connect the phone to the system. What I did in PC is catured in teh following image:
After that, when rebooting the phone, the phone began to falsh "samsung" and it cannot be shut down any more.
It seems that using other people's perso.txt does not work. One reason may be that, as you said, "perso.txt contains all the SIM-lock information, status and codes", other than unlock code, it might also read each individual phone's information, since that hte perso.txt is not mine, the phone cannot find the proper information, which causes phone to do indefinite loop. If that is the case, instead of uploading a new perso.txt, editing my own (even the corrupted) perso.txt and changing the corresponding location into the unlock code might work, as the phoen could start up before. Another reason may be that by editing the perso.txt, the system might detect the action for example like using CRC, and if only perso.txt is edited, system detected inconsistency and will go into indefinite loop. If I were the developer and I am aware that perople crack the phone, I might using another file or check code to protect. In this case, "I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell." might not work.
I guess that now even hardware unlock will not work, becaue when the phone start, it will read "perso.txt" and cannot find the right information. The only solution is push my original corrupted perso.txt back to the phone, but the question is how? Can you advise me what I should do now? SInce the phone does not start up at all, can I still flash the memory using Odin?
Thank you very much.
Cathy

Crap. I'm afraid that if your phone is now bootlooping with no access to recovery mode there is little to be done but to get it serviced or replaced.
No one has been able to flash EFS with Odin yet on our phones.
Also, your image attachment explaining what you attempted exactly is missing...
Look at the perso.txt files in a hex editor, there's no CRC or MD5 like thing anywhere in there. Of course it could be placed elsewhere, but it would be a first to have a booby-trapped phone OS...
I'll try locking my phone to another network within the next week for the heck of it.
Goodbye,
Darkshado

It's the format of the image. I changed to a different image format. You should be able to view the image in the first page now. Anyway, I posted it here again:
I'll try locking my phone to another network within the next week for the heck of it.
Click to expand...
Click to collapse
Let me know the result.
Thanks.
Cathy

SPnewb said:
Anyway, I posted it here again:
Click to expand...
Click to collapse
Please tell me: in what mode were you booted when you did the above?
Recovery?
Was the text blue or orange?
It's not normal that you had to use su. Otherwise your commands were correct starting with mount -o remount rw /

Darkshado said:
Please tell me: in what mode were you booted when you did the above?
Recovery?
Was the text blue or orange?
It's not normal that you had to use su. Otherwise your commands were correct starting with mount -o remount rw /
Click to expand...
Click to collapse
I thought that I booted in recovery mode since when I turned on the phone, I held Home key then press the power key, but when the phone start up there were only 4 or 5 choices in the recovery menu and except the one "reboot the system now", there were no other choices about reboot. I suspected that to choose "reboot the system now" will cause startup in normal mode. How do you start up the phone in recover mode?
I cannot recall teh color of the text, but I never see any orange text since I had the phone.
Thank you very much for your help. I'm going to get another Gio to unlock.

[RECOVERY]CWM Touch 6.0.2.8 for MEDION LIFETAB P9514 [25.2.2013]

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hello everybody!
The long wait has finally come to an end, as I successfully compiled CWM Touch Recovery for Medion Lifetab P9514. It works great on IceCreamSandwitch 4.0.3 Release 2 and it should also work on previous ICS updates. However, it is not compatible with Honeycomb 3.2!
Before we begin a warning is in order: You are making changes to your tablet’s software at your own risk!
So let's start. I advise you to first backup your stock recovery, just in case something goes wrong. There are couple of methods to do this. I will describe in my opinion the easiest, with adb commands for Microsoft Windows or Linux OS. This way you are not required to boot your tablet in special modes (fastboot or APX).
GETTING STARTED
When you connect LIFETAB to your PC, drivers should be installed automatically in Windows Vista/7. If they are not or if you encounter any erros, try the guide for Windows XP (original guide by @Pummelchen - android-hilfe.de).
Download drivers for WinXP: http://www.medion.com/au/service/_lightbox/treiber_details.php?did=10725
Extract the drivers - double click on "usb_p9514wxp.exe"
"Medion" folder will be created on C:/ drive, in there you will see "android_winusb.inf".
Open Device Manager: either by following the path "Start/Control Panel/System/Advanced System Settings/Hardware/Device Manager" or by right-clicking on "Computer" - "Properties" in start menu.
Connect your LIFETAB with a microUSB/USB Cable to the PC an wait for a few seconds.
In Device Manager "Other devices" should appear, there you will see "MTP" with a yellow exclamation mark. Right-click on it and choose "Properties".
Under "Driver tab" choose "Update driver".
Browse to C:/Medion and start the installation.
ADB/Fastboot tool for windows (USB drivers included): http://www.mediafire.com/download/bklnjn2x0fbln4b/MD_LT_P9514_Drivers_ADB_Fastboot.zip
You can install adb tools in Linux by following this guide: http://forum.xda-developers.com/showthread.php?t=2431956
Make sure you have USB-debugging enabled on your tablet (Settings – Developer options – USB debugging)
Run Windows Command Prompt (Start Menu – Run… – write in “cmd” – press OK); point the cursor to the ADB folder by using “cd” command (a simpler way: press SHIFT and right-click on ADB folder, choose "Open this folder in command window")
Open Terminal in Linux
Write the following order of commands in cmd:
BACKUP STOCK RECOVERY
See if your device is recognized (a long number)
Code:
adb devices
Enter the adb session
Code:
adb shell
Get root privileges
Code:
su
Make /system partition readable-writable, so you can make changes
Code:
mount -o rw,remount /system
Backup 1st file
Code:
mv /system/etc/install-recovery.sh /system/etc/install-recovery.sh.backup
Backup 2nd file
Code:
mv /system/recovery-from-boot.p recovery-from-boot.p.backup
Create and backup stock recovery image file
Code:
dd if=/dev/block/mmcblk0p1 of=/sdcard/download/original-recovery-p9514.img
RESTORE STOCK RECOVERY
Should you at any time encounter problems with cwm touch, or you simply don't like it, you can restore your stock recovery. The commands are therefore reversed:
Restore 1st file
Code:
mv /system/etc/install-recovery.sh.backup /system/etc/install-recovery.sh
Restore 2nd file
Code:
mv /system/recovery-from-boot.p.backup /system/recovery-from-boot.p
Restore stock recovery to mmcblk0p1 partition
Code:
dd if=/sdcard/download/original-recovery-p9514.img of=/dev/block/mmcblk0p1
Warning: Be carful to use the right number in mmcblk0p1. This is /recovery partition, if you use others you might brick your tablet!
An easier way to have stock recovery back is to simply re-flash ROM update zip file. But by doing this you will loose root privileges, configuration and possibly user data.
I suggest you save "original-recovery-p9514.img" also to your external sdcard and possibly to your PC. You can use your USB connection cable or a file explorer (like ES File Manager) to transfer the file to an external data storage. Another option is this adb command:
Code:
adb pull /sdcard/download/original-recovery-p9514.img
FLASH CWM TOUCH RECOVERY
Now that you’ve successfully backed-up our stock recovery, let’s flash the new cwm touch. Again there are a couple of ways to do this, I will describe in my opinion the easiest.
First download attached file, extract it and copy cwm-recovery-p9514.img to your internal sdcard. You can simply use a USB connection cable and transfer the file to the path “/sdcard/download” or use a file explorer (like ES File Manager) to copy the file.
Another method is with ADB commands. Put cwm-recovery-p9514.img in ADB folder on your PC. Open windows command window and check that your tablet is recognized (adb devices). The following line will transfer the .img file to “download” folder (you can use any other name, but the folder needs to exist on your sdcard):
Code:
adb push cwm-recovery-p9514.img /sdcard/download
To flash cwm recovery on the recovery partition, use the following commands:
Code:
adb shell
su
mount -o rw,remount /system
dd if=/sdcard/download/cwm-recovery-p9514.img of=/dev/block/mmcblk0p1
You can now reboot your tablet.
INSTALL CWM TOUCH RECOVERY USING TERMINAL EMULATOR
This is a simpler and faster way to flash my cwm touch recovery, without needing a PC/Laptop.
Install one of free terminal emulators from Google Play Store.
Here are a couple of options:
ConnectBot
Android Terminal Emulator
Providing you already copied "cwm-recovery-p9514.img" to your tablet, skip this step. If not, look at the previous steps.
Open the terminal emulator app and insert these lines:
Code:
su
mount -o rw,remount /system
dd if=/sdcard/download/cwm-recovery-p9514.img of=/dev/block/mmcblk0p1
To restore your original recovery:
Code:
su
mount -o rw,remount /system
dd if=/sdcard/download/original-recovery-p9514.img of=/dev/block/mmcblk0p1
USING CWM TOUCH RECOVERY
To enter cwm recovery mode press hard buttons in combination: power off your tablet, press and hold VOLUME UP (PLUS) and press POWER. Once you see "Ota…" in the top left corner of the display, quickly press:
1X VOLUME DOWN (MINUS),
2X VOLUME UP (PLUS),
1X VOLUME DOWN (MINUS).
You will see the counter go to 4 and cwm recovery will start.
For a more practical access to the recovery, use this app: Quick Reboot.
Make a backup of your rom as soon as possible, to save your data.
Please do not attempt to flash any zip files using this recovery. You may damage your tablet in doing so.
"Wipe cache partition", "wipe dalvik cache" and "fix permissions" are safe processes, but use "wipe data/factory reset" only when needed.
ADDITIONAL INFORMATION
NOTE: I will leave older versions of cwm touch recovery available, should you have any problems with newer ones.
This guide wouldn't be possible, without the help from guys on http://www.avi-plus.com, Yves & Micky.
XDA:DevDB Information
[RECOVERY]CWM Touch 6.0.2.8 for MEDION LIFETAB P9514 [25.2.2013], ROM for the Android General
Contributors
MMWolverine
ROM OS Version: 2.3.x Gingerbread
Version Information
Status: Testing
Created 2015-02-04
Last Updated 2015-11-01

Briliant! Just found out, that there is CWM for my "old" P9514 ... great work!
Hope there will be some Custom-ROMs soon; maybe on CM basis - the Stock ROM is not that what I would call "well".

d3rm1k said:
Briliant! Just found out, that there is CWM for my "old" P9514 ... great work!
Hope there will be some Custom-ROMs soon; maybe on CM basis - the Stock ROM is not that what I would call "well".
Click to expand...
Click to collapse
Thanks! Actually not to difficult making a cwm recovery, but when it comes to custom roms I'm still a bit of a noobie. I am learning fast though, so maybe in the near future.
Oh btw, here's the recovery guide in german language: http://www.handy-faq.de/forum/medio...on_lifetab_p9514_13_1_2013_a.html#post2385512

Yes, I know. Because of that German post I searched here, hoping that there already might be a Custom ROM.
But I only have a LogIn here and not the muse to sign up at handy-faq.de, yet

Many thanks for this cwm, the installation worked like a charm.
One small remark, to enter cwm you have to hold the Volume Up (Plus) and Power button. You could perhaps change this in your guide (it is correctly in the guide in german language)
I have translated your guide to Dutch on my blog, I'll hope it's no prob:
http://blog.johanvanbogaert.be/2013/02/clockworkmod-voor-de-medion-lifetab.html
Rgrds Johan

Jopeke said:
Many thanks for this cwm, the installation worked like a charm.
One small remark, to enter cwm you have to hold the Volume Up (Plus) and Power button. You could perhaps change this in your guide (it is correctly in the guide in german language)
I have translated your guide to Dutch on my blog, I'll hope it's no prob:
http://blog.johanvanbogaert.be/2013/02/clockworkmod-voor-de-medion-lifetab.html
Rgrds Johan
Click to expand...
Click to collapse
Thanks for notifying me about the mistake, I already corrected it.
I updated the cwm to newest 6.0.2.8 and will change the adb drivers part of the guide, as some users have difficulties understanding it.
I see no problem that you translated my guide, after all it's from different sources and made to be used for free.

MMWolverine said:
Thanks for notifying me about the mistake, I already corrected it.
I updated the cwm to newest 6.0.2.8 and will change the adb drivers part of the guide, as some users have difficulties understanding it.
I see no problem that you translated my guide, after all it's from different sources and made to be used for free.
Click to expand...
Click to collapse
Hi MMWolverine, already flashed v6.0.2.8, only took a minute.
I've updated my own blog as well.
Instead of using adb it is much easier to use a terminal emulator (like ConnectBot) on Android todo the update.
To install cwm someone only needs his tablet, ConnectBot and ES File Explorer. No PC, adb, usb connection necessary for flashing cwm.
If someone has rooted his lifetab, your guide is more then easy to understand to do this installation.
But if you don't wan't to use a PC for flashing the following is possible: From the lifetab download the zip, extract with ES File Explorer,Flash with ConnectBot (only the 3 last commands from your guide are necessary: su,mount..., dd....)

Actually, I did plan to do both guides. But I wasn't sure how many people would agree to install the terminal. Will probably do this, as you recommend.
I was also hoping, that the recovery would be uploaded to Rom manager app. Says on recovery maker website, that you need to be the device owner. Medion still isn't added to device list.

I have checked ROM Manager before doing the installation manually, its a pitty its not jet implemented in ROM Manager. But the installation is quit straight forward.
If someone is ever making a custom ROM for the LifeTab P9514, please implement USB OTG, because thats an option I'm waiting for.

Great that you added the instructions todo the installation through a terminal emulator on Android. Just one remark, the adb shell command can be removed while using a terminal on Android.

What happens if you try to flash a zip with CWM? Why doesn't it work and what would break?

You need a properly written updater-script. If a zip isn't compatible, you will only get an error, but nothing will be changed.

Do you know if the CM10 based ROM that works on the P9516 would work on the P9514 too?
Thanks

The answer is no. CM roms are hardware based and if you would flash p9516 rom on p9514 it wouldn't even boot.

lost p9514 Stock rom
Hi together!
I have a problem! I want to get back to unrooted original stock rom in lifetab p9514.
Somehow, dont ask me how, I lost the backed up version.
Is there a possibility to download such rom - I couldnt find anything!
Thanks in advance!
W

wfmagic said:
Hi together!
I have a problem! I want to get back to unrooted original stock rom in lifetab p9514.
Somehow, dont ask me how, I lost the backed up version.
Is there a possibility to download such rom - I couldnt find anything!
Thanks in advance!
W
Click to expand...
Click to collapse
Hello,
you can get official rom by typing in your MSN number (written on the back of your tablet): http://www.medion.com/de/service/download/software.php
And I have a mirror here: http://www.mediafire.com/download/xi5b93rj55bc0e7/Lifetab_p9514.20120719.2-ICS-signed-ota-update.zip
Hope that helps.

works like a charm!
I love this Forum - thank you very much!

[Q] Can my TF700T be fixed? SOLVED

Hello All,
This is my first post to the Forum. With that said I have been a long time follower of many of you. You have helped me learn a great deal and I have since unlocked, and flashed several ROMS to my TF700T. With that said I couldn’t find an answer to my dilemma and to be honest I don’t know how I got to where the current state of my tablet is.
As not to bore you all here is the short version. I was in the process of flashing the ZOMBi-POP-5.1.1_B2_omni_tf700t-KANG_signed ROM through TWRP v2.8.6.0. I made the mistake of picking up my sick toddler and putting here in my lap. While the tablet was running I was reading an article on the forum. My little princess hit something on the tablet and poof my tablet seems FUBAR!
I can get into TWRP if I flash it to my device via a command line on pc. If I try to reboot device it goes into a boot loop TWRP flashing every 5-10 seconds. I reflashed it and was able to get TWRP to load correctly. I am on bootloader version “US_epad-10.6.1.14.10-20130801”. I tried flashing a different Kernel (10.6.1.14.4-that2) in my forum reading to fix my issue. I can use some fastboot command to send files to my TF700T.
I get the following errors looking at the terminal window in TWRP
E:Unable to find partition size for ‘/misc’
E:Unable to find partition size for ‘/staging’
Erimary block device ‘/dev/block/mmcblk0p8’ for mount point ‘/data’ is not present!
E:Unable to mount ‘/data’
E:Unable to recreate /data/media folder.
E:Unable to find partition sixe for ‘/recovery’
E:Unable to find partition size for ‘/boot’
Updating partition details
E:Unable to mount ‘/system’
E:Unable to mount ‘/cache’
E:Unable to mount ‘/data’
… done
E:Unable to mount storage
E:Unable to mount /data/media during GUI startup.
E:Unable to mount ‘/cache’
Kernel does not have support for reading SELinux contexts.
E:Unable to mount ‘/cache’
E:Unable to set emmc bootloader message.
E:Unable to mount ‘cache’
E:Unable to mount /data/media/TWRP/.twrps when trying to read settings file.
E:Unable to mount ‘/data’
MTP enabled
Is my tablet now a paperweight or is there something I can do to resurrect it and try Zombi-POP? I hope I gave you enough information. If you need anything else let me know and I will see if I can get it.
Thank you in advance for your help.

You should have adb access in recovery. Run this command:
Code:
adb shell ls -l /dev/block/mmc*
and post the output.
I suspect you have to rebuild the partition table. Fortunately @_that provided a fastboot flashable blob here: http://forum.xda-developers.com/showpost.php?p=55166540&postcount=33
Read the whole thread though
Edit: And TWRP 2.8.6.0 may have a reboot bug. Use the official 2.8.4 or lj's Kang: http://forum.xda-developers.com/tra...overy-kang-twrp-tf700t-2-8-x-xarea51-t3049395

berndblb said:
You should have adb access in recovery. Run this command:
Code:
adb shell ls -l /dev/block/mmc*
and post the output.
I suspect you have to rebuild the partition table. Fortunately @_that provided a fastboot flashable blob here: http://forum.xda-developers.com/showpost.php?p=55166540&postcount=33
Read the whole thread though
Edit: And TWRP 2.8.6.0 may have a reboot bug. Use the official 2.8.4 or lj's Kang: http://forum.xda-developers.com/tra...overy-kang-twrp-tf700t-2-8-x-xarea51-t3049395
Click to expand...
Click to collapse
berndblb,
Thank you for the quick response. I ran the command as you said and here are my results:
C:\adb>adb shell ls -l /dev/block/mmc*
error: device not found
So I ran the fastboot command and found device
C:\adb>fastboot devices
015d2a50885c220f fastboot
I tried it as well in the terminal command through TWRP after getting the version you suggested and it said sh: adb: not found
any other suggestions?
I also ran the PT.blob file you linked to and it showed the status bar on the screen it loaded but no dice either. After I rebooted device and I get the same thing with TWRP v2.8.4. It just reboots screen every 5-10 seconds.

Ok, we need to backtrack a little. That command is supposed to be run from your computer through adb with the tablet booted to recovery.
You say that TWRP reboots every few seconds, but you also say that you used terminal in TWRP. Can you boot into TWRP??
If you can boot into it: What do you get with
Code:
adb devices
?
To check if the tablet can see your partitions, in terminal try
Code:
cat /proc/partitions

berndblb said:
Ok, we need to backtrack a little. That command is supposed to be run from your computer through adb with the tablet booted to recovery.
You say that TWRP reboots every few seconds, but you also say that you used terminal in TWRP. Can you boot into TWRP??
If you can boot into it: What do you get with
Code:
adb devices
?
To check if the tablet can see your partitions, in terminal try
Code:
cat /proc/partitions
Click to expand...
Click to collapse
I believe I may not be explaining it correctly. I booted my tablet up power + volume down key. Once I get to screen with 3 options in center and shows bootloader version. From here I plugged in my tablet to my pc and opened a command line, went to my adb folder and ran the code you suggested. Is this the correct steps or do I need to be in TWRP to run these commands?
I need to flash TWRP every time I reboot my tablet. If I do not it will cycle not find my OS and reboot into TWRP logo screen. This screen will just flash every 5-10 seconds. From here I can reboot with power + volume down get to the bootloader screen and then flash TWRP and reboot into it and it will work for that 1 time.
In TWRP terminal I get:
CODE
Adb devices
Sh: adb: not found
Code
Cat /proc/partitions
Cat can’t open /proc/partitions: No such file or directory
With TWRP on tablet screen I ran the codes you suggested via command line on PC with these results
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\adb>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
C:\adb>cat /proc/partitions
'cat' is not recognized as an internal or external command,
operable program or batch file.
C:\adb>

Ok we got to back up even more. You are confusing adb and terminal commands which are two different shoes.
You use adb to connect to your tablet from your PC when
a) the tablet is booted into Android or
b) the tablet is booted into recovery
You check the connection with 'adb devices'
Booted into recovery the return under "List of devices attached" should be something like: 1234567abcdsefg recovery
If you have an adb connection (and you need to have the correct drivers installed on your PC) you can run adb commands or connect to the tablet in an adb shell.
The command I posted earlier is a shell command. So the tablet needs to be in recovery to run that command.
Another way to manipulate your tablet is in Terminal, which is build into TWRP. The 'cat /proc/.." command is a terminal command.
And then there's fastboot which you use when the tablet is in the bootloader and fastboot mode.
Each tool is used for different things, so you cannot run fastboot commands in adb or terminal commands in adb and vice versa.
So before you do anything else let's try to get a clearer picture:
To flash the recovery you are using this command??
Code:
fastboot flash recovery <name_of_file>
Get into recovery.
Then EITHER connect to it in adb and run the adb shell command OR use the terminal in TWRP to run the cat / proc command.
Post the output.
Since it's easier to cut/paste from the cmd window on your PC or take a PrintScreen I think it's best if you use adb shell.

berndblb said:
Ok we got to back up even more. You are confusing adb and terminal commands which are two different shoes.
You use adb to connect to your tablet from your PC when
a) the tablet is booted into Android or
b) the tablet is booted into recovery
You check the connection with 'adb devices'
Booted into recovery the return under "List of devices attached" should be something like: 1234567abcdsefg recovery
If you have an adb connection (and you need to have the correct drivers installed on your PC) you can run adb commands or connect to the tablet in an adb shell.
The command I posted earlier is a shell command. So the tablet needs to be in recovery to run that command.
Another way to manipulate your tablet is in Terminal, which is build into TWRP. The 'cat /proc/.." command is a terminal command.
And then there's fastboot which you use when the tablet is in the bootloader and fastboot mode.
Each tool is used for different things, so you cannot run fastboot commands in adb or terminal commands in adb and vice versa.
So before you do anything else let's try to get a clearer picture:
To flash the recovery you are using this command??
Code:
fastboot flash recovery <name_of_file>
Get into recovery.
Then EITHER connect to it in adb and run the adb shell command OR use the terminal in TWRP to run the cat / proc command.
Post the output.
Since it's easier to cut/paste from the cmd window on your PC or take a PrintScreen I think it's best if you use adb shell.
Click to expand...
Click to collapse
Here is the results from using a command line on pc in recovery/adb.
C:\adb>adb devices
List of devices attached
0123456789ABCDEF recovery
C:\adb>cat /proc/partitions
'cat' is not recognized as an internal or external command,
operable program or batch file.
C:\adb>
Yes that is the code I used to flash recovery to my tablet. I used the program by Snoop05 from here http://forum.xda-developers.com/showthread.php?t=2588979 to load ADB and Fastboot onto my pc.

You are still running a terminal command in adb. That won't work... Read my last post again.
Run the adb shell command instead.

berndblb said:
You are still running a terminal command in adb. That won't work... Read my last post again.
Run the adb shell command instead.
Click to expand...
Click to collapse
My fault I failed to read your post correctly
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I am not sure if you can read the jpeg but the result is
adb shell ls -1 /dev/block/mmc*
ls: Unknown option '-1'. Aborting.

DELS71 said:
My fault I failed to read your post correctly
Click to expand...
Click to collapse
Indeed. The character after "-" should be the same as the one before "s". Not "1".

_that said:
Indeed. The character after "-" should be the same as the one before "s". Not "1".
Click to expand...
Click to collapse

DELS71 said:
View attachment 3351047
Click to expand...
Click to collapse
Reboot TWRP, then run this:
Code:
adb shell dmesg > dmesg.txt
Post the created file.

_that said:
Reboot TWRP, then run this:
Code:
adb shell dmesg > dmesg.txt
Post the created file.
Click to expand...
Click to collapse
View attachment dmesg.txt
I wasn't sure if this was proper way. I can post actual file in field if necessary.

DELS71 said:
View attachment 3351150
I wasn't sure if this was proper way. I can post actual file in field if necessary.
Click to expand...
Click to collapse
Code:
<6>[ 5.046834] mmcblk0: mmc0:0001 HYNIX 29.6 GiB
...
<6>[ 5.050342] mmcblk0: unknown partition table
Looks like your partition table got lost. Are you sure you flashed the partition table correctly using fastboot? http://forum.xda-developers.com/showpost.php?p=55166540&postcount=33

_that said:
Indeed. The character after "-" should be the same as the one before "s". Not "1".
Click to expand...
Click to collapse
Berndblb
THANK YOU THANK YOU THANK YOU!!! You save me with your skills. I was able to follow the steps and get back into TWRP after loading the PT.blob file without issue. I believe you were correct in going to 2.8.4. It did not refresh every few seconds. I loaded the files from my sd card and now have a working Zombi-POP tablet again. I really appreciate the help. If I can comment on your efficiency and help show me the link and I will.
Again I really appreciate the time and effort.

DELS71 said:
Berndblb
THANK YOU THANK YOU THANK YOU!!! You save me with your skills. I was able to follow the steps and get back into TWRP after loading the PT.blob file without issue. I believe you were correct in going to 2.8.4. It did not refresh every few seconds. I loaded the files from my sd card and now have a working Zombi-POP tablet again. I really appreciate the help. If I can comment on your efficiency and help show me the link and I will.
Again I really appreciate the time and effort.
Click to expand...
Click to collapse
Great to see you are up and running .... :good:
Can you add 'SOLVED' to the tread title ....
Thx Josh

For the record: the problem was that DELS71 flashed TWRP right after plashing the pt.blob - without rebooting in between. The rest of the conversation is here: http://forum.xda-developers.com/showpost.php?p=61217933&postcount=36

[CLOSED][SCRIPT][LINUX] Mount System as read write (Android 10+)

This Linux-only version is pretty much deprecated at this point. Please use the BRAND NEW UNIVERSAL VERSION instead! Thank you.
Ladies and gentlemen. Let me present to you my very first release here at the XDA forums:
Welcome to:
makeSystemRW v1.04
automated bash script by lebigmac for Android 10 and above​Creation date: February 2021
Updated: March 2021
Requirements:​
LINUX ONLY!
Android 10 or newer
This version only supports devices with super image.
Check if you have super by running ls -Alg /dev/block/by-name
phone must be rooted + bootloader unlocked + 10 GB free space on phone
at least 20 GB free space on computer for dumping data
adb and fastboot commands should be in your $PATH environment variable
I'm not 100% sure if this is a necessary requirement but I also disabled dm-verity and verification on my device just in case by simply booting into TWRP and then executing these 2 commands:
Code:
adb disable-verity
adb shell avbctl disable-verification
Description: A script for all Android power users that wish to make their read-only Android 10+ system read-write-able again to remove bloatware and make more thorough customizations to their device.
In a nutshell this is what the script is doing:
dumps your existing super image to your pc
extracts the embedded read-only partitions (system, vendor, product, etc...)
makes these partitions read-write-able
joins everything back together to new flashable super.img
flashes it to device
User data is not affected.
Usage: Simply call the script from the shell.
Optional arguments (replace x with your custom value) :
in=x : With this flag you can specify an existing super.img and skip the entire dumping of the super image process. Here you can use the super_original.img which you dumped earlier with makesysrw or the official super.img from your downloaded firmware. You probably have to unsparse the official super.img first using the included simg2img tool for superunpack to recognize it properly. If omitted, makesysrw will dump super image from phone to ./super_original.img
out=x : With this argument you can specify the output path. If omitted, default output value is ./super_fixed.img
size=x : With this parameter you can specify the extra free space (in megabytes) that will be added to each partition. If omitted, default extra size is 0 (shrink to minimum)
Examples:
Code:
# Run this command if you're first time user:
# Specify the extra free space in megabytes for each partition:
./makesysrw.sh size=100
# Plug an existing raw super image into the script like this:
./makesysrw.sh in=./super_original_raw.img size=100
# Specify both the input file as well as the output destination:
./makesysrw.sh in=./super_original_raw.img out=./super_fixed.img size=100
# For unsparsing the (sparse) super.img from your phone manufacturer's firmware you can do:
./tools/bin/simg2img ./super_sparse.img ./super_raw.img
NOTE: I did not come up with all this by myself. After searching for a solution for countless days without success, going even as far as learning hex editing - I coincidentally came across a couple of very interesting threads burried deep inside the new forum interface where this technique has been described and discussed by various enthousiasts (links can be found below in the credits section). So I take absolutely no credit for the underlying core mechanisms of the script. I'm only the amateur who put it all together into a compact script so that everybody can enjoy an Android system that's read-write-able again. Just like it used to be in Android 9 or earlier. Before this annoying 'shared_blocks feature' was implemented.
Credits: Big thanks to @munjeni for allowing me to use his amazing superunpack tool instead of the default lpunpack. Source code can be found here.
Also big thanks to @Brepro1 without your awesome tutorial guiding me I couldn't have created this script.
Thanks @AndyYan your interesting thread also helped me a lot for automating the script especially the lpdump part.
More thanks @gabrielfrias for his helpful comment
Thanks @YOisuPU and of course @topjohnwu for discovering the 'shared_blocks feature'
Thanks @bynarie for making available his otatools package! A part of it is now bundled with the archive
Disclaimer: This is open source software and is provided as is without any kind of warranty or support whatsoever. By using and viewing this software you agree to the following terms:
Under no circumstances shall the author be held responsible for any damages or negative consequences that may arrise from the (inappropriate) use of this software.
All responsibility and liability lies with the end-user. You hereby agree not to abuse this software for illegal purposes. Use this software at your own risk!
Please feel free to improve this script as you see fit (as long as you don't add anything malicious)
and make sure to post your feedback, suggestions and improvements in the official thread right here.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Mod Edit: Download link removed
Please click my like button below if you like it! Thanks​

It would be very helpful if you guys could please give me some feedback if the script works for you.
Which device are you using?
Your Android version?
Did you disable dm-verity and verification before running the script?
Your suggestions to enhance the script. Remember this is only version 1.0
Thanks!
@thor_1979

Great work! Your donation to the developers community is awesome.
The script works perfectly.
Consider keeping going.

Are you serious it actually works on your device? lmao
Congratulations. You are the first person to try it
The script pretty much does the same thing as your awesome tutorial describes.
Without your tutorial this script would not exist so thank you very much for making it available!

How do I use it? I'm really wanting to make my system rw again and this is perfect but how do I use it? It's a tar and Xz?

Simply extract the downloaded archive and open a terminal shell in the extracted folder by right clicking inside it and select Open in Terminal
Then run this command if you're running it for the first time
Code:
./makesysrw.sh size=100
or this command if you already have your raw super.img file
Code:
./makesysrw.sh in=./existing_super_image.img size=100
If you can't launch the script file make sure it is executable on your computer.

I really don't understand how this works why do you need the storage space is it making a system img that you than flash? I thought it just makes the current system read writable so you can install and uninstall system apps.

lebigmac said:
Simply extract the downloaded archive and open a terminal shell in the extracted folder by right clicking inside it and select Open in Terminal
Then run this command if you're running it for the first time
Code:
./makesysrw.sh
or this command if you already have your super.img file
Code:
./makesysrw.sh existing_super_image.img
If you can't launch the script file make sure it is executable on your computer.
Click to expand...
Click to collapse
Thanks I'm supposed to run the shell from my pc terminal or on the android device?

Sorry I see its for linux users. Ok now im getting it I have ubuntu 14 on my hard drive but I need to reinstall the grub menu because I deleted it or something. I have a s10 lite and tab S6 I would love to make the writable on the system so does this make a backup or dump of your system and than you flash it? Do you guys think thatll work on one ui 2.5 and im on lineage 18.1 on my s10 lite

Well in a nutshell this is what the script is doing:
dumps your existing super image to your pc
extracts the embedded read-only partitions (system, vendor, product, etc...)
makes these partitions read-write-able
joins everything back together to new flashable super.img
flashes it to device
User data is not affected.
The script is telling you exactly what's happening under the hood. You can also check out the source code if you have any doubts.
Yes this version of the script is supposed to be run on a Linux computer.
Please report back if it works for you or not.
Lineage OS? Doesn't that have a read-write-able system by default? In that case the script will likely fail.
Please keep in mind this script has been developed on Android 10 (Xiaomi X3 NFC) with a system that's read-only.

lebigmac said:
Well in a nutshell the script dumps your existing super image to your pc.
And then modifies the files to make everything read write able and then flashes back to the device. User data is not affected.
The script is telling you exactly what's happening under the hood. You can also check out the source code if you have any doubts.
Yes the script is supposed to be run on the computer
Please report back if it works for you or not.
Lineage OS? Doesn't that already come with read-write-able system by default? In that case the script will likely fail.
Please keep in mind this script has been developped on Android 10 MIUI 12 (Xiaomi X3 NFC) with a system that's read-only and embedded in a super image.
Click to expand...
Click to collapse
Honestly Im not a 100 percent sure anymore. I know it's a super img and it's really different in twrp there's a ton of new partitions and you have to wipe it off completely to flash a new system. I really haven't dug to deep into everything because I know that S6 oneui isn't writable and actually upset me because it's not like having full root access anymore.

For Windows users with TWRP.
(This is more like a reference)
From adb shell inside twrp.
X = Partition. To find out what block partition is mounted at, mount it in twrp then run 'df -h'.
e2fsck -f /dev/block/dm-x
resize2fs /dev/block/dm-x 3G
e2fsck -E unshare_blocks /dev/block/dm-x
Now reboot to fastbootd and execute:
fastboot resize-logical-partition <partition_slot> $((3*1024*1024*1024))

Thank you for the script.
When I read that I could use it with the super.img I guessed the usage was like
./makesysrw.sh image.img super_edited.img
I have a linux partition, but on a remote server and I was hoping to use it on the file and get my edited file from the server without putting the phone in the server..
Let me knowif you add something like that(-i and -o flags will be useful)
Best

Lossyx said:
For Windows users with TWRP.
(This is more like a reference)
From adb shell inside twrp.
X = Partition. To find out what block partition is mounted at, mount it in twrp then run 'df -h'.
e2fsck -f /dev/block/dm-x
resize2fs /dev/block/dm-x 3G
e2fsck -E unshare_blocks /dev/block/dm-x
Now reboot to fastbootd and execute:
fastboot resize-logical-partition <partition_slot> $((3*1024*1024*1024))
Click to expand...
Click to collapse
As much as I wish for a solution to be available to our fellow Windows users,
unfortunately your suggestion doesn't work here on my device see screenshot below.

lebigmac said:
As much as I wish for a solution to be available to our fellow Windows users,
unfortunately your suggestion doesn't work here on my device see screenshow below.
View attachment 5236719
Click to expand...
Click to collapse
Yeah. These dynamic partitions are weird, because for some reason I only managed to do this on slot A. And only did it on the vendor partition.
Also, this is the reference i was going by;
https://twitter.com/i/web/status/1260577424418488324

lebigmac said:
As much as I wish for a solution to be available to our fellow Windows users,
unfortunately your suggestion doesn't work here on my device see screenshow below.
View attachment 5236719
Click to expand...
Click to collapse
I think the problem is that you are requesting too large amount of memory try to replace 3G with smaller amount of memory

If anybody is good with creating flashable zips contact me! Need help working on universal version right now which will also be compatible with Windows and Mac users!
I am only amateur so need a real pro to give me some assistance here. Thank you.

Redmi note 9 pro. EU 12.0.2 rom. Android 10. It works. I installed WMware Workstation on a virtual machine in Windows. Thanks.(Google translate, sorry)

I can confirm that it works pềctly on my Pixel 4 XL Android 11 (coral-rq2a.210305.006) and Android 10 (coral-qq3a.200805.001), thank you for your awesome hard work!

Tried it on my Oneplus 7T Pro with Android 10. It extracted the superimage but failed at writing it back. It returned this error:
Code:
error: file_write: write: No space left on device
lpmake E 03-02 21:41:55 76867 76867 images.cpp:468] [liblp]sparse_file_write failed with code: -1
lpmake E 03-02 21:41:55 76867 76867 images.cpp:326] [liblp]Could not open image for partition: product_a
makesysrw: Error! failed to create super_fixed.img file./makesysrw.sh super_image.img 14.21s user 37.28s system 51% cpu 1:40.46 total
Any ideas? Thank you for your great work!