Database Info

[SOLVED] Unyaffs and system.img

Hi,
I have made a backup of 3 mtd block of my Telechips Android stick. This runs on Android 4.0.4 with a tcc8920st. The NAND images are boot.img recovery.img and system.img
(system.img is Yaffs2 fs like /data and /cache)
The mtd's are as follow:
[email protected]:# cat /proc/mtd
dev: size erasesize name
mtd0: 00a00000 00200000 "boot"
mtd1: 00600000 00200000 "kpanic"
mtd2: 12c00000 00200000 "system"
mtd3: 00400000 00200000 "splash"
mtd4: 09600000 00200000 "cache"
mtd5: 4c000000 00200000 "userdata"
mtd6: 00a00000 00200000 "recovery"
mtd7: 00200000 00200000 "misc"
mtd8: 00200000 00200000 "tcc"
Click to expand...
Click to collapse
I made a backup using the dd method:
dd if=/dev/mtd/mtd0 of=/sdcard/boot.img -bs=4096
dd if=/dev/mtd/mtd2 of=/sdcard/system.img -bs=4096
dd if=/dev/mtd/mtd6 of=/sdcard/recovery.img -bs=4096
Boot and recovery flash back without problem (both 10 Mb). However system.img won't.
(I use fastboot.exe and the device supports fastboot)
After reboot the /system partition is empty.
The yaffs info of the working system is:
Code:
[email protected]:# cat /proc/yaffs
YAFFS built:Aug 10 2012 15:20:29
Device 0 "system"
start_block........... 0
end_block............. 149
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 44
blocks_in_checkpt..... 1
n_tnodes.............. 2627
n_obj................. 1038
n_free_chunks......... 11364
n_page_writes......... 0
n_page_reads.......... 27991
n_erasures............ 0
n_gc_copies........... 0
all_gcs............... 0
passive_gc_count...... 0
oldest_dirty_gc_count. 0
n_gc_blocks........... 0
bg_gcs................ 0
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 24839
n_deleted_files....... 0
n_unlinked_files...... 0
refresh_count......... 0
n_bg_deletions........ 0
Device 2 "userdata"
start_block........... 0
end_block............. 607
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 419
blocks_in_checkpt..... 0
n_tnodes.............. 3511
n_obj................. 2358
n_free_chunks......... 123583
n_page_writes......... 6923
n_page_reads.......... 21678
n_erasures............ 28
n_gc_copies........... 3655
all_gcs............... 743
passive_gc_count...... 743
oldest_dirty_gc_count. 27
n_gc_blocks........... 29
bg_gcs................ 29
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 15682
n_deleted_files....... 0
n_unlinked_files...... 571
refresh_count......... 0
n_bg_deletions........ 0
Device 4 "cache"
start_block........... 0
end_block............. 74
total_bytes_per_chunk. 8192
use_nand_ecc.......... 1
no_tags_ecc........... 1
is_yaffs2............. 1
inband_tags........... 0
empty_lost_n_found.... 0
disable_lazy_load..... 0
refresh_period........ 0
n_caches.............. 10
n_reserved_blocks..... 5
always_check_erased... 0
data_bytes_per_chunk.. 8192
chunk_grp_bits........ 0
chunk_grp_size........ 1
n_erased_blocks....... 74
blocks_in_checkpt..... 0
n_tnodes.............. 24
n_obj................. 35
n_free_chunks......... 19143
n_page_writes......... 32
n_page_reads.......... 35
n_erasures............ 1
n_gc_copies........... 0
all_gcs............... 0
passive_gc_count...... 0
oldest_dirty_gc_count. 0
n_gc_blocks........... 0
bg_gcs................ 0
n_retired_writes...... 0
n_retired_blocks...... 0
n_ecc_fixed........... 0
n_ecc_unfixed......... 0
n_tags_ecc_fixed...... 0
n_tags_ecc_unfixed.... 0
cache_hits............ 10
n_deleted_files....... 0
n_unlinked_files...... 43
refresh_count......... 0
n_bg_deletions........ 0
All unyaffs and unyaffs2 tools crash on linus and windows. Then I ran into Yaffey windows tool (http://code.google.com/p/yaffey/). Allthough the tool doesn't really work on these system.img files it comes up with an interesting warning message:
Incomplete page found at the end of file (see picture in attachement)
That is the cause of my problem. I have other system.img that does flash with fastboot.exe into the device and that system.img does not give that message in Yaffey.
What does dd do (with -bs=4096) at the end of mtd blocks? Does it dump until the bitter end of the mtd block? What is missing at the end of my system.img Yaffs2 file? Some more FF's? How much more?
My system.img is 300 Mb (300x1024x1024=314.572.800 bytes) Divided by the dd bs of 4096 that would give exactly 76800 blocks. No halve blocks or so.
Still Yaffey says something is missing. And I think there is too. Another proper Yaffs2 system.img also has only FF's at the end. Perhaps the answer is in the /proc/yaffs file from above.
EDIT: must be a footer problem (not everything is dd-ed!) See second picture for proper footer. My system.img has only FF's.
Now how to reconstruct that footer? How many Chuncks per Block? 11364/44=256/257/258/259
With 256(?) chunks/block and 150 blocks and 8192 bytes/chunk: 314.572.800 = 300 Mb that would make sense.
Cheers

try an ext4 and see what results you have
from what i know on ics are use only ext4 partitions.
therefore also your system.img should ext4
upload`it somewhere and share it.
also give some more infos about tablet, processor/ram

Thanks for your answer. But i'm afraid we need a yaffs/yaffs2 file expert here.
Doesn't the Android SDK provide these tools? (I don't have them here now)
Look at the /proc/yaffs file I posted. Device 0 is /system.
The dd command just didn't copy everything. It is missing the last few kb.
I should have made a Nandroid backup.
Cheers

I solved the problem. From another user (thanx) I got the original /system partition in tar format, containing the proper owner en permissions on all the files)
Then in Unbuntu (on Virtualbox) I used the precompiled tccutils (attached)
With unyaffs -d <another system.img> I found this info:
Detected flash layout(s):
-c 8 -s 256 : chunk size = 8K, spare size = 256, no bad block info (-c 8 meaning 8Kb)
From Unbuntu (after unpacking the sytem.tar I was sent with tar xvfp system.tar) I then recreated the yaffs2 NAND flash file with:
sudo ./mkyaffs2image -c 8192 -s 256 system /mnt/temp/system_new.img
After that the image was fastboot ready and compatible with my device.
fastboot flash system system_new.img
The device is a m2b 8Gb HDMI Android TV stcik with ICS ( Telechips tcc8925)
More info: http://club.dx.com/forums/forums.dx/threadid.1227447
The original (recontructed) firmware and tools to create your firmware:
m2b original (fastboot) firmware and tools
Also the better know CX-01 stick can use the SYSTEM.IMG, not the boot/recovery of the m2b!!
Cheers

tweakradje said:
I solved the problem. From another user (thanx) I got the original /system partition in tar format, containing the proper owner en permissions on all the files)
Then in Unbuntu (on Virtualbox) I used the precompiled tccutils (attached)
With unyaffs -d <another system.img> I found this info:
Detected flash layout(s):
-c 8 -s 256 : chunk size = 8K, spare size = 256, no bad block info (-c 8 meaning 8Kb)
From Unbuntu (after unpacking the sytem.tar I was sent with tar xvfp system.tar) I then recreated the yaffs2 NAND flash file with:
sudo ./mkyaffs2image -c 8192 -s 256 system /mnt/temp/system_new.img
After that the image was fastboot ready and compatible with my device.
fastboot flash system system_new.img
The device is a m2b 8Gb HDMI Android TV stcik with ICS ( Telechips tcc8925)
More info: http://club.dx.com/forums/forums.dx/threadid.1227447
The original (recontructed) firmware and tools to create your firmware:
m2b original (fastboot) firmware and tools
Also the better know CX-01 stick can use the SYSTEM.IMG, not the boot/recovery of the m2b!!
Cheers
Click to expand...
Click to collapse
hi.
i have the same pb.. and i am trying ur solution but i m getting error.. can u pls help me abut it..?
sudo: ./mkyaffs2image: command not found..
with superuser;
bash: ./mkyaffs2imageermission denied..

[Q] xt925 Encryption Unsuccessful - cannot flash

So a year or so ago I flashed up to 4.1.2 (FIDO) on the phone and all worked fine.
Now the phone wont boot, all I get is Encryption Unsuccessful screen. I have tried reFlashing FIDO, and Stock 4.0.4 but RSDlite just throws a message saying "FAIL" - I think is due to a Partition problem. I have access to the Boot menu (10.9B), I have tried wiping the Cache and factory reset - Nothing.
Any Ideas how I can fix the partition and re Flash a ROM?

Have a came error too.
is0lde said:
So a year or so ago I flashed up to 4.1.2 (FIDO) on the phone and all worked fine.
Now the phone wont boot, all I get is Encryption Unsuccessful screen. I have tried reFlashing FIDO, and Stock 4.0.4 but RSDlite just throws a message saying "FAIL" - I think is due to a Partition problem. I have access to the Boot menu (10.9B), I have tried wiping the Cache and factory reset - Nothing.
Any Ideas how I can fix the partition and re Flash a ROM?
Click to expand...
Click to collapse
Waiting for an answer too.
---------- Post added at 11:13 AM ---------- Previous post was at 10:48 AM ----------
KisL said:
Waiting for an answer too.
Click to expand...
Click to collapse
cat /proc/partitions
major minor #blocks name
179 0 15388672 mmcblk0
179 1 102400 mmcblk0p1
179 2 1500 mmcblk0p2
179 3 1500 mmcblk0p3
179 4 512 mmcblk0p4
179 5 256 mmcblk0p5
179 6 140 mmcblk0p6
179 7 192 mmcblk0p7
179 8 512 mmcblk0p8
179 9 4 mmcblk0p9
179 10 1500 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 1500 mmcblk0p12
179 13 500 mmcblk0p13
179 14 500 mmcblk0p14
179 15 512 mmcblk0p15
179 16 1632 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 3072 mmcblk0p18
179 19 2048 mmcblk0p19
179 20 640 mmcblk0p20
179 21 8 mmcblk0p21
179 22 8192 mmcblk0p22
179 23 8 mmcblk0p23
179 24 3072 mmcblk0p24
179 25 1024 mmcblk0p25
179 26 512 mmcblk0p26
179 27 3072 mmcblk0p27
179 28 128 mmcblk0p28
179 29 4096 mmcblk0p29
179 30 512 mmcblk0p30
179 31 10240 mmcblk0p31
259 0 10240 mmcblk0p32
259 1 8192 mmcblk0p33
259 2 138754 mmcblk0p34
259 3 786432 mmcblk0p35
259 4 1523712 mmcblk0p36
259 5 153600 mmcblk0p37
259 6 12608751 mmcblk0p38
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 421180 48 421132 0% /dev
~ # cat /proc/mounts
cat /proc/mounts
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
~ # mount /system
mount /system
~ # cat /proc/mounts
cat /proc/mounts
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 rw,relatime,user_xatt
r,barrier=1,data=ordered 0 0
mount /data
mount: mounting /dev/block/platform/msm_sdcc.1/by-name/userdata on /data failed:
Invalid argument

please help
KisL said:
Waiting for an answer too.
---------- Post added at 11:13 AM ---------- Previous post was at 10:48 AM ----------
cat /proc/partitions
major minor #blocks name
179 0 15388672 mmcblk0
179 1 102400 mmcblk0p1
179 2 1500 mmcblk0p2
179 3 1500 mmcblk0p3
179 4 512 mmcblk0p4
179 5 256 mmcblk0p5
179 6 140 mmcblk0p6
179 7 192 mmcblk0p7
179 8 512 mmcblk0p8
179 9 4 mmcblk0p9
179 10 1500 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 1500 mmcblk0p12
179 13 500 mmcblk0p13
179 14 500 mmcblk0p14
179 15 512 mmcblk0p15
179 16 1632 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 3072 mmcblk0p18
179 19 2048 mmcblk0p19
179 20 640 mmcblk0p20
179 21 8 mmcblk0p21
179 22 8192 mmcblk0p22
179 23 8 mmcblk0p23
179 24 3072 mmcblk0p24
179 25 1024 mmcblk0p25
179 26 512 mmcblk0p26
179 27 3072 mmcblk0p27
179 28 128 mmcblk0p28
179 29 4096 mmcblk0p29
179 30 512 mmcblk0p30
179 31 10240 mmcblk0p31
259 0 10240 mmcblk0p32
259 1 8192 mmcblk0p33
259 2 138754 mmcblk0p34
259 3 786432 mmcblk0p35
259 4 1523712 mmcblk0p36
259 5 153600 mmcblk0p37
259 6 12608751 mmcblk0p38
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 421180 48 421132 0% /dev
~ # cat /proc/mounts
cat /proc/mounts
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
~ # mount /system
mount /system
~ # cat /proc/mounts
cat /proc/mounts
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 rw,relatime,user_xatt
r,barrier=1,data=ordered 0 0
mount /data
mount: mounting /dev/block/platform/msm_sdcc.1/by-name/userdata on /data failed:
Invalid argument
Click to expand...
Click to collapse
Any ideas? In Russia no Motorola service. I read about this problem on another phones. It can be crashed internal storage, but why in ADB i can see partitions? How to format all internal storage and parted it like a stock?

My FIDO XT925 also had this problem suddenly. From what I have found so far I have tried to use the stock recovery (hold vol +/- then power button,white menu will pop up, follow the instructions and select recovery with vol +), to update to Jelly bean but that is not working. I have also tried RSD Lite 6 and the flash process always fails to verify even after I modified the xml file. I'm pretty stuck at this point as well, hoping someone can help.

Bumping this. Just happened to my XT925 a day ago. Was working fine, last thing I noticed was googleservices crashing (with the OK button that was stuck in an infinite loop) so I had to hard-shut it off..
Was rooted since last year, but nothing odd happening recently, seemed totally random.. Also did the above, nothing seems to be working, is it bricked?
Also, any way to recover the internal SD card contents?

Weaponx525 said:
My FIDO XT925 also had this problem suddenly. From what I have found so far I have tried to use the stock recovery (hold vol +/- then power button,white menu will pop up, follow the instructions and select recovery with vol +), to update to Jelly bean but that is not working. I have also tried RSD Lite 6 and the flash process always fails to verify even after I modified the xml file. I'm pretty stuck at this point as well, hoping someone can help.
Click to expand...
Click to collapse
Gloomfrost said:
Bumping this. Just happened to my XT925 a day ago. Was working fine, last thing I noticed was googleservices crashing (with the OK button that was stuck in an infinite loop) so I had to hard-shut it off..
Was rooted since last year, but nothing odd happening recently, seemed totally random.. Also did the above, nothing seems to be working, is it bricked?
Also, any way to recover the internal SD card contents?
Click to expand...
Click to collapse
i dont know if i can help, but partition errors need to be fixed with moto fastboot. no other solution will work.
there are a couple of ways to go about this.
1. get moto fastboot and your stock file (if it doesnt contain a partition file your stuck, some do some dont)
flash each partition manually with mfastboot command starting with the partition file (important you flash the partition file first).
2. grab my "script" from the dev forum. make sure you get the "gpt fix" version. DO NOT USE THE SCRIPT AS IS, IT IS FOR 926 ONLY.
you can either:
A. run your commands from that folder as it already has the required moto fastboot.
or
B. delete all the 926 files from that folder
drop in all of your phones files and edit the "win batch file" file to fix any file name mismatches (you only need to flash the partitions i have listed, dont bother adding any more)
i dont recall if i left the "-w" command in there. that is the data wipe command. remove this line entirely if you want to try and keep data.
not sure if this will help, but if you have partition issues, these are the only ways to fix it.

bweN diorD said:
i dont know if i can help, but partition errors need to be fixed with moto fastboot. no other solution will work.
there are a couple of ways to go about this.
1. get moto fastboot and your stock file (if it doesnt contain a partition file your stuck, some do some dont)
flash each partition manually with mfastboot command starting with the partition file (important you flash the partition file first).
2. grab my "script" from the dev forum. make sure you get the "gpt fix" version. DO NOT USE THE SCRIPT AS IS, IT IS FOR 926 ONLY.
you can either:
A. run your commands from that folder as it already has the required moto fastboot.
or
B. delete all the 926 files from that folder
drop in all of your phones files and edit the "xml" file to fix any file name mismatches (you only need to flash the partitions i have listed, dont bother adding any more)
i dont recall if i left the "-w" command in there. that is the data wipe command. remove this line entirely if you want to try and keep data.
not sure if this will help, but if you have partition issues, these are the only ways to fix it.
Click to expand...
Click to collapse
Thanks, can I run some links by you to make sure I'm using the right stuff?
Moto fastboot: http://forum.xda-developers.com/showthread.php?t=1953948
Stock file: http://sbf.droid-developers.org/phone.php?device=6 - Should I use 4.0.4 or 4.1.2? I was on 4.1.2 OTA.
How do you mean flash each partition manually?
2. http://forum.xda-developers.com/showthread.php?t=2474393, downloading the "GPT error fix - Mirror 1" correct?
Is it step 1 OR step 2? Seems like you said you already have the moto fastboot in your link.. Also, what XT926 files are there to delete?

Gloomfrost said:
Thanks, can I run some links by you to make sure I'm using the right stuff?
Moto fastboot: http://forum.xda-developers.com/showthread.php?t=1953948
Stock file: http://sbf.droid-developers.org/phone.php?device=6 - Should I use 4.0.4 or 4.1.2? I was on 4.1.2 OTA.
How do you mean flash each partition manually?
2. http://forum.xda-developers.com/showthread.php?t=2474393, downloading the "GPT error fix - Mirror 1" correct?
Is it step 1 OR step 2? Seems like you said you already have the moto fastboot in your link.. Also, what XT926 files are there to delete?
Click to expand...
Click to collapse
m fastboot (check)
stock file (you have to use one = to or higher than the one currently installed. so 404 is a no)
flash manually (open a command prompt where you have mfastboot saved, connect your phone in fastboot, also make sure you have all of your stock files in the same dir as mfastboot, flash each partition using the mfastboot command and your correct file name. it would be easier if you look at the win batch file file in my gpt script for the proper commands to send rather than me trying to explain it. you will send the commands exactly as i have them in the batch file only correcting for file names and wait for each to finish, make sure its finished some take a bit of time like system.)
gpt utility (check)
step 1 or 2 (some people are lazy (not you obviously and wont go find mfastboot, so i only mentioned it is in my script for convenience)
what 926 files (just delete everything but the mfastboot.exe and the batch file file. all the other files you wont need or can use.
if you want, i can quickly upload the batch file file so you dont have to dl all that just for one file, and you can get the mfastboot from the other thread you posted.
---------- Post added at 06:05 PM ---------- Previous post was at 06:03 PM ----------
Gloomfrost said:
Thanks, can I run some links by you to make sure I'm using the right stuff?
Moto fastboot: http://forum.xda-developers.com/showthread.php?t=1953948
Stock file: http://sbf.droid-developers.org/phone.php?device=6 - Should I use 4.0.4 or 4.1.2? I was on 4.1.2 OTA.
How do you mean flash each partition manually?
2. http://forum.xda-developers.com/showthread.php?t=2474393, downloading the "GPT error fix - Mirror 1" correct?
Is it step 1 OR step 2? Seems like you said you already have the moto fastboot in your link.. Also, what XT926 files are there to delete?
Click to expand...
Click to collapse
OMG, i think my head is up my arse.
you dont want the xml file, you want the windows batch file. let me go edit those post grrrrr
---------- Post added at 06:11 PM ---------- Previous post was at 06:05 PM ----------
Gloomfrost said:
Thanks, can I run some links by you to make sure I'm using the right stuff?
Moto fastboot: http://forum.xda-developers.com/showthread.php?t=1953948
Stock file: http://sbf.droid-developers.org/phone.php?device=6 - Should I use 4.0.4 or 4.1.2? I was on 4.1.2 OTA.
How do you mean flash each partition manually?
2. http://forum.xda-developers.com/showthread.php?t=2474393, downloading the "GPT error fix - Mirror 1" correct?
Is it step 1 OR step 2? Seems like you said you already have the moto fastboot in your link.. Also, what XT926 files are there to delete?
Click to expand...
Click to collapse
ok here are the exact commands (just fix your file name as needed)
mfastboot flash partition gpt_main0.bin
mfastboot flash system system.img.ext4
mfastboot flash boot boot.img
mfastboot -w (this can be omitted if you want to try and save data)
mfastboot flash modem NON-HLOS.bin
mfastboot erase modemst1
mfastboot erase modemst2
mfastboot flash fsg fsg.mbn
mfastboot reboot

bweN diorD said:
m fastboot (check)
stock file (you have to use one = to or higher than the one currently installed. so 404 is a no)
flash manually (open a command prompt where you have mfastboot saved, connect your phone in fastboot, also make sure you have all of your stock files in the same dir as mfastboot, flash each partition using the mfastboot command and your correct file name. it would be easier if you look at the win batch file file in my gpt script for the proper commands to send rather than me trying to explain it. you will send the commands exactly as i have them in the batch file only correcting for file names and wait for each to finish, make sure its finished some take a bit of time like system.)
gpt utility (check)
step 1 or 2 (some people are lazy (not you obviously and wont go find mfastboot, so i only mentioned it is in my script for convenience)
what 926 files (just delete everything but the mfastboot.exe and the batch file file. all the other files you wont need or can use.
if you want, i can quickly upload the batch file file so you dont have to dl all that just for one file, and you can get the mfastboot from the other thread you posted.
---------- Post added at 06:05 PM ---------- Previous post was at 06:03 PM ----------
OMG, i think my head is up my arse.
you dont want the xml file, you want the windows batch file. let me go edit those post grrrrr
---------- Post added at 06:11 PM ---------- Previous post was at 06:05 PM ----------
ok here are the exact commands (just fix your file name as needed)
mfastboot flash partition gpt_main0.bin
mfastboot flash system system.img.ext4
mfastboot flash boot boot.img
mfastboot -w (this can be omitted if you want to try and save data)
mfastboot flash modem NON-HLOS.bin
mfastboot erase modemst1
mfastboot erase modemst2
mfastboot flash fsg fsg.mbn
mfastboot reboot
Click to expand...
Click to collapse
Okay thanks. I downloaded your GPT fix, deleted everything inside except mfastboot.exe and the batch file. Then I downloaded the 4.1.2 from sbf and extracted everything inside your utility folder. However, I'm not seeing file extensions.. what's up with that? Like, no bin, no .ext4? I downloaded the Android 4.1.2
Blur_Version.98.21.122002.XT925.RCI.en.CA
I'm going to assume it won't work unless they have file extensions..
Also, if I'll be running mfastboot manually using cmd prompt, why do I need the batch file? --EDIT: Nevermind, you want me to replace what it says with what you wrote here. Gotcha. What do you mean then by 'just fix your file name as needed' - You mean like if the 4.1.2 thing has 'fsg_signed' I should use that in the batch file correct?
Btw sorry, new user limits, have to wait 5 min before edits heh.. =|

Gloomfrost said:
Okay thanks. I downloaded your GPT fix, deleted everything inside except mfastboot.exe and the batch file. Then I downloaded the 4.1.2 from sbf and extracted everything inside your utility folder. However, I'm not seeing file extensions.. what's up with that? Like, no bin, no .ext4? I downloaded the Android 4.1.2
Blur_Version.98.21.122002.XT925.RCI.en.CA
I'm going to assume it won't work unless they have file extensions..
Also, if I'll be running mfastboot manually using cmd prompt, why do I need the batch file?
Click to expand...
Click to collapse
i dont know actually, it might work. you could try going to control panel/folder option/view/hide extensions for known file types and check or uncheck and see if it fixes the issue.
you dont, it was more of a guide assuming you didnt know the sequence and proper commands. but since i posted that, there is no reason if you want to do it manually.
---------- Post added at 06:29 PM ---------- Previous post was at 06:24 PM ----------
Gloomfrost said:
Okay thanks. I downloaded your GPT fix, deleted everything inside except mfastboot.exe and the batch file. Then I downloaded the 4.1.2 from sbf and extracted everything inside your utility folder. However, I'm not seeing file extensions.. what's up with that? Like, no bin, no .ext4? I downloaded the Android 4.1.2
Blur_Version.98.21.122002.XT925.RCI.en.CA
I'm going to assume it won't work unless they have file extensions..
Also, if I'll be running mfastboot manually using cmd prompt, why do I need the batch file? --EDIT: Nevermind, you want me to replace what it says with what you wrote here. Gotcha. What do you mean then by 'just fix your file name as needed' - You mean like if the 4.1.2 thing has 'fsg_signed' I should use that in the batch file correct?
Btw sorry, new user limits, have to wait 5 min before edits heh.. =|
Click to expand...
Click to collapse
no problem
yea if you want to use the batch file and have it do everything for you automatically, you likely would need to fix some file names as the ones in your stock file might not match the ones i have.
for instance
our partition file is: mfastboot flash partition gpt_main0.bin
but your file may be called partition.bin so you would have to change that line to
mfastboot flash partition partition.bin

bweN diorD said:
i dont know actually, it might work. you could try going to control panel/folder option/view/hide extensions for known file types and check or uncheck and see if it fixes the issue.
you dont, it was more of a guide assuming you didnt know the sequence and proper commands. but since i posted that, there is no reason if you want to do it manually.
---------- Post added at 06:29 PM ---------- Previous post was at 06:24 PM ----------
no problem
yea if you want to use the batch file and have it do everything for you automatically, you likely would need to fix some file names as the ones in your stock file might not match the ones i have.
for instance
our partition file is: mfastboot flash partition gpt_main0.bin
but your file may be called partition.bin so you would have to change that line to
mfastboot flash partition partition.bin
Click to expand...
Click to collapse
Okay so this is what I have now in the batch file, along with brackets for clarifications:
mfastboot flash partition partition_signed.bin
mfastboot flash system system_signed.img.ext4 (what extension should this have?)
mfastboot flash boot boot_signed.img
mfastboot -w
mfastboot flash modem_signed.bin
mfastboot erase modemst1 (leave this in even though I don't have any files like that in the package?)
mfastboot erase modemst2 (same as above?)
mfastboot flash fsg fsg_signed.mbn
mfastboot reboot
Should I take out all the extensions in the bat since that package file has none, or add them to the files as per above?

Gloomfrost said:
Okay so this is what I have now in the batch file, along with brackets for clarifications:
mfastboot flash partition partition_signed.bin
mfastboot flash system system_signed.img.ext4 (what extension should this have?) dont put an extension if your file states none, i think it will be fine
mfastboot flash boot boot.img
mfastboot -w delete this line if you want to try and save any data, i doubt either option will effect the success or failure of this mission but i would leave it in if you can
mfastboot flash modem NON-HLOS.bin (don't have anything like this in that package - should i remove this line?) doubt the modems were encrypted so delete this line
mfastboot erase modemst1 (left this in) delete this or you may have no modems, only because we arent re-writing them
mfastboot erase modemst2 (left this in) same as above
mfastboot flash fsg fsg_signed.mbn
mfastboot reboot
Should I take out all the extensions since that package file has none? no, just omit any that dont have extensions in your stock file. if we need to drop back and try another route, i would like to know that we tried the file names as you see them.
Click to expand...
Click to collapse
ok im going to go out on a limb here and make some edits above in red

bweN diorD said:
ok im going to go out on a limb here and make some edits above in red
Click to expand...
Click to collapse
Sorry I edited my previous message again - I have modem_signed. Leave that in instead of NON-HLOS?

Gloomfrost said:
Sorry I edited my previous message again - I have modem_signed. Leave that in instead of NON-HLOS?
Click to expand...
Click to collapse
thats kind of a catch 22, yea lets put that in but still remove the erase lines below it as you are writing the same modem.

bweN diorD said:
thats kind of a catch 22, yea lets put that in but still remove the erase lines below it as you are writing the same modem.
Click to expand...
Click to collapse
sending 'partition' (32 KB)...
OKAY [ 0.022s]
writing 'partition'...
This may take a few seconds, if a
different partition table is being
flashed since we need to backup
and restore a few partitions
Failed to program partition table
FAILED (remote failure)
finished. total time: 0.338s
sending 'system' (30720 KB)...
OKAY [ 2.348s]
writing 'system'...
Failed to erase partition
FAILED (remote failure)
finished. total time: 4.030s
sending 'boot' (10240 KB)...
OKAY [ 0.796s]
writing 'boot'...
Failed to erase partition
Failed to flash partition boot
FAILED (remote failure)
finished. total time: 1.544s
erasing 'userdata'...
Failed to erase partition
FAILED (remote failure)
finished. total time: 0.057s
unknown partition 'modem_signed'
error: cannot determine image filename for 'modem_signed'
sending 'fsg' (2849 KB)...
OKAY [ 0.236s]
writing 'fsg'...
Failed to erase partition
Failed to flash partition fsg
FAILED (remote failure)
finished. total time: 0.383s
rebooting...
finished. total time: 0.005s

Gloomfrost said:
sending 'partition' (32 KB)...
OKAY [ 0.022s]
writing 'partition'...
Click to expand...
Click to collapse
yea, that sucks.
im having the same problem over here.
i made this other user the same updated (not published) script, just because he has a 926, and i can share the script with anyone who needs it. (just to say, i know this is the only method, you are in a bad spot!)
anyways, its the same as you just made with the same results.
have a look to see if maybe one of the simple fixes (not yet confirmed or denied) helped this member.

I really appreciate the efforts here. When I can wrap my head around this I will try as well as post my results. I felt I had hit a brick wall last night and email Motorola Canada for tech support help..
Sent from my SM-N900W8 using Tapatalk

Weaponx525 said:
I really appreciate the efforts here. When I can wrap my head around this I will try as well as post my results. I felt I had hit a brick wall last night and email Motorola Canada for tech support help..
Sent from my SM-N900W8 using Tapatalk
Click to expand...
Click to collapse
Keep me posted on this if you don't mind - after maybe 18 hours at this, I'm going to give up
I find it interesting that I managed to unlock my bootloader (even though it still threw a FAILED (remote failure), but going into fastboot DOES say 'Unlocked Status Code: 3'
I also found some chinese forum where people were posting how to do stuff with fastboot oem codes, but if I do fastboot oem anything it just says 'Restricted oem code'. Meh.
Any new phone suggestions? Something that will hopefully last 2 days with battery like this one did.

Gloomfrost said:
Keep me posted on this if you don't mind - after maybe 18 hours at this, I'm going to give up
I find it interesting that I managed to unlock my bootloader (even though it still threw a FAILED (remote failure), but going into fastboot DOES say 'Unlocked Status Code: 3'
I also found some chinese forum where people were posting how to do stuff with fastboot oem codes, but if I do fastboot oem anything it just says 'Restricted oem code'. Meh.
Any new phone suggestions? Something that will hopefully last 2 days with battery like this one did.
Click to expand...
Click to collapse
I am personally trying harder than usual to fix this phone because the battery life is so awesome. It's still a great deal. I hear the Moto X gets pretty great battery life and its cheaper than Nexus 5 right now. Personally I would wait for the Nexus 6, which is rumored to be be built by Motorola.
I am trying to fix this phone for my wife. Personally I am using a Note 3: great big battery and screen but no loyalty to Samsung. If the Nexus 6 pops up I may not be able to resist
---------- Post added at 05:46 AM ---------- Previous post was at 05:39 AM ----------
I'm trying to keep this phone stock. However I am curious if using Fastboot to unlock and installing custom recovery can work with the partition as screwed up as it is. If so maybe with custom recovery we can properly format the partitions. Thoughts?

Weaponx525 said:
I am personally trying harder than usual to fix this phone because the battery life is so awesome. It's still a great deal. I hear the Moto X gets pretty great battery life and its cheaper than Nexus 5 right now. Personally I would wait for the Nexus 6, which is rumored to be be built by Motorola.
I am trying to fix this phone for my wife. Personally I am using a Note 3: great big battery and screen but no loyalty to Samsung. If the Nexus 6 pops up I may not be able to resist
---------- Post added at 05:46 AM ---------- Previous post was at 05:39 AM ----------
I'm trying to keep this phone stock. However I am curious if using Fastboot to unlock and installing custom recovery can work with the partition as screwed up as it is. If so maybe with custom recovery we can properly format the partitions. Thoughts?
Click to expand...
Click to collapse
After everything sane failed (trying to save the userdata, trying to keep stock), I tried flashing random stuff, including sideloading. Nothing worked. Even the 'unlock' like I said threw an error, though the device does say unlocked. If you manage to successfully install custom recovery please post back how.

Cannot Solve Bootloop TF700 with TWRP and KatKiss

Hi all,
I have tried to follow the instructions for fixing a bootloop here.
I am using Linux Mint 18.3 as my laptop OS.
I can push the bootit..ko file on to the device but when I run insmod I get this error message:
Code:
error: protocol fault (no status)
I think it is because TWRP crashes before the command can complete and the device starts rebooting.
I can see the device is connected on doing
Code:
adb devices
List of devices attached
015d29955b3ffe11 recovery
and I can even see the contents of the / directory:
Code:
blimey~/work/android_roms/recovery_images $ adb shell ls -ltr /
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
-rw-r--r-- 1 root root 4603 Jan 1 1970 ueventd.rc
-rw-r--r-- 1 root root 2520 Jan 1 1970 ueventd.cardhu.rc
drwxr-xr-x 5 root root 0 Jan 1 1970 twres
drwxr-xr-x 3 root root 0 Jan 1 1970 system
-rw-r--r-- 1 root root 9438 Jan 1 1970 service_contexts
-rw-r--r-- 1 root root 120253 Jan 1 1970 sepolicy
-rw-r--r-- 1 root root 52 Jan 1 1970 selinux_version
-rw-r--r-- 1 root root 578 Jan 1 1970 seapp_contexts
drwxr-x--- 2 root root 0 Jan 1 1970 sbin
drwxr-xr-x 3 root root 0 Jan 1 1970 res
-rw-r--r-- 1 root root 2920 Jan 1 1970 property_contexts
drwxr-xr-x 3 root root 0 Jan 1 1970 license
-rwxr-x--- 1 root root 1327 Jan 1 1970 init.recovery.usb.rc
-rwxr-x--- 1 root root 2814 Jan 1 1970 init.rc
-rwxr-x--- 1 root root 305668 Jan 1 1970 init
-rw-r----- 1 root root 1839 Jan 1 1970 fstab.cardhu
-rw-r--r-- 1 root root 11473 Jan 1 1970 file_contexts
-rw-r--r-- 1 root root 3044 Jan 1 1970 default.prop
drwxr-xr-x 2 root root 0 Jan 1 1970 data
lrwxrwxrwx 1 root root 13 Jan 1 1970 charger -> /sbin/healthd
dr-xr-xr-x 103 root root 0 Jan 1 1970 proc
drwxrwxr-x 2 root shell 60 Jan 8 01:17 tmp
drwxr-xr-x 13 root root 0 Jan 8 01:17 sys
drwxr-xr-x 2 root root 0 Jan 8 01:17 sideload
drwxr-xr-x 2 root root 0 Jan 8 01:17 recovery
drwxr-xr-x 11 root root 3500 Jan 8 01:17 dev
drwxr-xr-x 2 root root 0 Jan 8 01:17 boot
drwxrwxrwx 2 root root 0 Jan 8 01:17 sdcard
drwxr-xr-x 2 root root 0 Jan 8 01:17 etc
drwx------ 2 root root 0 Jan 1 2016 root
drwxrwx--- 6 system cache 4096 May 21 2017 cache
If I try to ls the file contents after pushing the bootit.ko file to check it has definitely been copied the TWRP always crashes before the command can complete (I'm guessing) and it reboots again ad infinitum.
I really don't know what else to try so any suggestions are real welcome. Thanks in advance.

Try adb shell insmod sdcard/bootit.ko

Wouldn't that entail pushing the bootit.ko to /sdcard?
I tried this:
Code:
[email protected] ~/work/android_roms/recovery_images $ adb push bootit.ko /sdcard/
672 KB/s (27690 bytes in 0.040s)
[email protected] ~/work/android_roms/recovery_images $ adb shell insmod /sdcard/bootit.ko
error: protocol fault (no status)
...but no joy, it seems like it exits TWRP before it can finish doing insmod. Also I'm not convinced the bootit.ko file is being saved to disk after each push. Am I right?

..

So I made a shell script to execute the two commands one after the other and I now got the screen with the 3 icons in the middle of the screen: RCK,Android,WipeData.
I did the following comands from that screen:
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[sudo] password for blimey:
015d29955b3ffe11 fastboot
[email protected]~/work/android_roms/recovery_images $ sudo fastboot erase misc
erasing 'misc'...
OKAY [ 1.044s]
finished. total time: 1.044s
[email protected]~/work/android_roms/recovery_images $ sudo fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 2.276s]
finished. total time: 2.276s
But after this when running fastboot devices I get no output:
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
I think the battery has died so I'll recharge and give it another go tomorrow.

Care to share the script?

berndblb said:
Care to share the script?
Click to expand...
Click to collapse
Sure - see attached file, just need .txt removed from the filename.

So I picked up where I left off and this what I got:
Code:
blimey~/work/android_roms/recovery_images $ sudo fastboot devices
015d29955b3ffe11 fastboot
blimey~/work/android_roms/recovery_images $ sudo fastboot erase system
******** Did you mean to fastboot format this partition?
erasing 'system'...
OKAY [ 2.813s]
finished. total time: 2.813s
blimey~/work/android_roms/recovery_images $ sudo fastboot erase recovery
erasing 'recovery'...
OKAY [ 1.970s]
finished. total time: 1.970s
blimey~/work/android_roms/recovery_images $ sudo fastboot -w
Creating filesystem with parameters:
Size: 61415620608
Block size: 4096
Blocks per group: 32768
Inodes per group: 8192
Inode size: 256
Journal blocks: 32768
Label:
Blocks: 14994048
Block groups: 458
Reserved block group size: 1024
Created filesystem with 11/3751936 inodes and 281560/14994048 blocks
Creating filesystem with parameters:
Size: 448790528
Block size: 4096
Blocks per group: 32768
Inodes per group: 6848
Inode size: 256
Journal blocks: 1712
Label:
Blocks: 109568
Block groups: 4
Reserved block group size: 31
Created filesystem with 11/27392 inodes and 3534/109568 blocks
erasing 'userdata'...
OKAY [ 88.674s]
sending 'userdata' (141163 KB)...
OKAY [ 24.116s]
writing 'userdata'...
OKAY [ 1.483s]
erasing 'cache'...
REBOOTED THE TABLET manually HERE as per the instructions
Code:
FAILED (command write failed (Protocol error))
finished. total time: 476.548s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase boot
erasing 'boot'...
OKAY [ 2.020s]
finished. total time: 2.020s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase misc
erasing 'misc'...
OKAY [ 1.007s]
finished. total time: 1.007s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 1.740s]
finished. total time: 1.740s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 flash system ./AsusFirmware/TF700K_all_WW_USER_V5.0.4.17.raw
erasing 'system'...
OKAY [ 2.411s]
sending 'system' (755707 KB)...
OKAY [125.324s]
writing 'system'...
OKAY [ 2.987s]
finished. total time: 130.722s
NO BLUE BAR OBSERVED ON TABLET
TABLET CONTINUES SHOWING THE 3 ICONS: RCK, ANDROID and WIPE DATA
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 reboot
rebooting...
Nothing happening, the tablet screen remains the same with the 3 icons.
Is the boot.blob file contained within TF700K_all_WW_USER_V5.0.4.17.raw?

I think this .raw file is the wrong file, I found a different file for my SKU on the Asus website which contains the contents in the attached screenshot. Is it blob or boot.img I should use?

Yes, flash the blob and only the blob, no extension on the file name. That should do it

So I tried that but I got this result:
Code:
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 flash system blob
erasing 'system'...
OKAY [ 2.313s]
sending 'system' (1781 KB)...
OKAY [ 1.121s]
writing 'system'...
FAILED (remote: (InvalidState))
finished. total time: 7.059s
The blue bar did appear this time but in addition to the error there is some red text in the top left corner saying "Signature mismatch"
I've googled for a solution, some people suggested here https://forum.xda-developers.com/showthread.php?t=2417097 that the system image might be the wrong version for this bootloader version (I think ).
So I downloaded the original version of the system image from http://drivers.softpedia.com/get/JOYSTICK-GAMEPAD-WHEELS-and-TABLETS/ASUS/ASUS-Transformer-Pad-Infinity-TF700T-Firmware-10611410-WW.shtml which matched the version number displayed in the bootloader and after flashing that blob hey presto its working again!!!:laugh::laugh::laugh:
Thanks a bloody million for your guidance and patience!!

(Q) fastboot zimage zImage

Hello,
I'm trying flash zImage, but get some erros:
$ fastboot flash zimage zImage
target didn't report max-download-size
sending 'zimage' (4370 KB)...
OKAY [ 0.427s]
writing 'zimage'...
FAILED (remote: partition table doesn't exist)
finished. total time: 0.482s
How to solve it?
Tks,
Demiank

demiank said:
Hello,
I'm trying flash zImage, but get some erros:
$ fastboot flash zimage zImage
target didn't report max-download-size
sending 'zimage' (4370 KB)...
OKAY [ 0.427s]
writing 'zimage'...
FAILED (remote: partition table doesn't exist)
finished. total time: 0.482s
How to solve it?
Tks,
Demiank
Click to expand...
Click to collapse
Which device is this? Also some theories.
- zimage isn't the name of the actual partition, cd to /dev/block/platform/xxxxx/by-name/ to see your list of partitions
- the image you're flashing doesn't have correct syntax. To fast via flashboot, the syntax is... fastboot flash (partition) (image) . So an example would be fastboot flash recovery twrp.img . You need to remember the file extension such as .img or whatever it is for your image. Also make sure you specify the directory such as fastboot flash recovery C:\Users\xxx\Downloads\twrp.img if you aren't in the current directory.

demiank said:
Hello,
I'm trying flash zImage, but get some erros:
$ fastboot flash zimage zImage
target didn't report max-download-size
sending 'zimage' (4370 KB)...
OKAY [ 0.427s]
writing 'zimage'...
FAILED (remote: partition table doesn't exist)
finished. total time: 0.482s
How to solve it?
Tks,
Demiank
Click to expand...
Click to collapse
zImage is a kernel file and it is in the boot.img. you have to unpack your boot.img and replace the existing zImage with new one and repack boot.img again.
Then flash through fastboot mode by "fastboot flash boot boot.img"
So, you want to flash it in boot partition.

The device is LG e615 (2012/2013 device). This don't have a boot partition. I just found a boot.img in cwm backup. The command " fastboot boot zImage" generate a boot.img file.

demiank said:
The device is LG e615 (2012/2013 device). This don't have a boot partition. I just found a boot.img in cwm backup. The command " fastboot boot zImage" generate a boot.img file.
Click to expand...
Click to collapse
$ fastboot boot zImage
creating boot image...
creating boot image - 4478976 bytes
Downloading 'boot.img' OKAY [ 0.416s]
booting OKAY [ 0.159s]
Finished. Total time: 0.650s
Device don't boot and lost fastboot connection;
[email protected]:/ $ cat /proc/partitions
major minor #blocks name
179 0 3817472 mmcblk0
179 1 20 mmcblk0p1
179 2 1003 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1 mmcblk0p4
179 5 4096 mmcblk0p5
179 6 4096 mmcblk0p6
179 7 4096 mmcblk0p7
179 8 24576 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 4096 mmcblk0p10
179 11 4096 mmcblk0p11
179 12 28672 mmcblk0p12
179 13 28672 mmcblk0p13
179 14 624640 mmcblk0p14
179 15 8192 mmcblk0p15
179 16 102400 mmcblk0p16
179 17 8192 mmcblk0p17
179 18 8192 mmcblk0p18
179 19 12288 mmcblk0p19
179 20 2823168 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 1024 mmcblk0p22
179 23 16384 mmcblk0p23
179 32 7761920 mmcblk1
179 33 7760896 mmcblk1p1
[email protected]:/ $ ls /
acct
cache
config
d
data
default.prop
dev
etc
fstab.m4ds
init
init.goldfish.rc
init.lge.early.rc
init.lge.rc
init.lge.usb.sh
init.m4ds.rc
init.m4ds.usb.rc
init.qcom.class_core.sh
init.qcom.class_main.sh
init.qcom.rc
init.qcom.ril.path.sh
init.qcom.sh
init.qcom.usb.rc
init.qcom.usb.sh
init.rc
init.target.rc
lgdms.fota.rc
lgdms.fota_update.rc
mnt
mpt
persist
persist-lg
proc
res
root
sbin
sdcard
storage
sys
system
ueventd.goldfish.rc
ueventd.m4ds.rc
ueventd.qcom.rc
ueventd.rc
vendor
[email protected]:/ # cat fstab.m4ds
# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
#TODO: Add 'check' as fs_mgr_flags with data partition.
# Currently we dont have e2fsck compiled. So fs check would failed.
#<src> <mnt_point> <type> <mnt_flags and options> <fs_mgr_flags>
#LGE chage partition
#/dev/block/platform/msm_sdcc.3/by-num/p12 /system ext4 ro,barrier=1 wait
#/dev/block/platform/msm_sdcc.3/by-num/p13 /data ext4 nosuid,nodev,barrier=1,noauto_da_alloc wait
#LGE_CHANGE_S [[email protected]] 20120926:Adding /data partition
/dev/block/platform/msm_sdcc.3/by-num/p14 /system ext4 ro,barrier=1,noatime wait
/dev/block/platform/msm_sdcc.3/by-num/p20 /data ext4 nosuid,nodev,noatime,barrier=1,noauto_da_alloc,errors=continue check
Where is my stock zImage or boot.img? How to flash this zImage after compile it following the LG readme.txt:
"2. Kernel Build
- Untar opensource packages of kernel.tar.gz using following command at the android folder
a)$tar xvzf kernel.tar.gz
- When you compile the kernel source code, you have to add google original prebuilt source(toolchain)
into the android folder.
- cd kernel
- export ARCH=arm
- export CROSS_COMPILE=../prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
- make m4-rev11_defconfig
- make zImage
3. After Build, You Can find the build image at arch/arm/boot"
Tks for all replies, but i don't understand how to flash my new kernel compiled by me.

[CLOSED]HaHaHack Dis: No Magisk REQUIRED!!!!

Magisk is no more...
I present a new fool proof method of flashing su to Android 10_Q and above!!
I ranted and ranted about variant=user/user-debug/eng builds that I got no-where... people thinkin am dissin john wu, nah, I respect what I've learnt from his app forcing me to connect online, I want su without connecting, in order to secure my own fone.
Introducing proof!!
Simple. Instead of flashing boot.img
Flash boot-debug.img from stock.
This address's the lack of adb root.
Logs:
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash vbmeta vb
lankmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.000s]
Writing 'vbmeta' OKAY [ 0.000s]
Finished. Total time: 0.016s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.515s]
Finished. Total time: 1.404s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
MyTwrp.img
Sending 'recovery' (26086 KB) OKAY [ 0.718s]
Writing 'recovery' OKAY [ 0.406s]
Finished. Total time: 1.139s
D:\0\AdbStation>fastboot reboot-recovery
Rebooting into recovery OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
adbd is already running as root
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # mount -o remount,rw /system_root
mount: '/system_root' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /system
mount: '/system' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /
'/dev/block/dm-1' is read-only
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # ls
acct d init.environ.rc metadata sbin
apex data init.rc mnt sdcard
bin debug_ramdisk init.usb.configfs.rc odm storage
bugreports default.prop init.usb.rc oem sys
cache dev init.zygote32.rc proc system
charger etc init.zygote64_32.rc product ueventd.rc
config init lost+found product_services vendor
Armor_X5_Q:/ # cd apex
Armor_X5_Q:/apex # ls
com.android.apex.cts.shim [email protected]
[email protected] com.android.resolv
com.android.conscrypt [email protected]
[email protected] com.android.runtime
com.android.media [email protected]
com.android.media.swcodec com.android.tzdata
[email protected] [email protected]
Armor_X5_Q:/apex # exit
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.577s]
Writing 'recovery' OKAY [ 0.312s]
Finished. Total time: 0.889s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # exit
------------------------
Pay attention, the first part above, I flashed a twrp...
Below, I flash stock images... without closing adb window.
--------------------------------------------------------------
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.499s]
Finished. Total time: 1.373s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.484s]
Writing 'recovery' OKAY [ 0.328s]
Finished. Total time: 0.811s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # exit
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # cd /system
Armor_X5_Q:/system # cd bin
Armor_X5_Q:/system/bin # ls
Edit'd not relevant.. too long the things we can do list pissed one off...
Armor_X5_Q:/system/bin #
No MORE MAGISK!!!
It'a a feature of Android 10 and over lol... says so in the android docs....
who needs su when you have root?
SYSTEM_AS_ROOT
Voila...
it's in the understanding.
YouRoot

1) what is this
2) you could've pastebin'd the log files bruh
{Mod edited language - Regards Oswald Boelcke}

I dont use pastebin. I wanted to post my proof here. My call. thanks for the suggestion though, I mean, why send a good hack to another site when I would not have found it if it were not for comin here?
Surely xda deserve some credit, which I give by posting my flashing log here...
I know all will find what I posted will work to write a ro system.
Su and Magisk ARE dead, john wu says so...
I say this is why.
Flash boot-debug.img instead of boot.img gives
adb root
adb shell
# <- the point of root!!!
Ps, I may be a bro to my 3 sister's, but I aint no bro... :O
I find what they cant see, because they gave away the sight to see, what I see, they no longer can
Until I light the way....

Pachacouti said:
I dont use pastebin. I wanted to post my proof here. My call. thanks for the suggestion though, I mean, why send a good hack to another site when I would not have found it if it were not for comin here?
Surely xda deserve some credit, which I give by posting my flashing log here...
I know all will find what I posted will work to write a ro system.
Su and Magisk ARE dead, john wu says so...
I say this is why.
Flash boot-debug.img instead of boot.img gives
adb root
adb shell
# <- the point of root!!!
Ps, I may be a bro to my 3 sister's, but I aint no bro... :O
I find what they cant see, because they gave away the sight to see, what I see, they no longer can
Until I light the way....
Click to expand...
Click to collapse
1. ROOT su binary is already included in GSI builds (original author is phhusson and not topjhonwu) since the begining of the project. It's not a new thing. Here Magisk came to Hide this feature !
2. Magisk doesn't give only ROOT ... but the "systemless option" for the dynamic modules that is the half part of the whole package !
3. Have you tested SafetyNet ???
4. TWRP is already a root method since you can access to /data partition and other partitions too !
5. Oh yeah, it looks like you have an old device without dynamic partitions (aka SUPER) ...
Cheers

im not using gsi, i'm using stock ma man, stock!
it's actually genuine root with stock!
Allbeit different from what we used to call root, it is ultimately a rooted boot-debug, as in:
#
Oh, for the record everyone, I'm on an A-only arm64-v8a Armor x5, the mt6762 which also claims to be mt6765, running lates updated Android 10_Q, no, NOT PIE. System-as-Root
and I would not be writtng in the system_1.32 thread if I did not have a super.img partition...
which I am currently flashing using nothing more than replacing my stock boot.img with the stock boot-debug.img, though I had to unlock bootloader to do this...
couldn't chmod the system_1.32 if the # did not show, true or false?
No Magisk... No su... the secret is in adb root not being available in user OR production builds, so use boot-debug.img to be able to type adb root to type adb shell to get #
No twrp. Stock recovery is not available, using boot-debug.img, so I flash twrp anyway.
Beat that!!!
You CANT, cause it's true... following magisk makes you think you need root when you were already given it in stock rom, (only viable if you see boot-debug.img beside your boot.img in stock folder), now if this is true, and obviously it is, then why did john wu not notice?
too busy waiting on me...
Time for a BIG update from magisk then? Not. (needed, pmsl)
Selfie Clappin Syndrome has left the buiding...
Ps, attempting magisk on boot-debug.img kills all adb and root access gained by not doing so.
I can and do flash my twrp, and have done so now, from lopstom into recovery, since normal stock recovery does NOT show when using boot-debug.img, and system_1.32 has just given me rw access in twrp, so systemrw actually works with no su or magisk installed.
On with testing...
And for the record, this is where I found out what you now know:
VTS testing with debug ramdisk | Android Open Source Project
source.android.com
works on Android 10_q stock, NOTE THIS IS FOR GSI ON ANDROID 11
Im on stock. nuff said.
Oh, look... debug vendor... debug... yum yum

Oh, and safety net pass's, because the debug is legit (stock boot-debug.img) lol, oh look, no magisk...

The downside is... I'm sitting with a completely rooted fone... with no root apps.
busybox is replaced with, yup, you guessed it, toybox! not by me, but comes as stock...
last I heard before discovering this was toybox IS the new busybox...
It's actually like linux without the 'custom' - in adb shell lol...
And it is indeed the desktop launcher kicking us out of writing to system in the first place, when rooting, since the desktop launcher cannot run root commands,, as it has no root rights. forcing PIE and earlier roots simply wont cut it...
I have to say it folks... upgrade...
And write some updated apps that dont hold us back!!
Oh, and I'd forget a ro system, cause even with systemrw, it's only in twrp it's of use to me, but cant save anything TO it, so kinda pointless to me for now... then I remind myself this is written for pie lol...
Edit, and I'll add this:
With only one phone to work on, so no experience in a/b partitioning, I'll assume (bein the mother of all f'up's lol) that the reason a/b partitions exist is because a pie bootloader is 2 bootloader's, split into 2 when remixed into android 10, seperating the pie users access to variant=eng being available, to having to flash boot-debug.img since windows 10.
Here's the kicker... I have yet ot flash any cusstom rom.
From stock I flash boot-debug.img, and twrp recovery, followed by the backup super_fixed.bin created by system_1.32, reboot into twrp and can instantly mount system/vendor as is expected of system_1.32, the script is only required once, if you make a back up that is...
Yet I cannot load any custom rom the usual way... twrp may show mounting system, but even when fastbooting TO system, in adb or twrp, I have to reflash a super, so forget writing overlay file systems pandering to big companies, write a writable system knowing it's all contained in a SUPER image using boot-debug as root scource.
I can however, flash a super and load an entirely different OS, rw across the board... if I flash a super.img
The kicker is having a completely new root that comes with the fone and how it works...
su is pointless, as is magisk, you are already root.
Get it?
magisk takes this away.
so if your on android 10 and over... forget magisk, load your boot-debug, and take control of your new root tool.
magisk cant see the countless other mount points made for each file for each app for each gif for each bit of binary, each has it's own mount point lol...
it's gettin that way
Final point. Open a folder, go INTO it, and run any exe. While exe is running, attempt to delete folder exe is contained in. Now you know why you cant write a ro system. Close the exe, and viola!!
You cant mount a folder you already occupy in gui of fone. Ahem.. remount /system.
It's like typing su to get #
forget su
#
The greatest trick is convincin people of security when there is in fact none when it comes to software.
Their greatest security is their idiocy.
The PARTITIONS of history have taught us not to doubt insanity and it's virtues...

And for problems mounting systemrw, no problem, no root!!
Android OverlayFS Integration with adb Remount

Thank you for your efforts in a root solution.

Usin the above convoluted method, I can indeed rw the ro system.
I deleted childspace apk as test. It worked.
Using only this order:
Place stock boot.img, recovery.img and boot-debug.img in the adb folder.
Also place your 'here's one I made earlier' magisk_patched_bootloader.img here.
Now the nippage:
1: Unlock stock bootloader. Reboot into bootloader, after granting adb keys.
2: Flash boot-debug - NOTHING ELSE.
3: Reboot into fone gui.
4: adb root
adb disable-verity
adb reboot - (boot into bootloader)
5: Flash magisk'd boot.img
6 (optional, I did this) Flash backed up Super_fixed.bin (had to rename to img)
7: flash twrp...
Now you can do what you want.
After this I removed the magisk'd bin, returned to my debug and the childspace app I removed stayed removed from a ro system.
So yeah, there's your door, blank vbmetas prevent rw access using this method. Use your real vbmeta when flashing boot-debug, boot debug will NOT work with magisk installed, I tried every utha way... all we really need is a nu su app that works using this method instead of simlinkin the heck out of ...
Now how to do this without the magisk step, and keep it..?
user-debug (are not user or debug img's, but the third lol)
Now they ARE hard to find, need to make one, not my cup of tea...

something to add..
Busybox 1.31 Install error on Android 9 -- SOLVED · Issue #93 · meefik/busybox
OK, I managed to solve the installation issue with Android 9 on the Samsung Galaxy Tab S6. Here's how I did it: root the tablet by installing twrp, dm_verity and magisk boot into Android install ro...
github.com

Hi Pachacouti. Thanks for your interest in my SystemRW project. I hope it was helpful to you.
Pachacouti said:
Oh, and safety net pass's, because the debug is legit (stock boot-debug.img) lol, oh look, no magisk...
Click to expand...
Click to collapse
Where can I find this stock boot-debug.img file that you're talking about? I can't find it inside my stock Xiaomi firmware (MIUI).
Pachacouti said:
system_1.32 has just given me rw access in twrp, so systemrw actually works with no su or magisk installed.
Click to expand...
Click to collapse
Yes that's true my SystemRW script should work regardless of whether Magisk is installed yet or not. All you need for it to work is a root shell in recovery.
Have fun!

lebigmac said:
Hi Pachacouti. Thanks for your interest in my SystemRW project. I hope it was helpful to you.
Where can I find this stock boot-debug.img file that you're talking about? I can't find it inside my stock Xiaomi firmware (MIUI).
Yes that's true my SystemRW script should work regardless of whether Magisk is installed yet or not. All you need for it to work is a root shell in recovery.
Have fun!
Click to expand...
Click to collapse
To answer your first question, take the boot-debug.img from here, the first you see, and try it. if it is the same size, it will most likely work
Be aware that this is a 32mb in size bootloader, others are 64mb, they obviously wont work.
This is not to say a 64mb boot-debug.img will NOT work, it simply wont FIT.
Then be aware of a/b or a-only.
If you check the first post, from where I flashed all stock, I flashed the boot-debug.img to boot, NOT recovery. I am attempting to create a working twrp'd version for my fone, but I'm too slow for the instant gratificationist in me lol... using stock vbmeta... in otherwords, it would work, cause it's all legit, and how android 10, 11, and 12 actually work.
I find your script is a perfect find to see if we can indeed write to anything, now how to move what access you have in twrp to include mounting these 3 partitions dm-1, 2, 3, while in the actual gui...
Again, if you cant get into recovery, flash twrp to recovery after flashing boot-debug.img, It does work, but I think settings in recovery are not needed when booted to boot-debug, so the recovery is actually not necessary, but we're used to it, so NEED...
Edit, here's my boot-debug, thought I was in another thread lol..
And FFS, DONT try magisk with this, root is destroyed when doing so, this is not me dissin john wu, it's google fighting back... respect da john wu saaaa
Ps, enjoy this misunderstanding:
I flashed and ran systemrw_1.32 with NO root, no twrp, no recovery, I did it all in adb using nothing but boot-debug.img flashed to boot, with legit vbmeta.
In user builds, flashing blank vbmetas is what actually cause's the inability to manipluate ro system.
At least since PIE. Android 10_q and over... different ball game.

Pachacouti said:
And for problems mounting systemrw, no problem, no root!!
Android OverlayFS Integration with adb Remount
Click to expand...
Click to collapse
forreal

Did you know....
A few years back, when alcohol 120% came out, I downloaded a dvd that turned out to be corrupt. The image supplied by Alcohol 120% always came with an mdf file, and the disk image itself. Mdf is actually the md5 hash of the dvd.
When attempting to burn disk, I accidently chose the mdf, (md5 hash) instead of the actual disk image, and it turned out that the mdf hash reproduced the disk image byte for byte.
In otherwords, the 4.7gig dvd image was never necessary. That's 4.7gig reproducable from an md5 hash of say 100kb in size.
Now imagine this in fones. Dont store the file, store it's hash.
The CIA hate me now...

Anyway, here is the process so far:
Grab the boot-debug.img below, if it works for you good.
From stock, unlocked bootloader, set adb keys:
fastboot flash boot boot-debug.img
fastboot reboot <- just to see what we got
adb root
adb disable-verity <- the proper way to disable verity. No blank vbmetas required.
adb reboot
adb wait-for-device
adb root
adb remount <- wont work, because boot-debug.img is not a user-debug version of boot-debug.img, so I need to use a magisk'd boot to gain 'other' access.. later...
Note: adb shell avbctl disable-verification is only available in user-debug builds, so instead of boot-debug.img, prob look like user-debug.img. Notice how I disable it below.
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img 2>nul >nul <- Notice how I flash genuine vbmeta, including the end part '2>nul >nul' to flash twrp to recovery. This clears the way to flash super without flashing blank vbmetas... this will reset when flashing stock boot, so no problem to a dev...
fastboot flash recovery MyTwrp.img (rebooted after just to make sure the recovery stayed after typing '2>nul >nul' after the vbmeta) -it stayed.
fastboot flash super super_fixed.img <- Same test as above, now reboot into twrp to test rw capabilities. Mine all working.
fastboot reboot-recovery <- Go immediately to mount, tick system and vendor, if tick stays, voila, mine stays ticked...
Do twrp test using adb:
adb shell
# mount -o rw,remount rootfs /
Find way to install su lol, this is where I'm at now.
Dont say install the killer of su...

I then do:
Armor_X5_Q:/ # ls -l `which su`
total 1608
dr-xr-xr-x 4 root root 0 2021-09-27 13:00 acct
drwxr-xr-x 2 root root 40 2021-09-27 13:00 apex
lrwxrwxrwx 1 root root 11 2021-09-10 01:30 bin -> /system/bin
lrwxrwxrwx 1 root root 50 2021-09-10 01:30 bugreports -> /data/use
r_de/0/com.android.shell/files/bugreports
drwxrwx--- 6 system cache 4096 2010-01-01 00:03 cache
lrwxrwxrwx 1 root root 19 2021-09-10 01:30 charger -> /system/bin/
charger
drwxr-xr-x 4 root root 0 1970-01-01 00:00 config
lrwxrwxrwx 1 root root 17 2021-09-10 01:30 d -> /sys/kernel/debug
drwxrwx--x 55 system system 4096 2021-09-27 12:25 data
drwxr-xr-x 2 root root 0 2021-09-10 01:30 debug_ramdisk
lrwxrwxrwx 1 root root 12 2021-09-10 01:30 default.prop -> prop.de
fault
drwxr-xr-x 19 root root 3540 2021-09-27 13:00 dev
lrwxrwxrwx 1 root root 11 2021-09-10 01:30 etc -> /system/etc
drwxrwxrwx 13 root root 32768 1970-01-01 00:00 external_sd
-rw-r--r-- 1 root root 46380 2021-09-10 01:34 file_contexts
-rw-r--r-- 1 root root 865607 2021-09-10 01:30 file_contexts.bin
lrwxrwxrwx 1 root root 16 2021-09-10 01:30 init -> /system/bin/ini
t
-rwxr-x--- 1 root root 7073 2021-09-10 01:30 init.rc
-rwxr-x--- 1 root root 103 2021-09-10 01:30 init.recovery.hlthchrg.
rc
-rwxr-x--- 1 root root 58 2021-09-10 01:30 init.recovery.ldconfig.
rc
-rwxr-x--- 1 root root 312 2021-09-10 01:30 init.recovery.logd.rc
-rwxr-x--- 1 root root 8824 2021-09-10 02:14 init.recovery.microtrus
t.rc
-rwxr-x--- 1 root root 3686 2021-09-10 02:00 init.recovery.mt6762.rc
-rwxrwx--- 1 root root 854 2021-08-28 14:20 init.recovery.prepdecry
pt.rc
-rwxr-x--- 1 root root 213 2021-09-10 01:30 init.recovery.service.r
c
-rwxr-x--- 1 root root 7862 2021-09-10 01:30 init.recovery.usb.rc
drwxr-xr-x 3 root root 0 2021-09-10 01:30 license
drwxr-xr-x 5 root system 100 2021-09-27 13:00 mnt
drwxrwx--x 6 system system 4096 2021-01-01 09:33 nvcfg
drwxrwx--x 8 root system 4096 2021-01-01 08:06 nvdata
drwxr-xr-x 2 root root 0 2021-09-10 01:30 odm
-rw-r--r-- 1 root root 0 2021-09-10 01:30 odm_file_contexts
-rw-r--r-- 1 root root 0 2021-09-10 01:30 odm_property_contexts
drwxr-xr-x 2 root root 0 2021-09-10 01:30 oem
drwxrwx--x 5 system system 4096 2021-01-01 09:33 persist
-rw-r--r-- 1 root root 32079 2021-09-10 01:30 plat_file_contexts
-rw-r--r-- 1 root root 9476 2021-09-10 01:30 plat_property_contexts
dr-xr-xr-x 359 root root 0 1970-01-01 00:00 proc
drwxr-xr-x 12 root root 4096 2009-01-01 00:00 product
-rw-r--r-- 1 root root 0 2021-09-10 01:30 product_file_contexts
-rw-r--r-- 1 root root 0 2021-09-10 01:30 product_property_contex
ts
lrwxrwxrwx 1 root root 24 2021-09-10 01:30 product_services -> /sy
stem/product_services
-rw-r--r-- 1 root root 7414 2021-09-10 01:48 prop.default
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_f
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_s
-rw-r--r-- 1 root root 0 2021-09-10 01:30 relink_binaries-timesta
mp
-rw-r--r-- 1 root root 0 2021-09-10 01:30 relink_libraries-timest
amp
drwxr-xr-x 3 root root 0 2021-09-10 01:30 res
drwx------ 2 root root 0 2020-06-05 06:41 root
drwxr-x--- 2 root root 0 2021-09-10 01:30 sbin
drwxrwx--- 13 media_rw media_rw 4096 2021-09-27 13:06 sdcard
-rw-r--r-- 1 root root 465178 2021-09-10 01:30 sepolicy
drwxr-xr-x 2 root root 0 2021-09-27 13:00 sideload
drwxr-x--x 2 root root 0 2021-09-10 01:30 storage
dr-xr-xr-x 14 root root 0 2021-09-27 13:00 sys
drwxr-xr-x 7 root root 0 2021-09-27 13:09 system
drwxr-xr-x 21 root root 4096 2009-01-01 00:00 system_root
drwxrwxr-x 2 root shell 120 2021-09-27 13:07 tmp
drwxr-xr-x 5 root root 0 2021-09-10 01:55 twres
-rw-r--r-- 1 root root 0 2021-09-10 01:30 twrp_ramdisk-timestamp
-rw-r--r-- 1 root root 5900 2021-09-10 02:03 ueventd.mt6762.rc
-rw-r--r-- 1 root root 2969 2021-09-10 02:02 ueventd.rc
drwxrwxrwx 2 root root 0 2021-09-27 13:01 usbotg
drwxr-xr-x 14 root shell 4096 2009-01-01 00:00 vendor
-rw-r--r-- 1 root root 7759 2021-09-10 01:30 vendor_file_contexts
-rw-r--r-- 1 root root 218 2021-09-10 01:30 vendor_property_context
s
-rw-r--r-- 1 root root 0 2021-09-10 01:30 vendor_service_contexts
Armor_X5_Q:/ #
Edit:
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_f
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_s
Why dm-1, 2, 3, cant be mounted even in root.

Pachacouti said:
Magisk is no more...
I present a new fool proof method of flashing su to Android 10_Q and above!!
I ranted and ranted about variant=user/user-debug/eng builds that I got no-where... people thinkin am dissin john wu, nah, I respect what I've learnt from his app forcing me to connect online, I want su without connecting, in order to secure my own fone.
Introducing proof!!
Simple. Instead of flashing boot.img
Flash boot-debug.img from stock.
This address's the lack of adb root.
Logs:
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash vbmeta vb
lankmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.000s]
Writing 'vbmeta' OKAY [ 0.000s]
Finished. Total time: 0.016s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.515s]
Finished. Total time: 1.404s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
MyTwrp.img
Sending 'recovery' (26086 KB) OKAY [ 0.718s]
Writing 'recovery' OKAY [ 0.406s]
Finished. Total time: 1.139s
D:\0\AdbStation>fastboot reboot-recovery
Rebooting into recovery OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
adbd is already running as root
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # mount -o remount,rw /system_root
mount: '/system_root' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /system
mount: '/system' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /
'/dev/block/dm-1' is read-only
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # ls
acct d init.environ.rc metadata sbin
apex data init.rc mnt sdcard
bin debug_ramdisk init.usb.configfs.rc odm storage
bugreports default.prop init.usb.rc oem sys
cache dev init.zygote32.rc proc system
charger etc init.zygote64_32.rc product ueventd.rc
config init lost+found product_services vendor
Armor_X5_Q:/ # cd apex
Armor_X5_Q:/apex # ls
com.android.apex.cts.shim [email protected]
[email protected] com.android.resolv
com.android.conscrypt [email protected]
[email protected] com.android.runtime
com.android.media [email protected]
com.android.media.swcodec com.android.tzdata
[email protected] [email protected]
Armor_X5_Q:/apex # exit
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.577s]
Writing 'recovery' OKAY [ 0.312s]
Finished. Total time: 0.889s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # exit
------------------------
Pay attention, the first part above, I flashed a twrp...
Below, I flash stock images... without closing adb window.
--------------------------------------------------------------
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.499s]
Finished. Total time: 1.373s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.484s]
Writing 'recovery' OKAY [ 0.328s]
Finished. Total time: 0.811s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # exit
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # cd /system
Armor_X5_Q:/system # cd bin
Armor_X5_Q:/system/bin # ls
Edit'd not relevant.. too long the things we can do list pissed one off...
Armor_X5_Q:/system/bin #
No MORE MAGISK!!!
It'a a feature of Android 10 and over lol... says so in the android docs....
who needs su when you have root?
SYSTEM_AS_ROOT
Voila...
it's in the understanding.
YouRoot
Click to expand...
Click to collapse
So, your bootloader is unlocked and your bootimage-debug gives root to you and the entire world. In other words, here is the key to my house, and by the way, there is no lock. And by another way, there will be nothing left in the house soon. Nice.

optimumpro said:
So, your bootloader is unlocked and your bootimage-debug gives root to you and the entire world. In other words, here is the key to my house, and by the way, there is no lock. And by another way, there will be nothing left in the house soon. Nice.
Click to expand...
Click to collapse
Oi... EVERY rooted fone has an unlocked bootloader, your point being?
Oh... I'm taking away profit from some... never noticed until you came along.. {Mod edit}
And you trust magisk... {Mod edit}
That would not tell you of THIS exploit:
{Mod edit: Disrespectful behaviour removed - Regards Oswald Boelcke}

Edit:
(Do all this offline... )
Flash magisk'd boot, but in gui, dont update internet, in fact, dont run it.
Install busybox-1.31.1-46.apk (do all this offline) but u cant install it yet, because magisk has no internet, but busybox will give you an option to install to, or edit the install.sh to say install dir / instead of /system, it did install what it could to the required directory, and if magisk'd bootloader grants su to busybox...
(it did in mine...) Reboot back into bootloader
Then reflash boot-debug.img, flash stock recovery, and reboot again, wot no magisk?
Now see:
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb remount
/system/bin/remount exited with status 2
remount failed
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
Armor_X5_Q:/ #
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb remount
/system/bin/remount exited with status 2
remount failed
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
Armor_X5_Q:/ # ^C
130|Armor_X5_Q:/ #
130|Armor_X5_Q:/ #
Notice it said nothing of user build or production build, and oh, you need to cntrl/c to exit this... then type exit... but notice who is logged in before :/
Su working in my fone, now to try with boot.img
Rememer: All stock