[Kernel] EFIDROID - Ultimate preboot enviroment! - Multiboot / Fastboot / UEFI - Galaxy Note 3 Android Development

updated4/4/2017 (Still does not work on stock 5.0) - Removed due to it still not booting stock 5.0, and ALSO now breaks booting unpatched.
twrp 3.1 is broken
twrp 2.7 is broken
twrp 3.0.1 works
some/most custom roms work
Most official/stock do not.
EFIDROID - Official link
Developer: m11kkaa
DO NOT BUG THE AUTHOR ABOUT BUGS/FEATURES, THIS IS UNOFFICIAL.
Most custom roms appear to boot
Install:​
assumes on stock firmware (Custom roms must report the DEVICEID as hlte, hltetmo, hltespr or hltevzw. Ask your Rom maintainer to correct it or visit post #51)
assumes root and bootloader unlocked
For now "efidroid" on playstore is not configured for our device, so we will do this using our own server:
Download "EFIDROID" from the playstore
Download "TerminalEmulator" from the playstore (or use adb shell)
Download "SimpleHTTPServer" from the playstore
NEW UNTESTED - Removed
OLD Download EFIDROID_SERVER_FILES from View attachment EFIDROID_SERVER_FILES.zip
Open and extract the "device" and "ota" folder to the INTERNAL storage of your phone
Open SimpleHTTPServer (do not change default settings)
Open Terminal Emulator and enter: (make sure you didn't forget any spaces)
su
setprop efidroid.server_url "http://localhost:12345"
Now open efidroid, it should automatically connect. Now press the menu key in the top left corner and press install, then press the big install button.
Now create your slot, and reboot.
Use the vol +/- to navigate up or down, use the power button to select an option
Long press power button on internal rom/recovery to boot without efidroid
Reinstalling/Updating:
Download the new OTAPACKAGE file and extract to INTERNALSD, replace old device/ota folders
Clear EFIDROIDMANAGER cache/data
Run the SETPROP command (don't forget su)
Turn on SimpleHTTPserver
Open efidroid and click uninstall, and then click install (Or click reinstall)
MAKE SURE YOUR BUILD DATE NOW MATCHES THE UPDATED BUILD DATE
Uninstall:
if you hit the uninstall button, the app copies the contents of the UEFIESP back to the real partitions and deletes the partition_*.img files. It does not delete the UEFIESP directory or any of the multiboot directories because they may contain other important files.
flashing boot+recovery outside of EFIDroid's control(e.g. using stock's fastboot/odin flash, or using unpatched boot) is pretty much the same as uninstalling efidroid without deleting the partition_*img files.
All that means that you don't have to worry about any of that if you restores your boot+recovery partitions(either through the app or manually). If you want to free up some space you can delete the UEFIESP directory using a root file manager.
Bugs/Issues:
REPORT ERRORS/BUG ON GITHUB
"can't find tagloader for type -1" - your recovery/rom is not supported (like twrp 3)
Report errors: https://github.com/efidroid/projectmanagement/issues
What you must include:
Exact steps to reproduce the error
Give the exact error shown on screen
If its storage related:
Give the output of "cat /proc/1/mountinfo"
EMERGENCY :
If you find yourself frustrated and just wanting things back the way they were:
Download odin
Download twrp (get the md5/tar version for odin)
Turn off phone (pull battery)
boot to download mode by holding vol down and home and power
Start up odin and press the AP button and browse for the TWRP file. Press start to flash.
Reboot phone into twrp recovery (vol up + home + power), and restore your boot/recovery partitions.
EFIDROID has now been effectively disabled[/HIDE]
Help and info:
If you are familiar with adding touchscreen support please visit us!
Join us on Slack : http://join-efidroid.rhcloud.com/
Once joined: https://efidroid.slack.com/
EFIDROID G+ page : https://plus.google.com/communities/...43671219382368
[/CENTER]

Works on N9005 LTE ?

It looks pretty cool but I've got limited knowledge. My N9005 is on phronesis rom v4.1, IdleKernel v6.6.5 and all partitions converted to F2FS, will it work on this format as well :/

As long as it is a note 3 on msm8974 (sorry exynos) it should work.
File system support should be trivial. I used that same FS myself

Is this an actual GRUB loader for android?
If so am ashuming this means it's possible for UNIX install
i.e. Arch Linux as OS.......

Hmmm.... Windows RT on Note 3... ^^
What about ACPI? We might need this for WinRT

With all due respect, I think you've posted a how to post bit earlier. I'm a flashaholic & the wait for the zip is killing me

I didn't think the day would come.
As a pleb, I will follow this thread with great interest.

djmalik420 said:
With all due respect, I think you've posted a how to post bit earlier. I'm a flashaholic & the wait for the zip is killing me
Click to expand...
Click to collapse
lololol

Wonder if this is ever going to work Great concept though.

Fake ¿ ???
Only what i see its a bootanimation, in the Video from a "older and other"

The OP account is suspended so I guess something fishy is going on.

Guess we will wait and see

oh come on now. I got suspended for being rude to a well respected member of xda. And its not fake... Really? Anyways... I took my ban as a break and just started back with m1cha on getting the uefi part to work with the screen.
A few pointers: You still need devs to port each os, like windows, true linux ect.
This is just a multiboot. So many devices lack that, some had safestrap, or kexec ect, but all those methods had quirks or special rules, or depended on android. This loads before even the kernel.
Also, it will have many tools that a typical recovery has, so you may not even need to reboot into recovery to setup partitions, also aroma was ported, so maybe even installing roms/kernels too.
Also, there will be an efidroid server "store" where you can get tools and apps to run in efidroid. So devs can extend functionality. Also there will be an android installer to make everything easier.
Just think of this as a pimped out safestrap.

SaschaElble said:
oh come on now. I got suspended for being rude to a well respected member of xda. And its not fake... Really? Anyways... I took my ban as a break and just started back with m1cha on getting the uefi part to work with the screen.
A few pointers: You still need devs to port each os, like windows, true linux ect.
This is just a multiboot. So many devices lack that, some had safestrap, or kexec ect, but all those methods had quirks or special rules, or depended on android. This loads before even the kernel.
Also, it will have many tools that a typical recovery has, so you may not even need to reboot into recovery to setup partitions, also aroma was ported, so maybe even installing roms/kernels too.
Also, there will be an efidroid server "store" where you can get tools and apps to run in efidroid. So devs can extend functionality. Also there will be an android installer to make everything easier.
Just think of this as a pimped out safestrap.
Click to expand...
Click to collapse
It doesn't matter what negative comments you get because "Criticism Is The Key To Innovation" it's my personal quotation ...I've been visiting this thread since day one at minimum of three times a day hopping that you would have uploaded the zip...Make it quick buddy & keep up the good work :good:

We need a samsung expert. Getting the display to work in uefi is troublesome. DTSI and gcdb display experience is needed.

SaschaElble said:
We need a samsung expert. Getting the display to work in uefi is troublesome. DTSI and gcdb display experience is needed.
Click to expand...
Click to collapse
as far as my knowledge is concerned, Master @darkera13 is kinda expert you're looking for...I don't personally know him or his skills but people around note 3 forums praise his work very much

Is this Note 3 specific?
This is kinda an off topic question, but, just a few days ago i wanted to try Remix OS out in my PC, but noticed that there is no direct EFI support...just thinking if this thread would be any benefit for PC UEFI users trying to boot Android x86 directly through efi file.
sorry for the question, might be my knowledge limitation on the field...

Using a x64 cpu and grub or refind you can boot RemixOS, they have a uefi image on their site. (Thats what they said) Basically you really don't need efidroid for this, as it would only make it more complicated.

grub is exactly my problem...
thanks a lot for clarifying

Related

[Q&A] Ubuntu on the Transformer (eMMC install)

This thread is for help and support related to ubuntu on the eeepad transformer, all questions not related to development should be asked here, please be friendly and do not flame each other or I will request the thread be closed.
Download links are in the third post.
There is a wiki entry here that has a bit more detailed explanation. Please note though that as it is a wiki information
quoted in there may or may not be entirely accurite.
you will need to download an nvflashable rom, like prime.
Please read the README before attempting this. The readme is below as well as in the kit, YOU WILL LOSE DATA.
Download links are in the second post.
OLiFE for the ASUS transformer
------------------------------------------------------------------
(c) 2011 Steven Barker <[email protected]>
This package should have only been linked to from xda-developers
or rootzwiki if you got the links to this package from anywhere
but those sites please send an email to the above email
address with the subject: "unauthorised posts"
DISCLAIMER
------------------------------------------------------------------
Steven Barker (lilstevie) nor anybody will take any responsibility
for any damage, data loss, fire, death of a loved one, or loss of
data resulting from using this mod for your device. Using this mod
may void your warranty.
NVFLASH
------------------------------------------------------------------
nvflash is the intellectual property of nvidia, and remains the
property of nvidia. Any questions or queries regarding the usage
and licence of nvflash should be directed to nvidia.
abootimg
------------------------------------------------------------------
abootimg is by Gilles Grandou <[email protected]> and is
unmodified. The source is available from online at
http://gitorious.org/ac100/abootimg
usage
------------------------------------------------------------------
Usage has changed since the release of the last kit, please read
these instructions carefully, as the install method is a little
more complex, (but easier once you use it).
If you downloaded OLiFE.tar.gz you will need to inject the android
rom and ubuntu image. You can use any nvflashable rom with this.
I recommend that you use prime as that is the configuration that
I have tested myself, and the ROM that I support for use with this
device. You can download the ubuntu image from
http://lilstevie.geek.nz/ports/ubuntu.img.gz.
If you downloaded OLiFE-Prime-Edition.tar.gz you will not need to
download the ubuntu image or an nvflash rom as they are seeded into
the image.
Install instructions:
1) Download the specific flavour of OLiFE that you want to use, and
extract it with "tar xvf <filename>".
2) If needed inject android rom and ubuntu image.
3) From the directory that OLiFE was extracted in run the main script
with the command ./OLiFE.sh.
4) Read the text that comes up and answer the question it asks.
5) Follow the menu to the option you want (below is a breakdown of
what each menu item is) and follow the instructions prompted. (also below
is instructions on how to get into the modes requested).
Menu items:
1) Backup Menu:
1) Full Backup (stock)
- Full backup (stock) takes a full backup of a stock
android system. This gives you an option to also back
up your user data(this will take a while).
2) Full Backup (ubuntu)
- Full backup (ubuntu) takes a full backup of a system
that dualboots android and ubuntu, this backs up your
system, and the ubuntu image. This gives you an option
to also back up your user data(this will take a while).
3) User data only
- This backs up the user data partition on your device.
(This option takes a while)
4) Android ROM
- This option backs up the android system only. This
option generates all the files (minus bootloader, and BCT)
required to flash a rom via nvflash.
5) Ubuntu Install
- This option backs up the ubuntu install on your device.
2) Flash Device:
1) Dualboot:
- This option will install ubuntu to your device in a
dualbooting configuration with android. During the
installation process it asks you which OS you would like
to boot by default.
2) uboot (linux only):
- This option will install ubuntu with u-boot and the
ChromeOS kernel that supports acceleration. This option
is currently unavailable, but should be available soon.
3) asus boot (linux only):
- This option will install ubuntu with the asus bootloader
with this configuration you will use all the eMMC for ubuntu
and there will be no android system installed on your device.
4) stock:
- This option will partition the device in a stock way and
install the android system that is in ./images. Use this
option if you no longer want ubuntu on your device.
3) Update Device:
1) Android Kernel:
- This option will update the android kernel on your device
with the boot.img from ./images/. This allows you to install
your own kernel on the device for android rather than the one
that comes with your chosen rom.
2) Ubuntu/Linux Kernel:
- This will update the ubuntu kernel on your device to the version
included in this flashkit. This option is for updating just the
kernel with nvflash rather than using the blob method. This method
is also good for if you flash a bad ubuntu kernel to the device.
3) Android ROM:
- This option will update the android rom on the device with the
one from ./images/. This is good for if the ROM you use is updated
or you would like to change ROMs and there is an nvflash image for it.
This option does not destroy your data.
4) Ubuntu Rootfs:
- This will update your ubuntu image on the device. This is destructive
to data stored in the ubuntu image.
5) Advanced (Unsupported):
- Any option in this menu is not supported and should be considered
unstable. There may be bugs in these options and they are not maintained
at this point in time.
1) Flash ChromeOS Kernel (Primary Boot):
- This option will flash the ChromeOS kernel to the primary boot
partition. This option may not currently work in it's current
configuration.
2) Flash ChromeOS Kernel (Secondary Boot):
- This option will flash the ChromeOS kernel to the secondary boot
partition. This option may not currently work in it's current
configuration.
3) Update Uboot Partition:
- This option will update the u-boot boot partition that u-boot
reads the kernel and boot script from. This option does work if
you have installed u-boot by compiling it from source and installed
it yourself.
4) Flash ClockworkRecoveryMod:
- This option allows you to temperarily flash CWR to the device so
you can update the installed rom. It backs up the current kernel in
the recovery kernel position and then flashes CWR. When you have finished
using CWR you then push any key and put the device back in APX mode and
it will restore the kernel that was in that position. (This only works if
android is your primary boot option at this time).
4) Inject Firmware:
1) Bluetooth firmware (default install):
- This option will inject the Bluetooth firmware from the
android ROM located at ./images/ in to the ubuntu of your
currently running system.
2) Bluetooth firmware (CrOS Kernel):
- This option will inject the Bluetooth firmware from the
android ROM located at ./images/ in to the ubuntu of your
currently running system and flashes the proper u-boot kernel
if you no longer need adb support.
5) Onscreen Keyboard:
- This runs OnBoard so that you can run through oem-config properly
you only need to use this option if you do not have a keyboard dock
and on the first boot.
1) Standard Kernel:
- This will invoke oem-config on the standard kernel installed
on the device.
2) ChromeOS Kernel:
- This will invoke oem-config on the u-boot kernel that is
installed on the device and flashes the proper u-boot kernel
if you no longer need adb support.
Device Modes:
APX Mode:
-This mode is used by nvflash to write files to the eMMC device.
To boot in this mode you press Power and Vol-Up.
Recovery Mode:
- This mode is where CWR or Asus recovery normally lives, but is
replaced by the secondary OS in the dualboot configuration.
To boot in this mode you press Power and Vol-Down, then Vol-Up when prompted.
Normal Boot:
-This mode is where android normally lives.
To boot in this mode you press the Power button until the screen turns on.
Changelog
------------------------------------------------------------------
1.2a - Release name: Odyssey
* New name for kit: OLiFE
* New menu system
* Updated README
* Better handling of platform detection
* Bluetooth support in ubuntu.img
* Preliminary support for ChromeOS kernel
* Preliminary support for uboot
* Fixed touchpad
* Fixed network manager
* Updated to ubuntu oneiric
* More options for flashing and updating
* OTB Wireless support (No more injecting)
* Smaller ubuntu.img for faster upload to device
* Auto resizing of rootfs on first boot
* Larger partition size (6GB) for ubuntu
* Refactored to more easily between devices
* Maybe something else I have missed
1.1 - Release name: Daedalus
* Firmware injector for BT and wifi firmwares
1.0 and silent updates - Release name: Prometheus
* Support for x86_64 linux distributions
* Updated README for release on xda-developers
* Fixes to install scripts
* Initial Release
Downloads:
RootFS md5sum(1a9fa8a698e4a96245a3c08511841eb4)
OLiFE md5sum(c30263fd8271a23bb211fd9fdd69fa45)
OLiFE Prime Edition md5sum(767779ccfa200e5e00b2f1e33a3d73a9)
Sources:
http://gitweb.lilstevie.geek.nz
To clone the repos "git clone git://lilstevie.geek.nz/$(name of repo).git"
lilstevie said:
This is running natively and from the eMMC so no µSD card required,
The video is a class2 µSD card and speeds are not an example of speeds from this kit.
Click to expand...
Click to collapse
Thanks for your hard work, but I'm a bit confused by those 2 statements, contradicting each other :/
Also, if I understood properly, there is no CWM after selecting dual boot
Finally, is this a final release, or for testing purpose only ?
If final, a step by step guide would be very welcome
Edit : Just saw there is the tag [DEV] so forget about my last question (guide)
Wow, amazing work here. Haven't been able to do much to my Transformer as of late (due to uni starting up again, and been seeing how the TF goes as a substitute for my usual netbook), but absolutely can't wait to try this out when I got some time.
And yeah, I'm a tad confused here as well. I'm assuming that you mean the video was of Ubuntu running of your microSD drive using Jhinta's scripts but now this allows us to run it off the internal drive... am I right?
And how is the speed difference so far, running off internal vs class 2 microSD?
EDIT: Also, I'm assuming the same things that didn't work on Jhinta's aren't working on this (network-manager gui, touchpad etc)? Or have you changed things up a bit? And the tegra ppa you talk about; that contain the proprietary 3D drivers you were talking about having a lack of in the video?
Nice to see the post in XDA Good work !
bud77 said:
Thanks for your hard work, but I'm a bit confused by those 2 statements, contradicting each other :/
Also, if I understood properly, there is no CWM after selecting dual boot
Click to expand...
Click to collapse
The video was taken before I was stable enough to even think about using internal memory, where as this kit is not using the µSD
and yeah you lose recovery after selecting dual boot, not much we can do about that for the time being.
poltak11 said:
Wow, amazing work here. Haven't been able to do much to my Transformer as of late (due to uni starting up again, and been seeing how the TF goes as a substitute for my usual netbook), but absolutely can't wait to try this out when I got some time.
And yeah, I'm a tad confused here as well. I'm assuming that you mean the video was of Ubuntu running of your microSD drive using Jhinta's scripts but now this allows us to run it off the internal drive... am I right?
And how is the speed difference so far, running off internal vs class 2 microSD?
EDIT: Also, I'm assuming the same things that didn't work on Jhinta's aren't working on this (network-manager gui, touchpad etc)? Or have you changed things up a bit? And the tegra ppa you talk about; that contain the proprietary 3D drivers you were talking about having a lack of in the video?
Click to expand...
Click to collapse
I started back at uni this week myself, and have been using my transformer as a netbook replacement with ubuntu. The video is using my stuff but before I had it running on the internal memory.
speed diference is massive between the class2 and internal. It was so great of a difference that I forget that it is arm now that it is on internal
the PPA will have things such as kernel updates, bluetooth enabler and all that. as for what is working in the release, things are pretty similar to Jhintas release, touchpad does not work correctly network manager gui doesn't work, I have something to enable bluetooth, that works nicely, but it isn't in the fs or up on the ppa yet. 3D drivers are a work in progress, still no EGL and the likes with the L4T releases, so it is really just acceleration for normal use, I have been working on them but as of yet no dice.
So using the PPA, in theory we won't have to flash the device again (at least for the ubuntu part), it will be able to auto-update itself ?
ErGo_404 said:
So using the PPA, in theory we won't have to flash the device again (at least for the ubuntu part), it will be able to auto-update itself ?
Click to expand...
Click to collapse
yes, that is the plan anyway
lilstevie said:
the PPA will have things such as kernel updates, bluetooth enabler and all that. as for what is working in the release, things are pretty similar to Jhintas release, touchpad does not work correctly network manager gui doesn't work, I have something to enable bluetooth, that works nicely, but it isn't in the fs or up on the ppa yet. 3D drivers are a work in progress, still no EGL and the likes with the L4T releases, so it is really just acceleration for normal use, I have been working on them but as of yet no dice.
Click to expand...
Click to collapse
Ah lovely idea with the PPA. When new 3.2 based Prime gets released, I'll try to get a few hours to myself to get this all working together.
Just a few quick questions first:
How do your scripts change the eMMC layout? Does eMMC work the same as a standard HDD/SSD partitioned with a GPT? As in, have you made separate partitions for Android and Ubuntu, or is it somehow shared?
And also related, how much room will it take up on the eMMC (as I've only got a 16GB TF)?
And finally, since you've been using yours at uni running Ubuntu, have you got any idea of the battery life running Ubuntu? I'm assuming it'd be pretty similar to stock, but yeah the battery indicator wasn't working last time I was playing around with Ubuntu from the microSD. Also, does the second keyboard battery work?
poltak11 said:
Ah lovely idea with the PPA. When new 3.2 based Prime gets released, I'll try to get a few hours to myself to get this all working together.
Just a few quick questions first:
How do your scripts change the eMMC layout? Does eMMC work the same as a standard HDD/SSD partitioned with a GPT? As in, have you made separate partitions for Android and Ubuntu, or is it somehow shared?
And also related, how much room will it take up on the eMMC (as I've only got a 16GB TF)?
And finally, since you've been using yours at uni running Ubuntu, have you got any idea of the battery life running Ubuntu? I'm assuming it'd be pretty similar to stock, but yeah the battery indicator wasn't working last time I was playing around with Ubuntu from the microSD. Also, does the second keyboard battery work?
Click to expand...
Click to collapse
The second battery does work, unless you get one of those dodged ones that just randomly stops charging which happened to me, with the dock connected and the battery in it refusing to charge my battery lasted 6 hours.
the layout is different to standard, UDA(User DAta partition) is 4.2GB smaller than what it was, so you have 9.99gb for android and 4.2 for ubuntu, the kernel and recovery kernels are moved up to the end of the flash as well so that they are accessible through /dev
Just finished installing it. Yea, from internal memory it's working much faster. ~20 second boot time!(I didn't have timer with me, so I counted in the head) That's like my laptop with SSD + 10 second bios booting. With a dock it feels like a true netbook. I think I'll even dare to test c/c++ IDE on this thing. Good job!
Used online timer. It's 21 seconds.
Hmm how do I start wifi? eth0 is not even showing in the list of devices.
aligatro2010 said:
Just finished installing it. Yea, from internal memory it's working much faster. ~20 second boot time!(I didn't have timer with me, so I counted in the head) That's like my laptop with SSD + 10 second bios booting. With a dock it feels like a true netbook. I think I'll even dare to test c/c++ IDE on this thing.
Used online timer. It's 21 seconds.
Hmm how do I start wifi? eth0 is not even showing in the list of devices.
Click to expand...
Click to collapse
Sorry forgot to mention in the first post, firmwares are not included in this release due to potential licensing issues, you can push the wifi firmware via adb to /lib/firmware and also the nvram, they are located in /system/vendor/fw_bcm4329.bin and /system/etc/nvram.txt on your android system, the module will autoload on boot once you have the firmware in place, and the interface will be named wlan0
lilstevie said:
Sorry forgot to mention in the first post, firmwares are not included in this release due to potential licensing issues, you can push the wifi firmware via adb to /lib/firmware and also the nvram, they are located in /system/vendor/fw_bcm4329.bin and /system/etc/nvram.txt on your android system, the module will autoload on boot once you have the firmware in place, and the interface will be named wlan0
Click to expand...
Click to collapse
nvram.txt to /etc right? I copied them straight from android partition, but it still doesn't load. Could it be because of the bcm4329_sta.bin or nvram should be placed in /lib/firmware ?
It works now.
So basically we will be able to dual boot Windows 7 and Android?
liorry said:
So basically we will be able to dual boot Windows 7 and Android?
Click to expand...
Click to collapse
No, Windows 7 doesn't have arm version. Windows 8 maybe in future, long future ....
aligatro2010 said:
nvram.txt to /etc right? I copied them straight from android partition, but it still doesn't load. Could it be because of the bcm4329_sta.bin or nvram should be placed in /lib/firmware ?
It works now.
Click to expand...
Click to collapse
the wifi firmware should be called fw_bcm4329.bin and nvram.txt should be in /lib/firmware, I probably should have been a little clearer, but I posted that just before going to bed, and was a little tired
lilstevie said:
the wifi firmware should be called fw_bcm4329.bin and nvram.txt should be in /lib/firmware, I probably should have been a little clearer, but I posted that just before going to bed, and was a little tired
Click to expand...
Click to collapse
"bcm4329_sta.bin" was already there before I even copied 2 modules and it was also loaded as module when I did modprobe. (not 100% sure about the second)That's why I thought it was conflicting with android's modules.
Wow, great work! Can't wait to try it.
Sent from my Transformer TF101 using XDA Premium App
I've probably missed something obvious.. But I get this.
file not found: linux.img
failed executing command 2147483647 NvError 0x4
command failure: create failed
rm: cannot remove `linux.img': No such file or directory
Click to expand...
Click to collapse
After like 5 minutes of NvFlash installing stuff.

[HELP!] Velocity Cruz T301 Full Brick Recovery

Hi XDA,
so basically i bought a Velocity Cruz T301 recently and followed the known procedures for rooting, flashing ClockworkMod Recovery and custom rom (SJHill Rom v0.3).
before the full brick my device was at ClockworkMod 5 and rooted with SJHill Rom v0.3.
i installed CWM by flashing the zip in stock recovery, then succesfully rooted the device, finally wiped and flashed my custom rom
after major dissapointment in this tablets performance i decided i wanted to get rid of it.
So i downloaded the stock rom, wipe and flashed it onto the tablet...
the tablet turned off when it was finished (i think it was attempting to reboot) and never turned back on again...EVER! :good:
i cant even get to recovery
i tried flashing with adb and fastboot but the device is never even presents itselft to the computer.
i found out that you can boot the device into USB boot mode where you hold the "VOL -" (Volume Down) button and press the reset button and while connected to the computer (windows only) a "JZ4760 USB Boot Device" appears.
i did some googling and also found out that the T301 is based on similar tech to a bunch of tablets and they can all be modified by some software released by Ingenic called USBBootTool.exe
the tool is written in chinese and i cant decypher it all, though i found out how to use it based on its usage for other Ingenic based tablets
1.) you will need to disable driver signature verification (press F8 on boot of windows and toggle the setting, i hate rebooting too but it has to be done)
2.) boot your tablet into USB Boot Mode (hold down Vol - and press Reset button)
3.) install the driver for your device (included in the files below)
4.) with the tablet disconnected you would open the USBBootTool.exe
5.) select your tablet in the options and fill each box with the files needed to flash (files included below)
6.) reconnect the tablet while still in USB Boot Mode and the software will flash your device on detection
everything goes fine for me except when i get to the flashing part in the end.
when USBBootTool detects my tablet, it attempts to flash and gives me a stream of errors and never flashes my device.
i dont know what to do at this point. i have provided direct links to all the software im using and also links to where i got them.
any help would be appreciated, thank you to the XDA community in advance
>------------------- DOWNLOADS ------------------------<
USBBootTool.exe / Tablet Drivers (4725 / 4725B / 4740 / 4750 / 4755 / 4760 / 4770)
http://dl.dropbox.com/u/79196608/burn_tools_3.0.16.rar
obtained from - http://forum.xda-developers.com/showthread.php?t=1720621
Velocity Cruz T301 Update.zip (contains the system.img / data.img / mbr-xboot.bin files)
http://www.cruztablet.com/T301update.zip
obtained from - http://www.cruztablet.com/Article_861.php
SJHill Rom v0.3
http://www.androidfilehost.com/?fid=9390362690511176486
obtained from - http://www.slatedroid.com/topic/27583-rom-t301-sjhill-rom-17-feb-2012-download-link-updated/
ClockworkMod 5
http://files.androtab.info/ingenic/cwm/20120514/T301-recovery-signed.zip
obtained from - http://androtab.info/mips/ingenic/clockworkmod/
I have the same situation. I have gone through every menu in the USB Boot tool and to no avail am I able to recover my T100.
gmick is redoing the software because the coding is set up wrong. Once he gets that figured out there should be a fool proof unbricking method that we can follow. He is posting information over on Slate Droid if you want to take a look.
feyerbrand said:
gmick is redoing the software because the coding is set up wrong. Once he gets that figured out there should be a fool proof unbricking method that we can follow. He is posting information over on Slate Droid if you want to take a look.
Click to expand...
Click to collapse
ok post the link to the thread, and ill add it to the first post as a solution if its found to be a working one
JustSayTech said:
ok post the link to the thread, and ill add it to the first post as a solution if its found to be a working one
Click to expand...
Click to collapse
*Cross Post from SlateDroid* (but I can't post the link because XDA won't allow it)
I found out why the USB boot isn't working. Well, more appropriately I know where it fails but not exactly "why".
The USB Boot tool works like this:
1) Send x00 command (Get CPU Info)
2) Device responds with "JZ4760V1"
3) Host sends two binaries, stage1 and stage2. Stage 1 sets up memory stuff, and Stage 2 sets up USB flashing functions.
4) Host checks that the binaries executed by issuing another x00 command (Which serves as an "Are you still there?" function)
5) If the response is good, the host will flash the images, if the response is bad, it will abort.
Our devices are failing at step 4. The linux usb boot tools (xburst-tools) fail in an identical fashion.
I know that the first stage binary transfers and executes fine because if it didn't the device would be limited to 16k. The second stage is 120K and is transferred successfully. Once the second stage "execute" command is sent, the device crashes.
The second stage is also unique to the CPU type. I've used all of the binaries for JZ4760 I could find on the net and when that failed I cross compiled my own binary from source and it still crashed.
At this point I highly doubt I'll ever be able to fix it, and this completely explains why no one could get any usb recovery tool to work while others using similar devices could. I guess our board is modified just enough for ingenic's stock binaries to fail. Without knowing what's changed (getting Velocity Micro's source) we're SOL.
I can open it up again and solder on the serial header but I'm betting it's going to give me some generic "couldn't execute" message that isn't going to help me. I'll probably do this anyway though because I've come this far so what's the loss.
wow, i learned alot from that post, seems like writing a usbboottool-like application that can send the commands but also log and possibly bypass security checks etc but that def would take sometime. thank you for your insight, seems youve come the closest to cracking the case, actually you found the fault, hopefully your methods can eventually bring about a fix
JZ 4770
gmick said:
*Cross Post from SlateDroid* (but I can't post the link because XDA won't allow it)
I found out why the USB boot isn't working. Well, more appropriately I know where it fails but not exactly "why".
The USB Boot tool works like this:
1) Send x00 command (Get CPU Info)
2) Device responds with "JZ4760V1"
3) Host sends two binaries, stage1 and stage2. Stage 1 sets up memory stuff, and Stage 2 sets up USB flashing functions.
4) Host checks that the binaries executed by issuing another x00 command (Which serves as an "Are you still there?" function)
5) If the response is good, the host will flash the images, if the response is bad, it will abort.
Our devices are failing at step 4. The linux usb boot tools (xburst-tools) fail in an identical fashion.
I know that the first stage binary transfers and executes fine because if it didn't the device would be limited to 16k. The second stage is 120K and is transferred successfully. Once the second stage "execute" command is sent, the device crashes.
The second stage is also unique to the CPU type. I've used all of the binaries for JZ4760 I could find on the net and when that failed I cross compiled my own binary from source and it still crashed.
At this point I highly doubt I'll ever be able to fix it, and this completely explains why no one could get any usb recovery tool to work while others using similar devices could. I guess our board is modified just enough for ingenic's stock binaries to fail. Without knowing what's changed (getting Velocity Micro's source) we're SOL.
I can open it up again and solder on the serial header but I'm betting it's going to give me some generic "couldn't execute" message that isn't going to help me. I'll probably do this anyway though because I've come this far so what's the loss.
Click to expand...
Click to collapse
for my JZ4770 Earlier USB tool was flashing .img without any problem but for now it is saying "load cfg failed". "API downlaod failed' like dialogues and doesnt flash anything. Any idea? Thanks in advance!!
First restart your computer (actually restart it) then redownload the USB boot tool and save it in a completely new directory and use a different USB port
Sent from my Pokeball
Yes, I did
JustSayTech said:
First restart your computer (actually restart it) then redownload the USB boot tool and save it in a completely new directory and use a different USB port
Sent from my Pokeball
Click to expand...
Click to collapse
Yes, I tried with this suggestion. Rather I reinstalled xp and the tried again. But the dialogues are same. The history is like this. Was having ICS on JZ 4770. Formatted with usb tool and put JB updates. It was not sensing touch so reflashed another JB updates. Now the tab boots, it reaches to boot logo for around 12 seconds and restarts in stock recovery. While it is in booting stage it get detected by windows and adb also. In stock recovery mode it get detected by windows and in turn by adb also. If I tried to install updates through SD card it shows it had installed and reboots after completion. But again the same way it goes to boot logo and then back to stock JB recovery. It also boots in ingenic boot device mode and gets detected by USB burn tools. But when try to flash any of the ROM it gives the same dialogues "check cfg failed" "api download failed" "boot. fw failed" and cant flash anything.
Is there any tool which can be flashed or a script which can be used from SD card for completely formatting flash memory so that USB burn tool can flash required ROM?
can you flash the stock rom in recovery?
Managed using USB BOOT TOOL for ingenic JZ 4770 board in English
JustSayTech said:
can you flash the stock rom in recovery?
Click to expand...
Click to collapse
thanks man but I managed to boot the device. I used following USB BOOT TOOL for ingenic 4770 boards. The goodness with this tool, this is completely in English. You will know what you are doing. Even after opening the main window of the tool you can right click and then get another options(yes again in English). My problem with this device was bad blocks at 1024. In the options there is chance to force erase whole the nand partitions which I used and erased all the partitions thereby made all the partions available for flashing and readable by the tool. Then from File option selected stock rom files and flashed them. While flashing selected JZ4770 iNanad.ini file in manual configuration. This tool has really helped me to come out of the issue and will be useful for guys using JZ 4770 board.
http://www.4shared.com/rar/m1BUV5r2/USBBurnTool_20120401_for_relea.html
Got USBBootTool.exe kind of working.
1. Download the following file from Ingenic.
ftp * ingenic * cn/3sw/01linux/tmp/jz4770-20110610.rar
2. Download Applocale from Microsoft.
www * microsoft * com/en-us/download/details.aspx?id=13209
3. Extract the jz4770-20110610.rar and find the folder. (Using 7zip should keep the UTF encoding in Chinese)
20110610\04burn\20110524_4770_Programmer
4. Copy the folder 20110524_4770_Programmer to location you want to use it in.
5. Install Microsoft Applocale (Just in case, I don't think it is required)
Now Start Applocale and create a shortcut to USBbootTool.exe inside 20110524_4770_Programmer
中文(简体) is simplified Chinese option and should let you view the GUI correctly.
6. Now with the Applocale Shortcut created for USBbootTool.exe you can start the application with correct fonts.
Now this is where is breaks down.
TABLET-8 NAND FINAL BSP(S3 TEST) will allow you to read from it and write to it, but the CFG is off.
\tool_cfg\tablet-8-nand-final.ini is the configuration for it.
DO NOT CONNECT THE DEVICE WITH ANY OPTIONS CHECKED OR LOAD ANY FILES.
See Attached Images.
Next to the Read button is some Boot Option menu. I am not fulling aware of what this does.
What I need is a someone to help me fix/correct the ini/cfg files in
\20110524_4770_Programmer\tool_cfg\.ini
\20110524_4770_Programmer\4760\
to correctly match the files of the NAND.
Also if anyone has a copy (dd to img) or (cat to img) of the block devices.
That would help a ton.
# cat /proc/partitions
# cat /proc/mtd
I would also love another T10x Tablet for cheap.
I want to start building things like new bootloader, kernel, system image,
performance libraries to take full use of the Ingenic JZ4760 (www * ingenic * cn/product.aspx?CID=11)
I also bring Christmas gifts
2 APKS. You can place them in /system/app or /data/app.
Google Play will crash now and again, but it will load and work. (Vending.apk)
Secondly I bring the gift of performance increase, just by a slight bit.
edit the line of the heapsize in /system/build.prop dalvik.vm.heapsize=96m
Remember to make sure the permissions are set back to 666 or 644.
Original Vending.Apk before updates came from here: (Incase you are paranoid)
code * google * com/p/ics-nexus-s-4g/source/browse/trunk/system/app/Vending.apk?spec=svn20&r=18
ics-nexus-s-4g * googlecode * com/svn-history/r18/trunk/system/app/Vending.apk
To prevent spam on the XDA forums, ALL new users prevented from posting outside links in their messages. After approximately 10 posts, you will be able to post outside links. Thank you for
Click to expand...
Click to collapse
Stupid. how do you expect real people to help post Tech Docs? That is bad Moderating and Administrating.
Make sure to replace the Asterisk's with spaces to normal dots.
Requesting Block Images.
Does anyone have a copy of it they can send me for a T10x?
block images......
IceGryphon said:
Does anyone have a copy of it they can send me for a T10x?
Click to expand...
Click to collapse
Which block images do you want?
...also is there a way to rip the stock images off the jz4760 in the t301.
Such as:
Can i usethe ingenic uboot tool?
Anybody find the jtag pins?
Is the 4 pin conn next 2 the batt for serial?
.......i guess ill try to take a look this weekend
Ics would be really nice, but probably slower than stock..... especially with the limited ram
I unpacked the stock rom. I also unpacked an ics rom for a jz4770, and repo sync'd the aosp and mips 3.0.8 android kernel.
I'm still trying to figure out specs for the processor though. I know that its mips32 - el- fp- r1, but i cannot figur out the dsp version ... if it has one?
Error in erasing nand
nanachitang420 said:
thanks man but I managed to boot the device. I used following USB BOOT TOOL for ingenic 4770 boards. The goodness with this tool, this is completely in English. You will know what you are doing. Even after opening the main window of the tool you can right click and then get another options(yes again in English). My problem with this device was bad blocks at 1024. In the options there is chance to force erase whole the nand partitions which I used and erased all the partitions thereby made all the partions available for flashing and readable by the tool. Then from File option selected stock rom files and flashed them. While flashing selected JZ4770 iNanad.ini file in manual configuration. This tool has really helped me to come out of the issue and will be useful for guys using JZ 4770 board.
http://www.4shared.com/rar/m1BUV5r2/USBBurnTool_20120401_for_relea.html
Click to expand...
Click to collapse
I used english ingenic tool to erase bad blocks but m nt able erase bad blocks live suit is giving eror id=0x4848

[LOCKED][DEV-TOOL] FIsH is the hack to boot whatever you want - ON ANY* DEVICE

FIsH a la carte - A porting guide for the FIsH framework.
Proudly introducing Android FIsH: Fluffy Incredible steadfasterX Hijack
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
FIsH: Fluffy Incredible steadfasterX Hijack​
First of all:
All this is for the brain of DEVELOPERS.
Well.. to be more specific: not really for developers but for COMPILERS
For using FIsH You do NOT need to DEVELOP anything - normally - the only thing you should be able to do is COMPILING -> e.g. TWRP.
If you have the knowledge to compile TWRP then FIsH is what you need to bring it on your locked device.
Just follow the menu card in the post #3 "Bring FIsH on the menu card" and your job is done.
If you are a user wanting to have FIsH for your device: FIND A COMPILER (a person who is able to compile TWRP/ROMs/.. for your device!!).
DO NOT ASK IF I CAN PORT FIsH TO YOUR DEVICE!
DO NOT ASK IF I CAN COMPILE [FILL IN WHATEVER YOU WANT] FOR YOU!
-> instead find a person willing to port FIsH plus the ramdisk of your choice (e.g. TWRP) and point him/her here.
When do you feel like a compiler or u want to be one: read on
if not: really still here? I said find a compiler!
Table of content
This whole thing here is damn long.. but that's one of the major difference for the FIsH: I try to explain what I do
For a better handling I splitted the guide into several parts:
This post: Explain me the FIsH (What it is)
Post #2: FIsH bowels (What's inside)
Post #3: Bring FIsH on the menu card (porting FIsH)
Post #4: FIsH cuisine (examples)
Post #5: FIsH hydra (multiboot in FIsH)
Post #6: Chew the FIsH (Copying/License)
Post #6: FIsH mutation history (Changelog)
Post #7: Go FIsHing (enduser installation guide example)
Overview
You can not unlock your bootloader? So now it's all over right?
TWRP and flashing custom ROMs on locked devices is impossible right?
Oh no wait there are hacks (up to KK) which have a workaround for this but I couldn't find anything for LL (sorry if I missed something) and what I found was not easy to port so nothing generic which i could just adapt easily.
Here is where the Android FIsH (refered to just FIsH in this whole doc) steps in
FIsH means: [F]luffy ncredible teadfasterX [H]ijack
FIsH is different from Safestrap or other hijacks because it should be better understood as a kind of framework for any ramdisk image you want to load.
FIsH will not harm the Android boot chain! Means it will not modify /boot, /recovery or aboot partitions. It will just modify /system.
FIsH:
... is NOT MultiROM (see post #5: FIsH hydra)
... is NOT efidroid (see post #5: FIsH hydra)
... is NOT Safestrap
... is NOT TWRP (booting with FIsH is tested and works)
... does NOT root your phone
... does NOT unlock your phone
... is a WORK IN PROGRESS!
... but FIsH could (in theory) "BOOT" any of the above!
U got it? FIsH is the hack to boot whatever you want.
This also means atm it is tested on some devices only and the only FIsHFOOD (ramdisk) FULLY tested and so stated to be working is TWRP.
Nevertheless I'm hard working currently on porting either MultiROM-in-FIsH or efidroid-in-FIsH to bring custom ROMs to locked devices as well (see post #5: FIsH hydra).
What the FIsH is (in short words)
Read about the full details of the implementation of FIsH in the next post (Post #2: FIsH bowels (What's inside)) but to give you a short overview:
FIsH is a boot hijack and wants to be a FRAMEWORK for booting any fishfood (ramdisk) you like.
FIsH is portable to other devices
FIsH gives you all possibilities to make the most of your device by letting you boot whatever you like
FIsH will not provide or contain any ROM or recovery by it's own - THATS YOUR HOLY OWN JOB NOW!
FIsH is the tool -> but building a ROM or recovery is (still) up to you.
These questions may come up in your mind now
Will FIsH void your warranty? Not more or less then rooting your device.
Will FIsH unlock your bootloader? omg NO! read it again!
Is there a risk with FIsH? For example could it soft-brick my device? Well.. absolutely! Safe is the death only. There are always risks especially for untested devices. I do all I can to keep this risk as low as possible and I provided a way to get out of bootloops but again you will get no guarantees here and elsewhere.
Will it work on Android version ICS, KK, LL, MM, N, O, ....? Check the pre-requirements. If you can answer them with yes it should work. If not then not. That easy.
Will I need a recovery partition to use FIsH? No. FIsH ran in RAM only. Even if your device does not have a recovery partition it will work.
Will FIsH work for my device? FIsH is more than just a hack for a special device or model it is a hack for ALL devices of ANY vendor! wtf? yes. Your FISHFOOD is device specific so the question would be better: Will the FISHFOOD (e.g. TWRP) work on my device? The answer is it depends. You need to compile it for your specific device and it should but who knows.
To narrow it a little more down:
you have to met the pre-requirements and there has to be done some things to get a value out of it but those are straight forward for a good compiler/developer like you!
FIsH pre-requirements
Here are the pre-requirements you have to met!
If you can't get them: Close this page and FORGET it (until the day you met those reqs)!
Here are the 2 simple requirements you have to met:
a) root by SuperSU >=v2.76 (greater or equal v2.76)
--> to test this requirement just start the installer of FIsH with --check (see next lines) which will check for all requirements and abort if its not possible
--> for many devices - if not all - this means you HAVE TO downgrade/install LL. It also means that you have to upgrade your SuperSU to this version by e.g. FlashFire if you have a lower version installed!
--> SU by phh is NOT supported => It needs a modified /boot and this would void the boot signing chain!
--> Magisk is NOT supported => It needs a modified /boot and this would void the boot signing chain!
--> I will NOT provide downgrading guides there are plenty of them so search and read.
--> I will NOT provide any guides in rooting your device
--> Before you think about downgrading to LL read about ANTI-ROLLBACK protection some devices and may have! Anti-Rollback means you CAN NOT downgrade - it would HARD-BRICK your device (wtf thinking the vendors who we are?? Is this even legal?!)! Check that before!!
b) you have to be able to disable SELinux in your booted Android
--> You do NOT need to set SELinux permanently to permissive. Just CHECK if you COULD get it MANUALLY. If you can get it OK. If not.. you obviously have not full root access but check the forums maybe there is something you can do about this.
--> I will NOT provide any guides enabling SELinux but some lines later you will see how u can execute the very simple check
--> to test this requirement just start the installer of FIsH with --check (see next lines) which will check for all requirements and abort if its not possible
Those above are hard facts so it may NEVER work with MM. Google has changed the way on how the boot chain will be verified and that means changes in /system will void it from now on.
If MM can get fully rooted somehow/somewhen on your device with SuperSU installed and you are able to disable SELinux the method will work there as well.
If you can not meet ALL of the above 2 requirements lay down and cry.
For the others: calm down and read on!
You can simply test those both requirements by downloading FIsH and execute the installer with the testing parameter:
./install.sh --check
Example output:
############# Checking for busybox
...downloading busybox
--2017-03-24 13:37:44-- https://busybox.net/downloads/binaries/1.26.2-defconfig-multiarch/busybox-armv6l
fishing/busybox 100%[========================>] 1,06M 542KB/s in 2,0s
2017-03-24 13:37:47 (542 KB/s) - »fishing/busybox« saved [1107664/1107664]
Waiting for your device... (you may have to switch to PTP mode on some devices!!)
Android Debug Bridge version 1.0.36
Revision 7.1.1_r13
############# checking Android version
-> Good. Matching exact the required Android SDK: 22
############# checking SuperSU version
-> Matching required SuperSU version: 279
############# temporary disable SELinux
-> command ended successfully (err=0)
SELinux mode: Permissive
... restoring SELinux mode to Enforcing
Tests finished! Check the above output!! Exiting here because in checking mode. Nothing installed.
Click to expand...
Click to collapse
The important lines are:
Matching required SuperSU version: XXX
"SELinux mode: Permissive"
If you see "SELinux mode: Enforcing" or any error messages you may doing something wrong or it just do not work for you.
Limitations!
Keep in mind what I said above: FIsH does NOT unlock your bootloader!
That means with FIsH itself you can NOT "install" anything. FIsH actually is the FRAMEWORK(!) for the FIsHFOOD (ramdisk) you want to load.
One good example is TWRP. This can be loaded even on devices do not having a recovery partition (I believe Sony is one of those).
Let's stay by the example of TWRP.
Keep in mind that when you use FIsH to provide TWRP you can NOT
Install a custom ROM like CM/Lineage (this will modify boot = SOFT-BRICK. for this u would need efidroid or multirom as FIsHFOOD)
Install a custom Kernel (this will modify boot = SOFT-BRICK)
Install a custom recovery (this will modify recovery =may SOFT-BRICK)
In short: do nothing which modifies boot or recovery partitions. Those changes will break your boot signing chain.
You can of course flash everything which is modifying /system /data only (e.g. xposed, Audio mods, etc...)
You're able to backup and restore as well of course and doing any other modifications which you may can't while the Android system is running.
Download
You will get the most current downloads at github but I uploaded all stable releases here at XDA as well to mirror them.
Latest stable (well tested and so hopefully fewest bugs): Download latest release at github (click)
Mirror / older stable versions: DOWNLOAD-TAB (click)
Next stable (lesser chances of issues but may still not released yet): github master branch
LIVE/FRESHEST code u can get (high chances of failures, bugs, unexpected behavior - but the latest and greatest features/bugfixes): github develop branch
FIsH helpers
If you want to reboot directly to an implemented version of FIsH from within Android check out this:
Thanks to @sdembiske who has onboarded the developer @AntaresOne we have an option to reboot into FIsH very comfortable now!
Check it out here: QuickReboot App
Support / IRC Channel
(DEVS/COMPILERS ONLY - NO ENDUSER SUPPORT!)
IRC means Internet Relay Chat and you will get best support here only.
This channel mentioned here is NOT an ENDUSER channel!!
It is for developers and compilers only!)
Endusers should use: #Carbon-user instead !
Choose how to get in:
PC (HexChat and Pidgin are only 2 of them! This list is not complete!)
Android (Yaaic, AndChat, HoloIRC, AndroIRC are only a few of them! This list is not complete!)
Web (KiwiIRC-Web,FreenodeWebchat])
When you have to choose a channel it is: #Carbon-Fusion (this is NOT an ENDUSER channel!! It is for developers and compilers only!)
Endusers should use: #Carbon-user instead !
When you be asked for a server network choose: freenode
Credits (without them - no FIsH!!!)
If you feel that someone / you is missing on this list lemme know!
Chainfire for SuperSU! This is the main part of FIsH.
TeamWin for TWRP
@cray_Doze, @dssmex, @Aaahh and @KeiranFTW for their hijack implementations (e.g. https://forum.xda-developers.com/showthread.php?t=2608408, first steps to a G4 hijack)
@dibbled for creating the android FIsH logo
steadfasterX for the android FIsH !
Famous last words
You may say: When this will work for up to LL only.. Why the hell are u releasing this now? We just see the upcoming Android O and you talk about LL? Well.. This whole thing is just a fun project. I want to learn and I want to give back something which helps others.
So at the end.. If u don't like.. its ok. If you don't need it.. ok. If you can't get any value out of it.. ok..
But maybe it helps others out there instead.
So if you're still not scared and want to continue.. what u r waiting for??
XDA:DevDB Information
android FIsH, Tool/Utility for all devices (see above for details)
Contributors
steadfasterX, BigCountry907, Rees86
Source Code: https://github.com/Carbon-Fusion/android_FIsH
Version Information
Status: Stable
Current Stable Version: v3.0
Stable Release Date: 2017-06-14
Created 2017-03-24
Last Updated 2017-09-11
FIsH bowels (What's inside)
This is for ppl understanding the basics. I will not explain it for dummies
Ok prepare urself for the naked magic
Actually FIsH is mostly similar to other RAM hijacks around with 3 major differences:
1. FIsH is based and depends on SuperSU.
YES - I make my life EASY. You actually need a rooted devices for the most kind of hijacks.
... and I assume the most ppl using SuperSU as their su binary.
... and SuperSU does not require to modify boot (at least until LL)
With this in mind and reading the SuperSU docs I had read that beginning from version 2.76 SuperSU
comes with a special kind of internal init.d support means: It executes custom scripts very early with full SELinux perms available.
Check out the docs here: https://su.chainfire.eu/#updates-sud
2. FIsH tries to be a generic framework with instructions to bring it on all devices.
The hack here is not device specific due to its nature of just executing a custom script by SuperSU.
I've made all scripts inside as easy portable as possible and given hopefully good descriptions and
porting instructions for EACH variable you may need to adjust.
3. it works for up to LL (when u can met the pre-reqs for MM or N, O or whatever comes then - it will work there as well!)
I found only methods for up to KK (e.g. 2nd init and others) but nothing for LL (sorry if I missed someone!) so I started FIsH.
So in sum FIsH is:
a set of scripts and tools which gets executed by SuperSU on early boot stage which hijacks the boot process to bring up your own ramdisk.
FIsH vs Flashfire
Flashfire is absolutely an AMAZING tool! You can backup, installing ZIPs etc all without an unlocked bootloader.
Due to it's nature it is not possible to do EVERYTHING with it (on a locked device), e.g. restoring your whole system partition.
TWRP-in-FIsH (FIsH plus TWRP as FIsHFOOD ramdisk) can provide this - even with a locked bootloader.
Besides this FIsH can do more like (hopefully) bringing you custom ROMs on locked bootloader devices.
FIsH vs Safestrap
Safestrap is supported up to KK and besides this it actually is some kind of MultiROM pendant (+ the hijack part).
FIsH supports any Android version up to LL (GB, ICS, KK, LL,..) as long as the 2 bloody requirements can be met.
Safestrap is a very customized version of TWRP and so limited to updates from there.
FIsH lets you boot any ordinary TWRP completely unmodified. This makes it easier to get new TWRP features on your device.
Besides this FIsH wants to be easy to port for everyone thats why it uses standard components only.
AFAIK it is not supported anymore anyways.
FIsH vs other RAM hijacks
The main reasons why FIsH exists are described already (LL support, easy portable and easy to use) so if you still feel that this is not different from the others... i dunno what to say
FIsHing (Hijacking) means:
FIsH kills all running services, scripts, binaries it can find.
Afterwards it will unmount everything and delete all files left behind from the initial ramdisk.
Now in that more or less clean state it will replace the initrd with the FIsHFOOD - means your own ramdisk like e.g. TWRP.
Some other stuff may happen also but at the end a binary will be started - normally a /init from your own ramdisk
So in sum it is a live replacemnt of the current ramdisk with your own.
Requirement <SuperSU>
It prepares the system to run the FIsH init script and also ensures that SELinux can be run in permissive mode.
Keep in mind that FIsH will enforce permissive mode on boot to do it's job so you do not have to do anything (normally) to let the FIsH boot.
Main components of FIsH:
./install.sh (file)
The installer is the first part you may need to adjust when you want to port FIsH.
This installer is for Linux users only. If you want to have Windows users executing FIsH point them to https://tinyurl.com/FWULatXDA !!
.. but you're free to port the installer to Windows (if u like: bring it back to me so I may include it..)
Your FIsHFOOD (your own ramdisk) has to be compatible to your running STOCK ROM. If you have LL 5.x running your ramdisk has to run / build for it.
important variables:
MINSDK: Adjust this SDK level to match your runnin STOCK ROM which has to be compatible with your FIsHFOOD
MINSU: The minimum SuperSU version required. Do not use anything lower than 279 (means 2.79) because this may not work!
BUSYBOXURI: This is a full URL to a busybox binary compatible with your device. You may have to adjust this but ensure u use a compatible version
because we highly depend on its syntax. The reason why FIsH does not come with busybox bundled is besides license stuff (I do not wanted to provide their
sources ) it may be required that you need another binary then me.
fishing/ (directory)
The real FIsH. Means all files which gets copied to the target device.
fishing/busybox (file - will be auto downloaded by the installer)
You should know what it is..
FIsH comes without busybox but the installer will download it automatically and place it here.
FIsH uses busybox to have all commands with the expected syntax in place and we highly depend on this in the hijack process!
fishing/fishfood.gz (file)
The FIsHFOOD is your own ramdisk - in gziped cpio (e.g. TWRP)
This ramdisk has to be compatible to your device's ROM. Means when you have a STOCK ROM 5.1 installed your ramdisk have to be compatible to LL 5.1.
You can ensure this within the installer (see FIsH Installer) where the Android version will be read and compared before FIsH installs actually.
fishing/fishfood.release (file)
The version and content of your FIsHFOOD
I recommend the following naming convention:
[yourFIsHFOOD]-in-FIsH-v[VERSIONNUMBER]_[DEVICE-MODEL]_[Android-Version]
e.g.
TWRP-in-FIsH-v1_LG-G4_LL
You can write in here whatever you like. The content will be send to the fish.log to identify which version the user has installed (helps debugging).
fishing/callmeFIsH (file)
a caller script which gets executed at very first.
The only task callmeFIsH has is to prepare the whole FIsH to get started out of /system and then starting FIsH from /res. After this it immediately exists to not keep open tasks on /system. callmeFIsH will be placed in /system/su.d/ to get autostarted by SuperSU.
fishing/FIsH (file)
The heart of the FIsH.. Get's called by callmeFIsH.
It will be executed by SuperSU on boot and will hijack the process and prepare and setup everything to let your FIsHFOOD coming up.
fishing/FIsH.me (file)
Functions and vars a user/dev normally wouldn't need to change. They are internal stuff only.
fishing/FIsH.porting (file)
As you're trying to port FIsH this file is your main part when it comes to customization for your device.
Here you should find everything required to be adapted and there are very high chances that you HAVE to adjust this to your device.
fishing/gofishing.sh (file)
The remote installer part. It will actually run as root and prepare your system for FIsH.
You normally will never need to touch this.
FIsH target directories
/system/fish/
All the bowels of FIsH like, FIsH, Busybox, fishfood.gz and fishfood.release go here
/system/su.d/
The FIsH caller (callmeFIsH) goes here
/cache/fish/
The most important directory for you: Here you will find all logfiles required for debugging!
.
Bring FIsH on the menu card (porting FIsH)
So you may now have a little bit understanding of what FIsH can do for you and what not.
When you feel FIsH could work for your device then why not just trying to port it?
This guide should help you for this task.
FIsH was made from scratch with portability in mind.
That means I tried to make it as simple as possible for you to port.
I really hope that task has been accomplished..
1. Met the pre-requirements
You have to understood that FIsH will work ONLY when the pre-requirements are met.
There is no way around or "if i met 1 of the 2 - will it work?" NO. You need BOTH!
If you will be asked by a user to port FIsH -> Ensure that the requirements can be met first before investing your time.
There is an easy test u can go for this: just execute the installer like this:
./install.sh --check
The installer will test and check if it get what it needs and then EXIT without(!) any installation.
2. Build your FIsHFOOD (your custom ramdisk)
I recommend to start with TWRP but choose whatever you like. For this guide i stay with TWRP.
Keep in mind that your FIsHFOOD has to be build with the same sources as your running STOCK ROM.
If you want to support multiple STOCK ROM versions you may have to build multiple FIsHFOOD versions.
Testing your FIsHFOOD is not that easy on locked devices so your only option is to go on once you feel your build is ready.
3. Cook the FIsHFOOD
When you build images or ramdisks you may end up with an image file needed some preparation first:
create a gziped cpio of your initial ramdisk u wanna load
example of twrp build by you:
after your build has finished you will find several img files in your out/ directory and you just need to copy the following file:
out/target/product/<YOURCODENAME>/ramdisk-recovery.img
and move it to:
fishing/fishfood.gz
example of an existing twrp image:
abootimg -x twrp.img (will extract the twrp image)
file initrd.img (should tell something like: gzip compressed data. if NOT: gzip it!)
mv initrd.img fishing/fishfood.gz (moves the extracted initial ramdisk)
Some Notes:
- this cpio has to be compressed with gzip (.gz file ending is importat!)
- the name of this file should be fishfood.gz (exactly this)!
- edit or add a file fishing/fishfood.release and type in what ur fishfood is (e.g. TWRP)
and the version of it course (a good example is: TWRP-in-FIsH-v1_LG-G4_LL)
Click to expand...
Click to collapse
4. Prepare the FIsH installer
Download FIsH and extract it.
open the file install.sh
Check the variables u may need to adjust: Check Post #2 above for some explanations and read the comments within
Note about the Android goFIsHing installer (fishing/gofishing.sh)
You normally do not need to touch this file. It may be required if you cannot install FIsH but that should hopefully not happen..
5. Cook the FIsH
open fishing/FIsH.porting
You will find 2 sections: GLOBAL and PORTING
Each section has hopefully meaningful comments to give you an idea what they do and how you should modify them.
Most vars also have example instructions to find the correct values for your device.
When you're trying to port FIsH you may have to try & error FIsH several times before and you may do not want to use your defined key combo to do so.
For this and also as a convenient option when you want to boot directly into FIsH from Android you can set a special flag to always boot FIsH.
Use it with care because it may let it bootloop while in your testing phase.
The file which activates FIsH without a key press is: /cache/recovery/boot
It can make sense to use this for an easier testing process (don't need any key presses to activate FIsH).
In sum the following command comes very handy while developing:
./install.sh && adb shell "su -c touch /cache/recovery/boot" && adb reboot
So the other way is using a key combo without the need to boot into Android.
For this you will find everything you need in the file fishing/FIsH.porting which you usually have to adjust to your specific device.
Providing user feedback for activating the FIsH:
FIsH gets NOT activated by default. That means if you would reboot your device it will just reboot.
To activate FIsH you need either to use a key combination (provided by you) or using the FIsH file flag.
The idea of the FIsH booting process is (see fishing/FIsH.porting)
a) WAIT_LED: show a LED color indicating FIsH has been STARTED (not ACTIVATED)
---> the user has to press the magic key combo NOW
b) VIBRATE: will vibrate to indicate that the time for pressing the magic key combo is over
c) FISH_LED: show a LED color indicating that FIsH has been ACTIVATED .... or NOT!
d) boot into either Android or your FIsHFOOD depending on what the user wants
If your device does not support different LEDs you can instead use the path to vibrate in the LEDs.
e.g. WAIT_LED="$VIBRATE". This will let the device vibrate instead of showing a LED color.
Whatever you end up with you have to check and adapt the enduser installation guide ofc as well..
6. Let the FIsH swim
Now it's time to test your FIsH port. But BEFORE:
You will take a high risk here at this early stage because it CAN bootloop/soft-brick your device if something goes totally wrong!
I hope I had done all to keep the risk for this low but no guarantees!!
So make a FULL backup of ALL your apps and do not forget to backup your internal storage with all your pictures etc.!!! (just a reminder: TWRP does NOT backup your internal storage!! Read the explanation here)
If the worse case happens you may need to totally bring your device back to pure STOCK so you have been warned!
7. Finally give the FIsH a name
If your FIsH swims... omg.. CONGRATS well done !!! The most hardest stuff is done now! Woot u r a REALLY good dev did u know that?! Your community will praise u!
Of course u r free to choose a name but I recommend to name your FIsH package like this:
[yourFIsHFOOD]-in-FIsH-v[VERSIONNUMBER]_[DEVICE-MODEL]_[Android-Version]
e.g.
TWRP-in-FIsH-v1_LG-G4_LL.tgz
Note: Did u see the different use of dashes and underscores? Keeping it that way is important.
This way we all get a clear understanding what it is, which TWRP-in-FIsH version, for which device and for which STOCK ROM version.
8. Release your FIsH to the wild ocean
Ok I will not tell you how you should release but it would be nice if you tell the users where this all comes from
Do not forget to report back to this thread if you have implemented a port so I can add it here for reference.
An example installation guide for your endusers can be found at Post #7: Go FIsHing
If you struggle somewhere you can find me in the IRC (see OP)
When you have to choose a channel it is: #Carbon-Fusion
When you will be asked for a server network choose: freenode
Trouble / Bootloop fix
if you encounter a bootloop (should never happen but who knows) you have 3 choices at least:
Option 1a: (TWRP-Bootloop) Within TWRP open Advanced -> File Manager -> Goto: /system/su.d and click "select" button -> Delete
Option 1b: (TWRP-Bootloop) From your PC: adb shell rm -rf /system/su.d/
Important: Catch the fish log (see next topic)
Option 2 (this works also for a bootloop without twrp): boot into download mode and use LGLaf to get a shell
then:
setenforce 0 <-- if that doesn't work you may have to do a FULL restore to stock
mount -oremount,rw /system
rm -rf /system/su.d/
reboot. You are out of the bootloop.
Important: Catch the fish log (see next topic)
Option 3: Last resort: Reflash STOCK. sorry.. there is always a risk..
Catch the FIsH logs
when in TWRP (or other ramdisk providing adb shell):
adb shell "cat /cache/fish/fish.log"
adb shell "cat /tmp/recovery.log"
OR - when in Android:
adb shell "su -c cat /cache/fish/fish.log"
adb shell "su -c cat /cache/fish/fish.log.old"
adb shell "su -c tar cvzf recoverylogs.tgz /cache/recovery"
adb pull recoverylogs.tgz
Upload the output to https://paste.omnirom.org and paste the link in the IRC channel
FIsH cuisine (examples)
Example implementations
LG G4 (any model):
TWRP-in-FIsH (https://forum.xda-developers.com/g4/development/locked-twrpinfish-locked-g4-devices-t3573048)
HTC Desire 626s:
FIsH-in-SDCARD - big thx to @BigCountry907 (https://forum.xda-developers.com/showpost.php?p=71630297&postcount=35)
HTC DESIRE 526 VERIZON:
FIsH-in-SDCARD - big thx again to @BigCountry907 (https://forum.xda-developers.com/desire-526/general/super-sd-htc-526-vzw-t3596497)
LG Flex 2 (h955):
TWRP-in-FIsH - big thx @ergo911 (https://forum.xda-developers.com/g-flex2/development/fish-flex-2-t3583093/post71690950)
If you have ported another device or know about one just post to this thread so I can list it here
.
FIsH hydra (multiboot in FIsH)
Bringing multiboot to your device is still not finished yet.
I just wanted to release FIsH now because I was able to proof the working concept based on TWRP and as FIsH is nothing device specific anything else should do so as well.
I have little hope that maybe other developers step in and trying to help me with this but well if not it doesn't matter.. just taking longer
The whole thing of multiboot is a WIP (work in progress) currently.
But now you can prepare yourself for a possible way on this by starting a port of TWRP-in-FIsH first to see if the FIsH concept works for your device. This is strongly recommended to start with whereever we will end up here. Then come back here and hopefully until then I have some news about that topic..
So in theory multibooting by FIsH should be possible. FIsH is just executing your ramdisk so..
The only thing we would need is a way to start any of the tools already available right?
Correct. But.. any of them have its own requirements and way of work. So I need to investigate the bowels of them first to adapt them to FIsH.
Let's think about my first choice: multiboot by efidroid.
While it is quite new for me and it's implementation of booting multiple ROMs is very nice and different from MultiROM. Kudos to MultiROM which provide multi boot of custom ROMs for years but I really like the approach of efidroid (even when I just starting to use it).
When you would be able to boot into efidroid with FIsH you could use as many (unpatched) ROMs as you like. Just 1 or 20 - depending on your disk space mainly. So what does that mean? With FIsH you can hijack the boot and jump in efidroid and now u r able to boot whatever custom ROM you like. That's the theory.
The practice is: efidroid is a bootloader and so completely different to TWRP for example. Using the same hack here will not work without modifications of efidroid and maybe FIsH. The key here is to use the efidroid binary plus the cmdline needed to get a custom ROM booted.
Don't get me wrong what NEVER will work is booting into efidroid like fastboot boot uefi_boot.img can provide. The first thing what I'm trying to achieve is to use the efidroid binary plus the needed cmdline to boot up a manually added custom ROM (thx to the efidroid dev @m1cha by the way.. I promise to bug u as often as possible ). When this works we have won. Well it will be far away from user friendly leaving it this way but it should be possible to write a GUI (e.g. based on AROMA) and then doing the actions efidroid offers in its boot menu. So.. at the end some kind of MultROM but without kexec patches would be possible then.
The other way around: multiboot by MultiROM.
A long player in the game of multiboot and often ported to many devices. The problem here is that it is more than just a ramdisk. It is splitted into a modified TWRP plus MultiROM itself which needs to be flashed from within TWRP. This flashing will inject modifications in your /boot image so it will not work this way on locked devices out of the box.
Before I want to dive into the deeps of a possibly MultiROM implentation for FIsH I want to end my testing for efidroid. So atm I cannot say if there will be a way or not because for this I need to find out what MultiROM really do in the boot image and adapt this change to FIsH. I strongly believe that this can be adapted but my time is limited and my priority lays on efidroid for the moment.
Tbh bringing up the modified TWRP version should be easy because it will work the same way as bringing the ordinary TWRP to FIsH but the other part in the boot image is what I'm not sure about what it does (haven't had the time to look into this yet).
If u feel like a developer and you are able to unbrick a soft-bricked device then feel free to investigate and try on your own and let me know
Update (2017-06-27):
I had the time to look into the possibilities of a multirom port to FIsH.
The bad news: its not easy as thought. Its near impossible yet not complete impossible.
I was a little bit confused by a new compile flag in multirom named MR_NO_KEXEC which allows you to use kernels not patched for kexec-hardboot.
Well but its not that easy..
- using kexec-hardboot needs a patched kernel
- and not using it (MR_NO_KEXEC flag set) will replace the whole boot partition(!) when a secondary ROM boots
So both options will break and can't be used.
The only way to go would be to modify the multirom sources (likely the trampoline part) to behave like efidroid does (heavy usage of loop devices instead of the current phys ones).
You can think of that this modification goes VERY deep, means a LOT of work and requires heavy C / C++ skills.
That's why I can't proceed here. I don't think that it is worth it tbh so I will investigate the other options and abandon the MultiROM approach.
The FIsH plate (sdcard booting)
Thanks to @BigCountry907 we could boot FIsH on every qualcomm device in a manner which has the potential to root any device, boot any ROM and more.
You remember? FIsH can be installed on a rooted device ONLY!
That's still true but with this you can boot e.g. TWRP-in-FIsH even on a not rooted MM / N /... by using the FIsH plate..
The whole process makes use of a qualcomm feature which let you do this.
- the whole process is incredible complicated to get it working!!!
- the whole process is very sensitive and you have to find the right combination of needed partitons to make it work
- the whole process is a complete try & error
- if I mean IF I get this working I could patch the bootloader partition on that sdcard partition without touching the REAL bootloader to test without bricking...
- I work together with @BigCountry907 to get it working but we live in complete diff timezones which makes it not easier
-
If you want to help you can find me in the IRC (see OP)
.
Chew the FIsH (Copying/License)
# This is Android FIsH: Fluffy Incredible steadfasterX Hijack
#
# Copyright (C) 2017 steadfasterX <[email protected]>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with this program. If not, see http://www.gnu.org/licenses/
Click to expand...
Click to collapse
FIsH mutation history (Changelog)
android FIsH v3.0
Released: 2017-06-14
Full Changelog: https://github.com/Carbon-Fusion/an...oidFIsH_v2.0...Carbon-Fusion:androidFIsH_v3.0
Download: see the OP
Summary Changelog:
adding the possibility to exclude easily process names/pid's from being killed (coming with a default exclusion list already)
check it out: `fishing/FIsH.porting` --> `EXCLUDEPROCS / EXCLUDEPIDS`
several fixes regarding the ramdisk extraction
heavy speed improvements regarding kill & mount
adding a version string to FIsH to be able to identify which framework is running
added a better `ps` command than the one provided by `busybox ps`
android FIsH v2.0
Released: 2017-04-11
Full Changelog: https://github.com/Carbon-Fusion/an...oidFIsH_v1.0...Carbon-Fusion:androidFIsH_v2.0
Download: see the OP
Summary Changelog:
Improved general speed by factor 4
Many bug fixes
Many improvements for the installer like a new clean function (uninstall FIsH)
android FIsH v1.0
Released: 2017-03-24
Full Changelog: https://github.com/Carbon-Fusion/android_FIsH/commits/androidFIsH_v1.0
Download: see the OP
Summary Changelog:
first general public release
Go FIsHing (enduser installation guide example)
COPY & PASTE template for your own XDA thread (completely pre-formatted)
installguide_XDA_format.txt
.
Special FIsH Dinner (Notes)
TWRP
The first step to get a success with FIsH is to use TWRP as your FIsHFOOD.
Once started the first thing coming in your mind may be backup & restore but use it with care!
FIsH will brutally unmount /system in - afaik - all cases because there will be open files on it which can't be avoided.
In order to use TWRP successfully you should set at least this special flag:
# Always use rm -rf to wipe
TW_ALWAYS_RMRF := true
This is a workaround because it means wiping /system or /data will behave differently then you might expect normally. Without this flag TWRP will format the partition. With this flag set TWRP will use rm and delete all files on it without formatting the partition.
Very interesting. I actually have a locked (bootloader) device which I'm looking for a way to unlock. I feel likr I could get something (*cough*TWRP*cough*) working because of this. Keep it up :good:
veez21 said:
Very interesting. I actually have a locked (bootloader) device which I'm looking for a way to unlock. I feel likr I could get something (*cough*TWRP*cough*) working because of this. Keep it up :good:
Click to expand...
Click to collapse
Just remember the limitations and leave thanks to @steadfasterX
I am very happy to have stumbled on this today.
I cant wait to get a little deeper into it but i must say very nice job.
I have been working on a big project myself. For creating a clone of any device emmc.
Burn the GPT Partition Table to a External_SD Card and flash the images.
What I have found is that If you make the SD Card right the Qualcomm Devices will boot from the sd card.
To the extent that If i unlock a device that normally can not be unlocked using my XTC-2 clip then copy the images ect from the unlocked device burn to sd card and then boot into H-boot or Download mode the Unlocked Status for example Bootloader Unlock and S-off and Super Cid ect ect ect will be present on the locked device. Thus giving elevated permissions. My setback has been there is no normal way for me to write any partitions yet. Anything I flash through H-boot writes to the SD Card. And I have been unable to make TWRP boot this way.
My initial though is to set up my unlocked device with fish and get it all working. Then create the sdcard image that includes the installed fish scripts. It would be simple to modify the external sd to meet all the fish requirements. even if the device itself can not meet the requirements. My device currently meets the requirements but it isnt for me. Its for the community of people that dont have java cards. This could potentially lead to a way of overcoming both of our current limitations.
All i need is a way to boot TWRP from my elevated privileged sd card and I can utilize that to provide unlocking.
Awesome
BigCountry907 said:
I am very happy to have stumbled on this today.
I cant wait to get a little deeper into it but i must say very nice job.
I have been working on a big project myself. For creating a clone of any device emmc.
Burn the GPT Partition Table to a External_SD Card and flash the images.
What I have found is that If you make the SD Card right the Qualcomm Devices will boot from the sd card.
To the extent that If i unlock a device that normally can not be unlocked using my XTC-2 clip then copy the images ect from the unlocked device burn to sd card and then boot into H-boot or Download mode the Unlocked Status for example Bootloader Unlock and S-off and Super Cid ect ect ect will be present on the locked device. Thus giving elevated permissions. My setback has been there is no normal way for me to write any partitions yet. Anything I flash through H-boot writes to the SD Card. And I have been unable to make TWRP boot this way.
My initial though is to set up my unlocked device with fish and get it all working. Then create the sdcard image that includes the installed fish scripts. It would be simple to modify the external sd to meet all the fish requirements. even if the device itself can not meet the requirements. My device currently meets the requirements but it isnt for me. Its for the community of people that dont have java cards. This could potentially lead to a way of overcoming both of our current limitations.
All i need is a way to boot TWRP from my elevated privileged sd card and I can utilize that to provide unlocking.
Awesome
Click to expand...
Click to collapse
cool. your project sounds amazing as well keep us updated please .. !
btw I personally do not need FIsH .. lol.. i have all my devices unlocked but there were many users for my current device which cannot unlock (LG G4 -> only a few models can be unlocked) so I started FIsH..
so don't give up and if u need help.. go to IRC channel #Carbon-Fusion on freenode.. see us there
.
You may have just saved the Verizon sgs4 from total death. We have to see if selinux can be changed first.
ninjasinabag said:
You may have just saved the Verizon sgs4 from total death. We have to see if selinux can be changed first.
Click to expand...
Click to collapse
just use the installer..
./install.sh --check
will tell you..
.
steadfasterX said:
just use the installer..
./install.sh --check
will tell you..
.
Click to expand...
Click to collapse
Knox disables selinux permission changes by default. So I know the install.sh will return with a negative.
I posted the link to this thread on the VZW S4 forums in the hopes someone will pick up.
ninjasinabag said:
Knox disables selinux permission changes by default. So I know the install.sh will return with a negative.
I posted the link to this thread on the VZW S4 forums in the hopes someone will pick up.
Click to expand...
Click to collapse
So no root available there?
.
Sent from my LG-H815 using XDA Labs
@steadfasterX
In my mind it is threads like this and projects like this that make this place so great.
Same reason for my project. To unlock HTC devices. Verizon devices cannot be unlocked easily.
If you ever need any help with the bash script let me know.
I'm pretty good with it. Bells and whistles like menus and whatnot too.
I was glad to see your shell scripts.
I know the language and it makes this easy.
steadfasterX said:
So no root available there?
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Root, but barely. We've gotta use kingroot to open the door before replacing kinguser with SuperSU.
This is where the sd card trick works well.
See if we can boot TWRP off of it then we automatically have root access in adb.
Then its a matter of flashing the right partitions ( Device Specific ) to unlock permanently.
DevUt said:
Just remember the limitations and leave thanks to @steadfasterX
Click to expand...
Click to collapse
No , I reached my thanks limit. I do know the proper ways of man :good:

[Root] H901 - For Newbies!

None of the methods in this thread are my own work. I struggled with getting my phone rooted for a long time and spend 10s of hours on the process. I had never rooted before and was therefore unfamiliar with all the terms, unfamiliar with how to complete all the recommended checks to ensure one had the right model, etc. There were several helpful threads but most approach the subject with the assumption that one knows something about the process. In this post I lay out what worked for me in a step-by-step way and what you have to do to achieve my results.
#1 Ensure you have a H-901 motherboard and not the Korean F600 motherboard by checking the sticker, and checking “About Phone” -> “Hardware Info” -> “Model number” in settings. These must both be LG-H901…from what I can tell the community has only developed technique for the H-901 variant.
#2 Get a micro SD card and load it with Magisk https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 , and if you have Marshmallow or Lollipop and want Nougat (much better experience IMHO), load the files in this thread: https://forum.xda-developers.com/tmobile-lg-v10/development/h901-t-mobile-nougat-v30b-twrp-t3639203 And maybe this thread as well (read both and then decide): https://forum.xda-developers.com/tm.../h901-t-mobile-nougat-v30c-flashable-t3744648
#3 Ensure you have unlocked your bootloader. (apparently only for T-mobile LG v10s since other carriers lock the bootloader) The FWUL virtual machine root method will not work if you have not done so. This is an entire process in itself. The following 2 videos which show how to root android 6.0 or earlier (process will not work with Nougat, 7.0, since some fastboot commands are missing). https://youtu.be/OtXlokk6JkQ , https://youtu.be/PPLwFGxLQA4
Also, this thread may be helpful. https://forum.xda-developers.com/tm...t-mobile-bootloader-factory-unlocked-t3236224 , download the nexus root toolkit here for easy ADB command entry http://www.wugfresh.com/nrt/ —we will only use the “Advanced Utilities” -> ”Manual Input” -> ”Launch CMD Prompt”. When it prompts you to select a phone, select the first option and then for android version select Android *** Any. Don’t use any of the other commands because they are not configured for your device.
If you get a “waiting for device” error while attempting the fastboot oem unlock command in the above thread, see: https://forum.xda-developers.com/tmobile-g4/help/fastboot-waiting-device-t3489789 Great video which shows how to change drivers. You will need to do this, I found a number of drivers that were already on my PC from google and Samsung worked although I didn’t have the specific one mentioned in the above thread. Don’t be afraid to experiment… you can always try another driver. And don’t require it to be hardware compatible. Ignore the warning message: https://youtu.be/nQjg6ePnGAc
---------------------------------------------
NOW that you have your bootloader unlocked you can proceed to actually flash the TWRP image as per this thread: https://forum.xda-developers.com/tmobile-lg-v10/general/root-h901-nougat-t3773942
Notes before beginning:
-To enter download mode to begin: Plug a USB cable into your phone with your phone powered off, hold down on the Vol Up button and plug the USB cord into your computer. It should immediately boot into download mode. Exiting Download mode after flash: pull battery…no damage will be done.
-To enter recovery after flashing TWRP: power off the phone then hold both the down volume and power at the same time. When you see the black LG screen briefly release the power button and then press it again while not letting the volume down up. You will see a screen asking if you want to delete all user settings. Say YES (via the volume and power keys—no touch input). You will see a screen asking if you want to delete all user data. Say YES (the data is only deleted if TWRP loads successfully) You will briefly see the black LG bootup screen. TWRP or factory recovery will load. Or if you did not unlock your bootloader, it will say recovery is corrupted and cannot be trusted, and then boot normally without changing your settings or deleting files.
-Additional note: as of 7-23-18 some commands had changed:
From V20 forum, Brian (runningnak3d) has moved to gitlab.com. So instead of github.com, we have to use a new git repository that Brian created in gitlab.com.
cd
mv lglaf lglaf_BAK
git clone https://gitlab.com/runningnak3d/lglaf
cd lglaf
git pull
git checkout v10-miscwrte
There are additional comments in the thread. Some timeout errors may be solved by: 1 - Download the VirtualBox extension pack: https://download.virtualbox.org/vir..._VirtualBox_Extension_Pack-5.2.8.vbox-extpack
2 - Go to File / Preferences / Extensions / click the + and browse to where you downloaded it.
3 - Once installed, with the VM off, right click on the VM, and go to settings. Click on USB, and pick USB 3.0. If your machine doesn't have a USB 3 port, pick 2.0.
But frankly, simply up arrow after a timeout error to load the last command on the command line and hit enter again. Simply keep doing this until it works. You know it works because no dialog appears for several minutes before informing one of success.
**Upgrade to Nougat after Flashing TWRP and booting to Recovery steps: (I did a full wipe as suggested by this thread: https://forum.xda-developers.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594 before flashing the v30b upgrade then full Nougat zip, and then flashing Magisk. I flashed the 3 zips sequentially. I was afraid Nougat would not boot successfully because the zip files are less than 2 gb combined but success! You may want to also flash the 30c upgrade before flashing Magisk for a total of 4 zip flashes. I did not try this. However doing all this means no backups are done so if there is a problem you may have to flash a KDZ with the LG UP tool (don’t ask me how).
As a final note, I cannot answer specific questions about the various processes provided or errors you may encounter that I have not listed in this write up since I have not experienced them. A bit of research on your part may be required, but this post should provide you with a huge head start compared to where I started. Good luck!
Methods to get unlimited mobile hotspot, very useful if you're on the $50 MetroPCs (owned by T-mobile) unlimited plan. All you $70 T-mobile plan suckazzz! https://forum.xda-developers.com/tm...ited-tetherting-hotspot-t3825144#post77249285
I would actually recommend using a USB tether client and forgoing root access if tethering is your only objective and you are trying to be efficient with your time. However, with root you can install all these cool apps!: https://www.digitaltrends.com/mobile/best-android-root-apps/
The following caught my eye:
-Rec: screen record
-liveboot: boot animation (does not work with Magisk)
-Servicely: checks to see which apps are using a lot of battery and lets you suppress them
-Adblock Plus
-Titanium backup: very powerful phone backup application & bloatware remover look into for quickly switching over to a different lg v10
-Greenify: put apps into hibernation
-System tuner: get lots of info about you phone but be careful making changes
-ES file explorer: dig into the android system
-Disk digger: recovers deleted files (photos only?)

[ROM][UNOFFICIAL] LineageOS 17.1 for Unihertz Atom L (20200828)

Introduction
This thread contains the LineageOS 17.1 custom firmware images for the Unihertz Atom L, a rugged Android phone released by Unihertz in July 2020, and the accompanying LineageOS Recovery used for flashing the firmware.
Please note that this ROM is one of my side projects, for which I could provide zero warranty. By installing this ROM, you acknowledge that you take all the risks that come with installing custom firmwares on your devices, including but not limited to bricking your device, losing your data, etc. You are always suggested to keep backups and make sure you know how to flash back to official ROM before trying any custom ROMs.
Please find the download links in the Download section. The following sections are guides to installing the ROM.
WARNING: DO NOT try to install this on Atom XL. This is ONLY for the Atom L.
Working Features
- All basic features (Telephony, VoLTE, Audio, Camera, NFC, WiFi, Bluetooth, ....)
- Programmable PTT (red) button (Functionality can be set in Settings - System - Buttons, under the "Search Button" section)
- 48MP camera seems to be working (unlike on many other super resolution devices)
Known Issues
- VoLTE is working (at least for me) but sometimes quirky. If you find it somehow stopped working, usually turning it off and back on again (in Settings - Network - Mobile Network) will fix it. Putting the device to SELinux Permissive mode also fixes most of the VoLTE quirks but this is not recommended (a few quirks in Enforcing mode is better than having the whole device Permissive)
Unlocking
1. Boot your Atom L to the official OS
2. Go into Settings - About phone, tap "build number" several times to enable developer settings
3. Go to Settings - System - Developer Settings, enable OEM unlocking and ADB debugging
4. Run `adb reboot bootloader` on your PC (there is no way to enter bootloader directly, only possible through adb)
5. Run `adb flashing unlock` and comfirm unlock on device (THIS WILL WIPE ALL DATA)
6. Reboot and now you should see an unlocked warning during boot screen.
Installing LineageOS Recovery
For now the only working recovery is the LineageOS Recovery, because the device's kernel does not load the touch driver in recovery mode for whatever reason, rendering TWRP useless.
1. Download `lineage_recovery_XXX.img` and `vbmeta.zip`, unpack `vbmeta.zip` to get three .img files starting with `vbmeta`
2. Run `adb reboot bootloader` to put your device in bootloader mode
3. Run `fastboot flash --disable-verification --disable-verity vbmeta vbmeta.img`
4. Run `fastboot flash --disable-verification --disable-verity vbmeta_system vbmeta_system.img`
5. Run `fastboot flash --disable-verification --disable-verity vbmeta_vendor vbmeta_vendor.img`
6. Run `fastboot flash recovery lineage_recovery_XXX.img`
7. Run `fastboot reboot recovery` to reboot into the newly-installed LineageOS Recovery
The LineageOS Recovery is operated by volume keys as selection and power as confirmation (or entering sub-menus). To return to upper levels of menus from sub-menus, press volume up until the selection goes to the first item and then disappears, then press power (i.e. there's a hidden "Go Back" item at the very top of each sub-menu).
The recovery will show a verification failed prompt for most packages that are not signed with the AOSP keys. This is safe to ignore.
Installing LineageOS 17.1
The LineageOS image must be installed via LineageOS recovery.
1. Download `lineage-17.1-Atom_L-XXX.zip`
2. Reboot your device into recovery (`adb reboot recovery` or simply hold volume up while turning power on)
3. Wipe all data (factory reset) (THIS DELETES EVEN INTERNAL STORAGE)
4. Choose Apply Update, then Apply Update from ADB
5. Run `adb sideload lineage-17.1-Atom_L-XXX.zip` from your PC
6. Wait for the process to finish. (The recovery might prompt something about verification failure, just ignore it and continue anyway)
7. At this point, you can then sideload the LATEST Magisk and OpenGAPPS Nano at your will (note that the size of the system partition might only be enough for the `nano` variant of OpenGAPPS) (If installing Magisk / OpenGAPPS fails, you can try rebooting into recovery again in advanced menus, then try installing them again)
8. Reboot into system and enjoy (Note that Magisk might cause your device to boot loop once or two but it will eventually boot)
When updating to a newer build, you have to flash the new zip, and then re-flash whatever mod you have installed previously (Magisk / GAPPS).
Download Links
LineageOS:
lineage-17.1-Atom_L-20200828-peter-signed.zip: https://mega.nz/file/bAgh1BZA#jzMs_0e9NUR9NcALXWp51ZeWttM5rl_3K5T8Or9hAW0
- Synchronized updates from LineageOS upstream.
lineage-17.1-Atom_L-20200728-peter-signed.zip: https://mega.nz/file/vBwlmL5D#wpw8RovBHyVFCLFlhQ2H5QAIb0ECXkT4of0FRijiP6A
LineageOS Recovery:
lineage_recovery_20200728.img: https://mega.nz/file/yc4Dnbyb#yx0Ci9p3q9_lfAiXkGfgWDFnRJI-JSGrv3kyawkU3fw
vbmeta:
vbmeta.zip: https://mega.nz/file/nF51mBoY#ZNY4j92wc_6a1dXch3l5r-w4VFl9QjN7YJaRMKRoEGk
XDA:DevDB Information
LineageOS 17.1 for Unihertz Atom L, ROM for the Android General
Contributors
PeterCxy
Source Code: https://cgit.typeblog.net/android/device/unihertz/Atom_L/
ROM OS Version: Android 10
Version Information
Status: Alpha
Created 2020-07-28
Last Updated 2020-07-28
How different is the Atom XL?
PeterCxy said:
Introduction
WARNING: DO NOT try to install this on Atom XL. This is ONLY for the Atom L.
Unfortunately I've got the XL version which I thought only varied from the L by the presence of a UHF radio! Can you explain to me why its not a suitable candidate for your mods which sound very good!?
And before you ask, I only got this radio for hacking so I don't mind experimenting if that is required. Please let me know if I can help.
The Bitfarmer
Click to expand...
Click to collapse
tvroman said:
PeterCxy said:
Introduction
WARNING: DO NOT try to install this on Atom XL. This is ONLY for the Atom L.
Unfortunately I've got the XL version which I thought only varied from the L by the presence of a UHF radio! Can you explain to me why its not a suitable candidate for your mods which sound very good!?
And before you ask, I only got this radio for hacking so I don't mind experimenting if that is required. Please let me know if I can help.
The Bitfarmer
Click to expand...
Click to collapse
Because Unihertz publishes completely different firmware files for the L and XL, so the safest assumption is that there is more difference than just the UHF radio. If you want to risk it, then you CAN try using this ROM on the XL, as long as you know how to revert back to official if things go wrong. (But I cannot guarantee if the kernel image from L that this ROM uses will not cause serious issues like corrupted baseband or something on the XL)
My suggestion is that instead of trying this ROM directly on the XL, someone with XL can try to modify my device tree for L, replacing the kernel, dtbo images and other vendor blobs from the ones from XL, and then re-compile the ROM for XL. This would be the proper way to handle these two devices.
Click to expand...
Click to collapse
Going XL
Hi.
Great work. :good:
I want to built a ROM for the Atom XL myself. And because I'm no expert on this (for now) I'm in search of guides and hints on how to achieve my goal.
As far as I know the biggest problem with Unihertz is that they use a Mediatek chipset with which they are not allowed to provide the sourcecode of the kernel. Or at least you have to pay for it from Mediatek.
But there are some variants of the chipset (Helio P60; mt6771) used in other mobile phones (e.g. Nokia X5) for which I was able to find kernelsources on Github. Using these and the latest Android kernel from google I tried to compile a kernel as a starting point. I was able to extract the build.config directly from the phone which helped tremendously. This should at least get me to the point where I'm able to assemble a TWRP build. But I believe that I'm still missing some (vital?) drivers which are specific to the actual device. This includes I think the missing touchscreen driver that you mentioned is preventing the recovery to be useful.
So now I'm a little bit stuck, because most of the guides to arrange a LineageOS (or any other custom ROM) build tree I found require the sourcecode from the manufacturer which we don't have. All other guides to build from scratch were too generic for my current level of expertise.
Can you please share your approach to create this build?
If you don't want to do this in the open you could also PM me.
With kind regards
ADT
a-dead-trousers said:
Hi.
Great work. :good:
I want to built a ROM for the Atom XL myself. And because I'm no expert on this (for now) I'm in search of guides and hints on how to achieve my goal.
As far as I know the biggest problem with Unihertz is that they use a Mediatek chipset with which they are not allowed to provide the sourcecode of the kernel. Or at least you have to pay for it from Mediatek.
But there are some variants of the chipset (Helio P60; mt6771) used in other mobile phones (e.g. Nokia X5) for which I was able to find kernelsources on Github. Using these and the latest Android kernel from google I tried to compile a kernel as a starting point. I was able to extract the build.config directly from the phone which helped tremendously. This should at least get me to the point where I'm able to assemble a TWRP build. But I believe that I'm still missing some (vital?) drivers which are specific to the actual device. This includes I think the missing touchscreen driver that you mentioned is preventing the recovery to be useful.
So now I'm a little bit stuck, because most of the guides to arrange a LineageOS (or any other custom ROM) build tree I found require the sourcecode from the manufacturer which we don't have. All other guides to build from scratch were too generic for my current level of expertise.
Can you please share your approach to create this build?
If you don't want to do this in the open you could also PM me.
With kind regards
ADT
Click to expand...
Click to collapse
You don't need the kernel source code to build a working ROM -- just look at my device tree for Atom L. I think you can build a working ROM for the XL by just replacing the prebuilt kernel in my device tree with the one from Atom XL and also re-extracting the vendor blobs from XL using the script in my devcie tree, then rename everything to Atom XL instead of L. I don't know if the integrated amateur radio would still work though.
PeterCxy said:
You don't need the kernel source code to build a working ROM -- just look at my device tree for Atom L. I think you can build a working ROM for the XL by just replacing the prebuilt kernel in my device tree with the one from Atom XL and also re-extracting the vendor blobs from XL using the script in my devcie tree, then rename everything to Atom XL instead of L. I don't know if the integrated amateur radio would still work though.
Click to expand...
Click to collapse
I'm already on to that.
But I seem to have trouble extracting the prebuilt kernel. None of the tools I found gave me the exact files you have got (dtb.img, dtbo.img, Image.gz). What did you use?
The best I could get were "dtb", "kernel" and "dtborecovery" (without extensions) which roughly had the same size as yours.
Also, as far as I understand it, with your initial commit (without the modifications for Lineage itself) I should be able to at least compile a recovery image but I got an error regarding a missing dtb.img file in the "out" directory.
Something seems to be missing because, my dtb file is in the "device" directory and not being transfered into "out" during building.
I'm not sure that is because I have got a different naming scheme (renamig it didn't help) or I did something wrong with the extraction.
---------- Post added at 07:30 ---------- Previous post was at 07:14 ----------
Another question I have:
Are the vbmeta-files you used to flash the recovery the ones from the original firmeware zip from unihertz or did you get them from the lineage built?
And reguarding the rather smallish system partition:
I have an idea to bypass that by using the SPFlash Tool from Mediatek. As far as I understand the settings in the scatter-file this tool does a repartitioning of the internal storage. So we only need to "decrease" the userdata, "move" some partitions inbetween and "increase" the system. Only problem is, I couldn't find a partition designated as "system" in the scatter-file, only one big "super" and a "vbmeta-system" (which for my understaning is for verified boot) partition.
What do you think?
a-dead-trousers said:
I'm already on to that.
But I seem to have trouble extracting the prebuilt kernel. None of the tools I found gave me the exact files you have got (dtb.img, dtbo.img, Image.gz). What did you use?
The best I could get were "dtb", "kernel" and "dtborecovery" (without extensions) which roughly had the same size as yours.
Also, as far as I understand it, with your initial commit (without the modifications for Lineage itself) I should be able to at least compile a recovery image but I got an error regarding a missing dtb.img file in the "out" directory.
Something seems to be missing because, my dtb file is in the "device" directory and not being transfered into "out" during building.
I'm not sure that is because I have got a different naming scheme (renamig it didn't help) or I did something wrong with the extraction.
---------- Post added at 07:30 ---------- Previous post was at 07:14 ----------
Another question I have:
Are the vbmeta-files you used to flash the recovery the ones from the original firmeware zip from unihertz or did you get them from the lineage built?
And reguarding the rather smallish system partition:
I have an idea to bypass that by using the SPFlash Tool from Mediatek. As far as I understand the settings in the scatter-file this tool does a repartitioning of the internal storage. So we only need to "decrease" the userdata, "move" some partitions inbetween and "increase" the system. Only problem is, I couldn't find a partition designated as "system" in the scatter-file, only one big "super" and a "vbmeta-system" (which for my understaning is for verified boot) partition.
What do you think?
Click to expand...
Click to collapse
> None of the tools I found gave me the exact files you have got (dtb.img, dtbo.img, Image.gz). What did you use?
There is a tool called `unpack_bootimg` in the Android source code. Just run `make unpack_bootimg` in the root directory of the Android source tree and you will get one in the output directory. (btw I have renamed those extracted files so the names won't exactly match, but you need this tool to extract the correct images. All other tools won't work properly).
> my dtb file is in the "device" directory and not being transfered into "out" during building.
Because most tools other than `unpack_bootimg` extracts dtb incorrectly.
> Are the vbmeta-files you used to flash the recovery the ones from the original firmeware zip from unihertz or did you get them from the lineage built?
Those don't matter. Either will work as long as you flash it with the correct parameters as given in my post.
> And reguarding the rather smallish system partition
No don't do that. Android 10 does not use a separate system partition anymore, instead both system, vendor and product are sub-partitions in a huge super partition. When flashing a new ROM, the partitions are automatically resized to match the new image exactly, instead of leaving free space unused like before Android 10. That's why I need to reserve space in BoardConfig.mk for gapps to be installed correctly.
Still not able to build.
PeterCxy said:
There is a tool called `unpack_bootimg` in the Android source code. Just run `make unpack_bootimg` in the root directory of the Android source tree and you will get one in the output directory. (btw I have renamed those extracted files so the names won't exactly match, but you need this tool to extract the correct images. All other tools won't work properly).
Click to expand...
Click to collapse
I'm still getting an error:
Code:
FAILED: ninja: 'out/target/product/Atom_XL/dtb.img', needed by 'out/target/product/Atom_XL/boot.img', missing and no known rule to make it
Comparing your BoardConfig.mk with mine shows a slight difference in the offset and size values which could be associated with the different kernels of the phones.
But using "unpack_bootimg" I didn't get a value for "BOARD_KERNEL_OFFSET" like you have it in your config. Could this be the problem?
Your BoardConfig.mk
My BoardConfig.mk
Do you see anything else out of the ordinary?
(Because I'm doing everything what you did step-by-step the links point to the best matching commits)
Despite not being able to compile right now I tried to press on with integrating your changes in the hopes that it will be fixed somehow later on
So I'm currently stuck on this commit of yours:
Atom_L: import overlay from official vendor
Where did you get the "config.xml" and "power_profile.xml" from? The best thing I could find was a "power_profile.xml" inside "/vendor/overlay/FrameworkResOverlay/FrameworkResOverlay.apk" which seems to be a "compiled" version of the aforementioned xml-file.
a-dead-trousers said:
I'm still getting an error:
Code:
FAILED: ninja: 'out/target/product/Atom_XL/dtb.img', needed by 'out/target/product/Atom_XL/boot.img', missing and no known rule to make it
Comparing your BoardConfig.mk with mine shows a slight difference in the offset and size values which could be associated with the different kernels of the phones.
But using "unpack_bootimg" I didn't get a value for "BOARD_KERNEL_OFFSET" like you have it in your config. Could this be the problem?
Your BoardConfig.mk
My BoardConfig.mk
Do you see anything else out of the ordinary?
(Because I'm doing everything what you did step-by-step the links point to the best matching commits)
Despite not being able to compile right now I tried to press on with integrating your changes in the hopes that it will be fixed somehow later on
So I'm currently stuck on this commit of yours:
Atom_L: import overlay from official vendor
Where did you get the "config.xml" and "power_profile.xml" from? The best thing I could find was a "power_profile.xml" inside "/vendor/overlay/FrameworkResOverlay/FrameworkResOverlay.apk" which seems to be a "compiled" version of the aforementioned xml-file.
Click to expand...
Click to collapse
> Comparing your BoardConfig.mk with mine shows a slight difference in the offset and size values which could be associated with the different kernels of the phones.
TARGET_KERNEL_OFFSET should normally always be 0x00008000. Also, your other offset values seem to be wrong too -- those values from `unpack_bootimg` cannot be filled in directly to BoardConfig.mk. Instead, you need to subtract BOARD_KERNEL_BASE from them (e.g. BOARD_RAMDISK_OFFSET should be 0x55000000 - 0x40078000, which is 0x14f88000, the same as mine). In fact, I think those parameters should be exactly the same for XL and L. Other than that, I don't think I can see much of a problem about your makefiles.
However, note that not all of my historical commits represent a compilable state of the device tree. I'd suggest you start directly from the latest state and just replace whatever is relevant instead of starting over. And there should not be much that needs changing at all except device names, fingerprints and the proprietary vendor files.
> Where did you get the "config.xml" and "power_profile.xml" from
Exactly from those apks. Just decompile them using apktool.
PeterCxy said:
TARGET_KERNEL_OFFSET should normally always be 0x00008000. Also, your other offset values seem to be wrong too -- those values from `unpack_bootimg` cannot be filled in directly to BoardConfig.mk. Instead, you need to subtract BOARD_KERNEL_BASE from them (e.g. BOARD_RAMDISK_OFFSET should be 0x55000000 - 0x40078000, which is 0x14f88000, the same as mine). In fact, I think those parameters should be exactly the same for XL and L. Other than that, I don't think I can see much of a problem about your makefiles.
Click to expand...
Click to collapse
Still giving me errors.
So I tried a very unconventional approach: I just copied the file myself into the mentioned "out/target/product/Atom_XL" folder.
For now it's still compiling. Fingers crossed.
PeterCxy said:
However, note that not all of my historical commits represent a compilable state of the device tree. I'd suggest you start directly from the latest state and just replace whatever is relevant instead of starting over. And there should not be much that needs changing at all except device names, fingerprints and the proprietary vendor files.
Click to expand...
Click to collapse
I just reached your biggest commit yet.
Can you tell me how you got the list of needed files? I hope it's not through trial-and-error.
Except for the values in "setup-makefiles.sh" only the "proprietary-files.txt" seems to be device specific. Is there anything else I need to be aware of in this commit?
P.S.: I know it is tedious to go through your commits one by one but I want to learn something of it not just simply copying what you did. To get a feeling where the biggest pitfalls are and what you did to circumvent them.
a-dead-trousers said:
Still giving me errors.
So I tried a very unconventional approach: I just copied the file myself into the mentioned "out/target/product/Atom_XL" folder.
For now it's still compiling. Fingers crossed.
I just reached your biggest commit yet.
Can you tell me how you got the list of needed files? I hope it's not through trial-and-error.
Except for the values in "setup-makefiles.sh" only the "proprietary-files.txt" seems to be device specific. Is there anything else I need to be aware of in this commit?
P.S.: I know it is tedious to go through your commits one by one but I want to learn something of it not just simply copying what you did. To get a feeling where the biggest pitfalls are and what you did to circumvent them.
Click to expand...
Click to collapse
> Still giving me errors.
Looks like that dtb.img error was totally my fault -- it was due to my jerry-rigged solution of using prebuilt dtb image that conflicted with one of Lineage's update in August and I haven't built the ROM for a month. Now I have fixed it in the latest commit.
> Can you tell me how you got the list of needed files?
All of those files are for VoLTE support and I started with the list from a commit in Redmi Note 7 Pro's device tree that imported those VoLTE blobs, and then added what was missing one by one (when something is missing the Phone process will crash and you can see what got missing in the logs). I don't think the list will be any different on Atom XL so you can just use the one in my device tree.
Hi.
Thanks to you everything is running smoothly here. But what bugs me is that TWRP is not working on our devices.
Although for the Atom there is a possibility: https://forum.xda-developers.com/android/development/twrp-modded-to-unihertz-atom-t3885793
Before I want to go public with my build I wanted to solve this last "mystery".
So I tried to include it in my current source tree according to the (official?) guide but some errors prevented me from a successful build.
Naturally I asked for some guidance at the most reasonable places I know of but got nothing so far:
https://forum.xda-developers.com/showpost.php?p=83443611&postcount=4622
https://forum.xda-developers.com/showpost.php?p=83455271&postcount=4623
https://github.com/TeamWin/android_bootable_recovery/issues/70
I even tried different repositories (omnirom/android_bootable_recovery) and revisions (android-9.0) but these resulted in missing library "type" (static vs. shared) errors so I assume these are too old for LineageOS 17.1
What I want to know is how you managed to get TWRP to built for your device even though the touchscreen wasn't working?
Did you use your LineageOS source tree or one of the many "minimal" manifests? If so, which one would be the "best" to use?
wkr ADT
@PeterCxy and @a-dead-trousers
Thanks for all the work on this so far. I've got an Atom L and have gotten the ROM's PeterCxy posted running on them as in the OP. Do either of you have a quick step-by-step workflow of how you got all the Lineage sources set up and built into the various ROMs? I'd like to be able to build the ROMs from scratch and understand the process.
If I can get caught up to where you two are at with the builds, I can help debug, test and work through issues.
dirtylimerick said:
[MENTION=5351691] Do either of you have a quick step-by-step workflow of how you got all the Lineage sources set up and built into the various ROMs? I'd like to be able to build the ROMs from scratch and understand the process.
If I can get caught up to where you two are at with the builds, I can help debug, test and work through issues.
Click to expand...
Click to collapse
I documented my steps to setup up the build environment in the readme of my repo:
https://github.com/ADeadTrousers/android_device_Unihertz_Atom_XL
But leave out the TWRP part. It isn't working yet mostly because TeamWin/android_bootable_recovery and LineageOS/android_bootable_recovery are too similar.
To figure out all the bits and pieces needed for the device I followed the commit log of @PeterCxy build.
Hi, @PeterCxy.
Finally I was able to build a TWRP recovery and surprise, surprise the touchscreen isn't working.
But during my attempts to get a working TWRP build I came acros a guide that explains how to patch the kernel to get the touchscreen to work.
https://forum.hovatek.com/thread-27132.html
So I tried to follow it but failed to identify the "end" of the zipped Image-file (step 18) to remove the payload from the gz-file. Regardless of which of the null-bytes I use for cutting I always get a warning from 7-zip that there is still data at the end.
Do you know a better approach to achieve this whole patching? Maybe even come up with a scripting solution to easily apply this patch in later builds?
wkr ADT
a-dead-trousers said:
Hi, @PeterCxy.
Finally I was able to build a TWRP recovery and surprise, surprise the touchscreen isn't working.
But during my attempts to get a working TWRP build I came acros a guide that explains how to patch the kernel to get the touchscreen to work.
https://forum.hovatek.com/thread-27132.html
So I tried to follow it but failed to identify the "end" of the zipped Image-file (step 18) to remove the payload from the gz-file. Regardless of which of the null-bytes I use for cutting I always get a warning from 7-zip that there is still data at the end.
Do you know a better approach to achieve this whole patching? Maybe even come up with a scripting solution to easily apply this patch in later builds?
wkr ADT
Click to expand...
Click to collapse
There is no sane way to solve the problem without kernel source code. Basically the stock kernel just does not load the touch screen driver in recovery mode. That patching guide is pretty out of date and I imagine it won't work on most recent kernels. The only proper way is to pressure Unihertz to actually obey GPLv2 and release their kernel source code. Or maybe someone can try reverse-engineering the kernel, but at least I won't do it because it'll just be too much of a hassle.
PeterCxy said:
There is no sane way to solve the problem without kernel source code. Basically the stock kernel just does not load the touch screen driver in recovery mode. The only proper way is to pressure Unihertz to actually obey GPLv2 and release their kernel source code.
Click to expand...
Click to collapse
I'm with you on this one, but as long as we don't have the source code we need to resort to other means to achieve our goals.
PeterCxy said:
That patching guide is pretty out of date and I imagine it won't work on most recent kernels.
Click to expand...
Click to collapse
Yeah it's from way back in 2019
Anyway, with a little bit of tinkering I was able to modify my kernel to load the touchscreen driver in recovery mode.
Here is the device tree and the manifest i used.
I wouldn't recommend to use it in it's current state at all though because the fstab needs a little bit of tinkering. Everything seems to be either unordered or not mounted properly and I fear anything you do in there now will mess up the whole device. BUT I got the touchscreen goin for me which is nice.
PeterCxy said:
Or maybe someone can try reverse-engineering the kernel, but at least I won't do it because it'll just be too much of a hassle.
Click to expand...
Click to collapse
As soon as I have everything sorted out that needs to be fixed on my build (e.g. signing, radio, included gapps working properly, TWRP) I want to dig deeper into the kernel.
There are some devices with Helios P60 out there from other vendors which offer kernel sources.
P.S.: I also uploaded a HOW-TO in my device tree.
If you or someone else wants to try it. Also if you want to you can send me a "symbl.txt" (see to the HOW-TO) extracted from your device then I can do the patching for the Atom_L too.
a-dead-trousers said:
I'm with you on this one, but as long as we don't have the source code we need to resort to other means to achieve our goals.
Yeah it's from way back in 2019
Anyway, with a little bit of tinkering I was able to modify my kernel to load the touchscreen driver in recovery mode.
Here is the device tree and the manifest i used.
I wouldn't recommend to use it in it's current state at all though because the fstab needs a little bit of tinkering. Everything seems to be either unordered or not mounted properly and I fear anything you do in there now will mess up the whole device. BUT I got the touchscreen goin for me which is nice.
As soon as I have everything sorted out that needs to be fixed on my build (e.g. signing, radio, included gapps working properly, TWRP) I want to dig deeper into the kernel.
There are some devices with Helios P60 out there from other vendors which offer kernel sources.
P.S.: I also uploaded a HOW-TO in my device tree.
If you or someone else wants to try it. Also if you want to you can send me a "symbl.txt" (see to the HOW-TO) extracted from your device then I can do the patching for the Atom_L too.
Click to expand...
Click to collapse
Happy to hear that you were able to figure the touchscreen out. I tried to port TWRP at the very beginning when I started tinkering with the device but quickly grew frustrated and just ported Lineage Recovery instead. I guess I might try patching the kernel image too at some point later.
BTW, for TWRP to work with devices released after Android 10, I'm pretty sure you need an extra set of patches that are not yet fully merged to the main TWRP repository. I remember there's some guy providing another manifest with all the patches applied but I couldn't remember the name.
Hi.
I just officially announced my build for the Atom XL:
https://forum.xda-developers.com/android/development/rom-lineageos-17-1-unihertz-atom-xl-t4171407
Could you please put a link in your first post for those in search of the Atom XL and found your thread instead. Thanks.
wkr ADT
hi @PeterCxy.
During my daily usage of the phone I encountered a strage problem:
The audio jack isn't working. Plugging in some headphones I get this slight click in the earpieces when the circuits connect but nothing else happens. Neither a "headphone" icon in the status bar nor hearing anything coming from the headphones itself. The main speaker of the phone keeps playing the music. Using bluetooth everything is working as expected though. So I used logcat to see if something is coming up during plugging in but nothing "catchy" shows up in the logs. My guess is that some (vendor?) service is missing or not started during booting. Next I checked If something shows up on logcat during boot but I'm not sure for what to look exactly. There are quite a few errors and warnings though. In my despair I started to "fix" the "avc: denied" (SEPolicy) entries. Thats when I found a specific error reguarding VoLTE. Maybe this would fix the problems you had with VoLTE in enforcing mode:
https://github.com/ADeadTrousers/an..._Atom_XL/blob/master/sepolicy/private/init.te
(The line with "socket_device:sock_file")
My provider doesn't support VoLTE so I'm not sure if this helps or not. Maybe you could check it.
Anyway can you please tell me if your device's audio jack is working or not?
If you're (by some mysterious coincidence) not affected by this, can you at least give me some pointers for what to look for to get this fixed on my side.
The Internet Is not very helpful when searching for "android audio jack" or something similiar.
Thanks in advance.
wkr ADT

Categories

Resources