Database Info

How to root the CDMA Hero

Ok everyone. First off do not update your phone if Sprint offers an upate. I don't think they are going to but if they do anytime soon and you update this exploit could likely be fixed. When updates are released the devs will make updates that keep root so do not update!
That said, this is a very newbie guide. This is meant for Windows but I will post instructions for linux as well (Ubuntu). I just need to warn you that I can't adb into my phone from Ubuntu so I have to do it through Windows. Don't know why it doesnt work but it doesnt. Mac users you can always (assuming you can get it to work in Ubuntu) download a live cd and boot into Ubuntu to try this. I don't have a mac (nor do I want one) so I can't give instructions (though I assume they should be relatively the same).
Step 1:
First you need to download the Android SDK. It may soumd confusing but it's not. There are tools in here that we need. You can get it from http://developer.android.com/sdk/index.html. This is a modular SDK and all the tools we need are in this download. Once downloaded you just need to extract it in a directory of choice.
The next thing we download is asroot2. This is a script that was developed that runs an exploit in Android's linux that allows us to run root. The link for that is here: http://forum.xda-developers.com/attachment.php?attachmentid=244212&d=1257621154. Unzip that file and place it in a directory of your choice. Also download http://www.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-heroc-v1.2.3.img and place that into the same directory you extracted asroot2.
Step 2:
Connect the phone to the USB port.
Ubuntu is easy for this (again assuming it works for you). Simply open a terminal and cd into the directory that you extracted the sdk into. Then cd into the tools directory. Then run the following commands:
sudo ./adb push /directory_you_placed_asroot2/asroot2 /data/local/
sudo ./adb shell chmod 0755 /data/local/asroot2
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4755 su
If all goes well you should be presented with a new prompt. This is the linux terminal built into Android. This will allow us to execute all the commands we need to execute because the asroot2 script gave us root access.
In Windows it is a little more difficult. You have to first install the driver for the phone. When Windows asks you for the drivers direct Windows to the directory you extracted the SDK into. You should see a folder called usb_driver. If you are running the 32 bit version of Windows select the x86 folder. If you are using a 64 bit version then select the x64 folder. Then select the android_usb.inf file. This should install the drivers.
If running XP or lower you will need to go to the start menu and click run, then you enter cmd and press enter. If Vista or higher you will press the start button and type cmd and press enter. When you are at the command prompt you cd to the directory you extracted the sdk into. Then cd into the tools directory. Then execute the following commands:
adb push /directory_you_placed_asroot2/asroot2 /data/local/
adb shell
chmod 0755 /data/local/asroot2
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4755 su
Now your phone is officially rooted! We arent done yet though. Now you need to flash the recovery image. If you are still in adb shell type in exit until you are out. You should be in the directory where you extracted the recovery image. If not go there. Type in the following:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
Once that is done, type in adb shell (or sudo ./adb shell in ubuntu). If your command prompt is a dollar sign then type in su and press enter. If it is a pound sign you are good. Then type in the following:
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
Once that is finished you are done. To reboot into recovery type in adb shell reboot recovery. You should reboot into recovery mode. Right now there is not a lot you can do but once we have some devs who make some roms then we will be well on our way to an even more awesome phone. Any questions please ask away. Also, I am sorry if this tutorial is hard to understand or badly laid out. My daughter is crawling all over me so it's hard to type or think. Good luck all and thanks to everyone who rooted this phone and made the recovery and did such a great job!

chuckhriczko said:
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
Click to expand...
Click to collapse
Is this the right command, every time I try I get : "adb: not found"
The transfer to the sd card seemed to go fine, and I am @ root (#).
Am I missing something?

You beat me to it!!!! I was planning on laying out the steps to make sure I had my head on straight.
To continue with your guide: (The following are questions, not procedures)
1. We run a Nandroid back up to lock in our stock ROM so if we ever do something stupid, aka brick the phone, we can push this back on?
2. What comes on the SD card? Is it needing to be backed up when I go to a 16GB class 6 card?
3. Insert the new SDcard and use the ext2/swap/fat32 script
4. convert ext2 to ext3, (now ready for apps2SD?)
Anything else you can add would be nice.
Again thanks for the steps! They are clear for me.

rockcrawler said:
Is this the right command, every time I try I get : "adb: not found"
The transfer to the sd card seemed to go fine, and I am @ root (#).
Am I missing something?
Click to expand...
Click to collapse
Sounds like you need to add the directory where you have adb to be added to he path. is your adb in the same dir as the image?

rockcrawler said:
Is this the right command, every time I try I get : "adb: not found"
The transfer to the sd card seemed to go fine, and I am @ root (#).
Am I missing something?
Click to expand...
Click to collapse
You may currently be in adb shell already. If you are showing the pound sign this is likely. The command is supposed to be run outside of adb shell. Try the command below:
flash_image recovery recovery-RA-heroc-v1.2.3.img

Treefallingquietly said:
Sounds like you need to add the directory where you have adb to be added to he path. is your adb in the same dir as the image?
Click to expand...
Click to collapse
I apologize, but that went right over my head.
I have used this command to copy the image to the sd card.
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
I got this output:
Code:
C:\androidSDK\android-sdk-windows\tools>adb push recovery-RA-heroc-v1.2.3.img /s
dcard/
1640 KB/s (3352576 bytes in 1.996s)
I then do the following with the noted result:
Code:
C:\androidSDK\android-sdk-windows\tools>adb shell
$ su
su
# adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
adb: not found
Any help as to where I making my mistake would be greatly appreciated.

Treefallingquietly said:
You beat me to it!!!! I was planning on laying out the steps to make sure I had my head on straight.
To continue with your guide: (The following are questions, not procedures)
1. We run a Nandroid back up to lock in our stock ROM so if we ever do something stupid, aka brick the phone, we can push this back on?
Click to expand...
Click to collapse
Yes. A nandroid backup completely backs up every piece of information on your phone. It is a complete image of your phone and if it needs to be restored for whatever reason you just load up recovery and can restore it the way it was before.
Treefallingquietly said:
2. What comes on the SD card? Is it needing to be backed up when I go to a 16GB class 6 card?
Click to expand...
Click to collapse
What do you mean exactly? The only thing that gets copied to an sd card is the nandroid backup so yes, when switching to an sd card just do another backup. Or you can also copy the nandroid folder from your existing sd card to your new one.
Treefallingquietly said:
3. Insert the new SDcard and use the ext2/swap/fat32 script
4. convert ext2 to ext3, (now ready for apps2SD?)
Click to expand...
Click to collapse
Yes and no. Just run the ext2/swap/fat32 script and it should be ready for apps2sd. You can convert to ext3 if you want. Generally on normal hard drives ext3 is faster, however there has been some controversy with that on android phones. As for converting to apps2sd, right now the best way is probably the manual method which I can write up a tutorial on as well. The dream forum has some good tutorials on it as they were the first to do it. I actually need to go back and re read some of those because it's been so long since I did it. I tried the apps2sd apk but that didnt seem to work for me.

rockcrawler said:
I apologize, but that went right over my head.
I have used this command to copy the image to the sd card.
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
I got this output:
Code:
C:\androidSDK\android-sdk-windows\tools>adb push recovery-RA-heroc-v1.2.3.img /s
dcard/
1640 KB/s (3352576 bytes in 1.996s)
I then do the following with the noted result:
Code:
C:\androidSDK\android-sdk-windows\tools>adb shell
$ su
su
# adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
adb: not found
Any help as to where I making my mistake would be greatly appreciated.
Click to expand...
Click to collapse
Yeah. The problem is that you are trying to adb shell twice. After you adb push then just run the command adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img. That should work.

chuckhriczko said:
You may currently be in adb shell already. If you are showing the pound sign this is likely. The command is supposed to be run outside of adb shell. Try the command below:
flash_image recovery recovery-RA-heroc-v1.2.3.img
Click to expand...
Click to collapse
Now I get the Following:
Code:
# flash_image recovery recovery-RA-heroc-v1.2.3.img
flash_image recovery recovery-RA-heroc-v1.2.3.img
error opening recovery-RA-heroc-v1.2.3.img: No such file or directory
#
And this outside adb shell, in the same directory where I did the push:
Code:
C:\androidSDK\android-sdk-windows\tools>adb shell flash_image recovery recovery-
RA-heroc-v1.2.3.img
error opening recovery-RA-heroc-v1.2.3.img: No such file or directory
Ideas?

rockcrawler said:
Is this the right command, every time I try I get : "adb: not found"
The transfer to the sd card seemed to go fine, and I am @ root (#).
Am I missing something?
Click to expand...
Click to collapse
yes he left out the /sdcard/in the path and if you are in teh shell you don't need the adb portion of the command.

rockcrawler said:
Now I get the Following:
Code:
# flash_image recovery recovery-RA-heroc-v1.2.3.img
flash_image recovery recovery-RA-heroc-v1.2.3.img
error opening recovery-RA-heroc-v1.2.3.img: No such file or directory
#
And this outside adb shell, in the same directory where I did the push:
Code:
C:\androidSDK\android-sdk-windows\tools>adb shell flash_image recovery recovery-
RA-heroc-v1.2.3.img
error opening recovery-RA-heroc-v1.2.3.img: No such file or directory
Ideas?
Click to expand...
Click to collapse
Ok. Most likely you dont have the recovery image in the directory. Try this. Copy the recovery image to the tools directory of the sdk. Then, outside of adb shell, (making sure you are in the tools directory of the sdk) execute the following command:
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
This should work as long as you have the recovery image in the correct directory.

can i use the rom from modaco? or at least the themes?

magicalan said:
can i use the rom from modaco? or at least the themes?
Click to expand...
Click to collapse
No way! This rom is a GSM rom and if it works at all and does not brick your phone then it wont have the right software to make your phone work. A dev has to create a rom specially for the CDMA Hero that has the right drivers.

chuckhriczko said:
Ok. Most likely you dont have the recovery image in the directory. Try this. Copy the recovery image to the tools directory of the sdk. Then, outside of adb shell, (making sure you are in the tools directory of the sdk) execute the following command:
adb shell flash_image recovery recovery-RA-heroc-v1.2.3.img
This should work as long as you have the recovery image in the correct directory.
Click to expand...
Click to collapse
I am feeling really special, not being able to make this work, but that is the folder that it has been in all this time. I have even downloaded and pushed it several times. Proof:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So I am not sure where I am messing up.
Thanks for all the help and hard work on this BTW!

rockcrawler said:
I am feeling really special, not being able to make this work, but that is the folder that it has been in all this time. I have even downloaded and pushed it several times. Proof:
So I am not sure where I am messing up.
Thanks for all the help and hard work on this BTW!
Click to expand...
Click to collapse
Meh. Not hard work. Just experience. The hard work is what the rom devs do. And it is difficult at first but once you get it trust me, you get it.Okay let's try this. Go into the command prompt (not adb shell) into the folder where adb and the recovery image is. Try to execute the following command and see if it works.
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
This will put the recovery image on the sdcard. If this works then we will continue.

chuckhriczko said:
Meh. Not hard work. Just experience. The hard work is what the rom devs do. And it is difficult at first but once you get it trust me, you get it.Okay let's try this. Go into the command prompt (not adb shell) into the folder where adb and the recovery image is. Try to execute the following command and see if it works.
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
This will put the recovery image on the sdcard. If this works then we will continue.
Click to expand...
Click to collapse
Done.
Code:
C:\androidSDK\android-sdk-windows\tools>adb push recovery-RA-heroc-v1.2.3.img /s
dcard/
1747 KB/s (3352576 bytes in 1.873s)
C:\androidSDK\android-sdk-windows\tools>

rockcrawler said:
Done.
Code:
C:\androidSDK\android-sdk-windows\tools>adb push recovery-RA-heroc-v1.2.3.img /s
dcard/
1747 KB/s (3352576 bytes in 1.873s)
C:\androidSDK\android-sdk-windows\tools>
Click to expand...
Click to collapse
Sweetness. Ok. Now type in the following:
Code:
$ adb shell
$ cd /sdcard/
$ su
# flash_image recovery recovery-RA-heroc-v1.2.3.img
That should work. Note, don't type in the $ or the #. Those are just there to show what the command prompt should look like.

THANK YOU!!!!!
chuckhriczko said:
Sweetness. Ok. Now type in the following:
Code:
$ adb shell
$ cd /sdcard/
$ su
# flash_image recovery recovery-RA-heroc-v1.2.3.img
That should work. Note, don't type in the $ or the #. Those are just there to show what the command prompt should look like.
Click to expand...
Click to collapse
Worked Like a charm, THANK YOU!!! Just booted to the recovery image and all is well.
p.s. Might want to edit the origional instructions, one your daughter goes to bed, to include the cd to the sd card, that is where my problem was.

rockcrawler said:
Worked Like a charm, THANK YOU!!! Just booted to the recovery image and all is well.
p.s. Might want to edit the origional instructions, one your daughter goes to bed, to include the cd to the sd card, that is where my problem was.
Click to expand...
Click to collapse
If I am able to I will. I understand that the instructions were a little hard to follow for beginners which was what I wanted to avoid. Glad you got it working though. Welcome to the world of Android hacking and please enjoy your stay

I'm getting suck trying to push the recovery img out to my sdcard
Code:
C:\AndroidSDK\tools>adb push recovery-RA-heroc-v1.2.3.img /sdcard/
cannot stat 'recovery-RA-heroc-v1.2.3.img': No such file or directory
I believe I have root access:
Code:
C:\AndroidSDK\tools>adb shell
$ su
su
#

[GUIDE] How to make a nandroid backup directly to your computer without using sdcard

INFORMATION
This guide is intended to make a full backup of your android phone (the entire memory block with all partitions) or a single partition (including sdcards, etc) directly to your computer, in either
Block level (with dd): for single partitions or whole memory block (all partitions in one piece). The backup always has the same size which is the size of the partition.
File level (with tar): only for individual partitions. This only includes files and folders, so occupies much less space, depending on how much filled is the partition.
It can be done with the phone powered on or from ClockWorkMod Recovery (from both ADB works, while in Fastboot doesn't so won't apply). Unless specified the commands meant to be used from Windows. For Linux and Unix is similar.
REQUIREMENTS
Rooted Android Phone
Busybox installed on your phone
If you are using Linux / OS X you have native tools, for Windows download Cygwin, and install with it netcat, pv and util-linux. Get them from Cygwin's setup.exe
ADB installed.
Make sure adb.exe is in your windows' path. See here and here, or use Path Manager.
Android phone with USB Debugging enabled, and the proper drivers installed on Windows so the phone is recognized. Typing 'adb devices' on a terminal should show your device.
PARTITION IDENTIFICATION
You now have to identify the partition or block device that you want to backup. For a single partition you can use either tar or dd, while for the entire memory block you can only use dd.
For example, on Galaxy Nexus you have the list of partitions here and for Galaxy S2 here.
Usually on android, the entire block containing all partitions is located at /dev/block/mmcblk0 and the data partitions is a subpartition of it. You can push parted with GPT support to your device and see all information on a partition or block.
Whole phone memory -> /dev/block/mmcblk0 (may vary, in some phones this is the sdcard)
Subpartitions -> depends on each device. Usually at /dev/block/platform/dw_mmc/by-name/ there are listed by name linking to the real device.
Back up of the whole memory block (via adb)
Connect the phone in ADB mode and unlock the screen.
Open one Cygwin Terminal and enter (replace mmcblk0 if needed):
Code:
adb forward tcp:5555 tcp:5555
adb shell
su
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
You will see the cursor blinking at the left. Now the phone is waiting to send the block over the network.
Open another Cygwin terminal and type:
Code:
adb forward tcp:5555 tcp:5555
cd /path/to/store/the/backup
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw
You will see how the image size is growing until it finishes. Now you have the whole phone backed up in raw format. You can see the contents of the GPT partition with gptfdisk tool, available for windows, linux and such. See official website and sourceforge to get it. You can do it the same from ClockWorkMod Recovery but you have to mount first the /system partition since the busybox included with clockworkmod does not come with netcat and you have to use the one from the system partition.
With further linux tools you could edit or extract single partitions from the whole block.
You can use adb via wifi as well with applications like WiFi ADB.
Back up of the whole memory block (via wifi)
Original post: [Q] Nandroid directly to computer w/o sdcard
We need to install a FTP server on the computer or the other device, configure a user with a password if we want to, and set some port. It uses by default 21 but this example uses 40. We must set a home dir for the user with write permissions.
Usually is a good idea to put myfifo in /cache not in /data because we may overwrite sensitive data in case we want to use that raw image for data recovery.
Open one Cygwin terminal
Code:
adb shell
su
mkfifo /cache/myfifo
ftpput -v -u user -p pass -P 40 COMPUTER_IP block.raw /cache/myfifo
Open another Cygwin terminal
Code:
adb shell
su
dd if=/dev/block/mmcblk0p12 of=/cache/myfifo
Tips:
- Fifos only can be made on linux native filesystems, for example on a FAT partition is not possible.
- Reading from a partition does not modify it.
Now check on Filezilla Server the speed
Back up of the whole memory block (USB tethering, Wifi tethering)
To use tethering you have to disconnect the computer from all networks and connect it only to the phone with the type of connection you want.
Once you connect it, you can view the IP of the computer and the IP of the phone from connection properties. The ip is the computer ip and the gateway is the phone's ip.
Wifi Tethering: Computer <---Wifi---> Phone <---3G---> Internet
USB Tethering:
Computer <---USB---> Phone <---Wifi---> Internet
Conputer <---USB---> Phone <---3G---> Internet
This is exactly the same as via wifi, except that the transfer speed is much higher because the computer and the phone are directly connected, instead of using a router as a gateway. In this case, the gateway is the phone. USB tethering has the highest transfer rate.
Back up of a single partition (raw = every bit of the partition)
It is exactly the same as the the previous but replacing mmcblk0 by the corresponding partition. You can use in this particular case several software to read the partition from windows, depending on partition filesystem: DiskInternals Linux Reader, Ext2Read, Ext2 File System Driver for Windows, Ext4Explore, plugin for Total Commander and ImDisk Virtual Disk Driver. You can also use recovery software on individual partitions like Recuva in combination with VHD Tool or command line tools included with operating systems.
Back up of a single partition (tar = only files and folders)
In this case, you need the partition mounted. To see the list of mounted partitions type on Cygwin Terminal
Code:
adb shell mount
Now you need to know where is mounted the partition you want to backup, for example the firmware is mounted on /system, which is the ROM.
In this case you will have to open three terminals, because of android limitations:
Open one Cygwin terminal and create a fifo, in /cache, for example, and redirect the tar there
Code:
adb forward tcp:5555 tcp:5555
adb shell
su
/system/xbin/busybox mkfifo /cache/myfifo
/system/xbin/busybox tar -cvf /cache/myfifo /system
We have to do it this way because redirecting the tar to stdout (with - ) is broken on android and will corrupt the tar file.
Open a second Cygwin terminal and type:
Code:
adb forward tcp:5555 tcp:5555
adb shell
su
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox cat /cache/myfifo
Open a third Cygwin terminal and type:
Code:
adb forward tcp:5555 tcp:5555
cd /path/to/store/the/backup
nc 127.0.0.1 5555 | pv -i 0.5 > system.tar
You can browse the tar file with Winrar, Total Commander, PeaZip and almost any compression tool. Note that you shouldn't extract files or edit it since the tar format saves the permission and owner data for each file, that is lost when extracted to FAT / NTFS partitions and you will mess things when restoring.
LINKS
[GUIDE] Internal Memory Data Recovery - Yes We Can!
How to Create and Attach a Virtual Hard Disk in Windows 7
[Guide] Types of Android backups
mohsyn said:
On newer android versions (Im on 7.2) data folder has a folder media which is link to sdcard and one ends up backing up entire sd card. I had a 64gb backup which wasn't necessary
In order to avoid skipping the media folder i had to do some trial and error because busybox tar command is not completely the same as GNU tar.
Would appreciate if you can mention it in the mail guide to use the following command to backup /data folder without copying sdcard files
In first terminal
tar cv --exclude data/media/0 -f /cache/myfifo /data
in 3rd terminal
nc 127.0.0.1 5555 | pv -i 0.5 > data.tar
no change in second terminal
Cheers
Click to expand...
Click to collapse

Umm...how to restore back from computer?
Sent from MARVEL

I am a little new to this, I have installed Android sdk and i am able to see my device by using "adb devices" , i have also installed Cygwin, now i want to backup whole phone memory block so i tried executing the first line on cygin "adb forward tcp:5555 tcp:5555" i get an error saying -bash: adb :command not found.
I am sorry if i am missing any thing, please guide me, and also what do you mean by "download Cygwin, and install with it netcat, pv and util-linux"
Thanx a ton !!

aunriz said:
I am a little new to this, I have installed Android sdk and i am able to see my device by using "adb devices" , i have also installed Cygwin, now i want to backup whole phone memory block so i tried executing the first line on cygin "adb forward tcp:5555 tcp:5555" i get an error saying -bash: adb :command not found.
I am sorry if i am missing any thing, please guide me, and also what do you mean by "download Cygwin, and install with it netcat, pv and util-linux"
Thanx a ton !!
Click to expand...
Click to collapse
You've done almost everything! But you skipped the section "make sure adb is in your path"
Probably you have adb.exe in the path
Code:
C:\Program Files (x86)\android-sdk\platform-tools\adb.exe
So you have to just add it to the Cygwin's path (would be better if you had added it earlier to the windows' path and cygwin will import it automatically but it is ok)
Code:
export PATH="/cygdrive/c/Program Files (x86)/android-sdk/platform-tools":$PATH
Remember to backup the path previously if you want.
Code:
echo $PATH > mypathbackup.txt

scandiun said:
You've done almost everything! But you skipped the section "make sure adb is in your path"
Probably you have adb.exe in the path
Code:
C:\Program Files (x86)\android-sdk\platform-tools\adb.exe
So you have to just add it to the Cygwin's path (would be better if you had added it earlier to the windows' path and cygwin will import it automatically but it is ok)
Code:
export PATH="/cygdrive/c/Program Files (x86)/android-sdk/platform-tools":$PATH
Remember to backup the path previously if you want.
Code:
echo $PATH > mypathbackup.txt
Click to expand...
Click to collapse
Thanks for replying but i cant seem to run the 3rd line , see this
[email protected] ~
$ adb forward tcp:5555 tcp:5555
[email protected] ~
$ adb shell
$ /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
reloc_library[1311]: 10182 cannot locate 'android_reboot'...
CANNOT LINK EXECUTABLE
i hav sucessfully installed busybox v1.14.3, i am not sure what is causing the problem
EDIT:
i found that my directory ws system/bin instead of xbin
so i changed it and first part worked correctly, now i cant seem to get the second part
[email protected] ~
$ adb forward tcp:5555 tcp:5555
[email protected] ~
$ cd c:/
[email protected] /cygdrive/c
$ nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw
-bash: nc: command not found
-bash: pv: command not found

aunriz said:
[email protected] /cygdrive/c
$ nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw
-bash: nc: command not found
-bash: pv: command not found
Click to expand...
Click to collapse
You don't have installed pv and netcat on cygwin. Run the setup.exe and install them.
If you run
Code:
whereis pv
whereis nc
should give you some path (in cygwin) but applies similar inside android.

scandiun said:
You don't have installed pv and netcat on cygwin. Run the setup.exe and install them.
If you run
Code:
whereis pv
whereis nc
should give you some path (in cygwin) but applies similar inside android.
Click to expand...
Click to collapse
Now i hav installed cv and nc and commands run sucessfully, but i get the raw file as just 1kb
First terminal:
[email protected] ~
$ adb forward tcp:5555 tcp:5555
adb shell
[email protected] ~
$ adb shell
$ /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0
/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0
$
second terminal:
[email protected] ~
$ adb forward tcp:5555 tcp:5555
[email protected] ~
$ cd c:/
[email protected] /cygdrive/c
$ nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw
55 B 0:00:00 [10.7kiB/s] [<=> ]
[email protected]

No idea what you may be doing wrong

Listen, I appreciate the guide, and it being basically the only one which popped up in google results, I can't gripe too much, but... you really, really need to make it more clear.
The point of a guide is to help a large group of people with varying degrees of knowledge (and if it's a guide targeted at a specific group of people, i.e tech savvy, then it needs to be indicated as such).
With that working definition in place, it follows that you should be as specific as possible; think of *everything*. By doing so, you not only avoid headaches for the people reading the guide, but for yourself as well since you don't have to reply to comments which might've otherwise been avoided.
I would post a question, but I'll probably have figured this out (with a good 1+ hours of searching no doubt) before anyone responds.
Here are some examples of what could be more specific:
"ADB installed." - what is ADB? Where's the link? It's not reasonable to assume people use these tools on a regular basis or remember them.
"You can push parted with GPT support to your device and see all information on a partition or block." - okay, so we know what it does but not how to install it or use it.
"ADB mode" - is this important? What is it? Not sure because it was glossed over.
These are just some examples. It's not the most horrendous trespass ever committed, but definitely annoying. Just spell it out from one step to the next, it works far better than topics with subheadings and unintuitive concepts being assumed as general knowledge on the behalf of noobs like me.
Edit: I'm just going to take everything off my SD card, use nandroid, and then copy the nandroid backup to computer as well. Please improve the guide, thanks.

Greatly appreciate this!
For me, a long-time UNIX and Linux administrator, this little guide was a breath of fresh air. Scandiun, *Thank You* for putting it together. It makes perfect sense to me -- just treat the phone as the linux machine it is. I'm becoming convinced that most of the more recent "developers" hanging around the android community have never used a linux machine before -- they don't seem to know what's going on, they go way out of their way to write overkill tools to do things clumsily that can already be done cleanly and quickly from the command line, and then they wrap those tools in so much mystery, black magic, and script-kiddie terminology that I can't figure out what they do either, and I certainly don't trust them doing things to my phone.
For example, I've got a new Galaxy S3, and just wasted a whole day digging around on xda, reviewing all of the "kewl rooting mods" until I got sick of it. Why the *heck* are people flashing entire partitions just to install a setuid /system/xbin/su on these devices? The rooting method I wound up using was dirt simple -- just find an rc exploit and use it to install an 'su' binary, by typing a few commands via adb. I used a variation of the exploit mentioned in http://seclists.org/fulldisclosure/2012/Aug/171, and elaborated in http://forum.xda-developers.com/showthread.php?t=1790104, http://forum.xda-developers.com/showthread.php?t=1792342, http://galaxys3root.com/galaxy-s3-root/how-to-root-u-s-canadian-dual-core-galaxy-s3-on-mac-osx/, and http://forum.xda-developers.com/showthread.php?t=1827518. If you are a UNIX person, you'll recognize what's going on with that exploit and be able to come up with something that suits your own needs. If you aren't a UNIX person, then you'll be completely lost. Sorta like this guide.
For anyone who doesn't yet know what adb is, or who's never used standard UNIX/Linux tools like dd, netcat, gparted, or busybox, I agree that this guide is not only not going to help you, but may actually aid you in shooting yourself in the foot with extreme efficiency. But please don't criticize or nag the OP in return for helpful advice freely given. You won't learn much about UNIX tools on an Android-related web site in any case. I recommend starting with a Linux systems administration book -- the Nemeth series is always good. But if you do take that route, you need to expect to take time to learn the basics.

Absolutely beautiful!
Thank you for this work. I was able to recover deleted files from my Galaxy Nexus' internal memory using this technique. I made a [GUIDE] using most of what you accomplished here: http://forum.xda-developers.com/showthread.php?p=34185439
Thank you, thank you, thank you! It can't be said enough. I had family photos that I would not have been able to reproduce. Much love to you and yours!
:good: :highfive: :victory:

so did anyone dare to restore the drive (all of storage, everything !)? without bricking the thing ?

mai77 said:
so did anyone dare to restore the drive? w.o bricking the thing ?
Click to expand...
Click to collapse
What drive? A partition?

scandiun said:
If you are using Linux / OS X you have native tools, for Windows download Cygwin, and install with it netcat, pv and util-linux. Get them from Cygwin's setup.exe
Click to expand...
Click to collapse
netcat is obsolete (mark to even find it) install net / nc instead
---------- Post added at 01:03 PM ---------- Previous post was at 01:03 PM ----------
scandiun said:
What drive? A partition?
Click to expand...
Click to collapse
all of storage I mean. the full monty ...
----------------------
parted seems to not work fully with Samsung galaxy Y = SGY proprietary rfs filesystem
on SGY mmcblk0 gives you the sd card, not internal storage with android.
backing up my sd card was a thing I could even do before I read this (lol)

mai77 said:
netcat is obsolete (mark to even find it) install net / nc instead
Click to expand...
Click to collapse
nc is an abbreviation for netcat. On Cygwin, you choose to install either, but for the original, written by the *Hobbit*, that allows direct execution of commands with -e and -t, you have to uncheck "Hide obsolete packages" on Cygwin's setup.exe.
The two of them are here:
Netcat 1.10 (netcat.traditional): http://www.netgull.com/cygwin/release-legacy/netcat/
Netcat 1.107 (netcat.openbsd): http://www.netgull.com/cygwin/release/nc/

mai77 said:
parted seems to not work fully with Samsung galaxy Y = SGY proprietary rfs filesystem
on SGY mmcblk0 gives you the sd card, not internal storage with android.
backing up my sd card was a thing I could even do before I read this (lol)
Click to expand...
Click to collapse
Can you post where is your whole memory block then or even the PIT file for that phone? You have an example here:
[Info] List of Samsung Galaxy S2 GT-I9100 devices and partitions

scandiun said:
Can you post where is your whole memory block then or even the PIT file for that phone? You have an example here:
[Info] List of Samsung Galaxy S2 GT-I9100 devices and partitions
Click to expand...
Click to collapse
I don't know where the "whole memory block" is or what it is. is it internal storage = NAND ?
here is the pit file:

mai77 said:
I don't know where the "whole memory block" is or what it is. is it internal storage = NAND ?
Click to expand...
Click to collapse
Yes it is the NAND. See your pit analysis here:
[INFO] Samsung Galaxy Y GT-S5360 PIT File Analysis

OK
scandiun said:
Yes it is the NAND. See your pit analysis here:
[INFO] Samsung Galaxy Y GT-S5360 PIT File Analysis
Click to expand...
Click to collapse
very interesting tool.
but how do I backup NAND in one piece on SGY ?
mmcblk0 = sd card
???blk0 = NAND
it must be somewhere ...

mai77 said:
but how do I backup NAND in one piece on SGY ?
mmcblk0 = sd card
???blk0 = NAND
it must be somewhere ...
Click to expand...
Click to collapse
Is almost sure that is under /dev/block. Please post the output of
Code:
ls -lR /dev/block

Backup your EFS-partition using tar and dd

This guide has been made with and for the i9505, but will most likely also work on other Galaxy S4-models.
Please be extra careful on models other than i9505 as the 'mmcblkXpXX' partition numbers might differ on your device. How to check this is written in the procedure.
As I could not find a procedure in this forum yet, I have made one myself.
Of course all of the below is 'USE AT YOUR OWN RISK'.
Requirements before you start
Install KIES software (and included driver) and connected your S4 atleast once (to see if it works)
Have ADB-executable available. It can be found in the ADT Bundle from Google. There are also much smaller packages with ADB-only which will work. I might create one myself later on and attach it to this thread..
Device is rooted and has busybox-installed (default with motochopper root method). Applications with a similar name in Play Store will allow you to install busybox manually.
Enable developer mode, go to Settings - More - Device-info - Tap 7 times on 'Build number' to unlock 'Developer options' in the previous screen. Then go to 'Developer options' and thick 'USB debugging'
Connect USB cable to your computer and smartphone with 'USB debugging' enabled
Preparations for both backup methods
Now open a ADB-shell, in Windows this would be: 'cmd' in Start-menu (or CTRL+R).
Change the directory to the ADT directory: sdk\platform-tools. In my case:
Code:
cd C:\Android\sdk\platform-tools
Then start the shell using adb:
Code:
adb shell
If you get the error:
'error: device offline'
Then, check your device and allow USB debugging for the presented device. Now try again the command 'adb shell'
If all goes well, you will see the following:
[email protected]:/ $
Now switch to root-user:
Code:
su -
It is possible that the phone now asks you to permit or deny root access. Of course, please permit.
When the switch succeeds, the '$' changes to '#', but you can also verify it by the id-command:
Code:
[email protected]:/ # id
id
uid=0(root) gid=0(root) context=u:r:shell:s0
If it shows root, all is fine.
Then, check with the following command if /efs is available and mounted:
Code:
mount | grep efs
It should show something like:
Code:
mount | grep efs
/dev/block/platform/msm_sdcc.1/by-name/efs /efs ext4 rw,seclabel,nosuid,nodev,no
atime,discard,journal_checksum,journal_async_commit,noauto_da_alloc,errors=panic
,data=ordered 0 0
Backup method using TAR
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
Run the folowing command to backup the whole efs-partition (all the files available on the system):
Code:
tar -cvf /data/media/0/efs.tar /efs
Your output will look like this:
Code:
[email protected]:/ # tar -cvf /data/media/0/efs.tar /efs
tar -cvf /data/media/0/efs.tar /efs
tar: removing leading '/' from member names
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
This will add all files in /efs to the tar archive located on your internal memory as 'efs.tar'.
Now, the permissions of this tar are incorrect (for this location) so we have to correct them:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.tar
And the file permissions:
Code:
chmod 664 /data/media/0/efs.tar
Now, your tar-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.tar .
This will copy the efs.tar to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
Backup method using 'dd'
NOTE: In case you left the ADB shell, please return to it using command 'adb shell' and switch to root again via 'su -' as described above.
From the output of the earlier executed command 'mount | grep efs', you can get the path of the EFS partition. It start with '/dev/block/..' is the part which you can use to find the original partition on your device.
As you can see, in my case this is, and I do not expect it to be any different on your device:
/dev/block/platform/msm_sdcc.1/by-name/efs
To check which 'mmcblk' partition it is, we should check out this link:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
This will show you the mmcblk which is the EFS-partition:
Code:
ls -al /dev/block/platform/msm_sdcc.1/by-name/efs
lrwxrwxrwx root root 1970-01-05 23:39 efs -> /dev/block/mmcblk0p10
As you can see, the actual partition in my case is:
Code:
/dev/block/mmcblk0p10
I expect that this is the same for all i9505-devices, but it's better safe to check it. On i9500-devices this might be a different number as they have a different partition-layout, that's why we're checking this. It is very important to save this location, also for future restores.
Now, to backup the partition using dd, run the following command, please make sure that the part directly after 'if=' is the partition you found using the 'ls -l' command. In my case '/dev/block/mmcblk0p10':
Code:
dd if=/dev/block/mmcblk0p10 of=/data/media/0/efs.img
When it finishes, it will show you something like:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This command reads the efs-partition, byte-by-byte to your internal memory, which you can transfer later on to your PC using ADB or MTP.
As the file created is owned by root:root and doesn't have the default permissions used for files at this location, it can be corrected with the following 2 commands:
Change owner and group:
Code:
chown media_rw:media_rw /data/media/0/efs.img
And the file permissions:
Code:
chmod 664 /data/media/0/efs.img
Now, your DD-backup is ready and can be copied via MTP towards your computer or you can use adb to copy it over. First type 'exit' twice to exit the adb shell. CTRL+C is an alternative to leave the 'adb shell'.
Code:
adb pull /mnt/shell/emulated/0/efs.img .
This will copy the efs.img to your current directory, which is in my case C:\Android\sdk\platform-tools. You can also replace the last . with the directory where you would like to put the file in.
To restore the files
Now to restore the files, in case there is really a need to, like imei-number ****up or something with the MAC-address of your wifi, or whatever.. the following commands can be used:
Of course, once again. USE AT YOUR OWN RISK!!!! Do not use this if not really necessary, as there are risks involved in doing this.
To restore the tar-backup, open 'adb shell' and switch to root using 'su -'. Now, first switch to the root directory, which is most likely not needed, but just to make sure the files will be extracted to the right location:
Code:
cd /
Before executing the next command, I assume that you have the efs.tar file in the root-directory of your internal SD-card.
Now, extract the tar file:
Code:
tar -xvf /data/media/0/efs.tar
This will extract the efs.tar file back to it's original location. It will show you something like:
Code:
[email protected]:/ # tar -xvf /data/media/0/efs.tar
tar -xvf /data/media/0/efs.tar
efs/
efs/imei/
efs/imei/mps_code.dat
efs/wifi/
efs/wifi/.mac.info
efs/FactoryApp/
efs/FactoryApp/test_nv
efs/FactoryApp/hist_nv
efs/FactoryApp/fdata
efs/FactoryApp/serial_no
efs/FactoryApp/factorymode
efs/FactoryApp/keystr
efs/FactoryApp/hw_ver
efs/FactoryApp/baro_delta
efs/FactoryApp/prepay
efs/FactoryApp/earjack_count
efs/FactoryApp/batt_cable_count
efs/bluetooth/
efs/bluetooth/bt_addr
efs/gyro_cal_data
efs/00000000.authtokcont
efs/carrier/
efs/carrier/HiddenMenu
efs/drm/
efs/drm/widevine/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/D3qpp0bxmJhbiZwIsCbXJ1434rc_
efs/drm/widevine/5dsokxEEDXgQhkN50bp-Z2K5InM_/RXFABDUxyT6Q+Zwx9ZhPGOq2Bq8_
efs/drm/playready/
efs/drm/playready/00004.PRV
efs/drm/playready/playready0.dat
efs/drm/playready/playready1.dat
efs/drm/playready/playready.hds
efs/wv.keys
efs/log/
efs/log/boot_cause
efs/.files/
efs/.files/.dx1/
efs/.files/.dm33/
efs/.files/.mp301/
efs/ss_data
efs/h2k.dat
efs/hw_offset
Then reboot your phone normally and see if it works again as you would expect.
If you restored the TAR-backup succesfully, you do not need to restore the dd-image. But in case your tar did not work or your /efs is not mounted due to corruption (in recovery) you can try the dd-recovery instead.
PLEASE BE AWARE THAT YOU SHOULD BE SURE ABOUT THE LOCATION OF THE EFS-PARTITION. THIS LOCATION WAS FOUND USING the 'ls -al /dev/block/platform/msm_sdcc.1/by-name/efs'-COMMAND EARLIER DESCRIBED. If you do not know this location, there's a risk you are overwriting other partitions (MODEM, SYSTEM, RECOVERY, ETC).
If you are sure about the original location, /dev/block/mmcblk......, then use this path just straight after 'of='. On my device the partition is /dev/block/mmcblk0p10.
Code:
dd if=/data/media/0/efs.img of=/dev/block/mmcblk0p10
Output will be similar to:
Code:
27904+0 records in
27904+0 records out
14286848 bytes transferred in 1.195 secs (11955521 bytes/sec)
This will read the efs.img and put it back in the original location.
NOTE 1: This thread gives you two options of backupping the EFS-partition. It is preferred to do both, better safe than sorry.
NOTE 2: Luckily, I have never had to restore any of the backups myself (not on this phone and not on earlier phones). This means that I was never able to test the restores, which counts for the most of us.
NOTE 3: DO NOT RESTORE unless you are really sure this will solve your issue. This will never resolve any lag or other problems with your rom.
NOTE 4: It is normal that the DD-file is much larger (10MB in size) as it also copies unused space and other meta-data of the partition.
NOTE 5: USE AT YOUR OWN RISK! Although the backup part is nearly riskless.
Note X: Feel free to thank me for this post.

Reservation for second post, just in case.

Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?

johan81 said:
Isn't rooting and using rootexplorer to zip de efs folder to external SD card and just copying that with a microSD cabel way easier?
Click to expand...
Click to collapse
Yes, zipping is easier but you will lose your permissions (owner and file permissions (changed via chown/chmod)) so it is actually not a good backup. The permissions/ownerships are backupped with the tar- and dd-backup.
The dd-file includes more than just the file; it also contains the partition meta-data, in case your filesystem got corrupted and it is not possible to recovery it.

Good job man.

EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546

shaq1907 said:
EFS Professional v2.0.35 is now support S4. You can also use this:
http://forum.xda-developers.com/showthread.php?t=1308546
Click to expand...
Click to collapse
dont seem to work crashes out while backing up
working now with new update

anybody knows how to adb read the the entire partition table of the galaxy s4?

Android 12 and Nandroid Backup.... ???

Using a Xiaomi Mi11 (rooted). Recently upgraded to MIUI 13 which is based on Android 12. Was going to do my usual TWRP backup before bringing the phone in to fix some minor problems with sticky volume keys, when I realized (!) my TWRP cannot even mount the /data partition, let alone decrypting and doing any backup.
So I started reading up on TWRP developments, and realized TWRP for now has lost its ability to see anything under /data if your phone is on Android 12.
Never a fan of things like Titanium backup where the backup is done on an app-by-app basis, so a lot of of settings like magisk modules / phone behavior, etc etc cannot be retained (at least that was my impression of it when I briefly tried those solutions). So when I decided to bring my phone in for repair anyway, I went ahead and wiped the phone clean, and had to live with losing 10 day's worth of my data - 10 days because fortunately I did a backup just before I upgraded from MIUI 12 to MIUI 13 10 days ago... (yeah could have done a lot of manual work to salvage some of the data before I wiped it clean, but I didn't bother with the tedious processes).
So I now have a fixed phone, no more sticky buttons, and restored my nandroid backup with the older MIUI 12 system (android 11 based), and not even considering moving back to MIUI 13 until there is a feasible way to do a TOTAL backup of the /data partition, in others words a nandroid backup on Android 12....
Question - is there any feasible method of doing a Nandroid Backup on an Android 12 system, with or without TWRP?
Thank you !!!

A NANDroid-backup is the bitwise 1:1 copy of existing Android system.
If phone's Anndroid OS is rooted then you always can launch a NANDroid-backup.
This can get achieved by pure ADB commands what of course requires ADB is enabled on phone.

xXx yYy said:
A NANDroid-backup is the bitwise 1:1 copy of existing Android system.
If phone's Anndroid OS is rooted then you always can launch a NANDroid-backup.
This can get achieved by pure ADB commands what of course requires ADB is enabled on phone.
Click to expand...
Click to collapse
Could you elaborate?
I can picture this issue -
if you do "adb shell" to enter terminal (or plain adb pull?) while your phone is switched on, a lot of files are being locked and/or being modified while the phone OS is running so how can someone just take a snapshot of everything under /data even with proper adb commands?
And if you go to recovery mode first, well at the present time no TWRP can access the data partition it seems. So again even with the appropriate adb commands, no copying is possible....?
Any clarification appreciated !

You would run
Code:
adb wait-for-device
adb root & adb shell "stop"
adb shell "mount -o rw,remount /data"
: run the backup command here
adb shell "start" & adb unroot

xXx yYy said:
You would run
Code:
adb wait-for-device
adb root & adb shell "stop"
adb shell "mount -o rw,remount /data"
: run the backup command here
adb shell "start" & adb unroot
Click to expand...
Click to collapse
Dear Android export @xXx yYy - wow ! This looks really promising !!
I just did a quick test by going straight to adb shell, "su", then "stop". My phone screen totally went blank, and I was amazed ! This is awesome !!! "start" and after a while the phone boots up again.
I then tried "top" while the phone is stopped. It seems to still have a few android related processes running, so I am not 100% sure if the whole system has been frozen. But you obviously know what you are talking about, and I have faith in you.
(by the way, I cannot "adb root", seems like after doing a quick search I will need to make my phone think it is a development build by patching the adbd daemon first on my phone.. suggestions on what to do appreciated)
You have just made me decide to spend the coming hours to test the following. Let me know if I should skip any of the steps below because you know it works so I don't need to waste time to validate:
1. Do a proper backup with TWRP first in case I screw up anything
2. start a terminal session with adb shell
3. "su", "stop"
4. "cd /data"
5. "tar -cvpzf /data/backup.tar.gz -C /data"
(If no error, this should be my nandroid backup...?)
6. flash phone and wipe everything clean, so it is back to brand new status, non-rooted
7. reboot phone, see if it is starting new as if I have just bought the phone
8. root the phone, then try and "stop", "delete everything under /data except /data/media", "delete everything under /data/media", "copy backup.tar.gz back to /data", "tar -xvzf /data/backup.tar.gz -C /"
9. If phone works and is back to the state immediately before backup, then restore successful

Take note that
Code:
adb root
is giving root access to adb ( adbd - read: adb daemon )
what has nothing to do with giving root access to current Android user with following shell command
Code:
adb shell "su"
Also take note that Android services aren't located in /data partition, the partition you want to back up.

With @xXx yYy 's help I think I am getting somewhere.
So essentially a "stop" command in android will stop Zygote (i.e. the mother of all app processes if I am not mistaken). Once you have stopped Zygote, I believe you are then free to make a duplicate of the entire /data environment.
So far that's exactly what I have done. Created a tar.gz file with a size of around 40GB. I believe I am halfway there in my quest to do Nandroid without TWRP, but what I still need to try is to restore the tar file after factory resetting the phone. Will be a time consuming process (as obviously I will also need to have a tried-and-true real backup created first in case I screw something up... I am doing everything on my main phone that I actually use everyday), so I will continue my experiment in the coming days.
One question I have already encountered however - I still cannot do "adb root", which would have allowed me to directly create the backup tar file AND pipe it to my PC all in one go. So far I have had to tar all within the phone, which means space will be a constraint, and it is more time consuming creating the backup file THEN think of a way to transfer that file out of the phone. Already posted a question here asking for help, and if anyone knows of a good way to get adbd to grant adb root request, please let me know.
Above all else, once I have a working method, and I have polished the process, I will be happy to share. I suspect many others are also yearning for a good backup / restore procedure on Android 12.

one can't backup /data partition this way, because tar is just a toybox applet not cabable of preserving secontext. get a gnu tar binary (for example from opengapps installer), set mount namespaces to global, set selinux permissive (if kernel allows it, important) and run from su
/storage/1234-5678 is exFAT and has enough free disk space
Code:
tar --selinux --xattrs --numeric-owner -vcpPf /storage/1234-5678/data.tar /data
/storage/1234-5678 is vfat or less free disk space
Code:
tar --selinux --xattrs --numeric-owner -vcpP /data | gzip | split -a 1 -b 1024m - /storage/1234-5678/data.tar.gz.
another approach would be loop mount some file and busybox cp -avc everything where the -c flag is responsible for secontext (proper busybox required)
--numeric-owner flag is recommended if you are planning to extract it on linux PC later
you could also exec-out straight to PC if no MicroSD Card available, but requires gzip or other compressed stream, otherwise windows will mess up linefeed with carriage return and render your file unreadable
Code:
adb exec-out "su -c 'tar --selinux --xattrs --numeric-owner -vcpP /data | gzip'" > data.tar.gz
restoring .tar.gz from TWRP is absolutely possible, it's just that TWRP can't handle encrypted userdata partition (yet)
Code:
cat /external_sd/data.tar.gz.* | gzip -d | tar --selinux --xattrs -vxpPC /
(where tar must called with full path to binary like /cache/tar or /tmp/tar, or unlink /sbin/tar applet and place binary /sbin, or just rename it gtar)
Note: bitwise 1:1 copy of apps is not possible/sufficient if you factory reset your device, because apps might save data in TEE TrustZone (which is flushed on factory reset)

Hi @seemebreakthis, very interesting discussion on Android 12 backup!
Did you reach a workable solution with this?
Since we can restore most apps from a Google backup, it seems the real issue is to recover the user settings etc. after the Google restore.

Interested in this. Any success thus far?

aIecxs said:
one can't backup /data partition this way, because tar is just a toybox applet not cabable of preserving secontext. get a gnu tar binary (for example from opengapps installer), set mount namespaces to global, set selinux permissive (if kernel allows it, important) and run from su
/storage/1234-5678 is exFAT and has enough free disk space
Code:
tar --selinux --xattrs --numeric-owner -vcpPf /storage/1234-5678/data.tar /data
/storage/1234-5678 is vfat or less free disk space
Code:
tar --selinux --xattrs --numeric-owner -vcpP /data | gzip | split -a 1 -b 1024m - /storage/1234-5678/data.tar.gz.
another approach would be loop mount some file and busybox cp -avc everything where the -c flag is responsible for secontext (proper busybox required)
--numeric-owner flag is recommended if you are planning to extract it on linux PC later
you could also exec-out straight to PC if no MicroSD Card available, but requires gzip or other compressed stream, otherwise windows will mess up linefeed with carriage return and render your file unreadable
Code:
adb exec-out "su -c 'tar --selinux --xattrs --numeric-owner -vcpP /data | gzip'" > data.tar.gz
restoring .tar.gz from TWRP is absolutely possible, it's just that TWRP can't handle encrypted userdata partition (yet)
Code:
cat /external_sd/data.tar.gz.* | gzip -d | tar --selinux --xattrs -vxpPC /
(where tar must called with full path to binary like /cache/tar or /tmp/tar, or unlink /sbin/tar applet and place binary /sbin, or just rename it gtar)
Note: bitwise 1:1 copy of apps is not possible/sufficient if you factory reset your device, because apps might save data in TEE TrustZone (which is flushed on factory reset)
Click to expand...
Click to collapse
You are a genius! That's excactly what i was searching for! Thank you!

This is a bit beyond me.. though I'm looking for a full ROM backup on Android 12. Does this work?

TWRP 3.7.0 is for Android 12 including Encryption Support (except for Samsung)

Question Resolve "adbd cannot run as root in production builds"

Hi!
I'm running Android 13. I've used Magisk to root the device but the command
Code:
adb root
results in
Code:
adbd cannot run as root in production builds
I already tried "adbd Insecure v2.00.apk" but it fails with the message
Code:
Could not patch adbd !
Is there a way to fix this?

you can overlay /system/bin/adbd with magisk module. create new directory in /data/adb/modules and place your files
Code:
/data/adb/modules/my_module/system/bin/adbd
/data/adb/modules/my_module/module.prop
https://topjohnwu.github.io/Magisk/guides.html#magisk-modules
or escalate to privileged shell and stream file content over stdin/stdout (linux only)
Code:
adb shell "su -c 'dd bs=1m if=/dev/block/bootdevice/by-name/boot 2> /dev/null'" > boot.img
adb shell "su -c 'dd bs=1m of=/dev/block/bootdevice/by-name/boot'" < path/to/boot.img

alecxs said:
you can overlay /system/bin/adbd with magisk module. create new directory in /data/adb/modules and place your files
Code:
/data/adb/modules/my_module/system/bin/adbd
/data/adb/modules/my_module/module.prop
https://topjohnwu.github.io/Magisk/guides.html#magisk-modules
or escalate to privileged shell and stream file content over stdin/stdout (linux only)
Code:
adb shell "su -c 'dd bs=1m if=/dev/block/bootdevice/by-name/boot 2> /dev/null'" > boot.img
adb shell "su -c 'dd bs=1m of=/dev/block/bootdevice/by-name/boot'" < path/to/boot.img
Click to expand...
Click to collapse
Thank you very much for your reply.
How would method 1 work? I find a different binary of adbd that has the root feature enabled and overlay the original with it through a Magisk module?

mattdeox said:
I already tried "adbd Insecure v2.00.apk" but it fails with the message
Click to expand...
Click to collapse
you found already, just unzip the assets/adbd.21.png from apk

alecxs said:
you found already, just unzip the assets/adbd.21.png from apk
Click to expand...
Click to collapse
I checked the file you mentioned and it has those contents:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What should I do with them?

mattdeox said:
. I've used Magisk to root the device but the command
Code:
adb root
results in
Code:
adbd cannot run as root in production builds
Click to expand...
Click to collapse
Why do you need this?

WoKoschekk said:
Why do you need this?
Click to expand...
Click to collapse
I would like to do some automated testing on my device using Appium to check if my website works correctly.
As I understood, adb root is needed to do it properly.

just rename the file > adbd
/data/data/eu.chainfire.adbd/files/adbd.21.png: ELF executable, 32-bit LSB arm, static, stripped

mattdeox said:
I would like to do some automated testing on my device using Appium to check if my website works correctly.
As I understood, adb root is needed to do it properly.
Click to expand...
Click to collapse
Basically: ADB is a commandline tool which acts as a client-server programm. You send ADB commands (usually from a desktop PC, but also possible from a rooted mobile) as a client to the adbd (daemon) on another device. The adbd executes those commands on the other device as user:shell. If you want the adbd acts as user:root then you have to execute adb root. BUT it's not possible to grant the adbd root permissions on a stock ROM (production builds). Even if the other device is rooted with Magisk it's still a production build!
The only way to execute commands as root via ADB on another device is
Code:
adb shell
su

alecxs said:
just rename the file > adbd
/data/data/eu.chainfire.adbd/files/adbd.21.png: ELF executable, 32-bit LSB arm, static, stripped
Click to expand...
Click to collapse
I created the structure you recommended
Code:
/data/adb/modules/adbRoot/module.prop
/data/adb/modules/adbRoot/system/bin/adbd
I opened Magisk and could see the module enabled.
Then restarted adbd
Code:
setprop ctl.restart adbd
But there was still the error
adbd cannot run as root in production builds
Click to expand...
Click to collapse
Then I found out on this page https://source.android.com/docs/core/ota/modular-system/adbd
that adbd moved on Android 13, supposedly to this location:
Code:
/apex/com.android.adbd/bin/adbd
Then I also created this file for the Magisk module
Code:
/data/adb/modules/adbRoot/system/apex/com.android.adbd/bin/adbd
Again, I restarted adb
Code:
setprop ctl.restart adbd
But the result still is the same
adbd cannot run as root in production builds
Click to expand...
Click to collapse
Anything else I could do/something that is wrong?

WoKoschekk said:
Basically: ADB is a commandline tool which acts as a client-server programm. You send ADB commands (usually from a desktop PC, but also possible from a rooted mobile) as a client to the adbd (daemon) on another device. The adbd executes those commands on the other device as user:shell. If you want the adbd acts as user:root then you have to execute adb root. BUT it's not possible to grant the adbd root permissions on a stock ROM (production builds). Even if the other device is rooted with Magisk it's still a production build!
The only way to execute commands as root via ADB on another device is
Code:
adb shell
su
Click to expand...
Click to collapse
Thank you very much for your input.
Are you saying there is nothing that can be done by replacing the adbd file or the config?
Do you think the solution by alecxs to replace the binary is not working?

mattdeox said:
Thank you very much for your input.
Are you saying there is nothing that can be done by replacing the adbd file or the config?
Do you think the solution by alecxs to replace the binary is not working?
Click to expand...
Click to collapse
Still do not understand the reason. Assume the command adb root is successful. how to proceed then?

Here's what you need for adb root:
daemon/main.cpp - platform/system/adb - Git at Google
These criterias have to be met to execute adb root.
In case the adbd gets root permissions, then you keep the privileges to run:
Code:
adb disable-verity
enable-verity
sideload OTAPACKAGE
remount [-R]
unroot
(For further information see 'adb help')
All the other ADB commands don't require the adbd to be rooted.

the insecure adbd by @Chainfire according to this logcat requires some additional sepolicy rules and probably therefore does not work with magisk out of the box.
found some magisk modules, maybe one of these binaries work for android 13 if you place it system/apex
[MODULE] Insecure adbd for Pixel devices
Hi everyone, I made a simple module for my own needs and I figured I'd share it here as well. This module enables "insecure adbd" on Pixel devices, which allows you to restart adbd in root mode via "adb root" and push/pull to/from the /data...
forum.xda-developers.com
[MODULE] Debugging modules: ADB Root, SELinux Permissive, Enable Eng
These modules are not meant for everyday use. They are intended for debugging and modification of a firmware. They significantly lower security of your device while active and even could softbrick it. You've been warned. ADB Root Magisk Module...
forum.xda-developers.com

Do I understand correctly:
To use/install the patched adbd I need a device with root permissions. Otherwise it wouldn't be possible to copy the adbd to /system/bin and make it executable. Having that patched adbd in /system/bin, I'm able to use the command adb root which let's me execute ADB commands with root permissions.
Why not using
Code:
adb shell
su
? Why I need a adbd with root permissions on a rooted device?

@WoKoschekk most likely he don't need it. we don't know. but there are cases where it can be useful, for example
Code:
adb pull /dev/block/bootdevice/by-name/userdata

alecxs said:
@WoKoschekk most likely he don't need it. we don't know. but there are cases where it can be useful, for example
Code:
adb pull /dev/block/bootdevice/by-name/userdata
Click to expand...
Click to collapse
Apart from the fact that it's not possible to restore such an image (e.g. corrupted encryption) you have to copy 128GB (minus the system) or more via USB. There is a reason why TWRP saves the data as a TAR archive and splits it into 1GB chunks.
I know there are more examples for a rooted adbd. But it could all be done in a root shell, too.

TWRP is useful for backup only if encryption is supported, which is not the case for Samsung encryption. But for forensic and recovery of deleted files full partition image is required. on FBE that /dev/block/bootdevice/by-name/userdata is already decrypted during runtime. for FDE one must adb pull /dev/block/dm-0 or whatever is mounted /data of course. Restoring works fine btw. just some encryption related files (like locksettings.db) must deleted.
I have posted workaround for streaming partitions with su (refer to 2. method in post #2) but it does not work on windows (not even with dos2unix)

TWRP was only an example for how /data could be backed up. In the most cases you restore /data after a wipe or when /data gets formatted. Then you will have a conflict with the already established encryption. After /data gets formatted the system generates a new master key during the next boot. You can't decrypt an old encryption with that master key.
The partition mirrors ~/dm-0 and so on are based on AVB and the device-mapper layer.
alecxs said:
I have posted workaround for streaming partitions with su
Click to expand...
Click to collapse
Yes, I know the 'netcat' method. Of course it's better to have a desktop PC and its storage for large images like /data. Better than an external sd. But you could also use the device's shell to create tar files.

WoKoschekk said:
Then you will have a conflict with the already established encryption.
Click to expand...
Click to collapse
Nope. works fine, as the partition image does not contain any encryption at all. consider it's already decrypted in AFU state.
WoKoschekk said:
After /data gets formatted the system generates a new master key during the next boot. You can't decrypt an old encryption with that master key.
Click to expand...
Click to collapse
Yes. only for FBE, for FDE it's static key. But encryption type doesn't matter, it contains plain files - same as TWRP backup.