Note: This method works with both 10i and 10j
I have read few posts arguing can root be done with 10i. I have been hesitant until last night. After I fixed USB 3.1 problem by updating the driver, I decided to give a try.
I updated mine with LG Bridge in order to grab an important file (a dll required for LGUP) and I made it. It's in
c:\users\(username)\Local\LG Electronics\LG Bridge\SW upgrade\
The dll file doesn't show up until the phones starts update, so timing is important.
Now, here is the instruction how to root with dirtycow method. I had problem with Easycow (no command error), so I have to do it manually to enter command one by one.
References:
https://forum.xda-developers.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594 (instruction and link to all files)
https://build.nethunter.com/android-tools/dirtycow/arm64/ (all required files. Copy all of them where your ADB folder is)
https://github.com/jcadduono/android_external_dirtycow#running (all the commands)
https://build.nethunter.com/test-builds/twrp/lge/twrp-3.0.2-1-h918.img (TWRP image. Rename it to twrp.img and put it into internal storage)
https://download.chainfire.eu/supersu (SuperSU. Put the file into memory card)
Prerequisites:
Your LG driver must be up to date. I have problem with USB 3.1 cable until the driver is up to date.
ADB installed and copy the address, and put all recowvery files into the folder (\sdk\platform-tools)
Rename TWRP file to twrp.img and put it into internal storage
Copy SuperSU into memory card
You must be in 100% stock ROM. Rooted or not.
USB debugging enabled and allowed your host computer.
Bootloader unlocked (you should see a warning on boot) and OEM unlock allowed in Developer Settings
Use LG Backup to backup internal storage and all apps into your memory card
Setup a temporary PIN
Steps:
1. Plug your phone to your host computer. Make sure it's in MTP mode.
2. Open your command prompt:
Code:
cd\
cd (right click your mouse and paste the ADB platform-tools address)
adb devices
This will show your connected phone (LGE Elsa)
3. Enter the following prompt: (you can simply highlight, copy, right click on command prompt and choose paste)
Code:
adb push dirtycow /data/local/tmp
adb push recowvery-applypatch /data/local/tmp
adb push recowvery-app_process64 /data/local/tmp
adb push recowvery-run-as /data/local/tmp
adb shell
cd /data/local/tmp
chmod 0777 *
./dirtycow /system/bin/applypatch recowvery-applypatch
On ADB shell mode, you should see $ on the front. Wait for few minutes.
Code:
./dirtycow /system/bin/app_process64 recowvery-app_process64
Your phone screen may look weird. Wait for another few minutes.
Type
Code:
exit
when finished.
4. Type in:
Code:
adb logcat -s recowvery
You should see a lot of lines comes across your screen. Wait for few minutes and press and hold Ctrl and press C once.
Code:
adb shell reboot recovery
Your phone will return to stock recovery.
Code:
adb shell
A $ sign will show up
Code:
getenforce
It should show Permissive.
5. Temp root
Type in:
Code:
cd /data/local/tmp
./dirtycow /system/bin/run-as recowvery-run-as
run-as exec ./recowvery-applypatch boot
The boot image will be patched.
Code:
run-as su
A # sign should show up. it means you have a temp root.
6. Flash TWRP
Code:
dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
exit
reboot recovery
6. Rooting
Your phone should be in TWRP.
Enter PIN you previously setup
Allow modifications
You may not be able to see internal storage. That's why you have to put SuperSU into memory card. Locate SuperSU and install it.
If everything went well, just reboot. You may want to wipe cache and dalvik cache.
Reboot
Update SuperSU binary if necessary
I can not get this thing to work.
It runs
C:\WINDOWS\system32>adb shell
elsa:/ $ cd /data/local/tmp
elsa:/data/local/tmp $ chmod 0777 *
dirtycow /system/bin/app_process64 recowvery-app_process64 <
warning: new file size (10200) and file old size (18600) differ
size 18600
[*] mmap 0x711b476000
[*] exploit (patch)
[*] currently 0x711b476000=10102464c457f
[*] madvise = 0x711b476000 18600
[*] madvise = 0 1048576
[*] /proc/self/mem -1971322880 1048576
[*] exploited 0x711b476000=10102464c457f
elsa:/data/local/tmp $
Click to expand...
Click to collapse
And when I run log cat:
--------- beginning of system
--------- beginning of main
--------- beginning of crash
01-12 10:54:53.926 12840 12840 I recowvery: Welcome to recowvery! (app_process64)
01-12 10:54:53.926 12840 12840 I recowvery: ------------
01-12 10:54:53.926 12840 12840 I recowvery: Current selinux context: u:r:zygote:s0
01-12 10:54:53.926 12840 12840 I recowvery: Set context to 'u:r:system_server:s0'
01-12 10:54:53.927 12840 12840 I recowvery: Current security context: u:r:system_server:s0
01-12 10:54:53.927 12840 12840 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
01-12 10:54:53.954 12840 12840 I recowvery: ------------
01-12 10:54:53.954 12840 12840 I recowvery: Recovery flash script should have started!
01-12 10:54:53.954 12840 12840 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
01-12 10:54:53.954 12840 12840 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
01-12 10:57:54.031 13219 13219 I recowvery: Welcome to recowvery! (app_process64)
01-12 10:57:54.031 13219 13219 I recowvery: ------------
01-12 10:57:54.032 13219 13219 I recowvery: Current selinux context: u:r:zygote:s0
01-12 10:57:54.032 13219 13219 I recowvery: Set context to 'u:r:system_server:s0'
01-12 10:57:54.034 13219 13219 I recowvery: Current security context: u:r:system_server:s0
01-12 10:57:54.034 13219 13219 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
01-12 10:57:54.038 13219 13219 I recowvery: ------------
01-12 10:57:54.038 13219 13219 I recowvery: Recovery flash script should have started!
01-12 10:57:54.038 13219 13219 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
01-12 10:57:54.038 13219 13219 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
01-12 11:00:54.101 13583 13583 I recowvery: Welcome to recowvery! (app_process64)
01-12 11:00:54.102 13583 13583 I recowvery: ------------
01-12 11:00:54.102 13583 13583 I recowvery: Current selinux context: u:r:zygote:s0
01-12 11:00:54.102 13583 13583 I recowvery: Set context to 'u:r:system_server:s0'
01-12 11:00:54.103 13583 13583 I recowvery: Current security context: u:r:system_server:s0
01-12 11:00:54.103 13583 13583 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
01-12 11:00:54.113 13583 13583 I recowvery: ------------
01-12 11:00:54.113 13583 13583 I recowvery: Recovery flash script should have started!
01-12 11:00:54.113 13583 13583 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
01-12 11:00:54.113 13583 13583 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
01-12 11:03:54.187 13961 13961 I recowvery: Welcome to recowvery! (app_process64)
01-12 11:03:54.187 13961 13961 I recowvery: ------------
01-12 11:03:54.188 13961 13961 I recowvery: Current selinux context: u:r:zygote:s0
01-12 11:03:54.188 13961 13961 I recowvery: Set context to 'u:r:system_server:s0'
01-12 11:03:54.189 13961 13961 I recowvery: Current security context: u:r:system_server:s0
01-12 11:03:54.189 13961 13961 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
01-12 11:03:54.190 13961 13961 I recowvery: ------------
01-12 11:03:54.191 13961 13961 I recowvery: Recovery flash script should have started!
01-12 11:03:54.191 13961 13961 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
01-12 11:03:54.191 13961 13961 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
Click to expand...
Click to collapse
All worked like a charm! Thanks OP!
Was gonna update and do this today but my damn hard drive quit on me. Really pissed. I need to update and probably return to stock since I have no way to fix anything in case something goes wrong. Might keep root but haven't decided. So to install the update via recovery, what do I need to do? Been a while since I had to do it this way. Say I wanted to keep root and twrp. Would I install boot img then system img the flash supersu and for safe measures flash twrp from this thread? What about the modem img and all that?
I was sweating bullets but I finally rooted 10i Thanks Op..
Starting root shell
1|elsa:/data/local/tmp $ dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
dd: /sdcard/twrp.img: No such file or directory
1|elsa:/data/local/tmp $
this what happen when I put the flash recovery comman any help?
how can you unroot the v20 and go to bone stock
dudeawsome said:
how can you unroot the v20 and go to bone stock
Click to expand...
Click to collapse
There's another thread where you can get required dll for LGUP, and you can also download stock kdz file.
https://forum.xda-developers.com/v20/how-to/h918-dll-lgup-t3535988
Use upgrade to retain your data
Use refurbish to wipe
mingkee said:
There's another thread where you can get required dll for LGUP, and you can also download stock kdz file.
https://forum.xda-developers.com/v20/how-to/h918-dll-lgup-t3535988
Use upgrade to retain your data
Use refurbish to wipe
Click to expand...
Click to collapse
Refurbish doesnt work
how do you setup temporary pin pls help asap
dudeawsome said:
Refurbish doesnt work
Click to expand...
Click to collapse
UPPERCUT works for me :good: https://forum.xda-developers.com/lg-g5/development/uppercut-lgup-loader-g5-variants-t3511295/
manuelperro said:
UPPERCUT works for me :good: https://forum.xda-developers.com/lg-g5/development/uppercut-lgup-loader-g5-variants-t3511295/
Click to expand...
Click to collapse
it says not working
dudeawsome said:
it says not working
Click to expand...
Click to collapse
well I just flashing my rooted h918d to h918i with UPPERCUT yesterday without any problems:fingers-crossed:
manuelperro said:
well I just flashing my rooted h918d to h918i with UPPERCUT yesterday without any problems:fingers-crossed:
Click to expand...
Click to collapse
yes you used the upgrade option not the refurbish option
dudeawsome said:
how do you setup temporary pin pls help asap
Click to expand...
Click to collapse
You don't really need it. However, you can set it up on Security Settings.
I didn't setup mine. I was prompt for password but I choose "cancel" and rooting still went through.
How do you unroot and remove twrp and go to full stock
dudeawsome said:
How do you unroot and remove twrp and go to full stock
Click to expand...
Click to collapse
Just scroll few posts back up and you will see the post with the bone stock kdz download link.
mingkee said:
Just scroll few posts back up and you will see the post with the bone stock kdz download link.
Click to expand...
Click to collapse
But the refurbish isn't supported by the kids only upgrade option
Could you please upload the dll file somewhere for me?
does 10j still have anti rollback unset?
Related
My htc was off for one month because i went to a trip and did not take it with me. when i came back i turned it on and boom! bootloop! came from nowhere.
I had the vipers rom on it so i tried to update to the newest vipers rom but still bootloop. i tried to install different rom but nothing help,
At the end i installed RUU and still i'm in bootloop! please help me
amitshkuri said:
My htc was off for one month because i went to a trip and did not take it with me. when i came back i turned it on and boom! bootloop! came from nowhere.
I had the vipers rom on it so i tried to update to the newest vipers rom but still bootloop. i tried to install different rom but nothing help,
At the end i installed RUU and still i'm in bootloop! please help me
Click to expand...
Click to collapse
can you boot into bootloader?
if yes post all the on screen details
rzr86 said:
can you boot into bootloader?
if yes post all the on screen details
Click to expand...
Click to collapse
yes i can get into bootloader but in recovery i get error.
***LOCKED***
PYRAMID PVT SHIP S-OFF RL
HBOOT-1.27.0000
RADIO-11.24A.3504.31_M
OpenADSP-v05.6.0.2226.00.0418
eMMC-boot
JAN 13 2012, 17:33:34
HBOOT
FASTBOOT
RECOVERY
FACTORY RESET
SIMLOCK
IMAGE CRC
amitshkuri said:
yes i can get into bootloader but in recovery i get error.
***LOCKED***
PYRAMID PVT SHIP S-OFF RL
HBOOT-1.27.0000
RADIO-11.24A.3504.31_M
OpenADSP-v05.6.0.2226.00.0418
eMMC-boot
JAN 13 2012, 17:33:34
HBOOT
FASTBOOT
RECOVERY
FACTORY RESET
SIMLOCK
IMAGE CRC
Click to expand...
Click to collapse
from this guide it has 3 options to flash 4ext recovery(see step 1)
http://forum.xda-developers.com/showthread.php?t=1472298
after that go into recovery
format all partitions except sdcard
flash the rom
see if it boots
rzr86 said:
from this guide it has 3 options to flash 4ext recovery(see step 1)
http://forum.xda-developers.com/showthread.php?t=1472298
after that go into recovery
format all partitions except sdcard
flash the rom
see if it boots
Click to expand...
Click to collapse
i flashed 4ext recovery and flashed 3.33 firmware and flashed ARHD 7.2 (i did full wipe for all patitions)
still in bootloop but now it pass the HTC logo and the quitly brilliant logo and start the beats animation then it restart.
HI
GREETINGS
according to your bootloader you have stock htc hboot and
stock htc hboot does not go well with soff
flash the hboot in my attachment
to flash the hboot:-
1 put the file in root of sd card
2 reboot into bootloader
3 the bootloader will scan the file, follow on screen instruction
4 reboot back in to bootloader and make a clean installation of the rom as suggested by "RZR86"
shrex said:
HI
GREETINGS
according to your bootloader you have stock htc hboot and
stock htc hboot does not go well with soff
flash the hboot in my attachment
to flash the hboot:-
1 put the file in root of sd card
2 reboot into bootloader
3 the bootloader will scan the file, follow on screen instruction
4 reboot back in to bootloader and make a clean installation of the rom as suggested by "RZR86"
Click to expand...
Click to collapse
I flashed the new hboot and flashed the recovery again and made a clean installation including format for all partitions and still i stuck in this bootloop! what can i do more?
amitshkuri said:
what can i do more?
Click to expand...
Click to collapse
Absolutely loads of stuff. First thing is to get the logs.
Flash a rom with adb set in the default.prop in the boot image ramdisk ( CM for example )
while the device is bootlooping run
Code:
adb shell dmesg
which gives the kernel messages then you can run
Code:
adb logcat -b system -b radio -b events -b main
this will run forever, you'll notice it repeating the same messages over and over, look out for lines that start with "E/"
they're errors being reported and will lead you to the cause of you're bootloop
If either of these two fail then reboot into recovery and run
Code:
adb shell cat /dev/last_kmsg
This is a saved copy of dmsg from the last session.
Once you've got the logs you can easily pinpoint the cause of the problem all you got is read them
PROTIP: Look for the word error or fail or something similar
ok so that's all the errors i found while booting:
E/QC-NETMGR-LIB( 165): couldn't open file /sys/module/f_rmnet/parameters/rmnet_ctl_ch
E/QC-NETMGR-LIB( 165): couldn't open /sys/module/rmnet/parameters/rmnet_ctl_ch
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/DxDrmNexPlayerIntegrator( 169): ** Discretix Server loaded config file - result=0 **
E/DxDrmNexPlayerIntegrator( 169): ** Discretix SignalsListener Thread is starting **
E/DxSecureClock( 169): ** Discretix Clock Monitor is starting **
E/msm8660.gralloc( 153): DEBUG_CALC_FPS: 0
E/msm8660.gralloc( 153): period: 10
E/msm8660.gralloc( 153): ignorethresh_us: 500000
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 0
E/SurfaceFlinger( 153): composer device failed to initialize (Invalid argument)
E/rmt_storage( 120): Unable to open /boot/modem_fsg
E/rmt_storage( 120): Invalid rmt_storage client
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 1
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 2
E/HtcBootAnimation( 225): Could not find width.
E/HtcBootAnimation( 225): Could not find height.
E/HtcBootAnimation( 225): Could not find framerate.
E/HtcBootAnimation( 225): Could not find part1.
E/HtcBootAnimation( 225): Could not find part2.
E/HtcBootAnimation( 225): Could not find part3.
E/HtcBootAnimation( 225): sqlite3_open error, sqlite result: 14, errno: 2, No such file or directory
E/QC-DIAG_LSM( 156):
E/QC-DIAG_LSM( 156): Diag_LSM: Diag_LSM_Init: Failed to open handle to diag driver, error = 13
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 3
E/ExtendedExtractor( 156): Failed to open MM_PARSER_LIB, dlerror = Cannot load library: reloc_library[1290]: 156
E/AudioPolicyManagerBase( 156): Could not open support_receiver()
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 4
And this came at the second of crash:
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 5
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 6
E/QC-NETMGR-LIB( 165): ifioctl: close port failed: (9)Bad file number
E/QC-NETMGR-LIB( 165): ifioctl: open port failed: (19)No such device
E/QC-NETMGR-LIB( 165): netmgr_kif_ifioctl_open_port() failed for rmnet0 on attempt 7
am i in trouble?
amitshkuri said:
am i in trouble?
Click to expand...
Click to collapse
It's difficult to say with ONLY the errors LOL. You've just removed all the context of what was going on around leading upto it. Can you post the rest of them, not here though, pastebin or somewhere like that.
Also dmesg output would be pretty useful to see if all the drivers are install correctly.
At first glance, You seem to be missing some vital libraries. files, to say anything more at this point would just be guessing? but yeah, dmesg and a full logcat.
Actually to save a back and forth you can run the following commands
Code:
adb root
adb shell stop
adb shell dumpstate > state.txt
adb shell dumpsys > sys.txt
Don't know what you know so I'll explain what this does.
adb root , restarts adb as the root user
adb shell stop, this stops the servicemanager and it's child services , basically stop loading android. If you have a boot animation you should see it stop, this also stops device from rebooting as the next commands take some time to run.
dumpstate and dumpsys will dump your entire device contents to state.txt and sys.txt on your desktop machine. you won't see any output and they do take some time to run so please be patient. As you've fully formatted it I wouldn't expect any personal data to be present in those files but may contain device specific info please have a look before posting. searching the for things like your email address, name, IMEI, serial no's etc should help.
Then zip the files and attach them to this thread. Like I mentioned these files contain everything about the Device and the current state and will give us everything we need to figure out whats wrong.
If you're not comfortable "doing the dump!" ( sounds like a song ) then option 1 of logcat and dmesg should do I'll probably end up asking for more but meh!
ok i tried but
Code:
adb root
adb shell stop
didn't help and the boot restart again and again so i cannot write the rest of codes you gave me.
i attached a rar file with the context of logcat and dmesg.
amitshkuri said:
ok i tried but
Code:
adb root
adb shell stop
didn't help and the boot restart again and again so i cannot write the rest of codes you gave me.
i attached a rar file with the context of logcat and dmesg.
Click to expand...
Click to collapse
That's fine dmesg tells all in this case, It's a bit weird. you system partition seem to be at fault. these messages
Code:
<6>[ 2.457794] EXT4-fs (mmcblk0p22): INFO: recovery required on readonly filesystem
<6>[ 2.457977] EXT4-fs (mmcblk0p22): write access will be enabled during recovery
<6>[ 2.466827] EXT4-fs (mmcblk0p22): barriers disabled
<6>[ 2.468963] EXT4-fs (mmcblk0p22): recovery complete
<6>[ 2.476013] EXT4-fs (mmcblk0p22): mounted filesystem with writeback data mode. Opts: barrier=0
which is just information but a couple of lines down is this
Code:
<6>[ 3.588012] EXT4-fs (mmcblk0p22): re-mounted. Opts: noauto_da_alloc,barrier=0
Logcat also has this related message
Code:
I//system/xbin/busybox( 107): tune2fs 1.41.12 (17-May-2010)
I//system/xbin/busybox( 107): tune2fs 1.41.12 (17-May-2010)
I//system/xbin/busybox( 107): The needs_recovery flag is set. Please run e2fsck before clearing
what it looks like is happening is the kernel has remounted your /system partition to try to set it up for recovery while the device is booting make system files unavailable in the process, which ties up to the messages about missing libraries from earlier on. it may well be easily solved simply by following the instruction and running e2fsck on /dev/block/mmcblk0p22, it worth a shot I'd say.
reboot into recovery and run
Code:
adb shell e2fsck /dev/block/mmcblk0p22
you may also have to remove the need_recovery flag from the partition... I don't know how to do that off the top of my head and I have to go out for a bit.... Google may be your friend
More Soon!
own diBeco
trevd said:
That's fine dmesg tells all in this case, It's a bit weird. you system partition seem to be at fault. these messages
Code:
<6>[ 2.457794] EXT4-fs (mmcblk0p22): INFO: recovery required on readonly filesystem
<6>[ 2.457977] EXT4-fs (mmcblk0p22): write access will be enabled during recovery
<6>[ 2.466827] EXT4-fs (mmcblk0p22): barriers disabled
<6>[ 2.468963] EXT4-fs (mmcblk0p22): recovery complete
<6>[ 2.476013] EXT4-fs (mmcblk0p22): mounted filesystem with writeback data mode. Opts: barrier=0
which is just information but a couple of lines down is this
Code:
<6>[ 3.588012] EXT4-fs (mmcblk0p22): re-mounted. Opts: noauto_da_alloc,barrier=0
Logcat also has this related message
Code:
I//system/xbin/busybox( 107): tune2fs 1.41.12 (17-May-2010)
I//system/xbin/busybox( 107): tune2fs 1.41.12 (17-May-2010)
I//system/xbin/busybox( 107): The needs_recovery flag is set. Please run e2fsck before clearing
what it looks like is happening is the kernel has remounted your /system partition to try to set it up for recovery while the device is booting make system files unavailable in the process, which ties up to the messages about missing libraries from earlier on. it may well be easily solved simply by following the instruction and running e2fsck on /dev/block/mmcblk0p22, it worth a shot I'd say.
reboot into recovery and run
Code:
adb shell e2fsck /dev/block/mmcblk0p22
you may also have to remove the need_recovery flag from the partition... I don't know how to do that off the top of my head and I have to go out for a bit.... Google may be your friend
More Soon!
Click to expand...
Click to collapse
The shell e2fsck did not help, still in bootloop.
i searched in google about the need_recovery flag and i found one post that explain how to do this but in ubuntu linux
the command " debugfs " mentioned there, i dont really understand what to do.
amitshkuri said:
The shell e2fsck did not help, still in bootloop.
i searched in google about the need_recovery flag and i found one post that explain how to do this but in ubuntu linux
the command " debugfs " mentioned there, i dont really understand what to do.
Click to expand...
Click to collapse
hi again.
After reading some more e2fsck need some extra options. apologises for that
Also as is usually the case with these things you're not the first person to have this problem. A quick xda search for "The needs_recovery flag is set" brings up this post
I've just tested it because my cache partition has the needs_recovery flag set so I ran the commands in that post in recovery and it did clear the needs_recovery flag. so in your case you need to boot into recovery make sure /system is NOT mount which should be the default state and run the following commands
Code:
adb shell
tune2fs -l /dev/block/mmcblk0p22 | grep features
this command get the list of filesystem features it should look something like this ( order may be different )
Code:
Filesystem features: has_journal resize_inode filetype needs_recovery extent sparse_super large_file
Next we'll run e2fsck with the right command this time LOL
Code:
e2fsck -f /dev/block/mmcblk0p22
After that we can remove the old journal with tune2fs
Code:
tune2fs -O ^has_journal -c 1 -i 1d -m 0 /dev/block/mmcblk0p22
This should remove both the has_journal and needs_recovery flags from the feature list. Seeing as has_journal was set we'll turn it back on
Code:
tune2fs -O has_journal -c 1 -i 1d -m 0 /dev/block/mmcblk0p22
Note the caret symbol ( ^ ) which is the difference between the above to commands. This controls whether a feature should be added or removed
Finally check the feature list again
Code:
tune2fs -l /dev/block/mmcblk0p22 | grep features
It should now look like this or something similar, If it still has needs_recovery in the list then something is wrong
Code:
Filesystem features: has_journal resize_inode filetype extent sparse_super large_file
All we need to do now is pray to the ghost of steve jobs and say the magic words
Code:
reboot
And hopefully we might have a win for you! :good:
when i write this line: e2fsck -f /dev/block/mmcblk0p22
i get this: Pass 1: Checking inodes, blocks, and sizes
Inodes that were part of a corrupted orphan linked list found. Fix<y>?
if i press "y" i get this: Inode 13765 is in use, but has dtime set. Fix<y>?
and more and more and more questions and cant continue with the next lines you gave me.
what to do?
amitshkuri said:
when i write this line: e2fsck -f /dev/block/mmcblk0p22
i get this: Pass 1: Checking inodes, blocks, and sizes
Inodes that were part of a corrupted orphan linked list found. Fix<y>?
if i press "y" i get this: Inode 13765 is in use, but has dtime set. Fix<y>?
and more and more and more questions and cant continue with the next lines you gave me.
what to do?
Click to expand...
Click to collapse
e2fsck -f -y /dev/block/mmcblk0p22
That will answer yes to all questions!
i did all exactly and still in a bootloop..
i got Filesystem features: has_journal resize_inode filetype extent sparse_super large_file
without the needs recovery, all went well.
is there hope?
amitshkuri said:
i did all exactly and still in a bootloop..
i got Filesystem features: has_journal resize_inode filetype extent sparse_super large_file
without the needs recovery, all went well.
is there hope?
Click to expand...
Click to collapse
Time to rinse and repeat, Grab the dmesg and the logcat and lets see what it's saying now? Also Have you tried reflashing the rom, it's possible the tune2fs has deleted some files but we can only find out by looking at the logs!
i tried now to reflashed and still bootloop :/
i attached the new demsg and logcat.
thank you for all the help!
amitshkuri said:
i tried now to reflashed and still bootloop :/
i attached the new demsg and logcat.
thank you for all the help!
Click to expand...
Click to collapse
Not a problem on the help. At least you bought an interesting problem to solve It's not your normal bootloop cause.
hmmm , It seems to have gone back to needs recovery.... Ok. Can you run the command from earlier but this time do not re-add the journal feature, so these commands
Code:
tune2fs -l /dev/block/mmcblk0p22 | grep features
e2fsck -f -y -v /dev/block/mmcblk0p22
tune2fs -O ^has_journal -c 1 -i 1d -m 0 /dev/block/mmcblk0p22
tune2fs -l /dev/block/mmcblk0p22 | grep features
#EDIT Mount as read only to mark it ready for mounting
mount -ro -text4 /dev/block/mmcblk0p22 /system
reboot
can you copy the output of these commands and post them up, I'm just curious to see what its runnning.
Do you know how to make your boot image insecure and how to mount /system with rw by default?
If not can you send me the boot image you're using an i'll fix it up.
The plan is to attempt the fs repair and remove journaling which from what I understand can be responsible for triggering the needs_recovery. should that not work, the kernel will try running recovery on the fs at boot time but this time it won't need to remount the /system partition because it will be already mounted as rw ... that's the theory at least.
If it fails send the logs and we'll have a look a some other options depending on the log out. But I wouldn't be worried there's still a couple of more things we can leverage to fixup the system partition.
[DISCUSSION]How to fix Jack server failing to build with error "Try jack-diagnose"
Did you got this error while building with Jack?
Code:
[ X% Y/Z] Building with Jack: /home/minealex2244/los/out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/with-local/classes.dex
FAILED: /bin/bash /home/minealex2244/los/out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/with-local/classes.dex.rsp
Communication error with Jack server (52). Try 'jack-diagnose'
ninja: build stopped: subcommand failed.
make: *** [ninja_wrapper] Error 1
It looks like the installation of Jack server is broken. So how do we fix it?
1. Open a terminal window
2. Type the following commands:
Code:
jack-admin kill-server
jack-admin uninstall-server
cd prebuilts/sdk/tools
touch jack
mm -j32 showcommands &> mm.out
./jack-admin install-server jack-launcher.jar jack-server-4.8.ALPHA.jar
3. Now the build should work.
Note: Sometimes it will continue to fail, just be persistent ("make" command again). In my case it is running somehow out of memory and that's why I'm persistent.
Note2: By increasing the RAM memory you will get better results. I see that Jack server is running out of memory at some point.
Note3: It is possible to reduce the number of concurrent services in file $HOME/.jack-server/config.properties
Code:
jack.server.max-service=N
where "N" is a number (default: 4).
Note4: Try creating a swap file of 20-40 GB as Jack uses a lot of RAM (https://forum.xda-developers.com/showpost.php?p=73083910&postcount=4).
Thanks for this post. I had lost the jack server and couldn't find how to get it back. You really saved me bro!
how do I create the swap file, new to building and I am having this issue? Thanks!
yung40oz84 said:
how do I create the swap file, new to building and I am having this issue? Thanks!
Click to expand...
Click to collapse
Here is a guide: https://www.howtoforge.com/ubuntu-swap-file
Also this may help:
Code:
export USE_CCACHE=1
prebuilts/misc/linux-x86/ccache/ccache -M 50G
Add these to your .bashrc
minealex2244 said:
Here is a guide: https://www.howtoforge.com/ubuntu-swap-file
Also this may help:
Code:
export USE_CCACHE=1
prebuilts/misc/linux-x86/ccache/ccache -M 50G
Add these to your .bashrc
Click to expand...
Click to collapse
Could I set the ccache to a large USB flashdrive for faster caching? I'm using a standard HDD, just curious if I could get a slight performance boost from this
Travisholt92 said:
Could I set the ccache to a large USB flashdrive for faster caching? I'm using a standard HDD, just curious if I could get a slight performance boost from this
Click to expand...
Click to collapse
It depends on how fast the USB drive is.
minealex2244 said:
It depends on how fast the USB drive is.
Click to expand...
Click to collapse
My USB ports are too slow for that, however I did find a speed boost by taking an old smaller sata hard drive and mounting it as the /out folder. So it mainly reads from one drive while writing to the other which helps with overall read/write latency. I hope this information helps someone else.
Does anybody know how to raise the the amount of resources javac uses when compiling? Mine is stuck at "javac -J-Xmx1024M" and I believe that is causing some build errors for me. My cm-14.1 tree is limited to 1024m and my lineage-15.0 tree is limited to 2048m for javac. The variable must be able to be changed somehow if it changes between build trees like that.
jack server error 51
I am trying to compile ResurrectionRemix Rom from source. Compilation would not even start.
Communication error with Jack server 51. Try 'jack-diagnose'
I am getting this error. I have tried killing the server and running it again. then getting this error
No Jack server running. Try 'jack-admin start-server'
I checked the logs but nothing is in there. I tried running "jack-diagnose" but it is showing permission denied. Kindly help me. thanks
Please send link to download the jack jar file for launcher and server.
karan4c6 said:
Please send link to download the jack jar file for launcher and server.
Click to expand...
Click to collapse
Repo sync -f should do the thing.
Stuck
Code:
[email protected] ~/Andro_Dev/DotOS/prebuilts/sdk/tools $ ./jack-admin install-server jack-launcher.jar jack-server-4.8.ALPHA.jar
Jack server jar "jack-server-4.8.ALPHA.jar" is not readable
[email protected] ~/Andro_Dev/DotOS/prebuilts/sdk/tools $
Black_J said:
Stuck
Code:
[email protected] ~/Andro_Dev/DotOS/prebuilts/sdk/tools $ ./jack-admin install-server jack-launcher.jar jack-server-4.8.ALPHA.jar
Jack server jar "jack-server-4.8.ALPHA.jar" is not readable
[email protected] ~/Andro_Dev/DotOS/prebuilts/sdk/tools $
Click to expand...
Click to collapse
Make sure that the file is RW and not RO. Right click on it and change the properties.
minealex2244 said:
Make sure that the file is RW and not RO. Right click on it and change the properties.
Click to expand...
Click to collapse
Thanks for the quick reply, but I figured out my problem.
I blindly just copied pasted the codes. The directory was having jack-server-4.11.ALPHA.jar not jack-server-4.8.ALPHA.jar in my case.
you saved me bro. Thanks
nit_in said:
I am trying to compile ResurrectionRemix Rom from source. Compilation would not even start.
Communication error with Jack server 51. Try 'jack-diagnose'
I am getting this error. I have tried killing the server and running it again. then getting this error
No Jack server running. Try 'jack-admin start-server'
I checked the logs but nothing is in there. I tried running "jack-diagnose" but it is showing permission denied. Kindly help me. thanks
Click to expand...
Click to collapse
Did you figure this out? I'm having same problem with the same error message.
Airtioteclint said:
Did you figure this out? I'm having same problem with the same error message.
Click to expand...
Click to collapse
before giving the make/lunch/brunch command enter this in terminal.
JACK_SERVER_VM_ARGUMENTS="-Xmx4g -Dfile.encoding=UTF-8 -XX:+TieredCompilation" /mnt/disk2/du/prebuilts/sdk/tools/jack-admin start-server
Click to expand...
Click to collapse
if this don't work, increase the value from 4g to 8g or more
replace the /mnt/disk2/du with your project directory.
Also open .jack-server/config.properties in your home.
and edit jack.server.max-service to 1
Hope this will help you.
Thanks
Another reason for Jack Server errors could be that the port server clashes with already started instances of other users in your system.
If you set up a server and admin port based on your uid, your Jack Server should work without issues.
at now: jack-server-4.8.ALPHA.jar
minealex2244 said:
Did you got this error while building with Jack?
Code:
[ X% Y/Z] Building with Jack: /home/minealex2244/los/out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/with-local/classes.dex
FAILED: /bin/bash /home/minealex2244/los/out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/with-local/classes.dex.rsp
Communication error with Jack server (52). Try 'jack-diagnose'
ninja: build stopped: subcommand failed.
make: *** [ninja_wrapper] Error 1
It looks like the installation of Jack server is broken. So how do we fix it?
1. Open a terminal window
2. Type the following commands:
Code:
jack-admin kill-server
jack-admin uninstall-server
cd prebuilts/sdk/tools
touch jack
mm -j32 showcommands &> mm.out
./jack-admin install-server jack-launcher.jar jack-server-4.8.ALPHA.jar
3. Now the build should work.
Note: Sometimes it will continue to fail, just be persistent ("make" command again). In my case it is running somehow out of memory and that's why I'm persistent.
Note2: By increasing the RAM memory you will get better results. I see that Jack server is running out of memory at some point.
Note3: It is possible to reduce the number of concurrent services in file $HOME/.jack-server/config.properties
Code:
jack.server.max-service=N
where "N" is a number (default: 4).
Note4: Try creating a swap file of 20-40 GB as Jack uses a lot of RAM (https://forum.xda-developers.com/showpost.php?p=73083910&postcount=4).
Click to expand...
Click to collapse
Hi I am getting a bunch of errors when It's compiling the package: Download Provider
FAILED: /bin/bash -c "(rm -f /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/classes.dex ) && (rm -f /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/classes.jack ) && (rm -rf /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc ) && (mkdir -p /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/ ) && (mkdir -p /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/ ) && (mkdir -p /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc ) && (rm -f /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list ) && (touch /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list ) && (echo -n 'packages/providers/DownloadProvider/src/com/android/providers/downloads/Constants.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadDrmHelper.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadIdleService.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadInfo.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadJobService.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadNotifier.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadReceiver.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadScanner.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadStorageProvider.java packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadThread.java packages/providers/DownloadProvider/src/com/android/providers/downloads/Helpers.java packages/providers/DownloadProvider/src/com/android/providers/downloads/OpenHelper.java packages/providers/DownloadProvider/src/com/android/providers/downloads/RealSystemFacade.java packages/providers/DownloadProvider/src/com/android/providers/downloads/StopRequestException.java packages/providers/DownloadProvider/src/com/android/providers/downloads/StorageUtils.java packages/providers/DownloadProvider/src/com/android/providers/downloads/SystemFacade.java ' >> /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list ) && (if [ -d "/home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/src" ]; then find /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/src -name '*.java' >> /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list; fi ) && (tr ' ' '\\n' < /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list | build/tools/normalize_path.py | sort -u > /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list-uniq ) && (echo -basedirectory /home/android/RR > /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/classes.dex.flags; echo -forceprocessing -include build/core/proguard.flags -dontobfuscate -dontoptimize -printmapping /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack_dictionary -include /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/proguard_options -include /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/proguard_options >> /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/classes.dex.flags ) && (if [ -s /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list-uniq ] ; then export tmpEcjArg="@/home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list-uniq"; else export tmpEcjArg=""; fi; JACK_VERSION=3.36.CANDIDATE /home/android/RR/out/host/linux-x86/bin/jack @build/core/jack-default.args --verbose error -g -D jack.java.source.version=1.8 --classpath /home/android/RR/out/target/common/obj/JAVA_LIBRARIES/core-junit_intermediates/classes.jack:/home/android/RR/out/target/common/obj/JAVA_LIBRARIES/core-libart_intermediates/classes.jack:/home/android/RR/out/target/common/obj/JAVA_LIBRARIES/core-oj_intermediates/classes.jack:/home/android/RR/out/target/common/obj/JAVA_LIBRARIES/ext_intermediates/classes.jack:/home/android/RR/out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/classes.jack:/home/android/RR/out/target/common/obj/JAVA_LIBRARIES/okhttp_intermediates/classes.jack --import /home/android/RR/out/target/common/obj/JAVA_LIBRARIES/android-support-documents-archive_intermediates/classes.jack --import /home/android/RR/out/target/common/obj/JAVA_LIBRARIES/guava_intermediates/classes.jack -D jack.android.min-api-level=25 -D jack.import.resource.policy=keep-first -D jack.import.type.policy=keep-first --output-jack /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/classes.jack --output-dex /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc --config-proguard /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/classes.dex.flags \$tmpEcjArg || ( rm -rf /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/classes.jack; exit 41 ) ) && (mv /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/classes*.dex /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/with-local/ ) && (rm -f /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list ) && (mv /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc/java-source-list-uniq /home/android/RR/out/target/common/obj/APPS/DownloadProvider_intermediates/jack-rsc.java-source-list )"
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadStorageProvider.java:326: The method setFilterByString(String) is undefined for the type DownloadManager.Query
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:150: COLUMN_DESTINATION cannot be resolved or is not a field
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:155: COLUMN_FILE_NAME_HINT cannot be resolved or is not a field
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:1133: The method update(SQLiteDatabase, ContentValues, String, String[]) is undefined for the type SQLiteQueryBuilder
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:1237: The method setStrictColumns(boolean) is undefined for the type SQLiteQueryBuilder
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:1238: The method setStrictGrammar(boolean) is undefined for the type SQLiteQueryBuilder
ERROR: /home/android/RR/packages/providers/DownloadProvider/src/com/android/providers/downloads/DownloadProvider.java:1316: The method delete(SQLiteDatabase, String, String[]) is undefined for the type SQLiteQueryBuilder
It looks like it's a jack error. I compiled 2 different roms and arrived at the same error. How can I fix it if it's possible?
I apologize if this is in the wrong place as this is my first thread, but I wanted to show people that OneClickRoot does work for T-Mo. They are legitimate. It cost me $35 and I chose to pay another $20 for a full phone replacement and guarantee if anything goes wrong they fix it. I had an H91810J Version with a newer security patch.
I am pasting the code they used through the command prompt, at least what I could from my buffer. I also missed part of the commands as I had the buffer size in my command prompt set too low so I missed some of the commands. I know more went on behind the scenes as I did the exact same thing numerous times and it NEVER flashed twrp. I have all the programs they used as well if they should be posted? Hopefully I am not violating any policies here as I am new to XDA so if I am please let me know.
A few of these steps were missing in the dirty cow exploit when I tried it or as I stated I missed some of it in the command prompt and more was going on through their program I didn't see. I have also rooted or I should say followed other people methods to root a phone several times (and understood the exploit) but I couldn't get twrp flashed on this. You can read my followup posts.
C:\Users\XXXXXXFAMILY>cd "C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo"
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb devices
List of devices attached
LGH918XXXXXXXX device
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell
elsa:/ $ cd system/xbin
cd system/xbin
elsa:/system/xbin $ ls
ls
dexlist tcd
elsa:/system/xbin $ exit
exit
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb reboot bootloader
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot devices
LGH918XXXXXXXX fastboot
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot oem unlock
...
(bootloader) Device already : unlocked!
OKAY [ 0.016s]
finished. total time: 0.016s
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>fastboot reboot
rebooting...
finished. total time: 0.000s
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push twrp.img /storage/emulated/0/Download
adb server is out of date. killing...
* daemon started successfully *
2361 KB/s (25759744 bytes in 10.654s)
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push dirtycow /data/local/tmp
9 KB/s (9984 bytes in 1.000s)
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-applypatch /data/local/tmp
1153 KB/s (18472 bytes in 0.015s)
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-app_process64 /data/local/tmp
637 KB/s (10200 bytes in 0.015s)
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb push recowvery-run-as /data/local/tmp
9 KB/s (10192 bytes in 1.000s)
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell
elsa:/ $ cd /data/local/tmp
cd /data/local/tmp
elsa:/data/local/tmp $ chmod 0777 *
chmod 0777 *
elsa:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch
./dirtycow /system/bin/applypatch recowvery-applypatch
warning: new file size (18472) and file old size (165144) differ
size 165144
[*] mmap 0x7554457000
[*] exploit (patch)
[*] currently 0x7554457000=10102464c457f
[*] madvise = 0x7554457000 165144
[*] madvise = 0 1048576
[*] /proc/self/mem 1367343104 1048576
[*] exploited 0x7554457000=10102464c457f
elsa:/data/local/tmp $ ./dirtycow /system/bin/app_process64 recowvery-app_process64
dirtycow /system/bin/app_process64 recowvery-app_process64 <
warning: new file size (10200) and file old size (18600) differ
size 18600
[*] mmap 0x7288fd4000
[*] exploit (patch)
[*] currently 0x7288fd4000=10102464c457f
[*] madvise = 0x7288fd4000 18600
[*] madvise = 0 1048576
[*] /proc/self/mem -1971322880 1048576
[*] exploited 0x7288fd4000=10102464c457f
elsa:/data/local/tmp $ exit
exit
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb logcat -s recowvery
--------- beginning of system
--------- beginning of main
--------- beginning of crash
04-23 00:35:53.713 8495 8495 I recowvery: Welcome to recowvery! (app_process64)
04-23 00:35:53.713 8495 8495 I recowvery: ------------
04-23 00:35:53.713 8495 8495 I recowvery: Current selinux context: u:r:zygote:s0
04-23 00:35:53.713 8495 8495 I recowvery: Set context to 'u:r:system_server:s0'
04-23 00:35:53.714 8495 8495 I recowvery: Current security context: u:r:system_server:s0
04-23 00:35:53.714 8495 8495 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
04-23 00:35:53.716 8495 8495 I recowvery: ------------
04-23 00:35:53.716 8495 8495 I recowvery: Recovery flash script should have started!
04-23 00:35:53.716 8495 8495 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
04-23 00:35:53.716 8495 8495 I recowvery: Waiting 120 seconds...
04-23 00:35:53.751 8499 8499 I recowvery: Welcome to recowvery! (applypatch)
04-23 00:35:53.751 8499 8499 I recowvery: ------------
04-23 00:35:53.751 8499 8499 I recowvery: Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...
04-23 00:35:53.931 8499 8499 I recowvery: Loaded boot image!
04-23 00:35:53.931 8499 8499 I recowvery: ------------
04-23 00:35:53.931 8499 8499 I recowvery: Saving old ramdisk to file
04-23 00:35:53.932 8499 8499 I recowvery: Writing to file '/cache/ramdisk.gz'...
04-23 00:35:53.962 8499 8499 I recowvery: Wrote OK: 6558126 bytes
04-23 00:35:53.962 8499 8499 I recowvery: Decompressing ramdisk (gzip -d)
04-23 00:35:54.411 8499 8499 I recowvery: Checking '/cache/ramdisk.cpio' for validity (size >= 4194304 bytes)
04-23 00:35:54.411 8499 8499 I recowvery: '/cache/ramdisk.cpio': 16792832 bytes
04-23 00:35:54.411 8499 8499 I recowvery: File OK
04-23 00:35:54.411 8499 8499 I recowvery: Decompression of ramdisk successful
04-23 00:35:54.411 8499 8499 I recowvery: Deleting '/cache/ramdisk.gz' (no longer needed)
04-23 00:35:54.415 8499 8499 I recowvery: ------------
04-23 00:35:54.415 8499 8499 I recowvery: Opened cpio archive '/cache/ramdisk.cpio' (16792832 bytes)
04-23 00:35:54.416 8499 8499 I recowvery: Wrote new file (308 bytes) to cpio archive,
04-23 00:35:54.416 8499 8499 I recowvery: Final size: 16793036 bytes
04-23 00:35:54.416 8499 8499 I recowvery: ------------
04-23 00:35:54.416 8499 8499 I recowvery: Compressing cpio to ramdisk (gzip -9 -c)
04-23 00:36:00.080 8499 8499 I recowvery: Checking '/cache/ramdisk.gz' for validity (size >= 2097152 bytes)
04-23 00:36:00.081 8499 8499 I recowvery: '/cache/ramdisk.gz': 6539881 bytes
04-23 00:36:00.081 8499 8499 I recowvery: File OK
04-23 00:36:00.081 8499 8499 I recowvery: Compression of ramdisk successful
04-23 00:36:00.081 8499 8499 I recowvery: Deleting '/cache/ramdisk.cpio' (no longer needed)
04-23 00:36:00.095 8499 8499 I recowvery: Loading new ramdisk into boot image
04-23 00:36:00.105 8499 8499 I recowvery: ------------
04-23 00:36:00.105 8499 8499 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] androidboot.hardware=elsa"
04-23 00:36:00.105 8499 8499 I recowvery: Setting permissive arguments on cmdline
04-23 00:36:00.105 8499 8499 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0"
04-23 00:36:00.105 8499 8499 I recowvery: ------------
04-23 00:36:00.105 8499 8499 I recowvery: Updating boot image hash
04-23 00:36:00.444 8499 8499 I recowvery: Writing modified boot image to block device '/dev/block/bootdevice/by-name/recovery'...
04-23 00:36:00.614 8499 8499 I recowvery: Done!
04-23 00:36:00.614 8499 8499 I recowvery: ------------
04-23 00:36:00.614 8499 8499 I recowvery: Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/recovery successfully!
04-23 00:36:00.614 8499 8499 I recowvery: You may use 'reboot recovery' now to enter a permissive system.
04-23 00:36:00.614 8499 8499 I recowvery: ***********************************************
04-23 00:36:00.614 8499 8499 I recowvery: * give jcadduono a hug, will ya? *
04-23 00:36:00.614 8499 8499 I recowvery: ***********************************************
^C
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell reboot recovery
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb shell
elsa:/ $ getenforce
getenforce
Permissive
elsa:/ $ cd /data/local/tmp
cd /data/local/tmp
elsa:/data/local/tmp $ ./dirtycow /system/bin/run-as recowvery-run-as
./dirtycow /system/bin/run-as recowvery-run-as
warning: new file size (10192) and file old size (14360) differ
size 14360
[*] mmap 0x7f643b9000
[*] exploit (patch)
[*] currently 0x7f643b9000=10102464c457f
[*] madvise = 0x7f643b9000 14360
[*] madvise = 0 1048576
[*] /proc/self/mem -2122317824 1048576
[*] exploited 0x7f643b9000=10102464c457f
elsa:/data/local/tmp $ run-as exec ./recowvery-applypatch boot
run-as exec ./recowvery-applypatch boot
Welcome to recowvery! (run-as)
------------
Current uid: 2000
Setting capabilities
Attempting to escalate to root
Current uid: 0
We have root access!
------------
Executing: './recowvery-applypatch' with 1 arguments
Welcome to recowvery! (applypatch)
------------
Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...
Loaded boot image!
------------
Saving old ramdisk to file
Writing to file '/data/local/ramdisk.gz'...
Wrote OK: 6558126 bytes
Decompressing ramdisk (gzip -d)
Checking '/data/local/ramdisk.cpio' for validity (size >= 4194304 bytes)
'/data/local/ramdisk.cpio': 16792832 bytes
File OK
Decompression of ramdisk successful
Deleting '/data/local/ramdisk.gz' (no longer needed)
------------
Opened cpio archive '/data/local/ramdisk.cpio' (16792832 bytes)
Wrote new file (308 bytes) to cpio archive,
Final size: 16793036 bytes
------------
Compressing cpio to ramdisk (gzip -9 -c)
Checking '/data/local/ramdisk.gz' for validity (size >= 2097152 bytes)
'/data/local/ramdisk.gz': 6539881 bytes
File OK
Compression of ramdisk successful
Deleting '/data/local/ramdisk.cpio' (no longer needed)
Loading new ramdisk into boot image
------------
cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] androidboot.hardware=elsa"
Setting permissive arguments on cmdline
cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] androidboot.hardware=elsa androidboot.selinux=permissive enforcing=0"
------------
Updating boot image hash
Writing modified boot image to block device '/dev/block/bootdevice/by-name/boot'...
Done!
------------
Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/boot successfully!
You may use 'reboot' now to enter a permissive system.
***********************************************
* give jcadduono a hug, will ya? *
***********************************************
elsa:/data/local/tmp $ run-as su
run-as su
Welcome to recowvery! (run-as)
------------
Current uid: 2000
Setting capabilities
Attempting to escalate to root
Current uid: 0
We have root access!
------------
Starting root shell
elsa:/data/local/tmp # dd if=/storage/emulated/0/Download/twrp.img of=/dev/block/bootdevice/by-name/recovery
ownload/twrp.img of=/dev/block/bootdevice/by-name/recovery <
50312+0 records in
50312+0 records out
25759744 bytes transferred in 2.940 secs (8761817 bytes/sec)
elsa:/data/local/tmp # reboot recovery
reboot recovery
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb devices
List of devices attached
LGH918XXXXXXXX recovery
C:\Users\XXXXXXFAMILY\Desktop\LG V20 TMo>adb sideload su.zip
Total xfer: 1.48x
C:\XXXXXXFAMILY\Desktop\LG V20 TMo>
Last of what my CMD buffer held. My Bad. I know better. Please Read followups Their is a point to this.
So you paid money for the exact same steps as you would do on your own? this guide is already posed with the EXACT steps you already needed.
Well I will say this. I have rooted many devices but things are getting a little more complicated these days. I pondered and procrastinated about rooting this device for a while after I bought it. I was a bit worried about bricking so I chose to leave it in their hands to do it months ago. It wasn't that much money and was painless and professional.
I've been meaning to bring this up for a while but didn't really see the right opportunity. They made the process so easy and boom it was done. Well worth the money!
Not sure why we need to post their process though. It's is the same posted elsewhere.
Great service. It was a great and interesting experience!
I tried the Exact steps...didn't work
I tried the exact recowvery steps and it wouldn't flash twrp. I tried it ten ways from Sunday and every time I got stuck when it was supposed to flash twrp nothing. Overridden by system recovery every time. So either the post listed is missing something or they did something not listed in my post but for $35 bucks and after me spending two weeks fighting with it. Trust me the $35 bucks was a lot easier and it is far from perfect but it works. They didn't wipe format the data partition either which is said to be the ONLY WAY in the XDA post as I lost nothing I had installed. Not even one email. Root checker verifies full root and I can install anything I want with full root. $35 bucks is much easier than bricking this thing. With the H91810J or higher you have one shot or its nothing but a pile of junk. $35 bucks was much easier trust me. Their professionalism was great as well and they stand behind their product. The recowvery isn't as easy on the higher versions of the H918. Especially 10J and higher. I realized my buffer for my cmd prompt wasn't set high enough either. Which bothers me as I obviously didn't get it all.
I've done this quite a few times and the one thing no one answered is this. With full root can I boot into twrp with ADB and do I backup without the system overwriting twrp? If so exactly how would I do it. Remember they did not Format Data. Nothing was lost at all. I don't want to do all this just to end up with a brick anyway when I try and make a backup? Then again I could ask them to do it and they probably would.
Their are plenty of bricks to attest to the fact the V 20 isn't that easy to root. It might be for some that had the first versions. For $35 bucks I was done fighting. Took them about 30 minutes done. Guarantee with it. Worth it to me I have a wife and kid. I have other things to do after two weeks of fighting with it.
The Point - OneClickRoot (Paying)
The point of my reply was this. If you don't want to take the chance and for a little more they offer full phone replacement. OneClickRoot is worth the money. By the times you spend hours installing full adb, device drivers, downloading tools, fixing any issues like wrong adb version, wrong drivers...etc then praying you don't make one mistake and brick your device. On top of that the time and frustration involved? Also, you can't install any updates, and you have to disable this in multiple places. Not just the setting that says enable disable updates. Like I said before I've done this numerous times (through other people's exploit's), the recowvery wasn't working as it was posted for me. I even went in as SU then Elevated SU then SuperSU. I got nowhere. I disabled FRP and did the OEM Unlock myself easily.
In My Opinion, OneClickRoot is worth the money if you don't want the hassle or waste the time. I am not a programmer, certainly not a master programmer, but I understand the exploits others find. Some people just blindly copy and paste. This might works sometimes, but other times it doesn't and you have to understand the exploit to fix the issue. I spent 5 years as an IT administrator for an entire network of one of Eli Lilly Pharmaceuticals subsidiaries. A multi-billion dollar drug company. I am not a genius but I do have some knowledge.
OneClickRoot was so simple and I learned how they did it. I'm sure more goes on behind the scenes through their program...etc. Also, if you have an issue an screw it up they fix it of if you pay another $20 they replace the phone completely and buy a new one.
How can you justify even attempting to root these things? I'm just saying if your comfortable with copy and paste and pray then go for it. If you don't understand the exploit of what it is doing then I would pay $35 plus another $20 for phone replacement and the full guarantee to OneClickRoot. Of course, this is my opinion. It depends on your knowledge and willingness to try and root your phone. So to answer a previous reply yes I did pat the $35 plus I chose to pay $20 for free phone replacement and a full guarantee to fix it for any reason. That's about an hours worth of pay to me. The answer is yes it is worth that much money just to not have to deal with it. I have a Wife and Kid. Why am I wasting weeks fixing this locked phone which shouldn't be locked? I learned a few lessons though. If possible I will never buy anything locked in any way ever again and I am done wasting my time doing something someone else can do for peanuts and I have peace of mind.
With the exception of the Nexus series and I haven't owned one in a while but the last pure android phone I owned was the easiest one to unlock like all of them should be. I do see what right these companies have to tell us we can't unlock our phones. We own them. Hopefully these "Right to Fix" laws get passed and people get behind them. If you don't know what that is find out and sign the petitions.
UPDATE: I Just did a FULL NANDROID of EVERYTHING. I hooked up a large USB drive and made it done. Also have all the original files. It really shouldn't be this difficult. We should have the "Right to Fix" and we should have control over something we own not locked by a manufacturer.
ATTENTION:
Code:
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards, the expulsion of some contestant at the Spanish version of Got Talent,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
THIS WILL WIPE ENTIRELY YOUR DEVICE. YOU WILL NEED TO CHANGE THE FILE SYSTEM OF /DATA TO EXT4 FROM F2FS IN TWRP BEFORE ANYTHING ELSE. AND, IT IS A MUST REQUIREMENT DOING A NANDROID OF YOUR CURRENT ROM WITH TWRP: TWRP Home >> Wipe >> Advanced Wipe >> tick data >> Repair or Change File System >> Change File System >> EXT4 >> Swipe to change.
UPDATE 22/07/2021: It has been discovered that some American surnia units (with model code XT1526 and XT1527, sold on Sprint and AT&T carriers) have different partition table than the European or Global versions (XT1521 and XT 1524). Sprint and AT&T surnia models are NOT COMPATIBLE with UBPorts, and trying to do this steps will cause a bootloop (easily fixable with a reflashing of LineageOS/stock ROM).
Hello. I'm a developer from Spain and I'm doing a porting work on my Moto E 2015 in Halium and Ubuntu Touch, and I'm looking for testers with surnia (CAUTION: ONLY surnia is allowed in this, NOT otus, sorry for this, I don't have otus) for testing this compilated version of Halium and Ubuntu Touch, because I'm having trouble with the port (rootfs not flashing on /data properly). I have some instructions to test this, and files to download and test on a real device.
-INSTRUCTIONS (only with Ubuntu Linux):
1-Download halium-boot (https://mega.nz/file/6TRRgAAa#YjtJ35nXxIMS_tVyaURRHuJfvjx3mxLFY1H6WWzD_Z4). Boot in Recovery Mode and flash with:
Code:
fastboot flash boot /path-to the image of halium-boot/halium-boot.img
2-Download system.img and halium-install.zip
https://mega.nz/file/GXBVAQyA#w68fYNKZ3He4Zg69QC9bkvQI8702ZAho4M4TVmKdfxg
https://github.com/JBBgameich/halium-install/archive/master.zip
Uncompress halium-install.zip and get into the folder via Terminal.
3-Download the latest rootfs from UBPorts:
https://ci.ubports.com/job/xenial-r.../out/ubports-touch.rootfs-xenial-armhf.tar.gz
4-Boot into TWRP recovery (or your recovery with BusyBox) and run this command (in the folder halium-install):
Code:
halium-install.sh -p ut -v path/to/rootfs.tar.gz path/to/system.img
Put a password that you can remember when prompted.
Wait, and it should flash all succesfully, if all goes well. I do not guarantee the success in this (my device has a problem with /data partition), so I need all the feedback possible in this (Terminal logs, for example, would be useful to me).
5-Reboot. Now, it should be the phone on Bootloader screen, but if you text in a terminal
Code:
ssh [email protected]
It should ask for a password and load the rootfs successfully.
After that, with this settings:
Code:
sudo mount -o remount,rw /
and
Code:
sudo -i # And enter your password
cat /var/lib/lxc/android/rootfs/ueventd*.rc|grep ^/dev|sed -e 's/^/dev///'|awk '{printf "ACTION=="add", KERNEL=="%s", OWNER="%s", GROUP="%s", MODE="%s"n",$1,$3,$4,$2}' | sed -e 's/r//' >/usr/lib/lxc-android-config/70-[codename].rules
and, finally, rebooting the phone, it should boot Ubuntu Touch. The lock password is the same than the password you made before in the install.
I need feedback to do this well. Any comments on this will be welcomed.
Logo of the project licensed by UBPorts by Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) License.
XDA:DevDB Information
Ubuntu Touch Porting: Motorola Moto E 2015 4G/LTE, ROM for the Moto E 2015
Contributors
impreza233, bartbart2003
Source Code: https://github.com/Halium/projectmanagement/issues/97
ROM OS Version: 7.x Nougat
ROM Kernel: Linux 3.10.x
ROM Firmware Required: Unlocked bootloader, latest TWRP or custom recovery with BusyBox installed
Version Information
Status: Alpha
Created 2018-09-29
Last Updated 2020-09-20
Great job!
Buen trabajo! Quizás lo testee más tarde, cuando esté seguro de que no necesitaré el celular para algo importante jajajaj.
~~
For English readers:
Great job! I may test it later, when I'm sure I won't be needing the phone for something important haha.
impreza233 said:
4-Boot into TWRP recovery (or your recovery with BusyBox) and run this command (in the folder halium-install):
Code:
halium-install-standalone.sh -p ut -v path/to/rootfs.tar.gz path/to/system.img
Click to expand...
Click to collapse
The file halium-install-standalone.sh is not existant. Tried using halium-install and /utils/standalone.sh, but both are giving me a "Permission denied" dialog. SU not found, using Squid's TWRP.
SonicoXD said:
The file halium-install-standalone.sh is not existant. Tried using halium-install and /utils/standalone.sh, but both are giving me a "Permission denied" dialog. SU not found, using Squid's TWRP.
Click to expand...
Click to collapse
Yes, it's a little fail on my install tutorial. The file is named halium-install.sh. utils/standalone.sh won't do nothing. I will fix this error in the tutorial. Thanks for the tip!!!
Otherwise, what version of Squid's TWRP do you use? I use the latest version from here: https://eu.dl.twrp.me/surnia/ and no problems on my side. I will investigate this too.
EDIT: fixed error on the install tutorial.
sh:halium-install.sh not found (twrp 3.2.3)
Android-fan117 said:
sh:halium-install.sh not found (twrp 3.2.3)
Click to expand...
Click to collapse
If you are inside the folder of halium-install.sh, when you have to type the command halium-install.sh, drag and drop the .sh file to the terminal, in this way:
path/to/halium-install.sh -p ut -v path/to/rootfs.tar.gz path/to/system.img
EDIT: fixed on the main tutorial.
ok... all flashed just fine,but ssh [email protected] gives Connection timed out (new network connection appears,when phone boots).I just can`t connect.
Android-fan117 said:
ok... all flashed just fine,but ssh [email protected] gives Connection timed out (new network connection appears,when phone boots).I just can`t connect.
Click to expand...
Click to collapse
Well, this is a good signal
What do you get if you do this command?:
Code:
ssh -vvvv [email protected]
I need to know that messages to debug this.
impreza233 said:
Well, this is a good signal
What do you get if you do this command?:
Code:
ssh -vvvv [email protected]
I need to know that messages to debug this.
Click to expand...
Click to collapse
I get this:
openSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "10.15.19.82" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 10.15.19.82 [10.15.19.82] port 22.
debug1: connect to address 10.15.19.82 port 22: Connection timed out
ssh: connect to host 10.15.19.82 port 22: Connection timed out
(But new network connection appears)
ALSO I saw some errors while installing:
I: Pushing rootfs and android image to /data via ADB
5528 KB/s (2147483648 bytes in 379.315s)
5243 KB/s (1895825408 bytes in 353.069s)
Installing udev rules
cannot stat './file/70-tenshi.rules': No such file or directory
cannot stat './file/70-tenshi.rules': No such file or directory
cannot stat './file/70-tenshi.rules': No such file or directory
Android-fan117 said:
I get this:
openSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "10.15.19.82" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 10.15.19.82 [10.15.19.82] port 22.
debug1: connect to address 10.15.19.82 port 22: Connection timed out
ssh: connect to host 10.15.19.82 port 22: Connection timed out
(But new network connection appears)
ALSO I saw some errors while installing:
I: Pushing rootfs and android image to /data via ADB
5528 KB/s (2147483648 bytes in 379.315s)
5243 KB/s (1895825408 bytes in 353.069s)
Installing udev rules
cannot stat './file/70-tenshi.rules': No such file or directory
cannot stat './file/70-tenshi.rules': No such file or directory
cannot stat './file/70-tenshi.rules': No such file or directory
Click to expand...
Click to collapse
Well, it means that the flashing of rootfs has been sucessful. Yipeee!!!! Well, the tenshi thing will be removed in future versions of the script. It was here only for debugging purposes.
For the ssh thing, I will provide a patch for that. Thanks again for your feedback!!!
impreza233 said:
Well, it means that the flashing of rootfs has been sucessful. Yipeee!!!! Well, the tenshi thing will be removed in future versions of the script. It was here only for debugging purposes.
For the ssh thing, I will provide a patch for that. Thanks again for your feedback!!!
Click to expand...
Click to collapse
Ok. Just let me know,when all be done. I'll test it again.
Android-fan117 said:
Ok. Just let me know,when all be done. I'll test it again.
Click to expand...
Click to collapse
Thanks for being the test case!
Android-fan117 said:
Ok. Just let me know,when all be done. I'll test it again.
Click to expand...
Click to collapse
Well, I have news. When you finish the halium-install process unpack and run the file attached to this message and remember to run the command to cancel previous connection with 10.15.19.82 in case of your ssh needs to. At that point it should be a connection to ssh.
impreza233 said:
Well, I have news. When you finish the halium-install process unpack and run the file attached to this message and remember to run the command to cancel previous connection with 10.15.19.82 in case of your ssh needs to. At that point it should be a connection to ssh.
Click to expand...
Click to collapse
get this(when run ssh_connection.sh):
* The device seems to be connected as enp0s20u7
RTNETLINK answers: File exists
RTNETLINK answers: File exists
PING 10.15.19.82 (10.15.19.82) 56(84) bytes of data.
From 192.168.2.89 icmp_seq=1 Destination Host Unreachable
From 192.168.2.89 icmp_seq=2 Destination Host Unreachable
From 192.168.2.89 icmp_seq=3 Destination Host Unreachable
--- 10.15.19.82 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2038ms
pipe 3
* Connecting using ssh
OpenSSH_7.2p2 Ubuntu-4ubuntu2.5, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 10.15.19.82 [10.15.19.82] port 22.
debug1: connect to address 10.15.19.82 port 22: No route to host
ssh: connect to host 10.15.19.82 port 22: No route to host
Android-fan117 said:
get this(when run ssh_connection.sh):
* The device seems to be connected as enp0s20u7
PING 10.15.19.82 (10.15.19.82) 56(84) bytes of data.
From 192.168.2.63 icmp_seq=1 Destination Host Unreachable
From 192.168.2.63 icmp_seq=2 Destination Host Unreachable
From 192.168.2.63 icmp_seq=3 Destination Host Unreachable
--- 10.15.19.82 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2052ms
pipe 3
* Connecting using ssh
OpenSSH_7.2p2 Ubuntu-4ubuntu2.5, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 10.15.19.82 [10.15.19.82] port 22.
debug1: connect to address 10.15.19.82 port 22: No route to host
ssh: connect to host 10.15.19.82 port 22: No route to host
Click to expand...
Click to collapse
Don't worry. I will continue tuning it for best results. My result is the same as you.
impreza233 said:
Don't worry. I will continue tuning it for best results. My result is the same as you.
Click to expand...
Click to collapse
Ok.I`ll be waiting for this.
Android-fan117 said:
Ok.I`ll be waiting for this.
Click to expand...
Click to collapse
I'm thinking about the fact that the system would not be properly booted when the phone is switched on. Could you do a dmesg -w when the phone is switched on and shows a network on your computer?
impreza233 said:
I'm thinking about the fact that the system would not be properly booted when the phone is switched on. Could you do a dmesg -w when the phone is switched on and shows a network on your computer?
Click to expand...
Click to collapse
I`ll do it right now
---------- Post added at 04:20 PM ---------- Previous post was at 04:04 PM ----------
impreza233 said:
I'm thinking about the fact that the system would not be properly booted when the phone is switched on. Could you do a dmesg -w when the phone is switched on and shows a network on your computer?
Click to expand...
Click to collapse
ok...I found this
[ 1373.515554] usb 3-7: New USB device found, idVendor=18d1, idProduct=d001
[ 1373.515560] usb 3-7: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1373.515564] usb 3-7: Product: Failed to boot
[ 1373.515568] usb 3-7: Manufacturer: Halium initrd
[ 1373.515571] usb 3-7: SerialNumber: halium-initrd telnet 192.168.2.15
Android-fan117 said:
I`ll do it right now
---------- Post added at 04:20 PM ---------- Previous post was at 04:04 PM ----------
ok...I found this
[ 1373.515554] usb 3-7: New USB device found, idVendor=18d1, idProduct=d001
[ 1373.515560] usb 3-7: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1373.515564] usb 3-7: Product: Failed to boot
[ 1373.515568] usb 3-7: Manufacturer: Halium initrd
[ 1373.515571] usb 3-7: SerialNumber: halium-initrd telnet 192.168.2.15
Click to expand...
Click to collapse
Just as I suspected. Halium fails to boot. I will continue investigating this. Thanks!!!
How to install:
Unlock bootloader:
Boot your device into the official OS.
Go to Settings > About phone, tap the "build number" several times to enable developer settings.
Go to Settings > System > Developer Settings, enable OEM unlocking and ADB debugging.
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC (there is no way to enter bootloader directly, only possible through adb).
Once your device has finished booting run fastboot flashing unlock and comfirm unlock on device (THIS WILL WIPE ALL DATA!).
Run fastboot reboot to reboot your device and now you should see an unlocked warning during boot screen.
Disable AVB:
Download vbmeta.img from the latest release page of your device.
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC to put your device in bootloader mode.
Once your device has finished booting run fastboot flash --disable-verification --disable-verity vbmeta vbmeta.img
Then run fastboot flash --disable-verification --disable-verity vbmeta_system vbmeta.img
Also run fastboot flash --disable-verification --disable-verity vbmeta_vendor vbmeta.img
Flash recovery image:
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC to put your device in bootloader mode.
Once your device has finished booting run fastboot erase recovery. For some reason, image may be not actually flashed, even if fastboot reported success (at least over the stock recovery image), so in order make sure that the custom image is always flashed it's better to always erase the partition before flashing. After the erasing run fastboot flash recovery recovery.img
Run fastboot reboot and after the screen goes dark press volume up until you see the TWRP logo. Also you can type fastboot reboot recovery to boot to recovery mode immediately.
Please note that booting in stock ROM will bring stock recovery back.
This recovery image is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare an image based on EEA binaries.
Source code https://github.com/Meetoul/twrp_device_Unihertz_Jelly2
Thanks!
This fantastic!
its work on EEA!
Meetoul said:
Source code https://github.com/Meetoul/twrp_device_Unihertz_Jelly2
Click to expand...
Click to collapse
I just received my Jelly 2. It was on 2020 and I went straight through your files. Your TWRP does not respond on my European Jelly 2. Meaning, the touch screen does not respond. But I connected an USB trackball and switched in between adb sideloads. So I finally got it working.
For some reason during reboot TWRP warns me that there is no OS installed. But LoS 18.1 (yours) booted fine. Also flashed opengapps 2707 nano.
After a reboot (phone is still restoring apps) there is a "serial console is enabled" message "performance is impacted, check bootloader". Any instructions on how to get rid of that?.
I cannot seem to mount system as R/W with GSI image from https://github.com/phhusson/treble_experimentations/releases from within TWRP. I guess that's a more general problem, though
Any ideas?
kkazakov13 said:
I cannot seem to mount system as R/W with GSI image from https://github.com/phhusson/treble_experimentations/releases from within TWRP. I guess that's a more general problem, though
Any ideas?
Click to expand...
Click to collapse
Dave you tried the latest release a suggested by Meetoul?
[ROM] [UNOFFICIAL] Lineage OS 17.1 | Unihertz Jelly 2
https://drive.google.com/drive/u/0/folders/1VSmj_-a1PYNzFWtUfbsDGWg4uIh-Tgkd This ROM is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare ROW...
forum.xda-developers.com
Release Fix gt1151qm touch in recovery · Meetoul/twrp_device_Unihertz_Jelly2_TEE
Recovery image based on new kernel image with patches for both gt1x and gt1151qm touch panel drivers.
github.com
Great Job!
I have Jelly2_JP.
I tried your recovery.img for Jelly2_TEE.
It can boot my Jelly2_JP, and it can enable adb shell, but it looped the splash screen.
But I execute following command in adb shell, twrp starts gui("Keep System Read only?" screen)
Jelly2_TEE:/ # mount -o ro /dev/block/mapper/system /
Touchscreen works fine.
Next, I tried to build twrp for Jelly2_JP using your device tree.
But it has same problem. (It looped the splash screen until I mount system partition.)
Do you have any advice?
Attachments
recovery_tee.log is pulled file from /tmp/recovery.log in your twrp for Jelly2_TEE. Line 1119 is after I mount system partition by adb shell.
recovery_jp.log is pulled file from /tmp/recovery.log in my twrp for Jelly2_JP. Line 1356 is after I mount system partition by adb shell.
My build instructions
$ cd ~/twrp
$ repo init -u https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git -b twrp-10.0
$ vi .repo/local_manifests/roomservice.xml
$ repo sync --force-sync
$ cd device/Unihertz
$ cp -r Jelly2_TEE Jelly2_JP
$ cd Jelly2_JP
$ mv omni_Jelly2_TEE.mk omni_Jelly2_JP.mk
$ grep -l Jelly2_TEE * | xargs sed -i 's/Jelly2_TEE/Jelly2_JP/g'
$ grep -l g55v71c2k_dfl_tee * | xargs sed -i 's/g55v71c2k_dfl_tee/g55v71c2k_dfl_jp_felica/g'
$ ./extract-files.sh ~/stock_jp/extracted
$ unpack_bootimg --boot_img ~/stock_jp/recovery.img --out ~/stock_jp/recovery
$ cp ~/stock_jp/recovery/kernel prebuilt/Image.gz
$ cp ~/stock_jp/recovery/dtb prebuilt/dtb/mt6771.dtb
$ cp ~/stock_jp/recovery/recovery_dtbo prebuilt/dtbo.img
$ cd ~/twrp
$ source build/envsetup.sh
$ lunch omni_Jelly2_JP-eng
$ mka recoveryimage
$ ls out/target/product/Jelly2_JP/recovery/root/vendor
bin etc
$ cp -r vendor/Unihertz/Jelly2_JP/proprietary/reovery/root/vendor out/target/product/Jelly2_JP/recovery/root
$ mka recoveryimage
file upload again.
Sorry, I can't upload Attach files.
I clicked "Attach files" button and choose file.
I clicked "Save" button, but file link did not inserted.
I uploaded recovery.log to github.
How to get vbmeta.img
Three knife said:
How to get vbmeta.img
Click to expand...
Click to collapse
Direct Link
Google Drive: Sign-in
Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).
drive.google.com
See Also
Jelly 2 firmware made available by Unihertz
A post to let people interested in small Android phones know that the firmware of the Jelly 2 has been made available by Unihertz. Would be great if a LineageOS version of this could be made...
forum.xda-developers.com
Or
[HOWTO] Flash a blank vbmeta
Hey guys, As some of you know samsung made had a bunch of different changes since the release of Android 10. It took me a week to figure it out but it was really simple. I had to do two things: Repatch the the magisk boot image with Preserve AVB...
forum.xda-developers.com
I found the crash point in Jelly2_JP.
The crash point is CHECK() on line 772 of twrp/hardware/interfaces/keymaster/4.0/support/Keymaster.cpp.
C++:
CHECK(error == ErrorCode::OK)
<< "Failed to get HMAC parameters from " << *keymaster << " error " << error;
CHECK() is defined on line 495 of twrp/system/core/base/include/android-base/logging.h
C++:
#define CHECK(x) \
LIKELY((x)) || ABORT_AFTER_LOG_FATAL_EXPR(false) || \
::android::base::LogMessage(__FILE__, __LINE__, ::android::base::DEFAULT, \
::android::base::FATAL, _LOG_TAG_INTERNAL, -1) \
.stream() \
<< "Check failed: " #x << " "
I thought /system/bin/recovery was crashing due to a bug.
But it is not a bug.
/system/bin/recovery is programmed to abort if CHECK() fails.
Next, I compared the results of CHECK().
1. using your recovery.img for Jelly2_TEE.
Code:
$ adb shell
Jelly2_TEE:/ # uname -a
Linux localhost 4.14.141+ #15 SMP PREEMPT Wed May 19 11:04:10 CST 2021 aarch64
Jelly2_TEE:/ # mount -o ro /dev/block/mapper/vendor /vendor
Jelly2_TEE:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_TEE:/ # umount /vendor
Jelly2_TEE:/ # md5sum /vendor/lib64/libkeymaster4.so
22ede18944c5f47daf04d699a72717b2 /vendor/lib64/libkeymaster4.so
Jelly2_TEE:/ # logcat -v brief -d -s /system/bin/recovery
E//system/bin/recovery( 324): Failed to get IAshmemDeviceService.
W//system/bin/recovery( 324): [libfs_mgr]Warning: unknown flag: resize
W//system/bin/recovery( 324): [libfs_mgr]Warning: unknown flag: resize
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition product on device /dev/block/dm-0
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition system on device /dev/block/dm-1
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition vendor on device /dev/block/dm-2
W//system/bin/recovery( 324): DM_DEV_STATUS failed for system_image: No such device or address
W//system/bin/recovery( 324): DM_DEV_STATUS failed for vendor_image: No such device or address
W//system/bin/recovery( 324): DM_DEV_STATUS failed for product_image: No such device or address
I//system/bin/recovery( 324): fscrypt_initialize_systemwide_keys
I//system/bin/recovery( 324): List of Keymaster HALs found:
I//system/bin/recovery( 324): Keymaster HAL #1: HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default
F//system/bin/recovery( 324): Keymaster.cpp:150] Check failed: error == ErrorCode::OK Failed to get HMAC parameters from HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default error SECURE_HW_COMMUNICATION_FAILED
2. using my recovery.img for Jelly2_JP.
This is built with Jelly2_JP's kernel and /vendor/*.
Code:
$ adb shell
Jelly2_JP:/ # uname -a
Linux localhost 4.14.141+ #5 SMP PREEMPT Wed May 19 12:15:37 CST 2021 aarch64
Jelly2_JP:/ # mount -o ro /dev/block/mapper/vendor /vendor
Jelly2_JP:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_JP:/ # umount /vendor
Jelly2_JP:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_JP:/ # logcat -v brief -d -s /system/bin/recovery
E//system/bin/recovery( 327): Failed to get IAshmemDeviceService.
W//system/bin/recovery( 327): [libfs_mgr]Warning: unknown flag: resize
W//system/bin/recovery( 327): [libfs_mgr]Warning: unknown flag: resize
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition product on device /dev/block/dm-0
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition system on device /dev/block/dm-1
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition vendor on device /dev/block/dm-2
W//system/bin/recovery( 327): DM_DEV_STATUS failed for system_image: No such device or address
W//system/bin/recovery( 327): DM_DEV_STATUS failed for vendor_image: No such device or address
W//system/bin/recovery( 327): DM_DEV_STATUS failed for product_image: No such device or address
I//system/bin/recovery( 327): fscrypt_initialize_systemwide_keys
I//system/bin/recovery( 327): List of Keymaster HALs found:
I//system/bin/recovery( 327): Keymaster HAL #1: HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default
F//system/bin/recovery( 327): Keymaster.cpp:150] Check failed: error == ErrorCode::OK Failed to get HMAC parameters from HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default error SECURE_HW_COMMUNICATION_FAILED
They are same Error code SECURE_HW_COMMUNICATION_FAILED.
Unfortunately, my recovery.img wasn't improved from your recovery.img when used with Jelly2_JP.
I'm sorry for the continuous posting.
I solved the decryption by modifying omni_Jelly2_JP.mk as follows.
Code:
PRODUCT_NAME := omni_Jelly2_JP
PRODUCT_DEVICE := Jelly2_JP
PRODUCT_MODEL := Jelly2_JP
PRODUCT_BOARD := g55v71c2k_dfl_jp_felica
BUILD_FINGERPRINT := "Unihertz/Jelly2_JP/Jelly2_JP:10/QP1A.190711.020/root.20210422.092852:user/release-keys"
PRODUCT_BUILD_PROP_OVERRIDES += \
TARGET_DEVICE=Jelly2_JP \
PRODUCT_NAME=Jelly2_JP \
PRIVATE_BUILD_DESC="Jelly2-user 10 QP1A.190711.020 root.20210422.092852 release-keys"
My mistake was that I only replaced "Jelly2_TEE" with "Jelly2_JP".
I had to replace "Jelly2" with "Jelly2_JP".
Anyway, now I can display the decryption screen.
Next, I tried HOW-TO-PATCH.md.
However, the touch screen does not respond on the patched kernel.
Code:
$ head -n 1 symbl_tee.txt
ffffff81dd680800 T do_undefinstr
$ grep get_boot_mode symbl_tee.txt
ffffff81ddda5b30 T get_boot_mode
$ zcat twrp/device/Unihertz/Jelly2_TEE/prebuilt/Image.gz > Image
$ aarch64-linux-android-objdump -D -b binary -m aarch64 --adjust-vma=0xffffff81dd680000 --start-address=0xffffff81ddda5b30 Image| head
ffffff81ddda5b30: d0009cc8 adrp x8, 0xffffff81df13f000
ffffff81ddda5b34: b947ad09 ldr w9, [x8,#1964]
ffffff81ddda5b38: 7100093f cmp w9, #0x2
I think you are using a different technique to enable the touch screen, because "cmp w9, #0x2" is not patched to "cmp w9, #0x0".
Please teach me your technique after you are not busy with work.
谢谢你,我用的是中国的没有Google Play的版本,按照你的步骤成功了,不过在安装完recovery.img之后,内部存储有可能无法写入,需要在recovery里删除data分区,然后就可以了
Thanks for this!
I flashed this TWRP, then installed AOSP 11, v313 of this GSI: https://github.com/phhusson/treble_experimentations/releases/tag/v313
Things seem good, except:
the battery seems to drain a little quickly
no IR blaster (ZaZa remote does not recognize it)
TWRP cannot decrypt the phone's contents, so I cannot flash gapps.
Is TWRP not able to decrypt because I'm using Android 11 and the TWRP was built for 10?
@karoooo
Sorry for not responding to you, for some reason email notifications from XDA were stopped. Please tell me if you still need patched kernel, I will try to patch it explain you the technique.
zxczxc4 said:
Thanks for this!
I flashed this TWRP, then installed AOSP 11, v313 of this GSI: https://github.com/phhusson/treble_experimentations/releases/tag/v313
Things seem good, except:
the battery seems to drain a little quickly
no IR blaster (ZaZa remote does not recognize it)
TWRP cannot decrypt the phone's contents, so I cannot flash gapps.
Is TWRP not able to decrypt because I'm using Android 11 and the TWRP was built for 10?
Click to expand...
Click to collapse
Actually, data decryption on MTK SoCs is very painful thing. I'm still waiting for stable release of Android 11 from Unihertz, but they are in no hurry...
I know that beta 11 available. Unfortunately, I was not able to update using the official way. The bootloader was locked and the moment of updating, but probably the reason is that it was unlocked before (it possible to relock bootloader using SP Flash Tool). But I manager to fetch zip update package and install it via TWRP After that I even managed to make package for SP Flash Tool based on this package, so I can to flash pure FW without updating and have locked bootloader!
UPD. I see that Unihertz have published Android 11 SW package for SP Flash Tool on their Google Drive! Soon I will try to make recovery based on this package.
@Meetoul
Thank you for your response.
Yes, yes, yes!
I want to know your technique.
Best Regards.
HI.
Summary: FRONT CAMERA not working after Bootloader Unlock
I am using Jelly2_JP (on latest Android 10) and I was wondering,
has anyone has experinced the Front Camera not working after Bootloader Unlock, and possibly the three " --disable-verification --disable-verity" commands?
The stock camera app won't recognize the front camera (not front/back switch button where there should be one), and other apps cant use the front camera either.
I can confirm that the front camera worked before unlocking the bootloader.
Reflashing stock image using SP Flash Tool and relocking Bootlader did not fix the issue.
Is anyone else experiencing the same issue?
karoooo said:
@Meetoul
Thank you for your response.
Yes, yes, yes!
I want to know your technique.
Best Regards.
Click to expand...
Click to collapse
Since Unihertz has released Android 11, I think that there is no sense to work on patching the old kernel.
Btw, now I'm working on TWRP based on Android 11 binaries from the latest FW, but no luck so far, it seems that kernel doesn't even start to boot...
@Meetoul
I wanted to learn your technique so that I could work on my own when Android 11 was released.
If Android 11 is formidable, prioritize working with Android 11.
Unfortunately, Android 11 for Jelly2_JP has not been released yet.
@kendzhi
I unlocked the bootloader with Jelly2_JP, but the front camera is still working.
@karoooo
Thank you for the reply!
May I ask, was your Jelly2_JP shipped before the latest Andorid 10 update (2021051912_g55v71c2k_dfl_jp_felica), meaning did your phone come with the previous Firmware (2020101915_g55v71c2k_dfl_jp_felica)?
I have two Jelly2_JP from Japan which came preshipped with the latest andorid Andorid 10 update (there was no need for OTA update). And in both phones, upon executing "fastboot flashing unlock" (without disableling AVB & without Rooting), the the front camera stopped working (not recognized by the system).
I even went into the Debug/Diagnostic? mode that was in Chinese (Booting by Vol down + Connecting to PC via USB), and peformed a hardware test for the Front Camera and the test froze the phone.
So I'm suspecting that Jelly2_JP that was shipped to Japan with the latest Firmware has some issues with Bootloader Unlocking breaking the Front Cam...