Database Info

[GUIDE] Huawei Ascend G6 LTE [G6-L11] (Root & Xposed Framework)

[GUIDE] Huawei Ascend G6 LTE [G6-L11] (Root & Xposed Framework)
ROOTING
Phone was rooted using ROOT Genius
- Download from shuame.com/en/root/
- Install and turn on USB debugging on your phone
- Connect the phone and wait for a little bit, it will work
- After rooting your phone will reboot
*Users who rooted with TOWELROOT*
When rooting with Towelroot there is a problem accesing partitions in root mode.
So now please use Root Genius method!
Uninstalling Towelroot
- Uninstall Towelroot (tr.apk) like normal app
- Go to SuperSU, settings then press permanent unroot
- Check your root status, then reboot the phone
- Now you can root with ROOT Genius method
You can check root with Root Checker or similar app.
Congratulations, your phone is rooted now
Xposed Framework
Xposed Framework will work only if you rooted the phone!
- Download Xposed Framework dl.xposed.info/latest.apk and install it
***Xposed will not work on Huawei devices because of conflict between Xposed and Huawei Theme engeine***
To make it work there are 2 options:
1 - Launch Xposed Installer, go to Settings and in the bottom tick "Disabled resource hooks"
Note: many modules will NOT work with this option checked
2 - This option involves editing build.prop file so be VERY CAREFUL! Also please BACKUP your build.prop file before editing!!!
You need to DISABLE Huawei Theme engeine then you DONT NEED "Disabled resource hook" and many modules will work.
In build.prop file you need to change this line: ro.config.hwtheme=2 to this line: ro.config.hwtheme=0
*If you dont have this line you have to add it
To edit build.prop file download app "BuildProp Editor" from Google play run it, allow root privileges for app
and tick search (down left corner)
Write "ro.config.hwtheme" tick the found line and change PROPERTY VALUE to 0 and tick save.
BE VERY CAREFUL TO NOT CHANGE ANY OTHER LINE THAN THIS!
After applying option 1 or 2 you can install Xposed Framework. (I recommend option 2 beacuse more modules will work)
Open the Xposed Installer, go to Framework (press OK) (make shure that INSTALLATION MODE is Classical (write to /system directly)
then tick Install/Update button and finnaly reboot the phone.
You now have fully working Xposed
Some nice Xposed modules:
- GravityBoxJB (Jelly Bean)
- BootManager
- Tinted Status Bar (works better with Google Now Launcher)
*Also im finding method to unlock bootloader for G6 LTE, when i suceed i will update this guide.
DISCLAMER:
I am not responsible for any damage to your phone, do this on your own risk!!!

need urgent helpp
man i broke my phone, Its soft brick right now. can u please me copy if system.img partition... my phone wont work till then:crying:

Please explain what you did to make it softbricked? Did you made build.prop backup?
Sent from my HUAWEI G6-L11 using XDA Free mobile app

wow bro
very good :victory:

Doesn't work
I've tried so many thing to root this phone but nothing works.
Towelroot just stay open for ages when i press make it rain, it stays freezed until i close it.
Still looking for a way to root this phone.

i have rooted my g6, but i have a problem.. when i use root-explorer end it get root access , bhot sdcards (internal and external) disappear.. how can i fix this?
Sent from my HUAWEI G6-L11 using XDA Free mobile app

Install File Explorer from NextApp and File Explorer root addon from Google play, and tell me if works.
Sent from my HUAWEI G6-L11 using XDA Free mobile app

If you having problems with Towelroot try RootGenius, Vroot or Kingo to root it.
Sent from my HUAWEI G6-L11 using XDA Free mobile app

the device is rooted, i can put and edit files in the /system folder and other root access folders, thevonly problem is the access on external cards... it appears unmounted in superuser mode..
if i try virtual terminal:
ls /storage/sdcard0 (or sdcard1) it show the external memory files
if i try :
su
ls /stoage/sdcard0 the folder is empty...
...i have also tryed to mount dev/block/mmcblk0p25 (sdcard0) it result busy
Sent from my HUAWEI G6-L11 using XDA Free mobile app

amonpaike said:
the device is rooted, i can put and edit files in the /system folder and other root access folders, thevonly problem is the access on external cards... it appears unmounted in superuser mode..
if i try virtual terminal:
ls /storage/sdcard0 (or sdcard1) it show the external memory files
if i try :
su
ls /stoage/sdcard0 the folder is empty...
...i have also tryed to mount dev/block/mmcblk0p25 (sdcard0) it result busy
Sent from my HUAWEI G6-L11 using XDA Free mobile app
Click to expand...
Click to collapse
I have tryed that now, I can confirm that when in root mode its "empty"
But tell me what are you trying to do? With File Explorer from NextApp and File Explorer root addon i can acces storage and / partiton with root privileges and see all the content. I will try to find out why is it like that.

whit fx explorer and root addon when i try to access to -> system(root)->storage/sdcard0/ it is empty...
i have rooted the g6-l11 whit towelroot.
this is the device block composition... in case any developer can make clockworkmod or other recovery for the g6-l11
[email protected]:/ # cat /proc/partitions
major minor #blocks name
179 0 7634944 mmcblk0
179 1 512 mmcblk0p1
179 2 32 mmcblk0p2
179 3 32 mmcblk0p3
179 4 500 mmcblk0p4
179 5 500 mmcblk0p5
179 6 5592 mmcblk0p6
179 7 1024 mmcblk0p7
179 8 65536 mmcblk0p8
179 9 4096 mmcblk0p9
179 10 4096 mmcblk0p10
179 11 98304 mmcblk0p11
179 12 4096 mmcblk0p12
179 13 1 mmcblk0p13
179 14 8 mmcblk0p14
179 15 32768 mmcblk0p15
179 16 65536 mmcblk0p16
179 17 8192 mmcblk0p17
179 18 12288 mmcblk0p18
179 19 16384 mmcblk0p19
179 20 262144 mmcblk0p20
179 21 196608 mmcblk0p21
179 22 4096 mmcblk0p22
179 23 1048576 mmcblk0p23
179 24 2097152 mmcblk0p24
179 25 3694575 mmcblk0p25
179 32 512 mmcblk0rpmb
(this is my 32gb external sdcard..)
179 64 30703616 mmcblk1
179 65 25626483 mmcblk1p1
179 66 4882874 mmcblk1p2
179 67 193536 mmcblk1p3
---------------------------------------------------------
ls - al /dev/block/platform/msm_sdcc.1/by-name/
lrwxrwxrwx root root 1970-05-06 22:58 DDR -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-05-06 22:58 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-05-06 22:58 bkbootup -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-05-06 22:58 boot -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-05-06 22:58 cache -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-05-06 22:58 cust -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-05-06 22:58 fsc -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-05-06 22:58 fsg -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-05-06 22:58 grow -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-05-06 22:58 log -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-05-06 22:58 misc -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-05-06 22:58 modem -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-05-06 22:58 modemst1 -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-05-06 22:58 modemst2 -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-05-06 22:58 oeminfo -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-05-06 22:58 pad -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-05-06 22:58 persist -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-05-06 22:58 recovery -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-05-06 22:58 rpm -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-05-06 22:58 sbl1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-05-06 22:58 sdi -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-05-06 22:58 ssd -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-05-06 22:58 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-05-06 22:58 tz -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-05-06 22:58 userdata -> /dev/block/mmcblk0p24
Sent from my HUAWEI G6-L11 using XDA Free mobile app

Maybe it's SuperSU binary, some users reported problems. If you find out the problem please report it here also

dont think it's a superSu binary problem...
this is
fstab.qcom
file in the root folder, there are no sdcards block mounted....
# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
#TODO: Add 'check' as fs_mgr_flags with data partition.
# Currently we dont have e2fsck compiled. So fs check would failed.
#
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,barrier=1 wait
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 nosuid,nodev,barrier=1,noauto_da_alloc wait,check,encryptable=footer,continue
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 nosuid,nodev,barrier=1 wait,check,continue
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 nosuid,nodev,barrier=1 wait,check,continue
/dev/block/platform/msm_sdcc.1/by-name/log /log ext4 nosuid,nodev,barrier=1 wait,check,continue
-----------------------------------------------------
the internal and external sdcard are mounted for non root mode by
/etc/internal_sd.fstab
#
/devices/msm_sdcc.2/mmc_host /storage/sdcard1 vfat nosuid,nodev wait,voldmanaged=external_sd:auto
/devices/msm_sdcc.1/mmc_host /storage/sdcard0 vfat nosuid,nodev wait,voldmanaged=internal_sd:25
/devices/platform/msm_hsusb_host /storage/usb vfat nosuid,nodev wait,voldmanaged=usbotg:auto
Sent from my HUAWEI G6-L11 using XDA Free mobile app
---------- Post added at 07:52 PM ---------- Previous post was at 07:22 PM ----------
the my big problem is... for example
i cant bakup system files to sdcard for same tests or cant copy a bootanimation.zip from sdcard to the root /cust folder for a personalized bootanimation etc etc..
Sent from my HUAWEI G6-L11 using XDA Free mobile app

Joseph Katana said:
If you having problems with Towelroot try RootGenius, Vroot or Kingo to root it.
Sent from my HUAWEI G6-L11 using XDA Free mobile app
Click to expand...
Click to collapse
Well, i just tried, Root Genius: stuck at connecting, Vroot detects my phone but fails at the end, Kingo doesn't detect my g6-l11.
Tried with 2 cables and 2 computer ( just in case )
So i guess, i'll just give up and wait for a better way to root it later.

amonpaike said:
i have rooted my g6, but i have a problem.. when i use root-explorer end it get root access , bhot sdcards (internal and external) disappear.. how can i fix this?
Sent from my HUAWEI G6-L11 using XDA Free mobile app
Click to expand...
Click to collapse
that problem is know. you can read how to solve it here: http://forum.xda-developers.com/android/general/huawei-ascend-g6-root-method-t2805938

washichi said:
that problem is know. you can read how to solve it here: http://forum.xda-developers.com/android/general/huawei-ascend-g6-root-method-t2805938
Click to expand...
Click to collapse
ok! i have used rootgenius metod and now sdcards are accessible in root mode.. tankyou!
Sent from my HUAWEI G6-L11 using XDA Free mobile app

Thank you for this info I will update the guide and post a link to this thread.

need urgent helpp
Joseph Katana said:
Please explain what you did to make it softbricked? Did you made build.prop backup?
Sent from my HUAWEI G6-L11 using XDA Free mobile app
Click to expand...
Click to collapse
Yes i have a backup but phone isnt starting and bootloader is locked and i dont know how to unlock it and flash the built.prop back. this is my first huawei phone. I downloaded whole firmware but dont know how to flash it

feetsonfire said:
Yes i have a backup but phone isnt starting and bootloader is locked and i dont know how to unlock it and flash the built.prop back. this is my first huawei phone. I downloaded whole firmware but dont know how to flash it
Click to expand...
Click to collapse
extract the downloaded official firmware to your sd, so you will get: SD:/dload/UPDATE.APP
then reboot your phone, and it will install

trouble with bootloader lock and firmware upgrades
Hi everyone!
I'm fairly new (to the board, too) and this thread has been resting for a while, but still I want to share my experience of rooting the Huawei Ascend P7 mini (or G6-L11) since there are tons of posts and threads out there on how to do it and they all did not work for me.
First of all, thanks for your guide, Joseph Katana! Helped me out partially.
I spent days on searching and trying and finally (just 2 hours ago!) I did it! So here are my Do's and Dont's:
After unpacking and booting for the first time, of course I went straight to updating from P7miniV100R001dontaskmeforgottomakescreenshot to P7miniV100R001C??B370 (also forgot to do a screenshot). First mistake, as the new firmware updates to Android 4.4.2 and I was not able to root my phone with whatever tool there is.
Took me a few hours of researching why I could not flash my phone, since its bootloader was locked to begin with. Turn to [email protected] for requesting an unlock code and make sure to include your phone specs such as Model-no, S/N, IMEI and PID. Alternatively, there are tons of 3rd-party softwares and websites which offer the same service (tho they'll want your PayPal specs, too : ).
So, I was basically all set, my phone was quickly unlocked via Fastboot. After some hours more of devouring tutorials and stuff I also had the appropriate USB-Drivers and HiSuite v2.3.42 installed (tho now I'm not sure, if that was even needed). Still RootGenius v1.8.7 kept complaining what a tough cookie I had, so I told it to shut it and turned to Framaroot, Towelroot, RootGenius v2.20(Chinese version) and basically went through each and every other tool. All failed.
And here's where it's back to Point 1. Just out of frustration I downgraded the firmware B370 back to B127. And surprisingly my phone was game since it rebooted without complaint and I was back to where I started. Of course I ran RootGenius again, but it wouldn't connect so I tried the Chinese versions. I know pretty risky to push buttons without knowing what they're doing, but the program recognized my phone correctly and I was able to root it successfully! Just to be sure, I checked with RootGenius v1.8.7. It connected immediately and also confirmed the root.
And to be absolutely sure I installed Xposed Framedwork, checked "Disable Resource Hooks" ("Ressourcen-APIs deaktivieren" in german) and voila, I was free to pick any module I so desired.
My phone is now running Android 4.3 Emotion UI 2.0 Lite G6-L11V100R001C00B127. Actually I had been expecting SuperSU but now it's Kinguser-Root, but I'm fine with that.
I have not yet tried out much with installing modules and stuff since it's all quite fresh.
Just wanted to let you know that it is doable : )

[Q] VERIZON Samsung Tab 2 10.1 sch-i915 Hardbrick help

I have an incident that I have accrued myself so no need for those comments. The history of the hardbrick i created. If any information regarding anything feel free.
First of all i rooted my device using towelroot. It works for alot of devices and runs as 3rd party apk installer. Created by the infamous Geohotz. Godbless. https://towelroot.com/ for those of you who do not know.
2nd i was looking and trying to swap my extSdCard with my internal /sdcard. I edited the vold.fstab and the vold.conf files thinking hey i can use the external as full internal to have the devive install apps on properly w/o manually moving and use the internal remaining sdcard memory as virtual Ram. I have not completed this process yet. Ill explain.
After mounting the internal as external and vice. I ended up being stuck in a boot loop. NOTE: i did not have custom recovery(was one of the oopsies) so was stuck with basic android recovery. Reset device did not fix. Was going to Odin flash the stock rom and/or CWM Recovery, but there is absolutely NO STOCK or LEAKED rom anywhere for the verizon model. I also pulled those 2 files off of my other tab 2 10.1 NON VERIZON *vold.fstab and vold.conf and places it into zip file and signed it using signapk.
which now i feel like an idiot finding this link "http://forum.xda-developers.com/galaxy-nexus/themes-apps/tutorial-making-flashable-zips-edify-t1611615"
NOTE: I used a different post somewhere that didnt explain to have the right binary so it gave me a signature mismatch error when trying to flash. Use above post to make sure you use propery binary.
Luckily i did some research and knowledge of what i actually did to fix it and plus my addiction to play around and learn things. I manually duplicated the vold.fstab/vold.conf files from my one device to the bricked one
Boot up device in Android recovery.
installed and loaded up ADB.exe from command line.
Code:
adb shell
su
echo *yourlinehere*> /system/etc/vold.fstab
echo *yourlinehere*>> /sytem/etc/vold.fstab
the first > rewrites the file from start black document and inputs the first line
the 2nd >> note the double >> appends to the next line.
i rebooted and VOILA FIXED!!! but wait....theres more ><
So knowing the troubles i had to fix my lil play around mistake. I wanted to get custom recovery partition installed. Used Rom Manager to install CWM Recovery. I picked the wrong rom for my device and flashed it. The one i used was for the international Tab 2 10.1 the gt-5100. It said it successfully flashed so i figured wth it couldnt hurt right? WRONG i clicked reboot to recovery to check it. and here is where I lie. HARD BRICK. No boot up at all. Plug in charger to outlet or PC i dont even get the charging device battery image. So now here we go more research fun!!!
I looked up some information on how to fix a hard bricked device. some posts say using a jig to bypass it and get into download mode. Ok this is a 30 pin connector not a 4 pin like most the android devices. I could do some research on this and probably rig a jig to convert and match the pin layouts but meh my problem still lies within not having stock firmware for this model. I also learn of Jtag methods. Oh all well and handy but buying the Riff Box and all this gets your device bootable, but hey guess what? it would allow me to boot into that download mode or android recovery. Which still bottom line fails as i dont have a stock rom to flash. OH the dilemna.
What ive come up with. I plugged in my device into my pc. Well what do you know i can actually get recognition. but this is where i am stuck at.
I figured out that the device is recognized and i needed drivers. I found this handy site
https://developer.qualcomm.com/forum/qdevnet-forums/general-discussion/9428 Which also explains that i messed up my boot partition.
I download and installed the QPST program and installed the drivers on win7. I had to reboot and use advanced options to disable the unsigned drivers check. OK sweet connection is up!
I tried using ADB shell but device isnt connected that way.
In the QPST program it shows my device on com10 in download mode. I tried to retrieve some data or partition information from the device but it says i cannot when device is in download mode. So no pulling files and fixing and reflashing them. Back to the same problem before NO STOCK ROM.
So here are the questions I have regarding my situation. The android device im playing with has the base partitions. As an example of this http://www.all-things-android.com/content/review-android-partition-layout
I do not have my partition layout for my device as its bricked. I dont even know if it needs to be repaired yet. If any of you with a verizon tab 2 10.1 sch-i915 has a rooted device and can get me this table or a pit file for this device it would be appreciated
2nd firmware vs firmware. As previously stated I do not have firmware for this verizon tab. HOWEVER i did find firmware for the Sprint version of this exact tablet. My question is, could these stock firmwares be exact duplicates with the exclusion of the boot up screen bs and the /misc partition containing the imei phone stats and carrier information?
3rd Flashing just certain partitions of this firmware. Is it possible if the above is feasible considering i know my /boot partition is messed up and my /recovery partition is messed up to only flash those 2 partitions with the one from sprint. The stock kernal should be the same in both devices for the /boot and the /recovery partition should hold the same android recovery should it not?
4th. If anyone has a rooted sch-i915 device would you be willing to make dump of the partitions using this guide http://forum.xda-developers.com/showthread.php?t=2450045. That would be appreciated.

Let Me Work On That
You Are Possibly In Luck. I Know Somone That Has That Tablet. Problem Is It Is My Mom's And Well She Rather Beat Me With It Then Let Me Touch It. I'll See What I Can Do And Will Post Back.. Wish Me Luck i Will Need It :fingers-crossed:

][NT3L][G3NC][ said:
You Are Possibly In Luck. I Know Somone That Has That Tablet. Problem Is It Is My Mom's And Well She Rather Beat Me With It Then Let Me Touch It. I'll See What I Can Do And Will Post Back.. Wish Me Luck i Will Need It :fingers-crossed:
Click to expand...
Click to collapse
Appreciated good luck.
If not possible and i get it fixed ill post how i did it and such. and also post up a JB 4.12 stock/updated leaked rom of this device which apparently seems to be missing in the world for some damn reason.

I Got A Question
Sorry I Been Busy, & Google Has Not Been Kind 2 Me. I Did Find The California Lottery Vulnerability Report Generated By Nessus. But If Someone Could Please Point Me In The Right Direction Or Just Break It Down For Me As Quickly And Light As You Could, Short, Straight Forward, The LIghtest Kliff Notes Ever Would Be Appreciated.
Verizion SCH-I915 [ 4.1.2 ]
I Only Had A Few Minutes With The Tablet But I Already Rooted It, Installed BusyBox, I Barely Started To Get Into The FIle System.... I'm Using Kali LInux
1. What Partitions/Blocks Do I Need To Obtain To Create An Odin Flashable Recovery Image
2. Is There A Droid Binary, Or Script I Can Use To Dump The Rom While Creating The Above For Odin?
Just Found Something I Downloaded At Some Point Called: ROMGEN Any Idea On That Binary??? And phantomphr33k Any Request.
Forgive Me I Work Nights, Two Kids, So I'm Up Days + On Call During The Day.
lrwxrwxrwx root root 1970-10-27 01:41 aboot -> /dev/block/mmcblk0p5 ???
lrwxrwxrwx root root 1970-10-27 01:41 backup -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-10-27 01:41 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-10-27 01:41 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-10-27 01:41 efs -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-10-27 01:41 fota -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-10-27 01:41 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-10-27 01:41 grow -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-10-27 01:41 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-10-27 01:41 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-10-27 01:41 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-10-27 01:41 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-10-27 01:41 param -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-10-27 01:41 persist -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-10-27 01:41 recovery -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-10-27 01:41 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-10-27 01:41 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-10-27 01:41 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-10-27 01:41 sbl3 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-10-27 01:41 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-10-27 01:41 system -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-10-27 01:41 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-10-27 01:41 userdata -> /dev/block/mmcblk0p15

Should Post The Rest Tomorrow
I Have Attached Some Text Files With The Output Of A Couple Commands To Get The block/partition layout.
I Have Dumped The system.img which is 1.6gb In SIze
Tomorrow I Should Have : Modem "firmware" , Boot , Recovery
QUESTIONS:
What Is aboot?
Which Is The Kernel?
What Is Modemst*?
And More Important, Which Ones Do I Need To Pull For A Complete ROM Dump?
lrwxrwxrwx 1 0 0 20 Nov 2 1970 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 0 0 21 Nov 2 1970 backup -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 0 0 20 Nov 2 1970 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 0 0 21 Nov 2 1970 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 0 0 21 Nov 2 1970 efs -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 0 0 21 Nov 2 1970 fota -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 0 0 21 Nov 2 1970 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 0 0 21 Nov 2 1970 grow -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 0 0 20 Nov 2 1970 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 0 0 21 Nov 2 1970 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 0 0 21 Nov 2 1970 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 0 0 20 Nov 2 1970 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 0 0 21 Nov 2 1970 param -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 0 0 21 Nov 2 1970 persist -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 0 0 21 Nov 2 1970 recovery -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 0 0 20 Nov 2 1970 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 0 0 20 Nov 2 1970 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 0 0 20 Nov 2 1970 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 0 0 20 Nov 2 1970 sbl3 -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 0 0 21 Nov 2 1970 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 0 0 21 Nov 2 1970 system -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 0 0 20 Nov 2 1970 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 0 0 21 Nov 2 1970 userdata -> /dev/block/mmcblk0p15

Sorry its the Holidays so its understandable. Cant really twist your arm to rush it Im by far not an expert on this i do research myself. Ill do my best and if anyone else can shed light please do.
][NT3L][G3NC][ said:
QUESTIONS:
[*]What Is aboot?
[*]Which Is The Kernel?
[*]What Is Modemst*?
[*]And More Important, Which Ones Do I Need To Pull For A Complete ROM Dump?
Click to expand...
Click to collapse
1) Aboot partition is basically your "Odin Downloader" protocol. while booting pressing power + Vol Dwn will put your device in this mode.
2) The kernel/ramdisk is stored in the /boot partition
Note Primary Bootloader and SB* are secondary bootloaders 1,2,3 those are loaded up as well to set certain params + setup/initialize hardware as far as im understanding. and loads up the kernel/ramdisk.
3)Ill quote from another thread: http://forum.xda-developers.com/showthread.php?t=2582811
][NT3L][G3NC][ said:
- backup and restore important device partitions - EFS (Samsung), TA (Sony), MODEM (Exynos devices), MODEMST1 & MODEMST2 (Qualcomm devices),
- root is required
- easy to use
- many localizations
- see paths to important partitions of your device using Menu -> Device Partitions
Click to expand...
Click to collapse
As far as im understanding these partitions hold carrier information/imei and all other sorts of GRPS information in regards to connecting your devices radio to Service. Sorta like your network card drivers and Mac Address
I looked at another persons rom dump and I seen only these partitions in the archive. Sadly I dont remember where i found this but is from a guy who JTAGS devices. So im pretty sure its legit. Its from the Sprints version of this device.
/system.img.ext4(going to be the biggest dump)
/recovery.img
/cache.img.ext4
/boot.img
[QUOTE=']
1. What Partitions/Blocks Do I Need To Obtain To Create An Odin Flashable Recovery Image
2. Is There A Droid Binary, Or Script I Can Use To Dump The Rom While Creating The Above For Odin?
Just Found Something I Downloaded At Some Point Called: ROMGEN Any Idea On That Binary??? And phantomphr33k Any Request.
[/QUOTE]
So basicallly special request if you could is mainly dump those partitions above
This Romgen seemingly looks to dump what is needed for the rom. It also makes and update-script flashable Odin file. Never tried it myself. ive used cygwin/kitchen personally.
If you would do that would be sufficient as a stock rom. Granted if the rom is updated its not stock.....BUT at least it will be an updated stock vwz sch-i915 out there in public finally.
AND...extra special request is a pit file. Reason being is i need to attempt to flash by other means not via odin.(more personal use than general public) and i need the block information to flash partitions to the chip at the certain points. Im extracting the *.img/bin files and compiling *.mbn files and going to attempt to flash directly to the chip. As far as ive seen its worked on a few other devices and i might as well try considering this is a Qualcomm device and it is recognized in QPST. Maybe the security on the bootloader may not allow it but what could it hurt? its already hard bricked right? lol
http://forum.xda-developers.com/showthread.php?t=1916936
program here for windows. I never checked for any linux based tools cuz i use cygwin if i absolutely need linux.
Much appreciated ][NT3L][G3NC][ your making my day :laugh:

happy new years intelligence since it seems ur the only one to view this thread.

so did you ever get a good romdump? I have been trying all night to do it to mine but can not get it to work.

[TUT] ROOT HD10 (2017), HD8(2016-2017) - EASY SuperSu

Update - March 23rd, 2019.
There is now an excellent offline rooting method for HD10 (2017), HD8(2016-2018), all current FireOS versions, thanks to the fantastic effort by @diplomatic - link. This new root is obtained within a few seconds, so it is very fast. To install permanent root after mtk-su for HD10 (2017), HD8 (2016-2017), use the scripts by @Rortiz2 in here: v2.1, or v1.0 (see this link for a Linux script). For HD8 (2018), there is a dedicated full bootloader unlocking and permanent root guide - link. For HD10 (2017) there is also a full bootloader unlocking procedure available - link. The historical Kingoroot rooting procedure for HD10 (2017) is below. As a friendly reminder, once you have a root shell (obtained by any means), ensure that you disable OTA updates as to avoid getting an unrootable update (except for HD8 (2018) - do not run the commands below before you unlock the bootloader!!!):
Code:
mount -w -o remount /system
mv /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk_
ls -l /system/priv-app/DeviceSoftwareOTA/
The original Kingoroot method for HD10 (2017), all current FireOS versions - EASY SuperSu
Update v0.9, 12/29/18 As empasized by shonkin in this post, the method still works for FireOS 5.6.3.4. Enjoy!!! I would never have expected the hole to last his long ...
Update v0.8, 01/26/18 - as first reported by @najoor in this post, FireOS 5.6.0.1 is rootable! Today I verified this myself after a somewhat unsuccessful FlashFire update.
Update v0.7, 01/14/18 - @freaky2xd made a video with these rooting instructions, please follow it if you prefer a visual guide (here or here)
Update v0.6, 01/09/18 - there were reports that dr.fone app seems to be able to root the device as well. I took dr.fone for a spin, and based on its bloatedness and a few other annoying features, my personal recommendation is that you stick with the devil we know - Kingoroot (link)
Update v0.5, 01/04/18 - add a DOS bat file to remove any possible updates to Amazon packages
Update v0.4, 01/02/18 - title update
Update v0.3, 12/31/17 - light clean up; I got into a bootloop, and had to sideload a stock ROM & re-root - a.k.a. "eat my own dogfood" - Everything works fine.
Update v0.2, 12/30/17 - some redundant commands are removed.
Update v0.1, 12/30/17 - the rooting procedure is essentially taken from @retyre (here and here). Except, the instructions below include a lot of details, and handle mostly everything from the PC/ADB side. Try, and report back. GOOD LUCK!
Here is the guide to the painless root (while out of the box FireOS allows it; right now all FireOS versions up to and including 5.6.0.1 - the current OTA - are rootable). The key enabler is the original post by @ztrund (link), great work blazing the trail (and motivating me to get another Fire tablet ASAP, LOL).
Given that the devices will be shipping with the (older) rootable FireOS for the next few months (but beware of the upcoming updates - see below !!!), there is a good window of opportunity to acquire a rootable Fire HD 10, and root it. As of Dec 27th 2017, there are no reports yet of non-rootable OTAs, but those OTAs will be coming soon, count on it!
The utmost goal here is to preserve the earliest FireOS version that you get, and not let it get updated by Amazon on a whim.
I am starting with a recently bought Fire HD 10 2017 (light refurb from eBay, missed the Black Friday mega sale ). I have FireOS 5.5.0.0 (earlier than 5.6.0.0!), version name 5.3.5.1 (591450020)
Part I (avoiding Amazon updating procedure upon the initial Fire setup) - this can (almost safely) be skipped today (end of Dec, 2017), since there are no reports of unrootable OTAs yet
Low tech way (thanks to @Blaiser47 and @retyre for suggestions!):
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Choose any option on that WiFi screen, press cancel, and then skip
Once Alexa shows up, swipe down from the top, turn on Airplane mode just to be sure
High tech way:
Set up a dedicated slow router, limit upload/download speed to ~25 kbps (this is the trickiest part, I have a dedicated Tomato router which I use to control traffic)
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Connect Fire to your slow router
Once Fire finds Internet, it'll immediately have "Checking for updates" on the screen, this is where the slow router should kick in, and do the trick of forcing the update to give up
Wait a bit for updates, hopefully, it won't find them, if found something, do factory reset, and repeat (on my 1st try it did find the update, although, could not download it quickly enough, I did a factory reset via Pwr&Vol+ recovery mode, and tried again - the 2nd time it skipped the update due to the slowness of the connection)
Sign in to Amazon account when prompted
Once Alexa shows up, swipe down from the top, turn on Airplane mode - no more risk of updates!!!
Part II (rooting via Kingoroot, disabling OTA, and getting SuperSu replacement, as per @retyre recommendations)
Take your Fire HD as is, do not do anything dramatic such as "factory reset", Amazon ROM sideloading, etc
Swipe down from the top, turn on Airplane mode - to ensure that there are no OTA updates during the procedure
In "Settings/Device Options", tap "Serial Number" 7 times, a menu "Developer Options" will appear
In "Settings/Device Options/Developer Options", turn ADB debugging to ON (under "Debugging")
In "Settings/Security", turn "Apps from Unknown Sources" to ON
Download ADB to your PC (link)
Setup ADB drivers on your PC, connect Fire to your PC, make sure "adb devices" command shows your Fire device, authorize ADB connection on Fire
Download SuperSu 2.79 (this exact version!!!) to your PC from this link, place it into your ADB PC folder. The filename of this apk will be assumed to be SuperSU-v2.79-20161205182033.apk below
Download the attached su64.zip to your PC (see the attachment below), unzip to your ADB PC folder
Open a CMD window in ADB PC folder (this will be called ADB_cmd window in the following steps), type
Code:
adb devices
adb uninstall eu.chainfire.supersu
This is a clean up of possible old SuperSu (just in case), ignore any errors you may get (if SuperSu is absent ...)
Download Kingoroot to your PC (link), install, let it update
Connect Fire to your PC; launch Kingoroot on PC; before pushing the big "ROOT" button in Kingoroot, uncheck a small box in the lower left corner for "Install recommended app" ; push "ROOT" button; wait for Kingoroot to root
Once Kingoroot succeeds, open a 2nd CMD window in ADB PC folder to your Fire (this will be called ADB_root window in the following steps), get a root shell, and disable OTA updates
Code:
adb shell
su
mount -w -o remount /system
mv /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk_
ls -l /system/priv-app/DeviceSoftwareOTA/
ignore any errors you may get while doing this; after 'su', you should see root (#) prompt here
Switch to the first ADB_cmd window, type
Code:
adb uninstall com.lionmobi.powerclean
adb uninstall com.kingoapp.link
adb uninstall kingoroot.supersu
adb install SuperSU-v2.79-20161205182033.apk
adb shell "am start -n eu.chainfire.supersu/eu.chainfire.supersu.MainActivity"
Skip this step - it is not needed
Switch to the second ADB_root window (with # prompt), type
Code:
cd /data/local/tmp
mount -w -o remount /system
cp ./su64 /system/xbin/daemonsu
chmod 0755 /system/xbin/daemonsu
daemonsu -d &
cp ./su64 /system/xbin/su
chmod 0755 /system/xbin/su
am start -n eu.chainfire.supersu/eu.chainfire.supersu.MainActivity
On your Fire, SuperSu should pop up. Update SuperSu binary as "Normal", it should report "Installation failed." Proceed to reboot. (If it doesn't report an outcome ("failed") in a couple of minutes, go to the Fire's Apps and force-stop SuperSU and retry.)
Upon reboot, SuperSU should be functional. Choose "Grant" as the default access.
Uninstall all the junk from Kingoroot on your Fire, thanks to @fstanis for detailed instructions (copied here, executed from PC):
Code:
adb uninstall com.nemo.vidmate
adb shell rm -rf /sdcard/VidMate
adb shell rm -rf /sdcard/.a
adb shell rm -rf /sdcard/.DataStorage
adb shell rm -rf /sdcard/.UTSystemConfig
Some troubleshooting options:
If you believe you have the correct FireOS, but Kingoroot (or SuperSu) still fail, download the attached no_amzn_updates.zip to your PC, unzip to your ADB PC folder, open a CMD window in ADB PC folder, and type
Code:
.\no_amzn_updates.bat
The script will attempt to uninstall any apk updates to the official Amazon packages. Then repeat the rooting procedure from Step 1 skipping as necessary. See this post for more additional info on what the script does.
If you mess up your /system too much and get into a bootloop with "Fire" logo - use this post for links to the official Amazon ROM files; these bin's can be sideloaded via "adb sideload" in recovery
Want to say thanks by clicking the "Thanks" button ?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Fire HD 10 ROM links & misc :
Update: Uploaded modified Supersu 2.82 SR5 ready to be flashed in FlashFire. It really represents the Chainfire's swan song, the last of the true SuperSu versions, the end of the era !!!
Fire HD 10 (7th Gen 2017) ROM links from Amazon (use for sideloading your preferred version in case you mess up). If possible, turn off WiFi before sideloading a bin file - you don't want to catch an OTA while it's loading!
FireOS 5.6.3.0 (reports say that it's still rootable, the downgrade behavior is not clear)
update-kindle-suez-40.6.2.6_user_626533320.bin
update-kindle-40.6.2.6_user_626533320.bin
FireOS 5.6.2.0 (still rootable, but cannot be downgraded to anything earlier!)
update-kindle-40.6.1.2_user_612495820.bin
FireOS 5.6.1.0 (still rootable, but cannot be downgraded to anything earlier!)
update-kindle-40.6.0.5_user_605485120.bin
System image (restore via FlashFire) link. Unzip files to /sdcard/FlashFire/Backups/5.6.1.0, rename the 2 img to bin extensions. Create md5 sum files (in a shell, type "md5 system.bin > system.md5", same for boot.bin) The system image includes SuperSu, Xposed, Busybox; OTA apk is NOT renamed.
FireOS 5.6.0.1
update-kindle-40.5.9.5_user_595550320.bin
System image (restore via FlashFire v0.24) - link. Unzip files to /sdcard/FlashFire/Backups/5.6.0.1. The system image includes SuperSu, Xposed, Busybox; OTA apk is renamed.
FireOS 5.6.0.0
update-kindle-40.5.9.5_user_595457320.bin
FireOS 5.6.0.0
update-kindle-40.5.9.5_user_595457020.bin
FireOS 5.5.0.0
update-kindle-40.5.9.1_user_591450020.bin
In addition, please find attach a SuperSu zip that works with Flash Fire v0.24 (tested with FireOS 5.5.0.0 & 5.6.0.0).
The file was created by taking SuperSu v2.82 zip from this link (file name - SuperSU-v2.82-201705271822.zip).
Then in META-INF\com\google\android\update-binary I replaced one line forcing SuperSu to install armv7 binaries instead of arm64:
Code:
if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=arm64; SYSTEMLIB=/system/lib64; APPPROCESS64=true; fi;
with this one:
Code:
if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=armv7; fi;
Everything else is identical to the official version.
Using the official SuperSu zip will cause a bootloop - it looks like Fire HD 10 is not quite arm64 yet, and needs armv7 version of su binaries to work.

Useful tips & information:
How to install Xposed & Flashfire for easy backups and ROM updates
Follow this post by @retyre (and thank him!!!): link
Note: With stock FlashFire versions, the latest Flashfire version you can use is v0.24 (see the attached v0.24 apk, it needs the date patch which requires Xposed installed). Alternatively, it is possible to replace a library in Flashfire v0.51, and make v0.51 work:
link1
link2
link3
For convenience, I've done this procedure to the free FlashFire v.51 version using free apktool, and attached the file below (the signature will not match with the original FlashFire signed by @Chainfire, so you will need to uninstall other FlashFire packages before installing this one!)
With v0.51, uncheck two options (as per link2):
1) Emulate framebuffer in Settings
2) Mount /system read/write (after you choose the update file).
If you don't do 2), Flashfire v.51 will just sit there and never do anything
How to enable Amazon packages (apk) updates but prevent the ROM updates (keeping root & rootable rom).
1) Edit /system/build.prop and change ro.build.version.number to have "9" as the first value instead of "5", as recommended in this link
2) Reboot
3) Enable OTA by ensuring that /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk is renamed back to apk from apk_
4) Reboot
At this point the Fire will download a lot of apk packages, and will update Amazon system components (keeping FireOS version the same).
Partition trivia:
Partition info (gdisk binary) :
Code:
[email protected]:/ # df
df
Filesystem Size Used Free Blksize
/dev 907.7M 80.0K 907.6M 4096
/dev/logd 512.0K 96.0K 416.0K 4096
/sys/fs/cgroup 907.7M 12.0K 907.7M 4096
/mnt/asec 907.7M 0.0K 907.7M 4096
/mnt/obb 907.7M 0.0K 907.7M 4096
/system 1.5G 1.2G 317.9M 4096
/data 26.5G 1.1G 25.4G 4096
/data/metrics 5.8M 232.0K 5.6M 4096
/cache 410.7M 14.9M 395.8M 4096
/mnt/sqfs 79.8M 79.8M 0.0K 32768
/mnt/cd-rom 1.2M 1.2M 0.0K 2048
/mnt/shell/emulated 26.5G 1.1G 25.4G 4096
/storage/emulated 907.7M 0.0K 907.7M 4096
/storage/emulated/0 26.5G 1.1G 25.4G 4096
/storage/emulated/0/Android/obb 26.5G 1.1G 25.4G 4096
/storage/emulated/legacy 26.5G 1.1G 25.4G 4096
/storage/emulated/legacy/Android/obb 26.5G 1.1G 25.4G 4096
[email protected]:/data/local/tmp # ./gdisk -l /dev/block/mmcblk0
./gdisk -l /dev/block/mmcblk0
GPT fdisk (gdisk) version 0.8.4
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/block/mmcblk0: 61071360 sectors, 29.1 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): B1541C10-343E-474B-B5B2-05796C64E992
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 61071326
Partitions will be aligned on 1024-sector boundaries
Total free space is 990 sectors (495.0 KiB)
Number Start (sector) End (sector) Size Code Name
1 1024 7167 3.0 MiB 8300 proinfo
2 7168 16383 4.5 MiB 8300 PMT
3 16384 18431 1024.0 KiB 8300 kb
4 18432 20479 1024.0 KiB 8300 dkb
5 20480 22527 1024.0 KiB 8300 lk
6 22528 32767 5.0 MiB 8300 tee1
7 32768 43007 5.0 MiB 8300 tee2
8 43008 123903 39.5 MiB 8300 metadata
9 123904 124927 512.0 KiB 8300 MISC
10 124928 141311 8.0 MiB 8300 reserved
11 141312 174079 16.0 MiB 8300 boot
12 174080 208895 17.0 MiB 8300 recovery
13 208896 3515391 1.6 GiB 8300 system
14 3515392 4383743 424.0 MiB 8300 cache
15 4383744 61071326 27.0 GiB 8300 userdata
[email protected]:/ # cat /proc/partitions
cat /proc/partitions
major minor #blocks name
7 0 81664 loop0
7 1 1254 loop1
7 2 10240 loop2
179 0 30535680 mmcblk0
179 1 3072 mmcblk0p1
179 2 4608 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 5120 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 40448 mmcblk0p8
179 9 512 mmcblk0p9
179 10 8192 mmcblk0p10
179 11 16384 mmcblk0p11
179 12 17408 mmcblk0p12
179 13 1653248 mmcblk0p13
179 14 434176 mmcblk0p14
179 15 28343791 mmcblk0p15
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 1024 mmcblk0boot0
179 33 2 mmcblk0boot0p1
179 34 2 mmcblk0boot0p2
179 35 256 mmcblk0boot0p3
179 36 747 mmcblk0boot0p4
[email protected]:/ # ls -l /dev/block
ls -l /dev/block
brw------- root root 7, 0 2017-12-28 11:05 loop0
brw------- root root 7, 1 2017-12-28 11:05 loop1
brw------- root root 7, 2 2017-12-28 11:05 loop2
brw------- root root 7, 3 2017-12-28 11:05 loop3
brw------- root root 7, 4 2017-12-28 11:05 loop4
brw------- root root 7, 5 2017-12-28 11:05 loop5
brw------- root root 7, 6 2017-12-28 11:05 loop6
brw------- root root 7, 7 2017-12-28 11:05 loop7
brw-rw---- root system 179, 0 2017-12-28 11:05 mmcblk0
brw-rw---- root system 179, 32 2017-12-28 11:05 mmcblk0boot0
brw------- root root 179, 33 2017-12-28 11:05 mmcblk0boot0p1
brw------- root root 179, 34 2017-12-28 11:05 mmcblk0boot0p2
brw------- root root 179, 35 2017-12-28 11:05 mmcblk0boot0p3
brw------- root root 179, 36 2017-12-28 11:05 mmcblk0boot0p4
brw-rw---- root system 179, 64 2017-12-28 11:05 mmcblk0boot1
brw------- root root 179, 1 2017-12-28 11:05 mmcblk0p1
brw------- root root 179, 10 2017-12-28 11:05 mmcblk0p10
brw------- root root 179, 11 2017-12-28 11:05 mmcblk0p11
brw------- root root 179, 12 2017-12-28 11:05 mmcblk0p12
brw------- root root 179, 13 2017-12-28 11:05 mmcblk0p13
brw------- root root 179, 14 2017-12-28 11:05 mmcblk0p14
brw------- root root 179, 15 2017-12-28 11:05 mmcblk0p15
brw------- root root 179, 2 2017-12-28 11:05 mmcblk0p2
brw------- root root 179, 3 2017-12-28 11:05 mmcblk0p3
brw------- root root 179, 4 2017-12-28 11:05 mmcblk0p4
brw------- root root 179, 5 2017-12-28 11:05 mmcblk0p5
brw------- root root 179, 6 2017-12-28 11:05 mmcblk0p6
brw------- root root 179, 7 2017-12-28 11:05 mmcblk0p7
brw------- root root 179, 8 2017-12-28 11:05 mmcblk0p8
brw------- root root 179, 9 2017-12-28 11:05 mmcblk0p9
brw-rw---- root system 179, 96 2017-12-28 11:05 mmcblk0rpmb
drwxr-xr-x root root 2017-12-28 11:05 platform
drwx------ root root 2017-12-28 11:05 vold
brw------- root root 254, 0 2017-12-28 11:05 zram0
[email protected]:/ # ls -l /dev/block/platform/mtk-msdc.0/by-name/
ls -l /dev/block/platform/mtk-msdc.0/by-name/
lrwxrwxrwx root root 2017-12-28 11:05 MISC -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2017-12-28 11:05 PMT -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2017-12-28 11:05 boot -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2017-12-28 11:05 boot0hdr0 -> /dev/block/mmcblk0boot0p1
lrwxrwxrwx root root 2017-12-28 11:05 boot0hdr1 -> /dev/block/mmcblk0boot0p2
lrwxrwxrwx root root 2017-12-28 11:05 boot0img0 -> /dev/block/mmcblk0boot0p3
lrwxrwxrwx root root 2017-12-28 11:05 boot0img1 -> /dev/block/mmcblk0boot0p4
lrwxrwxrwx root root 2017-12-28 11:05 cache -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2017-12-28 11:05 dkb -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2017-12-28 11:05 kb -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2017-12-28 11:05 lk -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2017-12-28 11:05 metadata -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2017-12-28 11:05 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2017-12-28 11:05 recovery -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2017-12-28 11:05 reserved -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2017-12-28 11:05 system -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2017-12-28 11:05 tee1 -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2017-12-28 11:05 tee2 -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2017-12-28 11:05 userdata -> /dev/block/mmcblk0p15
[email protected]:/ # fdisk /dev/block/mmcblk0
fdisk /dev/block/mmcblk0
The number of cylinders for this disk is set to 3786.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)
Command (m for help): p
p
Disk /dev/block/mmcblk0: 29 GB, 31268536320 bytes, 61071360 sectors
3786 cylinders, 256 heads, 63 sectors/track
Units: cylinders of 16128 * 512 = 8257536 bytes
Device Boot StartCHS EndCHS StartLBA EndLBA Sectors
Size Id Type
/dev/block/mmcblk0p1 0,0,2 1023,255,63 1 4294967295 4294967295 2047G ee EFI GPT

bibikalka said:
Here is the guide to the painless root (while out of the box FireOS allows it - right now all versions up to FireOS 5.6.0.0 are rootable). The key enabler is the original post by @ztrund (link), great work blazing the trail (and motivating me to get another Fire tablet ASAP, LOL).
Given that the devices will be shipping with the (older) rootable FireOS for the next few months (but beware of the upcoming updates - see below !!!), there is a good window of opportunity to acquire a rootable Fire HD 10, and root it. As of Dec 27th 2017, there are no reports yet of non-rootable OTAs, but those OTAs will be coming soon, count on it!
The utmost goal here is to preserve the earliest FireOS version that you get, and not let it get updated by Amazon on a whim.
I am starting with a recently bought Fire HD 10 2017 (light refurb from eBay, missed the Black Friday mega sale ). I have FireOS 5.5.0.0 (earlier than 5.6.0.0!), version name 5.3.5.1 (591450020)
Part I (avoiding Amazon updating procedure upon the initial Fire setup) - this can (almost safely) be skipped today (end of Dec, 2017), since there are no reports of unrootable OTAs yet
Set up a dedicated slow router, limit upload/download speed to ~25 kbps (this is the trickiest part, I have a dedicated Tomato router which I use to control traffic)
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Connect Fire to your slow router
Once Fire finds Internet, it'll immediately have "Checking for updates" on the screen, this is where the slow router should kick in, and do the trick of forcing the update to give up
Wait a bit for updates, hopefully, it won't find them, if found something, do factory reset, and repeat (on my 1st try it did find the update, although, could not download it quickly enough, I did a factory reset via Pwr&Vol+ recovery mode, and tried again - the 2nd time it skipped the update due to the slowness of the connection)
Sign in to Amazon account when prompted
Once Alexa shows up, swipe down from the top, turn on Airplane mode - no more risk of updates!!!
Done
Click to expand...
Click to collapse
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.

Blaiser47 said:
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.
Click to expand...
Click to collapse
Even simpler: Choose any option on that WiFi screen, press cancel, and then skip.
No offense to the OP, but given the kind of questions that get asked on these root threads, s/he probably lost half the visitors at "dedicated slow router."

Blaiser47 said:
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.
Click to expand...
Click to collapse
retyre said:
Even simpler: Choose any option on that WiFi screen, press cancel, and then skip.
No offense to the OP, but given the kind of questions that get asked on these root threads, s/he probably lost half the visitors at "dedicated slow router."
Click to expand...
Click to collapse
Great! Awesome tip!!! Even better than messing with the router - I've updated the post! XDA is no strangers to people with routers, especially if it involves blocking Amazon updates.

Curious does this work for the Fire 8? If not why?

ginfest said:
Curious does this work for the Fire 8? If not why?
Click to expand...
Click to collapse
The key difference is that the 2017 Fire HD 10 has an 'arm64-v8a' compiled system (with 64 bits), while all the older Fires are running 'armeabi-v7a' (with 32 bits). So a 64 bit bug must have slipped in. But let's be clear, if history is any guide, an Amazon update plugging this rootable bug is imminent at this point in time. That is why I urge everybody with root to disable OTA for good by renaming /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk to *apk_
Unfortunately, all the other Fires seem to be on lock down, for now I have disabled updates on all of mine (including Fire TV 2 sticks) in case an exploit becomes available in the future.

bibikalka said:
Great! Awesome tip!!! Even better than messing with the router - I've updated the post! XDA is no strangers to people with routers, especially if it involves blocking Amazon updates.
Click to expand...
Click to collapse
Thanks very much for your simple approach to rooting the hd 10, starting from unboxing it, and giving step by step guide.
What apps/tweaks/settings did you do after you rooted your HD 10 that you recommend we do, you seem to have a way of writing that is concise and to the point, very much appreciated. Any other suggestions for protecting the HD 10 from Amazon OTA updates or other hazards?
Thanks again.

Are you saying at the beginning that 5.6.0.0 is or is not rootable?

encephalon9986 said:
Are you saying at the beginning that 5.6.0.0 is or is not rootable?
Click to expand...
Click to collapse
It is rootable, I clarified, thanks!

Amazing, much easier than the previous guide!
For those interested, I wrote here how to remove the Kingoroot junk: https://forum.xda-developers.com/hd8-hd10/general/added-kingoroot-t3721482

After rooting can I remove FireOS and install Oreo?

Stansted said:
After rooting can I remove FireOS and install Oreo?
Click to expand...
Click to collapse
No. That requires an unlocked boot loader and a custom oreo rom. Neither are available yet and likely will not be

This guide didn't work for me. While KingoRoot reported achieving root, I couldn't run SuperSU because the SuperSU binary is already occupied (presumably by KingoRoot's version of SuperSU).

Stansted said:
This guide didn't work for me. While KingoRoot reported achieving root, I couldn't run SuperSU because the SuperSU binary is already occupied (presumably by KingoRoot's version of SuperSU).
Click to expand...
Click to collapse
Thanks!
I was not sure if unrooting was necessary, it now looks like you should launch SuperSu from the root shell after running unroot with Kingoroot:
Unroot Fire via Kingoroot on PC
Can you try and report back?

bibikalka said:
Thanks!
I was not sure if unrooting was necessary, it now looks like you should launch SuperSu from the root shell after running unroot with Kingoroot:
Unroot Fire via Kingoroot on PC
Can you try and report back?
Click to expand...
Click to collapse
I already tried that. It didn't work. After unrooting, SuperSU won't do anything because it doesn't detect root.

Stansted said:
I already tried that. It didn't work. After unrooting, SuperSU won't do anything because it doesn't detect root.
Click to expand...
Click to collapse
How about going back to su commands - link

Yeah, so I just double-checked to make sure I hadn't made a mistake. This doesn't work. While SuperSU launches just fine from the root shell, it won't do anything after you've unrooted with KingoRoot. And if you haven't unrooted with KingoRoot, the SuperSU binary is occupied. For the record, I'm using a 7th Gen Fire HD 10 running Fire OS 5.6.0.0. I might try retyre's method later, but I don't currently understand what he's asking me to do.

Stansted said:
Yeah, so I just double-checked to make sure I hadn't made a mistake. This doesn't work. While SuperSU launches just fine from the root shell, it won't do anything after you've unrooted with KingoRoot. And if you haven't unrooted with KingoRoot, the SuperSU binary is occupied. For the record, I'm using a 7th Gen Fire HD 10 running Fire OS 5.6.0.0. I might try retyre's method later, but I don't currently understand what he's asking me to do.
Click to expand...
Click to collapse
Download the 5.6.0.0 update .bin from here, adb sideload that file, and follow these steps to the letter. It will work.

K1 Not booting after flashing stock image

Yesterday I flashed BitO-KU kernel with dtb and blob file provided in this thread https://forum.xda-developers.com/sh.../tweaked-kernel-nvidia-shield-tablet-t3069776 on my Shield Tablet K1. Since then the problem started and my tab didn't boot.
How problem started?
Flashed BitO-KU kernel https://forum.xda-developers.com/sh.../tweaked-kernel-nvidia-shield-tablet-t3069776
Reboot (working fine)
Flashed dtb file "tegra124-tn8-p1761-1270-a04-e-battery.dtb" (provided in same thread)
Reboot (stuck on bootloader)
Flashed blob file (provided in same thread)
Reboot (stuck on bootloader)
After that I flashed factory images provided on Nvidia official site for K1 Tablet but still not booting. Although many times I have successfully flashed firmware images before, but only this time it's not booting. I think that the dtb and blob files I flashed previously with BitO-KU kernel were for Original Shield Tablet not for K1, that's why my tablet bricked.
What's working and what's not:
Bootloader is working and able to flash files using fastboot. But it's niether showing any error nor booting after flashing firmware images.
Recovery Not Working. Flashed various versions of TWRP from official website, none of them is working. Even tried directly booting to twrp recovery instead of flashing, still not working.
Any help is appreciated.
Sorry for my bad English!

Did you flash the stock system file and the stock blob? I think the instructions (recovery image) say to flash a few other things (recovery, userdata) but I was able to just flash the system and blob (flashing stock recovery might not hurt either).
Also, please don't apologize for your bad English. Your post is very well written, and I never would have guessed you are not a native English speaker.

redpoint73 said:
Did you flash the stock system file and the stock blob? I think the instructions (recovery image) say to flash a few other things (recovery, userdata) but I was able to just flash the system and blob (flashing stock recovery might not hurt either).
Also, please don't apologize for your bad English. Your post is very well written, and I never would have guessed you are not a native English speaker.
Click to expand...
Click to collapse
Hi @redpoint73, thanks for your response. Yes I did flash the stock system file, stock blob file and stock boot file. Still it wasn't booting.
And thanks for your compliment about my English.

Hello,
I was in a similar situation but finally managed to fix this boot issue on my K1.
What I have, Nvidia Shield Tablet K1
What I did wrong, flashed via fastboot a stock ROM image from Nvidia GameWorks - SHIELD Open Source Resources and Drivers
But not the correct one for Shield K1
I had the following steps for this recovery ROM (not for K1 tablet...):
fastboot flash recovery recovery.img
fastboot flash boot boot.img
fastboot flash system system.img
fastboot flash userdata userdata.img
fastboot flash dtb tegra124-tn8-p1761-1270-a04-e-battery.dtb
fastboot reboot
Flashing them failed on userdata (not enough space) and results in K1 to be stuck on boot and the Nvidia logo for ages.
(For a K1 tablet, you don't have a userdata and dtb flash image steps). I think what messed up my K1 is the dtb flashing step because formating, erasing and flashing recovery, boot, system and userdata partitions didn't have any effects on being stuck at boot.
What I did to get out of this mess and what you need:
Stock ROM K1: nv-recovery-image-shield-tablet-k1-factory0_0_0
fastboot + adb
twrp for K1 for revovery partitions
And know your K1 partitions
Via adb shell:
cd /etc
cat recovery.fstab
shieldtablet:/etc # cd /etc
shieldtablet:/etc # cat recovery.fstab
Result:
/dev/block/platform/sdhci-tegra.3/by-name/APP /system ext4 ro wait
/dev/block/platform/sdhci-tegra.3/by-name/CAC /cache ext4 noatime,nosuid,nodev,data=writeback,nodelalloc wait,formatable
/dev/block/platform/sdhci-tegra.3/by-name/LNX /boot emmc defaults defaults
/dev/block/platform/sdhci-tegra.3/by-name/MSC /misc emmc defaults defaults
/dev/block/platform/sdhci-tegra.3/by-name/UDA /data ext4 noatime,nosuid,nodev,data=writeback,noauto_da_alloc wait,check,formatable,encryptable=/dev/block/platform/sdhci-tegra.3/by-name/MDA
/dev/block/platform/sdhci-tegra.3/by-name/RP3 /usercalib ext4 noatime,data=writeback wait,formatable
/dev/block/platform/sdhci-tegra.3/by-name/USP /staging emmc defaults defaults
/dev/block/platform/sdhci-tegra.3/by-name/MDA /metadata emmc defaults defaults
/dev/block/platform/sdhci-tegra.3/by-name/SOS /recovery emmc defaults defaults
/devices/platform/sdhci-tegra.2/mmc_host* auto vfat defaults voldmanaged=sdcard1:auto,encryptable=userdata
/devices/tegra-ehci.0/usb* auto vfat defaults voldmanaged=usb:auto
/dev/block/platform/sdhci-tegra.2/by-num/p1 /sdcard vfat defaults recoveryonly
Via adb shell:
cd dev/block/platform/sdhci-tegra.3/by-name/
ls -al
Resust:
shieldtablet:/dev/block/platform/sdhci-tegra.3/by-name # ls -al
total 0
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
drwxr-xr-x 2 root root 520 2019-11-19 08:27 .
drwxr-xr-x 4 root root 600 2019-11-19 08:27 ..
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 APP -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 CAC -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 CHG -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 DTB -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 EKS -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 FB -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 FBP -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 FCG -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 FCT -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 GPT -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 LBP -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 LNX -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 MDA -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 MSC -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 NCT -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 RP1 -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 RP2 -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 RP3 -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 RP4 -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 SOS -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 TOS -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 UDA -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2019-11-19 08:27 USP -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 20 2019-11-19 08:27 WB0 -> /dev/block/mmcblk0p5
MAP boot, system, blob (staging) partitions with corresponding memory block
Ex: boot -> LNX -> /dev/block/mmcblk0p12
Via adb shell and using the images from K1 ROM nv-recovery-image-shield-tablet-k1-factory0_0_0 (check if your tablet k1 has the same partitions)
dd if=boot.img of=/dev/block/mmcblk0p12
dd if=system.img of=/dev/block/mmcblk0p13
dd if=blob of=/dev/block/mmcblk0p16
By getting from another ROM: tegra124-tn8-p1761-1270-a04-e-battery.dtb (renamed tegra124.dtb)
dd if=tegra124.dtb of=/dev/block/mmcblk0p11
Still failing... and stuck at boot so I decided to restore nv-recovery-image-shield-tablet-k1-factory0_0_0 via fastboot a last time but cleaned everything first:
twrp wipe all system cache data
then
fastboot flash system
fastboot erase boot
fastboot flash boot
fastboot erase staging
fastboot flash staging blob
fastboot reboot
And my Shield Tablet K1 was working again!! And very happy to have my Nvidia Shield K1 back (with latest LineageOS 15.1 ROM and working like a charm)!
I did a lot of stock ROM erase / format / restore on these partitions before and they all failed before. But I thing here the main difference is around the DTB partition.
May be the dd if=tegra124.dtb of=/dev/block/mmcblk0p11 step did properly restore the dtb info and partition or actually "corrupt" it in a way that cause the K1 to properly boot back. I don't know.
Hope that can help someone in the same situation!

MAGISK - How do i proceed in this situation?

Phone: TCL C5 with Android 8.1
i have tested mtk-su and it works
i can make a copy of the boot partition and everything
i have unlocked the bootloader
for some reason i have 2 boot files ( or more )
lrwxrwxrwx 1 root root 21 2020-12-03 16:24 boot -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 2020-12-03 16:24 boot2 -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 20 2020-12-03 16:24 boot_para -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 23 2020-12-03 16:24 preloader_a -> /dev/block/mmcblk0boot0
lrwxrwxrwx 1 root root 23 2020-12-03 16:24 preloader_b -> /dev/block/mmcblk0boot1
i don't know what is going on here but i can patch boot and boot2 with magisk
the files goes from 24 MB to 7.7 MB so i think this is kinda weird
i want to know how i can make a good backup of everything before trying to flash anything
so i can prevent bootloop
and i want to know if there is any way to test the boot.img before flashing it
if not i would like some help to backup everything before flashing it
i patch the boot.img and try doing "fastboot boot boot.img"
but the magisk manager doesn't show installed or anything so i don't think "fastboot boot" works in this situation
is there anything i can do to be sure before flashing?
Update: seems like i only need boot and boot2
maybe patching both and flashing it?
seems a little risky, they both are the same file with the same md5sum hash