Database Info

[Q] 64gb tf700 partitions show up as tmpfs

Hey all, i accidentally formatted the partitions on the tf700. it was unlocked/rooted and i have TWRP installed.
i do not have access to fastboot. i can use adb and adb shell.
i have tried the options 1a & 1b for the prime tf201 unbrick with no luck.
in the terminal if i write the command "df" it shows that the only partition i have is TMPFS, and it is 499732 1K blocks - mounted on /dev
since the card is showing up as TMPFS it is basically a ramdisk and it will be erased on a reboot, so no matter what changes i make, or rom i install it will always be erased.
if i try to mount the /data /system /cache partitions they all return E:Unable to mount '/system' (tw_mount)
( '/system' changes with '/data' and '/cache')
if i go to /dev/block the only things i see are loop0 - loop7 and mmcblk0p3
im thinking that all i need to do is somehow format the internal memory to reinstall a rom and i should be good to go, but i dont know what the partitions need to be, but i could also be way off.
im hoping someone has some insight. i would hate to have a brick

pbcustom98 said:
Hey all, i accidentally formatted the partitions on the tf700. it was unlocked/rooted and i have TWRP installed.
Click to expand...
Click to collapse
How did you do that?
pbcustom98 said:
if i go to /dev/block the only things i see are loop0 - loop7 and mmcblk0p3
Click to expand...
Click to collapse
Looks like your GPT got damaged - this may not be easy to repair (AFAIK the original GPT is nowhere in the Asus firmware download), but as long as you can boot TWRP and use adb, there is hope.
First of all, what does "cat /proc/partitions" say? For comparison, here is my output:
Code:
# cat /proc/partitions
major minor #blocks name
179 0 62087168 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 59976192 mmcblk0p8
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 48 31166976 mmcblk1
179 49 31162880 mmcblk1p1

_that said:
How did you do that?
Looks like your GPT got damaged - this may not be easy to repair (AFAIK the original GPT is nowhere in the Asus firmware download), but as long as you can boot TWRP and use adb, there is hope.
First of all, what does "cat /proc/partitions" say? For comparison, here is my output:
Code:
# cat /proc/partitions
major minor #blocks name
179 0 62087168 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 59976192 mmcblk0p8
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 48 31166976 mmcblk1
179 49 31162880 mmcblk1p1
Click to expand...
Click to collapse
out of stupidity
cat /proc/partitions shows the following:
# cat /proc/partitions
major minor #blocks name
under it though, there is nothing there

pbcustom98 said:
out of stupidity
Click to expand...
Click to collapse
If you can describe what you did, maybe it is easier to find out what exactly happened.
I assume you don't have an nvflash backup, right?
pbcustom98 said:
under it though, there is nothing there
Click to expand...
Click to collapse
OK. What is the output if you run:
Code:
dmesg|grep mmcblk0
?

_that said:
If you can describe what you did, maybe it is easier to find out what exactly happened.
I assume you don't have an nvflash backup, right?
OK. What is the output if you run:
Code:
dmesg|grep mmcblk0
?
Click to expand...
Click to collapse
I was unlocking the tablet, installing TWRP and then wiping the data, i misread the options and went too far by doing the format data option.
no backup. i do not have access to fastboot/APX now, and i did not create one before.
C:\Users\Daniel>adb shell
~ # ←[6ndmesg|grep mmcblk0
dmesg|grep mmcblk0
~ # ←[6n^C
C:\Users\Daniel>
also, the only way i have seen to get the other mmcblk0 partitions to show up (0p3, 0p4 etc) is to run the commands for the tf201 unbrick (option 1a/b)
dd if=/dev/zero of=/dev/block/mmcblk0p4 bs=100 count=1
dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=16 count=1
i was thinking that all i needed to do was to somehow format the data so the tablet can write to the partition instead of it just acting as a ramdisk. i even tried running fdisk -H 1 /dev/block/mmcblk0 and tried to format the data but i'm not familiar with the partition table of this tablet to redo it.
i have also tried doing those commands above and then running a live usb gparted disk to see if it shows up, but it hasnt worked yet

pbcustom98 said:
C:\Users\Daniel>adb shell
~ # ←[6ndmesg|grep mmcblk0
dmesg|grep mmcblk0
~ # ←[6n^C
C:\Users\Daniel>
Click to expand...
Click to collapse
Strange, it should at least output the line about detecting the card. Please reboot your tablet into recovery (to restart the kernel log), then do from your computer
Code:
adb shell dmesg > dmesg.txt
and put the resulting file on pastebin or attach it here.

pbcustom98 said:
I was unlocking the tablet, installing TWRP and then wiping the data, i misread the options and went too far by doing the format data option.
no backup. i do not have access to fastboot/APX now, and i did not create one before.
C:\Users\Daniel>adb shell
~ # ←[6ndmesg|grep mmcblk0
dmesg|grep mmcblk0
~ # ←[6n^C
C:\Users\Daniel>
also, the only way i have seen to get the other mmcblk0 partitions to show up (0p3, 0p4 etc) is to run the commands for the tf201 unbrick (option 1a/b)
dd if=/dev/zero of=/dev/block/mmcblk0p4 bs=100 count=1
dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=16 count=1
i was thinking that all i needed to do was to somehow format the data so the tablet can write to the partition instead of it just acting as a ramdisk. i even tried running fdisk -H 1 /dev/block/mmcblk0 and tried to format the data but i'm not familiar with the partition table of this talet to redo it.
i have also tried doing those commands above and then running a live usb gparted disk to see if it shows up, but it hasnt worked yet
Click to expand...
Click to collapse
That's odd, format data will not and shouldn't do that. I did this all the time. Do you have the lastest TWRP and was on JB? if you do, go back to "WIPE" option and do the wipe format again. This should reformat with ext4. After that do factory reset, wipe system, internal storage then try to reflash Cleanrom. TWRP may some how corrupted your partition, but not what you did.

_that said:
Strange, it should at least output the line about detecting the card. Please reboot your tablet into recovery (to restart the kernel log), then do from your computer
Code:
adb shell dmesg > dmesg.txt
and put the resulting file on pastebin or attach it here.
Click to expand...
Click to collapse
i cannot post outside links until about 10 posts.
Here is the pastebin attachedView attachment dmesg.txt

pbcustom98 said:
also, the only way i have seen to get the other mmcblk0 partitions to show up (0p3, 0p4 etc) is to run the commands for the tf201 unbrick (option 1a/b)
dd if=/dev/zero of=/dev/block/mmcblk0p4 bs=100 count=1
dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=16 count=1
Click to expand...
Click to collapse
If the partitions are not already there, then these commands simply create files that are named like the block devices that are missing. Not what you want at all, but harmless.
pbcustom98 said:
i was thinking that all i needed to do was to somehow format the data so the tablet can write to the partition instead of it just acting as a ramdisk. i even tried running fdisk -H 1 /dev/block/mmcblk0 and tried to format the data but i'm not familiar with the partition table of this tablet to redo it.
Click to expand...
Click to collapse
Do not try to to use fdisk, it does not support GPT.
pbcustom98 said:
i have also tried doing those commands above and then running a live usb gparted disk to see if it shows up, but it hasnt worked yet
Click to expand...
Click to collapse
How would you run a live disk on the tablet?
---------- Post added at 05:53 PM ---------- Previous post was at 05:46 PM ----------
pbcustom98 said:
i cannot post outside links until about 10 posts.
Here is the pastebin attachedView attachment 1456337
Click to expand...
Click to collapse
The important part is here:
Code:
<6>[ 9.067211] [mmc]:mmc_read_ext_csd:259 ext_csd.sectors 0x766c000 prod_name HYNIX BOOT_SIZE_MULTI 0x20
<4>[ 9.109988] mmc0: switch to bus width 1 ddr 0 failed
<3>[ 9.116163] mmc0: error -110 whilst initialising MMC card
The recovery kernel cannot initialize the MMC card. So there is no point in trying to run partitioning tools at this time, first you need to gain access to the eMMC. It cannot be completely broken, otherwise it could not boot the recovery.
Next step: find out what error -110 is and how to fix it.
btw, this thread seems to describe the same situation (read the post from MysticMgcn): http://forum.xda-developers.com/showthread.php?t=1917304

_that said:
If the partitions are not already there, then these commands simply create files that are named like the block devices that are missing. Not what you want at all, but harmless.
Do not try to to use fdisk, it does not support GPT.
How would you run a live disk on the tablet?
Click to expand...
Click to collapse
i ran gparted live usb on my laptop and tried connecting the tablet via usb after i had the partitions created.

pbcustom98 said:
i ran gparted live usb on my laptop and tried connecting the tablet via usb after i had the partitions created.
Click to expand...
Click to collapse
I still don't understand - where did you create those partitions? On your laptop?
Anyway, your TF700 is bricked until someone finds out how to make the TWRP kernel initialize the eMMC correctly in your situation. Without that, your internal storage is inaccessible, so any fix attempt at that level will fail.
Unfortunately there is still very little public information how the bootloader interacts with the kernels, so I cannot help you further. You may try asking in the thread I linked in my last post if anyone was able to recover from this.

_that said:
I still don't understand - where did you create those partitions? On your laptop?
Anyway, your TF700 is bricked until someone finds out how to make the TWRP kernel initialize the eMMC correctly in your situation. Without that, your internal storage is inaccessible, so any fix attempt at that level will fail.
Unfortunately there is still very little public information how the bootloader interacts with the kernels, so I cannot help you further. You may try asking in the thread I linked in my last post if anyone was able to recover from this.
Click to expand...
Click to collapse
i ran these two commands via adb shell:
dd if=/dev/zero of=/dev/block/mmcblk0p4 bs=100 count=1
dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=16 count=1
then once i saw them in /dev/block, i rebooted my laptop into gparted hoping that they would show up as a partition i can make changes to, but they didnt.
i will ask in the thread you linked, and thanks for all your help.

[SOLVED] Corrupted partition? ADB and Fastboot works.

Hello!
I need enlightenment and help from all of you, I spent hours looking for information and solutions but I wasn't able to find a situation similar to mine, rather small pieces from different scenarios.
Here's my situation:
After installing lj50036's pre-nightly OmniROM and setting it up, I decided to reboot and "clean" it. My BIG mistake was that for some reason (probably sleep-deprivation effects) I thought that doing a format in TWRP was a good idea...yeah, messed up.
I will try my best to describe the current situation and the solutions that I tried...
Currently, I am able to access fastboot and ADB sideload., even able to flash the recovery. The problem lies with not being able to install a ROM properly. What I can't do is access TWRP after a reboot, I must first flash it via fastboot in order to be able to access it, then of course it will reset after a reboot. TWRP will just keep being stuck in a loop if I don't go to fastboot. Whenever I try to install a ROM, it will fail not long after due to errors like : "Unable to mount data, system,cache etc."
I tried the following:
-The 'Repair' option in the advanced menu.
-Formatting using the 'ADB shell..." commands (I'm trying to find the correct command, as soon I arrive to my desktop, I'll update this post). What I did noticed is after entering that command, it would return strange characters. According to some posts, it could be some color formatting but I'm not sure.
-'sideloading' recoveries and ROMs.
INFO:
-Bootloader is 10.6.1.14.10
-Recovery is TWRP 2.8.6.0
From what I read, my guess is to correct the partition errors. Any tips on how to achieve this?
Could this be fixed by flashing a new bootloader or would it make it worse? I don't want to risk it further until I get some professional advice
Any assistance is greatly appreciated, Thank you all!

razgrizpr said:
Hello!
Here's my situation:
After installing lj50036's pre-nightly OmniROM and setting it up, I decided to reboot and "clean" it. My BIG mistake was that for some reason (probably sleep-deprivation effects) I thought that doing a format in TWRP was a good idea...yeah, messed up.
Click to expand...
Click to collapse
Why was doing a format a BIG mistake ???
Thx Josh

lj50036 said:
Why was doing a format a BIG mistake ???
Thx Josh
Click to expand...
Click to collapse
Doesn't formatting via TWRP erase all the data including the OS?

razgrizpr said:
Doesn't formatting via TWRP erase all the data including the OS?
Click to expand...
Click to collapse
Depends what partitions you formatted. The OS is in /system; your data is in /data.

_that said:
Depends what partitions you formatted. The OS is in /system; your data is in /data.
Click to expand...
Click to collapse
Makes sense. So I guess I erased them all? I honestly don't know since I left it formatting and returned a few hours later only to find it turned off. When I booted it, I experienced the mentioned issues. Battery was full as well. So maybe something went wrong during the formatting?
Is there a way to diagnose the partitions?

Did you try this?
http://forum.xda-developers.com/showpost.php?p=54521117&postcount=10

berndblb said:
Did you try this?
http://forum.xda-developers.com/showpost.php?p=54521117&postcount=10
Click to expand...
Click to collapse
Yes, I tried that. Upon entering 'make_ext4fs /dev/block/mmcblk0p8' I get the message 'Need size of file system'.
Found a similar thread where the issue was not being able to mount /data. It appears that for some people 'this' helped them although I'm not sure if I should try it. Others have mentioned 'downgrading' the bootloader and then go through all the process again with success.

razgrizpr said:
Yes, I tried that. Upon entering 'make_ext4fs /dev/block/mmcblk0p8' I get the message 'Need size of file system'.
Found a similar thread where the issue was not being able to mount /data. It appears that for some people 'this' helped them although I'm not sure if I should try it. Others have mentioned 'downgrading' the bootloader and then go through all the process again with success.
Click to expand...
Click to collapse
From recovery run this and post the output ....
Code:
adb pull /proc/partitions
You will get a file called 'partitions' in the current directory.....
Thx Josh

lj50036 said:
From recovery run this and post the output ....
Code:
adb pull /proc/partitions
You will get a file called 'partitions' in the current directory.....
Thx Josh
Click to expand...
Click to collapse
Thank you lj50036, I'm at work at the moment so I will try that as soon I get home and report back.

lj50036 said:
From recovery run this and post the output ....
Code:
adb pull /proc/partitions
You will get a file called 'partitions' in the current directory.....
Thx Josh
Click to expand...
Click to collapse
Here are the results:
Code:
major minor #blocks name
179 0 31039488 mmcblk0
179 32 2048 mmcblk0boot1
179 16 2048 mmcblk0boot0
179 48 31166976 mmcblk1
179 49 24901600 mmcblk1p1

razgrizpr said:
Here are the results:
Code:
major minor #blocks name
179 0 31039488 mmcblk0
179 32 2048 mmcblk0boot1
179 16 2048 mmcblk0boot0
179 48 31166976 mmcblk1
179 49 24901600 mmcblk1p1
Click to expand...
Click to collapse
Code:
major minor #blocks name
179 0 31039488 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 28924416 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 8192 mmcblk0p10
179 32 2048 mmcblk0boot1
179 16 2048 mmcblk0boot0
That is what it should look like ....
So if you still have fastboot flash the pt.blob will give you these partition back ....
After you flash the pt.blob boot back into recovery and run the same command and see it matches mine ...
Thx Josh

lj50036 said:
Code:
major minor #blocks name
179 0 31039488 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 28924416 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 8192 mmcblk0p10
179 32 2048 mmcblk0boot1
179 16 2048 mmcblk0boot0
That is what it should look like ....
So if you still have fastboot flash the pt.blob will give you these partition back ....
After you flash the pt.blob boot back into recovery and run the same command and see it matches mine ...
Thx Josh
Click to expand...
Click to collapse
Thank you so much lj50036!
Looks like correcting the partitions did the trick. After flashing the file, I managed to flash the ROM successfully.
All is good now, thank you all!

razgrizpr said:
Thank you so much lj50036!
Looks like correcting the partitions did the trick. After flashing the file, I managed to flash the ROM successfully.
All is good now, thank you all!
Click to expand...
Click to collapse
Great to see you up and running ....
Can you add 'SOLVED' to the thread tittle ...... :good:
Thx Josh

[Fixed][Q] possible permanent soft-brick tf700t

So, I just managed to get the Bootloader unlocked, flashed CWRM and then accidentally hit the factory reset button from the system settings menu, and am now stuck in the reset recovery screen.
I have access to adb but not fastboot. I have not done anything with NVFLASH
Am I permanently screwed for this motherboard or can I still be recovered?
ls -l /dev/block/mmc*
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
brw------- 1 root root 179, 0 Aug 29 02:23 /dev/block/mmcblk0
brw------- 1 root root 179, 16 Aug 29 02:23 /dev/block/mmcblk0boot0
brw------- 1 root root 179, 32 Aug 29 02:23 /dev/block/mmcblk0boot1
brw------- 1 root root 179, 1 Aug 29 02:23 /dev/block/mmcblk0p1
brw------- 1 root root 179, 10 Aug 29 02:23 /dev/block/mmcblk0p10
brw------- 1 root root 179, 2 Aug 29 02:23 /dev/block/mmcblk0p2
brw-rw---- 1 root system 179, 3 Aug 29 02:23 /dev/block/mmcblk0p3
brw-rw---- 1 root system 179, 4 Aug 29 02:23 /dev/block/mmcblk0p4
brw------- 1 root root 179, 5 Aug 29 02:23 /dev/block/mmcblk0p5
brw------- 1 drm drm 179, 6 Aug 29 02:23 /dev/block/mmcblk0p6
brw-rw---- 1 root system 179, 7 Aug 29 02:23 /dev/block/mmcblk0p7
brw------- 1 root root 179, 8 Aug 29 02:23 /dev/block/mmcblk0p8
brw------- 1 root root 179, 9 Aug 29 02:23 /dev/block/mmcblk0p9
Click to expand...
Click to collapse

Code:
adb shell
~ #cd sys
/sys # ls
ls
block class devices fs module tf_driver
bus dev firmware kernel power
/sys #cd block
/sys/block # ls
ls
loop0 loop2 loop4 loop6 mmcblk0 mmcblk0boot1
loop1 loop3 loop5 loop7 mmcblk0boot0 zram0
can I use this to edit something and unbrick?

Stephenopolos said:
Code:
adb shell
~ #cd sys
/sys # ls
ls
block class devices fs module tf_driver
bus dev firmware kernel power
/sys #cd block
/sys/block # ls
ls
loop0 loop2 loop4 loop6 mmcblk0 mmcblk0boot1
loop1 loop3 loop5 loop7 mmcblk0boot0 zram0
can I use this to edit something and unbrick?
Click to expand...
Click to collapse
If you reboot by long pressing the power button, does it boot straight back to recovery?
If so you can try these commands to clear the Wipe Data command from the misc partition:
Code:
adb shell
dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=64 count=1
reboot
Good luck!

Thanks for the quick response. Yes it does drop immediately into the recovery/reset wipe data screen on reboot.
It's pretty late and I want to avoid making any mistakes in typing commands so I'm going to try that in the morning.
Also, while i'm not the best at the command line side, I am comfortable opening things up, so if it doesn't work I'm not entirely opposed to just buying a replacement MB and swapping it out. Hopefully it'll work though.

Stephenopolos said:
Thanks for the quick response. Yes it does drop immediately into the recovery/reset wipe data screen on reboot.
It's pretty late and I want to avoid making any mistakes in typing commands so I'm going to try that in the morning.
Also, while i'm not the best at the command line side, I am comfortable opening things up, so if it doesn't work I'm not entirely opposed to just buying a replacement MB and swapping it out. Hopefully it'll work though.
Click to expand...
Click to collapse
If you use Wipe Data from the bootloader or the Factory reset from Settings a command gets written to misc to start the recovery and wipe data.
Problem is, custom recoveries don't really "get" the command and do not execute it so the command does not get erased from misc and you're stuck in booting to recovery because the bootloader executes that command on each boot.
If your recovery is CWM you can try just leaving it on the wipe data screen for a few hours. With past CWM versions that usually worked and it eventually finished the wipe. Not with TWRP though.
Connect the tab to power and leave it on the wipe data screen until tomorrow. Then you can still try to clear the command with dd.
Copy and paste it. You don't want to have any typos with a dd command...

berndblb said:
Problem is, custom recoveries don't really "get" the command
Click to expand...
Click to collapse
Only if your recovery kernel is too old to work with the bootloader, in which case it can't access any partitions.
berndblb said:
If your recovery is CWM you can try just leaving it on the wipe data screen for a few hours. With past CWM versions that usually worked and it eventually finished the wipe. Not with TWRP though.
Click to expand...
Click to collapse
TWRP should do its "Factory Reset" (which doesn't clear /sdcard). I've never tried it because I don't want to restore everything from a backup.

ran command this morning, and it hung in the shell... just sits there without finishing the command.
frustrating... I thought i'd read everything and triple read it again, but the main thread for custom recoveries for this tablet, didn't really mention anything about avoiding factory reset from device.
oh well. found a MB on ebay cheap i'll try the command again in a bit and if it doesn't work then next week i'll be installing a mb myself.
Code:
adb shell dd if=/dev/zero of=/dev/block/mmcblk0p3 bs=64 count=1
1+0 records in
1+0 records out
64 bytes (64B) copied, 402.164494 seconds, 0B/s
I'm assuming this means success...
will see in a bit... tablet is now claiming it has a low battery after I told it to reboot.

Hallelujah! it worked! berndblb You're my new favorite person in the world today.

_that said:
Only if your recovery kernel is too old to work with the bootloader, in which case it can't access any partitions.
TWRP should do its "Factory Reset" (which doesn't clear /sdcard). I've never tried it because I don't want to restore everything from a backup.
Click to expand...
Click to collapse
I have never tried it either. Just seen users reporting that with CWM installed the command eventually went through if you left it alone long enough. That doesn't seem to work with TWRP. But that's just hearsay....
Stephenopolos said:
Hallelujah! it worked! berndblb You're my new favorite person in the world today.
Click to expand...
Click to collapse
Very good!
But you have to thank @_that ^^^ for the command. He's the one I stole it from

berndblb said:
I have never tried it either. Just seen users reporting that with CWM installed the command eventually went through if you left it alone long enough. That doesn't seem to work with TWRP. But that's just hearsay....
Very good!
But you have to thank @_that ^^^ for the command. He's the one I stole it from
Click to expand...
Click to collapse
... you got to me first though...
Anyway, I had difficulty getting CM11 and CM12 to install eventually managed to get zombipop to install by dropping it onto a USB stick and using the keyboard dock. Had to flash a new recovery image as well.. apparently the one I put on there the first time around was screwy.

Stephenopolos said:
... you got to me first though...
Anyway, I had difficulty getting CM11 and CM12 to install eventually managed to get zombipop to install by dropping it onto a USB stick and using the keyboard dock. Had to flash a new recovery image as well.. apparently the one I put on there the first time around was screwy.
Click to expand...
Click to collapse
Luck for you that I was here first. _that would have made you pull all kinds of logs before giving you the same command :laugh: :cyclops:

berndblb said:
Luck for you that I was here first. _that would have made you pull all kinds of logs before giving you the same command :laugh: :cyclops:
Click to expand...
Click to collapse
The required logs in this case are already in the OP. But thank you for taking over first level support.

[ROM][STOCK][Silent OS 2.0.8 RC4] Blackphone 2

I am sharing a full stock ROM for SGP BP2 (Blackphone 2) which I got directly from Silent Circle support.
This ROM is not rooted because it's original, would be awesome if someone will be able to root it before i do that
Kernel: 3.10.49-gc6cf2ab
OS: Silent OS 2.0.8 RC4
Based on: Android Lollipop 5.1.1 (r1) and contains some Cyanogenmod files.
AOSP build: LMY47V
AOSP branch: android-5.1.1_r1
Here is a Google Drive folder with ROM files: https://drive.google.com/open?id=0BybUUdJE1dSZeUkxbE8wZUEtcHc
Folder contents:
BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
This is a full stock ROM for models that contain letters 'RW' in their model name.
Example: BP2H001RW1 - letters "RW" indicate you should use that .zip
RW (ROW) means 'Rest of World'.
build.prop contents: http://paste.debian.net/901606/
BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip
This is a full stock ROM for models that contain letters 'NA' and 'AM' in their model name.
Example: BP2H001AM1 - letters "AM" indicate you should use that .zip
NA means 'North America', AM means 'America'; probably the models being sold in that region are slightly different.
build.prop contents: http://paste.debian.net/901680/
boot.img
I've extracted 'boot.img' from the .zip and uploaded aside, in case someone is looking only for kernel and initrd.
boot.img is same in both NA and ROW roms.
recovery.img
It's a stock android recovery image, I've got it with dd after flashing the BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
md5sum:
Code:
afb4c7a26608d113b1b54da167fc0255 BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip
180021957910afc484c76f4a2246c491 BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
9e42e33b39244e8bfa6f250424c15270 boot.img
9c872f08f69a2b6cad93214c1089b03d recovery.img
sha1sum:
Code:
8164772318414d49389168495f732afb46467c1c BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip
14010e518725146a8ebe52caf4723be4c69c3c9a BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
a9bf9ce0a6f5b31860e228464fd3abbd9f232a57 boot.img
c76ea5c0ca330bf6dc2191d9db0bead1cac6d4c7 recovery.img
Known issues
Device name case mismatch ('bp2' vs 'BP2')
I wasn't able to reflash my device without modifying one file in a .zip
It may give you this error when you start updating:
Code:
This package is for "BP2" devices; this is a "bp2".
In that case you need to:
1) unpack a .zip file
2) find the file updater-script in the META-INF/com/google/android/ folder, which looks like:
PHP:
get_device_compatible("BP2") == "OK" || abort("This package is for \"BP2\" devices; this is a \"" + getprop("ro.product.device") + "\".");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
show_progress(0.200000, 10);
3) change the letters 'BP2' to 'bp2', so the first line will look like this:
PHP:
get_device_compatible("bp2") == "OK" || abort("This package is for \"BP2\" devices; this is a \"" + getprop("ro.product.device") + "\".");
4) Pack everything back into a .zip file
5) Apply the update using a new .zip file using stock recovery.
System image format
If you have a TWRP recovery instead of stock, you won't be able to flash the ROM from .zip (for some unknown reason it just doesn't flash a system partition)
You will need to extract the ROM .zip and use sdat2img tool to convert lollipop's system.new.dat format to system.img (raw format), after that you can flash system.img directly using TWRP or dd.
Follow this manual for Linux: http://forum.xda-developers.com/showpost.php?p=57635842&postcount=2
For Windows: http://forum.xda-developers.com/android/help/extract-dat-marshmallow-lollipop-easily-t3334117
Alternatively, you can flash stock recovery.img that I listed above, boot it and flash .zip from it directly.
Mounting /system with read-write using TWRP causes a bootloop
Thread: http://forum.xda-developers.com/android/help/blackphone-2-bootloop-rw-mount-using-t3516862
Security vulnerabilities
This ROM is vulnerable for these attacks according to QuadRooter Scanner:
CVE-2016-2059 - "QuadRooter"
CVE-2016-2504 - Elevation of privilege vulnerability in Qualcomm GPU driver
You may need to upgrade to the latest Silent OS version using OTA updater in order to mitigate these.
On the other hand, you may root your device using one of these vulns before upgrading, whether there is a root method that using QuadRooter exploit (I believe there will be one soon).
Oh c'mon Silent Circle, you made it annoying, just let us use root privileges peacefully, we are aware of damn risks!
Useful information
/proc/mounts
Code:
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,size=1481408k,nr_inodes=182626,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
none /var tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=770,gid=1000 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
/dev/block/dm-0 /system ext4 ro,seclabel,relatime,discard,data=ordered 0 0
/dev/block/bootdevice/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/dev/block/bootdevice/by-name/persist /persist ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/dev/block/bootdevice/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/vold/179:65 /mnt/media_rw/sdcard1 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/block/dm-1 /data ext4 rw,seclabel,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/proc/partitions
Code:
major minor #blocks name
179 0 30539776 mmcblk0
179 1 512 mmcblk0p1
179 2 512 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 512 mmcblk0p8
179 9 512 mmcblk0p9
179 10 512 mmcblk0p10
179 11 1024 mmcblk0p11
179 12 1024 mmcblk0p12
179 13 1536 mmcblk0p13
179 14 1536 mmcblk0p14
179 15 1 mmcblk0p15
179 16 8 mmcblk0p16
179 17 10240 mmcblk0p17
179 18 10240 mmcblk0p18
179 19 65536 mmcblk0p19
179 20 32 mmcblk0p20
179 21 65536 mmcblk0p21
179 22 1536 mmcblk0p22
179 23 16 mmcblk0p23
179 24 32768 mmcblk0p24
179 25 1966080 mmcblk0p25
179 26 32768 mmcblk0p26
179 27 917504 mmcblk0p27
179 28 32768 mmcblk0p28
179 29 1024 mmcblk0p29
179 30 512 mmcblk0p30
179 31 512 mmcblk0p31
259 0 32 mmcblk0p32
259 1 27162575 mmcblk0p33
179 32 4096 mmcblk0rpmb
179 64 3855360 mmcblk1
179 65 3851264 mmcblk1p1
254 0 1950564 dm-0
254 1 27162575 dm-1

This is great

drivers for blackphone 2
I recently purchased a blackphone2. IT had TWRP recovery installed and some version of lollypop and the phone was not rooted. I tried to install the stock rom which the silent circle supplied. But while flashing through TWRP it always generated error 6 or 7. I even tried OS 1 and 2 all gave the same error. Then I saw the info from your thread. I flashed the stock recovery and was successful in flashing it however the stock rom installation always get stuck at "patching system image unconditionally". One more thing my blackphone is not recognized by any PC. May be I do not have the drivers. I think I had to flash the boot.image file also which I missed . Now stuck in the stock recovery how can I flash the boot image file, whereas I dont have the usb drivers also. Please help.
mansoor

cmegmhi said:
[...]
I flashed the stock recovery and was successful in flashing it however the stock rom installation always get stuck at "patching system image unconditionally".
Click to expand...
Click to collapse
A "patching system image unconditionally" step may take some time because it's extracting a big image.
Can you try flashing one of .zip's from the google folder I published in this thread using a stock recovery?
Also, make sure you do "wipe data/factory reset" and "wipe cache partition" before flashing the .zip
Also, you can use a 'reboot to bootloader' option and boot or flash any image using fastboot
In order to get your phone recognized via USB, you need adb and fastboot installed on your computer and the appropriate drivers, search this forum to get HOW-TO's on that, there are many.

polartux said:
A "patching system image unconditionally" step may take some time because it's extracting a big image.
Can you try flashing one of .zip's from the google folder I published in this thread using a stock recovery?
Also, make sure you do "wipe data/factory reset" and "wipe cache partition" before flashing the .zip
Also, you can use a 'reboot to bootloader' option and boot or flash any image using fastboot
In order to get your phone recognized via USB, you need adb and fastboot installed on your computer and the appropriate drivers, search this forum to get HOW-TO's on that, there are many.
Click to expand...
Click to collapse
I have flashed the boot image as well as the recovery image from the above mentioned links. However from the recovery as I said earlier system flashing using the zip file does not complete and stuck for ever. I can boot to bootloader through recovery but how to flash the image file of rom as I have the zip file. How can I convert the zip file to image file. Any idea
A bundle of thanks for the help

cmegmhi said:
I have flashed the boot image as well as the recovery image from the above mentioned links. However from the recovery as I said earlier system flashing using the zip file does not complete and stuck for ever. I can boot to bootloader through recovery but how to flash the image file of rom as I have the zip file. How can I convert the zip file to image file. Any idea
A bundle of thanks for the help
Click to expand...
Click to collapse
The ROM posted above occupies more than 1.7 GB in the system partition, whereas the system partition I got on my phone is around 1.48 GB. Could this be the reason for the phone to get stuck during the rom installation "patching the system image unconditionally". If so the way out could be the resizing of the system partition. Based on this idea I have been looking around on the internet for a system resizing app for blackphone 2 without any success. Please guide me in this matter
Thanks in advance

How to Verifty Which One is letters "RW" Or 'NA' and 'AM'

I have unlocked bootloader and phone in bootloop no way to rescue it? bootloader and recovery works)
I have twrp and unlocked bootloader
how I do this? "sdat2img tool to convert lollipop's system.new.dat format to system.img"

How to root this phone and remove google apps? Many thanks

You probably should just flash a new rom and start over?

Silent OS 3.0.8 update disables cellular network in Blackphone 2 (unlicensed device)
Blackphone 2 not bought from Silent Circle or an approved vendor of Silent Circle will become an unlicensed device
after installation of Silent OS 3.0.8.
I bought my phone from coolicool.com. Cellular network connections didn't work after the update.
I contacted Silent Circle's support but they didn't want to help me because the phone was bought from
a non-approved vendor.
This Android 5.1.1 ROM re-enabled the cellular connectivity in my phone. Thank you!

Silent Circle will become an unlicensed device
I'm in the same case as you. At least I have a phone again, although the version of android is older.
Thanks!!!
akikoo said:
Blackphone 2 not bought from Silent Circle or an approved vendor of Silent Circle will become an unlicensed device
after installation of Silent OS 3.0.8.
I bought my phone from coolicool.com. Cellular network connections didn't work after the update.
I contacted Silent Circle's support but they didn't want to help me because the phone was bought from
a non-approved vendor.
This Android 5.1.1 ROM re-enabled the cellular connectivity in my phone. Thank you!
Click to expand...
Click to collapse

akikoo said:
Blackphone 2 not bought from Silent Circle or an approved vendor of Silent Circle will become an unlicensed device
after installation of Silent OS 3.0.8.
I bought my phone from coolicool.com. Cellular network connections didn't work after the update.
I contacted Silent Circle's support but they didn't want to help me because the phone was bought from
a non-approved vendor.
This Android 5.1.1 ROM re-enabled the cellular connectivity in my phone. Thank you!
Click to expand...
Click to collapse
Yeah me too, bought from an online store in Malaysia. Not only they disabled the SIM module, also ALL GOOGLE SERVICES as well..
This sucks so bad....

Silent Circle support's reply
Here's the reply I got from Silent Circle's support. I sent them the serial number and IMEI of the phone.
Like the online shop would be able to do anything for the f*cking OTA update...
------------------------------------------------------------------------------------------------------------------------------------------
Hello,
Upon review of the IMEI number (XXXXXXXXXXXXXXX) you provided, it has been determined this device
is not a genuine Silent Circle Blackphone2. This device was not sold by Silent Circle or
an approved vendor of Silent Circle and therefore we are unable to provide any further assistance.
We recommend you contact the original vendor directly for further assistance.
To purchase a Silent Circle genuine device please visit the following URL:
Sincerely,
Silent Circle Technical Support
------------------------------------------------------------------------------------------------------------------------------------------

Hello, I bought this phone from myefox and I'm waiting. So if I followed the upgrade I lose all network functionality ?. Or the phone can still work?

bastard81 said:
Hello, I bought this phone from myefox and I'm waiting. So if I followed the upgrade I lose all network functionality ?. Or the phone can still work?
Click to expand...
Click to collapse
When I first received the phone, OTA upgraded the phone to Silent OS 3.0.7, everything works fine.
Just don't go to 3.0.8
---------- Post added at 01:52 PM ---------- Previous post was at 01:27 PM ----------
akikoo said:
Here's the reply I got from Silent Circle's support. I sent them the serial number and IMEI of the phone.
Like the online shop would be able to do anything for the f*cking OTA update...
------------------------------------------------------------------------------------------------------------------------------------------
Hello,
Upon review of the IMEI number (XXXXXXXXXXXXXXX) you provided, it has been determined this device
is not a genuine Silent Circle Blackphone2. This device was not sold by Silent Circle or
an approved vendor of Silent Circle and therefore we are unable to provide any further assistance.
We recommend you contact the original vendor directly for further assistance.
To purchase a Silent Circle genuine device please visit the following URL:
Sincerely,
Silent Circle Technical Support
------------------------------------------------------------------------------------------------------------------------------------------
Click to expand...
Click to collapse
It's kinda sad and frustrating that this kind of attitude exist, I mean, c'mon.. How can you say it's not genuine???
It's obviously GENUINE SILENT CIRCLE BLACK PHONE 2! It's just that it someone else got their hands on the stock and sell it!
PLUS, I bet Silent Circle themself leaked out the so-called "unlicensed" devices to test the market.
That explains why there weren't any "license checking" prior to version 3.0.8!!
Good thing there's the stock ROM, and I bought the phone cheap around USD 130.

Any idiot would know! how can an original blackphone listed on their SC's website at $600 still, be sold at $130? furthermore, this is through chinese website, sending you from china.
---------- Post added at 04:01 PM ---------- Previous post was at 03:49 PM ----------
Btw, coolicool and efox. they are the same owner from china!

...
...

akikoo said:
Blackphone 2 not bought from Silent Circle or an approved vendor of Silent Circle will become an unlicensed device
after installation of Silent OS 3.0.8.
I bought my phone from coolicool.com. Cellular network connections didn't work after the update.
I contacted Silent Circle's support but they didn't want to help me because the phone was bought from
a non-approved vendor.
This Android 5.1.1 ROM re-enabled the cellular connectivity in my phone. Thank you!
Click to expand...
Click to collapse
That's what i went so... I bought my phone from antelife.com.
How to install this ROM? Someone please describe step by step! Thanks!

How to install the Android 5.1 update rom from this thread
kovikee said:
That's what i went so... I bought my phone from antelife.com.
How to install this ROM? Someone please describe step by step! Thanks!
Click to expand...
Click to collapse
Copy the zip file BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip from the first post to your sd card. I renamed it to update.zip.
Power off your phone.
Put the sd card into the sd card/sim card tray.
Press volume up and power button until your phone turns on. Keep the volume up button pressed down until you land in the recovery menu. From there you can select the menu entry that says something like apply update from sd card.

[TUT] ROOT HD10 (2017), HD8(2016-2017) - EASY SuperSu

Update - March 23rd, 2019.
There is now an excellent offline rooting method for HD10 (2017), HD8(2016-2018), all current FireOS versions, thanks to the fantastic effort by @diplomatic - link. This new root is obtained within a few seconds, so it is very fast. To install permanent root after mtk-su for HD10 (2017), HD8 (2016-2017), use the scripts by @Rortiz2 in here: v2.1, or v1.0 (see this link for a Linux script). For HD8 (2018), there is a dedicated full bootloader unlocking and permanent root guide - link. For HD10 (2017) there is also a full bootloader unlocking procedure available - link. The historical Kingoroot rooting procedure for HD10 (2017) is below. As a friendly reminder, once you have a root shell (obtained by any means), ensure that you disable OTA updates as to avoid getting an unrootable update (except for HD8 (2018) - do not run the commands below before you unlock the bootloader!!!):
Code:
mount -w -o remount /system
mv /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk_
ls -l /system/priv-app/DeviceSoftwareOTA/
The original Kingoroot method for HD10 (2017), all current FireOS versions - EASY SuperSu
Update v0.9, 12/29/18 As empasized by shonkin in this post, the method still works for FireOS 5.6.3.4. Enjoy!!! I would never have expected the hole to last his long ...
Update v0.8, 01/26/18 - as first reported by @najoor in this post, FireOS 5.6.0.1 is rootable! Today I verified this myself after a somewhat unsuccessful FlashFire update.
Update v0.7, 01/14/18 - @freaky2xd made a video with these rooting instructions, please follow it if you prefer a visual guide (here or here)
Update v0.6, 01/09/18 - there were reports that dr.fone app seems to be able to root the device as well. I took dr.fone for a spin, and based on its bloatedness and a few other annoying features, my personal recommendation is that you stick with the devil we know - Kingoroot (link)
Update v0.5, 01/04/18 - add a DOS bat file to remove any possible updates to Amazon packages
Update v0.4, 01/02/18 - title update
Update v0.3, 12/31/17 - light clean up; I got into a bootloop, and had to sideload a stock ROM & re-root - a.k.a. "eat my own dogfood" - Everything works fine.
Update v0.2, 12/30/17 - some redundant commands are removed.
Update v0.1, 12/30/17 - the rooting procedure is essentially taken from @retyre (here and here). Except, the instructions below include a lot of details, and handle mostly everything from the PC/ADB side. Try, and report back. GOOD LUCK!
Here is the guide to the painless root (while out of the box FireOS allows it; right now all FireOS versions up to and including 5.6.0.1 - the current OTA - are rootable). The key enabler is the original post by @ztrund (link), great work blazing the trail (and motivating me to get another Fire tablet ASAP, LOL).
Given that the devices will be shipping with the (older) rootable FireOS for the next few months (but beware of the upcoming updates - see below !!!), there is a good window of opportunity to acquire a rootable Fire HD 10, and root it. As of Dec 27th 2017, there are no reports yet of non-rootable OTAs, but those OTAs will be coming soon, count on it!
The utmost goal here is to preserve the earliest FireOS version that you get, and not let it get updated by Amazon on a whim.
I am starting with a recently bought Fire HD 10 2017 (light refurb from eBay, missed the Black Friday mega sale ). I have FireOS 5.5.0.0 (earlier than 5.6.0.0!), version name 5.3.5.1 (591450020)
Part I (avoiding Amazon updating procedure upon the initial Fire setup) - this can (almost safely) be skipped today (end of Dec, 2017), since there are no reports of unrootable OTAs yet
Low tech way (thanks to @Blaiser47 and @retyre for suggestions!):
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Choose any option on that WiFi screen, press cancel, and then skip
Once Alexa shows up, swipe down from the top, turn on Airplane mode just to be sure
High tech way:
Set up a dedicated slow router, limit upload/download speed to ~25 kbps (this is the trickiest part, I have a dedicated Tomato router which I use to control traffic)
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Connect Fire to your slow router
Once Fire finds Internet, it'll immediately have "Checking for updates" on the screen, this is where the slow router should kick in, and do the trick of forcing the update to give up
Wait a bit for updates, hopefully, it won't find them, if found something, do factory reset, and repeat (on my 1st try it did find the update, although, could not download it quickly enough, I did a factory reset via Pwr&Vol+ recovery mode, and tried again - the 2nd time it skipped the update due to the slowness of the connection)
Sign in to Amazon account when prompted
Once Alexa shows up, swipe down from the top, turn on Airplane mode - no more risk of updates!!!
Part II (rooting via Kingoroot, disabling OTA, and getting SuperSu replacement, as per @retyre recommendations)
Take your Fire HD as is, do not do anything dramatic such as "factory reset", Amazon ROM sideloading, etc
Swipe down from the top, turn on Airplane mode - to ensure that there are no OTA updates during the procedure
In "Settings/Device Options", tap "Serial Number" 7 times, a menu "Developer Options" will appear
In "Settings/Device Options/Developer Options", turn ADB debugging to ON (under "Debugging")
In "Settings/Security", turn "Apps from Unknown Sources" to ON
Download ADB to your PC (link)
Setup ADB drivers on your PC, connect Fire to your PC, make sure "adb devices" command shows your Fire device, authorize ADB connection on Fire
Download SuperSu 2.79 (this exact version!!!) to your PC from this link, place it into your ADB PC folder. The filename of this apk will be assumed to be SuperSU-v2.79-20161205182033.apk below
Download the attached su64.zip to your PC (see the attachment below), unzip to your ADB PC folder
Open a CMD window in ADB PC folder (this will be called ADB_cmd window in the following steps), type
Code:
adb devices
adb uninstall eu.chainfire.supersu
This is a clean up of possible old SuperSu (just in case), ignore any errors you may get (if SuperSu is absent ...)
Download Kingoroot to your PC (link), install, let it update
Connect Fire to your PC; launch Kingoroot on PC; before pushing the big "ROOT" button in Kingoroot, uncheck a small box in the lower left corner for "Install recommended app" ; push "ROOT" button; wait for Kingoroot to root
Once Kingoroot succeeds, open a 2nd CMD window in ADB PC folder to your Fire (this will be called ADB_root window in the following steps), get a root shell, and disable OTA updates
Code:
adb shell
su
mount -w -o remount /system
mv /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk_
ls -l /system/priv-app/DeviceSoftwareOTA/
ignore any errors you may get while doing this; after 'su', you should see root (#) prompt here
Switch to the first ADB_cmd window, type
Code:
adb uninstall com.lionmobi.powerclean
adb uninstall com.kingoapp.link
adb uninstall kingoroot.supersu
adb install SuperSU-v2.79-20161205182033.apk
adb shell "am start -n eu.chainfire.supersu/eu.chainfire.supersu.MainActivity"
Skip this step - it is not needed
Switch to the second ADB_root window (with # prompt), type
Code:
cd /data/local/tmp
mount -w -o remount /system
cp ./su64 /system/xbin/daemonsu
chmod 0755 /system/xbin/daemonsu
daemonsu -d &
cp ./su64 /system/xbin/su
chmod 0755 /system/xbin/su
am start -n eu.chainfire.supersu/eu.chainfire.supersu.MainActivity
On your Fire, SuperSu should pop up. Update SuperSu binary as "Normal", it should report "Installation failed." Proceed to reboot. (If it doesn't report an outcome ("failed") in a couple of minutes, go to the Fire's Apps and force-stop SuperSU and retry.)
Upon reboot, SuperSU should be functional. Choose "Grant" as the default access.
Uninstall all the junk from Kingoroot on your Fire, thanks to @fstanis for detailed instructions (copied here, executed from PC):
Code:
adb uninstall com.nemo.vidmate
adb shell rm -rf /sdcard/VidMate
adb shell rm -rf /sdcard/.a
adb shell rm -rf /sdcard/.DataStorage
adb shell rm -rf /sdcard/.UTSystemConfig
Some troubleshooting options:
If you believe you have the correct FireOS, but Kingoroot (or SuperSu) still fail, download the attached no_amzn_updates.zip to your PC, unzip to your ADB PC folder, open a CMD window in ADB PC folder, and type
Code:
.\no_amzn_updates.bat
The script will attempt to uninstall any apk updates to the official Amazon packages. Then repeat the rooting procedure from Step 1 skipping as necessary. See this post for more additional info on what the script does.
If you mess up your /system too much and get into a bootloop with "Fire" logo - use this post for links to the official Amazon ROM files; these bin's can be sideloaded via "adb sideload" in recovery
Want to say thanks by clicking the "Thanks" button ?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Fire HD 10 ROM links & misc :
Update: Uploaded modified Supersu 2.82 SR5 ready to be flashed in FlashFire. It really represents the Chainfire's swan song, the last of the true SuperSu versions, the end of the era !!!
Fire HD 10 (7th Gen 2017) ROM links from Amazon (use for sideloading your preferred version in case you mess up). If possible, turn off WiFi before sideloading a bin file - you don't want to catch an OTA while it's loading!
FireOS 5.6.3.0 (reports say that it's still rootable, the downgrade behavior is not clear)
update-kindle-suez-40.6.2.6_user_626533320.bin
update-kindle-40.6.2.6_user_626533320.bin
FireOS 5.6.2.0 (still rootable, but cannot be downgraded to anything earlier!)
update-kindle-40.6.1.2_user_612495820.bin
FireOS 5.6.1.0 (still rootable, but cannot be downgraded to anything earlier!)
update-kindle-40.6.0.5_user_605485120.bin
System image (restore via FlashFire) link. Unzip files to /sdcard/FlashFire/Backups/5.6.1.0, rename the 2 img to bin extensions. Create md5 sum files (in a shell, type "md5 system.bin > system.md5", same for boot.bin) The system image includes SuperSu, Xposed, Busybox; OTA apk is NOT renamed.
FireOS 5.6.0.1
update-kindle-40.5.9.5_user_595550320.bin
System image (restore via FlashFire v0.24) - link. Unzip files to /sdcard/FlashFire/Backups/5.6.0.1. The system image includes SuperSu, Xposed, Busybox; OTA apk is renamed.
FireOS 5.6.0.0
update-kindle-40.5.9.5_user_595457320.bin
FireOS 5.6.0.0
update-kindle-40.5.9.5_user_595457020.bin
FireOS 5.5.0.0
update-kindle-40.5.9.1_user_591450020.bin
In addition, please find attach a SuperSu zip that works with Flash Fire v0.24 (tested with FireOS 5.5.0.0 & 5.6.0.0).
The file was created by taking SuperSu v2.82 zip from this link (file name - SuperSU-v2.82-201705271822.zip).
Then in META-INF\com\google\android\update-binary I replaced one line forcing SuperSu to install armv7 binaries instead of arm64:
Code:
if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=arm64; SYSTEMLIB=/system/lib64; APPPROCESS64=true; fi;
with this one:
Code:
if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=armv7; fi;
Everything else is identical to the official version.
Using the official SuperSu zip will cause a bootloop - it looks like Fire HD 10 is not quite arm64 yet, and needs armv7 version of su binaries to work.

Useful tips & information:
How to install Xposed & Flashfire for easy backups and ROM updates
Follow this post by @retyre (and thank him!!!): link
Note: With stock FlashFire versions, the latest Flashfire version you can use is v0.24 (see the attached v0.24 apk, it needs the date patch which requires Xposed installed). Alternatively, it is possible to replace a library in Flashfire v0.51, and make v0.51 work:
link1
link2
link3
For convenience, I've done this procedure to the free FlashFire v.51 version using free apktool, and attached the file below (the signature will not match with the original FlashFire signed by @Chainfire, so you will need to uninstall other FlashFire packages before installing this one!)
With v0.51, uncheck two options (as per link2):
1) Emulate framebuffer in Settings
2) Mount /system read/write (after you choose the update file).
If you don't do 2), Flashfire v.51 will just sit there and never do anything
How to enable Amazon packages (apk) updates but prevent the ROM updates (keeping root & rootable rom).
1) Edit /system/build.prop and change ro.build.version.number to have "9" as the first value instead of "5", as recommended in this link
2) Reboot
3) Enable OTA by ensuring that /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk is renamed back to apk from apk_
4) Reboot
At this point the Fire will download a lot of apk packages, and will update Amazon system components (keeping FireOS version the same).
Partition trivia:
Partition info (gdisk binary) :
Code:
[email protected]:/ # df
df
Filesystem Size Used Free Blksize
/dev 907.7M 80.0K 907.6M 4096
/dev/logd 512.0K 96.0K 416.0K 4096
/sys/fs/cgroup 907.7M 12.0K 907.7M 4096
/mnt/asec 907.7M 0.0K 907.7M 4096
/mnt/obb 907.7M 0.0K 907.7M 4096
/system 1.5G 1.2G 317.9M 4096
/data 26.5G 1.1G 25.4G 4096
/data/metrics 5.8M 232.0K 5.6M 4096
/cache 410.7M 14.9M 395.8M 4096
/mnt/sqfs 79.8M 79.8M 0.0K 32768
/mnt/cd-rom 1.2M 1.2M 0.0K 2048
/mnt/shell/emulated 26.5G 1.1G 25.4G 4096
/storage/emulated 907.7M 0.0K 907.7M 4096
/storage/emulated/0 26.5G 1.1G 25.4G 4096
/storage/emulated/0/Android/obb 26.5G 1.1G 25.4G 4096
/storage/emulated/legacy 26.5G 1.1G 25.4G 4096
/storage/emulated/legacy/Android/obb 26.5G 1.1G 25.4G 4096
[email protected]:/data/local/tmp # ./gdisk -l /dev/block/mmcblk0
./gdisk -l /dev/block/mmcblk0
GPT fdisk (gdisk) version 0.8.4
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/block/mmcblk0: 61071360 sectors, 29.1 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): B1541C10-343E-474B-B5B2-05796C64E992
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 61071326
Partitions will be aligned on 1024-sector boundaries
Total free space is 990 sectors (495.0 KiB)
Number Start (sector) End (sector) Size Code Name
1 1024 7167 3.0 MiB 8300 proinfo
2 7168 16383 4.5 MiB 8300 PMT
3 16384 18431 1024.0 KiB 8300 kb
4 18432 20479 1024.0 KiB 8300 dkb
5 20480 22527 1024.0 KiB 8300 lk
6 22528 32767 5.0 MiB 8300 tee1
7 32768 43007 5.0 MiB 8300 tee2
8 43008 123903 39.5 MiB 8300 metadata
9 123904 124927 512.0 KiB 8300 MISC
10 124928 141311 8.0 MiB 8300 reserved
11 141312 174079 16.0 MiB 8300 boot
12 174080 208895 17.0 MiB 8300 recovery
13 208896 3515391 1.6 GiB 8300 system
14 3515392 4383743 424.0 MiB 8300 cache
15 4383744 61071326 27.0 GiB 8300 userdata
[email protected]:/ # cat /proc/partitions
cat /proc/partitions
major minor #blocks name
7 0 81664 loop0
7 1 1254 loop1
7 2 10240 loop2
179 0 30535680 mmcblk0
179 1 3072 mmcblk0p1
179 2 4608 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 5120 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 40448 mmcblk0p8
179 9 512 mmcblk0p9
179 10 8192 mmcblk0p10
179 11 16384 mmcblk0p11
179 12 17408 mmcblk0p12
179 13 1653248 mmcblk0p13
179 14 434176 mmcblk0p14
179 15 28343791 mmcblk0p15
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 1024 mmcblk0boot0
179 33 2 mmcblk0boot0p1
179 34 2 mmcblk0boot0p2
179 35 256 mmcblk0boot0p3
179 36 747 mmcblk0boot0p4
[email protected]:/ # ls -l /dev/block
ls -l /dev/block
brw------- root root 7, 0 2017-12-28 11:05 loop0
brw------- root root 7, 1 2017-12-28 11:05 loop1
brw------- root root 7, 2 2017-12-28 11:05 loop2
brw------- root root 7, 3 2017-12-28 11:05 loop3
brw------- root root 7, 4 2017-12-28 11:05 loop4
brw------- root root 7, 5 2017-12-28 11:05 loop5
brw------- root root 7, 6 2017-12-28 11:05 loop6
brw------- root root 7, 7 2017-12-28 11:05 loop7
brw-rw---- root system 179, 0 2017-12-28 11:05 mmcblk0
brw-rw---- root system 179, 32 2017-12-28 11:05 mmcblk0boot0
brw------- root root 179, 33 2017-12-28 11:05 mmcblk0boot0p1
brw------- root root 179, 34 2017-12-28 11:05 mmcblk0boot0p2
brw------- root root 179, 35 2017-12-28 11:05 mmcblk0boot0p3
brw------- root root 179, 36 2017-12-28 11:05 mmcblk0boot0p4
brw-rw---- root system 179, 64 2017-12-28 11:05 mmcblk0boot1
brw------- root root 179, 1 2017-12-28 11:05 mmcblk0p1
brw------- root root 179, 10 2017-12-28 11:05 mmcblk0p10
brw------- root root 179, 11 2017-12-28 11:05 mmcblk0p11
brw------- root root 179, 12 2017-12-28 11:05 mmcblk0p12
brw------- root root 179, 13 2017-12-28 11:05 mmcblk0p13
brw------- root root 179, 14 2017-12-28 11:05 mmcblk0p14
brw------- root root 179, 15 2017-12-28 11:05 mmcblk0p15
brw------- root root 179, 2 2017-12-28 11:05 mmcblk0p2
brw------- root root 179, 3 2017-12-28 11:05 mmcblk0p3
brw------- root root 179, 4 2017-12-28 11:05 mmcblk0p4
brw------- root root 179, 5 2017-12-28 11:05 mmcblk0p5
brw------- root root 179, 6 2017-12-28 11:05 mmcblk0p6
brw------- root root 179, 7 2017-12-28 11:05 mmcblk0p7
brw------- root root 179, 8 2017-12-28 11:05 mmcblk0p8
brw------- root root 179, 9 2017-12-28 11:05 mmcblk0p9
brw-rw---- root system 179, 96 2017-12-28 11:05 mmcblk0rpmb
drwxr-xr-x root root 2017-12-28 11:05 platform
drwx------ root root 2017-12-28 11:05 vold
brw------- root root 254, 0 2017-12-28 11:05 zram0
[email protected]:/ # ls -l /dev/block/platform/mtk-msdc.0/by-name/
ls -l /dev/block/platform/mtk-msdc.0/by-name/
lrwxrwxrwx root root 2017-12-28 11:05 MISC -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2017-12-28 11:05 PMT -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2017-12-28 11:05 boot -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2017-12-28 11:05 boot0hdr0 -> /dev/block/mmcblk0boot0p1
lrwxrwxrwx root root 2017-12-28 11:05 boot0hdr1 -> /dev/block/mmcblk0boot0p2
lrwxrwxrwx root root 2017-12-28 11:05 boot0img0 -> /dev/block/mmcblk0boot0p3
lrwxrwxrwx root root 2017-12-28 11:05 boot0img1 -> /dev/block/mmcblk0boot0p4
lrwxrwxrwx root root 2017-12-28 11:05 cache -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2017-12-28 11:05 dkb -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2017-12-28 11:05 kb -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2017-12-28 11:05 lk -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2017-12-28 11:05 metadata -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2017-12-28 11:05 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2017-12-28 11:05 recovery -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2017-12-28 11:05 reserved -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2017-12-28 11:05 system -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2017-12-28 11:05 tee1 -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2017-12-28 11:05 tee2 -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2017-12-28 11:05 userdata -> /dev/block/mmcblk0p15
[email protected]:/ # fdisk /dev/block/mmcblk0
fdisk /dev/block/mmcblk0
The number of cylinders for this disk is set to 3786.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)
Command (m for help): p
p
Disk /dev/block/mmcblk0: 29 GB, 31268536320 bytes, 61071360 sectors
3786 cylinders, 256 heads, 63 sectors/track
Units: cylinders of 16128 * 512 = 8257536 bytes
Device Boot StartCHS EndCHS StartLBA EndLBA Sectors
Size Id Type
/dev/block/mmcblk0p1 0,0,2 1023,255,63 1 4294967295 4294967295 2047G ee EFI GPT

bibikalka said:
Here is the guide to the painless root (while out of the box FireOS allows it - right now all versions up to FireOS 5.6.0.0 are rootable). The key enabler is the original post by @ztrund (link), great work blazing the trail (and motivating me to get another Fire tablet ASAP, LOL).
Given that the devices will be shipping with the (older) rootable FireOS for the next few months (but beware of the upcoming updates - see below !!!), there is a good window of opportunity to acquire a rootable Fire HD 10, and root it. As of Dec 27th 2017, there are no reports yet of non-rootable OTAs, but those OTAs will be coming soon, count on it!
The utmost goal here is to preserve the earliest FireOS version that you get, and not let it get updated by Amazon on a whim.
I am starting with a recently bought Fire HD 10 2017 (light refurb from eBay, missed the Black Friday mega sale ). I have FireOS 5.5.0.0 (earlier than 5.6.0.0!), version name 5.3.5.1 (591450020)
Part I (avoiding Amazon updating procedure upon the initial Fire setup) - this can (almost safely) be skipped today (end of Dec, 2017), since there are no reports of unrootable OTAs yet
Set up a dedicated slow router, limit upload/download speed to ~25 kbps (this is the trickiest part, I have a dedicated Tomato router which I use to control traffic)
Unpack Fire HD 10, turn it on, it will immediately demand a WiFi access
Connect Fire to your slow router
Once Fire finds Internet, it'll immediately have "Checking for updates" on the screen, this is where the slow router should kick in, and do the trick of forcing the update to give up
Wait a bit for updates, hopefully, it won't find them, if found something, do factory reset, and repeat (on my 1st try it did find the update, although, could not download it quickly enough, I did a factory reset via Pwr&Vol+ recovery mode, and tried again - the 2nd time it skipped the update due to the slowness of the connection)
Sign in to Amazon account when prompted
Once Alexa shows up, swipe down from the top, turn on Airplane mode - no more risk of updates!!!
Done
Click to expand...
Click to collapse
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.

Blaiser47 said:
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.
Click to expand...
Click to collapse
Even simpler: Choose any option on that WiFi screen, press cancel, and then skip.
No offense to the OP, but given the kind of questions that get asked on these root threads, s/he probably lost half the visitors at "dedicated slow router."

Blaiser47 said:
Why not just try to connect to a wifi with the wrong password, let it try, then hit back, then hit skip. Then you can get through without connecting to internet at all.
Click to expand...
Click to collapse
retyre said:
Even simpler: Choose any option on that WiFi screen, press cancel, and then skip.
No offense to the OP, but given the kind of questions that get asked on these root threads, s/he probably lost half the visitors at "dedicated slow router."
Click to expand...
Click to collapse
Great! Awesome tip!!! Even better than messing with the router - I've updated the post! XDA is no strangers to people with routers, especially if it involves blocking Amazon updates.

Curious does this work for the Fire 8? If not why?

ginfest said:
Curious does this work for the Fire 8? If not why?
Click to expand...
Click to collapse
The key difference is that the 2017 Fire HD 10 has an 'arm64-v8a' compiled system (with 64 bits), while all the older Fires are running 'armeabi-v7a' (with 32 bits). So a 64 bit bug must have slipped in. But let's be clear, if history is any guide, an Amazon update plugging this rootable bug is imminent at this point in time. That is why I urge everybody with root to disable OTA for good by renaming /system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk to *apk_
Unfortunately, all the other Fires seem to be on lock down, for now I have disabled updates on all of mine (including Fire TV 2 sticks) in case an exploit becomes available in the future.

bibikalka said:
Great! Awesome tip!!! Even better than messing with the router - I've updated the post! XDA is no strangers to people with routers, especially if it involves blocking Amazon updates.
Click to expand...
Click to collapse
Thanks very much for your simple approach to rooting the hd 10, starting from unboxing it, and giving step by step guide.
What apps/tweaks/settings did you do after you rooted your HD 10 that you recommend we do, you seem to have a way of writing that is concise and to the point, very much appreciated. Any other suggestions for protecting the HD 10 from Amazon OTA updates or other hazards?
Thanks again.

Are you saying at the beginning that 5.6.0.0 is or is not rootable?

encephalon9986 said:
Are you saying at the beginning that 5.6.0.0 is or is not rootable?
Click to expand...
Click to collapse
It is rootable, I clarified, thanks!

Amazing, much easier than the previous guide!
For those interested, I wrote here how to remove the Kingoroot junk: https://forum.xda-developers.com/hd8-hd10/general/added-kingoroot-t3721482

After rooting can I remove FireOS and install Oreo?

Stansted said:
After rooting can I remove FireOS and install Oreo?
Click to expand...
Click to collapse
No. That requires an unlocked boot loader and a custom oreo rom. Neither are available yet and likely will not be

This guide didn't work for me. While KingoRoot reported achieving root, I couldn't run SuperSU because the SuperSU binary is already occupied (presumably by KingoRoot's version of SuperSU).

Stansted said:
This guide didn't work for me. While KingoRoot reported achieving root, I couldn't run SuperSU because the SuperSU binary is already occupied (presumably by KingoRoot's version of SuperSU).
Click to expand...
Click to collapse
Thanks!
I was not sure if unrooting was necessary, it now looks like you should launch SuperSu from the root shell after running unroot with Kingoroot:
Unroot Fire via Kingoroot on PC
Can you try and report back?

bibikalka said:
Thanks!
I was not sure if unrooting was necessary, it now looks like you should launch SuperSu from the root shell after running unroot with Kingoroot:
Unroot Fire via Kingoroot on PC
Can you try and report back?
Click to expand...
Click to collapse
I already tried that. It didn't work. After unrooting, SuperSU won't do anything because it doesn't detect root.

Stansted said:
I already tried that. It didn't work. After unrooting, SuperSU won't do anything because it doesn't detect root.
Click to expand...
Click to collapse
How about going back to su commands - link

Yeah, so I just double-checked to make sure I hadn't made a mistake. This doesn't work. While SuperSU launches just fine from the root shell, it won't do anything after you've unrooted with KingoRoot. And if you haven't unrooted with KingoRoot, the SuperSU binary is occupied. For the record, I'm using a 7th Gen Fire HD 10 running Fire OS 5.6.0.0. I might try retyre's method later, but I don't currently understand what he's asking me to do.

Stansted said:
Yeah, so I just double-checked to make sure I hadn't made a mistake. This doesn't work. While SuperSU launches just fine from the root shell, it won't do anything after you've unrooted with KingoRoot. And if you haven't unrooted with KingoRoot, the SuperSU binary is occupied. For the record, I'm using a 7th Gen Fire HD 10 running Fire OS 5.6.0.0. I might try retyre's method later, but I don't currently understand what he's asking me to do.
Click to expand...
Click to collapse
Download the 5.6.0.0 update .bin from here, adb sideload that file, and follow these steps to the letter. It will work.