Related
Here is a zip file containing a modified recovery and boot image, as well as a few other things:
http://rapidshare.com/files/166164961/AndroidMod.zip
http://jf.nyquil.org/AndroidMod.zip
http://android-dls.com/forum/index.php?f=24&t=191&rb_v=viewtopic (see post for actual link to file)
NOTE: if you need a complete RC30 to v1.3 guide, see this page.
The recovery image (recovery_testkeys.img) uses the test keys that are distributed with the android platform source. This means that an OTA update or an update.zip update must be signed with the test key in order for it to install. In other words, it will no longer install OTA updates from t-mobile. You don't want them stealing back root access from you now do you? .
I've also included the test keys and the SignApk.jar tool, so you can sign your own update scripts (for use only with the modified recovery image). You can resign any image, even if it has been signed before. So for example, if you needed to install an "official" t-mobile update, you must re-sign it with the test keys first.
Another bonus in this recovery image is that ADB is enabled while in recovery mode. You can't adb into a shell (no sh binary), but you can at least use it to push and pull files from the device. For example, you could push an update.zip file to the sdcard.
The boot image (boot_nosecure.img) has been modified so that adb has root access by default. So when you do an adb shell, you automatically get a root shell. You can remount the system image using adb, and then push files directly to the system partition.
Finally, the "update - Restore Original RC29 Boot Image.zip" file is an update.zip file signed with the test keys, which will restore your boot partition back to the stock RC29 image. Useful if you accidentally hose your boot partition..
To install the recovery image onto your phone:
Code:
D:\Android\AndroidMod>adb push recovery_testkeys.img /data/local/recovery.img
912 KB/s (0 bytes in 1767424.001s)
D:\Android\AndroidMod>adb shell
$ su
su
# mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
# cd /system
cd /system
# cat /data/local/recovery.img > recovery.img
cat /data/local/recovery.img > recovery.img
# flash_image recovery recovery.img
flash_image recovery recovery.img
#
Note: You must place the recovery image at /system/recovery.img. the init.rc boot script automatically flashes the recovery partition with that file every time you boot up the phone.
At this point, it's probably a good idea to reboot the phone into recovery mode, and make sure it loads OK. If the recovery image is corrupt somehow, it will throw you back into SPL mode (the multi-color bootloader screen). If that happens, just boot the phone normally, and reflash recovery image.
Once it boots into recovery mode, press alt+L, and the next to top line of text should say something like "using test keys.". If it doesn't, then you're still using the original recovery image.
Note: If you are planning on installing the modified RC30 update, you can ignore the following - there is no need to install the boot image. The update already has a newer, modified boot image.
Now that you know you have the modified recovery image loaded, you can install the boot image:
Code:
D:\Android\AndroidMod>adb push boot_nosecure.img /data/local/boot.img
939 KB/s (0 bytes in 1533952.001s)
D:\Android\AndroidMod>adb shell
$ su
su
# flash_image boot /data/local/boot.img
flash_image boot /data/local/boot.img
# rm /data/local/boot.img
rm /data/local/boot.img
#
Now reboot the phone and let it boot normally. If the boot image was corrupted, it will boot into recovery mode instead. You can use the included update zip file to reload the original RC29 boot image.
Otherwise, if it boots up normally, open a command prompt however you like (telnet, adb, terminal emulator app, etc.) and type "getprop ro.secure". If it says 0, then you're running the modified boot image. Otherwise, if it says 1, you're still running the original boot image.
Attachement..
Hmm. It doesn't look like the attachment made it.. Does anyone have some space I could throw the file up at? It's around 5mb.
JesusFreke said:
Hmm. It doesn't look like the attachment made it.. Does anyone have some space I could throw the file up at? It's around 5mb.
Click to expand...
Click to collapse
I should have some space let me know
JesusFreke said:
Hmm. It doesn't look like the attachment made it.. Does anyone have some space I could throw the file up at? It's around 5mb.
Click to expand...
Click to collapse
Sent you an email with u/p if you need space.
test
anyway to test and make sure i did this correctly.. other than my phone booted and is not a paperweight
jriley60 said:
anyway to test and make sure i did this correctly.. other than my phone booted and is not a paperweight
Click to expand...
Click to collapse
To check the boot image, boot the phone normally, and then get a shell with adb. Type "id", and see if you are root
To check the recovery image, boot up the phone into recovery mode. Once you're in recovery mode, Press alt-l to show the text. The next to top line should say something like "using test keys"
JesusFreke said:
To check the boot image, boot the phone normally, and then get a shell with adb. Type "id", and see if you are root
To check the recovery image, boot up the phone into recovery mode. Once you're in recovery mode, Press alt-l to show the text. The next to top line should say something like "using test keys"
Click to expand...
Click to collapse
When will we see the files? Can you just upload to RS and we will mirror?
neoobs said:
When will we see the files? Can you just upload to RS and we will mirror?
Click to expand...
Click to collapse
Look at the original post. I added a link for the zip file..
boot.img is in correct. assuming typing id in telnet returning uid=0(root) gid=0(root) means i'm root then i'm good, thank you so much. looks like i really should install the emulator it might make things a little easier
JesusFreke said:
Look at the original post. I added a link for the zip file..
Click to expand...
Click to collapse
thank you. Sorry
jriley60 said:
boot.img is in correct. assuming typing id in telnet returning uid=0(root) gid=0(root) means i'm root then i'm good, thank you so much. looks like i really should install the emulator it might make things a little easier
Click to expand...
Click to collapse
Well, that does mean you have root, but that doesn't say anything about whether the boot.img was installed correctly. If you're telneting in, then you would have root access regardless of whether you are running a stock boot image or my modified one.
My boot image allows adb to connect to the phone as root. If you don't use adb, there's no reason to install my modified boot image.
Actually, there's an easier way to tell if you're running my boot image. Get to a command prompt (telnet, adb, terminal emulator app, whatever), and type
getprop ro.secure
If it says 0, then you correctly installed my boot image. Otherwise, if it says 1, you're still running the stock image.
Thanks! Was waiting for this.
Now to screw with my phone like crazy
Not that I don't trust you... but...
Ok... I don't trust you implicitly enough to reflash my phone with your stuff
Any chance you can post diffs against the android source tree so I can apply your changes and build it myself?
No offense - I just like to know what's going on...
RyeBrye said:
Ok... I don't trust you implicitly enough to reflash my phone with your stuff
Any chance you can post diffs against the android source tree so I can apply your changes and build it myself?
No offense - I just like to know what's going on...
Click to expand...
Click to collapse
Not at all
The recovery tool is just a stock build (almost) from the android source, using the test keys, which is the default if you don't specify keys of your own. The only change I made was to make it print out "using test keys" when it runs, just to make it easy to tell if it's running. I can give you a diff if you really want.. but it's a simple change though, and doesn't affect the actual functionality.
For the boot image, I replaced the initramfs image in the boot.img included in the official RC29 update, with the initramfs image from a default build of the android source, which has the ro.secure property set to 0.
I first tried the boot.img that was generated by the default android build, but I had issues with getting wifi to work, so I tried merging the initramfs image with the RC29 boot.img, and it seems to work fine.
I suspect you could accomplish the same thing by extracting the initramfs image from the RC29 boot.img, un-gzipping and un-cpioing it, and then modifying the default.prop file to set ro.secure to 0. Then you would have to package it back up and stick it back into the RC29 boot.img.
ro.secure is the property that the adb service looks at to determine if it should use root user, or drop to the shell user. When ro.secure is 0, adb will run as root.
It can be a bit of a pain to get the android source to build though. Make sure you get the dream specific product files (they aren't downloaded by default when you do a "repo sync"). You'll also encounter issues where it can't find libaudio.so or librpc.so. You'll have to copy these from the phone to a couple of output folders in order for the build to proceed.
If you get stuck, feel free to give me a holler and I'll try and help out.
Be warned.. the build takes quite a while.. on the order of an hour or two at least. But then again, I was doing it in a VM.. it may be faster if you do it on a native linux box.
i cant get it to work i know I'm doing something wrong can you(everyone)help me out(i have Vista 64) i get this error
this i what i type# C:\Android\AndroidMod>adb push recovery_testkeys.img /data/local/recovery.img
this is the errorC:AndroidAndroidMod: not found
please and thank you
EDIT: could we do it off the sdcard?
EDIT2: i think i found my own mistake this cant be done in Windows i need to have shell with adb meaning time to whip out VM
JesusFreke said:
For the boot image, I replaced the initramfs image in the boot.img included in the official RC29 update, with the initramfs image from a default build of the android source, which has the ro.secure property set to 0.
I first tried the boot.img that was generated by the default android build, but I had issues with getting wifi to work, so I tried merging the initramfs image with the RC29 boot.img, and it seems to work fine.
Click to expand...
Click to collapse
Can you talk more about this step of the process? How did you do this "merging"? Did you use mkbootimg?
JesusFreke said:
I suspect you could accomplish the same thing by extracting the initramfs image from the RC29 boot.img, un-gzipping and un-cpioing it, and then modifying the default.prop file to set ro.secure to 0. Then you would have to package it back up and stick it back into the RC29 boot.img.
Click to expand...
Click to collapse
And this could be done without going through the whole process of doing an Android build, right? I'm just thinking about how one might build a simple utility to allow editing of the ramdisk.
alansj said:
Can you talk more about this step of the process? How did you do this "merging"? Did you use mkbootimg?
Click to expand...
Click to collapse
I just used the good ol hex-editor. The gzip file starts with a few specific bytes (don't remember them offhand..), so you can search through the image. There are 2 gzip files, the initramfs is the last one. In mine, it starts at offset 0x00154000.
Once you find it, just cut it out and dump the new one in (there is some 00 padding after the gzip file ends.. not sure if you need to keep the padding or not). You also have to update the size of the initramfs, which is at offset 0x00000010.
alansj said:
And this could be done without going through the whole process of doing an Android build, right? I'm just thinking about how one might build a simple utility to allow editing of the ramdisk.
Click to expand...
Click to collapse
Yes.
Anyway to make this using the update.zip sd card method?
JesusFreke, per some requests in #android on freenode I have setup a wiki (not a device wiki like xda's but more like an "information about android/g1 and how to tweak it" wiki) and would like to put this on there. Let me know if you care (unless you would like to add it in your own words), the wiki is http://android-dls.com/wiki and its still very new, but im trying to to get it built up (RyeBrye is doing most of the work).
humble said:
i cant get it to work i know I'm doing something wrong can you(everyone)help me out(i have Vista 64) i get this error
this i what i type# C:\Android\AndroidMod>adb push recovery_testkeys.img /data/local/recovery.img
this is the errorC:AndroidAndroidMod: not found
please and thank you
EDIT: could we do it off the sdcard?
Click to expand...
Click to collapse
First of, you do know that when we refer to "C:\..." we refer to windows via a command prompt (or "cmd") and when you see "# ..." we refer to a shell connection to the Android phone.
Second, you do have the Android SDK right? If not download it HERE. Now extract that to a folder, preferably close to the C: root. (ex. C:\AndroidSDK)
1)Either extract/copy the files from the "AndroidMod.zip" to the Android Tools folder from the SDK (ex. C:\AndroidSDK\Tools) OR copy "adb.exe" and "AdbWinApi.dll" from the Android Tools folder from the SDK (ex. C:\AndroidSDK\Tools)to the folder where you have extracted the "AndroidMod.zip" to.
2)Open up a command prompt. Start -> Run (or Windows key + R) and type "cmd"
3)CD to the directory where the files are.
EXAMPLE:
C:\Users\[your_user_name_here]> cd \
C:> cd androidsdk\tools
C:\AndroidSDK\Tools>
4) Now follow the Instructions.
I wanted to add some extra steps to my init.rc file but was unsuccessful. I was hoping someone could explain what I'm doing wrong or advise if there is a better way to do this.
I started by creating a new backup image using clockworkmod and then copied the boot.img file over to my host. I then used the steps as described in the thread "HOWTO: Unpack, Edit, and Re-Pack Boot Images" to unpack the contents and get the init.rc file. After adding the additional steps at the end, I packaged the boot.img file back up using mkbootfs and mkbootimg and then pushed the file to my sdcard. However, when I try to use "flash_image" to flash the new boot.img, I always get the error "error scanning partition". I don't think the problem is with the new boot.img file because I get the same error if I try to flash the original boot.img or even some non-existing file.
I also tried to simply replace the original boot.img file in my clockworkmod back up directory and do a standard restore, but that doesn't get past the "Viewsonic" logo screen. I assume that is because of some checksum issue.
Can anyone see my error or suggest and alternate method?
Thanks in advance
So I just rooted via Pete's instructions, I'm on CWM 3.1.0.1 or something but I see some people are on 4.x.x.x what should I be on? Rom manager only lists the 3.1.0.1 thanks in advance.
DigitalDementia said:
So I just rooted via Pete's instructions, I'm on CWM 3.1.0.1 or something but I see some people are on 4.x.x.x what should I be on? Rom manager only lists the 3.1.0.1 thanks in advance.
Click to expand...
Click to collapse
you should upgrade to the latest, 4.x.x.x.
Im not really finding a link to that CWM version, if I flash one of the kernels will it give me the newest recovery? I know that's how people did it on the fascinate.
Going into the nexus s developement thread and look for cwm 4.x.x.x section posted by j_r0dd. The latest should be 4.0.1.4. Grab that .img file and put it into your C:\AndroidSDK\tools folder or wherever you have it located.
1. Open cmd,
cd C:\whateveryounamedit\tools
2. Boot into bootloader
3. Plug in usb and type: fastboot devices, your devices # should pop up, sometimes if its blank its still connected.
4. Type: fastboot flash recovery nameofrecovery.img
I would give a link, but im on the app.
Sorry.
EDIT: oh and be sure you grab the one for ns4g devices.
Wow thanks for being so helpful! I'll do that ASAP.
Your welcome.
kijp15 said:
Going into the nexus s developement thread and look for cwm 4.x.x.x section posted by j_r0dd. The latest should be 4.0.1.4. Grab that .img file and put it into your C:\AndroidSDK\tools folder or wherever you have it located.
1. Open cmd,
cd C:\whateveryounamedit\tools
2. Boot into bootloader
3. Plug in usb and type: fastboot devices, your devices # should pop up, sometimes if its blank its still connected.
4. Type: fastboot flash recovery nameofrecovery.img
I would give a link, but im on the app.
Sorry.
EDIT: oh and be sure you grab the one for ns4g devices.
Click to expand...
Click to collapse
adb doesn't seem to recognize fastboot as a command? I'm in the bootloader though.
Anyone have a zip of the cwm 4.x.x.x recovery?
Did you install android sdk on your computer? If not, you should do that before you proceed.
EDIT: or did you put adb to your path on your computer
I'm on W7 so I just went to platform-tools and typed cmd in the address bar. However fastboot isn't in platform-tools?
So I went to tools but got another error trying to flash.
Sorry for all the questions I've never had to use fastboot.
Or just put the .img file on the root of your sdcard.
Open terminal
type flash_image recovery /sdcard/nameofrecovery.img
Download android terminal
su
flash_image recovery /sdcard/nameofrecovery.img
Hit enter, it should now read the .img file
After that type reboot recovery to check it. Hope this helps.
kijp15 said:
Download android terminal
su
flash_image recovery /sdcard/nameofrecovery.img
Click to expand...
Click to collapse
If it says no image found?
DigitalDementia said:
If it says no image found?
Click to expand...
Click to collapse
Are you doing correctly?
I've done it a tons of time and it never gave me that msg.
When downloaded it, did it say .txt at the end, if it did change it from
.txt to .img.
And try again.
Positive. I renamed it cwm4.img for ease of use and I type:
su
flash_image recovery /sdcard/cwm4.img
Then it says flash_image: not found
kijp15 said:
When downloaded it, did it say .txt at the end, if it did change it from
.txt to .img.
And try again.
Click to expand...
Click to collapse
Still an image file.
Is your img file in any folders?
If it is your doing something wrong that I don't know about. Ha. If it is take out and out it on the root of your sdcard.
I've just flashed a img wit this same exact process and it went threw.
kijp15 said:
Is your img file in any folders?
If it is your doing something wrong that I don't know about. Ha. If it is take out and out it on the root of your sdcard.
I've just flashed a img wit this same exact process and it went threw.
Click to expand...
Click to collapse
Ugh... frustrating! It's not in a folder, it's right on the root mocking me. Okay just so I know I'm doing it right I do it like this:
su
flash_image recovery /sdcard/cwm4.img
Right? With the spaces between recovery and /sdcard/ ?
Hmmm... that is right.. is your terminal a black or blue background?
If its black your have the wrong terminal.
I owned and rooted a NS4G last year without an issue.
I've got a Mac now, and just got a new NS4G and tried rooting it.
I was able to unlock the bootloader via adb commands in Terminal. But when I try to flash a recovery using
Code:
~/Desktop/adb-fastboot/fastboot flash recovery.img
I get
Code:
unknown partition 'recovery.img'
error: cannot determine image filename for 'recovery.img'
I get the same error if the file is named twrp-crespo4g-2.0.0RC0.img or whatever. Either that "cannot determine..." or "unable to load".
So I can't get superuser because I don't have a recovery. In Rom Manager, it gives me an error cannot flash recovery or what not.
I'm presently stuck.
Nevermind. After some fiddling I realized I was typing in the wrong file name in the first place.
Amateurs.
On my TF700T I'm currently running CyanogenMod version 11-20140805-SNAPSHOT-M9-tf700t. I currently have CWM Recovery 6.0.4.4
I want to return to a stock Asus ROM from their website.
I've tried flashing WW_epad-user-10.6.1.14.10.zip with CWM but get an error...
assert failed: write_raw_image("/tmp/blob", "staging")
E:Error in /storage/sdcard1/WW_epad-user-10.6.1.14.10.zip
(Status 7)
Installation aborted.
What is it I'm doing wrong?
No thoughts?
I just tried commands from this thread, and I get error: cannot open 'blob' - yes the blob files was in the same folder as fastboot.
What cant I get this to work???
Bad download maybe?
sbdags said:
Bad download maybe?
Click to expand...
Click to collapse
I've downloaded the update 4-5 times... How big a deal is the different models? WW, TW, US??? I think it's WW, it was purchased in Australia.
Thanks for replying
When you tried to flash the zip from cwm did you unzip it first? I.e., flash the zip in the zip?
Other than that check the output of fastboot devices first.
sbdags said:
When you tried to flash the zip from cwm did you unzip it first? I.e., flash the zip in the zip?
Other than that check the output of fastboot devices first.
Click to expand...
Click to collapse
Yup I unzipped the download.
I'm running a Mac book pro, but running boot camp or OSX I still get 015d262e98340004 fastboot
typing fastboot reboot did reboot the tablet so fastboot and adb are working correctly.
FL00DY said:
I currently have CWM Recovery 6.0.4.4
assert failed: write_raw_image("/tmp/blob", "staging")
E:Error in /storage/sdcard1/WW_epad-user-10.6.1.14.10.zip
Click to expand...
Click to collapse
IIRC the "staging" target doesn't work in CWM - don't remember about TWRP. But you can edit the updater-script and replace "staging" with "/dev/block/mmcblk0p4", that should work.
FL00DY said:
I get error: cannot open 'blob' - yes the blob files was in the same folder as fastboot.
Click to expand...
Click to collapse
That's a common mistake in many of the guides - the file must be in your *current* directory.
FL00DY said:
Yup I unzipped the download.
I'm running a Mac book pro, but running boot camp or OSX I still get 015d262e98340004 fastboot
typing fastboot reboot did reboot the tablet so fastboot and adb are working correctly.
Click to expand...
Click to collapse
Hmm I've never used a mac in my life so I can't help you any further. On a windows machine or linux the last thing to check is that the blob file is in the same folder but you already said that.
Can you run an md5sum on the zip file (I know you dl'ed it 5 times) just to confirm it is not getting corrupted....
Other than that I'm out of ideas - sorry.
_that said:
IIRC the "staging" target doesn't work in CWM - don't remember about TWRP. But you can edit the updater-script and replace "staging" with "/dev/block/mmcblk0p4", that should work.
That's a common mistake in many of the guides - the file must be in your *current* directory.
Click to expand...
Click to collapse
The stock updater-script looks like this
Code:
assert(package_extract_file("blob", "/tmp/blob"), write_raw_image("/tmp/blob",
"staging"),delete("/tmp/blob"));
When you say replace "staging" - what should the bottom line look like?
This post says the blob must be in the same folder as the fastboot.exe - what do you mean when you say the file must be in your "current" directory?
sbdags said:
Hmm I've never used a mac in my life so I can't help you any further. On a windows machine or linux the last thing to check is that the blob file is in the same folder but you already said that.
Can you run an md5sum on the zip file (I know you dl'ed it 5 times) just to confirm it is not getting corrupted....
Other than that I'm out of ideas - sorry.
Click to expand...
Click to collapse
I've setup adb and fastboot to work the same way in Windows & OS X. I used to be a PC guy til I moved to graphic design... Thanks everyone for the help :good:
FL00DY said:
When you say replace "staging" - what should the bottom line look like?
Click to expand...
Click to collapse
If you don't know how to do a simple text substitution, I'd recommend you use the fastboot method.
FL00DY said:
This post says the blob must be in the same folder as the fastboot.exe - what do you mean when you say the file must be in your "current" directory?
Click to expand...
Click to collapse
That post is wrong as I already said. Files whose name you specify on a command line must be in your current working directory (of your shell), unless you specify them with a path. So you either have to use "cd" to the directory containing the blob file, or you have to specify the (relative or absolute) path to the blob file on the fastboot command line.
_that said:
If you don't know how to do a simple text substitution, I'd recommend you use the fastboot method.
Click to expand...
Click to collapse
Well I just wasn't sure if I was only replacing Staging ...
Meaning should the line look like this ...
Code:
"/dev/block/mmcblk0p4"),delete("/tmp/blob"));
That post is wrong as I already said. Files whose name you specify on a command line must be in your current working directory (of your shell), unless you specify them with a path. So you either have to use "cd" to the directory containing the blob file, or you have to specify the (relative or absolute) path to the blob file on the fastboot command line.
Click to expand...
Click to collapse
OK sure that makes sense, I just didnt want you meant by current. Thanks very much :good:
It all worked on Friday, thanks so much @_that life saver ... oh and I wasn't trying to steal your thunder in the other thread :good: