Database Info

[TOOL][NABIXD] NabiRootXD Root, Gapps, Recovery

NabiRootXD v2​
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This is a tool for rooting, installing Gapps(Play Store, etc), and adding custom TWRP recovery on Nabi XD. It's written as a windows command line batch file, and is based off NabiLab I made for Nabi2.
It was an adventure to say the least. I include some of the hurdles for those that want to duplicate the root process or just to place my thoughts "on paper" because of the 100's of posts I read from those that posted detailed information and allowed me to gain useful insight in how I could adapt things for the XD, and explain in one swoop to the many PM's I have received about "when will we see root on the XD" why it took so freaking long. Those that just want the program can continue to the Overview section.
What started as an interesting avenue was TWRP using the Nabi2 kernel was booting the NabiXD to TWRP without video. I thought it possible to dd the recovery, or boot kernel. Unfortunately it was unable to recognize internal storage as a block device and that ended that. Like a few devices on Android 4.1.1 and above the standard once click program using Bin4ry's ADB restore exploit doesn't work. It doesn't work for a couple of reasons, when restoring fakebackup.ab in locks up writing the first file, and even if it did work placing ro.kernel.qemu=1 in local.prop doesn't work because Jelly Bean doesn't parse any property files to set the ownership of adb daemon. Searching the file system I found su2 in the xbin directory. This was promising as it is the su program but renamed, also unfortunate was its permissions had no setuid bit set and while it was executable it would not change uid to 0. I then foolishly went down the path of nvflash(forced recovery). I attempted a few different avenues here to try and possibly get the SBK to unlock nvflash, that proved uneventful, especially without root access. I tried extracting what "could" be the key from the Nabi2 it hope it was reused. That lead no where, it would be awesome to have access to it for many other reasons but it turned out to be an exercise in learning but ultimately a waste of time. Then on to other Android exploits... Tried Samba, debugfs, and vfat exploit. All of those are either patched or I'm not skilled enough. I finally returned to looking at the ADB restore exploit.
The "tabletS" exploitation showed promise as it takes the avenue of installing /dev/sh vs ro.kernel. A side effect of the failed ADB restore bug was leaving a directory with full permissions. Bads3ctor had an interesting fakebackup.ab that was more reliable at making a directory or file that you simlinked have full permissions. Now you can step through the tabletS script more effectively where you couldn't before by manually setting permissions for files/directories you need by doing the restore for each file and directory you need. The script installs VPNfaker and backs up the /data/app directory, then creates a new app directory. This however will cause the NabiXD to rerun the initial kidsmode setup and breaks everything. You can dance around that by not rebooting, and VPN faker will still give you a Term app with system uid. From there you can't symlink the sysfs links properly to data/property but that can be worked around by moving and then removing files. Finally you can makedev /dev/sh and run su from /data/local/tmp. The end result is that the exploits and bugs found by others are adequate when strung together in the right order on the NabiXD just not the one click solutions provided on the forums, they needed some modifications and done by hand to figure out for the NabiXD
Here is a nice publication I found in my searches that is more layman terms for older root methods. http://www.sourceconference.com/publications/bos12pubs/android-modding-source.pdf
Overview
Video Overview of NabiRootXD - a video tutorial of the use of NabiRootXD.
-Root the Nabi XD
-Install Gapps(Play Store, etc)
-Make a stock backup of unrooted device
-Install stock, or TWRP recovery
-NabiLab patching system to install updates to this program
Version 2
-Fixed scripting error causing early exit
-Added 7z for patching system
Download
Read the installation section below to determine which version you want.
File names:
NabiRootXD.zip 96MB (Version 2)
Download
Download Mirror
Installation
NEW INSTALLS
1) Download NabiRootXD
NabiRootXD.zip 96MB
2) Extract the zip files to a location of your choosing. Run the NabiRootXD.bat file.
Prerequisites
1) Script is for Windows
2) ADB enabled in Android. Enter Mommy/Daddy mode. Open settings->developer options->put a check mark in USB debugging.
3) ADB and Fastboot driver. Most popular are the PDAnet drivers. You can get them here: PDAnet drivers
Usage
Obviously using this script on your NabiXD voids the warranty and I take no responsibility for the damage you cause.
MENU 1 - Root, Gapps, Recovery​
Menu Option 1 - Install Root, Recovery and Gapps
This option is best used if you have a brand new Nabi. At this point you should have met the prerequisites of enabling ADB in Android. Follow directions, most sticking points are pressing the volume + and then pressing the volume - button twice and making sure recovery kernel is the one highlighted. After its complete you should have a rooted Nabi, with Gapps and a backup of your unmodified Nabi in the folder TWRP/BACKUPS/YOURSERIAL/stockunrooted on your device. Not a bad idea to copy this off the Nabi to your computer if you need to free space or have it in a second location.
Menu Option 2 - Install Root and Recovery
Same as above but doesn't install Gapps. Some people have trouble with option 1 taking the Gapps install, I personally have never experienced it but the option is this one, or I guess if you are an elite hacker that just wants root.
Menu Option 3 - Install Gapps
Same Gapps installed in the Option 1. Useful for re-installing Gapps. This is Jelly Bean Gapps dated 10/11/2012 without Google Search. This makes NO backup of you Nabi. You will have to already have installed TWRP.
Menu Option 4 - Install Root
Installs root. Nothing fancy here, and likely unneeded but here for completeness if you find yourself in a strange situation. One that comes to mind is that you have a stock backup which you restored and don't want to do another backup so you would just run this and the gapps install. It makes NO backup. You will have to already have installed TWRP.
MENU 2 - Install Recoveries​
Menu Option 1 - Install TWRP 2.3.3.0 for Nabi Version 1.2.3
Installs TWRP 2.4.4.0. This is the latest at this time. It has a screen timeout, if the screen goes black touch the screen to wake the screen, it's not locked up.
Menu Option 2 - Install Stock Recovery
Installs stock recovery. This is useful for taking an OTA, or completely returning Nabi to stock.
Notes: TWRP installs are based off my work in this thread if you want to read more.
MENU 3 - Patch NabiLab​
Menu Option 1 - Install Patch
For any updates to NabiRootXD this is where you can automatically load them. Basically you will download NabiPatchXD.zip and place the entire zip in the patch folder. No unzipping just the single file. Then run this option.
Credits - If you see these guys buy them a beer.
jzmtaylor - Original Nabi2 script that this is based off of.
Bin4ry, Bads3ctor, HEXcube, drjbliss - all the bugs/exploits needed to accomplish root
Dees_Troy - TWRP build tutorial
Eric Karz - TWRP Theming and rooting assistance
TeamWin - They are the guys that make TWRP possible

Weeee more Easter goodies haha.
thanks aicjofs

Sir can i use this tool for installing Gapps for unrooted Galaxy Tab 7.0+ (wifi)? bcoz i updated my tablet for Honeycomb to Ice creamsandwich (China Firmware), everything is fine except that i cant open google playstore...

first of huge thank-you.. who do i send a bear donation to as a thank-you
there is a possible bug or its just me when pressing the menu button it will pull up a search, or say Google with a white back ground only way to get out isto press home if a menu appears then pressing back produces the same results

srgsng25 said:
first of huge thank-you.. who do i send a bear donation to as a thank-you
there is a possible bug or its just me when pressing the menu button it will pull up a search, or say Google with a white back ground only way to get out isto press home if a menu appears then pressing back produces the same results
Click to expand...
Click to collapse
The gapps removes the problem in system/app/quicksearchbox.apk you can rename it toquicksearchbox.bak
only other way I can think of is some how playstore added it to data/app
rename com.google.android.googlequicksearchbox.apk to com.google.android.googlequicksearchbox.bak
hth
ps: thank the op he spent hours and hours to make this happen = sacrificed his free time

Thanks for the feedback.
Perhaps we should have used the 7/26/2012 gapps? http://goo.im/gapps/gapps-jb-20120726-signed.zip 10/11/2012 is suppose to be 4.1.1 backward compatible, but perhaps there are some bugs with it on XD. Flash over the top of the current one. It will leave behind /system/app/thinkfree.apk, /system/app/microbes.apk and /system/lib/libmicrobes_jni.so, which you could remove manually. Wipe caches.
How about GPS stuff? Is that working?

i was looking at gapps-jb-20120810-JRO03C-Formula84-Custom
it has some things that sort of work like maps/local/ latitude /
I don't think gps is working
Even in the productions test it fails .
could it be a permissions problem ? I have not tried 20120726 .

Eric Karz said:
i was looking at gapps-jb-20120810-JRO03C-Formula84-Custom
it has some things that sort of work like maps/local/ latitude /
I don't think gps is working
Even in the productions test it fails .
could it be a permissions problem ? I have not tried 20120726 .
Click to expand...
Click to collapse
Do we know that the GPS works at all?

aicjofs said:
Do we know that the GPS works at all?
Click to expand...
Click to collapse
with gapps installed it doesn't seem to work .
maybe we are going to need a edited gapps ?

I'm just going to remove Google Search for now. That is highly annoying, I was messing around with ways to fix it, and got it to open in apps when you press the settings button, I was previously only getting it when pressing back button.. I updated the downloads. Until we figure out the fix, it's just too troublesome.

cool that did the trick renaming the file i do have a really stupid question is there a hiden proxy setting that makes the tablet able to bypass our DNS security filters with open dns just curious

srgsng25 said:
cool that did the trick renaming the file i do have a really stupid question is there a hiden proxy setting that makes the tablet able to bypass our DNS security filters with open dns just curious
Click to expand...
Click to collapse
I don't know if there is a hidden proxy. I'm not sure of your question. You could try going to settings-wifi. Long press the name of the network and a pop up will come up. Modify network, show advanced options. There is the proxy and DNS, for DNS you have to be static. I think there is 4.4.4.4 in there by default, plus what your router gives out.
If you are talking about something more underground I think you could use a getprop in adb shell or term.apk. I know I have seen stuff in there for DNS, something like dhcp.wlan0.dns there is stuff in there about "change" too. Should be able to set if you "su" and do a setprop. That would only be good until reboot, but could help you trouble shoot. I think it's set here /system/etc/dhcpcd/dhcpcd-hooks/20-dns.conf, maybe not in Jellybean. Anyway those are places to look if it's more then in settings that you are looking for.

ok it seems that this might be a work around to the quick search problem
edit the buildprop and change
ro.sf.lcd_density=160
to
ro.sf.lcd_density=145
I tried 149,150,59 and 120
120 does seem to fix it also but the screen makes every thing look smaller and some may not like that .(I do)
also I had to install BusyBox in order to get a few things to work including
build prop Editor by Nathan Campos (this tool seems to be a good test app to see if you have proper permissions)
note that the swipe screen will be a bit smaller under 160
maybe some one can use this info to edit quick search box we wouldn't have to change anything?

i am trying to get this tablet to use my network opendns settings and web filters

Can someone direct me to where I can get a Vista MTP driver for the Navi XD? I installed PdaNet as instructed but the tool wont connect, and I have a yellow exclamation mark by MTP Device. Can't seem to find anything else online.
EDIT: After rebooting a few times, then disabling my firewall, the tool connected. Thanks for the awesome tool.

Looks like an OTA was released for the Nabi XD today that bumbs the Nabi XD up to version 1.3.5. I tried doing the stock recovery option but the NabiRootXD app just closes out after selecting it. I looked into the NabiRootXD.bat file and I noticed on line 483 that it says to "GOTO Install_4" which doesn't seem to exist. I believe it should actually say "GOTO Install_2".
After making this change I was able to restore to the stock recovery to perform the OTA.
Now once I tried to install the OTA it appeared to atart the installs and then fails with the dead android symbol about a third of the way through. No idea what the problem is now so I'll just wait for others to try this and see what their results are.

yup getting the dead droid

Reinstall TWRP and "Install" this to update. Have a backup. Should work if you have made no system modifications, except what NabiRootXD did.
Download
TWRP may or may not ask you to reinstall superuser.
Also working on a patch to fix the exiting error in script.
EDIT: New links for a version 2. Fixed scripting error and patch system error. Easier to just download the whole program again then for me to explain fixing the patching system manually.

OTA procedure
srgsng25 said:
yup getting the dead droid [
BOOT into TWRP and perform and system restore to pre-root image
reboot
download and install the OTA
reapply root and gapps
Click to expand...
Click to collapse

aicjofs said:
Reinstall TWRP and "Install" this to update. Have a backup. Should work if you have made no system modifications, except what NabiRootXD did.
Download
TWRP may or may not ask you to reinstall superuser.
Also working on a patch to fix the exiting error in script.
EDIT: New links for a version 2. Fixed scripting error and patch system error. Easier to just download the whole program again then for me to explain fixing the patching system manually.
Click to expand...
Click to collapse
Thanks for the update aicjofs! I'll test this out shortly and let you know how everything goes.

Frequently asked Questions AT&T LG G3 (D850)

[SIZE=+3]Frequently Asked Questions[/SIZE]
[SIZE=+2]LG G3
AT&T D850[/SIZE]​
[SIZE=+1]This a short list of frequently asked questions in this device forum and the answers often given as a response. It should serve as a starting point for gathering knowledge and finding solutions to many common problems. Please only post in this thread with feedback on how to improve this document. Do not post "Thank you" type responses. If you have additional questions or require more help, try to find an existing thread or create your own. Do not use this as a general help thread.[/SIZE]
[SIZE=+1]Q1: How do I ask a question, so I'm not called a noob?[/SIZE]While you may see many questions asked in the Development section, PLEASE be aware this is not the place for questions.
Remember to use the search found at the top of the forum. There is also a search within each section. Example click on Q&A HERE. In the upper right you will now see two search's. At the top it says Search All Forums and a little further down you will see Search This Forum. Enter your search criteria in the Search This Forum to get info from this section. The search at the top will look through the entire forum.
Please read as much as you can prior to doing anything with your device.
Make sure your question has not been answered in the OP (Opening Post) of each section of Development
Search Q&A for threads that may have been started for a particular rom​
[SIZE=+1]Q2: How do I update my stock firmware?[/SIZE]1) Turn on WiFi or data
2) Go to Menu > Settings > About Phone.
3) Select firmware update​
[SIZE=+1]Q3: What is a ROM?[/SIZE]A rom is like a custom firmware image that is made by a Developer either entirely from scratch, or based off of the official firmware package. Some ROMs contain simple changes like changing icons and adding extra options to things, other more complicated ROMs can change the entire Android experience. Which one you will want to flash, will be entirely up to you. Read carefully, and make sure you understand what you are getting into before you flash.​
[SIZE=+1]Q4: What is a Kernel?[/SIZE]A kernel is the heart of the device's OS. In simplest terms it’s a connection between your apps and your device’s hardware; i.e. the processor, RAM, etc. A custom kernel can dramatically change the way your device’s hardware performs… for the better and/or the worse]​
[SIZE=+1]Q5: What is a Bootloader?[/SIZE]The bootloader is a program code that is executed before the device OS starts up, and that instructs that device to boot “normally”. The bootloader can come locked or unlocked from the manufacture. A unlocked bootloader will allow you to install custom ROMs & Kernels (as well as some other neat things) on your device.​
[SIZE=+1]Q6: What does Root/Rooting mean?[/SIZE]Put simply, Rooting your device allows you, and/or rooted apps, to access parts of the Linux based Android software that is your OS, and that you would otherwise not be able to access. These tasks can be as simple and beneficial as backing up your system setting, or as complicated as installing custom ROMs, Kernels, etc.​
[SIZE=+1]Q7: What is the purpose of rooting my device?[/SIZE]Please bear in mind, rooting can be dangerous and if done wrong "brick" your phone.
Rooting the phone is a decision made by individuals looking to improve upon the Android OS. There are many benefits, however it is done to customize the phone to it's full potential​
[SIZE=+1]Q8: How do I root my LG G3? [/SIZE]Use one of the following methods, for KitKat or Lollipop.
Android version 4.x.x (KitKat)
[ROOT][IOroot] LG G3 4.4.2 Jailbreak
PurpleDrake-Lite!
[Root] Stump Root for LG Devices
Android version 5.x.x (Lollipop)
One click script
[ROM][STOCK][BUMP'd] LG D850 20F Lollipop 5.0.1 (+ extras)
[SIZE=+1]Q9: How do I remove root and return to factory stock. Why would I uninstall root?[/SIZE]The complete "Unroot" method, can be found here"
Removing root is normally a process used for a couple main reasons:
1) You've done something to the device and now it doesn't seem to be working.
2) You need to return the device or send it in for service.​
[SIZE=+1]Q10: What is ADB (Android Debug Bridge) and what is it for?[/SIZE]Please read [GUIDE] ADB Workshop and Guide for everyone. There is much to learn, please view everything in the threads OP​
[SIZE=+1]Q11: How to I enter Download Mode and Recovery?[/SIZE]1) You must switch off the device to start the process.
2) Press and hold the “Volume Up” and connect the USB cable from phone to PC.
3) Use the original USB cable. Other device USB cables may not be detected by the Computer. It is strongly recomended to use the original cable that came with the device.
4) Wait for the driver installation on PC.
5) You will now see the download mode screen on your phone.
6) Done
You can now do any process, such as, install stock ROM through your computer or laptop.
You can return to the normal mode by pressing and holding power button.
DO NOT UNPLUG THE DEVICE while the update process is running. This can damage your device!​
[SIZE=+1]Q12: What is a "logcat" and how do I create one?[/SIZE]For setting up ADB see What is ADB (above) logcat allows us to log what the OS is doing, and possibly offer information if things are not working. its quite simple to create but may be difficult for most to understand. This is a tool a Developer may ask for in detecting issues your device may be encountering.
To use logcat
Code:
adb shell
logcat
To logcat to a certain file do
Code:
adb shell
logcat -d > /sdcard/whatevertexfileyoulike.txt
For a full explanation follow the link in What is ADB​
[SIZE=+1]Q13: Is there an app that will help me create a logcat directly from my phone?[/SIZE]Yes, Apps for logcat can be found in Google play LINK Any one of these apps will work. It is recomended to use one with a good rating. YouTube also has step by step directions on how to use many logcat apps​
[SIZE=+1]Q14: What does odexed and de-odexed mean and what is the difference between the two?[/SIZE]Please read HERE​
[SIZE=+1]Q15: What is a Nandroid backup?[/SIZE]A Nandroid backup is a complete backup of your entire current operating system. It backs up the NAND flash, (this is the hard drive of your device). A Nandroid backup can mean the difference when you install a custom rom or when you play with the roots of your device, and something goes wrong.​
[SIZE=+1]Q16: How do I make a Nandroid Backup?[/SIZE]In order to make a Nandroid backup, you must have a custom recovery installed.
From your phone, enter recovery mode and look for the ‘backup and restore’ click on backup and wait a few minutes until the process is done. It is best to save your Nandroid backups on the external SD card or on the PC to avoid erasing it by mistake. Performing a back up will NOT back up your external sd card and unless you choose to format your external sdcard, this will remain a safe place for this back up​
[SIZE=+1]Q17: How do I restore a Nandroid Backup?[/SIZE]Enter recovery mode again and look for the ‘backup and restore’. Select restore and everything should go back to normal in a few minutes.
If you choose the ‘Advanced Restore’ option, you can select which component of the backup to restore – like the boot, system, data or cache.
Reboot system. Your system is now restored and is exactly same as the time when the backup was made.​
[SIZE=+1]Q18: What is CWM Recovery (ClockWorkMod Recovery) and TWRP (TeamWin Recovery Project)?[/SIZE]They are recovery program's that allows you to backup / restore a full or partial system backup of your device. They also allow you to install flashable .zip files; which is one of the primary installation methods for custom ROMs. They also provides other features such as cache and delvik wiping, battery reset, and other processes. If you are thinking about flashing custom ROMs or just want a really good backup program, it's strongly advised that you to install one of these.​
[SIZE=+1]Q19: Why does my battery drain so quick?[/SIZE]Please see HERE for possible steps that can help​
[SIZE=+1]Q20: What is "Bloatware" (Bloated Software)?[/SIZE]Bloatware is all of the extra software applications that come pre-installed on your device (in addition to vanilla Android)–it can include any kind of application but some of the most notable examples are carrier apps and/or trial apps that you have to pay for after a certain time to keep using it. At best these apps can simply be taking up space on your phone, or at worst it can be running in the background without your knowledge and drain your battery​
[SIZE=+1]Q21: How do I remove "Bloatware"?[/SIZE]Important: You will require root for the following process
Start by making a backup of all apps in your recovery.
Next read this tutorial, How to remove bloatware on AT&T LG G3​
[SIZE=+1]Q22: How do I block "OTA" (Over The Air updates)?[/SIZE]Please follow these simple steps found here​
[SIZE=+1]Q23: What is the best rom for my phone?[/SIZE]While you can ask this as many times as you wish, the only answer is: the one that works best for you! A rule of thumb is to visit a several rom thread's and view what is happening within these rom's. Eventually viewing a few roms will cause the urge to try one that looks good to you.​
[SIZE=+1]Q24 What is the MD5, and what does it do?[/SIZE]It ensures that file's are downloaded correct and complete, in order to avoid issues when installing/using it.​
[SIZE=+1]Q25 What does the term "Bump" mean?[/SIZE]
thecubed said:
A new and easy way to sign boot images for most modern LG phones so they'll boot on any locked phone.
Bump an image once, and flash it to however many phones you please.
Click to expand...
Click to collapse
For a detailed explanation head over to here
Please feel free to offer additional questions w/ answers, you feel may be helpful to others.
** *** **​
This FAQ is part of a Recognized Contributor Group Initiative. Please look for a similar FAQ thread when visiting another device forum.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
A special thanks to everyone who contributed to the production of this FAQ

Coming from the nexus 5, these were some questions I had right away:
What does "Bumped" mean?
Can we root lollipop and if so, is it the same process? Do we still have to go back to kk to root?
Does anyone have the random dead spots in the digitizer where your touches aren't registered in certain spots for a while?
Great thread man
Sent from my LG-D850 using Tapatalk

DigitalUnderground said:
Coming from the nexus 5, these were some questions I had right away:
What does "Bumped" mean?
Can we root lollipop and if so, is it the same process? Do we still have to go back to kk to root?
Does anyone have the random dead spots in the digitizer where your touches aren't registered in certain spots for a while?
Great thread man
Sent from my LG-D850 using Tapatalk
Click to expand...
Click to collapse
All done, except for "spots". I'm not aware of this issue on sock LG G3. If you have further info regarding this, I will gladly post what you find.

I just have a quick question Tony, after flashing a custom rom I plug the usb into my computer from the phone, and my computer doesn't recognize the phone anymore. I just want to drag and drop some music files, but how can I make the computer read the phone again ?
So far I've checked that Im on MTP
Thank you

koc88518 said:
I just have a quick question Tony, after flashing a custom rom I plug the usb into my computer from the phone, and my computer doesn't recognize the phone anymore. I just want to drag and drop some music files, but how can I make the computer read the phone again ?
So far I've checked that Im on MTP
Thank you
Click to expand...
Click to collapse
You should find this tutorial helpful~ [How to fix] Windows 8/8.1 is not detecting my LG G3 device

Unified development section
are we going to get a unified development section? there are just as many and most likely more roms that run on the d850 that are posted elsewhere because they run on multiple versions of the g3. i think it would be a great adition this forum and bring a bunch of new roms in.

is there a d850 stock rom that has hotspot enabaled

What is the procedure for roofing my lg g3 please
---------- Post added at 03:44 AM ---------- Previous post was at 03:40 AM ----------
I am a noob

hi
how can install twrp un order to install custom ROM on LG g3 d855 kitkat 10n rooted with this method https://forum.xda-developers.com/lg...t-lg-firmwares-kitkat-lollipop-t3056951/page5

[MASTER THREAD] Fire HD 8 (2017) (7th Generation)

Hi,
This is a list (incomplete) of all the ROMs, mods, hacks, guides, etc. available for the Fire HD 8 (2017).
This was a root progress discussion thread, and I think there's too much valuable information here to just let it get buried. So, following @Rortiz2's suggestion this thread was transformed to a master thread with the aim of providing a complete guide for anyone wanting to mod their tablet.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Device Codename: douglas
Specifications:
SoC: Mediatek MT8163
CPU: Cortex-A53 (Quad Core 4x1.3Ghz)
GPU: Mali 720
RAM: 1.5GB
Android: 5.1 (FireOS 5.x.x.x)
Storage: 16/32GB
Includes a MicroSD slot
Battery: 3210mAh
Display: 8"
Front Camera: 2MP
Rear Camera: 2MP
The italicized text below are my comments/clarifications.
The root method was patched in 5.6.4.0 (some versions of 5.6.4.0 still work so you could try) It is advisable to disable OTA updates or unlock the bootloader immediately. It is still possible to unlock by a different method, check the bootloader unlocking thread.
Bootloader Unlock and TWRP:
[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)
This is an excellent and complete guide which has everything you need for this. Requires Linux, so you'll have to either install it as dual-boot or use a live system if you are not using it already. You don't need to downgrade if you are on 5.6.4.0.
Rooting:
You can flash Magisk using TWRP after bootloader unlock. Using Magisk is recommended because SuperSU is no longer supported, and Magisk has modules, Magisk Hide, and the root prompt is working (In SuperSU it's not working so you have to always grant root permissions which is a major security loophole)
Rapid Temporary Root for HD 8 & HD 10
This is the first software root method discovered for this tablet and is a really easy and quick method of getting a root shell, and the link has a complete guide on it. Refer here for installing SuperSU for permanent root, and here for an automated script for Windows.
[ROOT] Hardmod Root Your Amazon Fire HD 8 (7th Gen)
This is first root method ever discovered for this tablet and is a hardware root. This link has a complete step-by-step guide, assuming you have some soldering experience.
ROMs:
[ROM][unlocked]Lineage-12.1 for Amazon Fire HD8 2017 (douglas)
The first (and currently only) ROM for this device and it works great!
Miscellaneous:
Amazon Fire Toolbox, I have never tried this but it looks awesome!
Without root:
Removing accounts and viewing Usage Access settings which are hidden.
Debloating guide without root
With root:
A debloating guide made for HD 10, but works fine on the HD 8.
You can install apps as system apps just as on any other device, and you can use the app Link2SD for converting user apps to system apps. Refer to this StackExchange post for a guide on how to install apps as system.
Flashing GApps works well with TWRP, but the 16GB version doesn't have enough space in the system for even the pico version. Probably using pm uninstall on some system apps would work.
General Tips:
To return to stock or recover from a soft brick:
(Don't use this if you have already unlocked your bootloader: if you want just stock FireOS flash it through TWRP, and if complete stock follow the guide in the unlock thread)
(This assumes that you have ADB installed, I would not advise you on how here, there are numerous guides waiting for a Google search. This will erase your data.)
Download your current FireOS or a later firmware version. You can find the latest over at Amazon's website.
Boot to the recovery mode of your tablet, and use the volume and power buttons to select "Apply Update via ADB".
Now connect the tablet to a PC with a USB cabke, open a command prompt or shell on the directory where you downloaded the firmware BIN, enter the command adb sideload X.bin (replace X with the name of the BIN) and wait until finished (DON'T disconnect your device from the PC)
Now select "Wipe Data/Factory Reset" and "Yes" to wipe data (you can skip doing this if you want your data, but note that the tablet may bootloop or complain about corrupted data)
Select "Reboot system now"
The firmware BINs are just renamed ZIP files: you can rename it from .bin to .zip and treat it as such.
Amazon employs an anti-rollback mechanism which could permanently brick your device if you flash an older version through adb sideload. If you really want an older FireOS, you can rename .bin to .zip and flash them through TWRP after unlocking.
The stock launcher AppID is com.amazon.firelauncher, the stock keyboard is com.amazon.redstone, and the OTA update apps are com.amazon.device.software.ota and com.amazon.kindle.otter.oobe.forced.ota.
Again, this list is incomplete, so please suggest any additions in the comments! (don't hesitate to suggest your own work-the target of this thread to be a comprehensive and complete guide on everything about this tablet)
Good luck modding this tablet!

Thread before changing to a master thread (for historical purposes )
NOW WE HAVE AN UNLOCKING METHOD WITH TWRP! THE CONTENT BELOW IS OUTDATED.
Hi,
Now, I'm sick of Amazon's bloat slowing my tablet, and the frustration of not being able to use root apps. Fire HD 10 got rooted, but HD 8 and HD 7 are still in dark. HD 7 users can at least downgrade their devices and hope for a root exploit, but HD 8 users can't. If anyone else wanting to root this tablet and make it super fast, get rid of Fire Launcher, use Xposed, remove bloat, etc., let's collaborate with this!
LATEST RELEASE - Fire OS 5.3.6.4/Fire OS 5.6.3.4
SECURITY PATCH - ???
KERNEL VERSION - 3.18.19
List of possible software root methods:
1.) eMMC overwriting
Thanks to the hardware root method, we have a full eMMC dump so using the loophole in the flash unlock process which causes overwriting partitions next to it, we could overwrite on all the way, flashing original things, to the system partition and then flash a modified system partition.
Additions to the list are welcome!
List of possible exploits
Additions to list are welcome!
1.)CVE-2017-8890
Status: Confirmed possible.
Description: As I think, this is the most exploitable currently. Running the PoC results in 'somewhat unnatural' Use-After-Free s but the PoC fails to orient them to escalate privileges.
Cons: This exploit is based on obsolete IPv4 sockets, unlike it's cousin CVE-2017-9077, which is based on IPv6, but rather the same exploitation as this. That 'may' make this harder to exploit, but of course there's no evidence.
I, really only added this to cons because you should have a con.
2.)CVE-2017-15868
Status: Unsure
Description: NP Hardass said that this vulnerability is present on the source,I haven't explored it yet.
Cons: ¯\_(ツ)_/¯
If you tried these exploits, please notify me in below and I'll update the status. UPDATE: No point on keeping on trying these kernel exploits as no one (please correct me) who knows to write exploits in C comes here anymore. If someone wants to try though I will start maintaining this list again. Come on, let's collaborate on this!!! :laugh:
Thanks!
Download the eMMC dump from here: https://www.androidfilehost.com/?w=files&flid=282721
PS: You can download original kernel sources from Amazon, just search for it.
Original Thread:
Hi,
Now, I'm sick of Amazon's bloat slowing my tablet, and the frustration of not being able to use root apps. Fire HD 10 got rooted, but HD 8 and HD 7 are still in dark. HD 7 users can at least downgrade their devices and hope for a root exploit, but HD 8 users can't. If anyone else wanting to root this tablet and make it super fast, get rid of Fire Launcher, use Xposed, remove bloat, etc., let's collaborate with this!
LATEST RELEASE - Fire OS 5.6.0.1
SECURITY PATCH - 2017/08/01
KERNEL VERSION - 3.18.19*
*a quite old release it is.
List of possible exploits
Additions to list are welcome!
1.)CVE-2017-12762
Status: Unsure
Description: A super likely-to-work great exploit. If you want you can go look at the kernel source (link included below the thread) 3.18.19 for proof, it starts in line 2640. Looks like a stack buffer overflow.
Cons: ASLR may be an absolute game killer in this case. And some skill is required to exploit, very less-known around the internet. And Amazon may have removed the ISDN support up from the roots of kernel, because it's VERY deprecated.
2.)CVE-2017-16939
Status: Unsure
Description: A nice attack vector. A PoC is available in SecuriTeam blogs, which triggers use-after-free. I tried contacting them for some help, but they almost instantly replied that they don't provide support for their reported vulnerabilities. Sad.
Cons: ¯\_(ツ)_/¯
3.)CVE-2017-15868
Status: Unsure
4.)CVE-2017-10661
Status: Unsure
5.)CVE-2017-7541
Status: Unsure
6.)CVE-2017-6074
Status: Unsure
If you tried these exploits, please notify me in below and I'll update the status. Come on, let's collaborate on this!!! :laugh:
Thanks!

I added the link to the vulnerable code, in case anyone was wondering.

I'm glad to see this thread. Since recently rediscovering the potential of an old Fire 6 and rooting it, removing the bloat and Googlizing it, I wanted to get something a little bigger. I just got my 7th gen HD 8 in the mail yesterday and was devastated to see it was 5.4.0.1. I've blocked OTA, deleted the update it had downloaded, installed Google Play et al., and used NoRoot Data Firewall to block all Amazon apps. Unfortunately, I do not have the expertise to contribute much toward an effort to root this device but would like to help in any way. I appreciate seeing others are out there working on it.

if i knew how to develop the exploits i would honestly try these

Thank you so much for making this thread but I hope I never have to come back here and help, but if i get some extra time in the future I do plan on running all my binaries + servers on the tablet as well. Not to mention just looking at that version number made me want to vomit.

[/COLOR]What steps should I take to increase performance on the hd 8 while we wait for root?

rawfullz said:
[/COLOR]What steps should I take to increase performance on the hd 8 while we wait for root?
Click to expand...
Click to collapse
Hello rawfullz!
Try Greenify. You can use a workaround to grant it Usage Access.
1) Download Activity Launcher and Greenify from Play Store.
2) Launch Activity Launcher.
3) Notice the "Recent" text in the task-bar, press it, and select "All" from the drop-down list.
4) Scroll all the way below until you find "Settings", and press it.
5) Again, scroll below until you find "Apps with usage access", and press it.
6) The hidden "Apps with usage access" menu will pop up.
7) Grant Greenify usage access there. (You can turn off usage access for all Amazon apps if you want, to increase performance but it's recommended to leave out "Storage Management" intact, just in case.)
8) Launch Greenify, and continue with the setup.
9) :laugh::laugh::laugh::laugh:
If you ever want to grant any other app Usage Access, do this procedure, but, remember that "Activity Launcher" is kind of dangerous, if you just launch random activities. I learned that the hard way.

REMOVED

Thank you for making this thread, im looking forward to this become real.

What I dont get is you can download the firmware.bin as well as the source code from amazon, Whats the problem devs should be able to root ?

derwoodbones said:
What I dont get is you can download the firmware.bin as well as the source code from amazon, Whats the problem devs should be able to root ?
Click to expand...
Click to collapse
Hello!
Yes, we definitely can get the firmware. But there are some troubles,
1. Amazon devices are not very well known among the community.
2. Devs don't want to spend their time on our devices, even if we root this thing, no custom ROMs because of the locked bootloader.
3. Amazon didn't leave any loopholes on their OS, they are too clever.
And, I don't think that Amazon will open source their firmware until they checked throughly for any exploits.
We'll have to find exploits the rough way. :crying:

Hey, what about the Janus vulnerability? If some dev is reading this, please help us, because it doesn't require the device.

Supersonic27543 said:
Hello!
Yes, we definitely can get the firmware. But there are some troubles,
1. Amazon devices are not very well known among the community.
2. Devs don't want to spend their time on our devices, even if we root this thing, no custom ROMs because of the locked bootloader.
3. Amazon didn't leave any loopholes on their OS, they are too clever.
And, I don't think that Amazon will open source their firmware until they checked throughly for any exploits.
We'll have to find exploits the rough way. :crying:
Click to expand...
Click to collapse
You don't need an unlocked bootloader to flash a ROM.

Take a look at the BT stack with BlueBorne.
Sent from my iPhone using Tapatalk

Supersonic27543 said:
Now, I'm sick of Amazon's bloat slowing my tablet
Click to expand...
Click to collapse
You forgot to add: "and I wanna to fill my tablet by the Google's bloatware (2 times slower than Amazon's), and also add some rootkits and spyware masked as "super-duper tools for young hackars"

Great to see this thread. Hope some devs collaborate and find a way. Can't wait.
Meanwhile, do you guys have any cool mod to try in the tab.
I have installed playstore and adfree iytb YouTube and bunch of usual apps.

Hello!
DragonFire1024 said:
You don't need an unlocked bootloader to flash a ROM.
Click to expand...
Click to collapse
Yes, you don't need an unlocked bootloader to flash a ROM, theoretically, if the ROM is signed by Amazon. But considering custom ROMs, Lineage, Resurrection Remix, Stock Android, is it possible to compile and flash them without an unlocked bootloader? I thought that you need a custom recovery = unlocked bootloader. Thanks!
sensboston said:
You forgot to add: "and I wanna to fill my tablet by the Google's bloatware (2 times slower than Amazon's), and also add some rootkits and spyware masked as "super-duper tools for young hackars"
Click to expand...
Click to collapse
Hah. :laugh::laugh::laugh:
Robius said:
Take a look at the BT stack with BlueBorne.
Sent from my iPhone using Tapatalk
Click to expand...
Click to collapse
Great idea, gotta try this! Thanks!
EDIT: Not very confident though. Anyway, likely to work because the security patch of HD 8 is in August.
http://www.androidpolice.com/2017/0...atch-fixes-blueborne-bluetooth-vulnerability/

Someone got a bluetooth adapter handy?

Supersonic27543 said:
Hello!
Yes, you don't need an unlocked bootloader to flash a ROM, theoretically, if the ROM is signed by Amazon. But considering custom ROMs, Lineage, Resurrection Remix, Stock Android, is it possible to compile and flash them without an unlocked bootloader? I thought that you need a custom recovery = unlocked bootloader. Thanks!
Hah. :laugh::laugh::laugh:
Great idea, gotta try this! Thanks!
EDIT: Not very confident though. Anyway, likely to work because the security patch of HD 8 is in August.
http://www.androidpolice.com/2017/0...atch-fixes-blueborne-bluetooth-vulnerability/
Click to expand...
Click to collapse
Ask @ggow how he does it. But you don't need a unlocked bootloader. With root, FlashFire helps to get by the bootloader.

General [Kernel] StarKissed B2Q [Raccoon City]

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This kernel is (currently still very) experimental. Use at your own risk.​
This kernel assumes a few things about you, the user:
1. You have a Samsung Galaxy Z Flip 3
2. You have read all warnings and instructions
3. You are rooted (implying an unlocked bootloader)
4. You have an installation method
5. You have a backup boot image
Releases will be labeled with the commit hash of their source. An unlocked device is recommended for this kernel, but not necessarily required. I am not responsible for any issues or damage caused by installing this kernel, so have a backup ready.
Downloads for : Samsung Galaxy Z Flip3 5G | AndroidFileHost.com | Download GApps, Roms, Kernels, Themes, Firmware and more. Free file hosting for all Android developers.
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
www.androidfilehost.com
All kernels are released with the possibility of not booting. This should be considered a WIP release. They are provided for review and testing of the included components.
Thank you to everyone that has contributed to kernel development.
Specific credit is provided by maintaining accurate commit history.
Also, big thanks to @beanbean50 for testing the untested releases.
GitHub - StarKissed/starkissed-kernel-b2q
Contribute to StarKissed/starkissed-kernel-b2q development by creating an account on GitHub.
github.com
GitHub - StarKissed/AnyKernel3 at SM-F711B
AnyKernel, Evolved. Contribute to StarKissed/AnyKernel3 development by creating an account on GitHub.
github.com

Current Kernel Improvements
Boeffla Wakelock Blocker v1.1.0
Wireguard v1.0.20210606
Patched SafetyNet commandline
Magisk process detection patch
Disable watermark boosting
Multicolor LED / PlayStation / Nintendo HID
Tuxera ExFAT / NTFS modules
Umbrella Core / Raccoon City [WIP]
Optimization from Kirisakura / StarKissed
raccoon_city (originally written for the Shield Tablet) is a new take on "interactive" by using a combination of low latency timers and the kernel scheduler to scale more aggressively (or less, if configured that way) based on workload, in addition to capping the max inactive frequency. The purpose is to provide a balance between good battery life and performance without handicapping the device.
umbrella_core (originally written for the Note 4 and ported to hundreds of other devices) takes raccoon_city a step further with automation. In addition to the full array of user settings, this governor features a smart mode that will adjust the base values within a set range to further optimize battery and performance.
The difference between these governors and the batterysaver implementation (also available) is the lack of arbitrary caps on max values during normal use. By controlling the workload, this allows better control over when the next frequency is reached, instead of whether it is available at all.
The default configuration idles at a max of about 800 mHz, but can be configured for each cluster, much like most settings.
The original source is provided through the public Samsung source under SM-F711B
Samsung Open Source
opensource.samsung.com
Building / Compiling Custom Kernels
starkissed-kernel-b2q/build at main · StarKissed/starkissed-kernel-b2q
Contribute to StarKissed/starkissed-kernel-b2q development by creating an account on GitHub.
github.com

I haven't finished setting up my phone to back it up, wipe it, and start over with an unlocked bootloader yet. If anyone is feeling really brave and wants to test the builds, though, you are welcome to contact me. Remember that I have absolutely no idea if they will even boot, though.

Temporarily delayed. See below.

I really want to try this but for the life of me I can't get any fastboot commands to work (waiting for any device) flashed every known usb/fastboot driver out there, changed ports/cables etc but no luck, ADB works fine. Is there a way to make it flashable through Magisk or Odin?

beanbean50 said:
I really want to try this but for the life of me I can't get any fastboot commands to work (waiting for any device) flashed every known usb/fastboot driver out there, changed ports/cables etc but no luck, ADB works fine. Is there a way to make it flashable through Magisk or Odin?
Click to expand...
Click to collapse
I've been looking for how to convert it. I missed a couple changes, so I'm trying to wrap those up first.

I have a feeling it will be much like the last few devices where you need to use FKM, EX, etc until such time as custom recoveries exist. I don't see any instances where anyone has converted a modern kernel to Odin (tar) format, which means I doubt there was much success.

@twistedumbrella Probably silly question. I've always wondered if video-out is a hardware or software limitation on this device, since it lack DeX and I can't get any other video signal via USB-c.
Q: In your Kernel, does it allow any video signal from "force desktop mode" or similar via the USB-c or do you think this is total no-go due to hardware limitation?
EDIT: oh wait sorry, I think you actually answered my question in a another thread, although I did not really understood if it was confirmed to be a hardware limitation or not.

Tracking down a couple modules that still need to be made inline. I thought I had converted all of them. Once that's done, we should be good to start releasing builds.
jacobsson said:
@twistedumbrella Probably silly question. I've always wondered if video-out is a hardware or software limitation on this device, since it lack DeX and I can't get any other video signal via USB-c.
Q: In your Kernel, does it allow any video signal from "force desktop mode" or similar via the USB-c or do you think this is total no-go due to hardware limitation?
EDIT: oh wait sorry, I think you actually answered my question in a another thread, although I did not really understood if it was confirmed to be a hardware limitation or not.
Click to expand...
Click to collapse
There is a lengthy discussion on reddit where they found the same results and came to the same conclusions. If no signal is possible, wired video out appears to be missing altogether.
Interesting enough there ARE disabled drivers for it. The only thing I don't know is if they would work. I guess the only real way to find out would be to enable them and find some lucky victi... I mean tester to see if they enable it.

This is going to be interesting...
I have a US unlocked model and rumors are surfacing that this means I cannot unlock the bootloader. It has been stated that this has been the case for many years. This contradicts my experience with the Note 20 Ultra, which was also a US unlocked model with OEM unlock available.
That said, until I can confirm that the bootloader can be unlocked, I am unable to test builds on my own device. I am, however, able to test very similar builds with the same changes on a device with similar hardware.
Assuming Samsung lives up to their history of releasing kernel source that builds out of the box, this should allow building working kernels with only those changes that have been tested on the other device. Please note that the base source is for the European device.
I highly recommend having all data backed up and am Odin restore ready until such time as the kernel has a few confirmations.

Here goes nothing...
starkissed-b2q-b5cf738.zip | by twistedumbrella for Galaxy Z Flip3 5G
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
androidfilehost.com

Thanks for this, it looks very good but how do we flash it (whilst waiting for twrp) I've tried FKM, EX, Flashify, Magisk and Odin but all of them failed

beanbean50 said:
Thanks for this, it looks very good but how do we flash it (whilst waiting for twrp) I've tried FKM, EX, Flashify, Magisk and Odin but all of them failed
Click to expand...
Click to collapse
I guess this isn't a slot device like most of the newer ones. It would make sense not being one, but I didn't want to break anything being wrong. Assuming it had the slots when it didn't only fails. Assuming it didn't have the slots if it did could have caused a bad write. It was better to try with before trying without, since there is no fastboot to flat out check the device directly.
Here is a version without slots. Fingers crossed.
starkissed-b2q-17c6dd2a1e87.zip | by twistedumbrella for Galaxy Z Flip3 5G
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
androidfilehost.com

No luck here, FKM said something about 'Magisk detected no need to ...' but I missed the rest of the log as it rebooted within 2 seconds of flashing. However, it got stuck on the Samsung logo upon rebooting, thankfully and eventually I got into download mode and re-flashed the stock rom and all's well again.

beanbean50 said:
No luck here, FKM said something about 'Magisk detected no need to ...' but I missed the rest of the log as it rebooted within 2 seconds of flashing. However, it got stuck on the Samsung logo upon rebooting, thankfully and eventually I got into download mode and re-flashed the stock rom and all's well again.
Click to expand...
Click to collapse
It should have been telling you magisk was detected, so there was no need to install again. I'll have to look back over everything. The hardest part is not being able to test it locally.

Here's the install log if it's any help ...

beanbean50 said:
Here's the install log if it's any help ...
Click to expand...
Click to collapse
Thanks. I think the issue is a few drivers that didn't inline. They hid them all over and Samsung added fuel to the fire by making individual configuration files for each platform (despite being identical).

ok the kernel is being in testing (or experimental), but who has tested it, noticed improvements in battery life? Thank you

iaio72 said:
ok the kernel is being in testing (or experimental), but who has tested it, noticed improvements in battery life? Thank you
Click to expand...
Click to collapse
we still can't flash it (see the post above your one) but the good news is that we should soon have twrp and a custom rom

Even if the kernel didn't fully boot, the good news is that it froze on the Samsung logo and didn't simply reboot. What that means is that, most likely, it really is as simple as tracking down why these drivers are building as modules and making them inline. I imagine, even with things how they are, that the kernel might boot given enough time. Nobody wants to wait that long, though.

[Firefly] [ROCKCHIP] 3.5-Month UPDATE: Firefly ITX-3588J (Rockchip RK3588) "Deskphone" WORKS! Almost.

After 3.5 months of trial and error, unresponsive communities, ups and down, spending $75 on a video card that may be proving unnecessary ... I finally present to you - an almost fully-working Firefly ITX-3588J Dual-Boot Android/Linux ARM Machine.
WHAT IS IT?
The Firefly ITX-3588J is a Mini-ITX - small PC form-factor - "single-board computer" that was released earlier this year by the Chinese manufacturer Firefly, aka. T-Chip Intelligent Technology Co. Ltd.. It features the Rockchip RK3588 (hence the name) ARM system-on-chip (SoC) in a package that adduces many different kinds of ports including a PCI Express x4 slot, multiple HDMI video outs that go to the on-chip Mali GPU, and an M.2 that can be used in theory to add a telephone network card, making it a mini-desktop and smartphone all in one.
I got one because I saw it as an opportunity to for once have an easily-transportable low-energy consumption system that would be both an alternative to x86 and also not the Mac while still offering reasonable performance even if far from top-of-the-line - and ideally, it'd be great if more such boards come later because other ARM SBC boards tend to be both more limited and also very awkward with their cables. This is the only one I'm aware of, besides certain Raspberry Pi breakout boards like the Turing Pi, that can use a standard PC case.
But getting it to work, on the other hand, proved to be MUCH more diifficult because while the vendors offered a choice between Android 12 and Ubuntu 20.04 operating systems, I realized I needed both: I wanted access to both software ecosystems on the same machine, and was determined to get that to happen. And I want to say that within the last few days I have finally come quite close to achieving this dream in full.
WHAT DOES IT DO NOW?
Right now, the machine dual-boots Android 12 and Ubuntu 20.04 using the vendor-provided patched 5.10.66 Linux kernel source tree, with the user-space data of both OSes stored on a SATA SSD hard disk instead of the embedded eMMC. Boot selection is possible on startup simply by hitting "Ctrl+C" and typing the appropriate command to select the Ubuntu OS; otherwise, Android 12 boots by default. All this happens by video console on U-Boot with no serial port requirement, making it function as a proper stand-alone dual-boot ARM PC.
WHAT IS STILL TO BE DONE?
Graphics support on Ubuntu 20.04. No idea why this isn't working even with the provided kernel and driver packages. Text console over monitor works fine, though.
WHAT DID IT TAKE TO MAKE IT GO?
In retrospect, it's not really all that difficult. The most difficult part was just figuring everything out because there was very little comprehensive documentation given beyond how to simply load the images, and I had before this point zero real experience actually piecing together an Android system on a mobile/embedded-style board and machine. One thing that's a casualty is the stock Ubuntu image; it turned out to be much more fruitful to simply install the system to the hard drive via a procedure analogous to, albeit having to be arranged manually, what a typical installer would do, i.e. setting up and using APT to load the whole Ubuntu system from the Internet over wi-fi with the only vendor-adulterated component being the kernel and Mali graphics drivers because Valhall, nor even the whole RK3588, is currently mainlined in the Linux kernel system.
WHAT DOES IT LOOK LIKE?
The machine:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Running Android:
Ubuntu (no graphics yet!):

@Shimmy99 Would you please offer the procedure you used to make the board boot from SATA SSD?
That would be greatly apprecaited. I have a similar board and I have been interested in installing Android on a SATA SSD but the vendors don't respond to messages and there is very little information on their forum.
Thank you

qwestmogul2012 said:
@Shimmy99 Would you please offer the procedure you used to make the board boot from SATA SSD?
That would be greatly apprecaited. I have a similar board and I have been interested in installing Android on a SATA SSD but the vendors don't respond to messages and there is very little information on their forum.
Thank you
Click to expand...
Click to collapse
Mmm. I don't have a direct boot from SSD possible yet. Getting it to this stage has required coding work on the provided U-Boot and I would share a source pack to my github but it will take more to get direct SATA boot because it crashes when the U-Boot is compiled with those config options enabled for some reason. My focus mostly was on getting graphical console on the U-Boot so that there is not need to use the serial debug simply to switch OSes ). The way it works currently is that the kernels for both Android and Ubuntu are loaded to the eMMC, then the userdata / rootfs are loaded to the SSD. That said, I could try to play with that for sure.

It would really be nice if there was an easy way to install OS on SSD drive,that would be a massive upgrade from the measly 128GB EMMC.
By the way I don't know if you have already figured this out but there is an easy way to install GAPPS without using the tedious method you used.
You simply patch boot.img with Magisk then use ADB to install it back to the unit. From there you can use Magisk to install Magisk GAPPS.
For the life of me I can't seem to figure out how to install GPS/GNSS drivers for Android. The stock firmwares provided by the vendor have GPS drivers but those stock firmware have 1920x1080 resolution whereas I want to use 3840x2160 screen.
One way of dealing with that is editing build.prop file in vendor folder which works but then the unit won't boot past boot screen when a patched boot.img is installed. so it is sort of catch 22.

qwestmogul2012 said:
It would really be nice if there was an easy way to install OS on SSD drive,that would be a massive upgrade from the measly 128GB EMMC.
By the way I don't know if you have already figured this out but there is an easy way to install GAPPS without using the tedious method you used.
You simply patch boot.img with Magisk then use ADB to install it back to the unit. From there you can use Magisk to install Magisk GAPPS.
For the life of me I can't seem to figure out how to install GPS/GNSS drivers for Android. The stock firmwares provided by the vendor have GPS drivers but those stock firmware have 1920x1080 resolution whereas I want to use 3840x2160 screen.
One way of dealing with that is editing build.prop file in vendor folder which works but then the unit won't boot past boot screen when a patched boot.img is installed. so it is sort of catch 22.
Click to expand...
Click to collapse
Thanks. Yes. I am currently working on trying to build up a software system that will enable proper booting from SSD "due to popular demand" from here (basically trying to modify the provided "RK U-Boot" and/or combine it with GRUB), however my progress has been set back after having lost the FIQ serial debug converter for my board and needing to get a new one. Also, I didn't know about that trick with Magisk, thanks! And when you say "won't boot past boot screen", what do you mean? Do you have any logs from the USB or from the FIQ serial stream for when that happens?

After the patched boot file is loaded back into the unit using ADB,the unit simply shows Firefly logo,the screen goes black then it shows the same logo,it never goes past that logo.
In other words I want a unit that has a patched boot file so that I can root it with Magisk and also have 4K resolution which only attainable by editing the build.prop file.
The root that is already in the stock firmware is inadequate because they lack SU binaries and therefore most apps that require root permission don't work effectively.
I have no way of generating logs,I don't have a serial debugger.
My goal is to have a simple Android system that I can install in my car with 4K portable screens and GPS.
I have tried the Android radios being sold out there and don't meet my needs for a system that can use 4K screens.They are still stuck in 1920x1080 or below resolution,not to mention that they can't play 4K video files without stuttering or freezing. They also lack storage that can store those large files.

qwestmogul2012 said:
After the patched boot file is loaded back into the unit using ADB,the unit simply shows Firefly logo,the screen goes black then it shows the same logo,it never goes past that logo.
In other words I want a unit that has a patched boot file so that I can root it with Magisk and also have 4K resolution which only attainable by editing the build.prop file.
The root that is already in the stock firmware is inadequate because they lack SU binaries and therefore most apps that require root permission don't work effectively.
I have no way of generating logs,I don't have a serial debugger.
My goal is to have a simple Android system that I can install in my car with 4K portable screens and GPS.
I have tried the Android radios being sold out there and don't meet my needs for a system that can use 4K screens.They are still stuck in 1920x1080 or below resolution,not to mention that they can't play 4K video files without stuttering or freezing. They also lack storage that can store those large files.
Click to expand...
Click to collapse
Wow, that is some really interesting use of this device. Are you able to capture anything via the debug serial interface? (TTL serial, port is called "DEBUG" on the board, it appears to be the preferred serial interface for this processor.) If you don't have a suitable TTL->USB converter, you might want to get one. It must be able to support 1500000 baud, though, so be careful to check. Firefly offers one, though I lost mine as I mentioned and I had to get another, though a different one so I can mount it permanently in the case and break out a back-of-the-case port.
If you can capture anything via the TTL serial line, that would be great. That should give you some idea of what it's choking on. Send me that just so I can think about it while I'm waiting on this.

I will definitely order one.I never thought I would hit such a roadblock.I have edited various kind of Android roms successfully.This one from Firefly though is something else.I suppose that is what happens when they make their work not open source.
By the way do you know how to unpack super.img? the unpack script provide does not recognize super.img even if I change the name to update.img

qwestmogul2012 said:
I will definitely order one.I never thought I would hit such a roadblock.I have edited various kind of Android roms successfully.This one from Firefly though is something else.I suppose that is what happens when they make their work not open source.
By the way do you know how to unpack super.img? the unpack script provide does not recognize super.img even if I change the name to update.img
Click to expand...
Click to collapse
Sorry for not responding sooner but I was diligently cracking away at this thing VERY much actually ... !!!
Ah yes, I think though I'm pretty close to getting it to work; most of the work so far has been in trying just to figure out how everything works given documentation is scant and I had never, ever worked with Android or anything else at this level before!
Very little of the material is not opensource - some of the tools required to generate the rockchip images does not appear to be and there are some binary-blob kernel drivers, but a LOT more than one thinks is; you just have to ask Firefly for the "board SDK" and they will provide on request. Other than what I mentioned, the code in there is pretty much all licensed under GPL (hence why they have to give you that code, given they've made kernel modifications to support the RK3588 - apparently mainstream support is coming along but is still not primetime yet).
Nonetheless, I see you've unpacked the Android image ROM, so perhaps you already have that - if so, great. Hence let's get to it (note maybe you know some of this already but I also want to make this post useful for as many people as possible): super.img - which I'm actually playing with right now - is not Firefly magic, but is generic Android and has been mentioned before on this forum if you search for "super.img" here. It's a "super partition" that contains partitions.
Editing system.img inside super.img and flashing our modifications
I'm trying to modify my system.img (/system/build.prop) to include support for multi users. After struggling a lot, I've succeeded following your guide (that's an awesome work btw) to unpack, mount, modify, umount and repack super.img. Then...
forum.xda-developers.com
To unpack it you need to grab OTA Tools:
[GUIDE] OTA Tools LPUnpack
Please see this URL https://android.googlesource.com/platform/build.git/+/eec4a7cba4face3370acb6293ab357879920b467 and this for more information. Hi everyone. I'm surprised I havent seen a thread about ota tools yet and lpunpack. This zip file...
forum.xda-developers.com
and the way to do this is you should first use the program simg2img, which actually ships with Ubuntu as a package of the same name I believe. Suppose you're in the Linux terminal and working in the directory containing super.img. Create (if you haven't already) a directory to unpack it, e.g.
Code:
mkdir super_unpack
Then use simg2img to get a "raw" version:
Code:
simg2img super.img super.img.raw
then finally use the OTATools (replace the string "/path/to/otatools" with whatever, or put them on your PATH, or ...)
Code:
/path/to/otatools/lpunpack super.img.raw super_unpack/
and now you should have it fully unrolled into smaller .img files which will ACTUALLY mount. In particular, I needed this because product.img specifically seems to be the best place to load GApps into - they will both come up on first Android boot and they will be retained if you do an Android system reset ("reset to factory defaults").
Now REPACKING super.img ... that's the fun part!

I had actually managed to find the instructions to unpack the super.img and also managed to mount vendor.img which is where I wanted to make changes in modifying the build.prop file.
After repacking the super.img and flashing it using fastboot the Android did not boot.
I also managed to incorporate the super.img to a ROM but the Android did not boot as well.
My thinking is that Android 12 being a Dynamic partitioned rom does not allow any modification in the root system and that is why I have not had success making the Android boot.
It used to be so easy to do that on Android 10 but Android 11 and 12 are not.
Well,if someone manages to do it,I hope to understand how they did it.
As of now I am pretty much stuck with a vanilla rom which is very disconcerting considering how expensive the ITX-3588J is.
By the way I already have SDK which I have been using to make roms.
Please let me know if you manage to boot the Android using a repacked super.img
As always I am very grateful for your assistance. Happy Ney Year!

qwestmogul2012 said:
I had actually managed to find the instructions to unpack the super.img and also managed to mount vendor.img which is where I wanted to make changes in modifying the build.prop file.
After repacking the super.img and flashing it using fastboot the Android did not boot.
I also managed to incorporate the super.img to a ROM but the Android did not boot as well.
My thinking is that Android 12 being a Dynamic partitioned rom does not allow any modification in the root system and that is why I have not had success making the Android boot.
It used to be so easy to do that on Android 10 but Android 11 and 12 are not.
Well,if someone manages to do it,I hope to understand how they did it.
As of now I am pretty much stuck with a vanilla rom which is very disconcerting considering how expensive the ITX-3588J is.
By the way I already have SDK which I have been using to make roms.
Please let me know if you manage to boot the Android using a repacked super.img
As always I am very grateful for your assistance. Happy Ney Year!
Click to expand...
Click to collapse
Thanks. I did not see any mention about build.prop, though maybe you dropped that on another thread that wasn't in my notifications anymore.
You say the "Android did not boot". Do you have a adb dump? Do you have a serial (UART) debug dump (i.e. through the FIQ port)? Also, how are you repacking super.img? It is a tricky process as I mentioned at the end.

I did mention build.prop editing on my second comment of this thread.I initially tried to use root explorer file manager,that did not work.Then attempted to pull file from the system using ADB,edited it on my computer then pushed the edited file back to the system.That did not work either.
That is when I resorted to trying to edit it by unpacking the super.img.
I am still waiting to receive USB SERIAL debugger.
As for how I unpacked and repacked the super.img I used the instructions on the thread on this link
Editing system.img inside super.img and flashing our modifications
I'm trying to modify my system.img (/system/build.prop) to include support for multi users. After struggling a lot, I've succeeded following your guide (that's an awesome work btw) to unpack, mount, modify, umount and repack super.img. Then...
forum.xda-developers.com

Maybe this helps: https://forum.xda-developers.com/t/linux-porting-native-linux-to-galaxy-note9.3936077/
Somebody ported Linux to the Galaxy Note 9.