How to Unpack Boot Image and remove LG RCT and Triton Lgv20 (Linux & root only) - LG V20 Guides, News, & Discussion

STANDARD DISCLAIMER: I am not responsible for any damages caused to your phone. Use this guide at your own risk there is no warranty or guarantee.
I only know how to do this in Linux in the terminal. This has only been done on Stock Oreo 8.0, may not work on Nougat never tested. This mod will speed up your phone. We are going to remove a very small program "rctd" that's buried in the phones boot image file. Also there is an antivirus scanner burred in the boot image, it slows the phone down by scanning every file.
This guide is my notes on what I did to remove LG RCT from my H910 Lgv20. But you can use this guide to remove LG RCT from your Lgv20.
guide updated on 6-28-22
Requirements:
Root/Twrp
Lgv20
Stock Oreo 8.0
Linux
You can just copy and paste the commands in the Linux terminal.
In the Linux terminal paste:
install: abootimg
Ubuntu: sudo apt-get install abootimg
Arch: yay -S abootimg
install: fastboot & adb
Ubuntu: sudo apt-get install android-tools-adb android-tools-fastboot
Arch: sudo pacman -S android-tools
Reboot phone into twrp. Connect phone via usb cable. In the Linux terminal paste:
sudo su
mkdir /tmp/test
cd /tmp/test
Get your boot.img
adb shell dd if=/dev/block/bootdevice/by-name/boot of=/tmp/boot.img
adb pull /tmp/boot.img /tmp/test
sync
ls
the boot.img should be on your computer in /tmp/test/
You can unplug the usb cable from the phone. But stay in twrp we will need that later.
abootimg -x /tmp/test/boot.img
mkdir /tmp/test/initrd
cd /tmp/test/initrd
cat ../initrd.img | gunzip | cpio -vid
Going to remove rctd and lge_fota updates & comment out LG RCT access also going to comment out lge_handle_panic. And comment out triton service. You should be able to just copy all and paste all at once. Also I found a speed tweak by changing dalvik.vm.dex2oat-Xmx=512m to dalvik.vm.dex2oat-Xmx=256m will increase speed of phone.
rm /tmp/test/initrd/sbin/bnrd
rm /tmp/test/initrd/sbin/rctd
rm /tmp/test/initrd/sbin/lge_fota
sed -i '605 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '964 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '20 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '790 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1029 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1057,1058 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '1067 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '10 s/^/#/' /tmp/test/initrd/nonplat_seapp_contexts
sed -i '485 s/^/#/' /tmp/test/initrd/nonplat_property_contexts
sed -i '1343 s/^/#/' /tmp/test/initrd/nonplat_file_contexts
sed -i '129 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '133 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '137 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '141 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '145 s/^/#/' /tmp/test/initrd/init.msm8996_core.rc
sed -i '7,13 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '17 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '19,29 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '32,33 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '83,105 s/^/#/' /tmp/test/initrd/init.elsa.power.rc
sed -i '232,233 s/^/#/' /tmp/test/initrd/init.elsa_core.rc
you can check to make sure it worked with this command
clear
ls /tmp/test/initrd/sbin/bnrd
ls /tmp/test/initrd/sbin/rctd
ls /tmp/test/initrd/sbin/lge_fota
sed -n 605p /tmp/test/initrd/nonplat_file_contexts
sed -n 964p /tmp/test/initrd/nonplat_file_contexts
sed -n 20p /tmp/test/initrd/nonplat_file_contexts
sed -n 790p /tmp/test/initrd/nonplat_file_contexts
sed -n 1029p /tmp/test/initrd/nonplat_file_contexts
sed -n 1057,1058p /tmp/test/initrd/nonplat_file_contexts
sed -n 1067p /tmp/test/initrd/nonplat_file_contexts
sed -n 10p /tmp/test/initrd/nonplat_seapp_contexts
sed -n 485p /tmp/test/initrd/nonplat_property_contexts
sed -n 1343p /tmp/test/initrd/nonplat_file_contexts
sed -n 129p /tmp/test/initrd/init.msm8996_core.rc
sed -n 133p /tmp/test/initrd/init.msm8996_core.rc
sed -n 137p /tmp/test/initrd/init.msm8996_core.rc
sed -n 141p /tmp/test/initrd/init.msm8996_core.rc
sed -n 145p /tmp/test/initrd/init.msm8996_core.rc
sed -n 7,13p /tmp/test/initrd/init.elsa.power.rc
sed -n 17p /tmp/test/initrd/init.elsa.power.rc
sed -n 19,29p /tmp/test/initrd/init.elsa.power.rc
sed -n 32,33p /tmp/test/initrd/init.elsa.power.rc
sed -n 83,105p /tmp/test/initrd/init.elsa.power.rc
sed -n 232,233p /tmp/test/initrd/init.elsa_core.rc
This is what it should look like. If not, then do not flash the modded myboot.img. I am not 100% sure all Lgv20 boot images are the same. I am 99% sure they should be the same, but just in case.
ls: cannot access '/tmp/test/initrd/sbin/bnrd': No such file or directory
ls: cannot access '/tmp/test/initrd/sbin/rctd': No such file or directory
ls: cannot access '/tmp/test/initrd/sbin/lge_fota': No such file or directory
#/dev/block/platform/.*/by-name/rct u:object_r:rct_block_device:s0
#/dev/rct u:object_r:rct_device:s0
#/(system/vendor|vendor)/bin/triton u:object_r:triton_exec:s0
#/sys/devices/system/cpu/triton(/.*)? u:object_r:sysfs_triton:s0
#/dev/triton:io u:object_r:triton_device:s0
#/dev/socket/bnrd u:object_r:bnrd_socket:s0
#/dev/socket/ccmd u:object_r:ccmd_socket:s0
#/system/bin/ccmd u:object_r:ccmd_exec:s0
#user=_app seinfo=platform name=com.lge.rctprovider domain=platform_app type=app_data_file
#sys.lge.rooted u:object_r:system_prop:s0
#/sys/module/lge_handle_panic/parameters/gen_modem_panic u:object_r:sysfs_gen_modem_panic:s0
# write /sys/module/lge_handle_panic/parameters/cancel_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/pause_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/pause_boot_lockup_detect 0
# write /sys/module/lge_handle_panic/parameters/cancel_boot_lockup_detect 1
# write /sys/module/lge_handle_panic/parameters/powerctl_lockup_detect ${sys.powerctl}
#service triton /system/vendor/bin/triton
# class main
# user root
# group system
# socket triton-client stream 660 system system
# disabled
# oneshot
# start triton
# write /sys/devices/system/cpu/triton/debug 16
# write /sys/devices/system/cpu/triton/enable 1
# write /sys/devices/system/cpu/triton/enforce 0
# write /sys/devices/system/cpu/triton/cur_policy 0
# chown system system /sys/devices/system/cpu/triton/enable
# chmod 664 /sys/devices/system/cpu/triton/enable
# chmod 600 /sys/devices/system/cpu/triton/aevents
# chmod 600 /sys/devices/system/cpu/triton/bevents
# chown system system /sys/devices/system/cpu/triton/cur_policy
# chmod 664 /sys/devices/system/cpu/triton/cur_policy
# chmod 664 /sys/devices/system/cpu/triton/debug
# chown system system /sys/devices/system/cpu/triton/enable
# chmod 644 /sys/devices/system/cpu/triton/enable
#service fg-dump /vendor/bin/sh /vendor/bin/fg_dump.sh 10 /data/logger/fg.log
# user root
# group root system
# class main
# disabled
# oneshot
#on property:persist.service.fg.enable=0
# stop fg-dump
#on property:persist.service.fg.enable=1
# restart fg-dump
#on property:persist.service.fg.enable=2
# restart fg-dump
#on property:persist.service.fg.enable=3
# restart fg-dump
#on property:persist.service.fg.enable=4
# restart fg-dump
#on property:persist.service.fg.enable=5
# restart fg-dump
#on property:persist.service.fg.enable=6
# restart fg-dump
#on property:persist.service.fg.enable=99
# restart fg-dump
# setprop ro.ssbd.session /dev/block/bootdevice/by-name/eksst
# export HALLIC_STATUS_PATH /sys/class/switch/smartcover/state
continue making the myboot.img
find . | cpio --create --format='newc' | gzip > ../myinitd.img
cd /tmp/test
nano bootimg.cfg
delete the first line move everything up one line
bootsize = 0x19b15d3
ctrl-x y enter
make the modded myboot.img file
abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitd.img
plug usb cable back into phone. Phone should still be in twrp.
Going to write all zeros to fota and rct device. Updates and LG RCT devices we don't need them. And going to remvoe the dumpstate file it saves the logcat logs to the eMMC drive and slows down the phone a lot. The logcat files will still be saved to ram up to 4M but they will be deleted when you restart or it runs out of ram. This will speed up the phone removing dumpstate. Also there is a speed tweak need to change five lines in the build.prop file.
Note: If you have already used Auto_Debloat you may get some error messages file not found that's okay. It just means Auto_Debloat took care of the files for you.
mkfs.ntfs /dev/block/bootdevice/by-name/fota
mkfs.fat /dev/block/bootdevice/by-name/rct
adb shell umount -l /system
adb shell mount /system
adb shell rm /system/vendor/bin/subsystem_ramdump
adb shell rm /system/bin/dumpstate
adb shell rm /system/etc/init/dumpstate.rc
adb shell rm /system/bin/ccmd
adb shell rm /system/vendor/bin/triton
adb shell rm /system/vendor/bin/fg_dump.sh
adb shell mount /persist
adb shell rm /persist/rct
adb shell rm /persist/rct.cfg
adb shell umount -l /persist
adb shell umount -l /system
wipe dalvik cache and cache
reboot phone into bootloader aka fastboot from twrp
fastboot flash boot myboot.img
fastboot reboot
exit out of root user
exit
You can unplug usb cable now done.
And that is what I did to remove LG RCT from my Lgv20 phone. One thing to note is that you can not flash a new kernel to the boot.img or you will loose the modded boot.img everything will be reset back to default. If you need to flash a Kernel then just mod the boot.img again afterwards.
If for some reason your phone does not boot anymore, we are going to flash the original boot.img
Power off the Lgv20, or remove battery. Hold volume down while plugging in the usb cable.
sudo su
cd /tmp/test
fastboot flash boot boot.img
fastboot reboot
exit out of root user
exit
done

reserved

Related

Unroot for linux

Heres a modded linux script based on the defyroot script to unroot your defy
Code:
#!/bin/bash
# execute as bash root_Defy.v2
# Following Bin4ry instructions
# Using http://c-skills.blogspot.com/2010/07/android-trickery.html exploit
# See http://intrepidusgroup.com/insight/2010/09/android-root-source-code-looking-at-the-c-skills/ for an explanation of the exploit
ADB="./adblinux"
if [ ! -e $ADB ] ; then
echo "adb not found! Cannot continue." ;
exit 1 ;
fi
chmod +x $ADB
if [ $(grep -ic 22b8 /etc/udev/rules.d/51-android.rules) -eq 0 ] ; then
echo "SUBSYSTEM=="usb", ATTRS{idVendor}==\"22b8\", MODE=\"0666\"" >> /etc/udev/rules.d/51-android.rules ;
fi
if [ $($ADB devices | grep -c device$) -ne 1 ] ; then
echo "Too many devices attached: exiting!" ;
exit 1;
fi
SERIALNO=`$ADB devices | grep device$ | cut -f1`
if [ $? -eq 0 ] ; then
echo "Found device $SERIALNO" ;
else
echo "Error searching device number!" ;
exit 1;
fi
for file in rageagainstthecage su Superuser.apk ; do
echo -n "Pushing $file: " ;
$ADB -s $SERIALNO push $file /data/local/tmp/$file ;
echo "done" ;
done
#$ADB -s $SERIALNO push rageagainstthecage /data/local/tmp/rageagainstthecage
#$ADB -s $SERIALNO push su /data/local/tmp/su
#$ADB -s $SERIALNO push Superuser.apk /data/local/tmp/Superuser.apk
echo -n "Making rageagainstthecage executable and executing it: "
$ADB -s $SERIALNO shell chmod 755 /data/local/tmp/rageagainstthecage
$ADB -s $SERIALNO shell /data/local/tmp/rageagainstthecage
echo "done"
echo "Waiting 15 sec for phone adbd to restart before continuing"
sleep 15
echo -n "Remounting filesystem in read-write mode: "
$ADB -s $SERIALNO shell mount -o remount,rw -t ext3 /dev/block/mmcblk1p21 /system
echo "done"
echo -n "Removing su command: "
$ADB -s $SERIALNO shell rm /system/bin/su
echo "done"
echo -n "Removing Superuser apk: "
$ADB -s $SERIALNO shell rm /system/app/Superuser.apk
echo "done"
exit 0
added to linux tools, thanks!
By editing the original I could ensure that only what was created in the original, was altered, although in theory you should be able to strip or add anyfiles you want in the same way.
Works for sure on fedora 15 and opensuse11.4 and any the original script works on.

[Completed] [Q] Need urgent help with adb fastboot nandroid backup (paid assistance)

Hi,
I have idea like "backup all data (include apps, accounts, system settings) -> wipe all data -> upload backup -> start device", but backup upload on server by ftp/sftp.
After few times another script download necessary backup and upload on phone by adb/fastboot and start device.
PS Since I need it urgently enough and I tried huge amount of scripts and commands - asking for your help (in debt will not stay).
Skype: a.roman2403
Hi
Thanks for writing to us at XDA Assist. It isn't very clear what you're asking, can you please elaborate?
I wanna create now system of create and restore backups from multiply devices by server and without ppl)
Now i create backup by this script (sorr, i`m only learn)
Code:
adb wait-for-device
set dirname=%date:~0,2%%date:~3,2%%date:~8,2%%time:~0,2%%time:~3,2%
mkdir %dirname% > NULL
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep system | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\system.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep boot | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\boot.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep recovery | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\recovery.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep cache | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\cache.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep userdata | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\userdata.img
adb shell rm /sdcard/blkbackup.img
adb shell "pm list package -s" > %dirname%\system.apps.list
adb shell "pm list package -3" > %dirname%\3d-party.apps.list
i think what this logicaly work, but in realy - dont work and i cant upload backup in server.
can you explain me how i can create fully backup android device and restore it adter few days in device by shellscript.
In an ideal world I see it this way:
1) made a backup using http://forum.xda-developers.com/showthread.php?t=1620255
2) loading on server
3) another script download the desired backup and load it on your phone or PC
4) install
4.1) profit
Ant1Freeze said:
I wanna create now system of create and restore backups from multiply devices by server and without ppl)
Now i create backup by this script (sorr, i`m only learn)
Code:
adb wait-for-device
set dirname=%date:~0,2%%date:~3,2%%date:~8,2%%time:~0,2%%time:~3,2%
mkdir %dirname% > NULL
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep system | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\system.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep boot | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\boot.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep recovery | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\recovery.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep cache | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\cache.img
adb shell rm /sdcard/blkbackup.img
adb shell su -c "dd if=/$(ls -la /dev/block/platform/msm_sdcc.1/by-name | grep userdata | sed -r 's/.* .//') of=/sdcard/blkbackup.img"
adb pull /sdcard/blkbackup.img %dirname%\userdata.img
adb shell rm /sdcard/blkbackup.img
adb shell "pm list package -s" > %dirname%\system.apps.list
adb shell "pm list package -3" > %dirname%\3d-party.apps.list
i think what this logicaly work, but in realy - dont work and i cant upload backup in server.
can you explain me how i can create fully backup android device and restore it adter few days in device by shellscript.
In an ideal world I see it this way:
1) made a backup using http://forum.xda-developers.com/showthread.php?t=1620255
2) loading on server
3) another script download the desired backup and load it on your phone or PC
4) install
4.1) profit
Click to expand...
Click to collapse
Ok, I understand now. Unfortunately XDA Assist isn't a general helpdesk area, our purpose is to point people who don't know where to post in the right direction. I think the best place for your question would be here:
Android Q&A, Help & Troubleshooting
Transmitted via Bacon
tnx you)
Done http://forum.xda-developers.com/android/help/urgent-help-adb-fastboot-nandroid-t3086756
Cool. Thread closed, thanks.
Transmitted via Bacon

TWRP recovery image with my porting kernel for Xiaomi Redmi 3S

Test only!
Don't flash to phone.
Try with "fastboot boot recovery.img".
Pure TWRP:
https://github.com/yangyangnau/andr....0.2-with-linux-3.18.20-g39aa441-for-redmi-3s
TWRP with cofface‘s patch:
https://github.com/yangyangnau/andr...face-with-linux-3.18.20-g39aa441-for-redmi-3s
Please rename to recovery.img after download.
If you want remove dm-verity, you can cook twrp yourself or look here http://en.miui.com/thread-310923-1-1.html.
I'm porting kernel for redmi 3s.
https://github.com/yangyangnau/android_kernel_xiaomi_msm8937
http://forum.xda-developers.com/redmi-3/development/port-linux-kernel-source-xiaomi-redmi3s-t3469965
get stock ROM adb root shell for kernel testing
boot.img from stock ROM.
kernel wlan.ko from your kernel.
twrp-recovery.img from TWRP.
mkboot script from https://github.com/xiaolu/mkbootimg_tools.
Code:
#!/bin/sh
[ -f boot.img ] || exit 0
[ -f kernel ] || exit 0
[ -f wlan.ko ] || exit 0
[ -f twrp-recovery.img ] || exit 0
mkboot boot.img myboot
cp -a kernel myboot/
sed -i -e '/ro.adb.secure=/s+1+0+' \
-e '/ro.secure=/s+1+0+' \
-e '/security.perf_harden=/s+1+0+' \
-e '/ro.allow.mock.location=/s+0+1+' \
-e '/ro.debuggable/s+0+1+' \
-e '/persist.sys.usb.config=/s+none+adb+' \
-e '/ro.secureboot.devicelock/s/^/#/' myboot/ramdisk/default.prop
#echo 'persist.service.adb.enable=1' >> myboot/ramdisk/default.prop
#echo 'persist.service.debuggable=1' >> myboot/ramdisk/default.prop
cat ~/.android/adbkey.pub >> myboot/ramdisk/bin/adb_keys
sed -i "/cmd_line=/s/'$/ androidboot.selinux=permissive'/" myboot/img_info
sed -i -e 's+,verify++g' \
-e 's+forceencrypt+encryptable+g' myboot/ramdisk/fstab.qcom
mkboot myboot myboot.img
fastboot flash boot myboot.img
mkboot twrp-recovery.img twrp-recovery
cp -a twrp-recovery/ramdisk/supersu/su .
fastboot boot twrp-recovery.img
sleep 10s
adb shell mount /system
adb push su /system/bin/su
adb push su /system/xbin/su
adb shell mv /system/lib/modules/wlan.ko{,-}
adb push wlan.ko /system/lib/modules/wlan.ko
adb shell mv /system/bin/install-recovery.sh{,-}
adb shell umount /system
rm -rf myboot twrp-recovery
#adb push ~/.android/adbkey.pub /data/misc/adb/adb_keys
get adb root shell
Code:
adb shell
su -
Someone had tested? Its ok?
plz port Radon kernal for redmi 3s
how to boot into recovery? is it same twrp by flour_mo
Tried to boot the both versions. It boots, but wants some password to encrypt data. TWRP I have installed can decrypt data without wanting me to enter password (and I don't know what password should it be)
Plz bring custom kernel for land # devs
Good news. We finally booted a 4.9 on land

Rooting the webOS TV

pivotce.com informs that instructions have been published on gaining root access to a webOS TV. This is much harder than on the old phones and tablets. When this was done on legacy webOS, there was a wave of enhancements and tweaks made available to phone users from webOS Internals and other developers.
The instructions can be found on the Russian webOS forums here: webos-forums.ru/topic4650.html (English Translation via Google).
As the thread itself notes, this creates the possibility of fiddling with your TV in a way that may turn it into a large, thin brick and will almost certainly invalidate your warranty. The general user should stay well clear of this.
pivotCE published this for information only and recommend leaving investigations to those who know what they are doing or who can afford to wreck expensive television sets. We will watch to see if anything interesting emerges from this development.
+
Detailed analysis of the root access method described above:
forums.webosnation.com/lg-webos-tv/331754-pivotce-seems-webos-tv-has-been-rooted.html#post3450911
Hello!
I'm from webos-forums.ru. I've root on TV for a while and can help you with translation or testing on LG webOS 1.4.
rooting
I could use your help rooting my lg 65uf6450-ua if you would. Thank you
Root webOS
Hodizzal said:
I could use your help rooting my lg 65uf6450-ua if you would. Thank you
Click to expand...
Click to collapse
1. You need to install Developer Mode App and export private ssh-key with CLI (webostv.developer.lge.com/develop/app-test)
2. Convert private ssh-key with puttygen [import key <your private ssh-key>, then save private key]
3. Download exploit (zalil.su/6937580), then connect with TV User: prisoner, [<ip-tv>:9922] + private-key with WinSCP (or other SCP-client), upload to /media/developer on TV and rename it to root.
on linux
Code:
ssh -i <your private ssh-key> [email protected]<ip-tv> -p 9922 "/bin/sh -i"
4.
Code:
chmod +x root
Code:
./root
5. After try install any app from market go to LG App Store and try to install any app.
6. if third stage ok. the insert password 1111 as said.
7.
Code:
busybox chroot /proc/1/root
Code:
[email protected]tTV:/# id
Code:
uid=0(root) gid=0(root)........
I personally use Linux Subsystem on Windows 10 for all of this.
To install .ipk app:
Code:
ApplicationInstallerUtility -c install -p /tmp/<any-name>.ipk -u 0 -l /media/developer -d
Info about your linux kernel and TV firmware:
Code:
luna-send -n 1 -f luna://com.palm.systemservice/osInfo/query '{ "subscribe": false }'
Launch app:
Code:
luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix"}'
All apps ID you can find with
Code:
luna-send -n 1 "palm://com.palm.applicationManager/listLaunchPoints" "{}"
or at a folder /media/cryptofs/apps/usr/palm/applications/<App ID>/appinfo.json
For permanent root access through telnet:
1)
Code:
[email protected]:/# mkdir -p /media/cryptofs/root/etc
2)
Code:
[email protected]:/# cp -r /etc/* /media/cryptofs/root/etc
3)
Code:
[email protected]:/# mount -o bind /media/cryptofs/root/etc /etc
4)
Code:
[email protected]:/# passwd root
Enter any new root password
5)
Code:
cp /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh /tmp/start-devmode.sh
6) Download with WinSCP start-devmode.sh and edit it locally.
You need to add at the beginning
Code:
mount -o bind /media/cryptofs/root/etc /etc
telnetd -l /sbin/sulogin &
Plus you can add the line to launch any App at start, e.g:
Code:
luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix", "params":{}}'
And comment Dev Mode online check.
Here it's mine start-devmode.sh. It's for webOS 1.4. It can be different for other webOS versions:
Code:
#!/bin/sh
mount -o bind /media/cryptofs/root/etc /etc
telnetd -l /sbin/sulogin &
#luna-send -n 1 -f luna://com.webos.applicationManager/launch '{"id": "netflix", "params":{}}'
# FIXME: disable this to turn off script echo
set -x
# FIXME: disable this to stop script from bailing on error
# set -e
# TODO: Check upstart daemon/process tracking (do we need to change /etc/init/devmode.conf? start sshd as daemon?)
# set devmode ssh port here
SSH_PORT="9922"
# set arch:
ARCH="armv71"
grep -qs "qemux86" /etc/hostname && ARCH="i686"
# set directories
OPT_DEVMODE="/opt/devmode"
OPT_SSH="/opt/openssh"
DEVELOPER_HOME="/media/developer"
DEVMODE_SERVICE_DIR="/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service"
CRYPTO_SSH="$DEVMODE_SERVICE_DIR/binaries-${ARCH}/opt/openssh"
CRYPTO_OPT="$DEVMODE_SERVICE_DIR/binaries-${ARCH}/opt"
if [ -s ${DEVMODE_SERVICE_DIR}/jail_app.conf ] ; then
mv ${DEVMODE_SERVICE_DIR}/jail_app.conf ${DEVELOPER_HOME}
mv ${DEVMODE_SERVICE_DIR}/jail_app.conf.sig ${DEVELOPER_HOME}
fi
if [ -r ${DEVMODE_SERVICE_DIR}/sessionToken ] ; then
mv -f ${DEVMODE_SERVICE_DIR}/sessionToken /var/luna/preferences/devmode_enabled
fi
# Make sure the ssh binaries are executable (in service directory)
if [ ! -x "${CRYPTO_SSH}/sbin/sshd" ] ; then
chmod ugo+x ${CRYPTO_SSH}/sbin/sshd ${CRYPTO_SSH}/bin/ssh* ${CRYPTO_SSH}/bin/scp* || true
chmod ugo+x ${CRYPTO_SSH}/bin/sftp ${CRYPTO_SSH}/lib/openssh/* || true
chmod ugo+x ${CRYPTO_OPT}/devmode/usr/bin/* || true
fi
# TODO: (later) Look for "re-init" flag to re-generate ssh key if requested by app (via devkey service)
# com.palm.service.devmode could have "resetKey" method to erase /var/lib/devmode/ssh/webos_rsa
# Kind of dangerous though, since new key will need to be fetched on the desktop (after reboot)...
# We could just require a hard-reset of the TV which should blow away /var/lib/devmode/ssh/...
# Initialize the developer (client) SSH key pair, if it doesn't already exist
if [ ! -e /var/lib/devmode/ssh/webos_rsa ] ; then
mkdir -p /var/lib/devmode/ssh
chmod 0700 /var/lib/devmode/ssh
# get FIRST six (UPPER-CASE, hex) characters of 40-char nduid from nyx-cmd
# NOTE: This MUST match passphrase as displayed in devmode app (main.js)!
# PASSPHRASE="`/usr/bin/nyx-cmd DeviceInfo query nduid | head -c 6 | tr 'a-z' 'A-Z'`"
# PASSPHRASE="`/usr/bin/nyx-cmd DeviceInfo query nduid | tail -n1 | head -c 6 | tr 'a-z' 'A-Z'`"
PASSPHRASE="`tail /var/lib/secretagent/nduid -c 40 | head -c 6 | tr 'a-z' 'A-Z'`"
${CRYPTO_SSH}/bin/ssh-keygen -t rsa -C "[email protected]" -N "${PASSPHRASE}" -f /var/lib/devmode/ssh/webos_rsa
# copy ssh key to /var/luna/preferences so the devmode service's KeyServer can read it and serve to ares-webos-cli tools
cp -f /var/lib/devmode/ssh/webos_rsa /var/luna/preferences/webos_rsa
chmod 0644 /var/luna/preferences/webos_rsa
# if we generated a new ssh key, make sure we re-create the authorized_keys file
rm -f ${DEVELOPER_HOME}/.ssh/authorized_keys
fi
# Make sure the /media/developer (and log) directories exists (as sam.conf erases it when devmode is off):
mkdir -p ${DEVELOPER_HOME}/log
chmod 777 ${DEVELOPER_HOME} ${DEVELOPER_HOME}/log
# Install the SSH key into the authorized_keys file (if it doesn't already exist)
if [ ! -e ${DEVELOPER_HOME}/.ssh/authorized_keys ] ; then
mkdir -p ${DEVELOPER_HOME}/.ssh
cp -f /var/lib/devmode/ssh/webos_rsa.pub ${DEVELOPER_HOME}/.ssh/authorized_keys || true
# NOTE: authorized_keys MUST be world-readable else sshd can't read it inside the devmode jail
# To keep sshd from complaining about that, we launch sshd with -o "StrictModes no" (below).
chmod 755 ${DEVELOPER_HOME}/.ssh
chmod 644 ${DEVELOPER_HOME}/.ssh/authorized_keys
chown -R developer:developer ${DEVELOPER_HOME}/.ssh
fi
# FIXME: Can we move this to /var/run/devmode/sshd ?
# Create PrivSep dir
mkdir -p /var/run/sshd
chmod 0755 /var/run/sshd
# Create directory for host keys (rather than /opt/openssh/etc/ssh/)
HOST_KEY_DIR="/var/lib/devmode/sshd"
if [ ! -d "${HOST_KEY_DIR}" ] ; then
mkdir -p ${HOST_KEY_DIR}
chmod 0700 ${HOST_KEY_DIR}
fi
# Create initial keys if necessary
if [ ! -f ${HOST_KEY_DIR}/ssh_host_rsa_key ]; then
echo " generating ssh RSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_rsa_key -N '' -t rsa
fi
if [ ! -f ${HOST_KEY_DIR}/ssh_host_ecdsa_key ]; then
echo " generating ssh ECDSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_ecdsa_key -N '' -t ecdsa
fi
if [ ! -f ${HOST_KEY_DIR}/ssh_host_dsa_key ]; then
echo " generating ssh DSA key..."
${CRYPTO_SSH}/bin/ssh-keygen -q -f ${HOST_KEY_DIR}/ssh_host_dsa_key -N '' -t dsa
fi
# Check config
# NOTE: This should only be enabled for testing
#${CRYPTO_SSH}/sbin/sshd -f ${CRYPTO_SSH}/etc/ssh/sshd_config -h ${HOST_KEY_DIR}/ssh_host_rsa_key -t
# Set jailer command
DEVMODE_JAIL="/usr/bin/jailer -t native_devmode -i com.palm.devmode.openssh -p ${DEVELOPER_HOME}/ -s /bin/sh"
#DEVMODE_JAIL="echo"
# Add for debugging, but this will cause sshd to exit after the first ssh login:
# -ddd -e
# Make environment file for openssh
DEVMODE_JAIL_CONF="/etc/jail_native_devmode.conf"
DEVMODE_OPENSSH_ENV="${DEVELOPER_HOME}/.ssh/environment"
if [ -f ${DEVMODE_JAIL_CONF} ]; then
echo " generating environment file from jail_native_devmode.conf..."
find ${DEVMODE_JAIL_CONF} | xargs awk '/setenv/{printf "%s=%sn", $2,$3}' > ${DEVMODE_OPENSSH_ENV}
${DEVMODE_JAIL} /usr/bin/env >> ${DEVMODE_OPENSSH_ENV}
fi
# Set path for devmode
if [ -f ${DEVMODE_OPENSSH_ENV} ]; then
echo "PATH=${PATH}:${OPT_DEVMODE}/usr/bin" >> ${DEVMODE_OPENSSH_ENV}
fi
sleep 5;
for interface in $(ls /sys/class/net/ | grep -v -e lo -e sit);
do
if [ -r /sys/class/net/$interface/carrier ] ; then
if [[ $(cat /sys/class/net/$interface/carrier) == 1 ]]; then OnLine=1; fi
fi
done
#if [ $OnLine ]; then
# sessionToken=$(cat /var/luna/preferences/devmode_enabled);
# checkSession=$(curl --max-time 3 -s https://developer.lge.com/secure/CheckDevModeSession.dev?sessionToken=$sessionToken);
# if [ "$checkSession" != "" ] ; then
# result=$(node -pe 'JSON.parse(process.argv[1]).result' "$checkSession");
# if [ "$result" == "success" ] ; then
rm -rf /var/luna/preferences/dc*;
# # create devSessionTime file to remain session time in devmode app
# remainTime=$(node -pe 'JSON.parse(process.argv[1]).errorMsg' "$checkSession");
# resultValidTimeCheck=$(echo "${remainTime}" | egrep "^([0-9]{1,4}(:[0-5][0-9]){2})$");
# if [ "$resultValidTimeCheck" != "" ] ; then
echo '900:00:00' > ${DEVMODE_SERVICE_DIR}/devSessionTime;
chgrp 5000 ${DEVMODE_SERVICE_DIR}/devSessionTime;
chmod 664 ${DEVMODE_SERVICE_DIR}/devSessionTime;
# fi
# elif [ "$result" == "fail" ] ; then
# rm -rf /var/luna/preferences/devmode_enabled;
# rm -rf /var/luna/preferences/dc*;
# if [ -e ${DEVMODE_SERVICE_DIR}/devSessionTime ] ; then
# rm ${DEVMODE_SERVICE_DIR}/devSessionTime;
# fi
# fi
# fi
#fi
# Cache clear function added (except Local storage)
if [ -e ${DEVMODE_SERVICE_DIR}/devCacheClear ] ; then
rm -rf `ls | find /var/lib/webappmanager*/* -name "Local Storage" -o -name "localstorage" -prune -o -print`;
rm ${DEVMODE_SERVICE_DIR}/devCacheClear;
fi
# Launch sshd
${DEVMODE_JAIL} ${OPT_SSH}/sbin/sshd
-o StrictModes=no
-f ${OPT_SSH}/etc/ssh/sshd_config
-h ${HOST_KEY_DIR}/ssh_host_rsa_key
-o PasswordAuthentication=no -o PermitRootLogin=no -o PermitUserEnvironment=yes
-D -p ${SSH_PORT}
7) Upload new start-devmode.sh and rewrite the old one
Code:
cp /tmp/start-devmode.sh /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh
8) Restart TV.
Connect with telnet and type previously entered password.
Code:
telnet <ip-tv>
Trying <ip-tv>...
Connected to <ip-tv>].
Escape character is '^]'.
webOS TV 1.4.0 LGSmartTV
Give root password for system maintenance
(or type Control-D for normal startup):
Entering System Maintenance Mode
[email protected]:/#
Does it work on WebOS 3.5 devices?
medi01 said:
Does it work on WebOS 3.5 devices?
Click to expand...
Click to collapse
Positive.
is it possible to install webOS 3.0 on an 65EF9500 that currently has WebOS 2.0 via the USB upgrade method?
enkrypt3d said:
is it possible to install webOS 3.0 on an 65EF9500 that currently has WebOS 2.0 via the USB upgrade method?
Click to expand...
Click to collapse
No
Is there any method to get 3.0 installed over 1.4 I have a 49ub8500-ua
syconu said:
Is there any method to get 3.0 installed over 1.4 I have a 49ub8500-ua
Click to expand...
Click to collapse
No
Is there anything hack related that I can do with this to and can is support a new air mouse with a dongle
Ok, so I get run the root app and first ,second , and third stage all are good. then it says try get root password is 1111. But the terminal keeps freezing after that happens. A couple times my tv rebooted too. I cant figure out what i could have messed up. ANyone with any experience using this method have any legit information?
steven817817 said:
Ok, so I get run the root app and first ,second , and third stage all are good. then it says try get root password is 1111. But the terminal keeps freezing after that happens. A couple times my tv rebooted too. I cant figure out what i could have messed up. ANyone with any experience using this method have any legit information?
Click to expand...
Click to collapse
Try to delete all 'cache' files from exploit at /media/developer. It doesn't wotk twice as far as I concerned
Is there anyway I can root my 1.4.0 and if so what r the benefits of the root? Can I install Android or kodi? What's the point
teffd said:
Try to delete all 'cache' files from exploit at /media/developer. It doesn't wotk twice as far as I concerned
Click to expand...
Click to collapse
I tried it stil seems to finish step 3 then says enter 1111. But this is where it freezes up and does not get any further.
Is this still working on 3.6? I'm stuck at try to install any app from market.
Mazda77 said:
Positive.
Click to expand...
Click to collapse
Which TV and firmware version?
Is this possible with UJ63 serie?
Hi, would the root access allow somehow to connect other bluetooth devices different than LG? Thanks!
You can do pretty much anything to the system with root, even include support for unsupported devices in form of additional kernel modules.
For example, I've added Samba support so I can mount use my NAS (see my blog at ddscentral dot org for details).
Hey guys is it possible to install android apps into WebOS? I just bought an Lg oled LG 55EG9A7V i want to use Perfect Player IPTV but i cant install it right now...Other then that i dont need anything else..
Can anyone help me?

How To Guide BANKING APPS: How to modify build.Prop using recovery (and more...)

Ok, after some reading, testing and trying, my conclusion is that it is not possible to tweak a running system with not triggering SELinux.
Though, for letting banking apps work it is only needed to modify the build.prop in /system, which is in fact possible, even without TWRP.
So, this is what I am doing now:
Reboot into (LOS) recovery and then in the recovery menu:
Goto “Advanced”
Mount /system
Enable adb
From your pc with adb etc.. installed:
Code:
adb shell mount -o rw,remount /mnt/system
adb shell sed -i 's/ro.debuggable=1/ro.debuggable=0/g' /mnt/system/system/build.prop
adb shell sed -i 's/ro.build.type=userdebug/ro.build.type=user/g' /mnt/system/system/build.prop
adb reboot
That's it, banking apps working!
Okay, did some further research and in fact, found a solution for my "tweaking".
Though I have the feeling most people are not tweaking anymore, I hope it helps for the few people still interested! For me the result is a more lean system, working banking apps and HD calling (VoLTE), and it is just nice to do... ;-)
Scripts and approach can be found in the next posts.
After some boot issues I finally found out what was the issue of my problems with some tweaking around.
As we have a device with A/B, after flashing the update, the active partition is automatically switched after an update. This happens when flashing, so you have to reboot to recovery again directly after flashing the updated LOS and do the tweaking then to actually tweak the right partition...
A system update for me is now:
Code:
Reboot into recovery
CHECK WHICH IS THE ACTIVE PARTITION!!
Goto “Apply Update”
Goto “Apply from adb”
adb sideload <lineageos.zip>
Goto “Advanced”
Goto “Reboot to recovery”
CHECK WHICH IS THE ACTIVE PARTITION, SHOULD BE CHANGED!!
In recovery:
Goto “Advanced”
Goto “Mount /system”
Goto “Enable ADB”
Run tweak.bat
For the latest tweak script (a bat file) I am using now, see the next post.
Hope it helps for people with banking or VoLTE issues and the need to change some settings in build.prop or else... Use the information at your own risk
Latest tweaks.bat file (last changes 25/04/2023):
Code:
:: Moto G100 Tweak Script
:: Last modified 25-04-2023
:: Moto-J
:: ------------------------------------------------------------
:: Changelog:
::
:: 22-04-23 Added:
:: adb shell rm -rf /mnt/product/app/ApertureLensLauncher
:: adb shell rm -rf /mnt/system_ext/app/MotoActions
:: adb shell rm -rf /mnt/system_ext/app/WAPPushManager
:: adb shell rm -rf /mnt/system_ext/priv-app/LineageSetupWizard
:: ------------------------------------------------------------
@echo off
Setlocal EnableDelayedExpansion
color 0A
cls
echo MOTO G100 TWEAK SCRIPT
echo.
echo IMPORTANT:
echo - First boot into recovery
echo - Goto advanced and mount /system
echo - Goto advanced and enable adb
echo.
pause
echo.
echo ------------------------------------
echo Connecting device...................
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
adb devices
:: ------------------------------------------------------------
echo ------------------------------------
echo Mounting system partitions..........
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
:: /dev/block/dm-6 = /product
:: /dev/block/dm-7 = /system
:: /dev/block/dm-8 = /system_ext
:: /dev/block/dm-9 = /vendor
adb shell mkdir /mnt/product > nul 2>&1
adb shell mkdir /mnt/system > nul 2>&1
adb shell mkdir /mnt/system_ext > nul 2>&1
adb shell mkdir /mnt/vendor > nul 2>&1
adb shell mount -o rw,remount /mnt/system
adb shell mount /dev/block/dm-6 /mnt/product
adb shell mount /dev/block/dm-7 /mnt/system > nul 2>&1
adb shell mount /dev/block/dm-8 /mnt/system_ext
adb shell mount /dev/block/dm-9 /mnt/vendor
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Removing some packages..............
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
:: /product/app
adb shell rm -rf /mnt/product/app/Aperture
adb shell rm -rf /mnt/product/app/ApertureLensLauncher
adb shell rm -rf /mnt/product/app/Backgrounds
adb shell rm -rf /mnt/product/app/Gallery2
adb shell rm -rf /mnt/product/app/Jelly
adb shell rm -rf /mnt/product/app/PhotoTable
adb shell rm -rf /mnt/product/app/PowerOffAlarm
:: /product/priv-app
adb shell rm -rf /mnt/product/priv-app/Eleven
adb shell rm -rf /mnt/product/priv-app/OneTimeInitializer
:: /system/app
adb shell rm -rf /mnt/system/system/app/BasicDreams
adb shell rm -rf /mnt/system/system/app/BluetoothMidiService
adb shell rm -rf /mnt/system/system/app/BookmarkProvider
adb shell rm -rf /mnt/system/system/app/CaptivePortalLogin
adb shell rm -rf /mnt/system/system/app/CarrierDefaultApp
adb shell rm -rf /mnt/system/system/app/CompanionDeviceManager
adb shell rm -rf /mnt/system/system/app/EasterEgg
adb shell rm -rf /mnt/system/system/app/HTMLViewer
adb shell rm -rf /mnt/system/system/app/PrintRecommendationService
adb shell rm -rf /mnt/system/system/app/SimAppDialog
adb shell rm -rf /mnt/system/system/app/Stk
adb shell rm -rf /mnt/system/system/app/WallpaperBackup
:: /system/priv-app
adb shell rm -rf /mnt/system/system/priv-app/BackupRestoreConfirmation
adb shell rm -rf /mnt/system/system/priv-app/CallLogBackup
adb shell rm -rf /mnt/system/system/priv-app/InputDevices
adb shell rm -rf /mnt/system/system/priv-app/LiveWallpapersPicker
adb shell rm -rf /mnt/system/system/priv-app/ManagedProvisioning
adb shell rm -rf /mnt/system/system/priv-app/SharedStorageBackup
adb shell rm -rf /mnt/system/system/priv-app/StatementService
adb shell rm -rf /mnt/system/system/priv-app/Tag
adb shell rm -rf /mnt/system/system/priv-app/VpnDialogs
:: /system_ext/app
adb shell rm -rf /mnt/system_ext/app/datastatusnotification
adb shell rm -rf /mnt/system_ext/app/IfaaService
adb shell rm -rf /mnt/system_ext/app/MotoActions
adb shell rm -rf /mnt/system_ext/app/SoterService
adb shell rm -rf /mnt/system_ext/app/WAPPushManager
:: /system_ext/priv-app
adb shell rm -rf /mnt/system_ext/priv-app/LineageSetupWizard
adb shell rm -rf /mnt/system_ext/priv-app/Seedvault
adb shell rm -rf /mnt/system_ext/priv-app/Updater
:: /vendor/app
adb shell rm -rf /mnt/vendor/app/TimeService
:: For debugging purposes:
adb shell ls /mnt/product/app > _packages-product-app.txt
adb shell ls /mnt/product/priv-app > _packages-product-priv-app.txt
adb shell ls /mnt/system/system/app > _packages-system-system-app.txt
adb shell ls /mnt/system/system/priv-app > _packages-system-system-priv-app.txt
adb shell ls /mnt/system_ext/app > _packages-system_ext-app.txt
adb shell ls /mnt/system_ext/priv-app > _packages-system_ext-priv-app.txt
adb shell ls /mnt/vendor/app > _packages-vendor-app.txt
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Modifying /system/build.prop........
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
:: First remove the lines if available
adb shell sed -i '/^# Modified settings/d' /mnt/system/system/build.prop
adb shell sed -i '/^ro.debuggable/d' /mnt/system/system/build.prop
adb shell sed -i '/^ro.build.type/d' /mnt/system/system/build.prop
adb shell sed -i '/^fw.show_multiuserui/d' /mnt/system/system/build.prop
adb shell sed -i '/^fw.power_user_switcher/d' /mnt/system/system/build.prop
adb shell sed -i '/^fw.show_hidden_users/d' /mnt/system/system/build.prop
adb shell sed -i '/^ro.backup.disable/d' /mnt/system/system/build.prop
adb shell sed -i '/^ro.config.ksm.support/d' /mnt/system/system/build.prop
adb shell sed -i '/^persist.debug.wfd.enable/d' /mnt/system/system/build.prop
adb shell sed -i '/^persist.debug.wfd.appmonitoring/d' /mnt/system/system/build.prop
adb shell sed -i '/^debug.sf.enable_hwc_vds/d' /mnt/system/system/build.prop
adb shell sed -i '/^persist.adb.notify/d' /mnt/system/system/build.prop
adb shell sed -i '/^# end of file/d' /mnt/system/system/build.prop
:: And now add them at the end of the file
adb shell sed -i -e '$a# Modified settings' /mnt/system/system/build.prop
:: Let banking apps work
adb shell sed -i -e '$aro.debuggable=0' /mnt/system/system/build.prop
adb shell sed -i -e '$aro.build.type=user' /mnt/system/system/build.prop
:: Disable user switching
adb shell sed -i -e '$afw.show_multiuserui=0' /mnt/system/system/build.prop
adb shell sed -i -e '$afw.power_user_switcher=0' /mnt/system/system/build.prop
adb shell sed -i -e '$afw.show_hidden_users=0' /mnt/system/system/build.prop
:: Disable backup provider
adb shell sed -i -e '$aro.backup.disable=1' /mnt/system/system/build.prop
:: Disable Kernel Samepage Merging (KSM)
adb shell sed -i -e '$aro.config.ksm.support=false' /mnt/system/system/build.prop
:: Disable Mira Cast (Wifi Direct) eating your battery
adb shell sed -i -e '$apersist.debug.wfd.enable=0' /mnt/system/system/build.prop
adb shell sed -i -e '$apersist.debug.wfd.appmonitoring=0' /mnt/system/system/build.prop
adb shell sed -i -e '$adebug.sf.enable_hwc_vds=0' /mnt/system/system/build.prop
:: Disable notification while adb is active
adb shell sed -i -e '$apersist.adb.notify=0' /mnt/system/system/build.prop
adb shell sed -i -e '$a# end of file' /mnt/system/system/build.prop
:: For debugging purposes:
adb pull /mnt/system/system/build.prop
del /F _build.system.prop > nul 2>&1
ren build.prop _build.system.prop
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Modifying /vendor/build.prop........
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
:: First remove the lines if available
adb shell sed -i '/^# Modified settings/d' /mnt/vendor/build.prop
:: Firmware date
adb shell sed -i '/^ro.vendor.build.security_patch/d' /mnt/vendor/build.prop
:: Display
adb shell sed -i '/^debug.hwui.disable_vsync/d' /mnt/vendor/build.prop
adb shell sed -i '/^debug.hwui.render_dirty_regions/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.sys.use_dithering/d' /mnt/vendor/build.prop
adb shell sed -i '/^ro.sf.lcd_density/d' /mnt/vendor/build.prop
:: VoLTE (only what is missing)
adb shell sed -i '/^persist.dbg.ims_volte_enable/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.dbg.volte_avail_ovr/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.dbg.vt_avail_ovr/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.dbg.wfc_avail_ovr/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.vendor.radio.calls.on.ims/d' /mnt/vendor/build.prop
adb shell sed -i '/^persist.vendor.data.iwlan.enable/d' /mnt/vendor/build.prop
adb shell sed -i '/^# end of file/d' /mnt/vendor/build.prop
:: And now add them at the end of the file
adb shell sed -i -e '$a# Modified settings' /mnt/vendor/build.prop
:: Firmware date
set CUR_YYYY=%date:~9,4%
set CUR_MM=%date:~6,2%
set CUR_DD=%date:~3,2%
set SUBDATE=%CUR_YYYY%-%CUR_MM%-%CUR_DD%
adb shell sed -i -e '$aro.vendor.build.security_patch=%SUBDATE%' /mnt/vendor/build.prop
:: Display
adb shell sed -i -e '$adebug.hwui.disable_vsync=true' /mnt/vendor/build.prop
adb shell sed -i -e '$adebug.hwui.render_dirty_regions=false' /mnt/vendor/build.prop
adb shell sed -i -e '$apersist.sys.use_dithering=0' /mnt/vendor/build.prop
adb shell sed -i -e '$aro.sf.lcd_density=460' /mnt/vendor/build.prop
:: VoLTE (only what is missing)
adb shell sed -i -e '$apersist.dbg.ims_volte_enable=1' /mnt/vendor/build.prop
adb shell sed -i -e '$apersist.dbg.volte_avail_ovr=1' /mnt/vendor/build.prop
adb shell sed -i -e '$apersist.dbg.vt_avail_ovr=1' /mnt/vendor/build.prop
adb shell sed -i -e '$apersist.dbg.wfc_avail_ovr=1' /mnt/vendor/build.prop
adb shell sed -i -e '$apersist.vendor.radio.calls.on.ims=1' /mnt/vendor/build.prop
adb shell sed -i -e '$a# end of file' /mnt/vendor/build.prop
:: FOR VOLTE CHECK, DIAL *#*#4636#*#*, PHONE INFORMATION - 3DOTS MENU - IMS SERVICE STATUS
::
:: Complete VoLTE settings:
::
:: # Debug Options
:: persist.dbg.ims_volte_enable=1
:: persist.dbg.volte_avail_ovr=1
:: persist.dbg.vt_avail_ovr=1
:: persist.dbg.wfc_avail_ovr=1
::
:: # Data Options
:: # Commented this line out as it was reported to break WiFi calling on some carriers.
:: # persist.data.iwlan.enable=true
::
:: # Radio Options
:: persist.radio.rat_on=combine (OR persist.vendor.radio.rat_on=combine)
:: persist.radio.data_ltd_sys_ind=1 (OR persist.vendor.radio.data_ltd_sys_ind=1)
:: persist.radio.data_con_rprt=1 (OR persist.vendor.radio.data_con_rprt=1)
:: persist.radio.calls.on.ims=1 (OR persist.vendor.radio.calls.on.ims=1)
:: For debugging purposes:
adb pull /mnt/vendor/build.prop
del /F _build.vendor.prop > nul 2>&1
ren build.prop _build.vendor.prop
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Proper unmount partitions...........
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
adb shell umount /mnt/product
adb shell umount /mnt/system
adb shell umount /mnt/system_ext
adb shell umount /mnt/vendor
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Rebooting phone...
echo ------------------------------------
echo.
pause
adb reboot
For who wants to use some additional adb tweaks; it is possible to do this by enabling adb in your developer settings.
Here is the bat-file I am using (last changes 17/04/2023):
Code:
:: Moto G100 Tweak Script
:: Last modified 17-04-2023
:: Moto-J
:: ------------------------------------------------------------
@echo off
Setlocal EnableDelayedExpansion
color 0A
cls
echo MOTO G100 ADB TWEAK SCRIPT
echo.
echo IMPORTANT:
echo - Enable ADB in developer settings
echo - Connect phone and accept adb connection
echo.
pause
echo.
echo ------------------------------------
echo Connecting device...................
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
adb devices
:: ------------------------------------------------------------
echo ------------------------------------
echo Running tweaks......................
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
echo Enable privacy logging 7-day dashboard...
:: Enable privacy logging 7-day dashboard
adb shell device_config put privacy privacy_dashboard_7_day_toggle true
pause
echo Enable new combined safety center........
:: Enable new combined safety center
adb shell device_config put privacy safety_center_is_enabled true
pause
echo Enable DNS-over-HTTP3 support............
:: Enable DNS-over-HTTP3 support
adb shell device_config put netd_native doh 1
pause
echo Enable cached apps freezer...............
:: Enable cached apps freezer
adb shell device_config put activity_manager_native_boot use_freezer true
pause
echo Defer boot completed broadcasts..........
:: Defer boot completed broadcasts for background restricted apps
adb shell device_config put activity_manager defer_boot_completed_broadcast 2
pause
echo Enable separate notification slider......
adb shell device_config put systemui volume_separate_notification true
pause
echo.
echo Done!
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Now reboot and disable adb again....
echo ------------------------------------
echo.
pause
adb reboot
You can enable adb and adb-root, run the script, reboot and afterwards disable adb again.
The settings will stay even after updating, so only running the script once is enough.
Also with a custom rom you want to update your firmware so now and then.
Luckily we can find the firmware for our phone here:
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com
And here is the bat-file I am using with phone connected to PC in bootloader (last changes 15/04/2023):
Code:
:: Moto G100 Firmware Update Script
:: Last modified 15-04-2023
:: Moto-J
:: ------------------------------------------------------------
@echo off
Setlocal EnableDelayedExpansion
color 0A
cls
echo MOTO G100 FIRMWARE UPDATE SCRIPT
echo.
echo IMPORTANT:
echo - Connect phone to USB of PC
echo - Boot into bootloader
echo - Execute this BAT-file in directory with fastboot and latest firmware
echo.
pause
echo.
echo ------------------------------------
echo Connecting device...................
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
fastboot devices
:: ------------------------------------------------------------
echo ------------------------------------
echo Updating firmware files.............
echo ------------------------------------
echo.
echo Terminal output will be displayed here:
fastboot flash modem_a NON-HLOS.bin
fastboot flash modem_b NON-HLOS.bin
fastboot erase mdmddr
fastboot flash fsg_a fsg.mbn
fastboot flash fsg_b fsg.mbn
fastboot erase mdm1m9kefs1
fastboot erase mdm1m9kefs2
fastboot flash bluetooth_a BTFM.bin
fastboot flash bluetooth_b BTFM.bin
fastboot flash dsp_a dspso.bin
fastboot flash dsp_b dspso.bin
fastboot flash logo_a logo.bin
fastboot flash logo_b logo.bin
fastboot erase carrier
fastboot erase ddr
echo.
echo done
echo.
pause
echo.
:: ------------------------------------------------------------
echo ------------------------------------
echo Rebooting phone...
echo ------------------------------------
echo.
pause
fastboot reboot
I am only flashing the neccessary stuff as radio and bluetooth and only that is erased what is needed for the update. No data is lost after update, no other tweaking needed.
On first reboot switch off your WiFi and wait a few seconds; carrier info will be updated from your provider and everything is working again. After that you can switch on your WiFi again ;-)
Additional some things which could improve your battery life (and data usage), although this is already great because of the large battery of the Moto G100....
Restrict battery usage in background for apps which do not need it:
go to apps, show all apps, per app, go to battery usage and switch to restricted
For the apps with restricted battery usage, I also switch of background usage of mobile data and VPN.
go to apps, show all apps, per app, go to mobile data and wifi and switch off background usage and VPN
Switch off mobile data for all apps which do not need an internet connections
same approach, though switch off complete network access. You can do this for several apps which you are using without the need of an internet connection like most barcode and QR scanners, file browsers, card storage apps, galery's etc...
In network settings - SIM cards - preferred network types, only select the network types you really need and which are optimised for your usage.
for me this is NR/LTE/GSM/WCDMA as I switch off mobile data at night with profile settings and want to be available by phone (GSM/WCDMA), though for most people only NR/LTE will probably even fit when you are using the VoLTE changes from the first posts and VoLTE is working ;-)
Set peak frequency for screen refresh to 60 Herz, not 90 Herz. 90 Herz is more fluent when scrolling, though for normal reading, internet usage etc... I see no need for 90 Herz and it will save your battery
Set the time-out for your screen as short as possible. I am using 1 minute and it is okay for me.
Enable double click on status or lock screen to enable sleep and really use it.
Use dark theme and black background, although we do not have a led screen, it is still saving battery
Disable location and bluetooth when you are not using it, enable wifi (only) when available.
Disable tick to activate, screensaver and fingerprint sensor swipe
Don't use full brightness, though try to set it that low as possible
Don't charge your phone to 100% every time, though try to keep the battery level between 30-80%.
This is also why I have set battery saving planning to a percentage of 30%.
When you don't need your email updated real time, disable push and only use getting POP3 email for example every hour.
Although I am using a script to remove system apps after an update, you can also disable some system apps you not need. Either way; try to disable as much as possible which is not neccessary for a good working phone.
That's it for now. When I have some additional ideas I will let you know!
Outside of banking apps & enabling volte. What do your other removal of packages and tweaks do? Can you give a general breakdown?
Timmons said:
Outside of banking apps & enabling volte. What do your other removal of packages and tweaks do? Can you give a general breakdown?
Click to expand...
Click to collapse
Sorry but you really have to check yourself.
There are several websites where the apps of Android are explained
The same counts for the build.prop settings.
I think it would be good to check yourself so you know what you are doing.
And even better... may be you will find other tweaks you can share with us!
Moto-J said:
Sorry but you really have to check yourself.
There are several websites where the apps of Android are explained
The same counts for the build.prop settings.
I think it would be good to check yourself so you know what you are doing.
And even better... may be you will find other tweaks you can share with us!
Click to expand...
Click to collapse
Fair enough. You'd mentioned to chmod after updating. Do I have to do that if I just run your bat file to update it? Sorry for the rookie questions as I'm no expert at linux scripts.
Timmons said:
Fair enough. You'd mentioned to chmod after updating. Do I have to do that if I just run your bat file to update it? Sorry for the rookie questions as I'm no expert at linux scripts.
Click to expand...
Click to collapse
No, not neccessary when you are using the script and edit the file by using adb this way.
No rights are modified that way.
Moto-J said:
No, not neccessary when you are using the script and edit the file by using adb this way.
No rights are modified that way.
Click to expand...
Click to collapse
I've updated the script to only update the build file without removing anything but it's not working. getting this below for system & vendor
Modifying /system/build.prop........
------------------------------------
Terminal output will be displayed here:
sed: /mnt/system/system/build.prop: No such file or directory
------------------------------------
Modifying /vendor/build.prop........
------------------------------------
Terminal output will be displayed here:
sed: /mnt/vendor/build.prop: No such file or directory
Timmons said:
I've updated the script to only update the build file without removing anything but it's not working. getting this below for system & vendor
Modifying /system/build.prop........
------------------------------------
Terminal output will be displayed here:
sed: /mnt/system/system/build.prop: No such file or directory
------------------------------------
Modifying /vendor/build.prop........
------------------------------------
Terminal output will be displayed here:
sed: /mnt/vendor/build.prop: No such file or directory
Click to expand...
Click to collapse
Hi @Timmons;
Could it be that you removed the first part of the bat file where the drives are mounted?
Could you therefor share the complete bat file you are using now, so I can actually check what is or could be wrong?
Moto-J said:
Hi @Timmons;
Could it be that you removed the first part of the bat file where the drives are mounted?
Could you therefor share the complete bat file you are using now, so I can actually check what is or could be wrong?
Click to expand...
Click to collapse
And what happens when you copy the lines to the command line one by one instead of using the bat file?
Could you for example try the following lines to check:
Code:
adb devices
adb shell mkdir /mnt/vendor
adb shell mount /dev/block/dm-9 /mnt/vendor
adb shell ls /mnt/vendor
You should see a directory listing (ls) of /mnt/vendor or an error message somewhere
Moto-J said:
And what happens when you copy the lines to the command line one by one instead of using the bat file?
Could you for example try the following lines to check:
Code:
adb devices
adb shell mkdir /mnt/vendor
adb shell mount /dev/block/dm-9 /mnt/vendor
adb shell ls /mnt/vendor
You should see a directory listing (ls) of /mnt/vendor or an error message somewhere
Click to expand...
Click to collapse
C:\Users\Home\Downloads\Motorola>adb shell mkdir /mnt/vendor
mkdir: '/mnt/vendor': File exists
C:\Users\Home\Downloads\Motorola>adb shell ls /mnt/vendor
C:\Users\Home\Downloads\Motorola>adb shell mount /dev/block/dm-9 /mnt/vendor
mount: '/dev/block/dm-9'->'/mnt/vendor': No such file or directory
C:\Users\Home\Downloads\Motorola>adb devices
List of devices attached
ZY22CCJ22P recovery
C:\Users\Home\Downloads\Motorola>adb shell mount /dev/block/dm-9 /mnt/vendor
mount: '/dev/block/dm-9'->'/mnt/vendor': No such file or directory
Not having much luck entering them manually.
Timmons said:
C:\Users\Home\Downloads\Motorola>adb shell mkdir /mnt/vendor
mkdir: '/mnt/vendor': File exists
C:\Users\Home\Downloads\Motorola>adb shell ls /mnt/vendor
C:\Users\Home\Downloads\Motorola>adb shell mount /dev/block/dm-9 /mnt/vendor
mount: '/dev/block/dm-9'->'/mnt/vendor': No such file or directory
C:\Users\Home\Downloads\Motorola>adb devices
List of devices attached
ZY22CCJ22P recovery
C:\Users\Home\Downloads\Motorola>adb shell mount /dev/block/dm-9 /mnt/vendor
mount: '/dev/block/dm-9'->'/mnt/vendor': No such file or directory
Not having much luck entering them manually.
Click to expand...
Click to collapse
Hmmm... it seems that your partitions are different as dm-9 is not known... strange ;-)
Could you try:
adb devices
adb shell ls /dev/block/dm*
Moto-J said:
Hmmm... it seems that your partitions are different as dm-9 is not known... strange ;-)
Could you try:
adb devices
adb shell ls /dev/block/dm*
Click to expand...
Click to collapse
C:\Users\Home\Downloads\Motorola>adb devices
List of devices attached
ZY22CCJ22P recovery
C:\Users\Home\Downloads\Motorola>adb shell ls /dev/block/dm*
/dev/block/dm-0 /dev/block/dm-3 /dev/block/dm-6
/dev/block/dm-1 /dev/block/dm-4 /dev/block/dm-7
/dev/block/dm-2 /dev/block/dm-5 /dev/block/dm-8
Timmons said:
C:\Users\Home\Downloads\Motorola>adb devices
List of devices attached
ZY22CCJ22P recovery
C:\Users\Home\Downloads\Motorola>adb shell ls /dev/block/dm*
/dev/block/dm-0 /dev/block/dm-3 /dev/block/dm-6
/dev/block/dm-1 /dev/block/dm-4 /dev/block/dm-7
/dev/block/dm-2 /dev/block/dm-5 /dev/block/dm-8
Click to expand...
Click to collapse
Ok, it seems you do not have dm-9, so indeed partitions are different.
What I have done to find out what is what is the following:
adb shell mkdir /mnt/tmpdir
adb shell mount /dev/block/dm-0 /mnt/tmpdir
adb shell ls mnt/tmpdir
Then you see what the content is of dm-0 so you know which dir it is
After that you can do
adb shell umount /mnt/tmpdir
adb shell mount /dev/block/dm-1
adb shell ls mnt/tmpdir
etc....
It seems you have to find the right setup for mounting the drives, after that you can slightly modify the script and use it for your phone.

Categories

Resources