Database Develop

Custom boot.img

Here you go, a boot.img with a custom default.prop & init.rc:
- ro.secure = 0, which means ADB running as root;
- /, /system, /data mounted as rw;
- /data/local/bin added to PATH, to ease usage of installed local commands.
Anyone wanting to use this should already now how to flash it by now
Update:
Version 2 of this boot image, that automatically loads tattoo-hack.ko, uploaded here http://forum.xda-developers.com/showpost.php?p=5792750&postcount=38.

thx,
Someone has tested? comment to be helping mainfram3

leon i go to test
mainfram3 thanks for you hard work

Thank you very much
adb push ./boot.mf3.img /sdcard
- Then, open a shell to your phone via 'adb shell', get root (type "su"), and do the following two commands to flash your new boot image:
# cat /dev/zero > /dev/mtd/mtd2
write: No space left on device [this is ok, you can ignore]
# flash_image boot /sdcard/boot.mf3.img
-Reboot
Is it right?

It´s work!!!! Thanks a lot mainfram3

chusen said:
It´s work!!!! Thanks a lot mainfram3
Click to expand...
Click to collapse
How have you installed it?

*.- adb shell
*.- su
*.- insmod /data/local/bin/tattoo-hack.ko
*.- mount -o rw,remount /dev/block/mtdblock5 /data
*.- mount -o rw,remount /dev/block/mtdblock3 /system
*.- chmod 755 /data/local/bin/flash_image
*.- /data/local/bin/flash_image boot /sdcard/boot.mf3.img
You need flash_image by mainfram3 in /data/local/bin

chusen said:
*.- adb shell
*.- su
*.- insmod /data/local/bin/tattoo-hack.ko
*.- mount -o rw,remount /dev/block/mtdblock5 /data
*.- mount -o rw,remount /dev/block/mtdblock3 /system
*.- chmod 755 /data/local/bin/flash_image
*.- /data/local/bin/flash_image boot /sdcard/boot.mf3.img
You need flash_image by mainfram3 in /data/local/bin
Click to expand...
Click to collapse
Thank you chusen

I got this:
Code:
# /data/local/bin/flash_image boot /sdcard/boot.mf3.img
/data/local/bin/flash_image boot /sdcard/boot.mf3.img
mtd: read error at 0x00000000 (Cannot allocate memory)
.............
mtd: read error at 0x00160000 (Cannot allocate memory)
flashing boot from /sdcard/boot.mf3.img
#
It is correct?

svprm said:
I got this:
Code:
# /data/local/bin/flash_image boot /sdcard/boot.mf3.img
/data/local/bin/flash_image boot /sdcard/boot.mf3.img
mtd: read error at 0x00000000 (Cannot allocate memory)
.............
mtd: read error at 0x00160000 (Cannot allocate memory)
flashing boot from /sdcard/boot.mf3.img
#
It is correct?
Click to expand...
Click to collapse
mmmm.. i think no but i dont help you sorry

Now when i go to "adb shell"
It directly go to "#"

works fine here too.
Is it safe now to delete from /data/local/bin m7, su, flash_image etc, or needed to be there?

svprm said:
Now when i go to "adb shell"
It directly go to "#"
Click to expand...
Click to collapse
mmmm.....then is correctly? any dev can help he?

mainfram3 said:
- ro.secure = 0, which means ADB running as root;
Click to expand...
Click to collapse
If you're getting a root shell, than the image is working as intended

Thanks mainfram3, works as stated

Hi
Good work Mainfram3. Congratulations.
Sorry for my English. I'm Spanish.
adb shell ----> # ---->"root"
But there is a problem. to change something in /system runs out of space.
Tested with "df" command.
before:
/system: 153600K total, 142156K used, 11444K available (block size 4096)
after:
/system: 153600K total, 153600K used, 0K available (block size 4096)
Editar/Borrar Mensaje
EDIT:
This also happened before with M7 hack.
bye

mainfram3:
Hi, how did you repack the boot.img? Repacking it as thisWiki discribed seems not working.

maverixx said:
Hi
Good work Mainfram3. Congratulations.
Sorry for my English. I'm Spanish.
adb shell ----> # ---->"root"
But there is a problem. to change something in /system runs out of space.
Tested with "df" command.
before:
/system: 153600K total, 142156K used, 11444K available (block size 4096)
after:
/system: 153600K total, 153600K used, 0K available (block size 4096)
Editar/Borrar Mensaje
EDIT:
This also happened before with M7 hack.
bye
Click to expand...
Click to collapse
I think you didn't use the tattoo-hack.ko kernel module - right? Take some time and read here: http://forum.xda-developers.com/showthread.php?t=635961 - first post under "Other developer stuff"...
-bm-

I know perfectly this post.
If system is RW is assumed that the tattoo-hack.ko module is loaded.
even by executing:
insmod /data/local/bin/tattoo-hack.ko
mount -o rw,remount /dev/block/mtdblock3 /system
it is the same.
Thanks

@mainfram3: yo can modify boot.mf3.img to load tattoo-hack.ko at star?thanks in advance

[Q] Permission denied while pushing flash_image :(

Hi guys,
I just got a problem while flashing a recovery. I tried to use RomManager to flash the clockworkmod on my click, but while booting into it I just can enter the normal android recovery
I've read a little about this problem and found out, that I need to push the flash_image command line into the /system/bin - and there is the problem!
There're 2 different problems ... first one is permission denied - but I am root ...
Does someone has an idea why I can't push the flash_image?
Also tried http://forum.xda-developers.com/showpost.php?p=9192029&postcount=21 but it won't work - even with mounting the folders ...
Hope you can help me
Regards,
Smoky

Re
$ adb push flash_image /sdcard/
$ adb shell
# mount -o remount,rw -t yaffs2 /system
# mv /sdcard/flash_image /system/bin
# chmod 755 /system/bin/flash_image
# cd /system/bin
# ./flash_image recovery /sdcard/recovery.img
# mount -o remount,ro -t yaffs2 /system

Ok, found a solution
http://forum.xda-developers.com/showthread.php?t=950759
Thx, ready to close

[BRAINSTORM] Booting directly into recovery

For reference, these are my thoughts on the matter.
We have 3 ways to do this:
1. Get hold of SBL, change it and flash it
Currently impossible afaik.
2. Get an init.d bash script to reboot into recovery if key is pressed
Most likely possible taking these 2 assumptions into account:
a) Bash allows to detect a pressed key, something like this:
Code:
_key()
{
local kp
ESC=$'\e'
_KEY=
read -d '' -sn1 _KEY
case $_KEY in
"$ESC")
while read -d '' -sn1 -t1 kp
do
_KEY=$_KEY$kp
case $kp in
[a-zA-NP-Z~]) break;;
esac
done
;;
esac
printf -v "${1:-_KEY}" "%s" "$_KEY"
}
_key x
case $x in
$'\e[15~') reboot recovery ;;
esac
Replacing this key code for one of OB's.
But for this, we need assumption number 2:
b) Key codes mapping is the same for recoveries.
Now, while this is the method of the greatest chance to work, it is also fairly useless. Developers will often break the boot before the init.d scripts are ran. So, this code should be ran before. Hence, the third method.
3. Start a custom service in init.rc (@ ramdisk) that will detect pressed key
This would be the perfect solution as it can't be broken from kernel (zImage) or system changes. However, init.rc has its own programming language (android init language) and there's no way to run this kind of listener.
However, it is possible to run an external script located for example in /system/bin/. These can be both an executable compiled from c (higher chances of working) or a bash scripting like the aforementioned one (lower chances of working since android probably doesn't start a console on boot).
Code for this would be something like:
Code:
service exampleservice /system/bin/exampleservice
user exampleservice
group exampleservice
oneshot
So uh, am I missing anything?
Anyone has other ideas?

a lot of times i heared about pressing "G" and "Power" would boot into some kind of save mode... if thats true i guess its easyer to reprogramm that keycombo to do something else... so does that keycombo anything? i couldnt figure out^^
Sent from my LG-P970 using XDA App

Are others devices has the key combination code in SBL?
I wish I have enough knowledge about android system so i can help...

i04055 said:
Are others devices has the key combination code in SBL?
I wish I have enough knowledge about android system so i can help...
Click to expand...
Click to collapse
Yes there are devices heaving the key-combo in SBL if that answers your question. The "Samsung Galaxy S GT-I9000" e.g. has them there afaik. With that device it was possible flashing the SBL to add a "booting directly into recovery" key-combo...
So I don´t know why there should not be a solution to do the same to the OB but Noejn surely has good reason for telling its impossible.
But hey what about booting into recovery on every system startup and only boot into the system through the recovery? It´s a "quick & dirty" solution even if its possible but better than developing the way we do isn´t it? I´m not sure if its easier to change the startup that way than to add or modify a key-combo but maybe someone here does?

I'm sure (or hope..) someone can, but perhaps we should move this Thread to another part of the Forum so someone with the knowledge how to do this will read it.

d0n22 said:
But hey what about booting into recovery on every system startup and only boot into the system through the recovery? It´s a "quick & dirty" solution even if its possible but better than developing the way we do isn´t it? I´m not sure if its easier to change the startup that way than to add or modify a key-combo but maybe someone here does?
Click to expand...
Click to collapse
Yeah, i prefer that way if poosibble rather than nothing.
But if put it that way, when the phone get bootloop is it still posibbe to boot into recovery?
Sent from my LG-P970 using XDA App

This is how it's done on Xperia X8 phone.
The /system/bin/chargemon is usb-charge daemon that is being hijacked on boot (it's binary is replaced with this script)
Original chargemon is copied into "charger" to keep it's functionality.
Than "sleep 3" waits for any keypress, and checks the dump, if keys were pressed, it launches the recovery binary.
quite simple.
Code:
#!/system/bin/busybox sh
/system/bin/charger
cat /dev/input/event1 > /dev/keycheck&
sleep 3
kill -9 $!
if [ -s /dev/keycheck -o -f /data/local/tmp/xrecovery ]
then
rm -f /data/local/tmp/xrecovery
# remount rootfs rw
mount -o remount,rw rootfs /
# Umount MTDs
umount -l /dev/block/mtdblock1
umount -l /dev/block/mtdblock2
umount -l /dev/block/mtdblock3
# Mount recovery partition
cd /
rm -r /sbin
rm -f etc
tar -xf /system/bin/xrecovery.tar
# Umount /system
umount -l /dev/block/mtdblock0
# chroot
chroot / /init
fi
# remount rootfs rw
mount -o remount,rw rootfs /
chmod 0777 /dev -R
chown 0.2000 /dev/oncrpc -R
cd /
rm init*
rm logo.rle
rm default.prop
tar -xf /system/bin/ramdisk.tar
mkdir -p /minicm
cd /minicm
tar -xf /system/bin/ramdisk.tar
# Umount /system, data and cache
umount -l /dev/block/mtdblock0
umount /dev/block/mtdblock3
umount /dev/block/mtdblock1
rmdir /system /data /cache /mnt

racht said:
This is how it's done on Xperia X8 phone.
The /system/bin/chargemon is usb-charge daemon that is being hijacked on boot (it's binary is replaced with this script)
Original chargemon is copied into "charger" to keep it's functionality.
Than "sleep 3" waits for any keypress, and checks the dump, if keys were pressed, it launches the recovery binary.
quite simple.
Code:
#!/system/bin/busybox sh
/system/bin/charger
cat /dev/input/event1 > /dev/keycheck&
sleep 3
kill -9 $!
if [ -s /dev/keycheck -o -f /data/local/tmp/xrecovery ]
then
rm -f /data/local/tmp/xrecovery
# remount rootfs rw
mount -o remount,rw rootfs /
# Umount MTDs
umount -l /dev/block/mtdblock1
umount -l /dev/block/mtdblock2
umount -l /dev/block/mtdblock3
# Mount recovery partition
cd /
rm -r /sbin
rm -f etc
tar -xf /system/bin/xrecovery.tar
# Umount /system
umount -l /dev/block/mtdblock0
# chroot
chroot / /init
fi
# remount rootfs rw
mount -o remount,rw rootfs /
chmod 0777 /dev -R
chown 0.2000 /dev/oncrpc -R
cd /
rm init*
rm logo.rle
rm default.prop
tar -xf /system/bin/ramdisk.tar
mkdir -p /minicm
cd /minicm
tar -xf /system/bin/ramdisk.tar
# Umount /system, data and cache
umount -l /dev/block/mtdblock0
umount /dev/block/mtdblock3
umount /dev/block/mtdblock1
rmdir /system /data /cache /mnt
Click to expand...
Click to collapse
yeah ，from this we can see what is running before logo screen and we can mod that file

so.. is that mean we can boot to recovery mode same as x8?

racht said:
This is how it's done on Xperia X8 phone.
The /system/bin/chargemon is usb-charge daemon that is being hijacked on boot (it's binary is replaced with this script)
Original chargemon is copied into "charger" to keep it's functionality.
Than "sleep 3" waits for any keypress, and checks the dump, if keys were pressed, it launches the recovery binary.
quite simple.
Code:
#!/system/bin/busybox sh
/system/bin/charger
cat /dev/input/event1 > /dev/keycheck&
sleep 3
kill -9 $!
if [ -s /dev/keycheck -o -f /data/local/tmp/xrecovery ]
then
rm -f /data/local/tmp/xrecovery
# remount rootfs rw
mount -o remount,rw rootfs /
# Umount MTDs
umount -l /dev/block/mtdblock1
umount -l /dev/block/mtdblock2
umount -l /dev/block/mtdblock3
# Mount recovery partition
cd /
rm -r /sbin
rm -f etc
tar -xf /system/bin/xrecovery.tar
# Umount /system
umount -l /dev/block/mtdblock0
# chroot
chroot / /init
fi
# remount rootfs rw
mount -o remount,rw rootfs /
chmod 0777 /dev -R
chown 0.2000 /dev/oncrpc -R
cd /
rm init*
rm logo.rle
rm default.prop
tar -xf /system/bin/ramdisk.tar
mkdir -p /minicm
cd /minicm
tar -xf /system/bin/ramdisk.tar
# Umount /system, data and cache
umount -l /dev/block/mtdblock0
umount /dev/block/mtdblock3
umount /dev/block/mtdblock1
rmdir /system /data /cache /mnt
Click to expand...
Click to collapse
soundes quite promising... have you tried it?

Can this be usefull?
http://forum.xda-developers.com/showthread.php?t=991276

Noejn have you abandoned us ? Or are u planning to take a look at this ? Would be nice if u get OB up and running

recovery
Hi,
has there been any success with booting into recovery mode?
BR,
J

logitec said:
Hi,
has there been any success with booting into recovery mode?
BR,
J
Click to expand...
Click to collapse
No,I try to boot directly into recovery through boot.img,but I get a big "error" form the LG Security Team!

Hijacking a daemon would work if Optimus Black had those binaries. I took a quick glance at a backup and I didn't see chargemon in /system/bin.
Besides, a xRecovery is limited as it's dependent on system files so a /format can't be done which isn't really that "comfy", especially when changing fs.
But yeah, better than nothing. Still, the method you described is only possible in Xperia phones, as far as I know.
I still say injecting a service on the init.rc is the way to go.
However, I can't test this now.
racht said:
This is how it's done on Xperia X8 phone.
The /system/bin/chargemon is usb-charge daemon that is being hijacked on boot (it's binary is replaced with this script)
Original chargemon is copied into "charger" to keep it's functionality.
Than "sleep 3" waits for any keypress, and checks the dump, if keys were pressed, it launches the recovery binary.
quite simple.
Code:
#!/system/bin/busybox sh
/system/bin/charger
cat /dev/input/event1 > /dev/keycheck&
sleep 3
kill -9 $!
if [ -s /dev/keycheck -o -f /data/local/tmp/xrecovery ]
then
rm -f /data/local/tmp/xrecovery
# remount rootfs rw
mount -o remount,rw rootfs /
# Umount MTDs
umount -l /dev/block/mtdblock1
umount -l /dev/block/mtdblock2
umount -l /dev/block/mtdblock3
# Mount recovery partition
cd /
rm -r /sbin
rm -f etc
tar -xf /system/bin/xrecovery.tar
# Umount /system
umount -l /dev/block/mtdblock0
# chroot
chroot / /init
fi
# remount rootfs rw
mount -o remount,rw rootfs /
chmod 0777 /dev -R
chown 0.2000 /dev/oncrpc -R
cd /
rm init*
rm logo.rle
rm default.prop
tar -xf /system/bin/ramdisk.tar
mkdir -p /minicm
cd /minicm
tar -xf /system/bin/ramdisk.tar
# Umount /system, data and cache
umount -l /dev/block/mtdblock0
umount /dev/block/mtdblock3
umount /dev/block/mtdblock1
rmdir /system /data /cache /mnt
Click to expand...
Click to collapse

Good news, I'm getting close.

ok, thank you for everithing

Noejn said:
Good news, I'm getting close.
Click to expand...
Click to collapse
good news indeed^^ im working on it as well but im not feeling like getting close :-\ pls let me know what you did and how you did it as soon as its done... again thank you very much for your efforts!
Sent from my LG-P970 using XDA App

d0n22 said:
good news indeed^^ im working on it as well but im not feeling like getting close :-\ pls let me know what you did and how you did it as soon as its done... again thank you very much for your efforts!
Sent from my LG-P970 using XDA App
Click to expand...
Click to collapse
Well, I've succeed injecting the script on boot.
However, I'm getting some problems on the event0 > keycheck; I don't think at this time of boot /dev entries are up.
But I've already thought of a workaround and I'll test it tomorrow.

I´m thinking, if i compile kernel of ubuntu and install it in recovery partition, not possible then run ubuntu in native mode from sdcard with dualboot?

Ubuntu on Ideos X6

There are threads on this site and elsewhere showing the steps to boot ubuntu on android phones. Our Ideos X6 comes with a powerful hardware so i believe we can run ubuntu on it. But it seems that the kernel must support loop devices. Can anyone make a custom kernel supporting loop devices.
Or has anyone successful in running Ubuntu on Ideos X6.

Our kernel have support for loop device. Take this little instruction how install ubuntu oneiric, also the same process for debian just write distribution name and correct url in debootstrap.
1. this stage you must complete on your linux pc.
Code:
#debootstrap part on PC
sudo apt-get install debootstrap
sudo dd if=/dev/zero of=ubuntu.img seek=838860800 bs=1 count=1
sudo mke2fs -F ubuntu.img
sudo mkdir ubuntu
sudo mount -o loop ubuntu.img ubuntu/
sudo debootstrap --arch armel --foreign oneiric ubuntu http:/ports.ubuntu.com/ubuntu-ports/
sudo umount ubuntu
sudo rm -r ubuntu
2. push this ubuntu.img to sdcard on your phone.
Code:
adb push ubuntu.img /sdcard/ubuntu.img
3. create this script as ubuntu.sh on your sdcard too
Code:
echo "Setting some stuff up.."
export bin=/system/bin
export img=/mnt/sdcard/ubuntu.img
export mnt=/data/local/ubuntu
export PATH=$bin:/usr/bin:/usr/sbin:/bin:$PATH
export TERM=linux
export HOME=/root
mkdir $mnt
echo "Mounting the Linux Image"
busybox losetup /dev/block/loop7 $img
mount -t ext2 -o noatime,nodiratime /dev/block/loop7 $mnt
mount -t devpts devpts $mnt/dev/pts
mount -t proc proc $mnt/proc
mount -t sysfs sysfs $mnt/sys
echo "Setting Up Networking"
busybox sysctl -w net.ipv4.ip_forward=1
echo "nameserver 8.8.8.8" > $mnt/etc/resolv.conf
echo "nameserver 8.8.4.4" >> $mnt/etc/resolv.conf
echo "127.0.0.1 localhost" > $mnt/etc/hosts
echo "Mounting sdcard in /mnt"
mkdir $mnt/mnt/sdcard
busybox mount --bind /mnt/sdcard/ $mnt/mnt/sdcard
echo "Entering CHROOT "
echo " "
busybox chroot $mnt /bin/bash
echo " "
echo "Shutting down CHROOT"
umount $mnt/mnt/emmc
umount $mnt/mnt/sdcard
busybox sysctl -w net.ipv4.ip_forward=0
umount $mnt/dev/pts
umount $mnt/proc
umount $mnt/sys
umount $mnt
busybox losetup -d /dev/block/loop7
4. So now we connect to device, run superuser permission, and chroot to ubuntu
Code:
sudo adb shell
su
sh /sdcard/ubuntu.sh
5.run continue deboostrap
Code:
/debootstrap/debootsrap --second-stage
6. setup apt
Code:
echo 'deb http:/ports.ubuntu.com/ubuntu-ports/ oneiric main' >/etc/apt/sources.list
apt-get clean
apt-get update
7. add root password
Code:
passwd root
8. exit from ubuntu shell with 'exit' and run it again sh /sdcard/ubuntu.sh from terminal emulator on your device or via adb shell.
So, now ubuntu install successfully on your phone and you may install openssh and vnc server.
P.S. http:/ correct it with two //, I can't push correct link to forum. its denied post urls.

Error
I followed your steps exactly as given and changed / to // in http i am getting the following output when i ran ubuntu.sh. kindly help
# sh ubuntu.sh
Setting some stuff up..
mkdir failed for /data/local/ubuntu, File exists
Mounting the Linux Image
losetup: /dev/block/loop7
mount: Device or resource busy
mount: No such file or directory
mount: No such file or directory
mount: No such file or directory
Setting Up Networking
net.ipv4.ip_forward = 1
ubuntu.sh: cannot create /data/local/ubuntu/etc/resolv.conf: directory nonexistent
ubuntu.sh: cannot create /data/local/ubuntu/etc/resolv.conf: directory nonexistent
ubuntu.sh: cannot create /data/local/ubuntu/etc/hosts: directory nonexistent
Mounting sdcard in /mnt
mkdir failed for /data/local/ubuntu/mnt/sdcard, No such file or directory
mount: mounting /mnt/sdcard/ on /data/local/ubuntu/mnt/sdcard failed: No such file or directory
Entering CHROOT
chroot: can't execute '/bin/bash': No such file or directory
Shutting down CHROOT
failed.
failed.
net.ipv4.ip_forward = 0
failed.
failed.
failed.
failed.
losetup: /dev/block/loop7: Device or resource busy

Possbile what loop7 device already busy on your phone.
ry this command to see it
Code:
busybox losetup
And try manual steps which in script to see which step is failed.

When I type
Code:
#busybox losetup
nothing happens
when i type
Code:
#busybox losetup /dev/block/loop7 /mnt/sdcard/ubuntu.img
losetup: /dev/block/loop7
Code:
#mount -t ext2 -o noatime,nodiratime /dev/block/loop7 /data/local/ubuntu
mount: Device or resource busy
the second line is the outputfrom the command.

Do you phone have block devices in /dev/block/ ?

just checked using root explorer. there are many loop# files in /dev/block folder

You may try with UC kernel, or try with ext3 file system. I suppose what your kernel without support ext2.

i tried with UC v5. It supports ext2,ext3 and ext4. Still getting same error.
Should i convert my android filesystem to ext2,3,0r 4. If yes how to do it?

No, you don't need do converting. Problem with loop device or mount, try to see busybox losetup after mount image to block device, it's must show what image mounted to block device. If it's ok, try different option for mount.
I don't have anymore ideas why it doesn't work.
This scenario successful work on my phone.

Can you tell me what ROM you are using
Sent from my CSL-MI410 using XDA App

Last rom from wellcom (2.3-V318E)

now it works. Installed ubuntu. But i am now unable to install any package. when i try to install tightvncserver i get error message
E: Unable to locate package tightvncserver
actally i am not able to install any package
i have checked the /etc/apt/sourcels.list and it contains the required entry and i also did
apt-get clean
apt-get update
and it updates without any error

You need add another repositories to /etc/sources.list such as universe, multiverse, restricted with the same path.

Boot script does not have priviledge

I want to mount the second partition of my SD card at boot time for Link2SD's benefit, but I have been having a hard time.
I copied Link2SD's script in /data/adb/service.d/ and made some small changes:
Code:
#!/system/bin/sh
LOG=/data/link2sd-11link2sd.log
echo >> $LOG
date >> $LOG
sleep 10
mount -t ext4 -o rw,noatime /dev/block/mmcblk1p2 /data/sdext2 1>>$LOG 2>>$LOG
My log shows: "/data/adb/service.d/link2sd.sh: line 6: mount: Permission denied".
I have therefore tried to use su -c, and my log then shows: "/data/adb/service.d/link2sd.sh: line 7: su: Permission denied".
What am I doing wrong?
If it's useful, the log is also not showing the date.

noticed similar strange behavior guess Magisk is kinda broken