Database Develop

{Development}Evo-Derived one click root method.

Current Status 7/14
Without the NAND being unlocked, we are unable to re-write to the recovery partition. Other than that everything is working good. Unlocked NAND=One Click Root!
This method is directly based on the new root process for the Eris released on xda.
Original thread can be found here
The following information is taken directly from the thread mentioned above with some small modifications by me for the Incredible.
Big thanks to tereg for the toolkit and the guys who rooted the EVO with a file write/chmod race condition exploit that gave me the idea for this.
jcase noticed that a race isn't actually nessisary to exploit the chmod 777 on the file I've been working with, simplifying the script alot.
I used the files from the adb development pack that Tereg put together. Download them here. You don't need them for this root process as long as you have a working adb install.
You will need adb access. Install the android sdk for your platform (macos, windows, linux) get it for your OS here.
If you don't know how to install the sdk, search xda, there are a ton of howtos for that.
Files to download:
hack-v5-DINC.zip
A ROM file
Android SKD (skip if you have a working adb)
Instructions for linux/OSX.
Have adb in your path, or move the files contained in hack-v5-DINC.zip into your sdk/tools directory so your pushes will work properly.
FOR ALL OS's Make sure your phone has Applications->Development->USB Debugging turned on.
Do NOT have your phone in Disk Drive Mode, have it in Charge Only.
Open a terminal window in your /tools/ directory. Type this at the prompt.
Code:
sh runinlinux.sh
This will take a few minutes, follow the instructions on your screen.
If you get adb: command not found, edit runinlinux.sh and change every
Code:
#/bin/bash
adb push flash_image /data/local/
adb push recovery.img /data/local/
adb push testfile /data/local/
etc...
to
Code:
./adb push flash_image /data/local/
./adb push recovery.img /data/local/
./adb push testfile /data/local/
etc...
Instructions for windows (thanks tereg!)
Download the hack.zip file and extract it to the desktop. So, you have a folder on the desktop called hack. I would recommend moving or copying those files (EDIT: that are contained in the hack folder) to the C:\android-sdk-windows\tools folder. Why? Because the script runs "adb ____" commands, and unless you've set up adb to be able to run anywhere within the command prompt, the script won't run. So, it will universally work if the files in the hack folder are placed in C:\android-sdk-windows\tools
So, open a command prompt by pressing WindowsKey+R, or going to Start-Run (in WinXP) and typing
Code:
cmd
in the text box there and press OK
If you are in Windows Vista/Windows 7, go to the Start Menu, then type in
Code:
cmd
in the search bar in the lower right-hand corner of the start menu and press enter, and locate Command Prompt in the search results, or go to Start -> All Programs -> Accessories -> Command Prompt
Type
Code:
cd C:\android-sdk-windows\tools
and press enter
Now, I recommend pushing the ROM you want to flash to the SD card now.
Code:
adb push ROM.zip /sdcard
Then, type
Code:
runindos.bat
to execute the script.
You might have to run it 2 or 3 times for it to work. If it fails, just reboot the phone normally, then run
Code:
runindos.bat
again once the phone is booted back up and you're ready.
----------(Thanks again tereg!)
It will scan for a long time, give it at least 5 minutes. If it doesn't come back after 5 minutes cntrl +c to stop it, start the process again. MOST PEOPLE HAVE TO RUN THIS AT LEAST TWICE!
If your device reboots into a new screen with options on it, you now have root in recovery mode. At this point you will be flashing your Incredible's brains, so YOUR PHONE WILL BE BLANK AFTER LOADING A NEW ROM! All of your apps/numbers will be gone from the phone.
I suggest a nand backup first.
Download and copy one of these ROM's to your sdcard as update.zip and flash it with flash zip from sdcard by selecting "Install zip from sdcard".
The first boot after loading a new ROM takes quite a while to show any activity to the screen. Give it a good 5 minutes before you start wondering if it's ever going to come back.
---
runinlinux.sh
---
Code:
#/bin/bash
adb push recovery.img /data/local/
adb push flash_image /data/local/
adb shell chmod 777 /data/local/recovery.img
adb shell chmod 777 /data/local/flash_image
adb shell rm /data/local/rights/mid.txt
adb shell ln -s /dev/mtd/mtd1 /data/local/rights/mid.txt
echo "Files copied and permissions set, rebooting HTC Andriod 2.1"
adb reboot
echo "Your phone will now reboot into normal mode, then reboot into recovery mode. If it does not reboot the second time, wait 10 minutes and manually reboot and begin again."
echo "Your phone is now rebooting in Rooted Recovery mode, do a backup and load your ROMs"
adb wait-for-device
adb shell /data/local/flash_image recovery /data/local/recovery.img
adb reboot recovery
---
runindos.bat
---
Code:
@echo off
adb push recovery.img /data/local/
adb push flash_image /data/local/
adb shell chmod 777 /data/local/recovery.img
adb shell chmod 777 /data/local/flash_image
adb shell rm /data/local/rights/mid.txt
adb shell ln -s /dev/mtd/mtd1 /data/local/rights/mid.txt
echo "Files copied and permissions set, rebooting HTC Andriod 2.1"
echo "Your phone will now reboot into normal mode, then reboot into recovery mode. If it does not reboot the second time, wait 10 minutes and manually reboot and begin again."
adb reboot
adb wait-for-device
echo "Your phone is now rebooting in Rooted Recovery mode, do a backup and load your ROMs"
adb shell /data/local/flash_image recovery /data/local/recovery.img
adb reboot recovery
This thread is intended to be an think-tank, similar to the one on the eris forums where I got the idea from. Let the ideas flow!

has this been tested to work on the INC? if not why has this been posted.

outsid0r said:
has this been tested to work on the INC? if not why has this been posted.
Click to expand...
Click to collapse
uhm....do you read?
"This thread is intended to be an think-tank, similar to the one on the eris forums where I got the idea from. Let the ideas flow!"
no. this is not working yet. thats why the title even has {development} in it. the process is almost working, and this is a develpoment thread to work out the issue-which is also in big letters at the top...see where it says
"Without the NAND being unlocked, we are unable to re-write to the recovery partition. Other than that everything is working good. Unlocked NAND=One Click Root!"

So once we solve a much more difficult problem, the less difficult will be easier.
Makes sense.

We already know how to unlock the nand vs the exploit posted last night...also unrevoked will have it done In a few days anyway
Sent from my HTC Incredible using the XDA App

adrynalyne said:
So once we solve a much more difficult problem, the less difficult will be easier.
Makes sense.
Click to expand...
Click to collapse
the difficult problem has already been solved. the unrEVOked team already has the NAND unlocked. now its whether they want to share and make it a true one-click root method, or if they are going to keep it a secret and keep koush's clockworkmod recovery as the only possibility. this tool still uses the clockworkmod recovery, but after a NAND unlock your given the option to change. since koush is working for them too, im starting to think more and more that they are going to keep the monopoly.
im hoping that they will just incorporate their NAND unlock method into this root process. they can even re-lock it after the process is done as they do in their re-flash tool to preserve the monopoly, but a true one-click root is now possible with their co-operation. ive messaged them asking if they want to help out. we will see soon enough, so cross your fingers!

they can even re-lock it after the process is done as they do in their re-flash tool to preserve the monopoly
Click to expand...
Click to collapse
You just lost a ton of respect from me, and I suspect more than a few others. Talk about biting the hand that feeds you.

adrynalyne said:
You just lost a ton of respect from me, and I suspect more than a few others. Talk about biting the hand that feeds you.
Click to expand...
Click to collapse
So I see we have this starting up again....shakes head at OP..
@adrynalyne best to just ignore these people...its not like the winmo days is it man? Le sighe

Good advice, you are right. I will ignore this stuff in the future.
No, not like the winmo days at all. I've never seen so much anomisity and jealousy in a community before like there is for Android.

All I can say is we already intended to release this method, we were making a pretty robust obfuscation for it. But again the community has jumped before thinking and posted the bug for HTC to fix. There might not be any root's left after this one is burnt. Which it now is. Our tool will be released as is soon enough.
We don't care to create a monopoly, we happily work with others that ASK. Those that just jump and tell the world all the secrets we don't want plugged are just stupid, plain and simple.

adrynalyne said:
You just lost a ton of respect from me, and I suspect more than a few others. Talk about biting the hand that feeds you.
Click to expand...
Click to collapse
LOL Whatever, it isnt like respect from you is something anyone cares about. I like someone with the nerve to speak the truth no matter how unpopular it might be.

outsid0r said:
has this been tested to work on the INC? if not why has this been posted.
Click to expand...
Click to collapse
Please read. Think tank! I applaud this dude for trying. More than many others do here!

fader01 said:
LOL Whatever, it isnt like respect from you is something anyone cares about. I like someone with the nerve to speak the truth no matter how untrue it might be.
Click to expand...
Click to collapse
Fixed that for ya.

adrynalyne said:
You just lost a ton of respect from me, and I suspect more than a few others. Talk about biting the hand that feeds you.
Click to expand...
Click to collapse
Shadowmite said:
All I can say is we already intended to release this method, we were making a pretty robust obfuscation for it. But again the community has jumped before thinking and posted the bug for HTC to fix. There might not be any root's left after this one is burnt. Which it now is. Our tool will be released as is soon enough.
We don't care to create a monopoly, we happily work with others that ASK. Those that just jump and tell the world all the secrets we don't want plugged are just stupid, plain and simple.
Click to expand...
Click to collapse
it seems like my comment was taken the wrong way.
for one, clockworkmod recovery is the only one that works on the DINC AFAIK, amon_ras isnt working on here either.
the monopoly is basically a monopoly because of the lack of other available options, not necessarily because its enforced.
i apologize if it came off the wrong way or insulted anyone with the preceding comments.
i meant this thread as a co-operative think-tank, it wasnt my intention to start a big ordeal.

adrynalyne said:
Good advice, you are right. I will ignore this stuff in the future.
No, not like the winmo days at all. I've never seen so much anomisity and jealousy in a community before like there is for Android.
Click to expand...
Click to collapse
@adrynalyne yeah its a real rough community at times, but what ya gonna do right...its hard for me to ignore them at times too
@shadowmite. thanks for your guys hard work....the ignorant ones are everywhere nowadays, hope they don't get you guys down.
Cheers!

Shadowmite said:
All I can say is we already intended to release this method, we were making a pretty robust obfuscation for it. But again the community has jumped before thinking and posted the bug for HTC to fix. There might not be any root's left after this one is burnt. Which it now is. Our tool will be released as is soon enough.
We don't care to create a monopoly, we happily work with others that ASK. Those that just jump and tell the world all the secrets we don't want plugged are just stupid, plain and simple.
Click to expand...
Click to collapse
hmm. well i guess thats what happens when people try to help out the community...maybe next time i just wont do anything... :/
and FYI...i did contact you. i sent you a PM earlier today.
this method has been used on the EVO and hasnt been plugged, and its been in the works on the Eris-also an HTC phone- for quite a long time, and in the same way this is...a co-operative community effort to make the phone the best that it can be.And its still not been plugged.
id worry less about HTC plugging the exploits and more about getting the exploits available to the public.

Correct, you are not the original one leaking the method. But my point is devs capable of finding things like this should be capable of thinking about it being plugged. HTC fixed our recovery hold in the next OTA. Now it's quite possible nand and this root will be patched also. we have NO OTHER WAYS IN... Thats it. besides some VERY complicated exploits we are OUT after the next ota.
I got your pm's, but only after you posted this.
It's a moot point, our one click root is due out in a few minutes. we were going to further lengths to protect the method, but it's out anyway at this point.

Shadowmite said:
Correct, you are not the original one leaking the method. But my point is devs capable of finding things like this should be capable of thinking about it being plugged. HTC fixed our recovery hold in the next OTA. Now it's quite possible nand and this root will be patched also. we have NO OTHER WAYS IN... Thats it. besides some VERY complicated exploits we are OUT after the next ota.
I got your pm's, but only after you posted this.
It's a moot point, our one click root is due out in a few minutes. we were going to further lengths to protect the method, but it's out anyway at this point.
Click to expand...
Click to collapse
well i apologize for the fact that i may/may not have ruined your chances to make a big announcement for your release, but IMO its kinda bs that you keep the info on lockdown. the whole point of android is that its open. a select amount of people shouldnt consider themselves the gatekeepers of important information.

ban_dover said:
well i apologize for the fact that i may/may not have ruined your chances to make a big announcement for your release, but IMO its kinda bs that you keep the info on lockdown. the whole point of android is that its open. a select amount of people shouldnt consider themselves the gatekeepers of important information.
Click to expand...
Click to collapse
From our wiki, which you appearently haven't read:
http://unrevoked.com/rootwiki/doku.php/public/unrevoked2
That doesn't seem fair! Android is about open source.
In some senses, we agree; but at times, a tradeoff needs to be made. Releasing the source code for this, we believe, would compromise the greater ability to unlock devices like these in the future. Given the choice between sacrificing the liberty of running code on our handsets and the liberty of reading the code by which we unlock it, we feel that the millions of handsets are more important. It is unfortunate that we must make such a choice, and we look forward to the day in the future that no such decision need be made.
Click to expand...
Click to collapse

Shadowmite said:
From our wiki, which you appearently haven't read:
Click to expand...
Click to collapse
already read it.
i dont take my opinions from things i read. i take the information and draw my own conclusions. and in this case my conclusion is that, while i can see your point i still disagree.

cat /sdcard/su > su

I am using the PRS complete rooting guide. And when it tells me to type cat /sdcard/su > su, i am getting this error message - cat: can't open '/sdcard/su': No such file or directory.
Can anyone help with this?

Do you have su on your sdcard?

use unrevoked. one click root

just use the one click method by unrevoleved its easier

Su is not on the SD card. The sd card is a brand new PNY card. I have Su in the sdk/tools folder.

Then obviously, that command will not work. Use the unrevoked method if you are unsure what these commands do/how they work. Less headache on your end.

where is it located?

maybe i'm missing something obvious, but why pipe the text rather than just copy the file?
Sorry if this is the wrong place, but that command is curious.

This is what it's asking me to do.
From PRS Complete Rooting Guide
Now type the following commands to make it persistent through reboot
Code:
adb shell
su
export PATH=$PATH:/system/bin
cd /system/app
cat /sdcard/Superuser.apk > Superuser.apk
cd /system/bin
cat /sdcard/su > su
ln -s /system/bin/su /system/xbin/su /* IF YOU GET AN ERROR HERE DO rm /system/xbin/su THEN REDO */
chmod 06755 su

k_flan said:
maybe i'm missing something obvious, but why pipe the text rather than just copy the file?
Sorry if this is the wrong place, but that command is curious.
Click to expand...
Click to collapse
I don't know what that guide does, but it doesn't seem right --- it'll mess up the privs, that's why the old root was written as an update-payload.
It's redirected I/O since you can't copy across filesystem boundaries -- ie /sdcard to a different mountpoint.

So if I reboot my phone now, do you think I'll lose root and have to start over?

csills said:
So if I reboot my phone now, do you think I'll lose root and have to start over?
Click to expand...
Click to collapse
Either way, it shouldn't matter much. If it didn't work or you lost root for any reason, just go to http://unrevoked.com/ and click on the image for the Incredible. Today unrevoked released version 3 of their tool. This will root your phone and flash the custom recovery all without your needing to do anything in a shell.

askwhy said:
Either way, it shouldn't matter much. If it didn't work or you lost root for any reason, just go to and click on the image for the Incredible. Today unrevoked released version 3 of their tool. This will root your phone and flash the custom recovery all without your needing to do anything in a shell.
Click to expand...
Click to collapse
AND - if you appreciate unREVoked's work - please donate. They do amazing work and they do it all for free! We're the lucky ones to have such [email protected] developers out there who do this kind of stuff so that we don't have to figure out the exact second to push in our SD cards, push files to the SD card, and then push them to the phone at exactly the right time...... just download, run, and you're done.

Just use the unrevoked 3 you will save plenty of pain and struggle

unrevoked3 worked! Thanks for the help guys.

No problem were glad to be of assistance

[Q] Please help me use adb to root JI6 on a mac!!

I have been trying to make this whole adb think work for about twenty hours strait and I still have not gotten very far. I own a mac and no pc and updated to froyo with my buddies pc. I have followed all the directions to a T over and over using terminal on the mac and I can get to the ADB commands and even to where I can see my phone by clicking devices but I must be missing something important. ANY HELP WOULD BE REALLY APPRECIATED I AM ABOUT TO PULL MY FREAKING HAIR OUT!!!

Ok, so if you can see your phone through adb, then you are definitely on the right track. Unfortunately, I'm not really familiar with OS X anymore so I'm not quite sure how to do it. Just sit tight for now until someone who does use a Mac, or has more of a clue then I do can help you out.
But seriously, don't pull your hair out. It won't stay on your head forever ya know...

Edit: oops, just saw this is JI6 (Froyo) not JF6, so I can't help you, but here is a general overview:
from terminal inside Android sdk main directory:
tools/adb devices -> list all devices connected that ADB can see
tools/adb shell -> gets a normal user shell on your phone
tools/adb reboot recovery -> reboots into recovery mode, suitable for update.zip root method
--------------------------------
Place the root update.zip on internal sdcard.
from terminal inside Android sdk directory:
tools/adb reboot recovery
Select the update software option, and you will be done.

laxwillsch said:
I have been trying to make this whole adb think work for about twenty hours strait and I still have not gotten very far. I own a mac and no pc and updated to froyo with my buddies pc. I have followed all the directions to a T over and over using terminal on the mac and I can get to the ADB commands and even to where I can see my phone by clicking devices but I must be missing something important. ANY HELP WOULD BE REALLY APPRECIATED I AM ABOUT TO PULL MY FREAKING HAIR OUT!!!
Click to expand...
Click to collapse
Start simple:
If you open a terminal on the mac, and go to your android SDK tools folder; what happens when you type ADB shell?
Or if you type any of the ADB push commands?
You need to give more detail around what you are seeing for us to help you.

Ok so if I am in terminal and i type in my /android-sdk-mac_x86/tools nothing happens and it just says /android-sdk-mac_x86/tools is a directory. But if I type the same but with /tools/abd it opens the abd command lines, like how to write code. Then when I try to "adb push rageagainstthecage-arm5.bin /data/local/tmp/rageagainstthecage-arm5.bin"
it says "-bash: adb: command not found"
however when I type laxwillsch$ /android-sdk-mac_x86/tools/adb shell
it does give me the drop down $
but when I then try to write the next line of code "chmod 0755 rageagainstthecage-arm5.bin"
it says "chmod: rageagainstthecage-arm5.bin: No such file or directory"
I am stumped I am beginning to think i need to buy a pc as I am very interested in android development and want to learn more, but it seems all the tutorials are run assuming you are on a PC
EDIT** I have downloaded the android SDK started pack, and the 2.2 root pack and they are all in my /android-sdk-mac_x86/tools folder that is directly on my Macintosh HD for simplicity

Do you know how to change directories (cd command)?
The problem is that you are trying to work in one directory, but all your tools are in another.
So change directories to the tools directory:
cd /android-sdk-mac_x86/tools/
now run your adb commands - you may have to type ./adb to tell your mac to look in the current directory for the adb command (that is what ./ means "start here")
Also, try to understand what is happening so you can more easily troubleshoot: chmod is a command to change permissions, and you are running it on the phone. If you can't push the file to the phone, then you can change it's permisssions. I guess you never got rageagainstthecage on the phone, so there is no way to chmod it.
If you can't do this on a mac, a PC is not easier. I use both, and like both, but you need to learn basic commands first - they apply to the mac terminal and the windows cmd prompt.
Getting root means moving in and out of the phone - adb shell - puts you in a terminal on the phone. So you really need to understand cd (change directory); pwd (present working directory - shows you where you are); cp (copy); and know your current path - what the ./ does.
I hope this helps, not trying to sound condescending - maybe practice a linux terminal tutorial would help

Thanks so much, I am at school right now and cant test out all that but you are really helping me understand all this! I will post tonight and let you know how it goes. again thank you

ok so i dont have my usb cable with me but I was playing around with the commands that you suggested and ureka! i finally got to a point where it says "h70-33-65-19:tools laxwillsch$" thats a first! and when i type pwd it shows "/android-sdk-mac_x86/tools" so that means I am working out of the right directory right? and from here I enable usb debugging connect my phone then just copy and paste the codes from the thread correct?

yes, it sounds like you are on the right track. But take it nice and slow when you follow the steps. It is very important that the commands are entered exactly as you see them.
Also, one step tells you to wait for something to run and kick you out of ADB - wait just like it says - takes about 45 seconds but feels like forever.
If you are in the tools directory - just by typing "adb" no quotes will give you whole page of adb commands - if you get a "command not found", then you need to add the ./ and make it ./adb
Hope this helps and again, read the commands step by step a couple times first so you understand what is happening.
In a nutsell, you push the rage file;
change its permissions, run it;
get kicked out of ADB and then open a new ADB shell;
you are now root;
remount the system partition to give you write access when it reboots;
reboot;
push over some files;
change permissions on files you pushed;
reboot;
Some things to know - SU is a command for gaining root access; when you use SU your prompt changes (in adb shell) from $ to #
If you are succesful you should see the SuperUser app listed in your apps.

Done and Done just rooted successfully couldnt have done it without you! thanks so much

[REQUEST] Can someone post a guide to how to get Froyo on eMMC?

I don't want to dual-boot, even, just have a nice "normal" Nookie Froyo install on eMMC. I've seen several allude to the fact that it worked for them but no reviews of how they did it. I've backed up my 2.1 install with Clockwork so I'm not really worried about that.
TIA.

It's quite simple actually. All you need is basic knowledge of adb.
All disclaimers apply, I'm not responsible for any damage. Just know that mine is running on internal partitions. And the SD does mount too!
Before doing anything, I would recommend applying a dd from your partitions to your pc.
With, for example on mmcblk0p1 (boot) adb: dd if=/dev/block/mmcblk0p1 of=boot.img
You should do that for each partition to be safe (0p1 to 0p8).
All the following commands can be execute one after one, the separations are only there to makes things a bit more clear.
Then,
Boot to a working Nookie (NF) with your uSD fresh from burning, without any google apps, and without any uSD damaged errors.
Empty your internal system and copy uSD system over, by doing:
- adb shell mount -o remount,rw /dev/block/mmcblk1 / (---there is a space after the 1---)
- adb shell
- mkdir tmpfolder
- mount /dev/block/mmcblk0p5 tmpfolder
- cd tmpfolder
- rm -r * (---note that there is space after the r---)
- cd ..
- cp -r system/* tmpfolder (---this will take a few minutes---)
- umount tmpfolder
Click to expand...
Click to collapse
Then, you need to boot push the attached files (bottom of post) except for the 2 vold files to your boot partition: mmcblk0p1. Unzip, copy content, not zip.
You could very well replace uImage with the new Quickie overclocked uImage for froyo (see dev thread).
To push attached files to boot, do:
- mount /dev/block/mmcblk0p1 tmpfolder
- exit
- adb push [folder-containing-4-attached-files-except-vold.fstab] tmpfolder
- adb shell
- umount tmpfolder
Click to expand...
Click to collapse
I would also recommend erasing all your data. But that's up to you, if you want to keep your data on it. In any case, you can revert back with the data.img you created above . So next part you could skip, haven't tried skipping personally:
Non mandatory, but you could do:
- mount /dev/block/mmcblk0p6 tmpfolder
- cd tmpfolder
- rm -r *
- cd ..
- umount tmpfolder
Click to expand...
Click to collapse
Then you need to push vold.fstab and vold.conf (unzip volds, copy content) to system/etc
Copy vold's to system/etc:
- mount /dev/block/mmcblk0p5 tmpfolder
- exit
- adb push [folder-with-vold's] tmpfolder/etc/
- adb shell
- umount tmpfolder
- rm -r tmpfolder
- exit
Click to expand...
Click to collapse
Then shut down, remove uSD, and boot.
Again, you can choose to push the Quickie uImage, I you prefer, but the accelerometer doesn't work with it at the moment. The 950 kernel does sometimes crash on boot, but once booted is quite stable.
I think that's all folks. I could have been a bit vague at some times, but this should work. And if you made your imgs as recommended, you're bullet proof.
To revert back to initial state with img files, you need to copy files to sdcard and then dd:
- adb shell mount -o remount,rw /dev/block/mmcblk1p1 sdcard
- adb push XXX.img sdcard (--could take a few minutes--)
- dd if=XXXX.img of=/dev/block/mmcblk0pX
Click to expand...
Click to collapse
Do that for each partition.
For those who don't feel up to the task, I could make a CWR flashable zip file of all this. The only thing is, CWR dosen't boot on Nookie just yet. So you couldn't restore with a zip after the change.

[Before doing anything, I would recommend applying a dd from your partitions to your pc.
With, for example on mmcblk0p1 (boot) adb: dd if=/dev/block/mmcblk0p1 of=boot.img
You should do that for each partition to be safe (0p1 to 0p8).
[/QUOTE]
I am a little confused here. What are the names of the 7 other partitions? Thanks, Great guide btw!

See here.

Do you see improved speed and touch response running nookie from emmc?

im getting a "No such file or directory" error after "adb push [folder-with-vold's] tmpfolder/etc"
I created the directory but now it looks like i am stuck at the landscape android splash screen on boot...
any ideas? I am attempting to redo the whole process again just incase i missed something.

Sorry, there's a slash after etc.
Make sure you've copied the systen files, with "ls" inside tmpfolder where you copied system. Should be a etc folder there.
Sam

to the op: I'm not knocking you here, but do you have a basic idea of generic linux file hierarchy or operations in general? Getting a basic grasp on working with files in a linux terminal will make all of these operations make a lot more sense, since most "adb shell" commands are basic linux commands.

FastCR said:
to the op: I'm not knocking you here, but do you have a basic idea of generic linux file hierarchy or operations in general? Getting a basic grasp on working with files in a linux terminal will make all of these operations make a lot more sense, since most "adb shell" commands are basic linux commands.
Click to expand...
Click to collapse
Thanks but I don't see how that comment adds anything here.
Looks like the issue is above commands copy the actual system folder (not the contents of the folder) To the root of the partition. ls shows the folder "system" not the contents including etc. They are inside the folder but if the partition is mounted as system then the folder is redundant. Will check copying the contents and see if that helps.
Once I get it working in will post back to let others know
**** in the first block of code replace
Code:
- cp -r system tmpfolder (---this will take a few minutes---)
with
Code:
- cp -r system[B]/*[/B] tmpfolder (---this will take a few minutes---)
many thanks!

FastCR said:
to the op: I'm not knocking you here, but do you have a basic idea of generic linux file hierarchy or operations in general? Getting a basic grasp on working with files in a linux terminal will make all of these operations make a lot more sense, since most "adb shell" commands are basic linux commands.
Click to expand...
Click to collapse
Why would you go out of your way to say that? It's not constructive. As a junior member with three posts and 0 thanks after a year and a half, sharpen your teeth here at XDA before you act like a big shot.

Right thanks. Changed it.
Has it worked for you?
Sent from my HTC Desire using XDA App

samuelhalff said:
You could very well replace uImage with the new Quickie overclocked uImage for froyo (see dev thread).
Click to expand...
Click to collapse
Are you certain on this part? Last I read in that thread, Froyo needs a different minimum kernel.
UPDATE: Nevermind, I missed this updated effort.
Homer

Well, last time I checked, my NC was running at 950 on froyo with setcpu.
Check the forum. There's a nookie version of quickie. Except accelerometer doesn't work..

First, huge thanks to the second poster - great guide! Can we sticky this?
Second, yes I know what dd does, etc, I've been working with Linux for about ten years . I just don't know the ins and outs of embedded devices yet.

samuelhalff said:
Right thanks. Changed it.
Has it worked for you?
Sent from my HTC Desire using XDA App
Click to expand...
Click to collapse
yeah i was up till 4am last night but got it working. first i tried to use my existing nf sd card... bad idea. would boot from emmc to the touch android screen to begin, but could not get past. i assume it was the issue on nookdevs because wifi was not enabled. so i removed the setupwizard.apk but somehow bricked and was unable to boot from emmc. so i took the following steps to get things working properly:
1. reimage boot and system from the stock 1.0.1 images and reset the nook to stock, didnt even touch. at the intro screen i just powered it off.
2. next i took a fresh nf sdcard and run steps from your post(with the correction to copy system contents)
3. from there i had a working nf from sdcard! i did my tweaks (google apps, market fix and button remapping from nookdevs froyo tips)
i might to put together a post with a more verbose set of instructions for a one stop froyo shop but if i do i will be sure to give you credit for your contribution.
thanks again!

Hi,
Second, yes I know what dd does, etc, I've been working with Linux for about ten years . I just don't know the ins and outs of embedded devices yet.
Click to expand...
Click to collapse
Well, that's a nice contrast. I've been working on Linux/Android for about 2 months now
I should have mentioned that the NF uSD Card must be a newly burnt image, without all the nookie tips added to it. Of course, your Google framework will crash if you port it without your data.
By the way, there's a nice trick to get past the numb android interface, simply touch every corner of the screen, starting with top left and going clockwise. You'll then be sent the your home screen, and from there you'll log on to google account again.
I think the best way of doing it would to create a flashable .zip, which I'll make tonight if I find the time and if people are really interested. But don't forget CWR dosen't work on nookie for the time being. The only way back would be through adb.
So, does anyone wish to have a flashable zip of this? Or will it be a waist of time?
Sam

samuelhalff said:
Hi,
Well, that's a nice contrast. I've been working on Linux/Android for about 2 months now
I should have mentioned that the NF uSD Card must be a newly burnt image, without all the nookie tips added to it. Of course, your Google framework will crash if you port it without your data.
By the way, there's a nice trick to get past the numb android interface, simply touch every corner of the screen, starting with top left and going clockwise. You'll then be sent the your home screen, and from there you'll log on to google account again.
I think the best way of doing it would to create a flashable .zip, which I'll make tonight if I find the time and if people are really interested. But don't forget CWR dosen't work on nookie for the time being. The only way back would be through adb.
So, does anyone wish to have a flashable zip of this? Or will it be a waist of time?
Sam
Click to expand...
Click to collapse
I would love a flashable .zip. I think many others would as well.

starkruzr said:
I would love a flashable .zip. I think many others would as well.
Click to expand...
Click to collapse
Can't wait for a flashable zip. Maybe even some cm7 release candidates would make me real happy.
Sent from Nooted NookColor using XDA App

A pure C implementation of 'cuber' using OpenSSL's BigNum library

In case anybody cares, here's a pure C reimplementation of 'cuber.py'
(my own earlier reimplementation of @vortox's signature.py).
This is what I'm using in my '1-Click' bootloader unlock VM...
See 'grep ^gcc' for "build instructions".
Hack, you can probably build this for ARM and run it right on your very HDX tablet... (-;
UPDATE (JanuaryFebruary 2017):
OK; so, @zivimo had built this for ARM, but people still haven't noticed.
I repacked his binary from a .tar.gz to a .zip archive and decided to spell out the instructions for use.
Perhaps, this helps... With the right bootloader in place, and adb/fastboot installed (and working),
the unlock is as easy as follows...
Download and extract unlock.zip (SHA256: e40e3010f8eccfa9cbd1e73eecac30cf799099d183de23b2d256fc3407f143f6e5db0b8d82c8fd2a25a22b0a598014d22a2ec33cef27a8d4b65a36acde08f27a)
to the same directory that holds the adb and fastboot executables (unless you have added them to your PATH)
Click on get_code.bat in the extracted folder
-- optional (but commonly required) step(s) --
fix root (roll back, if you need to), flash vulnerable bootloader
[you'll definitely need to perform at least some of these if the last step fails]
Click on unlock.bat in the extracted folder
The archive also includes .sh variants of the .bat files for convenience.
You could also just click to show the hidden section and cut&paste... (-;
Code:
[STRIKE]unzip cuber.zip[/STRIKE]
adb push cuber /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/cuber
adb shell 'id=$(cat /sys/class/block/mmcblk0/device/{manfid,serial}); echo "$id"; echo 0x${id:6:2}${id:11:8} | /data/local/tmp/cuber > /sdcard/unlock.code'
adb pull /sdcard/unlock.code
adb shell rm /sdcard/unlock.code /data/local/tmp/cuber
adb reboot-bootloader
fastboot -i 0x1949 flash unlock unlock.code
NOTE: download and extract the attached 'cuberunlock.zip' and run the above commands
in the directory where 'cuber' got extracted to.

Nice job! Originally I wanted to use OpenSSL BigNum too, but I hadn't enough time and Python was easier to use

hey,
made a static compile with an arm debian (jessie). seemed the easiest solution to me. compile command:
Code:
# gcc -fPIE -static cuber.c -o cuber -lssl -lcrypto
# strip cuber
# ldd cuber
not a dynamic executable
# ./cuber
Usage: cuber [RSA-bytes] < data > sig
seems to work. arm(!) binary attached.

ok draxie, you pointed me here but something seems to be missing. i downloaded unlock.zip, put the files in my adb directory. when i run get_code.bat, it pushes cuber to the kindle in the right directory, changes permissions (dont see any errors there) but then stops saying the system can't find the specified path. Whats funny is i used es file explorer to check the paths in the script, and they are there so not sure where the hang up is.

chin_bone said:
ok draxie, you pointed me here but something seems to be missing. i downloaded unlock.zip, put the files in my adb directory. when i run get_code.bat, it pushes cuber to the kindle in the right directory, changes permissions (dont see any errors there) but then stops saying the system can't find the specified path. Whats funny is i used es file explorer to check the paths in the script, and they are there so not sure where the hang up is.
Click to expand...
Click to collapse
Did you check all three paths?
/data/local/tmp
/sdcard
/sys/class/block/mmcblk0
The 2nd one _may_ be problematic if you're on SafeStrap.
I don't know why. I'm yet to install that on one of my test
devices to investigate. (Or, was that the 1st... )
The 0 in the 3rd one may actually be a 1 on some systems.
I have a few extra lines in my VM script to work around
that, I can easily add that here as well, if that turns out
to be the issue.
BUT, to try and troubleshoot: how far does the script get?
If it didn't complain with the permissions, the 1st path is probably OK.
Does it print your manfid/serial?
If so, mmcblkX would be right as well.
Any chance that you're on SafeStrap?
Can you push/pull to/from /sdcard?
- - - - -
On a second thought: I've only ever tested this on Linux.
String quoting on Windows may work differently, and could *royally* mess up how that more complex command is interpreted.
I'll test tomorrow; it's like 20 past 1am here. I need to get some sleep.
In the meantime, as a workaround, you could just hard-code your manfid/serial, and replace this line:
Code:
adb shell 'id=$(cat /sys/class/block/mmcblk0/device/{manfid,serial}); echo "$id"; echo 0x${id:6:2}${id:11:8} | /data/local/tmp/cuber > /sdcard/unlock.code'
by the decidedly much simpler:
Code:
adb shell 'echo 0xmmssssssss | /data/local/tmp/cuber > /sdcard/unlock.code'

draxie said:
Did you check all three paths?
/data/local/tmp
/sdcard
/sys/class/block/mmcblk0
The 2nd one _may_ be problematic if you're on SafeStrap.
I don't know why. I'm yet to install that on one of my test
devices to investigate. (Or, was that the 1st... )
The 0 in the 3rd one may actually be a 1 on some systems.
I have a few extra lines in my VM script to work around
that, I can easily add that here as well, if that turns out
to be the issue.
BUT, to try and troubleshoot: how far does the script get?
If it didn't complain with the permissions, the 1st path is probably OK.
Does it print your manfid/serial?
If so, mmcblkX would be right as well.
Any chance that you're on SafeStrap?
Can you push/pull to/from /sdcard?
- - - - -
On a second thought: I've only ever tested this on Linux.
String quoting on Windows may work differently, and could *royally* mess up how that more complex command is interpreted.
I'll test tomorrow; it's like 20 past 1am here. I need to get some sleep.
Click to expand...
Click to collapse
It's all good draxie, i figured out what i was doing wrong with the other procedure, that damn STEP 2, once i did it, everything fell into place. Bootloader unlocked and now just trying to figure out which rom to try first. Thanks again, you guys are great and i know how valuable everyones time is. :good:

I keep hitting road blocks, I am rooted and on Fire OS 4.5.5.2 I click get code a screen flashes up then I click Unlock and my Kindle boots to the Grey Kindle screen with Fastboot underneath and nothing else happens. Same happens when I copy and past the code into ADB. What step am I failing at? Thanks for the help!

pdanforth said:
I keep hitting road blocks, I am rooted and on Fire OS 4.5.5.2 I click get code a screen flashes up then I click Unlock and my Kindle boots to the Grey Kindle screen with Fastboot underneath and nothing else happens. Same happens when I copy and past the code into ADB. What step am I failing at? Thanks for the help!
Click to expand...
Click to collapse
@draxie - I have no experience with this tool; python/gmpy2 works reliably for me. Sorry to pull you in ...

Davey126 said:
@draxie - I have no experience with this tool; python/gmpy2 works reliably for me. Sorry to pull you in ...
Click to expand...
Click to collapse
I am up and running now, unlocked and running kk-fire-nexus-rom-thor-20161017. Play store is also up and running.

pdanforth said:
I am up and running now, unlocked and running kk-fire-nexus-rom-thor-20161017. Play store is also up and running.
Click to expand...
Click to collapse
Did you end up using some other method, or did these scripts work for you in the end?
Either way, others may find useful if you could share whatever worked for you. (-;
Unfortunately, I still haven't had a chance to test these scripts in Windows;
so, I couldn't answer your first call for help in a good way. If there's something
wrong and there's enough interest, I'll be happy to fix it as soon as I can.

draxie said:
Did you end up using some other method, or did these scripts work for you in the end?
Either way, others may find useful if you could share whatever worked for you. (-;
Unfortunately, I still haven't had a chance to test these scripts in Windows;
so, I couldn't answer your first call for help in a good way. If there's something
wrong and there's enough interest, I'll be happy to fix it as soon as I can.
Click to expand...
Click to collapse
@stangri did my unlock file and I used this thread to unlock https://forum.xda-developers.com/kindle-fire-hdx/general/thor-unlocking-bootloader-firmware-t3463982
I had trouble making the Unlock file, once that was done and some help from other users I am now up and running!