Auto-Modify Boot Image [New! Ported to Windows, 23 Aug 2012] - Atrix 4G Android Development

I ported my automatic boot image modifier from Linux/Ubuntu to Windows. As with the Ubuntu version, my auto-modifier redirects ROM filesystem mounts from emmc (internal memory) to SD card (external memory) in the boot image to more quickly boot a ROM hosted on SD.
Features
Simple, lightweight install. No need to separately install Cygwin and required packages.
As with the Ubuntu version, the boot image ramdisk directory is automatically modified to redirect filesystem mounts for /system, /cache and /data from emmc to SD card so you can quickly boot a ROM hosted on SD. No other changes are made, though the Perl code can be altered as necessary to further modify ramdisk.
Tested working on XP using NottachTrix 1.3.1 AT&T boot image file. For Win 7, you may need to tweak User Access Control (UAC) to launch Cygwin.
Note: The unpacker script is just a copy of “split_bootimg.pl“ found here: http://www.enck.org/tools.html (Thanks Bill.)
Instructions
1. Download cygwin-auto-modify-boot.zip (50MB) here: http://www.mediafire.com/?kz9fqzwznzizb1z
2. Unzip files to Windows c:\ . OR, if you already have a fully functioning c:\cygwin build that contains the Perl v5.14.2, cpio and gunzip binaries, you should only need to extract the directory: cygwin\home\modify-boot to c:\. In any event, you should backup your existing c:\cygwin directory prior to unzipping.
3. Copy the original boot image file (boot.img in this example) to c:\cygwin\home\modify-boot
4. Navigate to c:\cygwin and launch c:\cygwin\cygwin.bat . This opens a cygwin command window, and also generates a set of user configuration files if opened for the first time.
5. In the Cygwin command window, enter: cd ../modify-boot . Here is my directory listing after Cygwin configured my system:
6. In the Cygwin command window, enter the command: ./modify-boot.sh boot.img and press Enter at the prompts. For me, the entire process took ~30 seconds to modify a NottachTrix boot image.
If everything goes right, the system creates a “boot-repack.img” file based on the modified ramdisk and stores it in the modify-boot directory. Various log/debug data are presented on screen and stored in the modify-boot directory.
That’s all! From here you can “fastboot flash boot boot-repack.img” to boot your SD-based ROM, or store the modified image in a boot configuration directory. See http://forum.xda-developers.com/showthread.php?t=1645344
Please note: The size of my dev team has never exceeded one (me); yet I will try to field requests for help as I am able.
References and Credits
http://cygwin.com/install.html
http://www.enck.org/tools.html
http://forum.xda-developers.com/showthread.php?t=1630130
+++++
Linux/Ubuntu Version
Many have studied this excellent tutorial on how to unpack, modify and repack Android ROM boot images: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images. Its contents form a solid baseline for customizing ROM boot images and ROMs in general. Here I attempt to automate the process of modifying boot images.
Results thus far provide an efficient means of booting ROMs that are cloned to SD card (see my clone thread: http://forum.xda-developers.com/showthread.php?t=1764680 ), as shown in the example below.
modify-boot zip: http://www.mediafire.com/?luobv279pcv827k contains five files: three Perl scripts to unpack, modify and repack a boot image, the “mkbootimg” executable, and an executive batch file to run the three Perl scripts in sequence.
Boot image modifier script: modify-bootimg-atrix.pl features a useful example of how customizations can be pre-programmed by including code to redirect ROM filesystem mounts to SD card, thus enabling us to boot SD card-based ROMs --- almost on the fly.
Of course there are many references to customizing boot images, but to my knowledge this is the first published attempt to automate the process. And since there are some interesting projects related to hosting Perl on Android (see References below), I think it would be fun to develop a CWM-flashable zip (or similar tool) that loads a Perl script interpreter and then runs a pre-programmed boot image modifier --- all on phone, without computer aiding.
Preliminaries
Linux-based OS (Ubuntu 12.04 preferred --- it's still free)
Android SDK Platform Tools (includes adb and fastboot)
Perl (Ubuntu 12.04 includes Perl 5.14.2)
Example: Boot Neutrino V2.8 GT cloned to SD card
Suppose we have already cloned Neutrino V2.8 GT ROM (/system, /cache and /data) to SD card. To boot it:
1. Download modify-boot.zip: http://www.mediafire.com/?luobv279pcv827k to Desktop and extract directory: /modify-boot to ~/Desktop
2. Extract boot.img from Neutrino V2.8 GT ROM.zip and drop it in ./modify-boot
3. Open a terminal, get root and cd ~/Desktop/modify-boot
4. Enter: “sh ./modify-boot.sh boot.img” and follow prompts (Output file: boot-repack.img)
5. Boot to fastboot and connect phone to computer
6. fastboot flash boot boot-repack.img
7. fastboot reboot
Once phone is booted, we can run a sanity check by entering:
adb shell (access Android filesystems)
# mount
Results should include the highlighted device names for filesystem mounts:
Code:
[COLOR="Blue"]/dev/block/mmcblk1p2 on /system[/COLOR] type ext4 (rw,noatime,nodiratime,errors=continue,barrier=0,nobh,data=writeback,noauto_da_alloc,discard)
[COLOR="Blue"]/dev/block/mmcblk1p4 on /data[/COLOR] type ext4 (rw,nosuid,nodev,noatime,nodiratime,barrier=0,nobh,data=writeback,noauto_da_alloc,discard)
[COLOR="Blue"]/dev/block/mmcblk1p3 on /cache[/COLOR] type ext4 (rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=0,nobh,data=writeback,noauto_da_alloc,discard)
We can now boot a cloned Neutrino V2.8 GT ROM from SD card, and/or save the modified boot image in a safe, visible location on SD card to configure dual boot (please see: http://forum.xda-developers.com/showthread.php?t=1645344 ). Or, we can roll the modified image into a flashable zip for a standalone boot push.
Standard disclaimers apply. In short, I am not responsible for any harm you or your phone may incur by using any or all of this material.
References
http://code.google.com/p/perldroid/
http://code.google.com/p/android-scripting/
http://forum.xda-developers.com/showthread.php?t=1585009
Credits
Many thanks to the Android Community Effort ( http://android-dls.com/wiki/index.php?title=Main_Page ), and to my friend and xda member ghost_og for his “mkbootimg” command-line fix that made boot image repacking work for Atrix.

Boot modifier script: modify-bootimg-atrix.pl includes logic to search both init.rc (Blur) and init.olympus.rc (CM) in ramdisk for ROM filesystem mounts.

Hi,
If you look at my Gobstopper for 2.3.6 I do exactly this kind of thing. I unpack the boot image into kernel and initramfs, modify init.rc, package it up again and flash back to boot. The binaries and source are included if you want to take a look.
Cheers!

Is it possible to modify partitions numbers? because i use different partitions because of webtop2sd and swap partition?
Adam

NFHimself said:
Hi,
If you look at my Gobstopper for 2.3.6 I do exactly this kind of thing. I unpack the boot image into kernel and initramfs, modify init.rc, package it up again and flash back to boot. The binaries and source are included if you want to take a look.
Cheers!
Click to expand...
Click to collapse
Elegant! Does it support multiple command lines? Also, does it support AT&T yet?

sendust7 said:
Elegant! Does it support multiple command lines? Also, does it support AT&T yet?
Click to expand...
Click to collapse
There is nothing Bell specific to it, static linked binaries so no rom dependence. It doesn't do anything about multiple command lines, no, the normal boot/recovery images have any at all, let alone multiple ones.
Cheers!

Is that right?
"5. Boot to fastboot and connect phone to computer
6. fastboot flash boot-repack.img
7. fastboot reboot"
Because my output is like this:
[email protected]:/home/gtmoraes/AtrixCM9/android-sdk-linux/platform-tools# ./fastboot flash boot-repack.img
unknown partition 'boot-repack.img'
error: cannot determine image filename for 'boot-repack.img'
[email protected]:/home/gtmoraes/AtrixCM9/android-sdk-linux/platform-tools#
and, of course, the boot-repack.img is in the same folder of fastboot
---
I've tried fastboot flash boot boot-repack.img. It softbricked
Reflashing the original boot.img de-bricked it without a hassle. Guess your solution is not compatible with Morrisoft CM7 ROM

GTMoraes said:
Is that right?
"5. Boot to fastboot and connect phone to computer
6. fastboot flash boot-repack.img
7. fastboot reboot"
Because my output is like this:
[email protected]:/home/gtmoraes/AtrixCM9/android-sdk-linux/platform-tools# ./fastboot flash boot-repack.img
unknown partition 'boot-repack.img'
error: cannot determine image filename for 'boot-repack.img'
[email protected]:/home/gtmoraes/AtrixCM9/android-sdk-linux/platform-tools#
and, of course, the boot-repack.img is in the same folder of fastboot
---
I've tried fastboot flash boot boot-repack.img. It softbricked
Reflashing the original boot.img de-bricked it without a hassle. Guess your solution is not compatible with Morrisoft CM7 ROM
Click to expand...
Click to collapse
Soft-brick is usually caused by one or more of the following:
1. The three ext partitions required to host ROM on SD card either do not exist, are not big enough or are corrupt.
2. The three ext partitions exist but no ROM is installed
3. ROM is not compatible with phone
4. User does not wait long enough for phone to boot after installing ROM. First boot usually takes 3 to 5 minutes as the phone is building cache. Subsequent boots should not take longer than a minute with a Class 4 or higher SD card.
And yes, the boot command should be: fastboot flash boot {boot-image}
Cheers

I ported my automatic boot image modifier from Linux/Ubuntu to Windows. As with the Ubuntu version, my auto-modifier redirects ROM filesystem mounts from emmc (internal memory) to SD card (external memory) in the boot image to more quickly boot a ROM hosted on SD.
Features
Simple, lightweight install. No need to separately install Cygwin and required packages.
As with the Ubuntu version, the boot image ramdisk directory is automatically modified to redirect filesystem mounts for /system, /cache and /data from emmc to SD card so you can quickly boot a ROM hosted on SD. No other changes are made, though the Perl code can be altered as necessary to further modify ramdisk.
Tested working on XP using NottachTrix 1.3.1 AT&T boot image file. For Win 7, you may need to tweak User Access Control (UAC) to launch Cygwin.

hi, the size from my original boot is 8 megas, after unpack and repack the size is 4.8 megas, and does not work, my boot is from motorola xt928, did you know why change the size,,thanks

Using CM10 from SD Card (Nottachtrix on internal)
For anyone looking to run Nottachtrix (or other rom) from internal memory and CM10 from external. You'll run into the same problem I did. The init.rc and init.olympus.rc files don't contain the partition information. You need to update the fstab.olympus file in the boot.img. I've attached mine for comparison. (note, after repartitioning my SD Card several times I ended up with a phantom partition (mmcblk1p4) therefore my data is actually on mmcblk1p5.
SD card partition sizes:
System: 340mb
Cache: 700mb
Data: 1.25gb
Additional notes about my partitioning experience:
The DD command in linux (and ADB) copies the entire partition exactly to the SD card's partition, therefore you lose space if you leave it this way. I used DD, but then used fsarchiver to backup all of the sd card's partitions, repartitioned the card again, and restored the partition info with fsarchiver. This made my SD card a lot cleaner and avoided wasting any space.
Everything's running great now. Thank you everyone who made dual booting possible!

Would this tool work on Desire HD?

Need some help. I pulled the boot.img created from ROM1 using copy-boot.img (until step 5 here) and when I ran modify-boot.sh on it, I got the below message:
Unpacking boot image...
Found a secondary file after the ramdisk image. According to the spec (mkbootimg.h) this file can exist, but this script is not designed to deal with this scenario.​
So, I got the boot-NottachTrix-1.3.1-att-sd-ext.img file from this thread and fastboot flashed it, thinking it is already modified, but my phone didn't boot. Then I tried running modify-boot.sh on it and then realized that it has a binary that won't run on mac.
Could someone tell me if I am on the right track with the 2nd steps above so that I can get hold of a ubuntu machine? I tried running it on a puppy linux livecd and it didn't work.
Why didn't the first step work? Is the boot.img created by the copy-boot.sh not in the right format?
Update: I forgot to mention this, but I have NottachTrix 1.3.1 installed on emmc but the size of the boot.img extracted by copy-boot.sh doesn't match that of the one attached to the above link. The one linked is size 3440640 while the one copy-boot.sh created is of size 8388608. For now, I fastboot flashed the later and got back into ROM1. I meanwhile got a livecd boot of ubuntu and ran modify-boot.sh on the one I downloaded and it created boot-repack.img successfully, but I had no success booting with it either.

irha said:
Need some help. I pulled the boot.img created from ROM1 using copy-boot.img (until step 5 here) and when I ran modify-boot.sh on it, I got the below message:
Unpacking boot image...
Found a secondary file after the ramdisk image. According to the spec (mkbootimg.h) this file can exist, but this script is not designed to deal with this scenario.​
So, I got the boot-NottachTrix-1.3.1-att-sd-ext.img file from this thread and fastboot flashed it, thinking it is already modified, but my phone didn't boot. Then I tried running modify-boot.sh on it and then realized that it has a binary that won't run on mac.
Could someone tell me if I am on the right track with the 2nd steps above so that I can get hold of a ubuntu machine? I tried running it on a puppy linux livecd and it didn't work.
Why didn't the first step work? Is the boot.img created by the copy-boot.sh not in the right format?
Update: I forgot to mention this, but I have NottachTrix 1.3.1 installed on emmc but the size of the boot.img extracted by copy-boot.sh doesn't match that of the one attached to the above link. The one linked is size 3440640 while the one copy-boot.sh created is of size 8388608. For now, I fastboot flashed the later and got back into ROM1. I meanwhile got a livecd boot of ubuntu and ran modify-boot.sh on the one I downloaded and it created boot-repack.img successfully, but I had no success booting with it either.
Click to expand...
Click to collapse
I have a newer thread: Dual Boot Atrix: Simplified and Standalone: http://forum.xda-developers.com/showthread.php?t=2124668
which presents my own custom standalone tools to do the following:
Partition SD card
Copy ROM from EMMC to SD
Flash boot image via Atrix Boot Emporium
Flash another ROM of choice to EMMC
No computer required.
On first boot, elapsed time from power-up to welcome screen can be several minutes --- especially for larger ROMs --- as the system is building cache.
Hope this helps

sendust7 said:
I have a newer thread: Dual Boot Atrix: Simplified and Standalone: http://forum.xda-developers.com/showthread.php?t=2124668
which presents my own custom standalone tools to do the following:
Partition SD card
Copy ROM from EMMC to SD
Flash boot image via Atrix Boot Emporium
Flash another ROM of choice to EMMC
No computer required.
On first boot, elapsed time from power-up to welcome screen can be several minutes --- especially for larger ROMs --- as the system is building cache.
Hope this helps
Click to expand...
Click to collapse
Thank you very much! I was able to directly go to the step 4, since I manually copied the partitions already and after verifying that I could boot into the sdcard, used the steps in the "Configuring Dual Boot" thread to get it switch between the two.
It looks like my sdcard is too slow to run android from it, so I will have to find another faster card

Related

NAND flash help

--Formality of newness here--
I'm a noob to flashing my Vogue, so maybe I'm just ignorant of something important, but I'm a programmer, been using linux for a decade, and comfortable hacking devices, so don't spare me any gory details.
Also, many thanks to everyone who has made this possible. The haret bootloader version is amazing, and I'm sure a nand version is even nicer.
--My problem--
I've never tried to flash my Vogue, so as of a few hours ago, it was a vanilla, but updated Sprint Vogue with a type 3 display panel. It has the latest official Sprint radio (3.42.30?).
I started with tatnai's recently stickied FAQ thread in this forum (I can't link it due to being a new member). I followed the steps linked to unlock my phone. I installed 2.31 CoKe and verified it in my bootloader. So far so good.
I then used RUU and VOGUIMGx320.NBH from the 2010-02-04 dated version of vogueeclairnbh.zip file. It succeeded. Resetting the device loads the Android linux kernel. All is well.
Now for my failure. I load a FAT32 formatted SD card with, say, myn's WarmDonut androidinstall.tar file under /sdcard/andboot/. [ignorethis]and copy in the latest zImageEclair (renamed to zImage of course) and the latest initrd.gz, [/ignorethis] hold the center button down through a hardware reset, it boots into the replimenu like this (minus whitespace and some truncation):
Code:
Android Installer
Choose options for installation or choose defaults
(*) Sys on NAND
( ) Sys on SDCard [...]
( ) Sys on Ext [...]
(*) Data on NAND
( ) Data on SDCard[...]
( ) Data on Ext [...]
[B]1. Fix Permissions[/B]
2. Clear Dalvik Cache
3. Backup /data
3. Restore /data
4. Wipe /data
5. Start Recovery Mode
6. Quit
For more info [...]
Notice that option #1 is not an install option. Running #1, I get errors from umount saying it can't mount /system or /data, which I assume is because it's not installed yet. Same with options 2 through 4. Recovery mode does allow me to mount the SD card as a block device, and quit leaves the installer menu.
Intution is telling me that it's not unlocked correctly and that the Android Installer can't write to nand, but without sourcecode for it, I'm kind of at a dead end of my knowledge, and I can't find a similar issue posted here or at PPCgeeks.
What am I missing? Let me know if I need to provide any more information.
If you're flashing to nand, you don't need a(n additional) zImage or initrd. maybe they're throwing the installer off.
I've removed them from my andboot folder, so that androidinstall.tar is the only file in there and retried. The same menu is presented without an install option. I also just reflashed the phone with the non-eclair nbh and got the same results.
I've used this andboot no-rootfs method with haret before, so I've got a pretty clear idea of what should happen, I just don't know what's gone wrong.
Ok, silly question re: folder structure - you should have just /andboot on the root of your sdcard, not /sdcard/andboot. I can't tell from your post.
burrgrinder said:
--Formality of newness here--
I'm a noob to flashing my Vogue, so maybe I'm just ignorant of something important, but I'm a programmer, been using linux for a decade, and comfortable hacking devices, so don't spare me any gory details.
Also, many thanks to everyone who has made this possible. The haret bootloader version is amazing, and I'm sure a nand version is even nicer.
--My problem--
I've never tried to flash my Vogue, so as of a few hours ago, it was a vanilla, but updated Sprint Vogue with a type 3 display panel. It has the latest official Sprint radio (3.42.30?).
I started with tatnai's recently stickied FAQ thread in this forum (I can't link it due to being a new member). I followed the steps linked to unlock my phone. I installed 2.31 CoKe and verified it in my bootloader. So far so good.
I then used RUU and VOGUIMGx320.NBH from the 2010-02-04 dated version of vogueeclairnbh.zip file. It succeeded. Resetting the device loads the Android linux kernel. All is well.
Now for my failure. I load a FAT32 formatted SD card with, say, myn's WarmDonut androidinstall.tar file under /sdcard/andboot/. [ignorethis]and copy in the latest zImageEclair (renamed to zImage of course) and the latest initrd.gz, [/ignorethis] hold the center button down through a hardware reset, it boots into the replimenu like this (minus whitespace and some truncation):
Code:
Android Installer
Choose options for installation or choose defaults
(*) Sys on NAND
( ) Sys on SDCard [...]
( ) Sys on Ext [...]
(*) Data on NAND
( ) Data on SDCard[...]
( ) Data on Ext [...]
[B]1. Fix Permissions[/B]
2. Clear Dalvik Cache
3. Backup /data
3. Restore /data
4. Wipe /data
5. Start Recovery Mode
6. Quit
For more info [...]
Notice that option #1 is not an install option. Running #1, I get errors from umount saying it can't mount /system or /data, which I assume is because it's not installed yet. Same with options 2 through 4. Recovery mode does allow me to mount the SD card as a block device, and quit leaves the installer menu.
Intution is telling me that it's not unlocked correctly and that the Android Installer can't write to nand, but without sourcecode for it, I'm kind of at a dead end of my knowledge, and I can't find a similar issue posted here or at PPCgeeks.
What am I missing? Let me know if I need to provide any more information.
Click to expand...
Click to collapse
If you start recovery mode and plug your device into a linux box you should be able to connect to it using adb (http://cs-alb-pc3.massey.ac.nz/vogue/files/adb) use "adb shell" to get a shell and you will be able to see why it doesn't find the tar file. Look at /init, see how it mounts the sdcard and try the same commands.
Hope this helps.
agree with the comments above. your problem does not have to do with unlocking. it has to do with your file structure or formatting of the sdcard or something along those lines preventing it from seeing the file.
things that may be wrong:
1. the andboot folder is named incorrectly
2. the andboot folder is not in the root of the sdcard (as mentioned above)
3. your androidinstall.tar is not correctly named, or is still zipped, or something of that nature. make sure you look at that file from your computer with it set to NOT hide extensions, so that you aren't missing that it is actually called androidinstall.tar.zip.
as dzo said, from the install menu hit Start recovery mode, then you can hook it up to any computer (usb mass storage function will work) and check all of these out.
Sorry about all this fuss. I finally determined that this menu is caused by a bad/misformatted SD card. The device was seeing it as in the slot, and would even mount it correctly in recovery mode, but nothing could be read by the Vogue. After swapping out to a new one, all is well.
Thanks for everyone's quick replies and insight.

Tattoo Custom Recovery Image

I'm starting this thread to document the work on creating a custom recovery image for the Tattoo.
The main goal is to provide a recovery image that will serve as the launchpad for flashing custom roms.
The Tattoo Custom Recovery Image will provide:
1) A way to use an update.zip signed with test-keys (already accomplished);
2) A way to perform a full backup of mtd2,mtd3,mtd4 and mtd5 (boot,system,cache and data).
3) A way to perform a full restore of the backup achieved by 2);
4) Adb support (already accomplished);
4.1) Adb shell support.
I'm open to input about using nandroid. Right now, without a S-OFF/ENG SPL this looks useless.
Also, if you have any other special need for recovery, please feel free to express it
Alpha release
Tattoo's Custom Recovery Image, Alpha Release
This first release includes:
- ADB enabled recovery
- ADB enabled root shell
- Accept update.zip signed with test keys
- All partitions mounted
- Custom recovery program (the last two options are stubs, not really working yet)
- Included in /sbin: busybox, flash_image and BART
- I've not used BART and, at the moment, cannot attest if it works or not.
- Backup script in /sbin/backup.sh
- Restore script in /sbin/restore.sh
With this custom recovery you can now do a full backup of your unit, by dumping the mtd block devices to your sdcard. Afterwards, you can use flash_image to recover your Tattoo to it's previous state.
I'm releasing this image as is. This is not a point-and-click recovery tool. If you don't know what you're doing, you can seriously damage your unit. The only reason I'm releasing this is in an effort to provide other devs with a way to easily recover their units, back to day-to-day configuration, while experimenting with them.
To flash:
Copy TCRI.alpha.img to /sdcard.
Run "flash_image recovery /sdcard/TCRI.alpha.img"
To reboot into recovery (quickest way)
adb reboot recovery
Please comment
thanks for you work
i try to flahs and get permission denied, do you know why?
flash_image: permission denied
chusen said:
i try to flahs and get permission denied, do you know why?
Click to expand...
Click to collapse
Partition remounted writeable from a fresh rebooted system with the tattoo-hack.ko module inserted??
But I'm sure you did that before because of:
I'm releasing this image as is. This is not a point-and-click recovery tool. If you don't know what you're doing...
Click to expand...
Click to collapse
;-)
-bm-
Thank you very much for your excellent job
Someone could install custom alpha recovery?
thx
@-bm-:yes I will try that way since the beginning. i mount with rw permissions /system and /data. i know is not a point-and-click recovery tool but i think i need more permissions but where?
Where did you guys get your flash_image binary from ?
The error you're getting is from flash_image, not from my recovery image.
I'll attach the flash_image I've been using to this post.
Please tell me if this solves your problem. You need tattoo-hack.ko module inserted, if you're using a release kernel.
Edit: You have the correct permissions in your flash_image binary, right ? After pushing it to the device, don't forget to chmod 755
It works I like drawing, jejeje.
Backup and Restore functionality appears to have no further
The adb root shell is perfect
Very good Work
for when the beta version? and the final version? lol
I try to dump the system userdata and boot.img and when i try to extract with unyasffs and i get this when i try to extract system.img
Code:
4 [main] unyaffs 3940 handle_exceptions: Exception: STATUS_ACCESS_VIOLATION
644 [main] unyaffs 3940 open_stackdumpfile: Dumping stack trace to unyaffs.exe.stackdump
and this with others
Code:
broken image file
Code:
[email protected]:~/Tattoo/images/boot/1$ ../../unpack.pl ./boot.1.img
Page size: 2048 (0x00000800)
Kernel size: 1899580 (0x001cfc3c)
Ramdisk size: 160952 (0x000274b8)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1 console=null
Writing boot.1.img-kernel ... complete.
Writing boot.1.img-ramdisk.gz ... complete.
528 blocks
[ boot.1.img-ramdisk.gz decompressed to boot.img-ramdisk ]
My image dumping script is OK
Take a look here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
The boot.img is not a yaffs2 image. It's a special format, comprised by a 2k header, a kernel image and a ramdisk.
The system.img is a yaffs2 image. From unyaffs's homepage: "Unyaffs is a program to extract files from a yaffs file system image. Now it can only extract images created by mkyaffs2image."
Chusen, I think it would be better to create a new thread for this, since it doesn't concern the custom recovery image directly.
Thank god for custom recovery!
Now we can really start cooking ROMs... gonna break out the tools tonight and get Android 1.6/2.1 sources ready to compile.
leon1984 said:
for when the beta version? and the final version? lol
Click to expand...
Click to collapse
You tell me
Next in line is to tie the backup/restore scripts to the UI, which won't be too hard.
Later, I may mess around with nandroid and bart, to see if they provide something more than my scripts.
Afterwards, when we have some custom roms available, I may create a downloader/updater option, to make it easier to install those.
Also, I'm taking requests for new features
suggestions about scripts
Excellent work, mainfram3. Thank you.
I have extracted the img file, and check backup.sh and restore.sh scripts. The code for checking sdcard remaining space is done. Here it is:
Code:
## TEST: Check free space in sdcard
NEED_KB="200000"
REM_KB=`du /sdcard | awk '{print $6}'`
if [ ${REM_KB%K} -lt $NEED_KB ]; then echo "Not enough space in /sdcard, exiting"; exit; fi
backup space min set to 200MB.
There is another suggestion about restore.sh. Because of backing up img to /sdcard/Backup, $1 might not be needed, right?
mainfram3 said:
Code:
[email protected]:~/Tattoo/images/boot/1$ ../../unpack.pl ./boot.1.img
Page size: 2048 (0x00000800)
Kernel size: 1899580 (0x001cfc3c)
Ramdisk size: 160952 (0x000274b8)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1 console=null
Writing boot.1.img-kernel ... complete.
Writing boot.1.img-ramdisk.gz ... complete.
528 blocks
[ boot.1.img-ramdisk.gz decompressed to boot.img-ramdisk ]
My image dumping script is OK
Take a look here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
The boot.img is not a yaffs2 image. It's a special format, comprised by a 2k header, a kernel image and a ramdisk.
The system.img is a yaffs2 image. From unyaffs's homepage: "Unyaffs is a program to extract files from a yaffs file system image. Now it can only extract images created by mkyaffs2image."
Chusen, I think it would be better to create a new thread for this, since it doesn't concern the custom recovery image directly.
Click to expand...
Click to collapse
and if you want to extract the boot.img here are the two scripts you need to fully extract the kernel(zImage) and ramdisk
split_bootimg.pl
and
extract-ramdisk.sh
they are attached below
jamezelle:
extract-ramdisk.sh missed #!, and the ramdisk zip file should be passed to $1 of this script.
mainfram3 said:
1) A way to use an update.zip signed with test-keys (already accomplished);
Click to expand...
Click to collapse
Hi mainfram3,
I don't want to jack your thread - could you add a little elaboration on this point, or provide a URL so I can learn a little more? The SPL on the phone (oem-78 or fastboot mode) accepts updates signed with the test key from the SDK? (Or some other key?) (On the Eris, the "rom.zip" files unpacked by the RUU are prepended with a mystery blob of 256 bytes - s'pose it could be a mic/sig, but if that's what it is, it don't appear to be in a standard DSA/RSA format, and those .zip files are not signed using the .apk/.jar manifest-signing method)
FYI here's an entertaining story of an epic fail in a related area. After reviewing the fastboot sources from the android tree, I decided that I wanted to spy on the (Windows) RUU update program by sniffing the USB bus - in particular to see if it was explicitly passing signatures in .sig files. (That's an undocumented command-line behavior in fastboot.)
Turns out that recent versions of libpcap and Wireshark allow for USB bus capture on Linux - and using the "usbmon" kernel module in Ubuntu 8.04 LTS, sniffing the USB (5k packet size) seems to work without hitch, even at USB 2.0 speeds. So I took it one step further, and installed WIn Xp SP3 in a QEMU VM on the Ubuntu machine, with the intention of running the RUU updater inside the Xp VM and sniffing the USB bus in the host OS (Linux) machine.
The result? QEMU/Win Xp VM can talk to the phone in either fastboot or adb mode, but bluescreens as soon as you start to move data at any appreciable rate. Doesn't seem to be dependent on whether monitoring is taking place. I might try putting the phone behind a cheapo USB 1.1 hub, and see if that helps, but for the moment I am stopped out on this hack.
bftb0
cn.fyodor said:
jamezelle:
extract-ramdisk.sh missed #!, and the ramdisk zip file should be passed to $1 of this script.
Click to expand...
Click to collapse
it works yea sorry about the
#/bin/sh
i didnt write the scripts btw

[WIP][ThinkTank] Alternate Boot Methods (Safely boot CM10 from usb)

This thread is for brainstorming and developing safe ways of booting our OUYAs to use custom ROMs.
I've developed an initial method that allows OUYA to boot CM 10 from a usb thumb drive that does not require you to mess with any of your internal storage at all! This allows you to keep your OUYA in pristine stock condition, while still enjoying CM 10 from an external thumb drive.
Unfortunately it does require you to setup the thumb drive in a particular way to allow it to be used and this may be difficult for some users without Linux experience. I hope some will find it useful and plan to develop easier methods in the future (probably involving a custom recovery image with the ability to setup the thumb drive for you)
I plan to post more details on how I achieved this so that others can use the knowledge and apply it to other roms or develop improved solutions, but I might work on some other things first. Mainly it involved unpacking/repacking the Android boot.img (google it and there are tutorials about how to do this, I also recommend checking out the "abootimg" program from the Ubuntu packages) and modifying a couple of the init/fstab files.
Note that the zip I am going to link to is not a flashable zip, extract it and follow the instructions in the README which I am including below. Also note the the Google apps are not included - so if you want them you will need to add them yourself. Just be aware things you add to the system partition will need correct permission set.
One of my other ideas I'm going to eventually try is swapping the boot/recovery partitions so that the device normally boots up into recovery and then will have an option to reboot into the recovery partition which would actually boot a full rom for regular use. This may still be dangerous on OUYA though, so is not recommended unless you know what you're doing. I have a Notion Ink Adam which I can boot into APX mode (a low-level nVidia recovery mode that can be used to restore the device in the case of bricking, unfortunately we do not have this level of acces on OUYA), so it will be much safer for me to experiment on it. I haven't really developed on it before though (in fact this OUYA bit is my first major Android development apart from doing/tweaking some CM builds from source myself for some of my devices), so it may take me some time to set stuff up to experiment with it.
Eventually I think we need some form of bootloader for the OUYA. I have read about some very interesting kexec hardboot patches that were developed for the original Nexus 7 that it would be very awesome if we could port to OUYA - that would allow us to boot the patched kernel and have it boot us into kernels/roms stored elsewhere.
Please post any feedback or ideas. Sorry the current method isn't that easy yet and I hope the instructions make sense - hopefully others can also help clarify.
If you'd like to donate to me, I'm certainly not going to turn you away, but keep the other devs in mind 'cause I haven't done that much yet! ( PayPal: [email protected] )
~Troop
ouya-sda123-boot by Trooper_Max
Safely boot your OUYA to CM 10 without messing with your internal storage! (fast thumb drive recommended!)
========
Credits:
========
khanning88 for the initial CM10 Experimental ROM - this is just a repackaging/reconfiguration of it.
mybook4, sonofskywalker3, rayman, professorpoptart for their CWM recovery
And of course the CyanogenMod/ClockworkMod team for the basis of everything!
=========
Contents:
=========
ouya-cm10-system.img:
ext4 system image dumped from CM 10 experimental OUYA rom
ouya-sda123-boot.img:
Android boot.img to boot CM 10 from thumb drive partitions (details below)
==============
Prerequisites:
==============
For this current method, you will need to be able to partition the thumb drive into three ext4 partitions. This probably means you need Linux - if you don't have a Linux system, I highly recommend checking out pendrivelinux.com for methods of booting Linux off of a thumb drive (I recommend Ubuntu 12.04 LTS or whatever version you are comfortable with).
I hope to develop more methods in the future that will be easier than this, but this is the initial method.
=============
Instructions:
=============
1. Partition the thumb drive with three ext4 partitions - note that they must be the first three partitions on the thumb drive, and I would likely just dedicate a thumb drive to this. I recommend using Disk Utility or gparted (usually both available from an Ubuntu thumb drive).
* The first partition will be the data partition and should be the largest
* Note that Android will create the virtual sd card at /data/media
* The second partition will be system (OUYA internal system is 512 M)
* The third partition will be cache (OUYA internal cache is 768 M)
* Feel free to adjust the size of the partitions, but I'd recommend sticking close to the stock sizes
* I've tested this on an 8 GB as well as a smaller 4 GB thumb drive, bigger should not be a problem
2. Note the device name of your thumb drive - It will likely be sdX where X is a letter corresonding to the order it was mounted in - I would expect it to be sdd if it happens to be the fourth drive connected to your machine. The system partition will then be sdX2.
3. Write the ouya-cm10-system.img to the second partition of the thumb drive. It is crucial that the files get copied into the partition with the correct permissions.
* The easiest way to ensure this is to use dd to do a byte for byte copy of the system image directly over the partition, but this is also very dangerous if you type it wrong, so be sure you have the write device name for your thumbdrive.
* I recommend looking in the Disk Utility or gparted, or running "mount", "df -h", and "cat /proc/partitions", to make sure you have an understanding of what drives are what device names before continuing
* Once you are certain of the device name, ie sdX2, where X is the letter for the thumb drive and 2 denotes the second partition which we are using as system, run "dd if=ouya-cm10-system.img of=/dev/sdX2 bs=4M" as administrator (on Ubuntu either by sticking the word "sudo" in front of the command or running "sudo su" first to switch to root)
* This command will not show any output until the end and may take a little while.
4. Clean/fix the filesystem and resize the filesystem to fill the partition.
* Run "esfsck -fp /dev/sdX2" as administrator
* Run "resize2fs /dev/sdX2" as administrator
5. Thumb drive is now ready (the data/cache partitions can be empty ext4, Android will fill them in). Connect it to the OUYA. Through a hub is fine - just be sure it is the only thumb drive connected at boot.
6. Boot the OUYA into fastboot mode. The only real way to do this right now is to first boot up the OUYA normally, then use "adb reboot bootloader" to reboot into the bootloader. You should be able to run "fastboot devices" then and see a device listed.
7. Boot ouya-sda123-boot.img using the command "fastboot boot ouya-sda123-boot.img". You should see it download to the OUYA and it should start booting.
8. Wait patiently. Remember that CM boots slow the first time and depending on the speed of your thumb drive may boot even slower. You can however type "adb devices" to see if it has started the adb daemon. If you don't see a boot animation after a while, you can try running "adb shell" and if you get a permission error, it probably means you didn't flash the system partition correctly, but hopefully all goes well. Note though that once it gets farther into the boot sequence it will turn off the adb daemon so you will lose adb access until it boots up and you can re-enable it.
9. Enjoy CM 10 on your OUYA without having messed with your internal storage! Just be sure not to let your OUYA fall asleep, as it may not be able to wake back up! I'm guessing this is because I was using a hub and so when it falls asleep, the thumb drive essentially gets disconnected and it cannot immediately find it again when it tries to resume. I'd recommend using a wakelock application or power toggle to keep the screen on all the time, etc.
========
For Help
========
Look for us on the XDA Developers Forum under the appropriate threads! Keep in mind that using this method to boot CM 10 may introduce new bugs that would not have occurred using CM 10 the regular way, so be sure to report problems in the appropriate place and mention what methods you used!
Click to expand...
Click to collapse
http://troopermax.com/releases/ouya-sda123-boot.zip
(be gentle - it's 145 MB, I use shared hosting, so feel free to mirror)
md5sum: 49c8e16e27b6deb9d1e8e86363b56f2f
Mirror: http://www.mediafire.com/download/hban76kzeys6ybd/ouya-sda123-boot.zip
~Troop
I'm including some rough developer details here for now about how I did it.
Many thanks once again to the OUYA CWM recovery, I found it insanely useful: http://forum.xda-developers.com/showthread.php?t=2295645
The main part was unpacking/modifying/repacking the boot.img (which contains the kernel/ramdisk/etc)
abootimg helped with this greatly:
http://manpages.ubuntu.com/manpages/precise/man1/abootimg.1.html
Then I followed instructions I found via google for unpacking/repacking the ramdisk:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images
The partitions the OUYA uses are mostly defined in fstab.cardhu:
# Android fstab file.
#<src> <mnt_point> <type> <mnt_flags> <fs_mgr_flags>
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
# We remount because we first mount as rw in order to generate NVSI symlink. See init.rc for details.
/dev/block/platform/sdhci-tegra.3/by-name/APP /system ext4 ro,remount wait
/dev/block/platform/sdhci-tegra.3/by-name/CAC /cache ext4 noatime,nosuid,nodev,journal_async_commit,data=writeback,nodelalloc,errors=panic wait
/dev/block/platform/sdhci-tegra.3/by-name/UDA /data ext4 noatime,nosuid,nodev,journal_async_commit,data=writeback,nodelalloc,errors=panic wait,encryptable=/dev/block/platform/sdhci-tegra.3/by-name/MDA
Click to expand...
Click to collapse
I found that I could use fastboot to boot into the CWM recovery and then use adb pull to dump images of the internal OUYA partitions, using the paths above, ex. "adb pull /dev/block/platform/sdhci-tegra.3/by-name/APP ouya-system.img" to dump the system partition. I did a regular clockwordmod backup first, but adb pull was useful here for pulling raw images.
So after backing up my OUYA stock system, I actually did flash the CM10 rom so that I could dump the partitions to my computer using adb. The main reason I did this was to ensure the system partition gets generated with the correct permissions. I didn't boot into CM10 though, though I was tempted. Instead I restored back to my backup to put my OUYA back in stock condition.
With the system image dumped into a file, I used resize2fs to shrink the file to the minimum size (resize2fs -fM ouya-system.img) This probably wasn't absolutely necessary since it would compress down in the zip, but this allows it to be written to smaller partition sizes.
http://manpages.ubuntu.com/manpages/precise/en/man8/resize2fs.8.html
Here is what I modified the fstab.cardhu to:
# Android fstab file.
#<src> <mnt_point> <type> <mnt_flags> <fs_mgr_flags>
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
# We remount because we first mount as rw in order to generate NVSI symlink. See init.rc for details.
/dev/block/sda2 /system ext4 rw wait
/dev/block/sda3 /cache ext4 noatime,nosuid,nodev,journal_async_commit,data=writeback,nodelalloc,errors=panic wait
/dev/block/sda1 /data ext4 noatime,nosuid,nodev,journal_async_commit,data=writeback,nodelalloc,errors=panic wait
Click to expand...
Click to collapse
Pretty straightforward, except that I removed the encryptable part on /data (not sure how that bits work and if I might have broken it) and made system read/write.
Also note, that I removed the initial read/write mounting of system in init.cardhu.rc since I was having trouble with it mounting from there (I'm guessing because my usb hub/thumb drive weren't yet available when that tried)
Here's the relevant part of init.cardhu.rc:
Before:
on fs
setprop ro.crypto.tmpfs_options size=128m,mode=0771,uid=1000,gid=1000
setprop ro.crypto.umount_sd false
# PLEASE DO NOT REMOVE NVSI SYMLINK! IF CHANGES ARE NEEDED PLEASE ENSURE THAT NVSI SYMLINK IS ALWAYS CREATED.
# Mount system to allow NVSI symlink
mount ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system rw
# Create NVSI filter symlink
symlink /data/data/com.nvidia.NvCPLSvc/files/com.nvidia.nvsiutilv1.xml /system/etc/permissions/com.nvidia.nvsiutilv1.xml
mount_all /fstab.cardhu
#chmod for OUYA parameters
chmod 0644 /dev/block/mmcblk0p5
Click to expand...
Click to collapse
After:
on fs
setprop ro.crypto.tmpfs_options size=128m,mode=0771,uid=1000,gid=1000
setprop ro.crypto.umount_sd false
# PLEASE DO NOT REMOVE NVSI SYMLINK! IF CHANGES ARE NEEDED PLEASE ENSURE THAT NVSI SYMLINK IS ALWAYS CREATED.
# Mount system to allow NVSI symlink
#mount ext4 /dev/block/sda2 /system rw
mount_all /fstab.cardhu
# Create NVSI filter symlink
symlink /data/data/com.nvidia.NvCPLSvc/files/com.nvidia.nvsiutilv1.xml /system/etc/permissions/com.nvidia.nvsiutilv1.xml
#chmod for OUYA parameters
chmod 0644 /dev/block/mmcblk0p5
Click to expand...
Click to collapse
Basically I commented out the mount command - before it was mounting system read/write for a moment to insert the symlink and let the filesystem update itself before remounting read-only in the fstab. The way I do it now it is simply mounted read/write from the fstab and left that way (some may consider this unsafe, but it is good for development... not too hard to remount it read-only if you so desire) I also shifted the symlink command down below the mount all command so it would hopefully still work... not sure what that was for, but they made it sound really important! XD
I also commented out this part about the usb drive since it doesn't really make sense anymore:
# Mount usb drives as /usbdrive. Generally usb drives are formatted with FAT
# filesystem, so we support FAT as of now.
#on device-added-/sys/block/sda
# mount vfat /dev/block/sda /mnt/usbdrive
Click to expand...
Click to collapse
I think those were all the changes I made before repacking it, though it did take me 5 attempts to get a working ramdisk so I may have lost track of something at some point. Those should be the key changes at least.
I also initially used raw dumps of the data and cache partitions on my thumb drive as well to make sure it would work. Then I tested to make sure it would work if they were empty ext4 partitions, which they do - Android fills them in as necessary. So only the system image was necessary to include. (and of course the boot.img for fastbooting)
This was a little bit harder than I had anticipated because I'd previously only looked into this type of thing for Gingerbread devices which aren't set up the same way. I'd kinda been hoping to get a solution where the user could just drop a system.img and data.img onto a fat32 usb thumb drive and the boot.img would loop mount them off the thumb drive. I haven't tried this for Gingerbread, but it seems pretty straightforward. It's not straightforward anymore here since fat32 sdcards aren't used anymore. Being familiar with Linux though, I am happy they are using ext4 everywhere and using the same space alloation for /data and /sdcard so you don't have to worry about which one to make big, but it does make some things more complicated for more average users. It's probably still possible to get the OUYA to do what I wanted, but more complicated and not sure it's worth pursuing over other methods which may be more fruitful.
Hope that's enough details to enlighten some people who may be wondering about the methods used here. My goal is to not only develop new ways of booting the OUYA, but also to share how I accomplished things so that others can learn from it.
~Troop
Is this similar to the Nook HD + CM10 boot?
---------- Post added at 05:07 AM ---------- Previous post was at 04:58 AM ----------
Wait that was blank a second ago. I am downloading now. I will mirro with my mediafir stuff if I can get it to work.
kairnage said:
Is this similar to the Nook HD + CM10 boot?
---------- Post added at 05:07 AM ---------- Previous post was at 04:58 AM ----------
Wait that was blank a second ago. I am downloading now. I will mirro with my mediafir stuff if I can get it to work.
Click to expand...
Click to collapse
Sorry, I was setting up the posts...
I'm not sure this is similar to any solution currently used on other devices, but I do know that other developers have used similar methods to develop their roms.
I don't have a Nook and haven't looked into what they use too much, but we may very well be able to learn from their work.
~Troop
So I dug up an old nvflash package from my Notion Ink Adam and tested it to make sure it still works (with the Adam in APX mode it allows me to directly flash the device with a new partition layout and flash the partitions directly). After verifying I had it setup correctly, I swapped the boot and recovery images and ran it again and sure enough... now when I boot my Adam normally, the recovery rom comes up, and when I boot my Adam into recovery it loads the normal rom - so the theory seems to work.
So I think the next thing I will try is building a new recovery for OUYA from source and adding an option to reboot into "recovery" to the menu, allowing it to be stored on the boot partition and the real boot.img to be stored on the recovery partition, allowing you to boot the OUYA and it comes up in recovery, then you select the new reboot option and it would reboot into "recovery" which would load a full rom. You could then safely flash boot images to the recovery partition without fear of bricking your device.
I think it should work nicely, but not sure how long it will take me since I need to set my build machine back up.
For those who are confused, read more about how these ideas started below!
~Troop
Trooper_Max said:
I think this is a great idea that needs more attention:
mybook4 said:
Devs, I propose the following to get rid of the potential brick risk:
Since we can't get into recovery manually (via HW buttons), let's reverse the role of SOS (recovery) and LNX (kernel). Since LNX is the booting kernel partition, let's flash recovery there and flash the kernel to the recovery partition. I believe we could do this by modifying the fstab and having our updater-scripts flash to the appropriate partitions.
From a cold start, a user will enter recovery (a minor inconvenience for safety). Depending on how we modify the recovery.fstab, getting to the ROM could be as simple as pressing power twice (recovery does a reboot system now and its fstab has the system actually reboot to the recovery partition, which is the ROM's kernel).
Definitely not straightforward, but should prevent bricks. Thoughts?
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
But then I'm definitely biased, because I had the same idea:
Trooper_Max said:
I agree with everyone it would be nice if we had a hardware means to boot into some kind of recovery or flashing mode to flash stock images.
But I was trying to think if there is anything we can do if we don't get that... (guess that makes me a pessimist >_>)
Let me preface this with don't try anything I'm describing here unless you know what you're doing, these are half-baked thoughts of someone who doesn't even have their OUYA yet:
What if we could swap the boot and recovery partitions? (I haven't received my OUYA yet, so I'm not even aware of what partitions it has, so assuming it has them, and yeah, it wouldn't be quite that simple)
Basically what I mean is when the device tries to boot normally, it would boot up a stable recovery rom. (ie the boot partition that normally has the kernel and then loads the rest of the rom instead just has a recovery rom)
Then you have the recovery partition be what boots the full rom. That way you only chance bricking your device when you flash the boot partition, which if we can get a stable recovery rom that works for this, wouldn't be often. We would probably want to modify the recovery to have a 3 second/configurable timer where if you don't do anything it boots into the "recovery" partition which would boot up the full rom.
Basically the boot partition becomes a new recovery rom which gets used like GRUB to boot into the "recovery" partition which boots up your actual rom, or maybe it could also boot from USB or netboot or whatever...
Pretty much what we need is a solid bootloader, sound about right? Let me know if any of this makes sense/doable or if I'm entirely off base here! I don't know if I will have the time to try any of this when I do get my OUYA, but wanted to share some ideas, please proceed at your own risk!
EDIT: Alternatively, the boot partition could be left stock and the recovery partition could be used as a bootloader to boot into USB or other options for loading roms without messing with the stock boot experience and risking bricking the device. ie in this configuration if you boot your device normally it would be stock, if you reboot into "recovery" it would load up a custom rom. Or instead of a custom rom, a custom recovery with bootloader capabilities.
~Troop
Click to expand...
Click to collapse
And I do plan to try this idea out eventually, but I've got some other ideas I intend to try out first.
The first one I hope to have done by the end of this weekend (hopefully sooner though) is to reconfigure this experimental CM build to be usable without touching any of the internal storage space. I plan to have a modified boot.img that will load system/data/sdcard folders off a usb thumb drive. This method would be completely safe, though a little inconvenient because you would need to use adb to reboot the OUYA into bootloader mode so that you can then fastboot it to load the modified boot.img, but after that it could be disconnected and would be running using only external storage. You're essentially using a computer to jumpstart your OUYA into CM10, while leaving everything on the OUYA itself in pristine stock condition. Then I plan to try out arm versions of adb/fastboot so I can use my tablet or possibly phone (USB OTG) to jumpstart the OUYA instead of having to rely on my computer all the time.
I think this will be an extremely safe way of using external ROMs until we can get some kind of special bootloader figured out.
So if anyone is thinking about trying CM10, but leery of messing with their OUYA, just wait another week or so and I should have a safe, non-intrusive solution worked out!
I welcome any input/thoughts on these ideas! And if anyone knows how to do the things I'm describing and wants to beat me to the punch, feel free and run with these ideas - I won't mind as long as you share your work and give me a little credit if any credit is due!
~Troop
Click to expand...
Click to collapse
I just ordered a 64GB PNY off Amazon. Once I get it Tuesday I am going to try this. I am uploading to my mediafire now to mirror.
Trooper_Max said:
So I dug up an old nvflash package from my Notion Ink Adam and tested it to make sure it still works (with the Adam in APX mode it allows me to directly flash the device with a new partition layout and flash the partitions directly). After verifying I had it setup correctly, I swapped the boot and recovery images and ran it again and sure enough... now when I boot my Adam normally, the recovery rom comes up, and when I boot my Adam into recovery it loads the normal rom - so the theory seems to work.
Click to expand...
Click to collapse
After some more playing with my Adam, I noticed that when I reboot into "recovery" which I have booting a CyanogenMod rom and then I reboot and from the reboot menu select "Reboot", it reboots into CyanogenMod again (even though I didn't expect it to). From the reboot menu I tell it to reboot into "recovery" and it boots into CM again, which that part makes sense, since I have the CM boot image stored in the recovery partition. So I got to thinking that maybe when you tell it to reboot into recovery it sets an SOS signal (the recovery partition is sometimes refered to as SOS) and when you boot a normal rom from recovery, it never clears that signal because it isn't normally booting that way. Whereas a true recovery rom knows it needs to clear that signal so you don't get stuck booting into the recovery rom all the time.
I was close - I scanned the recovery source on CM's github and found this bit:
https://github.com/CyanogenMod/android_bootable_recovery/blob/jellybean/recovery.c said:
// Reset to normal system boot so recovery won't cycle indefinitely.
struct bootloader_message boot;
memset(&boot, 0, sizeof(boot));
set_bootloader_message(&boot);
Click to expand...
Click to collapse
So there seems to be a "bootloader message" that tells it whether to boot from the boot or recovery partition. I was going to say we need to be careful how we reboot the device and probably modify the custom rom to be able to reset the boot message, but I just realized we can do better and use this to our advantage. We could set our custom rom to always clear the boot message so that you have to go through the recovery rom each time to boot the system normally, but we could also have the option of selectively resetting the bootloader message - purposefully get ourselves stuck rebooting into "recovery" all the time because that is our normal rom, then from our normal rom have the option of resetting the bootloader message when we want to go into our recovery image stored on the boot partition.
Something to think about - I don't like getting stuck out of my recovery image either, so we gotta be sure we can reset the bootloader message when we need to... I'm going to play with this some more tomorrow, but not sure how far I will get.
EDIT: More info on the bootloader message - seems it is stored on the misc partition. The more I think about this too, the more I'm not sure swapping the boot/recovery is much safer - if we had them swapped, but then the rom gets stuck in a boot loop before it can reset the bootloader message, we'd be stuck always booting into "recovery" and into the boot loop, so we'd be in just as much trouble as if we'd gotten our boot partition to cause boot loops. So whereas normally flashing the boot partition is potentially dangerous, in this scenario flashing the recovery partition would be potentially dangerous - you gotta be sure it's going to be able to reset the bootloader message. We could try to mitigate this by modifying the boot process to reset the bootloader message very early in the boot process (ie before the potential bootloop) so that if we get stuck, the next time we reboot, we'll reboot normally into the recovery rom.
But then we could also do just the opposite of that without swapping the boot/recovery partitions - very early in the boot process, modify the bootloader message to tell the bootloader to boot into recovery - that way if we get stuck the next time we boot up will be into recovery. Then later when the system successfully boots, we could reset the bootloader message so that after a successful boot the next boot will be another normal one instead of into recovery. If we get this right a failed boot would automatically take us to recovery on the next boot, while a successful boot would boot normally on the next boot. So this would be a way to build in some "brick-protection" into the boot.img to make it safer to flash. It'd probably be safest to not reset the bootloader message until the user actually selects the shutdown option - that way any abnormal reboot would cause it to come up into recovery mode.
So I'm not sure swapping boot/recovery partitions really buys us anything anymore, since it also swaps which partition is potentially dangerous to flash. The solution in either case is going to be to cleverly manipulate the bootloader message as described above. So we might just want to not swap them to minimize confusion and focus instead on building "brick-protection" like this into our boot images.
https://github.com/CyanogenMod/android_bootable_recovery/blob/jellybean/bootloader.h said:
/* Bootloader Message
*
* This structure describes the content of a block in flash
* that is used for recovery and the bootloader to talk to
* each other.
*
* The command field is updated by linux when it wants to
* reboot into recovery or to update radio or bootloader firmware.
* It is also updated by the bootloader when firmware update
* is complete (to boot into recovery for any final cleanup)
*
* The status field is written by the bootloader after the
* completion of an "update-radio" or "update-hboot" command.
*
* The recovery field is only written by linux and used
* for the system to send a message to recovery or the
* other way around.
*/
struct bootloader_message {
char command[32];
char status[32];
char recovery[1024];
};
/* Read and write the bootloader command from the "misc" partition.
* These return zero on success.
*/
int get_bootloader_message(struct bootloader_message *out);
int set_bootloader_message(const struct bootloader_message *in);
Click to expand...
Click to collapse
kairnage said:
I just ordered a 64GB PNY off Amazon. Once I get it Tuesday I am going to try this. I am uploading to my mediafire now to mirror.
Click to expand...
Click to collapse
Sounds nice - I'm tempted to get a nice big new thumb drive myself... I don't have any that big >_>
~Troop
I've been following your think tank and I agree with your latest idea 100%
Sending a message for bootloader to always boot into recovery if the system wasn't shut down normally is clean and simple.
I am curious though what about development, with nvflash requiring encryption of commands first mistake will render your ouya unusable.
dexter84 said:
I've been following your think tank and I agree with your latest idea 100%
Sending a message for bootloader to always boot into recovery if the system wasn't shut down normally is clean and simple.
I am curious though what about development, with nvflash requiring encryption of commands first mistake will render your ouya unusable.
Click to expand...
Click to collapse
Glad you agree with my new idea!
As far as development, yeah, that is why I used my Notion Ink Adam for some of the testing that I did.
As far as developing for OUYA, I don't think we are limited by not having nvflash, we just have to be more careful. Personally, if I were developing anything, I would use my above methods to fastboot boot images that load everything else from a thumb drive at least until whatever I'm developing becomes stable enough that I want to use it more permanently. Then I would be very careful about how I flash it.
Heck, if you wanted to be really safe, you could flash recovery images to both the boot and recovery partitions and just use external boot methods
In the long term though, I hope we can develop a bootloader based on the kexec hardboot patches for the original Nexus 7, which would allow booting completely off boot images stored in other locations, loading partitions from other locations. Other locations could even just be the virtual sd card if you don't want to use external media, but at that point we'd have a safe extra bootloader stored on the boot partition.
http://forum.xda-developers.com/showthread.php?t=2104706
Hope that makes sense.
~Troop
I was not aware that any content of RAM can survive a reboot, hard kexec booting custom OS from USB or image is definitely a safe solution, looks like all the pieces are there.
Wish I had something more than ouya alone, since you have your Adam are you going to try to develop something ?
dexter84 said:
I was not aware that any content of RAM can survive a reboot, hard kexec booting custom OS from USB or image is definitely a safe solution, looks like all the pieces are there.
Wish I had something more than ouya alone, since you have your Adam are you going to try to develop something ?
Click to expand...
Click to collapse
I do intend to, but I don't have a great deal of time to devote to Android development, so not sure how long it will take me. I'm trying to find what time I can though. This past weekend/last week I had a bit more than usual.
~Troop
Trooper_Max said:
http://troopermax.com/releases/ouya-sda123-boot.zip
(be gentle - it's 145 MB, I use shared hosting, so feel free to mirror)
md5sum: 49c8e16e27b6deb9d1e8e86363b56f2f
~Troop
Click to expand...
Click to collapse
Here is a mirror for you.
http://www.mediafire.com/download/hban76kzeys6ybd/ouya-sda123-boot.zip
I tried this on my new 64GB and it wouldn't boot, but it's a brand new card so it might be the problem. I'll try a known good card later.
kairnage said:
Here is a mirror for you.
http://www.mediafire.com/download/hban76kzeys6ybd/ouya-sda123-boot.zip
I tried this on my new 64GB and it wouldn't boot, but it's a brand new card so it might be the problem. I'll try a known good card later.
Click to expand...
Click to collapse
Sorry you had trouble - a couple other things to be wary of:
Have only the one thumb drive connected, at least until it boots - the boot.img looks for the data partition as sda1, the system partition as sda2, and the cache partition as sda3. If some other storage device is connected, it might be labeled sda by the OUYA depending on the order it finds them in and then the thumb drive might become sdb or so on.
It worked for me through a hub, but it may also be worth trying it directly if you have trouble.
Guessing you did this, but give it some time, booting from thumb drive especially on the first boot is slower. It's not too long, but it was long enough that for a moment I thought I'd failed again. Of course the thumb drive I was using wasn't built for speed, so YMMV.
If you're still having trouble - even on my failed attempts at boot images for this (it took me 5 tries at getting the ramdisk to get it bootable), I was still able to connect to it using adb. I ran adb on Linux, running adb as root to bypass all that udev configuration stuff - it's just easier, and if the OUYA/device failed to mount the system partition, it might not match the configuration you expect anyway. If you're able to run "adb shell" but it gives you a permission error about not being able to access the shell binary on the system partition, that probably means you didn't setup the system partition correctly - it's crucial that it get set up with the right permissions, which is why I provided the image so it could just be written directly with dd.
I'm going to try to put together a recovery image that can partition the thumb drive for you and flash an arbitrary update.zip to the thumb drive, but not sure when I will be able to have that ready. The initial version will not be able to patch the boot.img though, so that will still need to be modified like the one I have provided, but maybe in a future version I can get it to also modify the boot.img for loading the information from the thumb drive.
Let me know if you continue to have issues or if you do get it working! And if anyone else has got it working, please post so I can at least know someone got it working. It worked for me, and I don't see why it shouldn't work for anyone else, but if there is something conflicting I want to figure it out.
EDIT: I just remembered when I was looking into the swapping boot/recovery stuff, I noticed in the recovery source that there already are some tools that might be able to help partition the thumb drive and fix permissions included in the recovery source:
https://github.com/CyanogenMod/android_bootable_recovery/tree/jellybean/utilities
Tonight I'll see if I can put together some new instructions using those tools that might be easier and less error-prone. I'm hoping those tools can be applied to the thumb drive anyway, I'll try and figure that out tonight.
~Troop
Trooper_Max said:
Sorry you had trouble - a couple other things to be wary of:
Have only the one thumb drive connected, at least until it boots - the boot.img looks for the data partition as sda1, the system partition as sda2, and the cache partition as sda3. If some other storage device is connected, it might be labeled sda by the OUYA depending on the order it finds them in and then the thumb drive might become sdb or so on.
It worked for me through a hub, but it may also be worth trying it directly if you have trouble.
Guessing you did this, but give it some time, booting from thumb drive especially on the first boot is slower. It's not too long, but it was long enough that for a moment I thought I'd failed again. Of course the thumb drive I was using wasn't built for speed, so YMMV.
If you're still having trouble - even on my failed attempts at boot images for this (it took me 5 tries at getting the ramdisk to get it bootable), I was still able to connect to it using adb. I ran adb on Linux, running adb as root to bypass all that udev configuration stuff - it's just easier, and if the OUYA/device failed to mount the system partition, it might not match the configuration you expect anyway. If you're able to run "adb shell" but it gives you a permission error about not being able to access the shell binary on the system partition, that probably means you didn't setup the system partition correctly - it's crucial that it get set up with the right permissions, which is why I provided the image so it could just be written directly with dd.
I'm going to try to put together a recovery image that can partition the thumb drive for you and flash an arbitrary update.zip to the thumb drive, but not sure when I will be able to have that ready. The initial version will not be able to patch the boot.img though, so that will still need to be modified like the one I have provided, but maybe in a future version I can get it to also modify the boot.img for loading the information from the thumb drive.
Let me know if you continue to have issues or if you do get it working! And if anyone else has got it working, please post so I can at least know someone got it working. It worked for me, and I don't see why it shouldn't work for anyone else, but if there is something conflicting I want to figure it out.
EDIT: I just remembered when I was looking into the swapping boot/recovery stuff, I noticed in the recovery source that there already are some tools that might be able to help partition the thumb drive and fix permissions included in the recovery source:
https://github.com/CyanogenMod/android_bootable_recovery/tree/jellybean/utilities
Tonight I'll see if I can put together some new instructions using those tools that might be easier and less error-prone. I'm hoping those tools can be applied to the thumb drive anyway, I'll try and figure that out tonight.
~Troop
Click to expand...
Click to collapse
I could get into ADB as well but was only seeing the stock system. Actually now I think it was the adapter I was using. At first I assumed it was the microsd because it would hang on boot. But after trying a known good card it did the same. I remembered having issues with an adapter that has the indicator light to show it was connected on a tablet before. I tried a generic Kingston adapter and it sees the cards now. Of course I had already wiped them back to stock partitions. LOL Oh well, start again tomorrow.
For anyone who doen't have a Linux box handy or an extra thumb drive to boot a live USB, here are some quick instructions on how to partition the thumb drive from the OUYA itself. You can connect the thumb drive either before or after booting, it doesn't really matter. I'm using all fastboot/adb commands here so they are easy to recognize. If you're knowledgeable about how to use adb/fastboot, feel free to execute the commands however you're comfortable.
Type all the adb/fastboot commands as specified - if it doesn't begin with adb or fastboot, it isn't a command. All /dev paths you type into the commands should be related to /dev/block/sda (your thumb drive), not any internal partitions or you could mess up your OUYA!!!
Boot up the OUYA normally, then reboot into the bootloader:
adb reboot bootloader
Boot CWM using fastboot:
fastboot boot OuyaCWMrecovery6.0.3.2.img
Print partition information for the thumb drive:
adb shell parted /dev/block/sda print
Model: USB Flash Memory (scsi)
Disk /dev/block/sda: 8128MB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32.3kB 6000MB 6000MB primary ext4
2 6000MB 7000MB 1000MB primary ext4
3 7000MB 8000MB 1000MB primary ext4
Click to expand...
Click to collapse
(note in the example output above I already have it partitioned)
Here I was using an 8 GB thumb drive, you can see the size where it says 8128MB.
Delete Partitions from thumb drive: (be sure you don't have anything important on your thumb drive)
adb shell parted /dev/block/sda rm 1
adb shell parted /dev/block/sda rm 2
adb shell parted /dev/block/sda rm 3
(note that you only need to delete partitions that showed up in the table when you printed it, here I deleted 1,2,3, since I had 3 partitions above and the parted commands will say you may need to update your fstab, but that is not relevant here so don't worry about it)
Create 3 primary partitions (adjust the sizes as necessary):
adb shell parted /dev/block/sda mkpart primary 1 6000
adb shell parted /dev/block/sda mkpart primary 6000 7000
adb shell parted /dev/block/sda mkpart primary 7000 8128
Check your paritions again:
adb shell parted /dev/block/sda print
Format your partitions as ext4:
adb shell mke2fs -t ext4 /dev/block/sda1
adb shell mke2fs -t ext4 /dev/block/sda2
adb shell mke2fs -t ext4 /dev/block/sda3
Push the cm10 system image onto the device: (this will take a little while)
adb push ouya-cm10-system.img /tmp/ouya-cm10-system.img
Check that it copied correctly:
adb shell ls -l /tmp
-rw-rw-rw- 1 root root 260308992 Jul 27 2013 ouya-cm10-system.img
-rw-rw-rw- 1 root root 3587 Jan 1 02:12 recovery.log
Click to expand...
Click to collapse
(Note the size... I'm pretty sure copying it /tmp put it into the ramdisk, but our OUYA has enough ram for this)
Write the cm10 system image onto /dev/block/sda2: (this will take a little while)
adb shell dd if=/tmp/ouya-cm10-system.img of=/dev/block/sda2 bs=4M
Check/fix the filesystem:
adb shell e2fsck -fp /dev/block/sda2
Resize the filesystem to fill the partition:
adb shell resize2fs /dev/block/sda2
(Unfortunately, it looks like resize2fs is not included in CWM, so this step would need to be done on the computer)
At this point, the thumb drive should be good, so you just gotta reboot back to the bootloader and boot the boot image:
Reboot to the bootloader again:
adb reboot bootloader
Boot the modified boot image I provided:
fastboot boot ouya-sda123-boot.img
Not sure if that's necessarily easier or harder to follow than the other instructions... I'd probably rather do the partitioning on a desktop with GUIs, but for some who don't have a Linux box handy it might be easier to use the OUYA as a little Linux box
I'm sure you noticed this method still used dd to write the system image, just run from the OUYA instead. I looked into just extracting the system files from the CM10 zip onto the OUYA, but fixing the permissions was not as easy as I thought it would be - the /system partition permissions are actually fixed by the updater script as referred to here:
http://fokke.org/site/content/howto-create-android-updatezip-package
It's actually a scripting language and the script also creates symlinks and does other stuff.
You'd have to extract/modify the updater script to not use the internal partitions and then execute it (I think using the edify program)... still less straightforward than using dd if you have the image handy like I gave you... But I may look into this as another option. The knowledge will certainly be relevant when I look to build a custom CWM recovery to allow you to flash zips to the thumb drive instead of the internal partitions.
~Troop
Thanks to csonger for feedback, which may be handy if you have system partition issues:
csonger said:
I tried both methods (under linux and with ouya as well), but neither of them worked for me. My 8 gig pen couldn't boot.
The first thing is that the system image is 256MB and the tutorial says the System partition needs 512MB or 1GB.
After the boot failures I checked the pendrive. The second (system) partition was 256MB. It is ok when we use dd, but it was full. 100% usage.
First I run the e2fsck command to check for filesystem problems and it found some inode issues on it.
Following the fs fix the resize2fs command did the job and I had got a 1 gig System partition.
After that my pendrive could boot the cyanogenmod image without problems.
May be someone else has the same problem as me. Please share with them.
Thanks for your work:
csonger
Click to expand...
Click to collapse
I didn't have those issues myself for some reason, but I'll investigate and see what instructions I need to update!
Thanks again for the feedback!
~Troop
Finally got my Linux partition back up and running so I can give this a go again.
It's been trying to boot CM for about 15 minutes now, ADB does see it, but I think it might no like the partitions I did.I did 2GB for system and 1GB for cache. I will repartition and try again.
kairnage said:
It's been trying to boot CM for about 15 minutes now, ADB does see it, but I think it might no like the partitions I did.I did 2GB for system and 1GB for cache. I will repartition and try again.
Click to expand...
Click to collapse
That should be fine, I would think... If you continue to have trouble, try running e2fsck and resize2fs on the system partition, as csonger suggested. (In case you didn't already)
I was confused when I came up with the instructions that it worked without me doing resize2fs since I figured that would be needed to expand the filesystem to fill the partition, but somehow it worked anyway and even looked like it was expanded, but I'd probably just forgot to refresh my view after dd.
Note that you can run the commands with just the partition as an argument: (I added -fp to e2fsck to automatically find/fix problems)
e2fsck -fp /dev/sdX2
resize2fs /dev/sdX2
(Where X is the letter for your thumb drive)
Without a size specified, resize2fs resizes the filesystem to fill the partition.
Hope that helps!
EDIT: I went back and fixed the instructions with this addition now that I've tested it a little more. Unfortunately, I noticed that CWM does not include resize2fs and I didn't spot any other programs handy within CWM to do the trick, so you can't quite do this part on the OUYA. I will look into alternate instructions or building my own CWM that includes resize2fs or just plain automates this more.
~Troop

[GUIDE] Unpack system.new.dat

I've been struggling with these system.new.dat block images since lollipop came out. I searched high and low for a way to mount that image outside of twrp with no luck. So I just used twrp instead... These are the steps I take:
Clean flash a lollipop rom that has a system.new.dat image in twrp.
Reboot system.
When device finishes booting use hardware power button to power down without messing with the rom itself yet so it stays fresh. (It's ok to confirm power down on touch screen.)
In twrp make a backup of only the system partition.
Boot back to system and use the method you prefer to move the file system.ext4.win from:
/TWRP/BACKUPS/-ur-device-serial/-ur-backup-date
to your pc and rename it system.tar so you can unpack it. (Of course make sure you have the proper decompression tools, which every OS usually does now.)
Now you have the complete fresh contents of /system as you would in a traditional rom zip. You can do with that as you please, or just throw it into a rom kitchen. :silly:
There is also another solution to allow you to unpack and repack the system.new.dat file. See the link below.
http://forum.xda-developers.com/and.../how-to-conver-lollipop-dat-files-to-t2978952
adomol said:
[*]Boot back to system and use the method you prefer to move the file system.ext4.win from:
/TWRP/BACKUPS/-ur-device-serial/-ur-backup-date
to your pc and rename it system.tar so you can unpack it.
Click to expand...
Click to collapse
Quite tricky but still The way.
Thanx!
Or there's the easy way if your PC is running Windows:
Use @Alexey71's SystemExtractor

How To Guide Extract Boot Image (for Root) - the DSU-Sideloader Method (and Other Tutorials)

Very nice to see Y700 get it's own place on XDA! I myself had just bought the 12GB version and have been very satisfied. The tutorials and info related to this model had been very difficult to come by and mostly in other languages, so I had to do my own research and exploration. So far I was able to flash ROM and extract it's boot image for root thanks to the following tutorial (in Japanese)
boot.imgを入手できない機種でMagiskを導入する方法【DSU Loader】
Android端末のカスタマイズやRoot権限の使用が可能となる「Magisk」ですが、一部例外を除き、導入に…
smartasw.com
The boot image extraction part is trickier as Y700's roms come in GSI form. But with a workaround we can still achieve the same goal. (I heard that you can also use QFIL to do that but I haven't been able to make the tool work, so if someone else can make a tutorial that'd be great)
First you need to prepare:
- DSI-Sideloader from https://github.com/VegaBobo/DSU-Sideloader/releases
- Magisk Manager from topjohnwu's GitHub repo
- a GSI ROM with built in root permission. The one the tutorial was using: https://github.com/phhusson/treble_experimentations/releases/tag/v402 --> go download "system-squeak-arm64-ab-vanilla.img.xz" (~600MB, smallest needed to fulfill the task)
- turn on developer mode and ADB debugging. Get Google SDK platform tools ready and USB drivers installed.
Connect your Y700 to a computer. Check if ADB works.
Next, install the DSI-Sideloader app. Also extract the .xz package you downloaded above to get the .img image (should be ~1.7GB in size)
Copy the image to your Y700 tablet. Open the DSI-Sideloader app, load the image, set userdata size to default (2GB). You can leave image size unchanged.
NOTE: if you have an SD card inserted, click on "config" and check "Unmount SD", or just eject your SD card from tray. Failing to do so will result in error in the install step.
After you're done, click "Install". Once finished there will be a pop-up with commands you need to enter in the terminal of your choosing. On your computer navigate to the directory containing executables of Google SDK platform tools, fire up terminal, enter the 1st command (says non-root) as instructed, and run it.
You will see a progress bar in the drop-down notification area which will complete in a moment and prompt you to reboot. Do that from there.
After reboot you will be running the modded Project Treble ROM, with root access. It's a full fledge OS but once you shutdown / reboot you will go back to your own OS. Treat it as a LiveCD of some sort.
While still connected, turn on dev mode + ADB debugging and go back to terminal for some ADB work. Next we will be extracting boot image under the current environment, made possible by it's built-in root permission.
Run the following line by line:
Bash:
adb shell
Bash:
su
Bash:
cd /dev/block/bootdevice/by-name/
Bash:
mkdir /sdcard/backup_img
Bash:
for file in *; do
if [[ "${file}" = boot* ]]; then dd if=/dev/block/bootdevice/by-name/"${file}" of=/sdcard/backup_img/"${file}".img ; else continue ; fi
done
The 4th command creates a new directory storing extracted boot image, in our case /SD card/backup_img; and the 5th command is the meat of the entire process. It consists of 3 lines, key in one at a time and press "Enter". First line is "for...do", second is "if [[..." to "fi", third is just "done".
After some time the extracted boot image will be stored under the directory specified by the 4th command, in our case /sdcard/backup_img . They are stored in the temporary user space and once you reboot to your original OS you won't be able to access them again. So you need to turn on File Transfer mode, go to the actual directory on your PC and move them to your computer. They have the filenames "boot_a.img" and "boot_b.img" . After you're done, just reboot as usual and you'll get into your old OS.
Now you have the boot images, all that's left is to use Magisk Manager to patch them, enter fastboot mode, and flash the patched images using the following commands:
fastboot flash boot_a patched_img_A.img
fastboot flash boot_b patched_img_B.img
(Rename as needed)
And now your Y700 is rooted.
The linked Japanese webpage also talks about working Android 12 / 13 GSI flavors, patches, and ways to set up your Y700.

Categories

Resources