Database Develop

[ROOTING] The M7 Exploit + Newbie Guide

To be honest, I'm a nice guy, but when threads get filled with utter "OMG, How do I root?" posts, I get pissed off. I don't mean to backseat moderate or anything, I just really get fed up sometimes. Hence, I've broken out the hardcore side of myself, and I present:
Coburn's (mostly) failproof rootmeplz kthxbai tutorial, featuring the awesome m7 exploit.
YOU CANNOT USE THIS ROOT GUIDE TO INSTALL ANDROID 2.0.x/2.1/2.x AT THIS MOMENT IN TIME. PLEASE DO NOT ASK IF YOU CAN INSTALL ANDROID 2.x USING ROOT, AT THIS STAGE IT'S A BIG FAT NO! THANK YOU FOR YOUR ATTENTION!!
Alright.
Easy to understand, plain english guide
Download the ZIP file attached to this post. Extract the files to a safe location - perhaps C:\Tattoo ?
Now, you'll need adb for windows. You can get it from my website's server here: ADB for windows.
Make sure your device is in USB Debug Mode (Settings > Applications > Development). This is ESSENTIAL!
Extract all the files in the adb4win zip file to your C:\Tattoo folder.
Now, go to Command Prompt. In XP, it's under System Tools in Accessories. In Vista/7, it'll be under accessories.
Do the following at the command line:
C:\Users\Coburn> cd C:\Tattoo
This will change your working directory from C:\Users\Coburn (or silimar) to C:\Tattoo .
Now, at the command line, do this:
C:\Tattoo> adb-windows shell "mkdir /data/local/bin" (with the quotes!).
This makes a directory on the Tattoo under /data/local, called bin. If you get a error (like mkdir failed, file/folder exists), this is fine! Don't sweat it.
Now, run this command:
C:\Tattoo> adb-windows push m7 /data/local/bin/m7
...and wait until finish.
Run this:
C:\Tattoo> adb-windows shell "cd /data/local/bin && chmod 755 ./m7" (with the quotes!)
This allows you to run the sucker.
Now, the fun part. Run this:
C:\Tattoo> adb-windows shell
This will dump you at a "$" shell. do the following:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
...lotsa text will flow down your screen. This is normal. Sometimes the exploit causes adb to freeze up, I don't know. I think it may be due to the exploit. It worked on my mac fine though...
Soon, you'll be greeted with this:
#
This is the root prompt! If you get stuff like this:
# usage: reboot ...
usage: reboot ....
usage: reboot ...
Just keep your cool, press enter and the # will say "Boo" again. This is due the exploit spawning reboots to gain the shell.
Then, do these commands from this thread's first post:
-bm- and the hax0rs crew said:
You did it, you should be root now!
Let's set some variables:
Code:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
[...] check if ur root:
Code:
id
You should get something like this:
Code:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.
Click to expand...
Click to collapse
When you get this:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
[... lotsa pasta ...]
#
You can do anything then! Look at /system, /data, etc etc. You're broken free, my friend, and you'll forever be free. Until you press that exit button. you didn't. You didn't press that exit button? lolwut u did? Grrrrrrr!!!
EDIT: Added Guide to remount partitions. It's below.
Now you need to install su. Exit your root shell (via CTRL+C) (NO, Coburn, are you serious? ME LOSE ROOT SHELL?! ) and download this su.zip and extract it to C:\Tattoo. DO NOT EXIT THE COMMAND PROMPT WINDOW.
Meanwhile, back at the ranch, in your command prompt window, do this:
C:\Tattoo> adb-windows push su /data/local/bin/su
Then break out a shell...
C:\Tattoo> adb-windows shell
at the $ prompt, enter:
$ chmod 755 /data/local/bin/su
$ cd /data/local/bin/
..run the exploit again via "while 'true' ; do ./m7 ; done" to get root again then enter ...
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su
# mount -o rw,remount /dev/block/mtdblock5 /data
# mount -o rw,remount /dev/block/mtdblock3 /system (This line allows you to play around with files on the system partition!)
After that, you can exit out of the root shell, and try a normal shell and this:
$ /data/local/bin/su
...which should make you get a nice # prompt. (Sometimes it doesn't, for me it got su: permission denied, wtf?)
(End SU Part of guide)
Tested on Windows 7. Also works on a phone terminal emulator too!
Keep your cool peeps - I do this for fun, I'm not a fulltime android dev. I am an addict though.
Happy rootin my friends.
Cheers,
Tattoo Hacker Coburn.
Greets fly out to the geeks that hacked it originally - without you, I'd have got a nexus one.
Thanks for marsdroid for correcting an error. Kudos to you, bro!
"ANDROID - It's a virus. In a Good Way. Once it's in your system, you can't get rid of it."

You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #

You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.

mainfram3 said:
You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.
Click to expand...
Click to collapse
Noted. Will do.
LordGiotto said:
You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #
Click to expand...
Click to collapse
Heh, yeah. Might add that up too.

Coburn64.
Thanks Man.
Nice Thread.

Thank you Coburn

svprm said:
Coburn64.
Thanks Man.
Nice Thread.
Click to expand...
Click to collapse
Thanks bro for your thanks.

I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
[ROOTING] The M7 Exploit + Newbie Guide
Easy to understand, plain english guide
Click to expand...
Click to collapse
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-

-bm- said:
I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-
Click to expand...
Click to collapse
You're welcome. I actually wanted this thread to help your thread, I wanted to spawn a m7 exploit thread to keep the original thread (which is based on the classic m6 exploit) clean of "How do I root with m7" and such.
Keep up the good work too, bm!

Thanks Coburn, so m6 is useless..
adb shell rm /data/local/bin/m6?

thx for the work , and corrections ! deleted the ealyer post

?
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??

liderzre said:
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??
Click to expand...
Click to collapse
type
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin

rooted
Ty. Guide is not 100% for noobs. (ME).

Problem copying files to system partition after successfull rooting
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks

ronyrad said:
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks
Click to expand...
Click to collapse
The problem is well known an jet we have got no explanation. It looks like an additional security system build in by HTC. That is what also prevents us from flashing Custom ROMS at the moment. Development goes on here: http://forum.xda-developers.com/showthread.php?t=631540&page=18 but there is no solution or explanation until now.
-bm-

Could it be that it seems to be that the driver (yaffs) is possibly trying to copy /system into memory, and then reflash the partition all at once (to prevent NAND/NOR tear and wear)?

this guide is in error and will for sure not work ...
you should post probberly ...specially now when things is working....
there is no reason do do a NONSENCE guide .....
thx for the work thoe
Click to expand...
Click to collapse
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.

Coburn64 said:
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.
Click to expand...
Click to collapse
don't worry for such baseless allegations coburn.... u r doing a great job. keep up this good work bro.... thanks a lot for this wonderful presentation...
waiting for ur custom ROM.....

Coburn64 u are missing a ; in the 2. while
and i dont expect the newbies to sit back and wait for the "BUUH"..
but im sure someone will....
thx again
EDIT Coburn64 fixed it

[TUTORIAL] Extract Contents Inside Of SMGs

Hi there,
Here how I extract contents including folders and files from smg files.
I didn't find any real tutorial about this, I hope it will help you guys to better develop.
This following may soft brick your device, anyway you can recovery it by flashing it back with rsd lite.
always remember, use at your own risks...
Requirement:
- rsd lite \ sbf_flash
- sdcard
- 1,5gb android application free space
- gingerbreak (rooted phone)
- adb (android sdk)
- atrix phone
- no need of desktop linux
1) Extract the smg files from the sbf, to do you can use Rsd Lite or use Sbf_flash, google search is your friend.
link for sbf_flash
Code:
http://blog.opticaldelusion.org/2010/05/sbfflash.html
2) copy the smg files you extracted into the sdcard
2 *) optionally copy shellscript.sh to your sdcard if you don't want to type all those commands.
3) root your phone, easy with gingerbreak
4) set the phone to development mode and open adb shell
5) type the following commands :
* get su access, type su:
Code:
adb shell# su
* remount main block device to have write access to mnt directory:
Code:
mount -o rw,remount -t ext3 /dev/block/mmcblk1 / ;
* create two temporary loop devices:
Code:
/osh/bin/mknod /dev/loop0 b 7 0
/osh/bin/mknod /dev/loop1 b 7 1
* create two new mount directories for example:
Code:
mkdir /mnt/retail ;
mkdir /mnt/att ;
* mount smg files: ( in this example smg files are in smgs directory of your sdcard /smgs, I will copy the contents of retail smg to att smg, that's mean att smg contents will be overwritten )
Code:
/osh/bin/mount -o loop /mnt/sdcard-ext/smgs/olyfr_u4_1.5.7_signed_olpsattspe_p012_hwolympus_1g_1ffCG57.smg /mnt/att ;
/osh/bin/mount -o loop /mnt/sdcard-ext/smgs/olyem_u4_2.1.1_signed_ucaolyportfr_p014_a004_m001_hwolympus_1g_1ffCG57.smg /mnt/retail;
* make clean the att smg
Code:
/osh/bin/rm -rf /mnt/att/* ;
* copy contents from retail smg to att smg:
Code:
cp -dpRf /mnt/retail/* /mnt/att/;
* umount the previous mount directories we created
Code:
/osh/bin/umount /mnt/retail;
/osh/bin/umount /mnt/att ;
you're all done, congratulation!!
here is the script to automate the job, edit it as you want.
Code:
#!/system/bin/sh
mount -o rw,remount -t ext3 /dev/block/mmcblk1 / ;
/osh/bin/mknod /dev/loop0 b 7 0
/osh/bin/mknod /dev/loop1 b 7 1
mkdir /mnt/retail ;
mkdir /mnt/att ;
/osh/bin/mount -o loop /mnt/sdcard-ext/smgs/olyfr_u4_1.5.7_signed_olpsattspe_p012_hwolympus_1g_1ffCG57.smg /mnt/att ;
/osh/bin/mount -o loop /mnt/sdcard-ext/smgs/olyem_u4_2.1.1_signed_ucaolyportfr_p014_a004_m001_hwolympus_1g_1ffCG57.smg /mnt/retail;
/osh/bin/rm -rf /mnt/att/* ;
cp -dpRf /mnt/retail/* /mnt/att/;
/osh/bin/umount /mnt/retail;
/osh/bin/umount /mnt/att ;
there are 3 smgs that you can mount
1) system directory ...CG57.smg
2) data & preinstall directory CG62.smg
3) osh directory CG58.smg

Looks interesting thanks.
Sent from my MB860 using XDA Premium App

This is pretty awesome. I was wondering if something like this can be done. Is there an actual way to edit the cg smgs, so you could repack your own sbf and flash it?

You can also just take the SMG and mount it on any Linux box. Saves a lot of trouble. Of course, if you don't have a virtual machine or don't use Linux, this could be faster.

im sorry but what can we accomplish with the SMG files?

samcripp said:
im sorry but what can we accomplish with the SMG files?
Click to expand...
Click to collapse
SMG is smg, LOL...
that was a joke!!!
Get serious, I really don't know exactly what it is, for now I know that only motorola is using it, so this is just a filename extension and nothing more.
Inside the smg you have contents that you can use to build a custom roms, anyway there are many ways to do this.
Code:
Is there an actual way to edit the cg smgs, so you could repack your own sbf and flash it?
yes there is, but there smg checksums verification when you load the sbf in rsd lite, I never successfully created a fully flashable sbf. Unfortunately there is no full tutorial about this.

briggie108 said:
This is pretty awesome. I was wondering if something like this can be done. Is there an actual way to edit the cg smgs, so you could repack your own sbf and flash it?
Click to expand...
Click to collapse
You can by editting a single code group, and flashing it via fastboot. You'll need linux to mount and edit the image though.

[Q] ADB remount: operation not permitted

Hey Samsung Galaxy tab users and devs.
So im' having a bit of a problem here trying to remount my galaxy tab so i can read/write to it. My cache size is the famous and well hated 25 MB file size limit so i wanted to change it by using this method:
http://forum.xda-developers.com/showpost.php?p=18840882&postcount=227
Im currently running gingerbread 2.3 with root priviliges, and Clockworkmod 3.0.5
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
[/URL] [/IMG]
Whenever i've try to use the remount command it get this error:
http://imageshack.us/photo/my-images/600/androidadb.jpg/
So what am im doing wrong? running WIn 7 64 bit and my tablet is set to usb debugging mode.
Been searching Google and XDA the couple of days but haven't found any solution.
In advance thanks, jakk212

Jakk212 said:
Hey Samsung Galaxy tab users and devs.
So im' having a bit of a problem here trying to remount my galaxy tab so i can read/write to it. My cache size is the famous and well hated 25 MB file size limit so i wanted to change it by using this method:
http://forum.xda-developers.com/showpost.php?p=18840882&postcount=227
Im currently running gingerbread 2.3 with root priviliges, and Clockworkmod 3.0.5
[/URL] [/IMG]
Whenever i've try to use the remount command it get this error:
http://imageshack.us/photo/my-images/600/androidadb.jpg/
So what am im doing wrong? running WIn 7 64 bit and my tablet is set to usb debugging mode.
Been searching Google and XDA the couple of days but haven't found any solution.
In advance thanks, jakk212
Click to expand...
Click to collapse
Hi Jakk,
I'm not a developer, but, the error seems indicate that adb can't remount as RW the /system, so:
1) adb shell work? (you must see a "#" if you are root)
2) have you installed busybox?
3) the 01newcache script in init.d directory work if you have a rom/kernel that suppor init.d
I use the script and i can confirm that work very fine
Bye
Idk

1) How am i able to see that? Should i see a # at the ADB CMD box? Root checker veryfies that my device is rooted.
2) Yes it's installed using V1.16.2androidminimal - updating now.
3) How can i check if my ROM supports that? My rom is the Stock safe Rom provided when flashing to Overcome.

Using the "adb shell" command in ADB gives me a $

using the adb shell command gives me the $ as i said.
When using the command su it gives me the # you're where talking about.

Jakk212 said:
using the adb shell command gives me the $ as i said.
When using the command su it gives me the # you're where talking about.
Click to expand...
Click to collapse
Though im still not capable of remounting my galaxy tab

Jakk212 said:
using the adb shell command gives me the $ as i said.
When using the command su it gives me the # you're where talking about.
Click to expand...
Click to collapse
Hi Jakk,
Yes, so you have a working superuser thats ok, but if you have stock kernel (i think) there isn't any init.d support so the only way is to try manually.
Another way is installing a custom rom (boca, overcome, etc..) or custom kernel that have init.d support.
Bye
Idk
---------- Post added at 02:01 PM ---------- Previous post was at 01:55 PM ----------
Jakk212 said:
Though im still not capable of remounting my galaxy tab
Click to expand...
Click to collapse
There is some errore message when you try to remount via adb? Try to remount filsystem directly in a root shell, here :
http://forum.xda-developers.com/showthread.php?t=859712
there is, at the end of first post, the instruction to mount r/o the /system
Bye
Idk

Hmm actually not sure that there is a custom kernel installed (i don't suppose since it's a stock firmware, then the kernel should be stock - dosen't allow me to overglock however xD )
I've get this message:
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
30336CA087D400EC device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb remount
remount failed: Operation not permitted
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
# adb remount
adb remount
adb: not found
# remount
remount
remount: not found
#
Gonna try with to remount it directly in a root shell as you've said - see if that works.
I'll suppose that this is what im gonna write in adb?
Code:
> adb shell
# mount -o remount,rw -t rfs /dev/block/stl9 /system
# exit

Tried to flash the overcome kernel v3.3.1
Also i've connected the tab while in recovery mode now i get a ~$ when entering adb shell.

Jakk212 said:
Hmm actually not sure that there is a custom kernel installed (i don't suppose since it's a stock firmware, then the kernel should be stock - dosen't allow me to overglock however xD )
I've get this message:
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
30336CA087D400EC device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb remount
remount failed: Operation not permitted
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
# adb remount
adb remount
adb: not found
# remount
remount
remount: not found
#
Gonna try with to remount it directly in a root shell as you've said - see if that works.
I'll suppose that this is what im gonna write in adb?
Code:
> adb shell
# mount -o remount,rw -t rfs /dev/block/stl9 /system
# exit
Click to expand...
Click to collapse
Hi Jakk,
1) adb is use only from PC (windows or linux), there isn't any adb command into android OS...
2) My mistake: read this links: http://android-tricks.blogspot.com/2009/01/mount-filesystem-read-write.html and http://forum.xda-developers.com/showthread.php?t=685146; the above command is about rfs (Samsung Robust File System); if you have converted the filesystem into ext4, i'm not sure that above command work....
sorry
Bye
Idk

Im am able to mount using the
Code:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
Command you told me about but when i try to push the newcache file
Code:
adb push 01newcache /system/etc/init.d/
it simply says:
adb: Not found
When trying to copy it outside the shell it says:
failed to copy "01newcache" to "system/etc/init.d/": Is a directory.

Jakk212 said:
Im am able to mount using the
Code:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
Command you told me about but when i try to push the newcache file
Code:
adb push 01newcache /system/etc/init.d/
it simply says:
adb: Not found
When trying to copy it outside the shell it says:
failed to copy "01newcache" to "system/etc/init.d/": Is a directory.
Click to expand...
Click to collapse
Hi,
if you try the adb into android phone shell, simply don't work because adb is a windows command (adb = android debug bridge).
The good is seems you have the init.d directory, so try this:
go to android phone shell and remount /system
in a windows cmd shell do this:
adb push 01newcache /system/etc/init.d/
return into android phone shell:
adb shell
cd /system/etc/init.d
chmod 777 01newcache
ls -l /system/etc/init.d (to show the contend of init.d)
exit
Bye

So you mean that i'll just simply open a cmd box without refering to adb and then use the adb push 01newcache /system/etc/init.d/ command? How's that gonna work?
If you've got the time could you please assist me over teamwiever or something similair?

Jakk212 said:
So you mean that i'll just simply open a cmd box without refering to adb and then use the adb push 01newcache /system/etc/init.d/ command? How's that gonna work?
If you've got the time could you please assist me over teamwiever or something similair?
Click to expand...
Click to collapse
Hi Jakk,
Rollback, read this:
http://www.addictivetips.com/mobile/what-is-adb-and-how-to-install-it-android/
The operation is in 2 steps, pc and android terminal: adb is pc side the rest in android terminal.
I'm sorry, i prefer forum support, i've no time at this moment.....
If i'm not clear enough please tell me, i don't know your skill level...
Bye
Idk

pretty skilled, gonna start my IT-technician education after christmas, and i've know a bit bat programming from working with windows server and also a bit html and php.
capable of flashing ROMS, unbricking etc but haven't used ADB before. I've configured adb the exact same way as the tut you've sent me.
However i still just get's error codes like adb not found, remount not found, Is a directory, or are you sure you are rooted?

Jakk212 said:
pretty skilled, gonna start my IT-technician education after christmas, and i've know a bit bat programming from working with windows server and also a bit html and php.
capable of flashing ROMS, unbricking etc but haven't used ADB before. I've configured adb the exact same way as the tut you've sent me.
However i still just get's error codes like adb not found, remount not found, Is a directory, or are you sure you are rooted?
Click to expand...
Click to collapse
Is working ?:
Code:
adb shell
If yes then:
Code:
su
mount -o remount rw /system
then - if you are not able to use "push" - copy the file in your SDcard then, while in adb shell:
Code:
cp /sdcard/yourfile /your-destination/
Seem easy

then which one am i going to choose? The overwrite?
and am i just supposed to write it like this:
cp /mnt/sdcard/01newcache /system/etc/init.d/
Because then i've get a cp can't create /system/etc/init.d/: Is a directory

Jakk212 said:
then which one am i going to choose? The overwrite?
and am i just supposed to write it like this:
cp /mnt/sdcard/01newcache /system/etc/init.d/
Because then i've get a cp can't create /system/etc/init.d/: Is a directory
Click to expand...
Click to collapse
Try this:
cp /mnt/sdcard/01newcache /system/etc/init.d/01newcache
Bye

If you have the init.d folder then just manul copy "01newcache" to your sd card and from your tab, with a root explorer (i use esfile explorer with root option enabled from option menu) copy it to system/etc/init.d.

...to solve the original problem...
I fixed this on my device from a windows command prompt by typing "adb root" , which restarts the daemon on the device with root permissions.

[Recovery] [v500] CWM 6.0.5.1

ClockworkMod recovery (6.0.5.1) for LG G Pad 8.3 v500. This custom recovery installation package is for v500 models only. Built from source on 2014-12-13 by Jenkins.
Installation: Flash zip file with any custom recovery and reboot into updated CWM recovery.
Link: v500-CWM-6.0.5.1-20141213-recovery-signed.zip
MD5: 83150942a4f27006691472fa12159631
Note: An advantage to using the official CWM recovery with CM 11 is that the CWM recovery can be automatically updated with the CM Update tool, if enabled in the CM 11 developer options.
Manual Installation (first time installing custom recovery):
1) Gain root permission (ie; with Stumproot) and install SuperSU and Busybox.
2) Install Terminal Emulator or use ADB for opening up a shell (this example is using ADB).
Note: If using Terminal Emulator, make sure root access is given via SuperSU.
3) Download CWM installation zip file from the link above and manually extract it. Also, download the loki_tool binary from https://github.com/djrbliss/loki/archive/master.zip. The loki_tool binary is found in the "bin" folder of loki-master.zip after the file is extracted.
4) Copy recovery.img (contained in the CWM installation zip file from step #3) and the loki_tool binary (contained in the loki-master.zip file from step #3) to /data/local/tmp on your LG G Pad 8.3 v500 tablet with either ADB or a root explorer application and make loki_tool executable.
Code:
adb push recovery.img /data/local/tmp
adb push loki_tool /data/local/tmp
adb shell
su
chmod 755 /data/local/tmp/loki_tool
Note: Since the command "su" was entered, the shell has root permissions to proceed.
5) Patch the recovery.img into recovery.lok using loki_tool:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/data/local/tmp/aboot.img
/data/local/tmp/loki_tool patch recovery /data/local/tmp/aboot.img /data/local/tmp/recovery.img /data/local/tmp/recovery.lok
Note #1: At this point in the installation procedure, there have been no permanent changes to the system. If there is an error or warning while patching recovery.img and creating recovery.lok, then stop this manual installation procedure. In most cases, the problem is that the version of aboot.img found on the device is probably not exploitable with loki_tool. This manual custom recovery installation procedure must be started over again from the beginning after flashing a loki exploitable aboot.img to the device (downgrading firmware should help).
Note #2: If recovery.lok is created successfully without any errors or warnings, then continue with the final step. The shell should still be open with root (su) permissions enabled from the previous steps.
6) Flash recovery.lok file with loki_tool and reboot to new custom recovery.
Code:
/data/local/tmp/loki_tool flash recovery /data/local/tmp/recovery.lok
exit
exit
adb reboot recovery

Updated CWM to 20141120 sources.
sr: Fix vsync logic
* Use CLOCK_MONOTONIC to insulate from system clock changes.
* Normalize all timespec calculations to avoid overflow/underflow.
* Don't signal vsync if poll() fails.
Change-Id: If284ebf581309953c51b2f8d33d7d5800c636be5
sr: Fix screen flashing during wipe operations
* Clear buffer in draw_progress_locked() and always call this in
update_progress_locked(). This is necessary to ensure that all
backing frames in the graphics implementation get updated because
we aren't guaranteed to have any particular number of backing
frames.
* Remove dialogs on wipe operations since we are using the progress
animation now.
* Set progress indicator after showing "Formatting" text to avoid
momentary flicker.
Change-Id: I240d3b8e5c741c9f3ea4e5e17c1b9593e053888a
sr: Only use 4 items on wipe confirmation screens
* Large fonts in Touch UI prevent more than about 7 menu lines.
Change-Id: If523a85d67460c0ac4e012727d946eadb9c68436

Added guide to OP for first time custom recovery installation.
Edit: Updated guide to use loki_tool from github.

Hi,
I have tried this method and get an "unable to find" error as regard loki, seen in this picture i took.
I have placed both recovery.img and loki_tool as from your download links in data/local/tmp folder on lg
Where am i going wrong?
Thank you
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

When you type "adb shell" to open a connection, wait for the shell to open before typing "su". You will then notice that the terminal says "root" as the user. Make sure you have "dd" installed (this comes with installing Busybox). You can tell if dd is installed by typing "which dd" in the shell. If it returns with a path to dd, then it's there. I also noticed that you tried to chmod loki_tool before you have typed su to gain root. You only need to type su one time to get root permissions in the shell. You can tell it is using root because it shows you as the root user at the command prompt.

I am sorry for my dumbness, but i am new to this and not a clue what you are talking about lol.
I never typed su as i followed this procedure on youtube and copy and pasted your text.
I am trying to understand this adb method, but a noob tut is not available, thus trying anyway to get it to work obviously without success lol
https://www.youtube.com/watch?v=MVXX-YdhRU0
Best wishes

ADB needs root access in developer options. Attached screenshot.

Wingchundub said:
I am sorry for my dumbness, but i am new to this and not a clue what you are talking about lol.
I never typed su as i followed this procedure on youtube and copy and pasted your text.
I am trying to understand this adb method, but a noob tut is not available, thus trying anyway to get it to work obviously without success lol
https://www.youtube.com/watch?v=MVXX-YdhRU0
Best wishes
Click to expand...
Click to collapse
You are getting an unable to find error because you typed the name incorrectly (it is loki_tool not loki_tooldd). Be very careful that everything is exactly the same as the guide.
Edit: Also, when you type a command in ADB shell, wait for the command to finish before you type the next command. You can enter the next command in ADB when the prompt comes back.
Edit 2: After typing "adb shell", you only need to type "su" one time as long as you don't close the window.

Does it support f2fs?

I think f2fs support is not default for stock CM kernel. There aren't any customizations on this. This is from Jenkins.

Currently I'm using LP AOSP. Afaik, only LP available. On my Razr HD f2fs and CM12 works just great. Definitely noticeable faster with f2fs.

I have just noticed the loki-tooldd, i am positive i did not type that i,.e the dd on the end.
But i will again tomorrow, test this and come back with any results.
I am also never once typing SU, i assume the program is doing it automatically.
I will test and post pics also.
Thank you

Wingchundub said:
I have just noticed the loki-tooldd, i am positive i did not type that i,.e the dd on the end.
But i will again tomorrow, test this and come back with any results.
I am also never once typing SU, i assume the program is doing it automatically.
I will test and post pics also.
Thank you
Click to expand...
Click to collapse
I dont think ADB is working correctly for you because you are not getting the correct responses when you enter commands. It seems like your system is "hanging" when you enter commands in the adb shell.
Maybe you should try these commands in a Terminal Emulator shell instead of using an ADB shell. You will just need to install an extra root reboot application from Play Store so that you can easily reboot into the new recovery when you are finished.

Deltadroid said:
I dont think ADB is working correctly for you because you are not getting the correct responses when you enter commands. It seems like your system is "hanging" when you enter commands in the adb shell.
Maybe you should try these commands in a Terminal Emulator shell instead of using an ADB shell. You will just need to install an extra root reboot application from Play Store so that you can easily reboot into the new recovery when you are finished.
Click to expand...
Click to collapse
Thank you for you advice.
With terminal, I tried and copied the text provided, again gave same me errors and also the su and dd were there without me typing them.
It is coming to the point where i am giving up now as taking too much of my time.
Both are rooted and at least i can remove bloatware with root explorer etc and put my own stuff in, but would be nice to get this done and use custom roms, but simply not happening. @Tsjoklat, i do not see that option in developer options fella, checked 4 times to be sure.
Thank you loads fella, your a star and very helpful

Will You Do CWM Touch?

This version of CWM uses "swipe" gestures, but it isn't full touch. These versions of CWM are the official nightly builds. I was able to download the artifacts before they were removed for the next build in queue. Although, I plan on setting up a private build system pretty soon.

where am I wrong ???
HTML:
C:\Fastboot>adb devices
List of devices attached
07e7df499159c818 device
C:\Fastboot>adb shell
[email protected]:/ $ su
su
[email protected]:/ # adb push recovery.img /data/local/tmp
adb push recovery.img /data/local/tmp
* daemon not running. starting it now on port 5038 *
* daemon started successfully *
error: device not found
1|[email protected]:/ #

leardinet said:
where am I wrong ???
HTML:
C:\Fastboot>adb devicesList of devices attached07e7df499159c818 deviceC:\Fastboot>adb [email protected]:/ $ [email protected]:/ # adb push recovery.img /data/local/tmpadb push recovery.img /data/local/tmp* daemon not running. starting it now on port 5038 ** daemon started successfully *error: device not found1|[email protected]:/ #
Click to expand...
Click to collapse
It's out of order. First use adb to push the files, then use adb to open the shell.

Deltadroid said:
It's out of order. First use adb to push the files, then use adb to open the shell.
Click to expand...
Click to collapse
HTML:
C:\Program Files (x86)\Minimal ADB and Fastboot>adb push recovery.img /data/loca
l/tmp
cannot stat 'recovery.img': No such file or directory
C:\Program Files (x86)\Minimal ADB and Fastboot>
C:\Program Files (x86)\Minimal ADB and Fastboot>adb push loki_tool /data/local/t
mp
cannot stat 'loki_tool': No such file or directory
C:\Program Files (x86)\Minimal ADB and Fastboot>
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
su
chmod 755 /data/local/tmp/loki_tool
su
[email protected]:/ $
[email protected]:/ $ su
the files recovery.img and loki_tool copied in the data/local/tmp/ with ES File explorer
busybox installed

Your log says that you first typed "adb shell" and then you tried to use "adb push" inside the shell. Commands that begin with "adb" do not work when you are inside the "Adb shell".
Type "exit" inside the shell to close it and then "adb push" commands will work.

[MOD] Increase your SYSTEM partition to 2.5GB , Boot to 30MB , Recovery to 30MB for Y

Do you want to increase partitions using tool.....? Then here is the link
Finally your and MY wait is over Hear @I Putu Tirta Agung S & @Annabathina are introducing that HOW TO INCREASE YUREKA / PLUS PARTITIONS ........
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I & @I Putu Tirta Agung S are not responsible for anything that may happen to your phone as a result of following this guide / installing custom roms and/or kernels. you do so at your own risk and take the responsibility upon yourself. ​​
NOTE : Please read hole thread before starting........
Preface
This guide has been tested to work on Lollipop and Marshmallow. By following this guide, you will resize your boot, system, cache, and recovery partition to the new partition size as can be seen below:
This guide is quite safe as it doesn't change the emmc GUID and its unique partitions GUID, which is hard coded into our Yureka's non-HLOS (High Level Operating System).
The Guides
Backing up important partitions ( Very very important )
Go to TWRP (please use the newest, or at minimal Abhishek's 3.0.1-0), and when you are in it run "adb shell" from your computer using " ADB+&+Fastboot of yureka " by " Hold shift key and right click on mouse and select Open command window here " then type below lines ONE BY ONE (remember to do it line by line)
Code:
[SIZE="4"]dd if=/dev/block/mmcblk0 of=/sdcard/gpt.bin bs=512 count=34
adb shell dd if=/dev/block/mmcblk0p1 of=/sdcard/modem
adb shell dd if=/dev/block/mmcblk0p2 of=/sdcard/sbl1
adb shell dd if=/dev/block/mmcblk0p3 of=/sdcard/sbl1bak
adb shell dd if=/dev/block/mmcblk0p4 of=/sdcard/aboot
adb shell dd if=/dev/block/mmcblk0p5 of=/sdcard/abootbak
adb shell dd if=/dev/block/mmcblk0p6 of=/sdcard/rpm
adb shell dd if=/dev/block/mmcblk0p7 of=/sdcard/rpmbak
adb shell dd if=/dev/block/mmcblk0p8 of=/sdcard/tz
adb shell dd if=/dev/block/mmcblk0p9 of=/sdcard/tzbak
adb shell dd if=/dev/block/mmcblk0p10 of=/sdcard/hyp
adb shell dd if=/dev/block/mmcblk0p11 of=/sdcard/hypbak
adb shell dd if=/dev/block/mmcblk0p12 of=/sdcard/pad
adb shell dd if=/dev/block/mmcblk0p13 of=/sdcard/modemst1
adb shell dd if=/dev/block/mmcblk0p14 of=/sdcard/modemst2
adb shell dd if=/dev/block/mmcblk0p15 of=/sdcard/misc
adb shell dd if=/dev/block/mmcblk0p16 of=/sdcard/fsc
adb shell dd if=/dev/block/mmcblk0p17 of=/sdcard/ssd
adb shell dd if=/dev/block/mmcblk0p18 of=/sdcard/DDR
adb shell dd if=/dev/block/mmcblk0p19 of=/sdcard/fsg
adb shell dd if=/dev/block/mmcblk0p20 of=/sdcard/sec
adb shell dd if=/dev/block/mmcblk0p22 of=/sdcard/params
adb shell dd if=/dev/block/mmcblk0p23 of=/sdcard/panic
adb shell dd if=/dev/block/mmcblk0p24 of=/sdcard/autobak
adb shell dd if=/dev/block/mmcblk0p26 of=/sdcard/persist[/SIZE]
Copy all files from internal storage (sdcard) to your computer, keep them safe as they are very important if something bad happens.
Doing the magic
Download and extract "gpt.zip" attached in this post, and copy the "gpt.bin" file to the root of your internal storage (internal sdcard).
1. Go back to TWRP and run "adb shell" again from your computer, then type:
2. Go back to TWRP and run "adb shell" again from your computer, then type:
dd if=/sdcard/gpt.bin of=/dev/block/mmcblk0 bs=512 count=34
Click to expand...
Click to collapse
3. After all done, reboot to your bootloader and flash your recovery (TWRP) by typing:
fastboot -i 0x1ebf erase recovery
fastboot -i 0x1ebf flash recovery TheNameofYourRecovery.img
Click to expand...
Click to collapse
4. After that, type below commands (remember to do it line by line):
fastboot -i 0x1ebf oem unlock
fastboot -i 0x1ebf erase boot
fastboot -i 0x1ebf format cache
fastboot -i 0x1ebf format userdata
fastboot -i 0x1ebf format system
fastboot -i 0x1ebf reboot-bootloader
fastboot -i 0x1ebf boot recovery
Click to expand...
Click to collapse
5. After booting to TWRP, wipe everything again (system, data, cache, dalvik, internal storage)
6. Reboot the phone to TWRP again.
7. Copy your original "params", "panic", "autobak", and "persist" files you backed up earlier to the root of your internal storage (internal sdcard) and run "adb shell" again from your computer, then type:
adb shell dd if=/sdcard/params of=/dev/block/mmcblk0p22
adb shell dd if=/sdcard/panic of=/dev/block/mmcblk0p23
adb shell dd if=/sdcard/autobak of=/dev/block/mmcblk0p24
adb shell dd if=/sdcard/persist of=/dev/block/mmcblk0p26
Click to expand...
Click to collapse
This step is very important, so don't miss it or you will hard bricked your god damn phone.
8. After all done, reboot to your bootloader and type again below codes (remember to do it line by line):
fastboot -i 0x1ebf oem unlock
fastboot -i 0x1ebf erase boot
fastboot -i 0x1ebf format cache
fastboot -i 0x1ebf format userdata
fastboot -i 0x1ebf format system
fastboot -i 0x1ebf reboot-bootloader
fastboot -i 0x1ebf boot recovery
Click to expand...
Click to collapse
After booting to TWRP, wipe everything again (system, data, cache, dalvik, internal storage)
9. Reboot the phone to TWRP again.
Troubleshooting
Wallah, now you have 2.5 GB of system partition, 150 MB (it will be usefull if you use f2fs file system) cache partition, 30 MB of recovery partition, 30 MB of boot partition, and around 11.77 GB of data partition.
Oh btw, if you flash "userdata.img" from COS or CM roms, you will get something similar to this:
target reported max download size of 268435456 bytes
erasing 'userdata'...
OKAY [ 8.440s]
sending 'userdata' (137434 KB)...
OKAY [ 5.164s]
writing 'userdata'...
FAILED (remote: image size too large)
finished. total time: 13.634s
Click to expand...
Click to collapse
Why? Because now your data partition is approximately 1.5 GB smaller. So just relax, if you got that kind of warning.
Furthermore, because a lot of devs use that ****in ".dat" files ****ty thing ("system.new.dat", "system.patch.dat" and "system.transfer.list"), if you flash their roms (such as CM, AICP, Exodus, bla bla bla), you will see that your partition will go back to its original value. But not to worry, it is not the real value of what is really use. It is because of the nature on how sparse ext4 image is compiled, they need to set the partition size before compiling, and of course they use the old one, not the one we have changed.
So to overcome this problem, you need to do it the hard way, explained in the second post below. However, if you don't want the hazzle then just flash AOSParadox or YuOS (the TWRP version, not the fastboot one) or Mokee or any rom that doen't have "system.new.dat", "system.patch.dat" and "system.transfer.list" in its zip file, as they will read the new partition size just fine.
ADB+&+Fastboot : link
Partition changer : link
Back up code PNG : link
Device Driver installation links
ADB for pc : link
YU usb drivers : link
PdaNet drivers : link
@I Putu Tirta Agung S MY friend for every thing ( NOTE : YOUR the best HACKER that I ever met )
@Annabathina

If you want the hard way in changing ROMs with ****in ".dat" files ****ty thing ("system.new.dat", "system.patch.dat" and "system.transfer.list") to read the new partition size, then you need Ubuntu with the latest kernel (that has the latest patch on "Transparent Compression", see this post), and follow these steps (thanks to xpirt for his guide):
Step 1 - Decompressing = DAT (sparse data) -> EXT4 (raw image)
We're now using sdat2img binary, the usage is very simple (make sure you have python 3.x installed):
Code:
./sdat2img.py <transfer_list> <system_new_file> <system_ext4>- <transfer_list> = input, system.transfer.list from rom zip
<system_new_file> = input, system.new.dat from rom zip
<system_ext4> = output ext4 raw image file
and a quick example of usage:
Code:
./sdat2img.py system.transfer.list system.new.dat system.img
by running this command you will get as output the file my_new_system.img which is the raw ext4 image.
Step 2 - Decompress EXT4 (raw image) -> OUTPUT folder -> Compress EXT4 (raw image)
Now we need to mount or ext4 raw image into an output folder so we can see apks/jars etc. To do this we need to type this command:
Code:
sudo mount -t ext4 -o loop system.img output/
As you can see there is a new folder called output which we can edit/modify/delete your files (not able to? see here)
Now we need to compress it back to a raw ext4 image, to do this we need the make_ext4fs binary. Make sure you have the file_contexts file (taken from the Rom zip) inside the make_ext4fs path. Then type this (got issues? see here).
Code:
/make_ext4fs -T 0 -S file_contexts -l 2684354560 -a system system_new.img output/
The value of 2684354560 in above code is the new size of system partition in Bytes. Upon doing the above processes, you will get the new raw ext4 image called 'system_new.img' ready for the next step.
Step 3 - Converting = EXT4 (raw image) -> DAT (sparse data)
Now we need the rimg2sdat binary, the usage is very simple:
Code:
./rimg2sdat <system_img>
<system_img> = name of input ext4 raw image file
and a quick example of usage:
Code:
./rimg2sdat my_new_system.img
As you can see the output is composed by system.transfer.list, (system.patch.dat) & system.new.dat, ready to be replaced inside your Rom zip.
Just to make it really simple
1. Fire up your beloved ubuntu, make sure you have python 3.x installed.
2. Download "sdat2img.py", "make_ext4fs", and "rimg2sdat" binaries, and put it inside a folder (use a file manager for god sake). We can name the folder "****inGreat".
3. Now make an empty folder inside "****inGreat" folder, and name it "output".
4. Extract "system.new.dat", "system.patch.dat", "system.transfer.list", and "file_contexts" from your beloved rom's zip file, and put it inside "****inGreat" folder.
5. Now open "****inGreat" folder with root privilege, then open terminal (we call it cmd in windows) from there.
6. type below code on the terminal (one line at a time):
Code:
./sdat2img.py system.transfer.list system.new.dat system.img (press enter)
sudo mount -t ext4 -o loop system.img output/ (press enter)
/make_ext4fs -T 0 -S file_contexts -l 2684354560 -a system system_new.img output/ (press enter)
./rimg2sdat my_new_system.img (press enter)
7. Now copy the new "system.new.dat", "system.patch.dat", "system.transfer.list", and "file_contexts" inside "****inGreat" folder back to your beloved rom's zip file.
8. Flash the rom via TWRP
9. And you are good to go.
10. Ain't that simple!!!!!!!!!!!!!
sdat2img.py
- github.com
make_ext4fs
- mega.co.nz
rimg2sdat
- mega.co.nz

reserved for SS

@I Putu Tirta Agung S MY friend for every thing ( NOTE : YOUR the best HACKER that I ever met )
 @Annabathina

reserved

where is
gpt.zip
i cannot found

@ Annabathina I want to use yureka full default partitions on yureka plus version p3 which is pure locked bootloader andoroid 5.1 version. i need your help.

For all adb shell commands I am getting not found
should i proceed further?
Device Yu Yureka (Lineage os 14.1) @Annabathina

luck_y said:
For all adb shell commands I am getting not found
should i proceed further?
Device Yu Yureka (Lineage os 14.1) @Annabathina
Click to expand...
Click to collapse
This is due to your ADB drivers check weather your PC has successfully installed ADB or not

Successfully increased system partition. But as prescribed this mod is supported to LP and MM ROMs only. Is there any way to support this to OREO. And also prescribe a method for restoring stock partitions.

how to go to default partition
please help i am installing nitrogen os and you hard way is not easily understandable

please provide gpt for default partition
please sir atleast provide default gpt so that i can manage myself

yashgogia007 said:
please help i am installing nitrogen os and you hard way is not easily understandable
Click to expand...
Click to collapse
Follow this
http://forums.yuplaygod.com/index.php?threads/50913/
Sent from my AO5510 using Tapatalk

original gpt.bin
Can anyone post the original gpt.bin, which you back up in 1st step...?

Wolverine00796 said:
Can anyone post the original gpt.bin, which you back up in 1st step...?
Click to expand...
Click to collapse
Here you go.

hi kindly request you that after increase partation my phone stuck at boot logo showing some chinese language boot i tried every thing just manage to get stock rom but still my phone stuck in cyanogen mood please help me my phone no is this +91-9829009627 i have no other phone.

E:Unable to mount '/persist' please help me to get back my yureka AO5510 working