Database Develop

[Q] Restoring stock Recovery Image on Sprint

Hey all,
I had the sense to use the Rotobackup method on my new Sprint Tab after rooting it with the Z4root package. I then proceeded with the ( now outdated ) CWM Flash process adapted from the Epic 4g. Now, I can get into CWM and the process appears to be functional, but I can't get the "Wipe Data/Factory Reset" to work. It all goes well, but when I boot back into android, all the junk is still there.
Now, I know this wouldn't normally be a big deal... However.. In set'n up for my Rotobackup, I punched in a spare Gmail account in case someone wanted a copy of the backup for dissection,etc... Now, since I can't get the factory wipe to work ( neither from the Privacy menu, nor CWM ), I can't get that acct off my Tab so I can get to all my purchased apps on my main account.
Since I have the Rotobackup, I'm thinking that I can just restore one of those packages and get the stock recovery image back in place. I just want to verify which one I should restore before I move forward.
My expectation is that I need to restore the 'boot.bin' file. Can someone confirm this?
For the record, these are the files I have saved:
Code:
-rw-r--r--. 1 root root 262144 Dec 22 19:00 boot.bin
-rw-r--r--. 1 root root 32768000 Dec 22 19:00 cache.rfs
-rw-r--r--. 1 root root 25620093 Dec 22 19:23 data.tgz
-rw-r--r--. 1 root root 86507520 Dec 22 19:00 dbdata.rfs
-rw-r--r--. 1 root root 6553600 Dec 22 19:00 efs.rfs
-rw-r--r--. 1 root root 336068608 Dec 22 19:00 factoryfs.rfs
-rw-r--r--. 1 root root 16777216 Dec 22 19:00 modem.bin
-rw-r--r--. 1 root root 1310720 Dec 22 18:58 param.lfs
-rw-r--r--. 1 root root 262144 Dec 22 19:00 pit.pit
-rw-r--r--. 1 root root 1310720 Dec 22 19:00 Sbl.bin
-rw-r--r--. 1 root root 7864320 Dec 22 18:59 zImage
Thanks in advance,
LK

Or, can I simply do an rm -rf /data/* to get the effect of a factory wipe?
Thanks,
LK

Ok, I figured it out..
So, the thought of flashing the recovery image came from my root experiences on Evo. I decided while waiting for a response to do more digging through the CWM installation routine and noticed that it made a backup of the original recovery file ( since on Epic and Tab, it's a redirector method instead of an image on the Evo ). AND.. it had a 'Remove root/CWM' option!
I modified the run.sh script to NOT remove root on that option and only put the original CWM in place, ran it.. and VIOLA!
Hope this may help someone else.
LK

are you saying you have a working CWM running on your Sprint-flavored tab?

Hello Zoinks,
Nope... the CWM wasn't working properly on my Samsung Tab. I reverted to the stock recovery on my Tab to regain the ability to wipe it.
Thanks,
LK

and you were so close to being my new best friend
which modem are you using? we have not been able to properly export the factory modem

I'm afraid neither of us are that lucky.
I'm still using the original modem. Nothing has actually been flashed to the device aside from what it took to root it.
Nothing to see here...
LK

ok, so I also just rooted my new sprint tab. using the z4root method. I also have learned about rooting through my evo. I have not however got as far as you have as in getting a recovery image. If i understand what I have tried to absorb on this from the board, is that A) I should have gone with tmobile for the tab!!!! lol and B) this aint no EVO!!!!!
So could you point me in the right direction/advice with what I should do now, because I am lost!!!!
thanks in advance

I'd install bash with the 'Bash Installer' app from the market, and then any other goodies you like for rooted devices ( Adfree Android is a personal fav ).
Aside from that, hang tight and watch for more advancements in alternative ROMS and Recovery managers. Don't install any recovery manager at this time as they are too buggy for normal use and don't really have much in the way of usable features yet.
Clockwork Mod is the closest, but still doesn't support nandroid backup and the like.
Oh, also.. you should check into creating a 'Rotobackup' of your device per the instructions found in another thread of this sub-form.
Enjoy!
LK

linuxkidd said:
Ok, I figured it out..
So, the thought of flashing the recovery image came from my root experiences on Evo. I decided while waiting for a response to do more digging through the CWM installation routine and noticed that it made a backup of the original recovery file ( since on Epic and Tab, it's a redirector method instead of an image on the Evo ). AND.. it had a 'Remove root/CWM' option!
I modified the run.sh script to NOT remove root on that option and only put the original CWM in place, ran it.. and VIOLA!
Hope this may help someone else.
LK
Click to expand...
Click to collapse
I'm having the same problem, can you tell me how to do that? Where's the run.sh file?
Thanks.

Hello zephyrd,
The problem I had was because I used the CWM process outlined in this thread. The 'run.sh' script is the one included with the downloads in that thread.
I edited the run.sh file as follows:
* FInd the section that starts with 'function remove {'
* Inside that section, find the following two sub-sections:
- echo Running root file cleaner on device
- echo Removing remount binary
* Comment out the lines under those sections with # so that the final 'function remove {' section looks like this:
Code:
function remove {
clear
echo +++++++++++++++++++++++++++++++++++++++++++++++++++++
echo "Simple Root and ClockworkMod Uninstaller 2.01";
echo +++++++++++++++++++++++++++++++++++++++++++++++++++++
echo Bash Scripts by DRockstar and Firon
echo exploit by joeykrim, original uninstaller by noobnl
echo
echo REMOVES ALL ROOTS AND CLOCKWORKMOD REDIRECTOR
echo MODIFIED FOR USE WITH GALAXY TAB
chooser
startserver
checkroot
echo Mount device RW
$adb shell mount -t rfs -o remount,rw /dev/block/stl9 /system
#echo Running root file cleaner on device
#$adb push rclean /system/xbin/rclean
#$adb shell chmod 755 /system/xbin/rclean
#$adb shell /system/xbin/rclean
#$adb shell rm /system/xbin/rclean
#echo Removing remount binary
#$adb shell rm /system/bin/remount > /dev/null 2>&1
#$adb shell rm /system/xbin/remount > /dev/null 2>&1
echo Removing ClockworkMod redirector
$adb shell rm /system/bin/recoveryfiles/*
$adb shell rmdir /system/bin/recoveryfiles
$adb shell rm /system/bin/recoveryres/images/*
$adb shell rmdir /system/bin/recoveryres/images
$adb shell rm /system/bin/recoveryres/*
$adb shell rmdir /system/bin/recoveryres
$adb shell rm /system/bin/recovery
echo Restoring original recovery file
$adb push recovery /system/bin/recovery
$adb shell chmod 755 /system/bin/recovery
echo Rebooting phone
$adb reboot
checkboot
echo
echo SIMPLE ROOT UNINSTALLER COMPLETED.
end
}
When you run the 'run.sh' command, pick the 'Simple Root and ClockworkMod Uninstaller' option. This will restore your recovery manager back to the stock one, while leaving your Tab rooted.
NOTE: This same logic can be applied to the 'run.bat' file. The sections that need to be commented out are the same. Instead of using a # to comment the lines, place the word 'REM ' in front of them.
The run.bat 'remove' function will look as follows when done:
Code:
:remove
cls
echo +++++++++++++++++++++++++++++++++++++++++++++++++++++
echo Simple Root and ClockworkMod Uninstaller 2.01
echo +++++++++++++++++++++++++++++++++++++++++++++++++++++
echo Batch Scripts by DRockstar and Firon
echo exploit by joeykrim, original uninstaller by noobnl
echo.
echo REMOVES ALL ROOTS AND CLOCKWORKMOD REDIRECTOR
echo MODIFIED FOR USE WITH GALAXY TAB
call :chooser
if "%a%"=="m" goto :menu
call :startserver
call :checkroot
echo Mount device RW
adb shell mount -t rfs -o remount,rw /dev/block/stl9 /system
rem echo Running root file cleaner on device
rem adb push rclean /system/xbin/rclean
rem adb shell chmod 755 /system/xbin/rclean
rem adb shell /system/xbin/rclean
rem adb shell rm /system/xbin/rclean
rem rem echo Removing remount binary
rem adb shell rm /system/bin/remount > nul
rem adb shell rm /system/xbin/remount > nul
echo Removing ClockworkMod redirector
adb shell rm /system/bin/recoveryfiles/*
adb shell rmdir /system/bin/recoveryfiles
adb shell rm /system/bin/recoveryres/images/*
adb shell rmdir /system/bin/recoveryres/images
adb shell rm /system/bin/recoveryres/*
adb shell rmdir /system/bin/recoveryres
adb shell rm /system/bin/recovery
echo Restoring original recovery file
adb push recovery /system/bin/recovery
adb shell chmod 755 /system/bin/recovery
echo Rebooting phone
adb reboot
call :checkboot
echo.
echo SIMPLE ROOT UNINSTALLER COMPLETED.
goto :end
If you have any questions, please let me know. It's better to ask now than screw up your tab.
Hope this helps!
LK

linuxkidd said:
Hello zephyrd,
The problem I had was because I used the CWM process outlined in this thread. The 'run.sh' script is the one included with the downloads in that thread.
I edited the run.sh file as follows:
* FInd the section that starts with 'function remove {'
* Inside that section, find the following two sub-sections:
- echo Running root file cleaner on device
- echo Removing remount binary
* Comment out the lines under those sections with # so that the final 'function remove {' section looks like this:
When you run the 'run.sh' command, pick the 'Simple Root and ClockworkMod Uninstaller' option. This will restore your recovery manager back to the stock one, while leaving your Tab rooted.
NOTE: This same logic can be applied to the 'run.bat' file. The sections that need to be commented out are the same. Instead of using a # to comment the lines, place the word 'REM ' in front of them.
The run.bat 'remove' function will look as follows when done:
If you have any questions, please let me know. It's better to ask now than screw up your tab.
Hope this helps!
LK
Click to expand...
Click to collapse
Thanks so much for the help! However, this doesn't solve my problem, which is outlined in this thread.
I think my factory setting is modified somehow and can not be removed.
I don't expect any solutions any time soon but if you think you can help I can provide more info on the problem.
Thanks again!

Copy of stock recovery
Think you could post of a copy of the stock recovery file?

wolfson292 said:
Think you could post of a copy of the stock recovery file?
Click to expand...
Click to collapse
yea i could really use that right now too

Recovery process
Can you give me a guide to follow to
A. Return to stock: titanium back up on sd card. Unfortunately no way to get titanium bac on tab as market has disapeared. Unless I can down load .apk and then install from card.
B. Replace voodoo kernal with different one that restores screen rotation, market etc.
Will make generous donation to coffee/beer funds.
Any help for a noob in trouble?
[email protected] for mail, gtalk and pm's

can any one tell me how to make a copy of the original recovery image or send me a link to where i could find that information i searched the net but couldnt find an answer
plz help or email me at [email protected]

[STOCK]INIT.D support. No need to flash anything or even reboot into recovery

So yea I've been working on a proper "app2sd" solution that doesn't involve just switching the MicroSD for the eMMC, but I like the stock rom so far, so I didn't feel like flashing a rom just to get init.d, and I didn't feel like modifying the ramdisk in the kernel either. So I cooked up this script that anyone can run from terminal to get init.d support. It should work for other devices too, as long as they run /system/etc/install-recovery.sh on boot.
There's only three requirements for it to work:
#1 You must be rooted
#2 Your device must run /system/etc/install-recovery.sh
#3 You must have busybox
I tested a few times on my own device (GT-N8013), but haven't had anyone else test it, so don't freak out if it doesn't work. Just let me know what went wrong and I'll figure something out.
Running it is very simple:
#1 Open any terminal app
#2 su
#3 navigate to the folder where you have the script
#4 sh ./enableinit.sh
Your device will be rebooted once the process is done, don't freak out. If everything went fine, you'll have a file in /sdcard called init.d.log created by the test init.d script that is made by the enabler.
You can either download the attachment (rename it to enableinit.sh if you get the attachment), or create the file with the contents betlow:
Code:
#!/system/bin/sh
# Adds init.d support to any device that automatically runs /system/etc/install-recovery.sh
# on startup.
#
# Made by TweakerL, make sure to visit us at and-host.com or chat with us on freenode #and-host
echo '##################################################'
echo '## ##'
echo '## Script by TweakerL ##'
echo '## Visit us at and-host.com ##'
echo '## Chat with us at freenode #and-host ##'
echo '## ##'
echo '##################################################'
echo ''
echo 'This script will enable init.d if your device'
echo 'executes /system/etc/install-recovery.sh'
echo ''
echo 'Your tablet will be rebooted once the process'
echo 'is done.'
echo ''
echo 'If the script successfully enabled init.d you will'
echo 'have a file in /sdcard called init.d.log after'
echo 'the device is done rebooting. Remember to always'
echo 'set the proper permissions in your scripts or they'
echo 'will not work.'
echo ''
read -p "Press ENTER to continue..."
if [ ! -f /system/xbin/busybox -a ! -f /system/bin/busybox ]
then
echo 'You do not have busybox. Exiting now...'
else
# Mount system as rw in order to execute the script
busybox mount -o remount,rw -t ext4 /dev/block/mmcblk0p9 /system
# Check if install-recovery.sh already exists, and if so
# add the necessary lines, otherwise create it
if [ -f /system/etc/install-recovery.sh ]
then
if cat /system/etc/install-recovery.sh | busybox egrep -i "sysinit"
then
echo sysinit already present in install-recovery.sh, skipping this step.
else
busybox cp -f /system/etc/install-recovery.sh /sdcard/qsxdrgbhuk.sh
echo '' >> /sdcard/qsxdrgbhuk.sh
echo '/system/bin/sysinit' >> /sdcard/qsxdrgbhuk.sh
busybox cp -f /sdcard/qsxdrgbhuk.sh /system/etc/install-recovery.sh
fi
else
echo '#!/system/bin/sh' >> /sdcard/qsxdrgbhuk.sh
echo '' >> /sdcard/qsxdrgbhuk.sh
echo '/system/bin/sysinit' >> /sdcard/qsxdrgbhuk.sh
busybox cp -f /sdcard/qsxdrgbhuk.sh /system/etc/install-recovery.sh
busybox chmod 755 /system/etc/install-recovery.sh
fi
# Check if sysinit already exists and if so skip step
# otherwise create it
if [ ! -f /system/bin/sysinit ]
then
echo '#!/system/bin/sh' >> /sdcard/kuhbgrdxsq
echo 'export PATH=/sbin:/system/sbin:/system/bin:/system/xbin' >> /sdcard/kuhbgrdxsq
echo '' >> /sdcard/kuhbgrdxsq
echo '/system/bin/logwrapper busybox run-parts /system/etc/init.d' >> /sdcard/kuhbgrdxsq
busybox cp -f /sdcard/kuhbgrdxsq /system/bin/sysinit
busybox chmod 755 /system/bin/sysinit
else
echo sysinit already exists in /system/bin. init.d should already be enabled.
fi
# Cleanup
busybox rm -f /sdcard/qsxdrgbhuk.sh
busybox rm -f /sdcard/kuhbgrdxsq
#Check that init.d folder exists and if not create it
# as well as set the right permissions
if [ -d '/system/etc/init.d' ]
then
chmod 755 /system/etc/init.d
else
mkdir /system/etc/init.d
chmod 755 /system/etc/init.d
fi
# Create a test init.d script that echoes a file to
# /sdcard on successful execution
echo '#!/system/bin/sh' > /sdcard/99testinit
echo '' >> /sdcard/99testinit
echo 'echo init.d works > /sdcard/init.d.log' >> /sdcard/99testinit
busybox cp -f /sdcard/99testinit /system/etc/init.d
chmod 755 /system/etc/init.d/99testinit
busybox rm -f /sdcard/99testinit
# Sync and remount system
sync
busybox mount -o remount,ro -t ext4 /dev/block/mmcblk0p9 /system
# Reboot system to enable init.d
if [ -f /system/bin/reboot ]
then
echo Your device will reboot in 3 seconds
sleep 3
reboot
else
echo "Your device doesn't appear to have a reboot command,"
echo "please reboot your device now to avoid problems."
fi
fi

reserved

TweakerL said:
reserved
Click to expand...
Click to collapse
it is good!

TweakerL said:
reserved
Click to expand...
Click to collapse
Thanks for sharing.
Im tested my ainol elf offical rom novo0706, and worked. Thank
Sent from my Ainol Novo 7 Elf using Tapatalk 2

Pretty awesome. Will edit once i try this out.
Edit: Everything worked. Tested on GT-N8013
Thanks alot.
Sent from my GT-N8013 using Tapatalk 2

Hi, Can you tell more clearly how to make this work.
Sent from my GT-N8000 using xda app-developers app

Can any one make .zip file to flash thru recovery..thanks

The point was not to have to go into recovery...
Anyway, it's really simple...
Download the attached file
open terminal
then do the following commands
Code:
su
cd /sdcard
sh ./Download/enableinit.sh.txt
assuming that your browser saves files to /sdcard/Download

Sorry, I am a computer idiot . I really donot how to do after I had downloaded the text file. Appreciated if you can explain more detail.
Sent from my GT-N8000 using xda app-developers app

So now with init.d support ready, is it going to be possible to run proper a2sd scripts? And which one specifically would you recommend? Excuse me if i'm asking the wrong questions.

andylam16 said:
Sorry, I am a computer idiot . I really donot how to do after I had downloaded the text file. Appreciated if you can explain more detail.
Sent from my GT-N8000 using xda app-developers app
Click to expand...
Click to collapse
It has nothing to do with knowing anything about computers, as you don't need a computer to do this... just your device...
Download the file, on your device, if you're using stock browser it will go to /sdcard/Download
Make sure you have busybox, download a busybox installer from the market, install it, and run it, and tell it to install busybox
Download a terminal app from the play store for free, such as android terminal emulator, install it and open it
then type in these exact commands, just like they're in here, in the terminal:
Code:
su
sh /sdcard/Download/enableinit.sh
Assuming of course, that your stuff is getting download to /sdcard/Download.
If you can't do this... sell your android device and buy an iCrap one...
drnish83 said:
So now with init.d support ready, is it going to be possible to run proper a2sd scripts? And which one specifically would you recommend? Excuse me if i'm asking the wrong questions.
Click to expand...
Click to collapse
I'm working on my own app2sd script that should beat anything ever made. Here's what it does:
It uses a second partition in the MicroSD card for gaining extra storage, this partition has to be formatted to ext4
#1 It mounts the external ext4 partition to a new location
#2 It detects the location for /sdcard/Android; /data/data; /data/app no matter what device you have (suppose the directories aren't the same for a certain device)
#3 It has the option to mount /sdcard/Android to a folder in the external partition
#4 It has the option to mount /data/data to a folder in the external partition
#5 It has the option to mount /data/app to a folder in the external partition
#6 It has the option to automatically copy everything from any of those folders to the appropriate folder in the external partition
#7 It has the option to automatically wipe from the internal storage anything that it moves
#8 If you have all options enabled, apps will be automatically installed to the external partition and never take any space in the internal storage, while everything else (Download/recovery/backup/pictures/videos/etc...) all remain in the internal partition.

Wow... cant wait for this script
Sent from my GT-N8013 using Tapatalk 2

Thanks for explaining. Interesting indeed! Will definitely wait for it eagerly!

Here's a preview of the super app2sd script I'm working on. Much of it is already implemented, should have it all in a couple of days

confusing
I have tried your script and it has successful at first.. then i flashing my note again with stock rom and i try using ur script again but now there is nothing chance.. do you know why?? what must i do now??

You know, this is the damnedest thing, but your instructions call for Busybox installation, and I can't install Busybox on my N8013. And tips you can share?

NessLookAlike said:
You know, this is the damnedest thing, but your instructions call for Busybox installation, and I can't install Busybox on my N8013. And tips you can share?
Click to expand...
Click to collapse
Busy box installs on mine.
Sent from my GT-N8013 using Tapatalk 2

NessLookAlike said:
You know, this is the damnedest thing, but your instructions call for Busybox installation, and I can't install Busybox on my N8013. And tips you can share?
Click to expand...
Click to collapse
Only reason you wouldn't be able to install busybox is if you're not rooted.

Mr tweaker, i have done the process of init.d but there is nothing changed.. where is my false?
Sent from my GT-N8000 using XDA Premium HD app

Welly_11 said:
Mr tweaker, i have done the process of init.d but there is nothing changed.. where is my false?
Sent from my GT-N8000 using XDA Premium HD app
Click to expand...
Click to collapse
Look for these files and let me know if they're there:
/system/etc/install-recovery.sh
/system/bin/sysinit
/system/etc/init.d/99testinit
**************************************
If anybody needs help, look for me on irc - #and-host in freenode

[Q] Flashing a entire rom under linux/ubuntu ?

Hello everybody,
I am a linux user, and there dœs not seem to be any tutorial on the exact procedure to follow in order to flash a razr i. Dœs anybody know of that ?*Could anyone help ?*As for now, I first unlocked my phone in following Matt tools there :*http://174.132.194.66/~batakang/ftp/?dir=RAZRi/RootUtility in order to get my unlocking number and get the key from motorola, as described there :*http://forum.xda-developers.com/showthread.php?t=1928551 I also rooted the device thanks to the scripts included by Matt in his package.
Now, I would like to know exactly what orders in a command line I should use, once the phone connected via usb and on in fastboot mode or fully started, in order to flash not only a different boot but also an entire new rom. It seems to be easy for Windows user thanks to motorola tools, but I cannot find an equivalent for linux.
Could someone explain me that, step by step, if possible ?*I would also really like to know, even if it a second subject, what are the best roms available for this phone ?*Even ubuntu or firefox roms, I don't care

Ok, so basically, the .bat included in the windows fastboots files that you can find here and there describe the whole processes. I copy-past one, and i hope linux user will understand what to do most of the time just by reading the file :
Code:
@echo off
color 0e
echo.
echo. Because it's the utility Gotham deserves, but not the one it needs right now.
echo. So, we'll hunt it, because it can take it. Because it's not our hero.
echo. It's a silent guardian. A watchful protector. A Dark Knight.
echo BATMAN BATMAN BATMAN
echo N BATM N BATM N ATMAN ATMAN BAT AN BAT
echo ATMAN AN BATMAN ATMAN BAT TMAN
echo AN B MAN BATMAN ATMAN BATM BATM
echo TMA MAN BATMA TMAN BATM MAN
echo BAT AN BATM MAN BAT AN B
echo N BA *********************************************** BA
echo N B * Unlocked RAZR i Firmware Flasher * BAT
echo AN B * Created by mattlgroff * BAT
echo N B * Visit us at Batakang.com! * BA
echo N BA *********************************************** N BA
echo BAT AN BAT ATMAN TMAN MAN BATM MAN
echo ATMA AN BATMA BATMAN B BATMAN B TMAN BAT TMA
echo MAN B N BATMAN BATMAN BA N BATMAN BATMAN BA N BAT
echo BATMA BATMAN BATMAN BAT AN BATMAN BATMAN ATMAN
echo AN BATMAN BATMAN BAT AN BATMAN BATMAN BA
echo N BATMAN BATMAN BATMAN B
adb kill-server > nul
adb start-server > nul
ping 1.1.1.1 -n 1 -w 500 > nul
cls
echo. "Have drivers installed, phone connected, and USB Debugging enabled in Developer Options."
echo. "Also make sure to have a lot of battery power or a factory-style adapter before attempt."
pause
adb wait-for-device reboot bootloader
ping 1.1.1.1 -n 1 -w 1000 > nul
fastboot flash system system.img.ext4
ping 1.1.1.1 -n 1 -w 1000 > nul
fastboot flash boot razr_i_boot_insecured.img
fastboot reboot
echo. "Rebooting and working..."
adb wait-for-device remount
adb push su /system/bin/
adb push busybox /system/xbin/
adb push Superuser.apk /system/app/
adb shell "chmod 755 /system/xbin/busybox"
adb shell "chmod 6755 /system/bin/su"
adb reboot bootloader
echo. "Rebooting and working..."
ping 1.1.1.1 -n 1 -w 1000 > nul
fastboot flash boot boot.img
fastboot reboot
echo. "Done. If you bootloop go to Recovery and wipe data. "
pause

You can flash SBF with sbf_flash.
http://blog.opticaldelusion.org/2011/04/universal-binaries-running-same.html
For fastboot you can use the terminal with the Android SDK.

What replaces stagefright?

I found a script that adds boot audio. In it there is a line calling stagefright, stagefright either doesn't exist on my ROM and I have no clue as to add it. Here is the script in question which I don't know the original author however lithid from http://forum.cyanogenmod.org did some work on it and was close to creating a updater-script. Please Help Me as I know some scripting but not a lot
PS I was advised to ask this question to the devs by a cyanogenmod.org mod named bassmadrigal
Code:
#!/system/bin/sh
#I just made this into a script this was from a post on XDA by spiicytuna
#http://forum.xda-developers.com/showpost.php?p=8274824&postcount=2
#Please give the credit to him not me.
echo "preparing system..."
#Setting up the system for read/write access
mount -o remount,rw /system
#linking busybox mkdir (broken in rc2)
rm /system/bin/mkdir
ln -s /system/xbin/mkdir /system/bin/mkdir
mkdir -p /data/local/boot
echo "checking for previous bootsound installation..."
if [ -e /system/bin/bootsound ];
then
echo "bootsound already enabled, exiting.."
mount -o remount,ro /system
exit
fi
if [ "`ls /sbin|grep -q recovery;echo $?`" = "0" ];
then
mount -a > /dev/null
recoverymode=y
else
mount -o rw,remount /system
recoverymode=n
fi
echo "preparing startup scripts..."
#This is to create the needed scripts in init.local.rc
echo '' >> /system/etc/init.local.rc
echo '' >> /system/etc/init.local.rc
echo '###Bootsound - Safe to Delete: Start ###' >> /system/etc/init.local.rc
echo "" >> /system/etc/init.local.rc
echo 'service bootsound /system/bin/bootsound' >> /system/etc/init.local.rc
echo ' user media' >> /system/etc/init.local.rc
echo ' group audio' >> /system/etc/init.local.rc
echo ' disabled' >> /system/etc/init.local.rc
echo ' oneshot' >> /system/etc/init.local.rc
echo '' >> /system/etc/init.local.rc
echo 'on property:init.svc.bootanim=running # to correct timin' >> /system/etc/init.local.rc
echo ' start bootsound' >> /system/etc/init.local.rc
echo '' >> /system/etc/init.local.rc
echo 'on property:dev.bootcomplete=1' >> /system/etc/init.local.rc
echo ' stop bootsound' >> /system/etc/init.local.rc
echo '### Bootsound - Safe to Delete: End ###' >> /system/etc/init.local.rc
echo "creating script for bootsound in /system/bin..."
echo '#Now creating the bootsound script'
touch /system/bin/bootsound
echo '#!/system/bin/sh' >> /system/bin/bootsound
echo '' >> /system/bin/bootsound
echo 'bprop=/system/build.prop' >> /system/bin/bootsound
echo '' >> /system/bin/bootsound
echo 'play=$(cat $bprop | egrep -c -i -o ro.config.play.bootsound=1)' >> /system/bin/bootsound
echo 'if [ "$play" = "1" ]; then' >> /system/bin/bootsound
echo ' stagefright -a -o /system/media/android_audio.mp3' >> /system/bin/bootsound #this is the line that breaks the code
echo 'fi' >> /system/bin/bootsound
echo 'exit 0' >> /system/bin/bootsound
#Changing some permissions
chmod 777 /system/bin/bootsound
chown root:shell /system/bin/bootsound
echo '' >> /system/build.pro
echo 'ro.config.play.bootsound=1' >> /system/build.prop
echo 'media.stagefright.enable-player=true' >> /system/build.prop
echo 'media.stagefright.enable-meta=true' >> /system/build.prop
echo 'media.stagefright.enable-scan=true' >> /system/build.prop
echo 'media.stagefright.enable-http=true' >> /system/build.prop
#removed self-destruct, script checks for previous install
sleep 1
mount -o ro,remount /system
echo "done."
exit

ethan_hines said:
I found a script that adds boot audio. In it there is a line calling stagefright, stagefright either doesn't exist on my ROM and I have no clue as to add it. Here is the script in question which I don't know the original author however lithid from http://forum.cyanogenmod.org did some work on it and was close to creating a updater-script. Please Help Me as I know some scripting but not a lot
PS I was advised to ask this question to the devs by a cyanogenmod.org mod named bassmadrigal
Click to expand...
Click to collapse
Not sure if this works , but I will eventually try it , but not now , on my free time.
stagefright indeed is not included , my phone too doesn't have stagefright , if you go to youtube and search for android developement tutorials by "thenewboston" . you'll find 200 videos series , just watch the first 20 ones and you'll learn to use Media which replaces stagefright...I didn't try it yet.
It includes
Our_Player and Media Player and the directory of the song....check it out and give us heads ups!

thethiny said:
Not sure if this works , but I will eventually try it , but not now , on my free time.
stagefright indeed is not included , my phone too doesn't have stagefright , if you go to youtube and search for android developement tutorials by "thenewboston" . you'll find 200 videos series , just watch the first 20 ones and you'll learn to use Media which replaces stagefright...I didn't try it yet.
It includes
Our_Player and Media Player and the directory of the song....check it out and give us heads ups!
Click to expand...
Click to collapse
I appreciate the info, I took a look at his tutorials esp the ones involving animation, he really knows his stuff. I am not a Java programmer by any means and to be honest I find it quite tedious, it's like trying to teach a baby (this case the Dalvik VM) to do basic stuff like draw a green ball took like 20 lines of code!
What I need to know essentially is, do I have to use JAVA to get this to work now? In the past ie ICS and lower, there wasn't a problem with Custom Boot Audio, now with JB it seems it has disappeared from the radar.
I know the binary /system/bin/bootanimation (is this written in JAVA?, is there a source code for this bin?) is called at boot time by init.rc in the following manner:
Code:
service bootanim /system/bin/bootanimation
class main
user graphics
group graphics
disabled
oneshot
/system/bin/bootanimation (at least from what I gather) looks in /system/media for bootanimation.zip (zipped in store mode) decompresses it , looks at desc.txt for the code and displays the animation png by png.
In some desc.txt there is an s line, example:
Code:
# mobility
p 1 0 SOUND
s transdroid.mp3
which is SUPPOSED TO call a custom boot audio from /system/media (.mp3?) at the same time. This appears not to work. So logicaly I think the binary needs some tweaking. Can you offer any suggestions?
As you can see I have spent ALLOT of time mulling over why this,one would think, simple task: display a series of images and play audio at boot time I mean how hard can that be?
I am not trying to be a pest I just need to know WHY this doesn't work in JB (CM10.1)

Bruteforce Verizon Moto Z2 Force

Updated 7.30.20
I have a server up and running and thought it would be perfect to go back to this. I noticed some problems with the original code. After a while, the oem unlock command would hang, so I made it reboot the bootloader ever 1024 keys. I also added an initial oem unlock check because the first time you do the command it asks are you sure. This script should work forever.
I did notice that the screen will get burn in if left on for a long time. I cannot seem to find a way around this, no fastboot command can turn the screen off and keep fastboot running. I figured a $40 screen is worth reviving a $700 phone. This phone has been sitting in a box for years because verizon's anti everyone policies on bootloaders. I will be running this until it cracks the bootloader.
There is an automatic saving/restoring feature in case the computers gets turned off or I need to restart it. I also made the script not repeat characters more than 3 times in a row. I know chances are this won't work, but to me it's worth a try considering I don't have to do anything.
Code:
#!/bin/bash
restore() {
echo "Restoring Previous Session..."
crunch 20 20 ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -d 3 -s "${file}" | while read line; do
iter=$((iter + 1))
echo "Testing key ${line} - ${iter}"
line2=$((sudo fastboot oem unlock "${line}") 2>&1)
check=$(echo "${line2}" | sed -n 2p)
echo "${check}"
if [ "${check}" != "(bootloader) Code validation failure" ]; then
echo "${line}" >> key
finished
fi
echo "${line}" > current
if [ $iter -eq 1024 ]; then
echo "--------------------"
echo "Rebooting to bootloader"
echo "--------------------"
sudo fastboot reboot bootloader
echo "--------------------"
echo "Sleeping 5 seconds"
echo "--------------------"
sleep 5s
iter=0
echo "--------------------"
echo "Running initial oem unlock"
echo "--------------------"
sudo fastboot oem unlock aaaaaaaaaaaaaaaaaaaa
fi
done
}
new() {
echo "Running New Session..."
crunch 20 20 ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -d 3 | while read line; do
iter=$((iter + 1))
echo "Testing key ${line} - ${iter}"
line2=$((sudo fastboot oem unlock "${line}") 2>&1)
check=$(echo "${line2}" | sed -n 2p)
echo "${check}"
if [ "${check}" != "(bootloader) Code validation failure" ]; then
echo "${line}" >> key
finished
fi
echo "${line}" > current
if [ $iter -eq 1024 ]; then
echo "--------------------"
echo "Rebooting to bootloader"
echo "--------------------"
sudo fastboot reboot bootloader
echo "--------------------"
echo "Sleeping 5 seconds"
echo "--------------------"
sleep 5s
iter=0
echo "--------------------"
echo "Running initial oem unlock"
echo "--------------------"
sudo fastboot oem unlock aaaaaaaaaaaaaaaaaaaa
fi
done
}
finished() {
echo ""
echo "------------------------------------"
echo ""
echo "A different output was given, probably bootloader key found"
echo "Last checked key was"
echo "${line}"
echo "Key is also stored in a file called key"
echo "${line}" >> key
chmod 555 key
echo ""
echo "------------------------------------"
echo ""
echo "Press enter to close the terminal"
read var
exit 1
}
testresult() {
if [ -f "current" ]; then
file=$(cat current)
if [ "${file}" == "" ]; then
rm current
new
else
restore
fi
else
new
fi
}
testkey() {
if [ -f "key" ]; then
file=$(cat key)
if [ "${file}" == "" ]; then
chmod 775 key
rm key
testresult
else
echo "Key from last run was found, it is"
echo "${file}"
echo "Backing up to key.old"
chmod 775 key
cat key >> key.old
rm key
testresult
fi
else
testresult
fi
}
iter=0
sudo fastboot oem unlock aaaaaaaaaaaaaaaaaaaa
testkey

Knuxyl said:
I wrote a script for linux to bruteforce the bootloader unlock key on the Verizon model Motorola Moto Z2 Force.
Since I do not use my Force I figured I would run a bruteforce on the bootloader to hopefully one day get it unlocked. I am using an ASUS Tinkerboard with Debian 2.0.7 to run this code.
Requirements
Linux (Ubuntu do sudo apt-get install crunch sed, if your using anything else get crunch and sed)
Time
What it does
Generates alpha-numerics keys 20 characters long in order starting at AAAAAAAAAAAAAAAAAAAA.
It creates a file called "current" that will save your spot in case you want to resume later.
It will stop when bootloader response does not says validation failure and save the last used key to a file called "success"
Code (create a .sh file with this, do chmod +x thisfile.sh, then run it with ./thisfile.sh)
Code:
restore() {
crunch 20 20 ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -s "${file}" | while read line ; do echo "Testing key below ${line}" && line2=$((sudo fastboot oem unlock "${line}") 2>&1) && check=$(echo "${line2}" | sed -n 2p) && echo "${check}" && if [ "${check}" != "(bootloader) Code validation failure" ]; then echo "${line}" >> success && finished ; fi && echo "${line}" > current ; done
}
new() {
crunch 20 20 ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 | while read line ; do echo "Testing key below ${line}" && line2=$((sudo fastboot oem unlock "${line}") 2>&1) && check=$(echo "${line2}" | sed -n 2p) && echo "${check}" && if [ "${check}" != "(bootloader) Code validation failure" ]; then echo "${line}" >> success && finished ; fi && echo "${line}" > current ; done
}
finished() {
clear
echo "A different output was given, probably bootloader key found"
echo "Last checked key was"
echo "${line}"
echo "Key is also stored in a file called success"
echo "${line}" >> success
echo ""
echo "Press enter to close the terminal"
read var
exit 1
}
if [ -f "current" ]; then
file=$(cat current)
if [ "${file}" == "" ]; then
rm current
new
else
restore
fi
else
new
fi
I am running this now, I will post back if I ever get the key. Started 1700 on 23-July-2018.
I am on AAAAAAAAAAAAAAAAAUAA as of 1743 for a time/speed reference.
Click to expand...
Click to collapse
If it works, it might one day, unlock bootloaders for other phones as well. Good luck, first person I found to even try such a thing...

You'd have much better odds winning the lottery than getting a brute force answer in your lifetime. It is really folly. Let's assume you are doing just numeric characters instead of alpha numeric. That gives you 10 to the 20th power number of combinations instead of 36 to the 20th power. So if you wrote really optimized code and could go through 1 billion combinations a second, that would be 10 to the 9th power. I billion seconds later you would have gone through 10 to the 18th power or just one percent of the possible combinations. A billion seconds is a little more than 31 years. So in 3100 years you would have gone though just the strictly numeric solutions. As I've said before, brute force isn't going to get you the answer and shouldn't even be considered a viable answer.

kingstu said:
You'd have much better odds winning the lottery than getting a brute force answer in your lifetime. It is really folly. Let's assume you are doing just numeric characters instead of alpha numeric. That gives you 10 to the 20th power number of combinations instead of 36 to the 20th power. So if you wrote really optimized code and could go through 1 billion combinations a second, that would be 10 to the 9th power. I billion seconds later you would have gone through 10 to the 18th power or just one percent of the possible combinations. A billion seconds is a little more than 31 years. So in 3100 years you would have gone though just the strictly numeric solutions. As I've said before, brute force isn't going to get you the answer and shouldn't even be considered a viable answer.
Click to expand...
Click to collapse
What's your solution? You seem to have all the answers.

Find an exploit.
Try
Code:
fastboot oem unlock nowait
This worked for the Moto 360 on Marshmallow, it MIGHT work.
To find an exploit would be quicker than brute forcing.

doubledragon5 said:
What's your solution? You seem to have all the answers.
Click to expand...
Click to collapse
I don't have all the answers but buying a bootloader unlockable version is what I would recommend. By showing how long it would take I save someone from waiting and waiting for a task that won't complete in his lifetime...

So the phone died like a day later while running the bruteforce. I have the powerpack moto mod so I'm going to have to plug that in to a charger, put it on the phone, and plug usb to phone and pc/tinkerboard... when I get around to it. But I will keep up with this thread.
I tried the nowait fastboot and Code Validation Failure.

Is it even possible for a mobile device to go through 1-billion combinations a second? What if the code was split up over like 10 devices, and the code had each device only working on a smaller section for the unlock code......

azreark1 said:
Is it even possible for a mobile device to go through 1-billion combinations a second? What if the code was split up over like 10 devices, and the code had each device only working on a smaller section for the unlock code......
Click to expand...
Click to collapse
The unlock has to be tested on the specific device so splitting the processing among multiple devices won't solve the problem since each has its own unique code. Just buy a device with an unlockable bootloader since if it was that easy to decode the device wouldn't be very secure and that would have me more worried...

Oh so it's not a generic unlock code, it would still only be device specific?! Yeah thats pretty useless.

The method was initially a failure, why was it laid out here?

08sv80 said:
The method was initially a failure, why was it laid out here?
Click to expand...
Click to collapse
this is really only for people who have a verizon moto z2 force that they do not use and a pc they keep running 24/7. the method is not a failure, it just takes a long time. this is the only solution we have so far, so its better than nothing, but if u dont like it then move on, dont waste time posting useless comments.

for anyone that was interested in this, i must note that while phone is on the bootloader (fastboot) the screen stays on at like max brightness the whole time, so it can easily cause screen burn in. until i find some fastboot command to turn the screen off this is highly not recommended. Mine started burning in so I stopped the process.

you write nonsense and make people believe it? take it easy. your method is initially a failure. Believe on 4PDA, we know all the working methods.

If it hasn't been done, I believe the only way to unlock these bootloaders is exercising some consumer rights through a legal battle, and good luck with that, not worth wasting the time and money. I would be happy to just have temp-root, even if I have to do it every time I boot the phone. That would be more productive to chase, but I believe all exploits have been tried.

Could somebody use IBM's quantum computer
What if somebody could rewrite the script and use IBM's quantum computer. I am not a developer or a script Kitty or anything but that idea crossed my mind. Could it be possible or is it possible. I do know IBM lets people use their old quantum computer so it's just an idea.

Fastlane81 said:
What if somebody could rewrite the script and use IBM's quantum computer. I am not a developer or a script Kitty or anything but that idea crossed my mind. Could it be possible or is it possible. I do know IBM lets people use their old quantum computer so it's just an idea.
Click to expand...
Click to collapse
It's the phone's response and process that takes time, not the computer running the script.

m4f1050 said:
It's the phone's response and process that takes time, not the computer running the script.
Click to expand...
Click to collapse
Ok I figured that there was so many combinations that the normal computer couldn't figure out the combinations that fastso I figured with a quantum computer it can do it in days instead of months or years. That is what I was thinking.

Fastlane81 said:
Ok I figured that there was so many combinations that the normal computer couldn't figure out the combinations that fastso I figured with a quantum computer it can do it in days instead of months or years. That is what I was thinking.
Click to expand...
Click to collapse
Trust me, even an 8-bit Atari can create random numbers fast enough for this task (not saying you can use one, because you need to store the numbers and compare the newly created one with the ones already used, which I would use SQL server for this and not memory.) It's the phone itself the one slowing this down when entering the number and waiting for the phone to respond and starting the process again.

Kindly give instructions.
If someone can kindly give me instructions on how to initiate this code that would be awesome I have Ubuntu 20.04.1 installed on my desktop. And I just need to know how to initiate this script. If you can email me at [email protected] that would be awesome thank you very much