Database Develop

[DEV][TOOL] Generic SBK dumper [Source included]

Generic Nvidia Tegra Secure Boot Key Dumper, v0.4
**************************************
YOU MUST GET ROOT BEFORE PROCESSING!!!
This is a temp memory only fix, after you reboot your phone, everything will restore to it's original status. So it WILL NOT brick your phone at all!
**************************************
I am not sure it work for your devices or not, because I only get a SU660 device!
So , you must knew that P880 use a Secure Boot Key to encrypt its nflash communication, if you don't know the SBK, you can't use nvflash backup/restore your partitions.
I found that in the linux kernel, there is some protection that block the user try to read out SBK when the phone in "odm_production" status. So I designed a little software try to patch the phone RAM to bypass the protection.
This is a kernel patcher which will remove the protection when trying to read /sys/firmware/fuse/secure_boot_key
The dumper will patch the kernel in memory, and let you show the secure_boot_key.
Hope it work for all tegra devices.
Usage:
1. adb push dumpSBK /data/local/
2. adb shell
su
chmod 0777 /data/local/dumpSBK
/data/local/dumpSBK
After that, you can
4. cat /sys/firmware/fuse/secure_boot_key
dumpSBK will search the first 1MB physical address(which kernel will be there), and try to patch it.
Usage: dumpSBK [star_mem_addr in KB]
for example: dumpSBK 32
which will search the 32KB~1MB physical memory.
2012/12/31:
re-compile it with -static switch, so it can run on all android platform.
update instructions.
2013/01/01:
modify the program, and let you select which memory range to patch.
usage: dumpSBK [start_memory_addr] [end_memory_addr]
for example: dumpSBK 1 1024
which will search 1MB ~ 1024MB memory and try to patch the kernel.
2013/01/01:
v0.3 add more error detection in the file.
2013/01/06:
v0.4 wil search the first 1MB physical memory, you can specify the start_address , for example dumpSBK 32
and update the search pattern , it will fit for more compiler options.
2013/01/07:
Secure_Boot_Key Dumper for tegra2/tegra3 v0.1
1. adb push ss.ko /sdcard/
2. adb shell
su
cd /sdcard/
insmod ss.ko
dmesg
3. at the end of dmesg, you should see the secure_boot_key.....
2013/01/08:
v0.2 dump all known fuses.....

If you get a error:
Kernel patching failed! Abort....
that means your device kernel has a differnt tegra source code, or compiled with a different compiler........
Please let me know which kernel source code and compiler / compile switch it used.

marsgod said:
If you get a error:
Kernel patching failed! Abort....
that means your device kernel has a differnt tegra source code, or compiled with a different compiler........
Please let me know which kernel source code and compiler / compile switch it used.
Click to expand...
Click to collapse
will it hard brick the phone???

razerblade17 said:
will it hard brick the phone???
Click to expand...
Click to collapse
Do you want to try and find out? I certainly don't.
I like my phone and don't want to end up with an expensive paperweight instead :banghead:

SimonTS said:
Do you want to try and find out? I certainly don't.
I like my phone and don't want to end up with an expensive paperweight instead :banghead:
Click to expand...
Click to collapse
i'd have tried if i didnt sell mine
plus this wont brick the device
nothing can since bootloader's lock so u practically cant mess up anything that matters for booting up

The Troll said:
i'd have tried if i didnt sell mine
plus this wont brick the device
nothing can since bootloader's lock so u practically cant mess up anything that matters for booting up
Click to expand...
Click to collapse
Yep, i think Troll isn't trolling us i would try it out ,but i'm waitin' for my LG, factory reset via recovery bricked it.

This is a temp memory only fix, after you reboot your phone, everything will restore to it's original status. So it WILL NOT brick your phone at all!
The patcher will patch a single byte in your phone RAM, it will not modify any bit in your NAND Flash.

C:\adb>adb shell chmod 0777 /data/local/dumpSBK
Unable to chmod /data/local/dumpSBK: Operation not permitted
I got this

Here is a log of what happened, after I ran the program on my 4X with 10H F/W:
[email protected]:/data/local # /data/local/dumpSBK
/data/local/dumpSBK
[1] + Stopped (signal) /data/local/dumpSBK
[email protected]:/data/local # cat /sys/firmware/fuse/secure_boot_key
cat /sys/firmware/fuse/secure_boot_key
[1] + Segmentation fault /data/local/dumpSBK
Click to expand...
Click to collapse

^ You guys have rooted phone and debugging turned on? maybe that's why these errors.

phone rooted, recheked with root checker.
I have debuging mode one.
But i cant push files to /data/local/
C:\o4xr>adb push dumpSBK /data/local/
push: dumpSBK/Readme.txt -> /data/local/Readme.txt
failed to copy 'dumpSBK/Readme.txt' to '/data/local/Readme.txt': Permission deni
ed
Click to expand...
Click to collapse
So i put those files there with es file explorer and try to run second comand:
C:\o4xr>adb shell chmod 0777 /data/local/dumpSBK
Unable to chmod /data/local/dumpSBK: Operation not permitted
Click to expand...
Click to collapse
Who can explain why?

s7ar73r said:
phone rooted, recheked with root checker.
I have debuging mode one.
But i cant push files to /data/local/
So i put those files there with es file explorer and try to run second comand:
Who can explain why?
Click to expand...
Click to collapse
uhmm
as i seem to recall, the hello world rooting method *only known method* turns on access to that location..
thats where superuser and binaries are added
so if im correct u'd be able to push it if u follow the rooting method and adding the commands to the root.bat *or whatever its name it* that we run in pc by using notepad or anything..
so it should reroot and push ur desired file as well
*again, dun remember, been months but im sure hello world/backuptest thingy will be useful*

k1337Ultra said:
Here is a log of what happened, after I ran the program on my 4X with 10H F/W:
Click to expand...
Click to collapse
I get the this,too.
the v1 patch did not completely work.

The Troll said:
uhmm
as i seem to recall, the hello world rooting method *only known method* turns on access to that location..
thats where superuser and binaries are added
so if im correct u'd be able to push it if u follow the rooting method and adding the commands to the root.bat *or whatever its name it* that we run in pc by using notepad or anything..
so it should reroot and push ur desired file as well
*again, dun remember, been months but im sure hello world/backuptest thingy will be useful*
Click to expand...
Click to collapse
Its not the only known method... but now I don't have time, even to think... I just woke up and came to the computer.
You need to think widder
Gonna back to sleep :angel:

k1337Ultra said:
Here is a log of what happened, after I ran the program on my 4X with 10H F/W:
Click to expand...
Click to collapse
En.... I think it is due to I compiled the dumpSBK with 4.1.2 android, so it will not work on a ICS rom... I will check it later...

s7ar73r said:
C:\adb>adb shell chmod 0777 /data/local/dumpSBK
Unable to chmod /data/local/dumpSBK: Operation not permitted
I got this
Click to expand...
Click to collapse
You MUST root your device.
then type
adb root
to get the adb rooted work.
Of couse, you must have your device USB debug ON.

please do all the steps the right way , starting with the OP instruction you the right way.
OP is assuming we got a "unsecure" booted device, which we have not exactly due to the locked bootloader.
so its pointless to write "root" instruction froms adb when the device is in secure mode. OP is now told and should update the instructions, thank you.
ignore all the "adb shell" instruction and log into the device with "adb shell" once only.
in that shell which is opened execute the "su", so you get a root # prompt.
then run instructions given and skip all "adb shell" infront.
thats it, good luck.
edit:
adb remount,adb root and running root commands only work on unsecure devices , we got ro.secure=1 here and adb not allowed to run root commands

i think it's better toroot Your 4X with Dexter http://forum.xda-developers.com/showpost.php?p=30574547&postcount=85 because it doesn't have any issues, for me with 1st root method for example titanium backup wasn't working.
@marsgod, yep - we don't have 4.1.2 but 4.0.3, but u can leave this version because we'll get 4.1.2 in january

k1337Ultra said:
Here is a log of what happened, after I ran the program on my 4X with 10H F/W:
Click to expand...
Click to collapse
[email protected]:/data/local # /data/local/dumpSBK
/data/local/dumpSBK
[1] + Stopped (signal) /data/local/dumpSBK
[email protected]:/data/local # cat /sys/firmware/fuse/secure_boot_key
cat /sys/firmware/fuse/secure_boot_key
[1] + Segmentation fault /data/local/dumpSBK
i have same result . segmentation fault
whats wrong?

bullghost said:
[email protected]:/data/local # /data/local/dumpSBK
/data/local/dumpSBK
[1] + Stopped (signal) /data/local/dumpSBK
[email protected]:/data/local # cat /sys/firmware/fuse/secure_boot_key
cat /sys/firmware/fuse/secure_boot_key
[1] + Segmentation fault /data/local/dumpSBK
i have same result . segmentation fault
whats wrong?
Click to expand...
Click to collapse
after adb shell type su, u should have [email protected], not [email protected]
@edit so... anyone tested it in right way?

[ROOT][10-29-13]How to Manually Root the Nvidia Shield

Introduction
The following procedure will walk you through the step-by-step process for gaining root access on the Nvidia Shield.
Note: You must have an unlocked bootloader before you can proceed with this tutorial!
A tutorial on how to unlock your Shield's bootloader can be found here.
This tutorial also assumes how have the correct ADB and Fastboot drivers installed for your device, for a tutorial on how to install the ADB and Fastboot drivers for the Shield please look here.
Due to the nature of modifying devices system files the standard XDA disclaimer applies: I take no responsibility for bricked devices due to the following rooting procedure, no warranty express or implied is given, I will not be held responsible if you mess up your device by following this procedure!
Procedure
Before you begin please make sure to read and re-read the whole procedure, making sure you understand the directions.
1. Download the "Superuser-su.zip" file and the "roth-insecure-boot-63.img" file that are attached to this post. After you have downloaded the files, extract the contents of the "Superuser-su.zip" file which contains Superuser.apk and the su binary, and move them to your ADB and Fastboot folder on your computer. Also transfer the "roth-insecure-boot-63.img" to your computer's ADB and Fastboot folder.
MD5 Checksum for "roth-insecure-boot-63.img": F8BA5C48D0323D99E2A748C77BF647F6
2. Connect your Shield to your computer using your USB cable. For maximum reliability please connect the USB cable to a USB 2.0 port directly connected to the motherboard as USB ports on the front of a case panel or USB 3.0 ports can sometimes be unreliable.
3. Now that your Shield is connected to your computer make sure that "USB debugging" is enabled under the Developer Options section in the system settings menu (If the Developer Options section is hidden, go to the About Phone/About Tablet section of the system settings and then tap on the item that lists the Build number 7 times or until it says "You are now a developer" and the Developer Options section becomes visible in the system settings).
4. Open a command prompt window (cmd) in your ADB and Fastboot folder on your computer and issue the following commands (If you are new to using ADB and Fastboot I would recommend checking out this excellent guide to get you up and running):
Code:
adb reboot bootloader
Now that you are in fastboot mode let's make sure that the computer see's our device:
Code:
fastboot devices
If the computer see's our device then we can proceed, if it doesn't see your device make sure you are in fastboot mode and have the correct ADB and Fastboot drivers installed for the Shield.
Now we will be booting an insecure boot.img (ro.secure = 0) to our device to allow us to gain root acess:
Code:
fastboot boot roth-insecure-boot-63.img
After the insecure boot.img finishes flashing the device will automatically boot up using the insecure boot.img.
5.First we need to mount the /system partition as read/write so we can modify it:
Code:
adb shell
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
exit
6. Now we need to run the following commands to push the Superuser.apk and su binary to there correct positions and set the proper file permissions:
Code:
adb push su /system/xbin
adb push Superuser.apk /system/app
adb shell
chmod 6755 /system/xbin/su
chmod 644 /system/app/Superuser.apk
mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
sync
reboot
7. After the device reboots and power on into the Android Operating System you should see Koush's Superuser app in your app-drawer and you should be rooted. If you would like to verify root access you can download and run Root Checker Basic from the Play Store here. Enjoy!
Credits: Koush for his open source Superuser.apk and the su binary (https://github.com/koush/Superuser)
If users would like me to create a 1-click root process of this please let me know and I will do so .
If you are stuck with the rooting procedures I would recommend checking out this great video tutorial by wwjoshdew.

Alternatively the following works in almost one click (one fast boot, actually): https://github.com/linux-shield/shield-root

Gnurou said:
Alternatively the following works in almost one click (one fast boot, actually): https://github.com/linux-shield/shield-root
Click to expand...
Click to collapse
It's just whole unlocking thing and giving up your devices warranty. NVIIDA being able to decline your RMA if your fan goes out and the unit overheats. Or if the scree dies (for example). I'll do it, just gotta grow a pair first.

wwjoshdew said:
It's just whole unlocking thing and giving up your devices warranty. NVIIDA being able to decline your RMA if your fan goes out and the unit overheats. Or if the scree dies (for example). I'll do it, just gotta grow a pair first.
Click to expand...
Click to collapse
I did my RMA and nvidia sent me a new 1. So you should get your new shield b4 you send it back if you happen to root it and the screen dies.

This is a pretty complicated way of rooting. All I did was unlock the bootloader, flashed Clockworkmod Recovery, and then flashed the SuperSu zip with that. Rooted! As easy as a Nexus.

dark42 said:
This is a pretty complicated way of rooting. All I did was unlock the bootloader, flashed Clockworkmod Recovery, and then flashed the SuperSu zip with that. Rooted! As easy as a Nexus.
Click to expand...
Click to collapse
I hear yeah, this procedure is meant for those that really want to understand how the basic rooting process works and who want to gain experience manually performing these types of procedures .
Sent from my SCH-I535 using xda premium

shimp208 said:
I hear yeah, this procedure is meant for those that really want to understand how the basic rooting process works and who want to gain experience manually performing these types of procedures .
Sent from my SCH-I535 using xda premium
Click to expand...
Click to collapse
This method is actually nearly the same. It's a bootable self-contained image (like recovery is) that mounts the correct partitions, installs the necessary bits, and is done.

I haven't done this yet ... but could you also provide instructions on how to revert? I ask this as it would be nice to know that there is a back-out plan.
Kris

i00 said:
I haven't done this yet ... but could you also provide instructions on how to revert? I ask this as it would be nice to know that there is a back-out plan.
Kris
Click to expand...
Click to collapse
To unroot your Shield since you are only temporarily booting an insecure boot image rather then flashing it, if you run the following commands in either ADB shell or terminal emulator will unroot your device:
Code:
$ su
# mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
# rm -f /system/app/Superuser.apk
# rm -f /system/xbin/su
# mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
Then after you have entered those commands reboot your device and you'll be unrooted.

shimp208 said:
To unroot your Shield since you are only temporarily booting an insecure boot image rather then flashing it, if you run the following commands in either ADB shell or terminal emulator will unroot your device:
Code:
$ su
# mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
# rm -f /system/app/Superuser.apk
# rm -f /system/xbin/su
# mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
Then after you have entered those commands reboot your device and you'll be unrooted.
Click to expand...
Click to collapse
OK ... well lets say after rooting we install an app that uses root access to stuff up your device ... how do you restore the original image?
Kris

i00 said:
OK ... well lets say after rooting we install an app that uses root access to stuff up your device ... how do you restore the original image?
Kris
Click to expand...
Click to collapse
The original factory restore image that you can be flashed to your shield to return it to stock can be downloaded from here, along with the factory image extraction instructions (Under the open source resources section), as well as the factory image flashing instructions.

Does anyone if the root stop you from updating the device like GS4?

Simply rooting does not. I was rooted and updated. You lose root but can just reroot it like the first time. I am not sure if you have a custom recovery installed though. I haven't used one on the shield.

I am using the window 8 and I can't get the command prompt to work either directly open or open it as administrator to type the command. Any idea what I am doing wrong?
Shimp208. Can you create a video on how to unlock and root the shield?
Sent from my SHIELD using Tapatalk 2

wrc1010 said:
I am using the window 8 and I can't get the command prompt to work either directly open or open it as administrator to type the command. Any idea what I am doing wrong?
Shimp208. Can you create a video on how to unlock and root the shield?
Sent from my SHIELD using Tapatalk 2
Click to expand...
Click to collapse
When you mean you can't get the command prompt to directly open what do you mean by that? Does command prompt not open or run at all when you open it? Do you have ADB and Fastboot installed and the files listed for this procedure in your ADB and Fastboot directory? The Shield I rooted was my friends and he's on vacation right now so I unfortunately can't make a video right now , but I'll still be happy to try and help you through the procedure.

Finally success root my shield

oh god
wrc1010 said:
Finally success root my shield
Click to expand...
Click to collapse
I want that feeling soooo bad. The drivers aren't installing on my computer correctly. I can boot my shield via command but when I enter adb devices nothing shows up even though in device manager the device shows up as Nvidia Shield ADB.
Sad times, its tough as its so new everyone is still trying to figure it out and if the drivers don't install first time there aren't any problem solving threads etc

gogul1 said:
I want that feeling soooo bad. The drivers aren't installing on my computer correctly. I can boot my shield via command but when I enter adb devices nothing shows up even though in device manager the device shows up as Nvidia Shield ADB.
Sad times, its tough as its so new everyone is still trying to figure it out and if the drivers don't install first time there aren't any problem solving threads etc
Click to expand...
Click to collapse
What drivers are you trying to install and which version of Windows are you running?

Drivers
shimp208 said:
What drivers are you trying to install and which version of Windows are you running?
Click to expand...
Click to collapse
The ADB drivers and I'm running windows 7 64bit
Been trying to install them all day but I can bootload into shield but it can't pick up devices so can't root it.

gogul1 said:
The ADB drivers and I'm running windows 7 64bit
Been trying to install them all day but I can bootload into shield but it can't pick up devices so can't root it.
Click to expand...
Click to collapse
Did you try and install these drivers? Make sure to uninstall your old driver installation first.

[SOLVED][Q] 4.4.3 after restart restores previous values

Hi!
I have problem with my HTC One m7 (ViperOne 7.0.1).
While I changed something in /system/app folder (eg. deleted a "DriveActivator.apk" - successfully accomplished) and restart phone, I see again that deleted app!!!
Do you know why? I'm using RootExplorer, I have root and granted permissions to r/w.
It seems like system restores some kind of backup - I don't know why, and I don't know how to fix it (I mean do some permanent changes in /system/app).

dry3333 said:
Hi!
I have problem with my HTC One m7 (ViperOne 7.0.1).
While I changed something in /system/app folder (eg. deleted a "DriveActivator.apk" - successfully accomplished) and restart phone, I see again that deleted app!!!
Do you know why? I'm using RootExplorer, I have root and granted permissions to r/w.
It seems like system restores some kind of backup - I don't know why, and I don't know how to fix it (I mean do some permanent changes in /system/app).
Click to expand...
Click to collapse
It appears that the System isn't booted with RW capabilities
There's a nice long command that I'll give you later that will fix it
If you wanna get it sooner and aren't afraid of adb shell (make sure you have root access enabled for adb AND apps, not just apps) you can Google remount Linux system read/write and you should find it
You'll need to modify that command to reflect the One, but the name of the partition should be something like by-name-system or something
I'll get it later if you need it when I wake up

ajbiz11 said:
It appears that the System isn't booted with RW capabilities
There's a nice long command that I'll give you later that will fix it
If you wanna get it sooner and aren't afraid of adb shell (make sure you have root access enabled for adb AND apps, not just apps) you can Google remount Linux system read/write and you should find it
You'll need to modify that command to reflect the One, but the name of the partition should be something like by-name-system or something
I'll get it later if you need it when I wake up
Click to expand...
Click to collapse
Thanks mate!
Stupid question - how I can check whether I have root access enabled for adb and apps? I have superuser app, and in settings I can see: "Superuser Access: Apps and ADB" - is this what you are wrote about?

dry3333 said:
Thanks mate!
Stupid question - how I can check whether I have root access enabled for adb and apps? I have superuser app, and in settings I can see: "Superuser Access: Apps and ADB" - is this what you are wrote about?
Click to expand...
Click to collapse
That's exactly what I'm referring to (The settings thing)
Lemme go find that command for you
---------- Post added at 06:00 AM ---------- Previous post was at 05:56 AM ----------
Wish I knew this existed when I was working on the L port
There's an app to do exactly what you need without looking up partitions
https://play.google.com/store/apps/details?id=com.beansoft.mount_system
Although if you want to go through terminal, here's a tutorial
http://ckirbach.wordpress.com/2012/11/27/how-to-remount-system-as-read-write-in-android/
Basically, you use grep to find the name of the system partition, then run the mount command to remount the partition you found in that precious step

I have this app: Mount /system (rw / ro), also I have this option in superuser and it works fine - I mean that I can change /system/app or for eg. edit /etc/hosts (I get message that ES explorer granted superuser access), but after restart I see previous files (before changes)... I have no idea how make this work - maybe I need custom kernel or something? I want to make permanent changes in system files...
I have reinstalled system (clean option with wipe all data), but still no results...

dry3333 said:
I have this app: Mount /system (rw / ro), also I have this option in superuser and it works fine - I mean that I can change /system/app or for eg. edit /etc/hosts (I get message that ES explorer granted superuser access), but after restart I see previous files (before changes)... I have no idea how make this work - maybe I need custom kernel or something? I want to make permanent changes in system files...
I have reinstalled system (clean option with wipe all data), but still no results...
Click to expand...
Click to collapse
The remount app should do exactly that
Try the command option and make your changes then reboot

ajbiz11 said:
The remount app should do exactly that
Try the command option and make your changes then reboot
Click to expand...
Click to collapse
I have tried - still no results. My system already has RW permissions. Problem is that after restart my files are "restored".
Analogously like in Cisco IOS - commit but without write memory.
Maybe I should go to recovery and do something (but I don't know what)?

dry3333 said:
I have tried - still no results. My system already has RW permissions. Problem is that after restart my files are "restored".
Analogously like in Cisco IOS - commit but without write memory.
Maybe I should go to recovery and do something (but I don't know what)?
Click to expand...
Click to collapse
Check the Viper forum and maybe post there
I only run CM-base so I'm not too experienced with Sense issues

ajbiz11 said:
Check the Viper forum and maybe post there
I only run CM-base so I'm not too experienced with Sense issues
Click to expand...
Click to collapse
Thanks - they said they don't know, but it affects S-ON users....
Can You tell me one thing - I execute this script:
echo off
adb reboot
cd /d %~dp0
echo .
echo Waiting for device...
adb wait-for-device
echo.
adb -d shell stop
adb -d shell su -c "mount -o remount rw /system"
adb -d shell rm /system/app/DriveActivator.apk
adb reboot
This should remove DriveActivator (while script is ongoing I see no errors), but after reboot DriveActivator.apk is still in /system/app...
Is there any other way to permanently remove/change files in /system/app?

dry3333 said:
Thanks - they said they don't know, but it affects S-ON users....
Can You tell me one thing - I execute this script:
echo off
adb reboot
cd /d %~dp0
echo .
echo Waiting for device...
adb wait-for-device
echo.
adb -d shell stop
adb -d shell su -c "mount -o remount rw /system"
adb -d shell rm /system/app/DriveActivator.apk
adb reboot
This should remove DriveActivator (while script is ongoing I see no errors), but after reboot DriveActivator.apk is still in /system/app...
Is there any other way to permanently remove/change files in /system/app?
Click to expand...
Click to collapse
You can remove it from the ViperROM zip and format ONLY system and reflash
That SHOULD work
That's like...the be all end all

dry3333 said:
Thanks - they said they don't know, but it affects S-ON users....
Can You tell me one thing - I execute this script:
echo off
adb reboot
cd /d %~dp0
echo .
echo Waiting for device...
adb wait-for-device
echo.
adb -d shell stop
adb -d shell su -c "mount -o remount rw /system"
adb -d shell rm /system/app/DriveActivator.apk
adb reboot
This should remove DriveActivator (while script is ongoing I see no errors), but after reboot DriveActivator.apk is still in /system/app...
Is there any other way to permanently remove/change files in /system/app?
Click to expand...
Click to collapse
Make life simple: erase the apk while in custom recovery, TWRP has a file manager, or you can use Aroma File Manager
even adb commands while booted in custom recovery are better than booted up ROM.

nkk71 said:
Make life simple: erase the apk while in custom recovery, TWRP has a file manager, or you can use Aroma File Manager
even adb commands while booted in custom recovery are better than booted up ROM.
Click to expand...
Click to collapse
Thanks for advice. Is it possible via TWRP not only remove file, but also replace it? Where shoul I place new file for replace original one?

dry3333 said:
Thanks for advice. Is it possible via TWRP not only remove file, but also replace it? Where shoul I place new file for replace original one?
Click to expand...
Click to collapse
I would recommend using the Aroma File Manager instead of TWRP's, just place all the files you'll need on your internal storage (including Aroma File Manager), then reboot to select "Install" to run the Aroma File Manager and remove/replace whatever you need to.
You may need to also check if the permissions are right, I can't remember if Aroma File Manager has that built in.
remember that once you are in recovery to mount /system (in the Mount menu)
and you can even use adb shell, and adb push commands to replace the .apk.... i'm just guessing it's easier with a GUI interface.

nkk71 said:
I would recommend using the Aroma File Manager instead of TWRP's, just place all the files you'll need on your internal storage (including Aroma File Manager), then reboot to select "Install" to run the Aroma File Manager and remove/replace whatever you need to.
You may need to also check if the permissions are right, I can't remember if Aroma File Manager has that built in.
remember that once you are in recovery to mount /system (in the Mount menu)
and you can even use adb shell, and adb push commands to replace the .apk.... i'm just guessing it's easier with a GUI interface.
Click to expand...
Click to collapse
The windows drivers don't work with recovery mode (usually)

ajbiz11 said:
The windows drivers don't work with recovery mode (usually)
Click to expand...
Click to collapse
they do for me, but sometimes (after flashing a new/different version) i have to manually select the drivers, check FAQ#2 here: http://forum.xda-developers.com/showpost.php?p=52135024&postcount=2

I would like to thank you for advice. I did this via TWRP (after I had mounted /system). It works fine for me

dry3333 said:
I would like to thank you for advice. I did this via TWRP (after I had mounted /system). It works fine for me
Click to expand...
Click to collapse
sure, no problem :good: :good:
if all is good now, can you also edit main thread title to include [SOLVED], thanks
edit the first post -> at the bottom of the edit window, click Go Advanced, and then you can edit main title

[Q] Z3C just rooted and Titanium Backup issue

Hello there, I just rooted my Z3C 5803 phone with the exploit founded yesterday (.93 FW) and first thing I did was to install Titanium Backup because there were a lot of programs I wanted to remove for good from this device and also wanted to integrate newer versions into the Rom. Whenever I try to integrate, for example, a newer YouTube, Google Chrome, Google Play Store version into the Rom, TB seems to keep trying and trying forever.
Checking into the TB FAQ i found this:
"14. I tried to integrate system app updates or to convert user apps to system apps but it didn’t work. Why?
These features require a NAND unlocked ("S-OFF") device, in order to write to the ROM.
Depending on the software, some S-ON devices may "remember" modifications made to /system for a while, or until the next reboot. That is not enough for our purpose.
Please search the Internet for information on how to make your particular device S-OFF."
.......but, of course, for me that is Chinese. Doesn´t mean that if I´m root, I can anything I want to the Rom? If not, what do I need to make the phone S-OFF?
Hope someone could help this noob!
Thanks in advance.
Alx

http://forum.xda-developers.com/z3-compact/general/questions-belong-t2868300

Sorry, didnt know that. Will create it in that section.

Use link2sd, be careful

harrymason37 said:
Use link2sd, be careful
Click to expand...
Click to collapse
Would link2sd let me remove and integrate apps from/to the ROM of my cellphone?

S-OFF and S-ON are terms used for HTC phones if i'm not mistaken
Sent from my D5833 using XDA Free mobile app

alxtorrentazos said:
Would link2sd let me remove and integrate apps from/to the ROM of my cellphone?
Click to expand...
Click to collapse
yes, you can remove system app or convert user app into system app just make make sure you grant its superuser request

harrymason37 said:
yes, you can remove system app or convert user app into system app just make make sure you grant its superuser request
Click to expand...
Click to collapse
Thanks Harry . Never used that app before, will have to read a guide about how to do that. I always used TB for that in my old Samsung Xcover 2 phone with Jelly Bean.

alxtorrentazos said:
Hello there, I just rooted my Z3C 5803 phone with the exploit founded yesterday (.93 FW) and first thing I did was to install Titanium Backup because there were a lot of programs I wanted to remove for good from this device and also wanted to integrate newer versions into the Rom. Whenever I try to integrate, for example, a newer YouTube, Google Chrome, Google Play Store version into the Rom, TB seems to keep trying and trying forever.
Checking into the TB FAQ i found this:
"14. I tried to integrate system app updates or to convert user apps to system apps but it didn’t work. Why?
These features require a NAND unlocked ("S-OFF") device, in order to write to the ROM.
Depending on the software, some S-ON devices may "remember" modifications made to /system for a while, or until the next reboot. That is not enough for our purpose.
Please search the Internet for information on how to make your particular device S-OFF."
.......but, of course, for me that is Chinese. Doesn´t mean that if I´m root, I can anything I want to the Rom? If not, what do I need to make the phone S-OFF?
Hope someone could help this noob!
Thanks in advance.
Alx
Click to expand...
Click to collapse
hey , go to the the giefroot folder you downloaded to root your phone , then go to ''files'' folder , and then open a ''cmd window'' there (by pressing ctrl + right click) and then write copy paste these codes one after another
adb push systemrw.sh /data/local/tmp
adb push modulecrcpatch /data/local/tmp
adb push wp_mod.ko /data/local/tmp
adb shell
chmod 777 /data/local/tmp/systemrw.sh
chmod 777 /data/local/tmp/modulecrcpatch
chmod 777 /data/local/tmp/wp_mod.ko
su
cd /data/local/tmp
./systemrw.sh
i hope it works , i had same issue and i fixed it

sorry, but I´m getting those "not found" msgs and is still the same....TB gets stuck while trying to integrate the files into the ROM
[email protected]:/data/local/tmp # ./systemrw.sh
./systemrw.sh
modulecrcpatch (by zxz0O0)
module_layout: patched to 0xDB2AB789
__aeabi_unwind_cpp_pr1: match
kallsyms_lookup_name: not found
printk: not found
mem_text_write_kernel_word: not found
__aeabi_unwind_cpp_pr0: match
successfully patched
Installing of mount.sh finished
rm failed for /data/local/tmp/memfile, No such file or directory
255|[email protected]:/data/local/tmp #

alxtorrentazos said:
sorry, but I´m getting those "not found" msgs and is still the same....TB gets stuck while trying to integrate the files into the ROM
[email protected]:/data/local/tmp # ./systemrw.sh
./systemrw.sh
modulecrcpatch (by zxz0O0)
module_layout: patched to 0xDB2AB789
__aeabi_unwind_cpp_pr1: match
kallsyms_lookup_name: not found
printk: not found
mem_text_write_kernel_word: not found
__aeabi_unwind_cpp_pr0: match
successfully patched
Installing of mount.sh finished
rm failed for /data/local/tmp/memfile, No such file or directory
255|[email protected]:/data/local/tmp #
Click to expand...
Click to collapse
I had a similar problem until i installed dualrecovery. Now the rw permission persists after reboot.

xpsg said:
I had a similar problem until i installed dualrecovery. Now the rw permission persists after reboot.
Click to expand...
Click to collapse
But I DO have RW permissions over the system folder..............according to ES File Explorer I have "rwxr-xr-x" and those stay after I reboot my device. I can use ES File Explorer to copy files wherever I want. Root is working just fine, is just TB that cannot integrate stuff onto the ROM (neither remove, I only can freeze apps, but I want to remove them for good).

my TiBu seems to work, theres no errors. But it doesnt actually seem to work. I cant uninstall any system apps. It does the process says complete but the apps remain.
Any Solution?
Thanks

I used this tool to access rw to system http://forum.xda-developers.com/showthread.php?p=57043230
[4.4.4] Sony RIC KILLER
After that you will have write permission to system
Sent from my D5803 using XDA Free mobile app

mardrest said:
I used this tool to access rw to system http://forum.xda-developers.com/showthread.php?p=57043230
[4.4.4] Sony RIC KILLER
After that you will have write permission to system
Sent from my D5803 using XDA Free mobile app
Click to expand...
Click to collapse
I will try that once I'm at home. Weird thing is I tried to copy a file inside the system folder and it worked just fine, so, I do have permissions over the folder..........dont know

This tool dissable the sony ric protection that dissable access to /system
Sent from my D5803 using XDA Free mobile app

pw1nce said:
hey , go to the the giefroot folder you downloaded to root your phone , then go to ''files'' folder , and then open a ''cmd window'' there (by pressing ctrl + right click) and then write copy paste these codes one after another
adb push systemrw.sh /data/local/tmp
adb push modulecrcpatch /data/local/tmp
adb push wp_mod.ko /data/local/tmp
adb shell
chmod 777 /data/local/tmp/systemrw.sh
chmod 777 /data/local/tmp/modulecrcpatch
chmod 777 /data/local/tmp/wp_mod.ko
su
cd /data/local/tmp
./systemrw.sh
i hope it works , i had same issue and i fixed it
Click to expand...
Click to collapse
This fixed my xposed framework issues! Thank you!

Yeah, that fixed the permissions to install Xposed, but that doesnt work to let Titanium Backup modify the files in the rom. MKLCF2, could you please try to integrate, let's say YOUTUBE or GOOGLE PLAY into the rom ?
I'm still at work and cannot test anything

Try
Code:
su
mount -o remount,rw /system
after that you should be able to mess around with Titanium Backup

Thanks for that tip but 2 things still happens.......I'm still unable to integrate YOUTUBE or GOOGLE PLAY newer versions into the rom AND, everytime I reboot the device is like I lose that option and I have to do the entries again on the terminal..........for example, Xposed keeps asking me "are you root?" when I try to install/update it.
Is there any other solution to this?
TIA

Now What?

Now that we have root, what things are we going to be focusing on next? Probably Safestrap and ROMs. What cool things have you guys found with root?

Vlasp said:
Now that we have root, what things are we going to be focusing on next? Probably Safestrap and ROMs. What cool things have you guys found with root?
Click to expand...
Click to collapse
Well for one thing if you disabled/uninstall Unified Search, it allows google search to work correctly in the launcher, also without root you can replace the amazon keyboard with the google keyboard and get voice search.
Edit: We need to probably install Google play services properly to get Google Play Games to work correctly but I am not sure.

The ability to install apps depending on root is awesome.
If you are asking for wishes, then I wish I could use CyanogenMod on this device.

I have de-amazonified my tablet a bit. Cant wait to get a custom rom installed on it though.

we need a safe list with what apps can we delete... i did the same but i don't know for sure what to delete and what to keep... i mention that i don't use amazon apps nor i logged in..
Sent from my KFFOWI using XDA Forums

balanigga said:
we need a safe list with what apps can we delete... i did the same but i don't know for sure what to delete and what to keep... i mention that i don't use amazon apps nor i logged in..
Sent from my KFFOWI using XDA Forums
Click to expand...
Click to collapse
For the moment......
http://forum.xda-developers.com/showpost.php?p=63605889&postcount=77
If wants to remove more can give chmod 000 to apk & reboot before delete

What about reassigning the home button to a different launcher?

xT29c said:
What about reassigning the home button to a different launcher?
Click to expand...
Click to collapse
Just install another launcher and remove FireLauncher from system.

csolanol said:
Just install another launcher and remove FireLauncher from system.
Click to expand...
Click to collapse
Oh, nice. Okay, thanks!

csolanol said:
Just install another launcher and remove FireLauncher from system.
Click to expand...
Click to collapse
how can i do this? thanks in advance
Edit: nevermind I found it, thanks anyway

joelwylde said:
how can i do this? thanks in advance
Click to expand...
Click to collapse
You can use titanium backup, and remove it like that. I would make a backup firs though just in-case.
Also, I need help trying to unhide the firelauncher process. I have the command here "adb shell pm unhide [package:com.amazon.firelauncher]"
But I need the other command first so ADB can talk to my tablet. Because I ran the command, and it just says "true" when it should say "false".

joelwylde said:
how can i do this? thanks in advance
Click to expand...
Click to collapse
Working Launcher replacement thanks to @diegocr and @Awesomeslayerg ! Here's the steps:
1. See @diegocr post at http://forum.xda-developers.com/showpost.php?p=63599598&postcount=23 and download "boot-firelauncher.img"
2. Enable USB debugging
3. Install your launcher of choice!
4. On your computer, run
adb reboot bootloader
Click to expand...
Click to collapse
5. Once your tablet reboots in to fastboot, run on your computer (if you are not in the same directory as boot-firelauncher.img, put the full path):
fastboot boot boot-firelauncher.img
Click to expand...
Click to collapse
6. Tablet will reboot
7. Once booted open an adb shell:
adb shell
Click to expand...
Click to collapse
8. To back up the existing app, run:
cp /system/priv-app/com.amazon.firelauncher/com.amazon.firelauncher.apk /sdcard/Download/com.amazon.firelauncher.apk
Click to expand...
Click to collapse
9. Then nuke it!
rm /system/priv-app/com.amazon.firelauncher/com.amazon.firelauncher.apk
Click to expand...
Click to collapse
10. Now, run to restart your device:
reboot
Click to expand...
Click to collapse
Confirmed working on my tablet with FireOS 5.0.1.
Enjoy!
Forget all the formatting problems
Sent from my KFFOWI using Tapatalk

If you are already rooted you don't need to do all that stuff.
Just adb shell
su
mount -o remount,rw /system
rm -r /system/priv-app/com.amazon.firelauncher or whatever the package is called.
Reboot and it's done.
Remember to install a launcher before this.

csolanol said:
If you are already rooted you don't need to do all that stuff.
Just adb shell
su
mount -o remount,rw /system
rm -r /system/priv-app/com.amazon.firelauncher or whatever the package is called.
Reboot and it's done.
Remember to install a launcher before this.
Click to expand...
Click to collapse
Will this work if I hid the process with ADB before hand? If not, how do I unhide it? What command would I use before "adb shell pm unhide [package:com.amazon.firelauncher]"

Don't know, try if it works hiding, but I doubt it.

I want to replace the hosts file with the one of my Lenovo S660 (China phone). The S660 hosts file is about a mile long and has entries like "0.0.0.0 bad.ad.server" - a very basic but effective way to avoid a lot ads, even at apps. I have not yet took a closer look but I think I would create a mix of both files for the fire.
So, what are the steps?
I have done similar things to my rooted Sony Experia Tipo concerning modifying files at /system, which is mounted RO as default. So I remounted it RW with ES-Explorer, modified what I had to and mounted RO with ES-Explorer again.
I wonder, if this is ok, because of the security means the fire/android has.

I took a chance and I was successfull.
I attached the unchanged hosts file from my Lenovo S660 /system/etc/ as hosts.lenovo.zip file. The fire hosts has just 1 line: 127.0.0.1 localhost. The lenovo's hosts has 25858 lines.
Code:
- unzip hosts.lenovo.zip -> you get host.lenovo
- rename hosts.lenovo to hosts
- connect fire
- adb push hosts /data
- adb shell
- $ su -
- # cd /data
- # chmod 644 hosts
- # exit
- $ exit
- ES Explorer
- Enable root explorer
- remount /system rw
- go to /data
- mark hosts
- cut hosts (to memory)
- go to /system/etc
- mark hosts
- rename hosts to hosts.old
- insert hosts from memory
- remount /system ro
- exit ES Explorer
done.
should work, use at own risk.
Note: You cannot chmod 644 at /mnt/sdcard1 because it is vfat there, that's why you use /data.
Note: You cannot write to /system/etc while at adb shell, even if it is mounted RW, that's why you have to use ES Explorer which will ask you to choose the path with android overlay window - which makes it work (at least my experience).
If you have apps which showed ads before, then you might keep on seeing the very last forever. Or a broken link sign. Or even a popop with broken link sign. Or your ads hosts is missing at the lenovo hosts file and you keep on seeing ads. There even my be websites you cannot visit anymore - which I have not yet experienced, but the risk exists, or will come.
If interested, take a look at http://winhelp2002.mvps.org/hosts.htm for more information and use for your windows or linux pc.
If you don't like it you can go back, you have a copy of your old hosts file.

I want to replace the hosts file with the one of my Lenovo S660 (China phone). The S660 hosts file is about a mile long and has entries like "0.0.0.0 bad.ad.server" - a very basic but effective way to avoid a lot ads, even at apps.
Click to expand...
Click to collapse
Check out the adaway app (open source). It blocks ads through the host file just like you're doing except it puts the host file in place for you, combines host files from a couple different sources (running de-duplication on them) & auto updates your host file as new ad severs are added or removed. Absolutely beats rolling your own host file manually.

That is new information to me, thanks.