CD-17302F (Lenovo Smart Display 7") (Ivy) AVB/Bootloader Unlock, Firmware - Google Home

How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB C cable
2. You will need fastboot drivers on your PC
3. Unplug the power cable from your device
4. Remove the silicone cover from around the power plug (Might be hard it has adhesive on the back)
5. Plug the USB C cable into the now revealed USB-C port
6. Hold the volume + button and plug in the power cord (Smart plugs or switches help so you don't damage the ports by replugging them constantly)
7. Keep holding volume + for about 10-15 seconds (It is slow to boot to fastboot)
8. Once the device shows up on your computer in a terminal run the following command:
Code:
fastboot flashing unlock
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Word of warning doing this causes the stock OS not to boot fully.
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB unlock zip
2. Run either the avb-unlock.bat or this command in a terminal
Code:
at_auth_unlock.exe creds\
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command or the Avb_lock.bat:
Code:
fastboot oem at-lock-vboot!
Now that you are AVB unlocked you can flash the firmware/partitions from fastboot using the flash-all scripts located in the firmware zips.
Combined firmware: (Flashes both Factory and User firmware one to each slot)
Here
User (Stock) firmware:
Here
Debug/Factory Firmware:
Here
AVB Unlock tool:
Here
Various Screenshots:
Spoiler
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The firmware provided allows you to have adb and adb root on either debug or user. But the downside is with avb off the device can't access its Tee keys so the user firmware will not finish setup. But you can still install other apps and use root which allows you to fully turn off the security restrictions to allow you to edit files on the device. The commands you need to run are these:
Spoiler
Code:
adb root
adb disable-verity
adb reboot
adb root
adb remount
adb shell setenforce 0
Disable-verity will last until you factory reset or run adb enable-verity
Useful adb and android things commands:
Spoiler
Brings up the default launcher selector screen (If a launcher you try opens and then closes it is not supported by Android Things. You will need one that does not have Widget support. Like KISS Launcher)
Code:
adb shell am start -a android.intent.action.MAIN -c android.intent.category.HOME
Lists installed app package names
Code:
adb shell pm list packages
Change the -p to whichever package name you want to launch it emulates clicking the apps icon in launcher so some system apps don't support it.
Code:
adb shell monkey -p PACKAGE_NAME -c android.intent.category.LAUNCHER 1
Will launch the android things settings page
Code:
adb shell monkey -p com.android.iotlauncher -c android.intent.category.HOME 1
This will launch the google setupwizard/launcher
Code:
adb shell monkey -p com.google.assistant.core -c android.intent.category.LAUNCHER 1
Seems to soft reboot the android things system, but not actually reboot the device proper
Code:
adb shell monkey -p com.google.android.apps.quartz -c android.intent.category.LAUNCHER 1
Launches camera app
Code:
adb shell am start -n com.android.camera2/com.android.camera.CameraActivity

Truely impressive work @deadman96385 !! Thank you for the release

So if we turn AVB off, install an apk (like Zello) or other 3rd party launcher (like Nova), then turn AVB back on, will it boot? Or do we have to leave AVB off inorder to use other android apks?

I did the flash, booted Ok the first time but got:
adb devices
HA16XGYL no permissions
Then did the unlock again and
fastboot oem at-lock-vboot
fastboot set_active b
fastboot reboot
but now it's stuck in "Your device will boot in 5 seconds"
How to exactly unlock + boot + adb install myapp.apk?

Edit: Nevermind

Jarkk'o said:
I did the flash, booted Ok the first time but got:
adb devices
HA16XGYL no permissions
Then did the unlock again and
fastboot oem at-lock-vboot
fastboot set_active b
fastboot reboot
but now it's stuck in "Your device will boot in 5 seconds"
How to exactly unlock + boot + adb install myapp.apk?
Click to expand...
Click to collapse
This may help you: https://itsfoss.com/fix-error-insufficient-permissions-device/

thanks for making this thread! ended up with a demo unit a year ago. and couldnt find anything about flashing the OS at the time.

Is there a way to update webview? I tried using Home Assistant app, but it fails with js errors and it seems a newer webview is needed

Hi, sorry, i'm kind of a noob to this.
Finally realized i was in fastboot mode even though the screen stayed black. I was then able to do the AVB unlock, but then i'm not really sure what i'm supposed to do to get an Android Things flashed device.
I ended up trying the flash-all bat, but on reboot the device updated itself after i connected it to google home.

Just as a reference, I've downloaded the ADB Interface Driver (adb_driver_20110720.zip) on https://support.lenovo.com/in/en/downloads/ds022366-adb-interface-driver-thinkpad-tablet to be able to pass stage 1 and 2
Looks like I've successfully passed stage 1 and 2 - AVB Unlocked.
Now I need to start flashing, but don't have a clue which commands to use. @deadman96385 Would you be so kind as to explain what are the last remaining commands. I've downloaded the combined firmware ? I also tried the flash-all.bat without any success

vizharan said:
Is there a way to update webview? I tried using Home Assistant app, but it fails with js errors and it seems a newer webview is needed
Click to expand...
Click to collapse
It looks like you were able to get the device flashed. Maybe you can give me some advise how to get it flashed (last step). Thank you so much

@jangeenidee in the end i wasn't able to flash it correctly, i'll try again when i'm able to block internet access preventing it to self update.
But given it's a third party device with an old webview version, Google blocked web browser usage on this device, rendering it useless for my purpose as it is. It's still a good paperweight google photos gallery though.

vizharan said:
Is there a way to update webview? I tried using Home Assistant app, but it fails with js errors and it seems a newer webview is needed
Click to expand...
Click to collapse
If you're able to root your device with Magisk you can use a Magisk Module like Webview Manager. I had the same issue using the Home Assistant on my CD-18781Y (Lenovo ThinkSmart View) at first but after rooting and installing the module I was able to change the Webview to a newer one in developer settings.

Related

[TUTORIAL] Keeping root after upgrade from v10x to v20x

↓ A new root method! ↓
There is now a new root method, that does not require downgrade!
http://forum.xda-developers.com/showthread.php?t=2180688
↑ Read this thread first! ↑
Prerequisites
A rooted LG O4X HD with a v10 firmware. (SuperSU preferred - personally tested)
Device adb drivers installed (so that a phone is detected as an ADB device when in B&R Recovery mode), adb itself is included in the archive
You need an installed Busybox! (/system/bin preferred, or need to edit bat file)
Warning: Do NOT do factory reset between step 1 and step 3! Otherwise /data/rootkit will be deleted, and you will have to start over.
Important note for linux users: bat files are for Windows. If you are using linux, i assume that it will be easy for you to open bat files and do commands by hand.
Step 0
Backup all your settings, and data from internal storage (!), cause factory reset (wipe) will be required.
You can try using LG's backup tool or Titanium Backup or anything else.
Also I'd strongly recommend removing SIM card and SD card from the phone.
Step 1
Make sure USB debugging is enabled (Settings -> Dev Options -> Debugging)
Connect your phone to your PC.
Execute file step0.bat and ensure that you grant su priv to ADB shell (2000).
Now execute file step1.bat - it:
- creates folder /data/rootkit
- copies busybox from /system/bin to /data/rootkit
- copies su from /system/xbin to /data/rootkit
- copies Superuser.apk from /system/app to /data/rootkit
- ensures owner and group of 0 for those files
- chmods files to required attributes (06755 for su, 0644 for apk, 0777 for busybox)
Result should be something like this: Note: In v2 i modified step1, so it tries to copy busybusybox from bin and xbin - one of them will fail, thats normal.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Step 2
Upgrade your firmware to v20a. For example: http://forum.xda-developers.com/showthread.php?t=2069723
DO NOT DO FACTORY RESET! OR YOU WILL DELETE /data/rootkit FOLDER! DO STEP 3 FIRST!
Step 3
After successful upgrade shut down your phone.
Now, with USB connected (!!), hold volume up and power, and keep holding it at least until you hear windows "new device" sound.
You must see something like this:
Now execute file step3.bat - it:
- remounts system as writeable
- copies su to /system/xbin/
- copies superuser to /system/app/
- sets permissions on those files
Step 4
Now you can hold power button to reboot or just run step4.bat to reboot instantly.
Make sure that root is working, before doing factory reset!
Now you are STRONGLY recommended to do factory reset - or many things will mess up, such as lock screen settings or storage.
AGAIN warning, that factory reset WILL wipe internal storage, look at step 0
If you did all things correct, root will be kept (because it is on ro system partition now)
Step 5
Enjoy.
Note
If you are already at v20a and you want root, you can:
1) Wait for official release, with really unlocked BL - then it will be possible to install CWM -> get root
2) Wait until I make some interaction with B&R daemon in recovery
3) Wait for someone to find easier method
4) If you dont want to wait, you can go back to v10x (warning: all data will be wiped!), root phone, and do the procedure.
Any comments, notes, criticism or anything else very welcome!
Edit: In version 2 it tries to copy busybox from /system/bin and /system/xbin, thanks to AlderCass for pointing out
Nice work friend :good:
I don't have adb on my pc, is there a way to simply download the drivers? I ask because my current pc doesn't have the internet
Sent from my LG-P880 using Tapatalk 2
@non4 said:
I don't have adb on my pc, is there a way to simply download the drivers? I ask because my current pc doesn't have the internet
Sent from my LG-P880 using Tapatalk 2
Click to expand...
Click to collapse
adb is included in the archive... i will see what i can do about drivers.
try to connect phone to your PC with debugging on and do "adb devices" from the folder with unpacked adb
if it sees your device - then good
@SkyDev
great findings, nice to see ideas expand to something useful.
did you also went all way and tried to install a changed/modified boot.img and add it to the LNX partition in /dev/block/mmcblk0p2 or /dev/block/platform/sdhci-tegra.3/by-name/LNX , it might just be our bootloader do work as unlocked and we can write unsigned boot / recovery img
edit;
i believe you can easily test it from recovery and su in here. even if you get security error on "boot", i think recovery can still be booted and you can recover the backup of the mmcblk0p2 partition (men always do backups)
Utterly fantastic work, and I'm sure this discovery will be the first huge step in truly unlocking this device. Congratulations!
Sent from my LG-P880 using xda app-developers app
skydev said:
adb is included in the archive... i will see what i can do about drivers.
try to connect phone to your PC with debugging on and do "adb devices" from the folder with unpacked adb
if it sees your device - then good
Click to expand...
Click to collapse
Isn't adb a pain to install? At least it was back in the day when I rooted my desire z with froyo thanks for the good work I will try get this to work on my own
Sent from my LG-P880 using Tapatalk 2
Dexter_nlb said:
@SkyDev
great findings, nice to see ideas expand to something useful.
did you also went all way and tried to install a changed/modified boot.img and add it to the LNX partition in /dev/block/mmcblk0p2 or /dev/block/platform/sdhci-tegra.3/by-name/LNX , it might just be our bootloader do work as unlocked and we can write unsigned boot / recovery img
edit;
i believe you can easily test it from recovery and su in here. even if you get security error on "boot", i think recovery can still be booted and you can recover the backup of the mmcblk0p2 partition (men always do backups)
Click to expand...
Click to collapse
Well, when now root is easily obtainable, you can do it
I think you are more experienced in all those things, i am low-levelly playing with phones only for 3-4 days so far.
I just dont want to trash stuff to the extent that reflash would be required.
Anyway i worked on the method almost 10 hours instead of sleeping at night, so now i think i going to go take some "Deep sleep" /10:46/
Anyway, i am noting again: if anyone also has disassembly skills, then you really should try to disassemble and analyze brd (backup and recovery daemon) - it runs at recovery with root rights, listens for commands on udp port, and probably can be used for "perfect root" (root without reflashing, and maybe even any LG device)
for people having issues using adb, you can download "terminal" from play , and do the same steps except do not start from a windows shell with adb
you just open the terminal.
secondly all files needed, should be tar'd instead, so the busbox more easily can unpack all files with proper rights instantly to the dest folder.
ie.
# cd /data ; tar xf /data/local/tmp/rootkit.tar
assuming rootkit folder is extracted and all files already was properly set with rights in linux when tar'ing the folder.
so conclusion
you do 3 steps to do this.
1. download rootkit.tar
2. open terminal on phone
3. cd to /data and extract(tar xf) rootkit.tar from where you put it when downloaded
this is all without adb used.
but you need adb in the end to run the bat file
Dexter_nlb said:
for people having issues using adb, you can download "terminal" from play , and do the same steps except do not start from a windows shell with adb
you just open the terminal.
secondly all files needed, should be tar'd instead, so the busbox more easily can unpack all files with proper rights instantly to the dest folder.
ie.
# cd /data ; tar xf /data/local/tmp/rootkit.tar
assuming rootkit folder is extracted and all files already was properly set with rights in linux when tar'ing the folder.
so conclusion
you do 3 steps to do this.
1. download rootkit.tar
2. open terminal on phone
3. cd to /data and extract(tar xf) rootkit.tar from where you put it when downloaded
this is all without adb used.
but you need adb in the end to run the bat file
Click to expand...
Click to collapse
Well, adb will be required anyway, and i want to keep freedom of choosing the su binary and Superuser.apk file.
The only requirement: su must grant root if called from recovery (when Superuser.apk is not accessible)
Also, why mess with terminal? You can easily misspell command, and they are long and important (because executed as root)
But idea with tar is good, maybe it will be required to do it this way, from B&R way.
I'm trying this method now and I noticed that a command in step1 fails on my system.
I changed:
adb shell su -c cp /system/bin/busybox /data/rootkit/
to
adb shell su -c cp /system/xbin/busybox /data/rootkit/
postacik said:
I'm trying this method now and I noticed that a command in step1 fails on my system.
I changed:
adb shell su -c cp /system/bin/busybox /data/rootkit/
to
adb shell su -c cp /system/xbin/busybox /data/rootkit/
Click to expand...
Click to collapse
Prerequisites
A rooted LG O4X HD with a v10 firmware. (SuperSU preferred - personally tested)
Device adb drivers installed (so that a phone is detected as an ADB device when in B&R Recovery mode), adb itself is included in the archive
You need an installed Busybox! (/system/bin preferred, or need to edit bat file)
Warning: Do NOT do factory reset between step 1 and step 3! Otherwise /data/rootkit will be deleted, and you will have to start over.
Important note for linux users: bat files are for Windows. If you are using linux, i assume that it will be easy for you to open bat files and do commands by hand.
Click to expand...
Click to collapse
Already mentioned in first post.
lukas77 said:
Already mentioned in first post.
Click to expand...
Click to collapse
I stated that I changed the line to work "on my system".
So everybody trying this will pay attention to that...
sry for this newbie ques,
but how to install adb drivers in our device..
jitesh22 said:
sry for this newbie ques,
but how to install adb drivers in our device..
Click to expand...
Click to collapse
There are many posts on these forums on how to do this - search for them, as this thread does not deal with that.
Everything works perfect, and now i have root on my JB .
Works like a charm! Thanks so much skydev! :laugh:
I upgraded to v20a with these instructions and now I have a rooted v20a.
Thank you very much skydev.
A picture for proof: http://g1303.hizliresim.com/17/7/ktz5m.png
I think we will be able to root when new versions arrive as long as we keep the /data/rootkit folder.
Edit: I upgraded to v20a with my LG PC Suite Version Hacker ( http://forum.xda-developers.com/showthread.php?t=2134192 ) and did no factory reset after the upgrade. Everything seems to work fine upto now.
quick and dirrrrrty
thats how i like it^^
well done
AW: [TUTORIAL] Keeping root after upgrade from v10x to v20x
Worked fine. There we're no problems. Did the kdz flashing via virtual machine with windows and the rooting part on mac os x since your scripts can be easily adapted. Also i dont have to care about adb or fastboot drivers.
Gesendet von meinem LG-P880 mit Tapatalk 2

[Q] Deleted System from HTC One - Stuck in TWRP

Hey there everyone,
Android newbie here.
Just wanted to start off assuring everyone that I've been scouring the internet for answers.
I've been using the following links.
http://forum.xda-developers.com/showthread.php?t=2322220
[Q] Device not found on ADB | TWRP Sideload and CWM mount problems
http://forum.xda-developers.com/showthread.php?t=2345877
help wiped phone and sdcard cant sideload
http://forum.xda-developers.com/showthread.php?t=2325853
[GUIDE] How to ADB Push to fix a formatted /sdcard (Mac + PC)
I'm on a Mac and have an HTC One of course.
At the moment, whenever I switch on the phone it automatically takes me to the TWRP screen.
It looks like there is no system as I cannot boot into the original stock rom (I never installed a customer rom but did have the Kernel which enabled the HTC logo to be functional).
My goal is to get a ROM onto the phone so that I can install it (don't care if the phone is completely wiped).
Issue is that my Mac doesn't detect the phone when plugged in via USB. Neither via the HTC Sync Manager or by Android File Transfer Apps.
When in TWRP, I went to Advance then ADB Sideload. All I get is a the message ADP Sideload Complete Failed.
So the advice was to ADB Push the file onto the phone.
After downloading the Android SDK, extracted everything to desktop, went into the folder called tools, double clicked on the file called Android, made sure that I ticked the right boxes, it downloaded some stuff and then closed the window.
I then opened up terminal and typed in cd Desktop/platform-tools
./adb devices
I get the message saying Daemon started successfully and List of Devices attached (however there are no devices listed).
(At this point I've got the USB cable plugged into the HTC One and it's on the TWRP screen.
I really don't know what to do.
Could someone please help?
Are you using usb port 3.0?
However, boot in fastboot and see if the
Code:
fastboot devices
command work
I'm sorry but I have no clue where you mean I should type in that command.
I've now clicked on reboot in TWRP then it is in the fastboot screen (white screen, with bunch of text and the word fastboot highlighted in red).
I plugged in the USB cable to my mac, open up terminal and typed in.
./adb devices
then
./adb fastboot devices (assuming that's what you had meant) and it did nothing except for load up a screen with commands see attached.
You have only to write:
Code:
./fastboot devices
without adb
hey there,
I typed in cd Desktop/platform-tools
then
./fastboot devices
However it did nothing.
So I typed in
./adb devices after that
And I still get nothing.
Kei$ cd desktop/platform-tools
platform-tools Kei$ ./fastboot devices
platform-tools Kei$ ./adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
platform-tools Kei$
Seems you don't have fastboot into the folder.
However, have you checked that you aren't using a usb 3.0 port?
And driver of phone are installed?
just in case this helps.
When you run the fastboot command, on your phone, what screen are you on. Is it the recovery (twrp) or bootloader?
Also make sure only the phone is connected via usb and nothing else if you have the MacBook air
Sent from my HTC One using xda app-developers app
amnesia said:
just in case this helps.
Click to expand...
Click to collapse
Umh, you're s-on, i will advice you to go to s-off when you've restored it.
akuma24 said:
When you run the fastboot command, on your phone, what screen are you on. Is it the recovery (twrp) or bootloader?
Also make sure only the phone is connected via usb and nothing else if you have the MacBook air
Sent from my HTC One using xda app-developers app
Click to expand...
Click to collapse
Yeah, seems he was in recovery, when he have to use the fastboot command in fastboot...
within platform-tools folder I have the following files
adb
api
fastbood
notice.tx
source.properties
systrace
-------
I've installed the HTC Sync (which should install the drivers needed as all threads say)
My iMac is a mid 2010 version and uses USB 2.0 for all four ports.
amnesia said:
within platform-tools folder I have the following files
adb
api
fastbood
notice.tx
source.properties
systrace
-------
I've installed the HTC Sync (which should install the drivers needed as all threads say)
My iMac is a mid 2010 version and uses USB 2.0 for all four ports.
Click to expand...
Click to collapse
So, now, unistall HTC Sync, boot in fastboot and use the command:
Code:
./fastboot devices
after move to the directory.
I had a similar problem last evening, however I am operating on Windows 8.1, thank goodness for dual boot as I had to use Win7 as 8.1 would not recognize adb interface.
However, once in twrp recovery,just the main screen you should be able to use :
adb devices
and it should list your device:
xxxdevicexxx recovery
if so then you use
adb push rom.zip (i tend to rename them to make this easier) /data/media/0
took about 12 minutes for the rom to be placed, then I did an install, I had to do it twice before it took, but after that I was good to go
When in the bootloader, does it say fastboot usb?
Sent from my HTC One using xda app-developers app
Guich said:
So, now, unistall HTC Sync, boot in fastboot and use the command:
Code:
./fastboot devices
after move to the directory.
Click to expand...
Click to collapse
Alright so I uninstalled HTC Sync Manager (Dragging and dropping it to the recycle bin then using Clean My Mac to uninstall it).
Then in terminal I typed in
./fastboot devices
platform-tools Kei$ ./fastboot devices
There was no response at all from the terminal.
Let me know if you would like me to take a video of exactly what I'm doing.
I'm confident that I'm following instructions perfectly.
akuma24 said:
When in the bootloader, does it say fastboot usb?
Sent from my HTC One using xda app-developers app
Click to expand...
Click to collapse
Here is a closer image of what I see.
amnesia said:
Alright so I uninstalled HTC Sync Manager (Dragging and dropping it to the recycle bin then using Clean My Mac to uninstall it).
Then in terminal I typed in
./fastboot devices
platform-tools Kei$ ./fastboot devices
There was no response at all from the terminal.
Let me know if you would like me to take a video of exactly what I'm doing.
I'm confident that I'm following instructions perfectly.
Click to expand...
Click to collapse
I don't have a mac, but the command will work like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So, try to use another cable.
amnesia said:
Here is a closer image of what I see.
Click to expand...
Click to collapse
Your phone isn't connected to the PC.
So, try to use another cable.
Which Mac os are you on and how many usb calls do you have plugged in ?
Sent from my HTC One using xda app-developers app
Oh no, don't say that! I've got windows 8 on my mac (via VMWare fusion) and was going to try that...
I'm on Mac OSX 10.8.4
I have two out of the 4 USB ports plugged in (one is the phone) the other is the printer.
I just went through 3 usb cables and finally the Fastboot screen says
Fastboot USB ! Guess the first two weren't good enough, they were charging the phone though.
I then went into terminal and typed in
./fastboot devices
and now it says
<serial number> fastboot
What's next boss ? What do I type.

[noob-read] adb and fastboot. What is it? How can it help you?

Contents / Thread overview
Introduction
What is Fastboot?
What is adb?
How to install adb and fastboot
How to test adb and fastboot work
OK Gimme some useful fastboot commands please!
OK Gimme some useful adb commands please!
A little more about using Windows command prompt
Myth Busters
Introduction
adb and fastboot are very useful command line tools. They can be used from Windows, Linux or Mac to carry out tasks on your android device, such as moving and backing up files, rooting and restoring your phone to it's factory state. Understanding how to use these tools could save your phone when you get yourself in trouble. This is especially true of rooted users. Particularly those of you who are "new to the scene". You definitely should read and understand this thread before you do ANYTHING root related.
This thread is not intended to be a non-exhausted reference. It is merely here to give an overview of the most basic of basics
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is fastboot?
Fastboot comprises of 2 components.
1) Fastboot mode on the phone (The Bootloader)
2) Fastboot tool on your computer
Fastboot is a small command line tool that you can use from your computer whilst the phone is connected via USB and you are booted into the bootloader. The most common uses for fastboot are:
Unlocking the bootloader - needed as part of the rooting process
Flashing a custom recovery to the device - needed as part of the rooting process
Flashing factory images - used for saving / trestoring your device back to stock
Being able to do these 3 things are essential before rooting. Many new users skip learning these and use a toolkit to root. As a result, when they mess up and we try to explain what they need to do to fix their issues, it becomes very difficult for us to help as fastboot is not understood. It is YOUR responsibility to understand these things BEFORE you mess up.
What is adb?
adb is another small command line tool that stands for "Android Debugging Bridge". Again, it can be used from a computer connected via USB to your android device. It can be used whilst the device is booted into Android or (if you have a custom recovery), it can be used in recovery too, unlike fastboot (yes, adb and fastboot are NOT the same thing) which can only be used in the bootloader.
adb can be used to push files to (or pull files from) your phone. It can also be used to execute many of the commands available in Linux terminals (Or Android terminal emulators) on the device itself. We're not here to cover all these commands however. We just want to cover the basics.
How to install adb and fastboot
adb and fastboot are very easy to install and can be installed on Windows, Linux and MAC computers. The Windows install can be a little bit more complicated than the other 2 and may need additional drivers installing too.
Windows.
There is a very handy tool that can install adb and fastboot in 15 seconds. It is recommended that you use this to install adb and fastboot. Please see the link immediately below for that tool:
ADB, Fastboot and Drivers - 15 seconds ADB Installer - Really quick and easy way to install adb and fastboot (by @Snoop05). Downlkoad links are at the bottom of post 1.
This tool asks if you want to install adb and fastboot (to which you should answer Y) and then creates c:\adb\adb.exe and c:\adb\fastboot.exe
It then asks if you want to install it system wide (to which again, you should answer Y)... This then allows you to type adb commands in the command prompt without having to open a particular directory first. You may or may not understand what I mean when I say that, but take it from me, its much more convenient and easier to use this way.
There is actually a manual way of doing what the 15 second installer is doing, by extracting the adb.exe and fastboot.exe to your computer and using the Windows Enviroment variable PATH to make the executables work system wide, however the installer is much quicker, but for reference:
Code:
right-click computer > properties > advanced > environment variables.
under system variables click "path" and click "edit"
at the end of the line, add the below:
;c:\adb_fastboot
where c:\adb_fastboot is where you decided to extract adb and fastboot executables.
Please note, the semi-colon ; is VERY important.
You can do this if for some reason the installer becomes unavailable
It will also ask if you want to install device drivers. Actually, say N to this as we're going to cover that next, using the Universal Naked driver which has better compatibility.
Here is a link to the naked driver: DOWNLOAD THIS which has been taken from this thread:
[ADB/FB/APX Driver] Universal Naked Driver
Some of the below instructions are taken from the thread above by @1wayjonny but I have moved them here to make it easier for you guys.
Code:
To install on Windows 7:
- Ensure existing drivers are uninstalled first*
- Extract the zip to c:\adb (created earlier by the installer)
- Right-click "Computer" > Manage in windows and choose "Device Manager"
- Boot the Nexus 5 to the bootloader (Volume down + Power) and connect the USB Cable
- Watch for any new devices with exclamation marks appearing
- Right-Click the new device > Update driver software
- Choose the "browse" method and browse to c:\adb then follow the wizard to the end.
*To uninstall existing drivers, boot into Android and connect the USB cable. Monitor device manager for the device showing up. To uninstall the device, right-click it to uninstall it. At the prompt, ensure you also choose to delete the driver. Repeat this for bootloader and recovery.
Code:
To Install on Windows 8, you must additionally disable driver enforcement
- From the Metro Start Screen, open Settings (move your mouse to the bottom-right-corner of the screen and wait for the - -- pop-out bar to appear, then click the Gear icon).
- Click ‘More PC Settings’.
- Click ‘General’.
- Scroll down, and click ‘Restart now’ under ‘Advanced startup’.
- Wait a bit.
- Click ‘Troubleshoot’.
- Click ‘Advanced Options’
- Click ‘Windows Startup Settings’
- Click Restart.
Once that is done, your Windows computer is configured for adb and fastboot.
In device manager, the device should show up as below, depending whether you are booted into recovery or bootloader...
Recovery - Android Device > Google Nexus 4 ADB Interface
Bootloader - Android Device > Google Nexus 4 Bootloader Interface
If it shows as something different, either you have existing drivers in the way or something went wrong.
Linux and Mac
Here is a really simple tool to install adb and fastboot on the above OS. The only expectation is you know how to open and run a terminal command. Please see the link immediately below:
Nexus Tools 2.2 (Featured by XDA) - adb and fastboot installer for Linux and Mac (by @corbin052198)
Once you have installed adb and fastboot from the above link, you're ready to go.
How to test adb and fastboot work
As previously mentioned, adb and fastboot are both command line tools. That means you must run these tools from command prompt (cmd in Windows) or Terminal (Linux and Mac).
Remember earlier, I mentioned that fastboot can only be used in bootloader? and adb can only be used in Android (or custom recovery - lets cover that later)? We can use the command "fastboot devices" and "adb devices to see if we have adb and fastboot working correctly.
Lets try it.
Boot your phone into android
Connect it to your computer via USB
Open cmd (start > type "cmd" on Windows) or Terminal (Mac/ Linux
Type in the windows "adb devices" and press enter
Here is what we don't want to see:
Notice how there is nothing underneath where it says "List of attached devices" That means it cannot see any device
Here is what we DO want to see:
We can see that there is now a device listed.
OK lets test fastboot. Unplug the USB and turn off the phone. When it is off, hold down Volume down + power until you feel the vibrate. You will now be in the bootloader. Reconnect the USB cable.
In the same window (cmd or terminal) we're going to now type "fastboot devices".
Again, here is an example of what we don't and do want to see:
If in both modes, you can see your devices "Serial Number", then you know they are both working. If they're not working (mainly Windows users) you may want to check this additional thread about troubleshooting drivers.
[*] Diagnosing USB Driver and ADB issues in Windows - Ensure ADB and fastboot WORK before you root (by @MaxRabbit)
Please note that if you cannot get adb and fastboot to work "system wide", you can open the command prompt to the location of the adb and fastboot executables exist and try from there.
OK Gimme some useful fastboot commands please!
Here are some of the most useful fastboot commands you will come across. Fastboot is used mostly for flashing images to the devices partitions on the internal memory.
Code:
fastboot oem unlock
This unlocks your bootloader and allows you to flash a recovery to root. WARNING, this will wipe your device. If you actually want to do this, please follow this guide:
How to Unlock Bootloader, Install Custom Recovery and Root - The preferred method. Allows you to learn and understand the basics (by @Chromium)
Code:
fastboot flash recovery recovery.img
This will flash a recovery.img to the recovery partition. The command is broken down into "fastboot flash" (what to do) "recovery" (where to flash to) "recovery.img" what to flash there. In the terminal or command prompt, you cannot just type "recovery.img" though. It has to be the path to where the recovery image is. For example, if my recovery image is on my desktop, I would have to type:
Code:
fastboot flash recovery c:\users\rootsu\desktop\recovery.img
It is worth noting, that it IS case sensitive, meaning if your file is called Recovery.img, you must type the capital R...
Other things you would flash:
Code:
fastboot flash system system.img
fastboot flash boot boot.img
These will flash the system image (ROM) and bot image (kernel) as you would if you were returning to stock. If you want to return to stock, please use this guide:
How to flash a factory image | Return to stock | Unroot/SAVE your Nexus 5 - Understand how to undo whatever you do before you root (by @abaaaabbbb63)
You can also boot into a recovery.img without flashing it...
Code:
fastboot boot c:\users\rootsu\desktop\recovery.img
which is "fastboot boot" (what to do) "c:\users\rootsu\desktop\recovery.img" what to do it with. As you may have noticed, we did not define the recovery partition in this command, that's because we're not flashing it....
OK Gimme some useful adb commands please!
At the moment, we are going to assume you have a custom recovery and you have booted into recovery. The reason for this is using adb in recovery can be much simpler.
Here are some useful scenarios for using adb.
Backup your sdcard to your PC
Code:
adb shell
mount data
exit
adb pull data/media/0 c:\MyBackup
**Please note, some recoveries may "mount data" automatically on boot, so don't be disheartened if you get an error stating device or resource busy. This probably just means you can't mount what is already mounted**
/data/media/0 is the real location of /sdcard for your information. Also referred to as "The mount point". What we have done here is "adb pull" (what to do) "data/media/0" (what to move) "c:\MyBackup" (where to move it to)
Push a zip file from your PC to your sdcard (useful if you wiped your sdcard and rom)
Code:
adb shell
mount data
exit
adb push c:\rom.zip data/media/0
What we have done here is "adb push" (what to do) "c:\rom.zip" (what to move) "data/media/0" (where to move it to)
You can of course also use adb to push and pull files to and from /system too. You just need to:
Code:
adb shell
mount system
exit
I mentioned earlier that using custom recovery is much easier for adb than whilst booted into Android. You need to ensure you have a kernel that allows insecure adb before you do anything with system and data partitions. You also need to ensure that USB debugging has been enabled in developer options.
For example, to mount system to pull files whilst android is running you have to:
Code:
adb root
adb shell
mount -o rw,remount /dev/block/platform/msm_sdcc.1/by-name/system /system
...which is clearly a little bit more involved, so I recommend you use recovery for adb push and pull. You can find more detailed information on adb here: http://developer.android.com/tools/help/adb.html
A little more about using Windows command prompt
One thing to understand is that like Windows, command prompt (cmd.exe) works with directories (or folders if you like). The Linux and Mac terminals are the same, but most linux users, we expect you would already know this.
Here you will see I have downloaded a recovery image that I want to flash using fastboot.
As you can see, the recovery.img is located in C:\users\rootSU\Desktop
Usually when you open the command prompt from the start menu, or run command, the command prompt will default to your user location as seen below:
So lets try and fastboot flash recovery recovery.img...
It fails with a not-too-accurate error message. It has failed because you have not told it where the recovery image is. It assumes it is in the directory as listed in the prompt
So, how do we deal with this? Well, there are 3 ways.
1) We tell the command prompt where the recovery.img actully is in the command itself
Success! As you can see, we have told the command that the location for the file is Desktop\recovery.img
2) We can change the directory in command prompt to the directory where the file is. In this example, we change directory to "Desktop". The change directory command is "cd " or in this case "cd Desktop"
3) ...and possibly the simplest method. We hold shift whilst we right-click on the folder we want to change directory to, and directly open a command prompt there:
Another point to make with command prompt or terminals, is if you do a particular command, it is "pre-programmed" to "expect" a particular format of that command.
For example, we know that adb push as a command expects after it . This means the command is actually
Code:
adb push
BUT if you put something AFTER , for example -
Code:
adb push somethingelse
, it will assume that the "somethingelse" is a bad parameter, and the command will fail. It will probably display (or "print" which is the technical term in a terminal) a helpful guide of how the command should be used instead of trying to run the command which it does not understand.
You're probably wondering why I am telling you this. Well quite simply, it is a warning about folder names. Imagine you have c:\users\rootSU\My Documents as a folder. You assume the command is then
Code:
adb pull /data/media/0 c:\users\rootSU\My Documents
but it is not... There is a space in between My and Documents. What you have actually done is
Code:
adb pull Documents
because it uses a space to signify the end of a command or parameter. It is best to avoid using folders with spaces in them. Avoid as much as you can. In the event it is unavoidable (Although when is it ever>) then please surround the path with quotation marks,
Code:
adb pull /data/media/0 "c:\users\rootSU\My Documents"
so that way, it sees everything between the " " as a single parameter.
Myth Busters
Myth 1: You need USB debugging on to use adb and fastboot
If you cannot boot into Android, it doesn't matter. You DO NOT need USB Debugging turned on to use adb outside of android. USB Debugging is an Android ONLY setting. Fastboot obviously also does not need debugging either as this too is outside of Android
Myth 2: to adb push or fastboot flash files, they must be in the same folder as adb or fastboot executables. Sorry but this is rubbish. You can pass the full path of the image you're flashing or file you're pushing in the command and fastboot / adb can be called system wide if you've set them as an environment variable or used the 15 second installer
This should absolutely be a sticky!!
Sent from my EVO using XDA Premium 4 mobile app
Evolution_Freak said:
This should absolutely be a sticky!!
Sent from my EVO using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Thanks. I created it specifically to put in the general sticky in my signature. Section 1a and 4
Great work @rootSU definitely should be sticky!
psycho693 said:
Great work @rootSU definitely should be sticky!
Click to expand...
Click to collapse
Thanks. Its in there. All in the main sticky thread
Sent from my Nexus 5 using Tapatalk
rootSU said:
Thanks. Its in there. All in the main sticky thread
Sent from my Nexus 5 using Tapatalk
Click to expand...
Click to collapse
It helps a lot because I have been looking for a good guide to pull system files while the phone is running
psycho693 said:
It helps a lot because I have been looking for a good guide to pull system files while the phone is running
Click to expand...
Click to collapse
Cool
The main thing for me was we had a diagnosis thread and we had a full guide for rooting or returning to stock but nothing to answer the how to set up or how to adb push basic questions... I've seen several threads today alone
Sent from my Nexus 5 using Tapatalk
Very cool, didn't actually know the push/pull commands or that driver you reference
wonderful(really wonderful)!
but i cant find the start button on this toolkit.. :silly:
simms22 said:
wonderful(really wonderful)!
but i cant find the start button on this toolkit.. :silly:
Click to expand...
Click to collapse
LMAO! rootSU, this is freakin awesome. Every thread that I find complaining about issues with toolkits will be redirected here. If this isn't stickied it should be a crime.
Sent from my Nexus 5 using xda premium
I suggested to the mods that we have just one sticky in general that has all the threads we believe to be Stickies within it. That way we can control it ourselves but without making it messy, so we have that now ( see signature).
Sent from my Nexus 5 using Tapatalk
Thanks for listing my Nexus Tools
corbin052198 said:
Thanks for listing my Nexus Tools
Click to expand...
Click to collapse
Thanks for making them
Sent from my Nexus 5 using Tapatalk
simms22 said:
wonderful(really wonderful)!
but i cant find the start button on this toolkit.. :silly:
Click to expand...
Click to collapse
How do I flash the toolkit? I think its bricked :silly:
Good thread.
Amazingly detailed thread. There's no way to mess up reading this thread, the noobs will definitely learn if they can do the reading first that is.
I will laugh when a noob asks, "fastboot? It takes about a minute for me to boot!"
Sent from my Nexus 5 using XDA Premium 4 mobile app
I'm not sure what this all is, but awesome guide!!!!
? I'll be frequently linking this too.
Good job my friend, i am sure it's really helpful for a lot of people
Tapatalk Team SlimRoms
Added the below section about using command prompt. Hopefully a little more detail should help.
A little more about using Windows command prompt
One thing to understand is that like Windows, command prompt (cmd.exe) works with directories (or folders if you like). The Linux and Mac terminals are the same, but most linux users, we expect you would already know this.
Here you will see I have downloaded a recovery image that I want to flash using fastboot.
As you can see, the recovery.img is located in C:\users\rootSU\Desktop
Usually when you open the command prompt from the start menu, or run command, the command prompt will default to your user location as seen below:
So lets try and fastboot flash recovery recovery.img...
It fails with a not-too-accurate error message. It has failed because you have not told it where the recovery image is. It assumes it is in the directory as listed in the prompt
So, how do we deal with this? Well, there are 3 ways.
1) We tell the command prompt where the recovery.img actully is in the command itself
Success! As you can see, we have told the command that the location for the file is Desktop\recovery.img
2) We can change the directory in command prompt to the directory where the file is. In this example, we change directory to "Desktop". The change directory command is "cd <directory>" or in this case "cd Desktop"
3) ...and possibly the simplest method. We hold shift whilst we right-click on the folder we want to change directory to, and directly open a command prompt there:
Click to expand...
Click to collapse
Added a bit more about using directory paths with spaces.
Sent from my Nexus 5 using Tapatalk
After a week with my new nexus, it's time for a litlle fun... But first must say thank you for this explanation.
Sent from my Nexus 5 using Tapatalk 2

Bootloader locked. Flashing lock flag is locked!

Hello....
I want to unlock bootloader of itel p33
(Couldn't found any custom recovery for this device)
I tried adb fastboot option...
fastboot oem unlock
fastboot flashing unlock
fastboot flash boot pathed_boot.img
fastboot flash recovery recovery.img
etc..
in adb command line it shows
...
Failed.(flashing lock flag is locked. Plz unlock it first!)
.
(I have enabled oem unlocking in dev option)
How to unlock the locked bootloader? I just want to root.
Currently using Itel p33
Android 8.1.0(go edition)
1gb ram/16gb rom
Spreadtrum sc7731e
(I just want to know is it possible if i unpack stock firmware img file and edit something and repack it. Then flash it to phone. Will it help?? I don't have much knowledge.)
Thanks....
Hey, I have the same kind of device with this issue. I am guessing the bootloader is not unlockable, I think this is true for probably any device with this processor. I got my hands on a reference sprd u-boot source code, which is not exactly labeled for this chipset but it seems to have a lot of things related to it. I'll post an update here if I get to root the device or be able to install a modified version of the firmware.
A quick note for myself : after looking for the fastboot commands in the src, there are some fkup I am seeing, the "fastboot boot" cmd seems to point the function for "fastboot continue" ???? wth
oem and flashing commands should be available if secboot is enabled but fastboot gives out unknown command but the strings are there in the compiled uboot ?????
Code:
fastboot_register("getvar:", fb_cmd_getvar);
/*when you input cmd"flash" in host, we will rcv cmd"download" first,then the "flash",
so even if we can't see cmd"download" in host fastboot cmd list,it is also used */
fastboot_register("download:", fb_cmd_download);
fastboot_publish("version", "1.0");
fastboot_register("flash:", fb_cmd_flash);
fastboot_register("erase:", fb_cmd_erase);
fastboot_register("[COLOR="SeaGreen"]boot[/COLOR]", [COLOR="Red"]fb_cmd_continue[/COLOR]);
fastboot_register("reboot", fb_cmd_reboot);
fastboot_register("powerdown", fb_cmd_powerdown);
fastboot_register("continue", [COLOR="Red"]fb_cmd_continue[/COLOR]);
fastboot_register("reboot-bootloader", fb_cmd_reboot_bootloader);
#ifdef CONFIG_SECBOOT
fastboot_register("flashing", fb_cmd_setlockflag);
fastboot_register("getflag", fb_cmd_getlockflag);
fastboot_register("oem", fb_cmd_oemcmd);
/*add fastboot cmd for sharkl2*/
fastboot_register("getlcs", fb_cmd_getlcs);
fastboot_register("setrma", fb_cmd_setrma);
fastboot_register("getsocid", fb_cmd_getsocid);
#endif
Same problem (Itel Vision 1 Plus P36 Pro LTE L6501)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hey, I have the same kind of device with this issue. I am guessing the bootloader is not unlockable, I think this is true for probably any device with this processor. I got my hands on a reference sprd u-boot source code, which is not exactly labeled for this chipset but it seems to have a lot of things related to it. I'll post an update here if I get to root the device or be able to install a modified version of the firmware.[/B][/SIZE][/FONT]
A quick note for myself : after looking for the fastboot commands in the src, there are some fkup I am seeing, the "fastboot boot" cmd seems to point the function for "fastboot continue" ???? wth
oem and flashing commands should be available if secboot is enabled but fastboot gives out unknown command but the strings are there in the compiled uboot ?????
Code:
fastboot_register("getvar:", fb_cmd_getvar);
/*when you input cmd"flash" in host, we will rcv cmd"download" first,then the "flash",
so even if we can't see cmd"download" in host fastboot cmd list,it is also used */
fastboot_register("download:", fb_cmd_download);
fastboot_publish("version", "1.0");
fastboot_register("flash:", fb_cmd_flash);
fastboot_register("erase:", fb_cmd_erase);
fastboot_register("[COLOR="SeaGreen"]boot[/COLOR]", [COLOR="Red"]fb_cmd_continue[/COLOR]);
fastboot_register("reboot", fb_cmd_reboot);
fastboot_register("powerdown", fb_cmd_powerdown);
fastboot_register("continue", [COLOR="Red"]fb_cmd_continue[/COLOR]);
fastboot_register("reboot-bootloader", fb_cmd_reboot_bootloader);
#ifdef CONFIG_SECBOOT
fastboot_register("flashing", fb_cmd_setlockflag);
fastboot_register("getflag", fb_cmd_getlockflag);
fastboot_register("oem", fb_cmd_oemcmd);
/*add fastboot cmd for sharkl2*/
fastboot_register("getlcs", fb_cmd_getlcs);
fastboot_register("setrma", fb_cmd_setrma);
fastboot_register("getsocid", fb_cmd_getsocid);
#endif
[/QUOTE]
My device is Itel Vision 1 Plus (P36 Pro LTE) L6501.
And I'm facing same kind of problem. Can't do literally anything in fastboot.
Is there any way to contact the makers/developers for a response?
I'm already regretting my decision to buy an itel phone.
shamimurrahman19 said:
Hey, I have the same kind of device with this issue. I am guessing the bootloader is not unlockable, I think this is true for probably any device with this processor. I got my hands on a reference sprd u-boot source code, which is not exactly labeled for this chipset but it seems to have a lot of things related to it. I'll post an update here if I get to root the device or be able to install a modified version of the firmware.[/B][/SIZE][/FONT]
Click to expand...
Click to collapse
I am getting those same errors typing in the same commands. I guess it's a phone that just can be rooted? Or just not by this method?
P.S. Currently trying this on a BLU G5.
fastboot_register("getvar:", fb_cmd_getvar);
/*when you input cmd"flash" in host, we will rcv cmd"download" first,then the "flash",
so even if we can't see cmd"download" in host fastboot cmd list,it is also used */
fastboot_register("download:", fb_cmd_download);
fastboot_publish("version", "1.0");
fastboot_register("flash:", fb_cmd_flash);
fastboot_register("erase:", fb_cmd_erase);
fastboot_register("boot", fb_cmd_continue);
fastboot_register("reboot", fb_cmd_reboot);
fastboot_register("powerdown", fb_cmd_powerdown);
fastboot_register("continue", fb_cmd_continue);
fastboot_register("reboot-bootloader", fb_cmd_reboot_bootloader);
#ifdef CONFIG_SECBOOT
fastboot_register("flashing", fb_cmd_setlockflag);
fastboot_register("getflag", fb_cmd_getlockflag);
fastboot_register("oem", fb_cmd_oemcmd);
/*add fastboot cmd for sharkl2*/
fastboot_register("getlcs", fb_cmd_getlcs);
fastboot_register("setrma", fb_cmd_setrma);
fastboot_register("getsocid", fb_cmd_getsocid);
#endif
you may need rooted phone to flash via adb nd get #su permission
hello this is of interest to me. I have the decompiled binaries, editable on my linux device, for this img. i can edit the part you need. Please show me exactly how you would fix this
flaccidattempts said:
hello this is of interest to me. I have the decompiled binaries, editable on my linux device, for this img. i can edit the part you need. Please show me exactly how you would fix this
Click to expand...
Click to collapse
can you decompile the kernel and get full source code?
well i believe im pretty close
take a look. I lost the original file
How to unlock bootloader on Spreadtrum Phone - unofficial twrp
unlock bootloader on Spreadtrum Phone easy method by using the signature.bin, you can unlock any spreadtrum or UniSoc Phone
unofficialtwrp.com
this will erase all of your data. what is your phone model? and please show me how to decompile kernel binaries. I really need this.
There is no certified way to reverse source code from binary. The process in which it has been compiled has to be reversed.
Now if you want to analyze binary and cross-examine it with android from source files, then you can derive using basic lamba functions to infer missing pieces.
But..... binaries can be engineered in a way that the code becomes obvious ESPECIALLY if you have Android from Source.
Essentially, you can download android from source using google repo tool, repo the release edition, compare side by side, file for file, what is different.
I Use these linux command s
$ strings <binary file> >> myText.txt
Click to expand...
Click to collapse
$ hexdump <binary file>
Click to expand...
Click to collapse
From there i use a custom python file that 'line for line' searches for the strings, if they match, it logs the match.
once done with that, it sends it over to sublime text, which for some reason, on rare occasions resolves the binaries immediately, especially when paired with the matching strings file.
For files that are obviously encrypted, i wait till the end and brute force popular hashes, map out links, use lambda functions and use general deduction to solve to source.
If you want to learn how to analyze binaries with linux watch "malware analysis" videos on youtube
TWRP recovery for this device, tested and working. Plus magisk patched boot image for instant root and custom vbmeta for verifying the boot and recovery image, for now there seems to be no way of disabling verity check permanently on this device.

(Lenovo Smart Display 8" & 10") (Amber & Blueberry) AVB/Bootloader Unlock, Firmware

This guide supports the following devices: SD-8501F, SD-X701B, SD-X501F
How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB C cable
2. You will need fastboot drivers on your PC
3. Unplug the power cable from your device
4. Remove the silicone cover from the bottom right of your device (Might be hard it has adhesive on the back)
5. Plug the USB C cable into the now revealed USB-C port
6. Hold the volume - button and plug in the power cord keep holding volume - for about 10-15 seconds (It is slow to boot to fastboot) Smart plugs or switches help so you don't damage the ports by replugging them constantly.
7. Keep holding volume - for about 10-15 seconds (It is slow to boot to fastboot)
8. Once the device shows up on your computer in a terminal run the following command:
Code:
fastboot flashing unlock
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Word of warning doing this causes the stock OS not to boot fully.
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB unlock zip
2. Run either the avb-unlock.bat or this command in a terminal
Code:
at_auth_unlock.exe creds\
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command or the Avb_lock.bat:
Code:
fastboot oem at-lock-vboot!
Now that you are AVB unlocked you can flash the firmware/partitions from fastboot using the flash-all scripts located in the firmware zips.
Blueberry 10" Firmware:
Spoiler
Stock Debug firmware (Allows you to OTA to latest firmware if on the user slot and avb locked, but adb is unauthorized so you can't edit files on this one. ADB is intact on the other slot if you change over to it)
Android 8.1 Debug Firmware (Do not AVB lock on this firmware it uses different keys but you can fastboot/edl flash other firmware to recover if you do):
Android 7.0 Debug firmware (Select the Legacy unlock option if avb unlocking)
Amber 8" Firmware:
Spoiler
UNTESTED FLASH AT YOUR OWN RISK (But should be fine report back if it works)
Stock Debug Firmware
Unified 8" and 10" Debug/Development firmware (Only tested on Blueberry/10" but these should work on Amber/8" as well)
Spoiler
Android 8.1 Debug Firmware (Do not AVB lock on this firmware it uses different keys but you can fastboot/edl flash other firmware to recover if you do):
Android 7.0 Debug firmware (Select the Legacy unlock option if avb unlocking):
AVB Unlock tool:
Here
Amber and Blueberry EDL Firehose:
Here
The firmware provided allows you to have adb and adb root on either debug or user. But the downside is with avb off the device can't access its Tee keys so the user firmware will not finish setup. But you can still install other apps and use root which allows you to fully turn off the security restrictions to allow you to edit files on the device. The commands you need to run are these:
Spoiler
Code:
adb root
adb disable-verity
adb reboot
adb root
adb remount
adb shell setenforce 0
Disable-verity will last until you factory reset or run adb enable-verity
Useful adb and android things commands:
Spoiler
Brings up the default launcher selector screen (If a launcher you try opens and then closes it is not supported by Android Things. You will need one that does not have Widget support. Like KISS Launcher)
Code:
adb shell am start -a android.intent.action.MAIN -c android.intent.category.HOME
Lists installed app package names
Code:
adb shell pm list packages
Change the -p to whichever package name you want to launch it emulates clicking the apps icon in launcher so some system apps don't support it.
Code:
adb shell monkey -p PACKAGE_NAME -c android.intent.category.LAUNCHER 1
Will launch the android things settings page
Code:
adb shell monkey -p com.android.iotlauncher -c android.intent.category.HOME 1
This will launch the google setupwizard/launcher
Code:
adb shell monkey -p com.google.assistant.core -c android.intent.category.LAUNCHER 1
Seems to soft reboot the android things system, but not actually reboot the device proper
Code:
adb shell monkey -p com.google.android.apps.quartz -c android.intent.category.LAUNCHER 1
Launches camera app
Code:
adb shell am start -n com.android.camera2/com.android.camera.CameraActivity
Various Screenshots:
Spoiler
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Is there another forum, or talk about what exactly we can do with this fw?? Thanks. Also my comp not seeing the device in fastboot. Yes I have adb and fastboot tools.
Also not seeing the device in fastboot while holding Vol + and plugging in the power. Tried Vol -, and got the new USB device notification, but holding Vol - doesn't seem to get to fastboot, and it'll just boot to the normal OS.
agentdr8 said:
Also not seeing the device in fastboot while holding Vol + and plugging in the power. Tried Vol -, and got the new USB device notification, but holding Vol - doesn't seem to get to fastboot, and it'll just boot to the normal OS.
Click to expand...
Click to collapse
I can see other phones in fastboot, just not this smart display. WTF? I think this is a BS thread.
bs3pro said:
Is there another forum, or talk about what exactly we can do with this fw?? Thanks. Also my comp not seeing the device in fastboot. Yes I have adb and fastboot tools.
Click to expand...
Click to collapse
agentdr8 said:
Also not seeing the device in fastboot while holding Vol + and plugging in the power. Tried Vol -, and got the new USB device notification, but holding Vol - doesn't seem to get to fastboot, and it'll just boot to the normal OS.
Click to expand...
Click to collapse
bs3pro said:
I can see other phones in fastboot, just not this smart display. WTF? I think this is a BS thread.
Click to expand...
Click to collapse
Very sorry about the delay, it seems I made a minor typo in the instructions. I said to do Vol+ for fastboot when it is really Vol-. If you do not get a fastboot device after doing that open up device manager and install the google usb driver on the missing driver device. This method very much does work, I had someone test it on the 8" as well as a few people on their 10" and 7" devices before I released it on XDA.
deadman96385 said:
Very sorry about the delay, it seems I made a minor typo in the instructions. I said to do Vol+ for fastboot when it is really Vol-. If you do not get a fastboot device after doing that open up device manager and install the google usb driver on the missing driver device. This method very much does work, I had someone test it on the 8" as well as a few people on their 10" and 7" devices before I released it on XDA.
Click to expand...
Click to collapse
Will give it another go. Thanks for the reply.
deadman96385 said:
Very sorry about the delay, it seems I made a minor typo in the instructions. I said to do Vol+ for fastboot when it is really Vol-. If you do not get a fastboot device after doing that open up device manager and install the google usb driver on the missing driver device. This method very much does work, I had someone test it on the 8" as well as a few people on their 10" and 7" devices before I released it on XDA.
Click to expand...
Click to collapse
ok, im in fastboot!
AND....I get this. ugh
C:\Users\Owner>fastboot flashing unlock FAILED (remote: 'oem unlock is not allowed') fastboot: error: Command failed
bs3pro said:
ok, im in fastboot!
AND....I get this. ugh
C:\Users\Owner>fastboot flashing unlock FAILED (remote: 'oem unlock is not allowed') fastboot: error: Command failed
Click to expand...
Click to collapse
Try and just doing the avb part, it seems on some newer firmware's its tied into avb unlock/lock so when that is unlocked it unlocks the BL.
deadman96385 said:
If you do not get a fastboot device after doing that open up device manager and install the google usb driver on the missing driver device.
Click to expand...
Click to collapse
Holding Vol- makes a QUSB_BULK (VID 05C6, PID 9008) device show up in Device Manager, which I think is EDL mode and not bootloader? I tried changing it to the Android Bootloader Interface driver but fastboot never seems to find it.
Holding Vol+ makes it boot to what seems to be a missing recovery mode, with the "dead" Android and the red exclamation point icon, but that doesn't lead to any USB devices being seen.
Any thoughts?
agentdr8 said:
Holding Vol- makes a QUSB_BULK (VID 05C6, PID 9008) device show up in Device Manager, which I think is EDL mode and not bootloader? I tried changing it to the Android Bootloader Interface driver but fastboot never seems to find it.
Holding Vol+ makes it boot to what seems to be a missing recovery mode, with the "dead" Android and the red exclamation point icon, but that doesn't lead to any USB devices being seen.
Any thoughts?
Click to expand...
Click to collapse
You don't have bootloader drivers installed
i unlocked, and flashed the universal fw to my 8inch. Now i just have black screen. It always just reboots to fastboot.
EDIT!! The flashall.bat file is corrupt!!!!!!! Need to edit out the format userdata line, otherwise the flash fails!!!
When try to flash the firmware fail with error mke2fs: invalid option -- 'b'
Error: Unknown option ?
If I coment the lines:
#if [[ "${WIPE_USER_DATA}" = true ]]; then
# ARGS+=( format userdata )
#fi
Don't fail, apparently it works fine, I can set it up, connect to google home app.
After this, the update screen appears, when it reaches 100% it restarts and starts the update screen again. And this in an infinite loop.
Any idea how I can fix it? Or just install any linux ?
Can I perform this on Linux PC? I guess not since it requires running .exe file.
I have SD8501F I was able to get it into fastboot mode on both linux and windows pc, but that's about it.
On linux it was recognized right away, on windows I had to manually install google android bootloader driver once it popped in device manager.
It failed to unlock.
fastboot devices return this:
HUA0777K fastboot
--------------------------------------
fastboot flashing unlock:
...
FAILED (remote: oem unlock is not allowed)
finished. total time: 0.012s
----------------------------------------------------
at_auth_unlock.exe creds\
...
FAILED (status read failed (Too many links))
finished. total time: 0.000s
Command 'fastboot oem at-get-vboot-unlock-challenge' returned non-zero exit status 1
No matter what I try, I can't get to the fastboot from neither linux nor windows. I have fastboot drivers installed on windows, I also used fastboot on linux recently with other device. I can get to that broken bootloader while holding vol up without an issue. But holding vol down does not do anything, it just boots to system as usual
CatBug said:
No matter what I try, I can't get to the fastboot from neither linux nor windows. I have fastboot drivers installed on windows, I also used fastboot on linux recently with other device. I can get to that broken bootloader while holding vol up without an issue. But holding vol down does not do anything, it just boots to system as usual
Click to expand...
Click to collapse
I figured at least on my device 10-15sec holding vol down is too much it goes into recovery and leaves it and continue normal boot.
Screen is complete black in fastboot mode, so it's hard to tell when it in.
It's easier on windows as you can see sound when usb is recognized. Then you release vol down.
Basically connecting usb cable hold vol down and plug power, in 2-5sec you will hear usb recognized on windows. Release vol down. And now on windows i had to go to device manager and install driver. On linux it just worked.
Trick is to not hold vol down for too long
bg.stefan90 said:
I figured at least on my device 10-15sec holding vol down is too much it goes into recovery and leaves it and continue normal boot.
Screen is complete black in fastboot mode, so it's hard to tell when it in.
It's easier on windows as you can see sound when usb is recognized. Then you release vol down.
Basically connecting usb cable hold vol down and plug power, in 2-5sec you will hear usb recognized on windows. Release vol down. And now on windows i had to go to device manager and install driver. On linux it just worked.
Trick is to not hold vol down for too long
Click to expand...
Click to collapse
That was a perfect advice, mate, thx a lot!
As for other people, fastboot flashing unlock failed but I managed to run at_auth_unlock.exe creds\ successfuly. Then I commented that format user data line and ran the flash all script.
Now the device boots to fastboot everytime. What should I do now?
Hello, I've flashed firmware with "success" but my device (SmartDisplay 10'') is not reconized by the command adb devices... I'm stuck there after many tries !
I use fastboot and ADB with linuxMint.
Any ideas ?
Axh3ll said:
Hello, I've flashed firmware with "success" but my device (SmartDisplay 10'') is not reconized by the command adb devices... I'm stuck there after many tries !
I use fastboot and ADB with linuxMint.
Any ideas ?
Click to expand...
Click to collapse
Does it get recognized by "fastboot devices"? If so then your device is booting to bootloader after flashing the firmware. Just like mine.
CatBug said:
Does it get recognized by "fastboot devices"? If so then your device is booting to bootloader after flashing the firmware. Just like mine.
Click to expand...
Click to collapse
Yes it is reconized in fastboot devices, I never success to have it in ADB...

Categories

Resources