Related
Has anyone found a method for restoring Serial Number and DeviceID after recovering a bricked NT? I've recovered, but I can't re-register with B&N due to missing SN/ID? Not really finding any answers in the forums so far. If you have some info or can point me in the right direction, I'd be greatful. (yes I have been trying to look through the forums, just not seeing an answer, though it seems many have asked).
shawnshine2 said:
Has anyone found a method for restoring Serial Number and DeviceID after recovering a bricked NT? I've recovered, but I can't re-register with B&N due to missing SN/ID? Not really finding any answers in the forums so far. If you have some info or can point me in the right direction, I'd be greatful. (yes I have been trying to look through the forums, just not seeing an answer, though it seems many have asked).
Click to expand...
Click to collapse
I would have expected a deregister and reset would have restored your sn.
Beyond that I have found the sn at two locations.
/rom/devconf/SerialNumber
/rom/devconf/DeviceID
these are both text files; there may be others but this is what I found
your sn is located where your sdcard plugs in if you don't have it otherwise
I have not tried to edit these files so I can't suggest you do.
Sorry not much help but that's all I have.
I lost mine once but it returned after I replaced the restore partition and did a reset.
added info:
I pulled both files listed above and checked them with a hex editor and they contain the sn and only the sn - no extra characters of any kind (16 bytes only) permissions on are 440 and 440.
Thanks for the bit o' info. Unfortunately it's not as simple as that. The entire partition table had been deleted thus removing all of the data for the NT. I was able to recreate the partitions, and using meghd00t's & CRE's recovery method got v.1.4.0 B&N reinstalled. Now I'm not able to re-register the device with B&N due to missing DeviceID/Serial. I'm still looking around seeing if I can find a way to re-enter the info. I haven't had much luck in finding an easy way to do it, much less a hard way.
Serial number resolved / Now need Model Number & MAC location
It looks like I only had one file "/rom/devconf/DeviceID" that was only 8 zeros. I pulled the file with ADB, added my SN, saved and pushed it back. I took the saved file, renamed it to SerialNumber and did a push to rom as well.
C:\android-sdk-windows\platform-tools>adb remount
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
remount succeeded
C:\android-sdk-windows\platform-tools>adb devices
List of devices attached
0000000000000000 recovery
C:\android-sdk-windows\platform-tools>adb pull /rom/devconf/DeviceID
1 KB/s (8 bytes in 0.007s)
(here I pulled the file: notice it's only 8bytes instead of 16. Once I had the file my pc, I edited it with Notepad and added my 16digit serial, then saved)
C:\android-sdk-windows\platform-tools>adb push DeviceID /rom/devconf
2 KB/s (16 bytes in 0.007s)
(here I pushed the file back to the nook. notice it is now 16bytes)
C:\android-sdk-windows\platform-tools>adb push SerialNumber /rom/devconf
3 KB/s (16 bytes in 0.004s)
(here I renamed the file on my pc as SerialNumber then pushed it to the rom)
C:\android-sdk-windows\platform-tools>adb shell
~ # ls
ls
boot etc sd-ext
bootdata init sdcard
cache init.rc sys
data proc system
datadata res tmp
default.prop rom ueventd.acclaim.rc
dev root ueventd.goldfish.rc
emmc sbin ueventd.rc
~ # cd rom
cd rom
/rom # cd devconf
cd devconf
/rom/devconf # ls
ls
DeviceID SerialNumber
/rom/devconf # cat DeviceID
cat DeviceID
20202400########/rom/devconf #
/rom/devconf # cat SerialNumber
cat SerialNumber
20202400########/rom/devconf #
/rom/devconf # exit
exit
C:\android-sdk-windows\platform-tools>adb kill-server
C:\android-sdk-windows\platform-tools>
Now the Nook registers the Serial Number. What I need now is to find out where the MAC address and Model number should be listed (located). If I can get that added, I think I'll be good to go. At least I'm now half way there!
shawnshine2 said:
It looks like I only had one file "/rom/devconf/DeviceID" that was only 8 zeros. I pulled the file with ADB, added my SN, saved and pushed it back. I took the saved file, renamed it to SerialNumber and did a push to rom as well.
C:\android-sdk-windows\platform-tools>adb remount
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
remount succeeded
C:\android-sdk-windows\platform-tools>adb devices
List of devices attached
0000000000000000 recovery
C:\android-sdk-windows\platform-tools>adb pull /rom/devconf/DeviceID
1 KB/s (8 bytes in 0.007s)
(here I pulled the file: notice it's only 8bytes instead of 16. Once I had the file my pc, I edited it with Notepad and added my 16digit serial, then saved)
C:\android-sdk-windows\platform-tools>adb push DeviceID /rom/devconf
2 KB/s (16 bytes in 0.007s)
(here I pushed the file back to the nook. notice it is now 16bytes)
C:\android-sdk-windows\platform-tools>adb push SerialNumber /rom/devconf
3 KB/s (16 bytes in 0.004s)
(here I renamed the file on my pc as SerialNumber then pushed it to the rom)
C:\android-sdk-windows\platform-tools>adb shell
~ # ls
ls
boot etc sd-ext
bootdata init sdcard
cache init.rc sys
data proc system
datadata res tmp
default.prop rom ueventd.acclaim.rc
dev root ueventd.goldfish.rc
emmc sbin ueventd.rc
~ # cd rom
cd rom
/rom # cd devconf
cd devconf
/rom/devconf # ls
ls
DeviceID SerialNumber
/rom/devconf # cat DeviceID
cat DeviceID
20202400########/rom/devconf #
/rom/devconf # cat SerialNumber
cat SerialNumber
20202400########/rom/devconf #
/rom/devconf # exit
exit
C:\android-sdk-windows\platform-tools>adb kill-server
C:\android-sdk-windows\platform-tools>
Now the Nook registers the Serial Number. What I need now is to find out where the MAC address and Model number should be listed (located). If I can get that added, I think I'll be good to go. At least I'm now half way there!
Click to expand...
Click to collapse
Hang in there, this can be done. With cwm I formatted everything including rom and I was able to recover. I'll check on mac and get back so just remain positive.
How to find your Original B&N Nook Tablet MAC Address
I don't know if there is a way to find the Nook Tablet's original MAC address using ADB, but as far as I could find, IF you had ever flashed a version of CM7 onto your device the MAC address is given as 08:00:28:12:03:58. So unless you wrote down your original MAC address before flashing, you will end up with this one. I however do remember a little trick with pc's. When you have a bad nic card in a pc and your dealing with Firewalls and Routers (as I do for work) you can open the system and find the MAC address either printed directly on the board or listed on a sticker that's attached. So I did a little bit of rummaging through some YouTube videos and found a tear down of the NT. Lo and behold, right inside the back cover is a sticker with the NT's serial number AND MAC address. The video for cracking open your nook is here: http://www.youtube.com/watch?v=3SVO2JCgqPM And the website for the tear down is here: http://www.ifixit.com/Teardown/Nook-Tablet-Teardown/7121/1
But, if you don't have a T5 torq's screwdriver to remove the two screws at the SDcard door, if you are very very very careful and gentle, you can still use a tiny (and I mean tiny) flat head and gently insert at the bottom of the back panel right at the middle point and gently pry the back off working your screwdriver in a clockwise direction. Just don't try to pop that lower right hand corner open, you will break the case. (you been warned). Once you have about 3 quarters of the back popped off gently lift up the back cover and peer inside, you should see the SN & MAC address label. Copy the numbers. Replacing the cover back you need to be just as gentle and you want to work it back in going in a counterclockwise motion and only use the screwdriver to help work the last one or two tabs back in. If you are careful enough you won't even know that it was ever open. NOTE: There are two tiny gray paper stickers over the two screws at the SDcard door. If you remove the two papers, and expose the screws, you may have a hard time getting warrenty work done. So just know that before you start futzing with it.
Now if I can just find out where the heck the MAC address is located in the B&N v.1.4.0 software.
shawnshine2 said:
It looks like I only had one file "/rom/devconf/DeviceID" that was only 8 zeros. I pulled the file with ADB, added my SN, saved and pushed it back. I took the saved file, renamed it to SerialNumber and did a push to rom as well.
C:\android-sdk-windows\platform-tools>adb remount
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
remount succeeded
C:\android-sdk-windows\platform-tools>adb devices
List of devices attached
0000000000000000 recovery
C:\android-sdk-windows\platform-tools>adb pull /rom/devconf/DeviceID
1 KB/s (8 bytes in 0.007s)
(here I pulled the file: notice it's only 8bytes instead of 16. Once I had the file my pc, I edited it with Notepad and added my 16digit serial, then saved)
C:\android-sdk-windows\platform-tools>adb push DeviceID /rom/devconf
2 KB/s (16 bytes in 0.007s)
(here I pushed the file back to the nook. notice it is now 16bytes)
C:\android-sdk-windows\platform-tools>adb push SerialNumber /rom/devconf
3 KB/s (16 bytes in 0.004s)
(here I renamed the file on my pc as SerialNumber then pushed it to the rom)
C:\android-sdk-windows\platform-tools>adb shell
~ # ls
ls
boot etc sd-ext
bootdata init sdcard
cache init.rc sys
data proc system
datadata res tmp
default.prop rom ueventd.acclaim.rc
dev root ueventd.goldfish.rc
emmc sbin ueventd.rc
~ # cd rom
cd rom
/rom # cd devconf
cd devconf
/rom/devconf # ls
ls
DeviceID SerialNumber
/rom/devconf # cat DeviceID
cat DeviceID
20202400########/rom/devconf #
/rom/devconf # cat SerialNumber
cat SerialNumber
20202400########/rom/devconf #
/rom/devconf # exit
exit
C:\android-sdk-windows\platform-tools>adb kill-server
C:\android-sdk-windows\platform-tools>
Now the Nook registers the Serial Number. What I need now is to find out where the MAC address and Model number should be listed (located). If I can get that added, I think I'll be good to go. At least I'm now half way there!
Click to expand...
Click to collapse
I'm only finding the mac at one location (seems to easy) but that may be all.
/rom/devconf/MACAddress 12 bytes 440 permissions no colons used in this file just the address all typed together.
We must have been typing together. I run cm7 internal final and have my mac as from the factory. What you mentioned may have related to the first version.
I must have been asleep earlier. Model no
/rom/devconf/ModelNuumber 7 bytes permissions 440 - (BNTV250)
One more step done, another one pops up.
Add the files and I got that knocked out but still having an issue. My devconf directory only had the one original file. I've added the ones you listed and now I have the Serial, Model, and MAC all showing on the Device Info tab. I think there has to be a second MAC location as when I get the Wifi page of the setup screens, it's still listing the old bad MAC address. But It does let me connect to my router. But when it goes to register I still get the error screen. When I click Device Info button, it shows all my info in Green now, but shows Battery: ! 100% in red. I reset battery stats, but nothing changed. I'll keep cracking away at it.
shawnshine2 said:
Add the files and I got that knocked out but still having an issue. My devconf directory only had the one original file. I've added the ones you listed and now I have the Serial, Model, and MAC all showing on the Device Info tab. I think there has to be a second MAC location as when I get the Wifi page of the setup screens, it's still listing the old bad MAC address. But It does let me connect to my router. But when it goes to register I still get the error screen. When I click Device Info button, it shows all my info in Green now, but shows Battery: ! 100% in red. I reset battery stats, but nothing changed. I'll keep cracking away at it.
Click to expand...
Click to collapse
I'm getting a different sense of where we began than I was in the beginning. Are you running CM7 and if so is it from the sdcard?
As a note /rom/devconf includes seventeen files total in my configuration (cm7 alpha final internal - flashed from 1.4.0). If you are running cm7 from sdcard I'll restore to 1.4.0 and see if I can help from there.
Restored all the info / but I think it's a fruitless quest
Whole story long........ I started out with a Nook Tablet that had no partitions, I acquired it that way. It had nothing, wouldn't even boot up. So I have been playing with it for two weeks trying to get it unbricked. After many tries and countless hours, using adamoutler, veronica, and meghd00t & EMR's forum posts I was able to get it running with the SDcard (CM7). I had to recreate the partitions in ADB. I struggled with the whole boot w/wo usb cable & sdcard for a long time. Finally on Friday I used EMR's recovery image and got it where I could finally make some headway and was finally able to boot normally. I used the internal restore image that Veronica posted but was unable to register with B&N. Thus began the search for Serial Numbers & MAC Addresses. The funny thing about that image (and I don't know if it's just because I never had the files to begin with) when you had told me about all the files in /rom/devconf I was confused cause I had only the one empty file. I recreated the files you suggested but still couldn't register. So I went back to one of Veronica's other posts about restoring partition images using the dd command. I copied partition 5, 6, 7, 8, and 9 using her partition images and all of the missing information was restored. I just had to edit the SerialNumber, DeviceID, MACAddress file and I used xvi32 hex editor to add my original MAC address back into the WiFiBackupCalibration file. After all of that, I re-flashed the original recovery software and did a complete restore of the B&N software back to version 1.0.0 . I am sad to report that I am still unable to register it back with B&N. Not a really a big deal, I just wanted to see if I could get it back to as close to original as I could. Using the bypass registration technique shows that there are several additional individual "keys" (hash private key and public key)that are locked to the device from the factory (most likely to keep people from doing what we are doing) and if what is on the device doesn't match what they have in the system from the factory then it refuses the registration. (my theory anyway). So unless someone knows something I don't, that's what I'm going with. One thing I have noticed is that on the Registration Error page, just below the Device Info button is a code B-CM1004. I'm curious if that is an error code and if it is what it might mean? If I find anything else I'll post back. Moral of the story is that I've since flashed CM7 internally and I now have my original MAC address. (always a silver lining).
shawnshine2 said:
Whole story long........ I started out with a Nook Tablet that had no partitions, I acquired it that way. It had nothing, wouldn't even boot up. So I have been playing with it for two weeks trying to get it unbricked. After many tries and countless hours, using adamoutler, veronica, and meghd00t & EMR's forum posts I was able to get it running with the SDcard (CM7). I had to recreate the partitions in ADB. I struggled with the whole boot w/wo usb cable & sdcard for a long time. Finally on Friday I used EMR's recovery image and got it where I could finally make some headway and was finally able to boot normally. I used the internal restore image that Veronica posted but was unable to register with B&N. Thus began the search for Serial Numbers & MAC Addresses. The funny thing about that image (and I don't know if it's just because I never had the files to begin with) when you had told me about all the files in /rom/devconf I was confused cause I had only the one empty file. I recreated the files you suggested but still couldn't register. So I went back to one of Veronica's other posts about restoring partition images using the dd command. I copied partition 5, 6, 7, 8, and 9 using her partition images and all of the missing information was restored. I just had to edit the SerialNumber, DeviceID, MACAddress file and I used xvi32 hex editor to add my original MAC address back into the WiFiBackupCalibration file. After all of that, I re-flashed the original recovery software and did a complete restore of the B&N software back to version 1.0.0 . I am sad to report that I am still unable to register it back with B&N. Not a really a big deal, I just wanted to see if I could get it back to as close to original as I could. Using the bypass registration technique shows that there are several additional individual "keys" (hash private key and public key)that are locked to the device from the factory (most likely to keep people from doing what we are doing) and if what is on the device doesn't match what they have in the system from the factory then it refuses the registration. (my theory anyway). So unless someone knows something I don't, that's what I'm going with. One thing I have noticed is that on the Registration Error page, just below the Device Info button is a code B-CM1004. I'm curious if that is an error code and if it is what it might mean? If I find anything else I'll post back. Moral of the story is that I've since flashed CM7 internally and I now have my original MAC address. (always a silver lining).
Click to expand...
Click to collapse
I haven't abandoned your problem but from here it will be much slower to find a path unless someone with prior knowledge comments. In the meantime you may be able to register B&N from CM7 with NOOK for Android by B&N. https://play.google.com/store/search?q=nook&c=apps
I haven't made any progress toward clearing your problem. If it were mine I would think seriously about doing a CWM backup, doing this recovery “[UnBrick]TOTAL WIPE and reflash back to 1.4.0 via Ubuntu Recovery --Now Easier!!!!”.http://forum.xda-developers.com/showthread.php?t=1470910
Once that is completed reboot into recovery and allow stock 1.4.0 recovery. You could always restore your backup if this failed. If reluctant to try this then you can try NOOK for Android by B&N from Google Play(Android Market) and maybe get registered with your current setup.https://play.google.com/store/search?q=nook+for+android
I'm sorry but this is all I can formulate now.
You guys are way more knowledgeable than me, but, is it possible that you can't register your Tablet, shawnshine2, because the last owner didn't deregister it?
smarcin said:
You guys are way more knowledgeable than me, but, is it possible that you can't register your Tablet, shawnshine2, because the last owner didn't deregister it?
Click to expand...
Click to collapse
Of course it is possible. Thanks for replying 3 heads are better than 2.
I have a theory that I use to help keep me grounded so I can't agree that we know more.
Want to hear my theory? Well I'll tell you either way! I may know more about some subject but you will know more about others; it takes all of us to make the world a better place.
Thanks for your input and I'm throwing a thanks your way.
And finally the saga ends ...for better or worse.
So to give a final ( ? ) update here, after going through every forum post I could find and even trying a few things not covered I finally gave in and called customer support. Since I bought this used and completely wiped out, I didn't expect that they would be much help. I was surprised. The CSR asked a few questions about what the problem was and I give it to him straight. He was surprisingly understanding. He looked up the serial number and said it was still registered to the previous owner, but it was also still under warranty. Here he was little cautious with me, but I give him all of my buddies information, name, address, phone number, email. With that, he was a little more comfortable. He said that he needed to De-register it on their servers and then for me to try again in 15 minutes. Unfortunately, this did not fix it. I called him back and he passed me to the technical desk. They in-turn had me try to do a "hard reset" (as if I hadn't done that 100 times already). When that failed, he said that the only thing they could do was to swap it out. I figured they'd say no since I wasn't the original owner, but they actually went ahead and sent the email with the return voucher to my buddy. He was gracious enough to print it out for me. Went to the store later in the afternoon and they switched it out no questions asked with a cert. pre-owned. But in true sales-people style, they talked me into buying a new case! So, I am at a loss to say what the problem was but B&N really didn't seem to care. They just wanted to make sure I was happy with their customer service, which, at the end of the day, I am really grateful for. I'm sorry I don't have the answer that can solve this problem for others, but honesty with B&N at least got me a replacement with almost no hassle. So, if nothing else, you can always give that a shot.
shawnshine2 said:
So to give a final ( ? ) update here, after going through every forum post I could find and even trying a few things not covered I finally gave in and called customer support. Since I bought this used and completely wiped out, I didn't expect that they would be much help. I was surprised. The CSR asked a few questions about what the problem was and I give it to him straight. He was surprisingly understanding. He looked up the serial number and said it was still registered to the previous owner, but it was also still under warranty. Here he was little cautious with me, but I give him all of my buddies information, name, address, phone number, email. With that, he was a little more comfortable. He said that he needed to De-register it on their servers and then for me to try again in 15 minutes. Unfortunately, this did not fix it. I called him back and he passed me to the technical desk. They in-turn had me try to do a "hard reset" (as if I hadn't done that 100 times already). When that failed, he said that the only thing they could do was to swap it out. I figured they'd say no since I wasn't the original owner, but they actually went ahead and sent the email with the return voucher to my buddy. He was gracious enough to print it out for me. Went to the store later in the afternoon and they switched it out no questions asked with a cert. pre-owned. But in true sales-people style, they talked me into buying a new case! So, I am at a loss to say what the problem was but B&N really didn't seem to care. They just wanted to make sure I was happy with their customer service, which, at the end of the day, I am really grateful for. I'm sorry I don't have the answer that can solve this problem for others, but honesty with B&N at least got me a replacement with almost no hassle. So, if nothing else, you can always give that a shot.
Click to expand...
Click to collapse
Great! I'm glad you didn't wait any longer on me as I was stumped.
Happy computing.
Not wanting to give up but may have to
After hours and hours of searching and reading, I must say this post makes me kind of sad. I haven't taken the time to reset my serial number and MAC, but this post makes me think "why bother". I really love my Nook & I was trying to unRoot and just go back to stock. Somewhere along the way I must've clicked something wrong and hosed it all up. AdamOutler's Total Wipe method was the only thing I could find to get me out of a CWM bootloop. Mine is right at a year old (Christmas gift last year), so I seriously doubt B&N will be as forgiving with me.
Just adding to this thread in case someone has figured out anything since April. I also messaged Adam to see if he had any thoughts. Sadness is setting in.
Vol4Ever said:
After hours and hours of searching and reading, I must say this post makes me kind of sad. I haven't taken the time to reset my serial number and MAC, but this post makes me think "why bother". I really love my Nook & I was trying to unRoot and just go back to stock. Somewhere along the way I must've clicked something wrong and hosed it all up. AdamOutler's Total Wipe method was the only thing I could find to get me out of a CWM bootloop. Mine is right at a year old (Christmas gift last year), so I seriously doubt B&N will be as forgiving with me.
Just adding to this thread in case someone has figured out anything since April. I also messaged Adam to see if he had any thoughts. Sadness is setting in.
Click to expand...
Click to collapse
Have you looked at this thread?
Yes. Read in detail. It tells you how to retrieve serial number, but that apparently doesn't get you past the B&N checks that occur when setting up the tablet. It still locks up and gives the number to tech support. Without completing the activation step, you can't access the B&N store or your previously purchased content.
Vol4Ever said:
Yes. Read in detail. It tells you how to retrieve serial number, but that apparently doesn't get you past the B&N checks that occur when setting up the tablet. It still locks up and gives the number to tech support. Without completing the activation step, you can't access the B&N store or your previously purchased content.
Click to expand...
Click to collapse
My reading of that thread's first post is it's about how to put tablet's serial number (which can be found on the back of the micro-SD card slot cover) back into the NT's relevant system info files. The "Retrieve" word in the OP's thread title is, unfortunately, misleading.
Out of curiosity couldn't we just use a command line to mount the system as R/W and push Busybox, Su app and Su binary to the proper locations.
Sent from my ADR6410LVW using xda app-developers app
Or atleast use a recovery exploit
Sent from my ADR6410LVW using xda app-developers app
No the system wont allow it... We have to find a way in right now the system just overrides everything
Sent from my ADR6410LVW using xda app-developers app
Have you guys tried this?
http://forum.xda-developers.com/showthread.php?t=1706588
-viperboy- said:
Have you guys tried this?
http://forum.xda-developers.com/showthread.php?t=1706588
Click to expand...
Click to collapse
It has been attempted.
http://forum.xda-developers.com/showthread.php?p=30394502&highlight=debugfs#post30394502
What about writing a custom hboot and hex editing it as an upgrade? It's been successful on other devices example is the blackrose hboot for nexus, incredible s and others
Sent from my ADR6410LVW using xda app-developers app
IceDragon59 said:
It has been attempted.
http://forum.xda-developers.com/showthread.php?p=30394502&highlight=debugfs#post30394502
Click to expand...
Click to collapse
RevolutionaryPC said:
What about writing a custom hboot and hex editing it as an upgrade? It's been successful on other devices example is the blackrose hboot for nexus, incredible s and others
Sent from my ADR6410LVW using xda app-developers app
Click to expand...
Click to collapse
check out viperboy's thread in general hes looking for testers/help to try some things
RevolutionaryPC said:
What about writing a custom hboot and hex editing it as an upgrade? It's been successful on other devices example is the blackrose hboot for nexus, incredible s and others
Sent from my ADR6410LVW using xda app-developers app
Click to expand...
Click to collapse
Could potentially work, but that is VERY risky as it can perma-brick the device.
... I'm going to try the replacing the recovery.IMG in stock ruu with an open source One..if it goes sideways I've always got the 15 month warranty
Sent from my ADR6410LVW using xda app-developers app
RevolutionaryPC said:
... I'm going to try the replacing the recovery.IMG in stock ruu with an open source One..if it goes sideways I've always got the 15 month warranty
Sent from my ADR6410LVW using xda app-developers app
Click to expand...
Click to collapse
Good luck
RevolutionaryPC said:
... I'm going to try the replacing the recovery.IMG in stock ruu with an open source One..if it goes sideways I've always got the 15 month warranty
Sent from my ADR6410LVW using xda app-developers app
Click to expand...
Click to collapse
That's not going to work man. It checks the signature before you flash it.
-viperboy- said:
Have you guys tried this?
http://forum.xda-developers.com/showthread.php?t=1706588
Click to expand...
Click to collapse
I tried the debugfs trick with no success. I studied all the methods described in the following threads as well. I even have a rooted TF101 and did some comparisons on the file structures, haven't found anything useful there.
http://forum.xda-developers.com/showthread.php?t=1704209
http://forum.xda-developers.com/showthread.php?t=1622628
I'm no debugfs expert, though, so I might have missed something. I was seeing permission denied when debugfs tried to get write access. I suspect this is because the system wasn't mounting the symlink target as R/W on boot like on other devices. I can try it some more if you have ideas I might have missed though... I still have all the binaries pushed via adb to the device to /data/local/tmp/ (which, on this device, is a folder where shell user can write; though, unfortunately, I can't move or rename the folder itself, likely due to parent permissions). All my symlink attempts have been to targets inside this dir since I can't find any others that will allow it. For example:
Code:
ln -s /dev/block/mmcblk0p33 /data/local/tmp/mmcblk0p33
If we knew a dir on /data that gives shell user or adb group enough permission to symlink to /system with write access, then that trick might still work. Only /data partition (or perhaps /cache or /devlog) will work since they are ext4... All other partitions are types that don't support symlinks.
On Ubuntu 12.04, I tried mounting partitions from the RUU. I can mount /system on my machine, but I still can't figure out how to mount /data outside of the device. I thought this might give me a way to list all contents of /data on a system where I have root already, and then I could try each one as a symlink target on the device. So far I'm not having luck with that approach... Anyone with more Rom knowledge know how I can do that? Ideally, I'd like to mount the ENTIRE filesystem for this device (/data in particular) from the RUU onto my Ubuntu system and poke around more.
On a separate type of attempt, I dug into some scripts inside the /system dir (from the RUU, but mounted on Ubuntu 12.04 so I can view everything). I'm looking in /system/etc/init.qcom.dsps_links.sh, line 77. I see that, if no results are returned trying to list /firmware_dsps/dsps*, then the system will be remounted RW long enough to create the symlinks. A similar case statement also exists in init.qcom.modem_links.sh, for the same reason (a check if links are missing, then a remount in RW mode to create them). How we exploit that is another consideration. Anyone know how we might take advantage of this? It seems like it will be difficult without (a) removing the symlinks, and (b) "pausing" the bootup process just after that step long enough to push su binary to /system/xbin. Since we would already need root to do either of those things, I'm not convinced this is even worth pursuing unless somebody has ideas I'm missing.
Any other ideas? One other I've been looking at is setting ro.kernel.qemu=1 in a file called /data/local.prop. This would make the OS boot as if it's an AVD, thus giving shell root by default. Again, you need to be rooted already (or somehow elevated, e.g. via some other exploit) to write this file, so maybe another dead end here.
Also, I'm sure I'm not the first to try this, but I've also checked all known exploits using the "X-Ray" app at http://www.xray.io/. Normally, I'd be quite pleased to learn that I'm patched against all those exploits. Unfortunately, not this time.
And then, of course, there was my attempt to use mempodroid (before I discovered X-Ray and learned that it's not vulnerable). The kernel version "should" support it, but they must have applied Linus' patch to their kernel before this device hit the market. I've suspected ever since that this was the reason the Fireball release date kept getting pushed back, but we can't know for sure.
Sent from my ADR6410LVW using xda app-developers app, edited from a device where I have Admin rights
CaptainRewind said:
I tried the debugfs trick with no success. I studied all the methods described in the following threads as well. I even have a rooted TF101 and did some comparisons on the file structures, haven't found anything useful there.
http://forum.xda-developers.com/showthread.php?t=1704209
http://forum.xda-developers.com/showthread.php?t=1622628
I'm no debugfs expert, though, so I might have missed something. I was seeing permission denied when debugfs tried to get write access. I suspect this is because the system wasn't mounting the symlink target as R/W on boot like on other devices. I can try it some more if you have ideas I might have missed though... I still have all the binaries pushed via adb to the device to /data/local/tmp/ (which, on this device, is a folder where shell user can write; though, unfortunately, I can't move or rename the folder itself, likely due to parent permissions). All my symlink attempts have been to targets inside this dir since I can't find any others that will allow it. For example:
Code:
ln -s /dev/block/mmcblk0p33 /data/local/tmp/mmcblk0p33
If we knew a dir on /data that gives shell user or adb group enough permission to symlink to /system with write access, then that trick might still work. Only /data partition (or perhaps /cache or /devlog) will work since they are ext4... All other partitions are types that don't support symlinks.
On Ubuntu 12.04, I tried mounting partitions from the RUU. I can mount /system on my machine, but I still can't figure out how to mount /data outside of the device. I thought this might give me a way to list all contents of /data on a system where I have root already, and then I could try each one as a symlink target on the device. So far I'm not having luck with that approach... Anyone with more Rom knowledge know how I can do that? Ideally, I'd like to mount the ENTIRE filesystem for this device (/data in particular) from the RUU onto my Ubuntu system and poke around more.
On a separate type of attempt, I dug into some scripts inside the /system dir (from the RUU, but mounted on Ubuntu 12.04 so I can view everything). I'm looking in /system/etc/init.qcom.dsps_links.sh, line 77. I see that, if no results are returned trying to list /firmware_dsps/dsps*, then the system will be remounted RW long enough to create the symlinks. A similar case statement also exists in init.qcom.modem_links.sh, for the same reason (a check if links are missing, then a remount in RW mode to create them). How we exploit that is another consideration. Anyone know how we might take advantage of this? It seems like it will be difficult without (a) removing the symlinks, and (b) "pausing" the bootup process just after that step long enough to push su binary to /system/xbin. Since we would already need root to do either of those things, I'm not convinced this is even worth pursuing unless somebody has ideas I'm missing.
Any other ideas? One other I've been looking at is setting ro.kernel.qemu=1 in a file called /data/local.prop. This would make the OS boot as if it's an AVD, thus giving shell root by default. Again, you need to be rooted already (or somehow elevated, e.g. via some other exploit) to write this file, so maybe another dead end here.
Also, I'm sure I'm not the first to try this, but I've also checked all known exploits using the "X-Ray" app at http://www.xray.io/. Normally, I'd be quite pleased to learn that I'm patched against all those exploits. Unfortunately, not this time.
And then, of course, there was my attempt to use mempodroid (before I discovered X-Ray and learned that it's not vulnerable). The kernel version "should" support it, but they must have applied Linus' patch to their kernel before this device hit the market. I've suspected ever since that this was the reason the Fireball release date kept getting pushed back, but we can't know for sure.
Sent from my ADR6410LVW using xda app-developers app, edited from a device where I have Admin rights
Click to expand...
Click to collapse
This might help a little bit, but I don't think you can touch anything in DxDrm, but almost all those files are world writable:
/data/DxDrm:
total 28
-rwxrwxrwx 1 0 0 16 Aug 24 05:11 DxDeviceKey
-rw-rw---- 1 0 0 403 Sep 7 16:27 DxDrmConfig_Server.txt
-rwxrwxrwx 1 0 0 1284 Sep 7 16:27 DxSecureDB
-rwxrwxrwx 1 0 0 8504 Sep 7 16:27 DxSecureDB_secondary
-rwxrwxrwx 1 0 0 80 Aug 24 05:11 NVS
drwxr-xr-x 20 0 0 0 Sep 7 16:27 fuse
srwxrwxrwx 1 0 0 0 Sep 7 16:27 socket_5000.tmp
Click to expand...
Click to collapse
Also, this folder was world-writable:
/data/data/com.google.android.apps.maps:
drwxrwx-wx 2 10161 10161 4096 Sep 6 22:49 app_da_speech
Click to expand...
Click to collapse
And another file that was world-writable but was a symlinked:
/data/system
lrwxrwxrwx 1 0 0 30 Sep 6 22:49 wpa_supplicant -> /data/misc/wifi/wpa_supplicant
Click to expand...
Click to collapse
Maybe that helps a little bit
-viperboy- said:
This might help a little bit, but I don't think you can touch anything in DxDrm, but almost all those files are world writable:
Also, this folder was world-writable:
And another file that was world-writable but was a symlinked:
Maybe that helps a little bit
Click to expand...
Click to collapse
How are you able to see that, or are you looking at a different device?
I tried every dir and file you listed. I can't move/delete any of those files to even try and see if it gets recreated on reboot. And of course I can't just symlink over-top of any without getting "File exists".
Also, when I do successfully create a symlink (as I mentioned before), and even after rebooting, I get this message from debugfs:
Code:
1|[email protected]:/data $ /data/local/tmp/debugfs -w /data/local/tmp/mmcblk0p33
/data/local/tmp/debugfs -w /data/local/tmp/mmcblk0p33
debugfs 1.42 (29-Nov-2011)
/data/local/tmp/mmcblk0p33: Permission denied while opening filesystem
I've found another folder (by greping for "/data" in all text files that exist in the /system image I have mounted in Ubuntu) where I can symlink, as you can see here:
Code:
1|[email protected]:/ $ ls -l /data/wpstiles
ls -l /data/wpstiles
lrwxrwxrwx shell shell 2012-09-08 22:05 mmcblk0p33 -> /dev/block/mmcblk0p33
lrwxrwxrwx shell shell 2012-09-08 22:09 p33 -> /dev/block/platform/msm_sdcc.1/by-num/p33
But, I'm still getting the same error from debugfs as above on all of those I've tried, even after trying reboots to see if permissions are getting assigned on boot. What we need is a file that has permissions changed on boot, which we've been unable to find thus far.
CaptainRewind said:
How are you able to see that, or are you looking at a different device?
I tried every dir and file you listed. I can't move/delete any of those files to even try and see if it gets recreated on reboot. And of course I can't just symlink over-top of any without getting "File exists".
Also, when I do successfully create a symlink (as I mentioned before), and even after rebooting, I get this message from debugfs:
Code:
1|[email protected]:/data $ /data/local/tmp/debugfs -w /data/local/tmp/mmcblk0p33
/data/local/tmp/debugfs -w /data/local/tmp/mmcblk0p33
debugfs 1.42 (29-Nov-2011)
/data/local/tmp/mmcblk0p33: Permission denied while opening filesystem
I've found another folder (by greping for "/data" in all text files that exist in the /system image I have mounted in Ubuntu) where I can symlink, as you can see here:
Code:
1|[email protected]:/ $ ls -l /data/wpstiles
ls -l /data/wpstiles
lrwxrwxrwx shell shell 2012-09-08 22:05 mmcblk0p33 -> /dev/block/mmcblk0p33
lrwxrwxrwx shell shell 2012-09-08 22:09 p33 -> /dev/block/platform/msm_sdcc.1/by-num/p33
But, I'm still getting the same error from debugfs as above on all of those I've tried, even after trying reboots to see if permissions are getting assigned on boot. What we need is a file that has permissions changed on boot, which we've been unable to find thus far.
Click to expand...
Click to collapse
I went through a huge list of files on an Inc 4G by doing an ls -lR /data. Also, the way you would wanna symlink is ln -s
Sent from my EVO using Tapatalk 2
-viperboy- said:
I went through a huge list of files on an Inc 4G by doing an ls -lR /data. Also, the way you would wanna symlink is ln -s
Sent from my EVO using Tapatalk 2
Click to expand...
Click to collapse
I did that ls -lR, too, a few weeks ago, but must have missed a few files. Or I may have tried them all and forgotten. None of them work anyways.
Right I was using busybox and doing an ln -s to create the symlinks. The ls -l above was just to display the symlink source for this audience.
So, it seems that the symlink trick is officially a bust.
Sent from my ADR6410LVW using xda app-developers app
I applaud everyone's efforts to get root for this device. Someone posted a possibility earlier in the Q&A subforum, so I thought I'd link it here since no one has commented yet. It potentially has merit.
http://forums.androidcentral.com/ne...ide-factory-image-restore-your-nexus-7-a.html
Maybe it could be adapted for us. At least some fastboot ideas. I don't know... I'm going crazy without root!
IceDragon59 said:
I don't know... I'm going crazy without root!
Click to expand...
Click to collapse
This.
I just upgraded from my original HTC Incredible (with cyanogenmod, though I had to fight with it sometimes, I loved it), to the Incredible 4G. I don't have a ton of developing experience, but would be willing to help.
They might just unlock us via HTCDev after the iphone5 goes on sale on September 25th.
IceDragon59 said:
I applaud everyone's efforts to get root for this device. Someone posted a possibility earlier in the Q&A subforum, so I thought I'd link it here since no one has commented yet. It potentially has merit.
http://forums.androidcentral.com/ne...ide-factory-image-restore-your-nexus-7-a.html
Maybe it could be adapted for us. At least some fastboot ideas. I don't know... I'm going crazy without root!
Click to expand...
Click to collapse
z4root has been patched for a while on HTC devices. The way that they restored the phone in AC is not something you can do with a locked (S-ON) HTC device.
htc quick root
has anyone read that article on htc quick root, or tried this on our phone, probably doesn't work for us
Since the ViewPad 7 & Variants forum has not got a Q&A section, then please use this thread for any questions. Please dont open a new thread to ask your question, anyone found doing this will have their thread removed and will be warned.
[ask] Howto update to ice cream sandwich
Help me
I want to update to ice cream viewpad7 shandwich.
What should be prepared?
I would recomend you start HERE, this will provide you with all the info you need.
Youtube has a green line on top of the screen.
Now I am using tentone's CleanView Ice v1.3. When I watch videos (Youtube, PPS, etc.) there is a green line on top of the screen. Can someone help me? I can't post in the developer's section because I am new to this forum.
Edit: Is it caused by the 120 DPI?
Viewpad 7E
I purchased a Viewpad 7e that had to Rom. I managed to installed the Viewsonic rom from the sd card but I cannot install anything other rom or recovery.
I saw on this site, for Viewpad 7, that you could copy Flash_image and CWrecovery.img to the sd card and use Terminal emulator to install the CW recovery but it doesn't work "erro scanning partition: no such file or directory".
Does anyone have an idea how to flash a better recovery or a rom?
Recovery
afitzroy said:
I purchased a Viewpad 7e that had to Rom. I managed to installed the Viewsonic rom from the sd card but I cannot install anything other rom or recovery.
I saw on this site, for Viewpad 7, that you could copy Flash_image and CWrecovery.img to the sd card and use Terminal emulator to install the CW recovery but it doesn't work "erro scanning partition: no such file or directory".
Does anyone have an idea how to flash a better recovery or a rom?
Click to expand...
Click to collapse
Flashed the CW Recovery via Rom Manager, choosing the Mi700 option but it wouldn't work when I tried to reboot into recovery. I just got a message "enter recovery mode". Went down the root (excuse the pun) of trying to install a recovery from SD card via Terminal emulator but got nowhere. In the end, and out of desperation I flashed one of the Hauwei recovery roms via Rom Manager and was suprised when it worked.
Give that a try?
How can I get root access on one viewpad 7X?
Hauwei recovery rom compatibility on Viewpad 7e
modelman1968 said:
Flashed the CW Recovery via Rom Manager, choosing the Mi700 option but it wouldn't work when I tried to reboot into recovery. I just got a message "enter recovery mode". Went down the root (excuse the pun) of trying to install a recovery from SD card via Terminal emulator but got nowhere. In the end, and out of desperation I flashed one of the Hauwei recovery roms via Rom Manager and was suprised when it worked.
Give that a try?
Click to expand...
Click to collapse
sorrry if this is a wrong request, but can you please send me a link of that Hauwei recovery roms. i'm sooo tired of this rom
modelman1968 said:
Flashed the CW Recovery via Rom Manager, choosing the Mi700 option but it wouldn't work when I tried to reboot into recovery. I just got a message "enter recovery mode". Went down the root (excuse the pun) of trying to install a recovery from SD card via Terminal emulator but got nowhere. In the end, and out of desperation I flashed one of the Hauwei recovery roms via Rom Manager and was suprised when it worked.
Give that a try?
Click to expand...
Click to collapse
Someone else could confirm this?
modelman1968 which img file from this list http://www.clockworkmod.com/rommanager did you use??
viewpad e72
Hi, I have a viewpad e72 and I can not get root access ...
has icecreamsandwich 4.0.3, android system recovery e3 ... when I go to android system recovery jumps me the following dialog:
"E: bad arguments bootloader (null)"
"E: unknown volume for path [/ UDisk / factory_update_param.aml]"
"E: can not mount / UDisk / factory_update_param.aml]"
I tried several methods to get root access but none works!
locking the bootloader will not let me get accesoo root?
This tablet has a 1GHz Cortex A9 processor and 1 GB DDR3 RAM
any help is welcome! thanks
using google translator
Small Viewpad 7 issue
Hi there user!
im having small problems with my viewpad 7.
Q:What do i have?
A: A viewpad 7, ( Android 2.2.2) dated: 2010-12-04
Q:What do i want?
A: well basically im trying do upgrade android 2.2.2. to atleast 2.3.7. so i can run some games from the market that it wont play now. ( yes my girlfriend wants to play candy crush but its not compatible)
Qwhat have i already done & Tried?
A: i have followed a guide into rooting my device, this worked like a charm ( sorry link not working)
After that i went one to Flashing ClockworkMod Recovery.
i followed a guide from Theunlockr. com
but before i got there i had to install Android SDK, no problems there whatsoever.
so after i had done all that i downloaded the necessary software ( Flash_image and Cwrecovery )
Usb debugging mode was on and i openend USB Storage to cope/paste the files into root of SDCard(FAT)
i was ready to start Flashing ClockworkMod Recovery on the Viewpad 7
i started by opening C:\android-sdk\platform-tools and shift-rightclick to open command prompt
in there i did the following:
1- i entered ADB by typing in adb shell and hit enter.
2- I typed in su to gain superuser access. ( had to accept on the viewpad 7)
3- after that i typed in cat /proc/mtd
4- than i typed cat /dev/mtd/mtd3 > /sdcard/recovery.img to back everything up, no errors whatsoever
5- after that i had to start flashing with this command:
chmod 755 /system/bin/flash_image
flash_image recovery /sdcard/cwrecovery.imgchmod 755 /system/bin/flash_image
strangly it have me an error: Unable to chmod /system/bin/flash_image: No such file or directory.
after that i got stuck, and i have tried a few things but i cant get it to work. here is a copy of my command promt:
C:\android-sdk\platform-tools>adb shell
$ su
su
# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00500000 00020000 "boot"
mtd1: 00200000 00020000 "misc"
mtd2: 00080000 00020000 "splash"
mtd3: 00500000 00020000 "recovery"
mtd4: 00500000 00020000 "ftm"
mtd5: 01a00000 00020000 "hidden"
mtd6: 00060000 00020000 "dbgmsk"
mtd7: 0a000000 00020000 "system"
mtd8: 00200000 00020000 "misc2"
mtd9: 05800000 00020000 "cache"
mtd10: 0ab80000 00020000 "userdata"
# cat /dev/mtd/mtd3 > /sdcard/recovery.img
cat /dev/mtd/mtd3 > /sdcard/recovery.img
# chmod 755 /system/bin/flash_image
flash_image recovery /sdcard/cwrecovery.imgchmod 755 /system/bin/flash_image
Unable to chmod /system/bin/flash_image: No such file or directory
any help would be appriciated,
thanks in advance and have a nice day!
Martijn
how i bootloader my viewbad
hello
i have viewsonic tablet 7 inche
i want bootloader it but there arn't volume bottun in my tablet
so there are any way to bootloader my tab
(there r bower + esc + menu + reset bottun)
usb dongle on 7x
Can I put an usb gsm dongle on a viepad 7x? If yes which models are supported? Thanks in advance
p.s. 7x has not builtin hsdpa , hasn'it?
VB80a
Not sure if its a variant of viewpad 7 or not, but I got this cheap ViewSonic VB80a pro (from dealextreme, SKU: 172665)
1.5GHz dual core, running 4.1.1 (JRO03C) with wlan and bluetooth, using reference board MID design g08refem618 .
Perfect to use in the for OBD interface, but it has some permission issues installing many apps saying it cant be installed on sdcard or usb.
However, this tablet sees the internal memory as an sd card (/storage/sdcard0) and the external sdcard is /storage/sdcard0/external_sdcard.
And those apps can't be installed to what it thinks is external sdcard...
It's an easy fix for the app coder, contacted one of them and got to try a modified package and it installed without a hitch.
But... there are MANY MANY apps that won't install, and asking all of them to re-write their permissions is hardly an option.
So I wanted to root the pad and try some stuff, like symbolic links, to see if that'd work...
I heard DooMLoRD's Easy Rooting Toolkit works on many of these cheap chinese tablets and gave it a go.
After copying the files to /data/local/tmp, chmodding etc, (which worked without any errors btw) it says:
VB80a Pro (JRO03C.eng.wei_song.20121213) is not supported.
You need to manage to get remap_pfn_range addresses.
So I came here trying to get in touch with him but since this is not a general community forum I'm not allowed to post in that thread,
and I hardly think he'll see this message either
But at least other people with this pad can find out why they get this message and can contact the app developer and just hope he's in a good mood...
If anyone find a way to root it without involving too complicated stuff - please let me know!
Cheers
//Greg.
Device: g08refem618
Model: VB80a Pro
Board: g08refem618
Product: g08refem618
Brand: MID
Manufacturer: MID
CPU+ABI: armeabi-v7a
Bootloader: unknown
Radio: unknown (does not have built in sim card slot/function)
Hardware: amlogic
Release: 4.1.1
SDK: 16
Type: user
Build: JRO03C.eng.wei_song.20121213
Locale: en_US
Cherry Mobile Superion TV2 phone & Tablet in one
Hi,
I recently got a hold of a Cherry Mobile dual sim phone & tablet in one from the Philippines and i have been searching for a custom rom for this. I'm not sure if it is a variant of the Viewpad but somewhere in my research I read it was. I have already rooted the device using framaroot. Super user is installed, rom manager installed but could not find any custom roms.
My apologies if this is not the correct forum for this and would appreciate it if someone can point me to the right direction.
Thanks in advance for any help!
Dennis
Hi all, hoping some kind person knows how to compile a CWM recovery image for me (don't care about version) for my Alcatel One Touch 983. I did try the CWM builder but it failed so I guess I'm doing something wrong.
The output for cat /proc/mtd is:
dev: size erasesize name
mtd0: 01000000 00020000 "modem"
mtd1: 00100000 00020000 "sysparm_ind"
mtd2: 00a00000 00020000 "comms"
mtd3: 000c0000 00020000 "dsp_pram"
mtd4: 00300000 00020000 "dsp_dram"
mtd5: 00100000 00020000 "bootloader"
mtd6: 00080000 00020000 "systemdata"
mtd7: 00040000 00020000 "deviceinfo"
mtd8: 00040000 00020000 "ckdatablock"
mtd9: 00100000 00020000 "bootloader2"
mtd10: 00080000 00020000 "FOTAFLAG"
mtd11: 00500000 00020000 "boot"
mtd12: 00500000 00020000 "recovery"
mtd13: 00040000 00020000 "misc"
mtd14: 00080000 00020000 "boot2icon"
mtd15: 07600000 00020000 "system"
mtd16: 03c00000 00020000 "cache"
mtd17: 00100000 00020000 "kpanic"
mtd18: 08300000 00020000 "custpack"
mtd19: 0a000000 00020000 "userdata"
Attached is the recovery.img (in zip format) for the device.
I'm hoping to load this via fastboot (unless instructed otherwise).
Can anyone help please ? there is very little support for this device anywhere at the moment.
Thankyou.
bump....was hoping someone could spend 15mts doing this..ah well !!
give it a day or 2, i'm sure someone will be along to get support for this phone going
and i'll be waiting
Would there be any way to do a recovery via update.zip?
My 983 just got soft locked (loops on turning on and can't even turn off unless removing battery).
I got some bad flashing going in there
Thing is, I don't have access to root, can't turn it in.
I'm a newb in all this android stuff, but I can't seem to use fastboot and turning it on with the up volume key only brings me to a big window that asks me if I want to do a factory reset (factory reset doesn't solve prolly due to that bad flashing).
I can get to recovery screen via adb tho.
Over there I only have the choice to install the update.zip or to reset to factory.
So, as I can see, my only chance is to get an update.zip (can put it on sdcard using my laptop card reader) and run it.
If you have a way to do it, I'll be really grateful.
ahkronn, this is precisely why we need a proper CWM recovery build for this device. With the Alcatel recovery partition you cannot do much, definetly not save your existing ROM. Even if we at least had a factory stock rom you could load it up via 'update.zip', but I have not been able to track one of those down either.
Root is not going to win you much if you're having boot loops, unless you can actually completely boot your device then maybe you can use root explorer to see what's missing or install logging utilities and then look at the logs. As it stand this device doesn't seem to have support anywhere by anyone I can track down across the vast cyberspace. It's a pity, cause I own some 20 android devices and this Alcatel compares quite well in the low to mid-range space. Even unlock (SIM unlock) turned out to be a pain, I had 3 online unlockers refund me the money because they couldn't do it. I guess the lesson here is if you want supported devices (especially on this site) then your HTCs and Samsungs are the way to go.
I wish we could do something about the internal storage space filling up so quickly. If we could even get rid of all the additional Touchpal languages that would be a start.
There is an official application called "Alcatel One Touch Upgrade NB v1.02" that may be able to restore people's broken phones to their default brand new state: http://www.alcatelonetouch.com/glob...ne-touch-upgrade-nb-1-0-3-setup-medoclite.exe
The .exe name says v1.03 so does their website but it is actually v1.02.
I really hope someone makes a stock android 2.3.7 rom for this without all the junk that alcatel forces on us such as their horrible keyboard and large foreign language files. There are a few programs that can unlock the phone via usb now btw. GB-Key is one of the small number of programs, there isn't any programs that can generate unlock codes yet, only direct unlocks via usb.
This phone is just £40 delivered from o2 uk btw. It has a 1ghz broadcom BCM21552G cpu, 512mb ram, 512mb rom, 2gb micro sd. This is literally the perfect best bang for buck phone on the planet. It comes with android 2.3.7, alcatel have already said they won't be bringing out android 4.0+ which is understandable considering it is such a cheap phone. The camera is 3.2mp, there is no camera flash. The screen is 320x480 3.5". It has 802.11b/g/n dual band (2.4/5ghz) wireless, bluetooth 4.0 and nfc, gps and glonass and fm radio. It basically has virtually everything you want yet the phone is just £40 locked to o2 network.
More processor info here: http://www.broadcom.com/press/release.php?id=s638212
help me
when i upgrate my alcatel ot-980 with cynogen it was update sucessfully but i reebbot it . it was stuck in alcatel boot screen dont know what to do....
Here is the Alcatel OT-983 rom: https://www.dropbox.com/s/g2ljtrpqru3uihm/rom 983.zip?m
this .zip file contains the boot.img, system.img and recovery.img
Someone needs to create a clockwork mod recovery for our phones now.
here is the sourcecode for this phone: http://www.mirrorcreator.com/files/85KDRTYP/OT_983_20130103.7z_links
Still hoping for a CWM and CM, or somesuch, for this phone.
hajj_3 said:
I really hope someone makes a stock android 2.3.7 rom for this without all the junk that alcatel forces on us such as their horrible keyboard and large foreign language files.
Click to expand...
Click to collapse
They're in the /system partition so uninstalling doesn't get you any more user mem. I deleted the extra language files anyway, though, as I was sick of the sight of them.
Further information on recovery + boot
This is my first Android phone, and so far I've managed to get out of a few scrapes with it not booting, but this isn't for the faint-hearted....
Anyway, I've been trying to install some recovery software on it, to make life easier. As xzyk has noticed, there are some interesting partition names when doing 'cat /proc/mtd' . When turning on the phone, I think that:
Pressing volume up when powering on enters some sort of recovery mode, where the only option is to wipe the data (recovery partition)
Pressing volume down when powering on enters fastboot mode where I can connect the phone via the USB cable to a linux computer and type fastboot flashing commands (bootloader partition).
I've found out that the Alcatel OT 983 is very similar to the Vodafone smart II aka Alcatel v860 aka Alcatel MTC-962 (if you have used ALCATEL ONE TOUCH Upgrade NB V1.0.2 you can see you either select the MTC-962 or One Touch 983 model). There's a lot of information on this phone in this thread:
Vodafone smart II/Alcatel v860 Reocovery !ROOT!. Look out for posts by phenomenalxp, aka roeddie, the author of roeddie rom. His web site contains an 'extended recovery' image which I think comes from the MTC-962 (a Russian version of the v860). This extended recovery has an option to 'backup and restore'. I can't post URLs but google for 'Vodafone Smart II Recovery roeddie' to see this. Interestingly there's a screenshot of the "All data will be lost,continue?" screen which the OT 983 recovery provides.
I tried installing this image to the recovery partition and it started up by pressing volume up + power on, however it did not recognise the OT 983
keyboard layout, and only the volume up key worked. But it was interesting that it started up at all.
I took a closer look at the image (google "HOWTO: Unpack, Edit, and Re-Pack Boot Images" for info on this). I downloaded split_bootimg.zip, used this command to strip away the header in it
Code:
dd if=recovery.img of=nh_recovery.img bs=2048 skip=1
and then ran
Code:
$./split_bootimg.pl nh_header_recovery.img
Page size: 2048 (0x00000800)
Kernel size: 3141432 (0x002fef38)
Ramdisk size: 1363027 (0x0014cc53)
Second size: 0 (0x00000000)
Board name: RF42W0W0
Command line:
Writing nh_recovery.img-kernel ... complete.
Writing nh_recovery.img-ramdisk.gz ... complete.
$mkdir ramdisk
$ cd ramdisk/
$ gunzip -c ../nh_recovery.img-ramdisk.gz |cpio -i
which extracted the ramdisk, and I found the recovery binary in sbin/recovery.
I ran this binary from a terminal on my phone, and it started up. The text was hidden by Android, but I could see that pressing volume up and down highlighted the different options.
Next I unpacked the original recovery image, replaced the recovery binary with this one, and rebuilt the image using the header from the original image. This time recovery mode didn't boot at all. phenomenalxp thinks that the bootloader is locked, and I think he is right. Using a hex editor on the original recovery and boot images, I noticed that the header is mostly zeros, but interestingly contains these hex codes at offset 0x20:
Code:
BA BE FA CE 28 XX XX 00
BABEFACE looks suspiciously like a marker of some sort. Let's search for this string in the first partition, modem.img (I used 'dd if=/dev/mtd/mtd0 of=modem.img' on my phone to generate this image).
Code:
strings modem.img > modem_strings.txt
If you search for babeface in this file you will see
Code:
ERROR: Couldn't find 0xbabeface in comms image!!!
So there is some sort of checking going on here that the image file is 'valid'. Next I downloaded an ARM disassembler for Windows called disarm (google "Binary file ARM code disassembler for PC") and searched for babeface in the disassembled code.
Code:
000002ec: ldr r4,#0x664 ; = #0x28003000
000002f0: ldr r0,[r4,#0x20]
000002f4: ldr r4,#0x66c ; = #0xbabeface
000002f8: cmp r0,r4
Look, it's checking for babeface at offset 0x20
Code:
000002fc: beq #0x304
00000300: b #0x31c
So let's see what happens if it fails this check
Code:
0000031c: ldr r4,#0x574 ; = #0x8880018
...
00000334: b #0x334
So if the check doesn't work it goes into an infinite loop and never boots.
The word after 'babeface' is some sort of checksum which is checked using some iterative code. So I think if we want to know how to generate this checksum, we need to analyse this code further. This I believe is what we need to do if we want to install CWM recovery or other recovery software on the OT 983.
A cautionary tale...
I had a go at porting roeddie ROM to work on the OT 983. The partition sizes are slightly different between these models, but I thought I could move some apps from the smaller system on the 983 to custpack, which is bigger on the 983. Firstly I used dd to make a backup of the existing yaffs2 partitions (data, system, custpack). Then I used unyaffs from the yafuse project to extract the roeddie ROM and copied the files to the phone via adb, deleting bits and copying things across as I went. Eventually the system became unstable and some binaries weren't working correctly, probably due to having a new system/lib directory. When I rebooted, the system didn't boot up fully, and adb said it couldn't find /system/bin/sh.
So I flashed my backup images back to the phone to restore the original state. But nope, it didn't work. I used unyaffs to extract the contents of the backups, but it said they weren't valid yaffs images.
OK, I thought, One Touch Upgrade NB will restore the phone state, as I've used it before. But when it started up it read the phone, checked online, then told me I already have the latest and greatest version of the software, so it wouldn't allow me to reinstall it! I erased the system and custom partitions to remove system.ver and custpack.ver, but One Touch Upgrade still gave the same message.
Now I was getting really stuck, thinking maybe the software version was in the deviceinfo or systemdata partitions, or that I might have to somehow have One Touch Upgrade to force it to reinstall the software.
I had a go at flashing hajj_3's system image and that made the screen go blank after the usual Android robot had appeared. I guessed it needed information from the custpack partition to make the rest of it work. I extracted hajj_3's system image using unyaffs2, and it said it was a valid yaffs2 image. I had already made a tarball of /system and /custpack using tar running on the phone, so I extracted them, used mkyaffs2image to recreate the images, and flashed them. And...
Success :victory:
So in summary,
You can't backup the yaffs2 images using dd or dump_image - it creates invalid yaffs2 images.
[*]You can't rely on One Touch Upgrade NB reverting your phone's state because it thinks you already have the latest software, and refuses to help.
[*]Keep a tarball of /system and /custpack handy.
[*]Life would be a lot easier if we had decent backup and recovery software on the phone (see my previous post).
Interesting posts, although I must admit alot of it goes over my head - I'm still and Android/Linux noob.
You've somewhat cleared up a mystery for me with what you say about Vodaphone. When I did eventually manage to boot into recovery, I was surprised to see a Vodaphone logo displayed in the background, despite the phone being bought from, and locked to, O2.
And yes, there's definately something funky going on with the bootloader. I've never been able to boot into it.
superusr said:
I had a go at porting roeddie ROM to work on the OT 983. The partition sizes are slightly different between these models, but I thought I could move some apps from the smaller system on the 983 to custpack, which is bigger on the 983. Firstly I used dd to make a backup of the existing yaffs2 partitions (data, system, custpack). Then I used unyaffs from the yafuse project to extract the roeddie ROM and copied the files to the phone via adb, deleting bits and copying things across as I went. Eventually the system became unstable and some binaries weren't working correctly, probably due to having a new system/lib directory. When I rebooted, the system didn't boot up fully, and adb said it couldn't find /system/bin/sh.
So I flashed my backup images back to the phone to restore the original state. But nope, it didn't work. I used unyaffs to extract the contents of the backups, but it said they weren't valid yaffs images.
OK, I thought, One Touch Upgrade NB will restore the phone state, as I've used it before. But when it started up it read the phone, checked online, then told me I already have the latest and greatest version of the software, so it wouldn't allow me to reinstall it! I erased the system and custom partitions to remove system.ver and custpack.ver, but One Touch Upgrade still gave the same message.
Now I was getting really stuck, thinking maybe the software version was in the deviceinfo or systemdata partitions, or that I might have to somehow have One Touch Upgrade to force it to reinstall the software.
I had a go at flashing hajj_3's system image and that made the screen go blank after the usual Android robot had appeared. I guessed it needed information from the custpack partition to make the rest of it work. I extracted hajj_3's system image using unyaffs2, and it said it was a valid yaffs2 image. I had already made a tarball of /system and /custpack using tar running on the phone, so I extracted them, used mkyaffs2image to recreate the images, and flashed them. And...
Success :victory:
So in summary,
You can't backup the yaffs2 images using dd or dump_image - it creates invalid yaffs2 images.
[*]You can't rely on One Touch Upgrade NB reverting your phone's state because it thinks you already have the latest software, and refuses to help.
[*]Keep a tarball of /system and /custpack handy.
[*]Life would be a lot easier if we had decent backup and recovery software on the phone (see my previous post).
Click to expand...
Click to collapse
Hi, after i playing with that recovery and custom, rom, really works like in your case, but when i was playing with aroma mods, e brick everyhing, at this moment, my phone don+t boot, don't ebter in fastboot, only one toutch upgrade detect wit android alcatel onetoutch mobile phone(com9), i can´t recover any of my backups and i can´t acess phone adb or fastboot, can you give me some help?
rwaver said:
Hi, after i playing with that recovery and custom, rom, really works like in your case, but when i was playing with aroma mods, e brick everyhing, at this moment, my phone don+t boot, don't ebter in fastboot, only one toutch upgrade detect wit android alcatel onetoutch mobile phone(com9), i can´t recover any of my backups and i can´t acess phone adb or fastboot, can you give me some help?
Click to expand...
Click to collapse
Not sure what you should do here. If fastboot doesn't work that might mean your bootloader partition is corrupted, or that the 'modem' partition which calls the bootloader is corrupted. What happens when you run One Touch Upgrade? Does it detect the version of software running on the phone?
I don't know how One Touch Upgrade works but it might use fastboot to boot a custom kernel. There's a couple of .img files within One Touch Upgrade - if you replace these with your bootloader image (containing fastboot), does fastboot start then?
superusr said:
Not sure what you should do here. If fastboot doesn't work that might mean your bootloader partition is corrupted, or that the 'modem' partition which calls the bootloader is corrupted. What happens when you run One Touch Upgrade? Does it detect the version of software running on the phone?
I don't know how One Touch Upgrade works but it might use fastboot to boot a custom kernel. There's a couple of .img files within One Touch Upgrade - if you replace these with your bootloader image (containing fastboot), does fastboot start then?
Click to expand...
Click to collapse
HI, One Touch Upgrade detect but says doesnt exist new version, i tried replace, don't work,
Anyone can help-me? The phone is stuck on android logo, don't enter on recovery mode or fastboot, only One Toutch Upgrade NB can detect with driver Alcatel One Toutch Mobile Phone on COM1, with thant i can´t do anything .....an ideas?
superusr said:
I had a go at porting roeddie ROM to work on the OT 983. The partition sizes are slightly different between these models, but I thought I could move some apps from the smaller system on the 983 to custpack, which is bigger on the 983. Firstly I used dd to make a backup of the existing yaffs2 partitions (data, system, custpack). Then I used unyaffs from the yafuse project to extract the roeddie ROM and copied the files to the phone via adb, deleting bits and copying things across as I went. Eventually the system became unstable and some binaries weren't working correctly, probably due to having a new system/lib directory. When I rebooted, the system didn't boot up fully, and adb said it couldn't find /system/bin/sh.
So I flashed my backup images back to the phone to restore the original state. But nope, it didn't work. I used unyaffs to extract the contents of the backups, but it said they weren't valid yaffs images.
OK, I thought, One Touch Upgrade NB will restore the phone state, as I've used it before. But when it started up it read the phone, checked online, then told me I already have the latest and greatest version of the software, so it wouldn't allow me to reinstall it! I erased the system and custom partitions to remove system.ver and custpack.ver, but One Touch Upgrade still gave the same message.
Now I was getting really stuck, thinking maybe the software version was in the deviceinfo or systemdata partitions, or that I might have to somehow have One Touch Upgrade to force it to reinstall the software.
I had a go at flashing hajj_3's system image and that made the screen go blank after the usual Android robot had appeared. I guessed it needed information from the custpack partition to make the rest of it work. I extracted hajj_3's system image using unyaffs2, and it said it was a valid yaffs2 image. I had already made a tarball of /system and /custpack using tar running on the phone, so I extracted them, used mkyaffs2image to recreate the images, and flashed them. And...
Success :victory:
So in summary,
You can't backup the yaffs2 images using dd or dump_image - it creates invalid yaffs2 images.
[*]You can't rely on One Touch Upgrade NB reverting your phone's state because it thinks you already have the latest software, and refuses to help.
[*]Keep a tarball of /system and /custpack handy.
[*]Life would be a lot easier if we had decent backup and recovery software on the phone (see my previous post).
Click to expand...
Click to collapse
Thanks superusr,
That was superb info!
Keep going
Sent from my NexusHD2 using xda app-developers app
Posted this in the wrong place, i guess this is the right
Hi everyone,
I have a 10.1'' chinese tablet with a rk3066 chip, suddenly the firmware got damagend, there is no way to find the original, i've tried with over 100 different firmwares from here or rockchipfirmware, nothing worked, but there is 1 version that barely works (PlayerMomo12 release 3) but the screen is inverted in both axis (X and Y), i've tried different methods to fix it, with apks, with usb debugging, and nothing worked, the apps just doesn't works, even one of them dissapeared and i was unable to install it again, using my laptop doesnt works because the directory that should mount doesn't exist, i don't know why but i've tried all the methods, even mounting with a terminal inside the tablet (you can imagine how hard was writting with the screen like a mirror), then i thought the only solution was using the kitchen to modify the file script.bin, but again, a lot of problems, i couldn't open the image, found this thread:
http://forum.xda-developers.com/show...33246&page=555
-------------------------------------
Originally Posted by biglcny
just running sysrw and sysro would return this:
Usage: mount [-r] [-w] [-o options] [-t type] device directory
rather than no output as usual. I believe there may be another version of mount that takes different parameters. When a rom is flashed and you connect to it with adb shell there is a version of mount in /system/bin that is different and accepts options in a different format.
simply typing running mount at the command line or in a shell script uses that one instead of the busybox one.
dr.notor replied:
Well, the above is an example of totally screwed up mount binary, dunno which phone and ROM you are using but the guy who produced the above would deserve a bit hit with a cluebat into their head.
If you have similar broken crap, simply edit the scripts to call busybox mount and not mount.
-------------------------------------
well, this is the point (after a lot of days working on this) when i give up, this tablet was bought in China and the company (scope) doesn't sell it anymore, and they don't reply the emails, even the webpage is half empty, this is the point when i ask, if someone can help me sending a working kernel based on this rom (PlayerMomo12 release 3) or the firmware with the script.bin modified to invert both axis, if no one can, then it's the moment to smash the tablet with a giant hammer and send it back to China
i could bought 2 galaxy tab 4 if i wasn't wasted so much time on this
here is the firmware if someone wanna to try
http://www.rockchipfirmware.com/cont...-tnt-release-3