Hi folks (this should be in the development forums, but I can't post there yet...)
I booted my Sony Tablet S into recovery mode, then managed to get the SD Card to mount. (Select option 2 and it will mount it up for you ). Using "adb pull" to retrieve /proc/mounts I get the following gem:
Code:
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk1p1 /sdcard vfat rw,nodev,noatime,nodiratime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,comp_uni,avoid_dlink,errors=remount-ro 0 0
From what I can see, this means if we can convince the system to run executables placed on the SD Card - we should be able to run a suid binary - and attain root (then be able to mount /system rw and add a su binary)
Does that help anyone?
bcooksley said:
Hi folks (this should be in the development forums, but I can't post there yet...)
I booted my Sony Tablet S into recovery mode, then managed to get the SD Card to mount. (Select option 2 and it will mount it up for you ). Using "adb pull" to retrieve /proc/mounts I get the following gem:
Code:
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk1p1 /sdcard vfat rw,nodev,noatime,nodiratime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,comp_uni,avoid_dlink,errors=remount-ro 0 0
From what I can see, this means if we can convince the system to run executables placed on the SD Card - we should be able to run a suid binary - and attain root (then be able to mount /system rw and add a su binary)
Does that help anyone?
Click to expand...
Click to collapse
Thank you. I hope it helps to mount sd for app2sd, psxperia, direct media playing soon
Sent from my R800i
How does the system decide if a program can run as root? The location it runs from?
Is there a cron function in the tablets, or ability to add something to the init.d steps?
An application which is both setuid and owned by root (known as setsuid) can be executed by any user and is granted root privileges immediately. That is how "su" (and other similar apps) work.
Unfortunately, i've discovered that the file system arguments it supplies are hardcoded - so whilst it can detect that a SD card is formatted with ext4 - the mount fails as ext4 doesn't support the FAT specific arguments.
So while we will be able to use this to get executables on the system - we can't get setsuid executables on the system, limiting us to executables being run as the "shell" user.
Yes. Ill help. I sent you a pm.
Ok, so whilst the SD Card method has unfortunately not panned out - I have found something potentially interesting none the less.
This lies in the update system used by Sony. I have determined that the updates appear to be encrypted using a Triple-DES key, which is embedded in, or retrieved by /system/lib/libautomagic_library.so.
This file has traces of apparently being written by HTC (the strings HTC_RIL, CDMA and PHONE all appear in it). It also has a reference to the location /data/data/com.sony.automagic.client.app/file/ (which doesn't exist on my device)
This library is used by the updater application itself - through a Java framework "automagic_downloader". Unfortunately, due to the use of the compiled C code for decryption and update verification (which includes SHA1/MD5 sum checks, likely against the previously downloaded info.xml, which it also handles) it is not possible to tell if the decrypted file is the one placed in /cache however.
The key "ro.sony.build.incremental" written in /system/build.prop is the version number used by Sony to determine if the system needs updating or not, as far as I can tell (with the C library being used, it is difficult to tell)
I have also noted, that when in recovery mode, the following two statements are present in /default.props
ro.build.description=nbx03_033-user 3.2.1 THMASU0035 0035.002 test-keys
ro.build.fingerprint=Sony/nbx03_002/nbx03:3.2.1/THMASU0035/0035.002:user/test-keys
I am not sure at this point if this just means that different keys will be used - or if the keys referenced are the ones available publicly in Android's repositories.
Please note that the above, whilst interesting, does not provide a direct path to rooting the device at this time. Note also that I was not able to complete the paths that the updater application takes codewise, so some of the code I examined may not be used - and thus the above may not apply.
However, if correct this may allow for the OTA images to be decrypted at some point, if someone can decompile those libraries (or otherwise extract the keys using a hex editor).
bcooksley said:
Ok, so whilst the SD Card method has unfortunately not panned out - I have found something potentially interesting none the less.
This lies in the update system used by Sony. I have determined that the updates appear to be encrypted using a Triple-DES key, which is embedded in, or retrieved by /system/lib/libautomagic_library.so.
This file has traces of apparently being written by HTC (the strings HTC_RIL, CDMA and PHONE all appear in it). It also has a reference to the location /data/data/com.sony.automagic.client.app/file/ (which doesn't exist on my device)
This library is used by the updater application itself - through a Java framework "automagic_downloader". Unfortunately, due to the use of the compiled C code for decryption and update verification (which includes SHA1/MD5 sum checks, likely against the previously downloaded info.xml, which it also handles) it is not possible to tell if the decrypted file is the one placed in /cache however.
The key "ro.sony.build.incremental" written in /system/build.prop is the version number used by Sony to determine if the system needs updating or not, as far as I can tell (with the C library being used, it is difficult to tell)
I have also noted, that when in recovery mode, the following two statements are present in /default.props
ro.build.description=nbx03_033-user 3.2.1 THMASU0035 0035.002 test-keys
ro.build.fingerprint=Sony/nbx03_002/nbx03:3.2.1/THMASU0035/0035.002:user/test-keys
I am not sure at this point if this just means that different keys will be used - or if the keys referenced are the ones available publicly in Android's repositories.
Please note that the above, whilst interesting, does not provide a direct path to rooting the device at this time. Note also that I was not able to complete the paths that the updater application takes codewise, so some of the code I examined may not be used - and thus the above may not apply.
However, if correct this may allow for the OTA images to be decrypted at some point, if someone can decompile those libraries (or otherwise extract the keys using a hex editor).
Click to expand...
Click to collapse
Thanks, and please evryone lets keep trying until someone figures this out. Any effort is progress iMO
Related
tl;dr
What I really would like is some way to move a file from my phone's internal storage (it's in /data/data/...) to my computer when it's connected via USB. I'll settle for a way to find my SD card directory and move it there. Alternatively, I'd be okay with putting it somewhere that survives a factory reset from recovery mode.
I'm bad with technology. I can only get my phone into recovery and/or download modes, and I want to pull a few files off it before I factory restore. I am on the default firmware (though my phone IS rooted) and I have no interest whatsoever in doing things like putting CWM on here. Thank you in advance for not suggesting anything of the sort!
I have adb installed. My computer "sees" my phone just fine. I can use adb shell and muck around, but I get "permission denied" when I try to look at anything other than the root directory or do anything. How do I change these permissions, or copy an entire folder despite them? I tried looking into it more and got "adbd cannot run as root" as an error, which I don't understand because my phone is rooted and Superuser is installed. Is it just because I can't turn the damn thing on?
I can get to the files (and see them) if I open ADB and use "su -" and remount the system as RW, which I figured out thanks to Google. I can see the file just fine, I just don't know the command to move it. Is it "cat"?
edit: it does seem to be "cat", for moving internally, but I can't move it anywhere that I can figure out how to access. I have an SD card in my phone, and /sdcard and /sdcard1 both seem to exist, but using cat to move a file to either of them won't make it actually show up on my SD card. Also, using ls on /sdcard doesn't display anything at all, so I don't see /sdcard/external_sd which google maybe suggested I should.
edit2: this is what "adb shell mount" returns. I don't think it's seeing my SD card at all:
C:\Users\User>adb shell mount
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mmcblk0p9 /system ext4 rw,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0
Click to expand...
Click to collapse
if I use "cd /mnt" and "ls" it doesn't return anything, so it doesn't see anything there.
edit3: I can also move the file with "dd". What a journey of discovery I'm having here! I just can't figure out how to move it somewhere that actually gets it off the phone. I tried exiting the shell (via Ctrl-D) and then using pull, but it just gave me permission denied again. I have it in /sdcard/ and I tried using "adb shell cat" and I created a file that has the only contents "permission denied"
I would also accept a way to just rip every single file, since I know the location of the thing I want, I just can't DO anything to it.
Thank you again in advance, I'm really bad with this stuff and I appreciate it.
Probably a total jerk move to bump this, but I've managed to narrow the topic down significantly, and maybe everyone will think there's a reply and flock in to read it and one of those people will be able to help me!
Yesterday, a customer brought me a phone that seems to be hanging on boot. The phone is a stock (non-rooted) US Cellular Galaxy S II SCH-R760. I'm not trying to fix the phone. He just wants his pics and contacts. There was no SD card in the phone and he claims there never has been.
This phone was a real pain to get into recovery. I'm pretty sure it suffers from the well known power button issues. ADB will let me connect in recovery mode. It never sees the phone when trying a normal boot.
I've found reference to internal storage being located at /storage/sdcard0. There is no storage folder off the root. I tried cd'ing to it anyway but it doesn't exist. There is nothing shown in /mnt or /dev. There are no files or folders in /sdcard.
I've read about using Kies. The program sees the phone and goes into "Connecting" while attempting a normal boot or in recovery mode but it never gets beyond that point. I'm using driver version 1.5.27.0.
I've tried using "adb pull / ./s2" in an attempt to copy the entire file system. The command just hangs and no files ever copy.
***EDIT - further attempts to pull the entire file system finally worked somewhat. After restarting recovery, I was able to get the command to run but it skipped most of the file system. It only copied over the mnt, sbin, sys, and system folders. The only jpg files in there are files you may see during a firmware upgrade.
Any other thoughts about how to get this guys data?
Here is the folder list:
mnt
persist
dbdata
efs
cache
system2
preload
sdcard
etc
system
sbin
ueventd.smdkc210.rc
sys
init.goldfish.rc
data
init
tmp
init_kernel_only.rc
vendor
init.rc
init.smdkc210.rc
proc
ueventd.rc
default.prop
recovery.rc
lib
fota.rc
lpm.rc
ueventd.goldfish.rc
res
dev
There is a chance, that /storage/sdcard0 is not mounted automatically when you boot into recovery. You could try to adb shell into the device when in recovery mode and try to mount sdcard0 manually.
Another chance to get the pics: do an image backup of the sdcard0 partition and loop mount that image on your PC. On my blog you can also find a tool which is doing that. Unfortunately it's not finished yet (even if the functionality you would need is working ) and there are only a few devices supported out of the box. For other devices you would need to create a device specific config file.
Sent from my Nexus 7 using xda app-developers app
AndDiSa said:
There is a chance, that /storage/sdcard0 is not mounted automatically when you boot into recovery. You could try to adb shell into the device when in recovery mode and try to mount sdcard0 manually.
Another chance to get the pics: do an image backup of the sdcard0 partition and loop mount that image on your PC. On my blog you can also find a tool which is doing that. Unfortunately it's not finished yet (even if the functionality you would need is working ) and there are only a few devices supported out of the box. For other devices you would need to create a device specific config file.
Sent from my Nexus 7 using xda app-developers app
Click to expand...
Click to collapse
I'll need some help on this one. I'm a Windows guy. I'm not afraid to try anything but Linux and Android are beyond me without help from Google and the awesome XDA community. I looked for your tool on your blog. I'm guessing you are referring to the Android Remote Toolkit. If that is the case, it has been over 10 years since I've compiled anything. That is beyond me.
From what I can gather, the internal storage is possibly located at /devices/platform/s3c-mshci.0/mmc_host/mmc0/mmc0. If that is correct, how exactly do I mount it? There is no /devices folder. The file system is read only (no root). I can't create a folder for the mount. I've tried using the empty /sdcard folder for a mount point. My best guess at the mount command was:
Code:
mount -r -t auto /devices/platform/s3c-mshci.0/mmc_host/mmc0/mmc0 /sdcard
This produced a result of
Code:
mount: Operation not permitted
Here is a little bit of data for you to help see what the current situation is. This is the output of the mount and fs commands:
Code:
$ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=111 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /tmp tmpfs rw,relatime,mode=755 0 0
/dev/block/mmcblk0p9 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /mnt/.lfs j4fs rw,relatime 0 0
/dev/block/mmcblk0p7 /cache ext4 rw,nodev,noatime,nodiratime,barrier=1,data=orde
red 0 0
$ df
df
Filesystem Size Used Free Blksize
/dev 417M 76K 417M 4096
/tmp 417M 56K 417M 4096
/system 503M 484M 19M 4096
/mnt/.lfs: Function not implemented
/cache 295M 5M 290M 4096
And here is the contents of vold.fstab. I'm guessing this will show where the internal storage is located but I'm not completely comfortable with reading it.
Code:
## Vold 2.0 Generic fstab
## - San Mehat ([email protected])
##
#######################
## Regular device mount
##
## Format: dev_mount <label> <mount_point> <part> <sysfs_path1...>
## label - Label for the volume
## mount_point - Where the volume will be mounted
## part - Partition # (1 based), or 'auto' for first usable partition.
## <sysfs_path> - List of sysfs paths to source devices
######################
# internal sdcard
{
ums_path = /sys/devices/platform/usb_mass_storage/lun0/file
asec = disable
discard = enable
}
dev_mount sdcard /mnt/sdcard 11 /devices/platform/s3c-mshci.0/mmc_host/mmc0/mmc0
# external sdcard
{
ums_path = /sys/devices/platform/usb_mass_storage/lun1/file
asec = enable
}
dev_mount sdcard1 /mnt/sdcard/external_sd auto /devices/virtual/block/cyasblkdevblk0
# otg sdcard
{
ums_path = /dev/zero
asec = disable
}
usb_mount sdcard2 /mnt/sdcard/usbStorage auto /devices/platform/s3c_otghcd/usb
#end line ## keep this line
You need to be root to mount a file system, to to call "su" before calling the mount command.
AndDiSa said:
You need to be root to mount a file system, to to call "su" before calling the mount command.
Click to expand...
Click to collapse
That is what I was afraid of. This is the US Cellular version of this phone. I think I can halfway get it rooted but I don't think the phone would ever function again or be able to be returned to stock for warranty. The only good info I can find for getting it rooted and being able to either return to stock or turn it into a functioning phone is found here:
http://forum.xda-developers.com/showpost.php?p=23276856&postcount=3
http://forum.xda-developers.com/showthread.php?t=1677463
The problem is that the USCCROOT-sfx.exe package is not available from the download link. Any downloads I've found by the same name do not include the files mentioned in the instructions.
I think it is time to hand this phone back to the guy and tell him he is out of luck. Keep your stuff backed up and synced.
Do you have a custom recovery installed on it? If yes, you will have root access on cmd line level.
Sent from my Nexus 7 using xda app-developers app
I'm trying to put the SU binary in a different place than the /system folder. I can flash it to /data with the correct permissions, but when I run SU, it doesn't get root.
Code:
[email protected]:/ $ /data/su
/data/su
1|[email protected]:/ $ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)
Is there a reason why it doesn't work in /data/? Is there another folder (not /system/) where it should work?
Code:
ls -la /data/su
-rwsr-sr-x root root 380532 2008-08-01 12:00 su
# From a working /system/su :
-rwsr-sr-x root root 380532 2008-08-01 12:00 su
Has to be in /system. It has elevated privileges that you can't get in the /data partition. Are you unable to put it in /system, as in trying to root a new device, or is there another reason you're against putting it there?
I continued searching myself (like I should) and I just found the answer (sorry, forgot to subscribe to the thread). /data is mounted with "nosuid" option, so privilege elevation isn't possible.
Code:
[email protected]:/ $ cat /proc/self/mountinfo
cat /proc/self/mountinfo
1 1 0:1 / / ro,relatime - rootfs rootfs ro
12 1 0:12 / /dev rw,nosuid,relatime - tmpfs tmpfs rw,mode=755
13 12 0:9 / /dev/pts rw,relatime - devpts devpts rw,mode=600
14 1 0:3 / /proc rw,relatime - proc proc rw
15 1 0:13 / /sys rw,relatime - sysfs sysfs rw
16 15 0:5 / /sys/kernel/debug rw,relatime - debugfs debugfs rw
17 1 0:14 / /acct rw,relatime - cgroup none rw,cpuacct
18 1 0:15 / /mnt/asec rw,relatime - tmpfs tmpfs rw,mode=755,gid=1000
19 1 0:16 / /mnt/obb rw,relatime - tmpfs tmpfs rw,mode=755,gid=1000
20 12 0:17 / /dev/cpuctl rw,relatime - cgroup none rw,cpu
21 1 179:1 / /system ro,relatime - ext4 /dev/block/mmcblk0p1 ro,user_xattr,acl,barrier=1,data=ordered
22 1 179:7 / /data rw,nosuid,nodev,noatime,nodiratime - ext4 /dev/block/mmcblk0p7 rw,errors=panic,user_xattr,acl,barrier=1,nodelalloc,data=ordered
23 1 179:2 / /cache rw,nosuid,nodev,noatime,nodiratime - ext4 /dev/block/mmcblk0p2 rw,errors=panic,user_xattr,acl,barrier=1,nodelalloc,data=ordered
24 1 0:18 / /Removable rw,relatime - tmpfs tmpfs rw,mode=755,gid=1000
25 1 0:19 / /mnt/sdcard rw,nosuid,nodev,relatime - fuse /dev/fuse rw,user_id=1023,group_id=1023,default_permissions,allow_other
26 24 179:9 / /Removable/MicroSD rw,nosuid,nodev,noexec,relatime - vfat /dev/block/vold/179:9 rw,dirsync,uid=1000,gid=1015,fmask=0000,dmask=0000,allow
rtname=mixed,utf8,errors=remount-ro
If I understand this correctly, there's no location (except for /system) that is mounted without the nosuid flag (or at least no location where I can put the SU binary). Is it possible to create a new partition that would also be automatically mounted at startup? Which files should I edit/where should I look for info?
I'm not trying to root a new device. It works perfectly fine in /system/. I want to have root access without it being obvious that it's available.
You can use the option of SuperSU to have no icon or use a launcher that can hide apps, like Nova. Then you would only be able to tell if you were looking under the All Tab in the Application Manager in Settings, or if you have a device like a Samsung where it might show your device status as Custom. If that's the case, I believe there's an Xposed mod to change that to official status.
Sent from my A0001 using XDA Premium 4 mobile app
es0tericcha0s said:
You can use the option of SuperSU to have no icon or use a launcher that can hide apps, like Nova. Then you would only be able to tell if you were looking under the All Tab in the Application Manager in Settings, or if you have a device like a Samsung where it might show your device status as Custom. If that's the case, I believe there's an Xposed mod to change that to official status.
Click to expand...
Click to collapse
No, I'm trying to hide it on a system wide level. I'm doing this for forensics/research purposes. Not for the user, but for apps. For XPosed, there's also RootCloack, but that's lacking in many ways. There are a lot of ways of still detecting root while RoatCloack is installed.
Does anybody know how I can add a partition? I've searched for documentation but so far I've only found information about how to resize partitions.
Dauntless said:
No, I'm trying to hide it on a system wide level. I'm doing this for forensics/research purposes. Not for the user, but for apps. For XPosed, there's also RootCloack, but that's lacking in many ways. There are a lot of ways of still detecting root while RoatCloack is installed.
Does anybody know how I can add a partition? I've searched for documentation but so far I've only found information about how to resize partitions.
Click to expand...
Click to collapse
Messing with that would be a good way to brick the device. I don't believe there would be a way to create a new partition in that manner, and if you could, even less likely it would be able to run su from it. And different manufacturers do their partitions and sometimes even files systems differently. If you could, somehow, get it to work with one phone, it wouldn't be a universal solution.
es0tericcha0s said:
Messing with that would be a good way to brick the device. I don't believe there would be a way to create a new partition in that manner, and if you could, even less likely it would be able to run su from it. And different manufacturers do their partitions and sometimes even files systems differently. If you could, somehow, get it to work with one phone, it wouldn't be a universal solution.
Click to expand...
Click to collapse
Is there a reason why you think it would be impossible to su from it if it's mounted without the nosuid flag?
Maybe a different approach then: Where should I look if I want to mount /data (or any other partition) without the nosuid flag?
It also doesn't have to be a universal solution.
I just don't think it's possible to mount another partition with that flag.
Sent from my A0001 using XDA Premium 4 mobile app
I see various options for converting system apps <==> user apps and moving or linking some to SD. But I don't see a good general discussion of this. Also, I think my old phone needs a more hard core approach--probably one that trims down /system and reduces how much /system overlaps redundantly with updates on /data. So here goes...
First off, these solutions seem inadequate:
built-in apps2sd: it still fills up internal memory a lot.
s2e: an all-or-nothing approach for each category
free version of link2sd: cannot move-and-link app data, nor system apps
I've been fairly happy with link2sd, but it's still not radical enough for me. Can s2e be combined with it to reclaim even more space?
Assumptions about a stronger solution:
It will require root access.
It will break OTA (can this be turned off safely? can someone link to a good overview of problems/workarounds?)
It *might* require a fairly fast SD card (but still limited to an old phone's bus speeds, etc.) Note: I just bought a 32GB class 10 SDHC card (UHS-1 U3) for my s5360.
It might require one or two paid apps (hopefully not)
One of the most promising options I've seen is to convert system apps to user apps and then move-and-link them to SD. For the conversion step, do the following all do the same thing?
link2sd Plus (paid)
Titanium Backup Pro (paid)
System Tuner (paid) -- I've tried the free ones and move (and freeze) always fails.
app mover (free) http://forum.xda-developers.com/showthread.php?t=1999346
And are there rules of thumb for what can be safely converted?
EDIT: I just found this handy list--my guess is that any green or yellow Yes can be safely converted to a user app and even moved/linked to SD, but that red shouldn't, and think twice before uninstalling yellow :
http://wiki.cyanogenmod.org/w/Barebones#CM-10.1_App_list_.28WIP.29
Can apps that were moved to /data still be updated? I'd especially like to target outdated system apps that are have already been updated anyway and are thus running from /data anyway. My understanding is that 'moving' those to /data doesn't increase /data usage and doesn't reduce performance--just slightly reduces permissions--as long as I don't move/link them to SD.
lightningdude said:
In all seriousness, though, I'm not entirely sure the Link2SD has good implementation of this method. You might try Titanium Backup to convert system to user apps, then try linking it with Link2SD. It may still not work, but it'd be worth a shot, I suppose.
Furthermore, I always delete bloatware I'm not going to use with Titantium Backup. If I need to go back to stock for an OTA, I just flash the complete stock of whatever phone I'm on.
Click to expand...
Click to collapse
If this can all be done successfully, can the internal partitions then be resized? That is, if we safely shunt some of /system and /cache off to SD, can we then let /data steal some space from both? (My s5360 has this by default: /system 230MB, /cache 40MB, /data 197MB)
My old s5360 seems to get full almost immediately after flashing a cm11 rom (LolliKat) and minimal gapps onto it, although I plan to try again with a version of minimal gapps that installs to SD.
For that matter, can some ROMs be installed primarily to SD? I get the impression that that's how some dual-boot (multiROM) approaches work, but I don't really know.
I've also seen one guide for permanently mounting /system as read-write. I think I'd be ok with that (are the security concerns truly awful?), especially if it meant that system apps would update themselves in-place without impacting /data. But I'm guessing it's not that simple.
can't create /system/... Read-only file system
I found another cool feature of link2sd to "integrate update into system", removing it from data and eliminating the double use of space. The free version includes this feature, but unfortunately it always errors out for me:
`sh: [51]: can't create /system/app/Music.apk.t: Read-only file system`
I tried upgrading to link2sd Plus, since that's the version that includes a convert feature, which requires write access to /system:
C-Jon said:
One of the most promising options I've seen is to convert system apps to user apps and then move-and-link them to SD.
Click to expand...
Click to collapse
But that feature failed too, for the same reason. So I tried all of the following--granting each app superuser access for 10 minutes each time--and they also failed to successfully mount /system as RW:
X-plore - long press the / folder and choose System Shell, then enter `su` and `mount -o remount,rw /system /system`. It gives no error, but if I then immediately `cd system` and try to `mkdir xxzz` it gives an error: `can't create directory 'xxzz' : Read-only file system`. If I use the GUI, I can apparently create a folder under /system with no error, but if I browse up and come back, the folder is gone.
ES File Explorer (free version) - menu, Root Explorer, Mount R/W. I tried running it multiple times, setting both `/` and `/system` to RW. After doing this a couple times, `/` showed up as already RW, but `system` never did. I immediately retried link2sd Integrate--fails with same error.
mountsystemrorw - this app is dedicated to this one task, and when I click "MOUNT /system RW" it claims success ("Your system is now mounted RW!"); but it actually fails. (At least, link2sd Integrate and X-plore still give the same error/failures.)
AnExplorer - menu, Root. I don't see 'mount' options.
Has KitKat made it nearly impossible to mess with /system, even as root? Or am I doing something wrong?
Just in case, I tried re-running "recreate mount scripts" in link2sd, which had worked before, and this time it failed too! `can't create /system/etc/init.d/11link2sd: Read-only file system`. So maybe something has changed since I first installed link2sd. Hmm. I do see this in a thread on stack exchange, "Write access to the system partition is usually blocked by the kernel at boot." But "recreate mount scripts" worked before, *after* I'd flashed the current kernel (Kernel Bangprovn#1.zip) and ROM (LolliKat Stable 2.zip). That's how I got the ext4 partition working for link2sd in the first place.
I'm getting frustrated and don't want to have a big fight every time I want to integrate or convert an app. So I'm wondering just how feasible the following might be...
I've also seen one guide for permanently mounting /system as read-write. I think I'd be ok with that (are the security concerns truly awful?), especially if it meant that system apps would update themselves in-place without impacting /data.
Click to expand...
Click to collapse
I'm guessing they wouldn't simply self-update. But if I could easily run the Integrate step without this RW battle, that might be enough.
If it helps, here is my mount info:
Code:
cat /proc/mounts
rootfs / rootfs ro,noatime,nodiratime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,noatime,nodiratime 0 0
sysfs /sys sysfs rw,seclabel,noatime,nodiratime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,noatime,nodiratime 0 0
/sys/kernel/debug /sys/kernel/debug debugfs rw,noatime,nodiratime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
none /sys/fs/cgroup/memory cgroup rw,relatime,memory 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/fuse tmpfs rw,seclabel,relatime,mode=775,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mtdblock8 /system yaffs2 ro,seclabel,noatime,nodiratime 0 0
/dev/block/mtdblock9 /cache yaffs2 rw,seclabel,nosuid,nodev,noatime,nodiratime 0 0
/dev/block/mtdblock10 /data yaffs2 rw,seclabel,nosuid,nodev,noatime,nodiratime 0 0
/dev/block/mmcblk0p2 /data/sdext2 ext4 rw,seclabel,relatime,barrier=1,data=writeback 0 0
/dev/block/vold/179:1 /mnt/media_rw/sdcard0 vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/fuse /storage/sdcard0 fuse rw,nosuid,nodev,noatime,nodiratime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
using bin/mount rather than xbin/mount
I finally found a solution: remount by explicitly using `/system/bin/mount -o ...` rather than just `mount -o ...`. I'm guessing that at some point the version in /system/xbin started taking priority and for some reason that version fails silently. More info here:
http://android.stackexchange.com/a/110883/109855
Good day,
The situation at hand:
- Samsung SM-G900F
- CM 14.1 (or what ever the last official CM Build was)
- rooted ("#" in ABD SHELL is shown)
- non-functional display (no input it seems and black. glorious spider-app)
- phone is booting normally (TWRP recovery + download mode included)
- ADB only works in recovery
So, as the phone is still working fine (apart from keeping everything for itself) I'd figure I could use programs like "MyPhoneExplorer", DDMS, or anything to use it while I'm waiting to get a new one.
Only thing that keeps me from doing so - my phone is on "charging mode" when plugged in USB and normally booted.
In order to activate the "usb debugging" (and set it as default) I tried to pull the "build.props" from /system - however, ADB keeps telling that folder doesn't exist.
I thought at first, there'd be an problem with RO/RW settings but when trying to remount /system I'm getting this:
Code:
~ # ←[6nmount -o w,remount /system
mount -o w,remount /system
mount: can't find /system in /proc/mounts
When checking with ADBFileExplorer, the folder "system" is there but completely empty.
Running #mount results in
Code:
~ # ←[6nmount
mount
rootfs on / type rootfs (rw,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
/dev/block/mmcblk0p26 on /data type ext4 (rw,seclabel,relatime,data=ordered)
/dev/block/mmcblk0p26 on /sdcard type ext4 (rw,seclabel,relatime,data=ordered)
/dev/block/mmcblk0p24 on /cache type ext4 (rw,seclabel,relatime,data=ordered)
I assume (or rather: I fear), I'd have to enable "system" for mounting in the TWRP screen to be able to temper with my build.prop.
Maybe someone can shed a light and show me, what I got to do to access /system and build.prop?
(Apart from getting a new display.)
Greetings
I believe you need to call "/sys" instead of "/system" so it can be found in /proc/mounts where the mount requirement are stored
Pan0ptics said:
I believe you need to call "/sys" instead of "/system" so it can be found in /proc/mounts where the mount requirement are stored
Click to expand...
Click to collapse
help!
my audio daemon services are not running in latest nitrogen pie rom.it was running before on other pie rom on redmi 3s
some bug reports generated .
i did all possible simple solution like factory reset or complete clean flash of stock rom or tried other older rom like rr oreo rom but no luck .
and i mounted system partition as rw it resets to ro after every reboot.
maybe strace is not running properly it is mentioned in bug report