Minimal system with root - Android Q&A, Help & Troubleshooting

Hi all,
I'm after a system.img that's going to allow me to run adb shell sessions as root. That's all I need. I don't need any of the normal phone fuctions or devices. I'd imagine disabling these would overcome any incompatibility issues... but I don't know.
Naturally, it'd be easier if such an image already existed, but I should be able to follow instructions on how to reconfigure a normal system and pack it to yaffs2 image.

---

How about the ramdisk of most custom recoveries- or is that too spare? It will give you a kernel, adb, and busybox if you are lucky.
sent from my android tablet

---

gee one said:
How about the ramdisk of most custom recoveries- or is that too spare? It will give you a kernel, adb, and busybox if you are lucky.
Click to expand...
Click to collapse
As long as I can do an adb shell as root then it's good enough.
I haven't found any compatible custom recovery images that I can flash. Everything I read seems to endup point to clockworkmod and I can't find flashable images for that. It seems to be flashed through rom manager only. I'm probably wrong though.

---

Depending on your device, there are several ways to flash. These may or may not apply to you:
1) some recovery installer app that you can download, similar to rom manager, or even rom manager itself!
2) a zip file that you make or modify yourself
3) flash through the staging partition, which may or may not be available on your device
4) copy directly into a recovery partition
5) who knows?
What device are you using and what rom and recovery are you using?

---

Sorry, I should have given you some info about my situation.
My phone is a chinese mt6516 iClone: W008+. It's currently without a working system partition so I flash images via pc using Mediatek flash tool.
For a recovery, I'd need an image file to flash directly. For a system partition I could flash and image file or I can pack a dir structure into a yaffs2 image file for flashing.

---

That seems above my paygrade... when you say image file, do you mean a packed boot.img that starts with ANDROID!
sent from my cyanogen(mod) vision

---

gee one said:
That seems above my paygrade... when you say image file, do you mean a packed boot.img that starts with ANDROID!
Click to expand...
Click to collapse
Well, a boot.img would go on the boot partition for booting into android normally. A recovery.img would also start with ANDROID but would go on the ... er... recovery partition. A system image would be different starting something like:
Code:
03 00 00 00 01 00 00 00 ff ff

---

Ok, it looks like the system.img is yaffs.
I was asking about the boot partition because most recovery images are just boot.img's with the recovery binary in the ramdisk. I made a boot.img once from a recovery partition and flashed it, so I had two recoveries on the same device, and no system! I thought this might be something of what you are looking for. You won't have or need a system since everything will load from the boot.img.
sent from my cyanogen(mod) vision

---

Yes, anything that gives me a root shell via adb would be good. It's just a question of finding something appropriate to try...

---

Are there any roms or system images available for your device now? Or can you pull the boot.img from your current device.
sent from my cyanogen(mod) vision

---

I can't find anything 3rd party for it. But I do have a boot.img that I extracted.

---

Send me a link and I'll poke around. Do you have a way to flash the boot.img?
sent from my cyanogen(mod) vision

---

Nice one.
This was ripped with dump_image:
boot.zip

---

OK, I extracted the ram disk- it was in an odd format. They sure talk funny.
ramdisk_2bb4ad9697.tar
So all the inits are for a fully working system, which you don't have. I guess the next step would be to strip out the inits to just a few basic mount points and then have it start adb. After that, add busybox and whatever goodies, repack it, and then flash away.
I really don't know my way around the init files, so it's mostly hack and slash. If you have any insight on how to strip them down, let's hear it. I'll try to read up on how linux boots. Also, knowing the partition mounts would be helpful, although I suppose you could figure that out with adb, if this actually works.

---

Cheers for that. Looks quite intriguing... I'm going to need a good deal more reading to make use of it though.

---

OK, here is a first stab- I modified the default.prop and added busybox and su. I did not touch any of the init's.
Here is the default.prop- insecure and adb enabled. I didn't change the inits, but it does look like they will start adb. They will probably fail to start everything else that it expects to find in system and frameworks, so your syslog will probably be littered with error messages, if there is even a syslog.
Code:
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=0
ro.allow.mock.location=0
ro.debuggable=1
persist.service.adb.enable=1
Here is the ramdisk. I added busybox and su. I'm not sure if these will be helpful, but I figured it couldn't hurt.
edit: I just realized that /xbin is not in the path. "export PATH $PATH:/xbin" should fix it?? "/xbin/busybox --install /system/xbin" should install busybox to /system/xbin.
Code:
total 212
-rw-r--r-- 1 root root 20175 2012-03-08 18:26 advanced_meta_init.rc
drwxrwx--x 2 root root 4096 2012-03-08 18:26 data
-rw-r--r-- 1 root root 118 2012-03-08 20:11 default.prop
drwxr-xr-x 2 root root 4096 2012-03-08 18:26 dev
-rwxr-x--- 1 root root 107436 2012-03-08 18:26 init
-rwxr-x--- 1 root root 5828 2012-03-08 18:26 init.factory.rc
-rwxr-x--- 1 root root 1677 2012-03-08 18:26 init.goldfish.rc
-rwxr-x--- 1 root root 2263 2012-03-08 18:26 init.mt6516.rc
-rwxr-x--- 1 root root 20514 2012-03-08 18:26 init.rc
-rw-r--r-- 1 root root 5529 2012-03-08 18:26 meta_init.rc
drwxr-xr-x 2 root root 4096 2012-03-08 18:26 proc
lrwxrwxrwx 1 root root 11 2012-03-08 18:34 res -> /system/res
drwxr-x--- 2 root root 4096 2012-03-08 20:16 sbin
drwxr-xr-x 2 root root 4096 2012-03-08 18:26 sys
drwxr-xr-x 2 root root 4096 2012-03-08 18:26 system
drwxr-xr-x 2 root root 4096 2012-03-08 18:06 temp
drwxr-xr-x 2 root root 4096 2012-03-08 20:16 xbin
./data:
total 0
./dev:
total 0
./proc:
total 0
./sbin:
total 368
-rwxr-x--- 1 root root 138372 2012-03-08 18:26 adbd
-rwxr-x--- 1 root root 107436 2012-03-08 18:26 advanced_meta_init
-rwxr-x--- 1 root root 103116 2012-03-08 18:26 meta_init
-rwxr-x--- 1 root root 18012 2012-03-08 18:26 meta_tst
./sys:
total 0
./system:
total 0
./temp:
total 0
./xbin:
total 828
-rwxrwxr-x 1 root root 821340 2012-03-08 20:14 busybox
-rwsr-sr-x 1 root root 22364 2012-03-08 20:15 su
I did not change the kernel at all. The kernel and ramdisk have a 512 byte header file- it seems to have a file marker, size of package, and type of partition encoded into it. I'm not even sure this is android? I am certainly NOT an expert at this. For the record, I know nothing about the device that you have. I didn't even google it to see if was indeed an android phone.
All that being said, I will be surprised if this works and I would not be surprised if you end up with a brick. If it were my device, I would only flash this if I had a 100% bulletproof way to flash the stock boot.img externally without relying on the software on the phone. There is no system or frameworks, so it will most likely look like a stuck boot, but adb should be enabled. There is no boot animation or friendly little green android to greet you. I don't know if more stuff is needed in bin or sbin?
Now the disclaimers-
Code:
[SIZE="5"][COLOR="Red"][B]ALL WARRANTIES REGARDING
MERCHANTABILITY AND FITNESS OF PURPOSE,
EXPRESSED OR IMPLIED, ARE DISCLAIMED.
Flashing this boot image can cause
loss of data, loss of device, inability to use device,
spontaneous bricking, and other grave consequences.
Use at your own peril.
If anything bad happens, it's not my fault.[/COLOR][/B]
[/SIZE]
.
Good Luck! If in doubt, don't flash it!
https://rapidshare.com/files/1856533633/boot_adb_4026ab44b0.img

---

Well, I can't say I understand what you've done here but...
I've now got a working phone with root adb. Brilliant!!! Thanks.
I had to flash another system image (meant for a different phone) so that I could get a shell working otherwise I'd get a 'can't find /system/bin/sh' error. But having done that, it works a treat. The system still needs a bit of work to get my phone as it should be but that's another story.
I'm really interested in how you've managed to do this. How do you unpack/repack the boot.img? I'd love to mess about with this and see how long it takes to blow my phone up. I tried to follow one guide on the net but it just wasn't happening.

---

Ok, I found the ROOTFS section and pulled it out. So I can see how it all fits together.
According to 7zip, this is a 'Cpio' archive inside a 'Gzip' archive. What's 'Cpio'?

---

That's the funny part- there is a 512 byte header that has a few id characters, the file size and then "ROOTFS". The kernel image is similar. All the android parts that I've pulled apart didn't have the 512 byte header.
If you strip that out, then you will have a gzipped cpio archive. You can extract it with "gunzip -c <the ramdisk> | cpio -i"
To recompress it, "find . | cpio -o -H newc | gzip >> ../your-new-ramdisk"
You'll have to reattach the 512 byte header and adjust the file size.
sent from my cyanogen(mod) vision

---

Well I got round to having a little play with this. Thanks for the info Gee, it's been filed safely.
I looked at the recovery image and the init.rc doesn't do alot; Ideal starting place. Nothing is mounted by default so I put a couple of commands to mount /sdcard and /system normally just to test it. I also had to enable adb in the default.prop file as you did before. This was pretty straight forward and worked. I got into adb shell with root, no problem.
Now I thought it would be ideal if I could mount the sdcard as /system and put '/bin/sh' on the sdcard. Androids sh isn't a link like it is on Linux so I thought this should work. It didn't! On issuing the 'adb shell' command, I got:
Code:
link_image[2030]: failed to link /system/bin/sh
CANNOT LINK EXECUTABLE
So I thought I'd try the cache partition. I copied /bin/* to /cache, put the mount commands for /sdcard and cache as /system and this time... I got the same error. I'm surprised the cache partition didn't work. I was able to 'adb pull' the /system/bin/ files from it so I don't know why adb couldn't just execute one of them???
I don't know what to try next as I don't want to be forced to have the system partition mounted just for the sake of adb finding sh. I wouldn't mind if I could just umount it once I'm in the shell... but that would be to easy, wouldn't it.