I've seen a lot of stuff using 'dd' but nothing that uses that for backuping the entire phone.
When I connect my phone I see both the external SDcard and the internal and just to be sure to take the correct one I pull the external out,
unless you know by its size, can I use this: (this assumes that /dev/sdb is the internal SDcard)
Code:
dd if=/dev/sdb of=/some/place/phone.image bs=4096 conv=notrunc,noerror
and later use that for a total recovery?
I've done this for lots of my Linux systems even just to backup some partitions (but then sdbN...)
but never on a phone and since it's Linux based....
//B52
Of course you can backup using dd, I suggest though that you do partitions seperately since restoring a single image be problematic if possible since some partitions are hidden and writing to the bootloader partitions is not a good idea incase of problems
Here is a list of the partitions with names.
[email protected]:/sdcard # ls -l /dev/block/platform/dw_mmc/by-name/
lrwxrwxrwx 1 root root 20 May 12 21:24 CACHE -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 May 12 21:24 DATAFS -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 20 May 12 21:24 EFS -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 May 12 21:24 FACTORYFS -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 May 12 21:24 HIDDEN -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 May 12 21:24 KERNEL -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 May 12 21:24 MODEM -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 May 12 21:24 PARAM -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 May 12 21:24 RECOVERY -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 May 12 21:24 SBL1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 May 12 21:24 SBL2 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 May 12 21:24 UMS -> /dev/block/mmcblk0p11
The ones I suggest backing up are:
EFS this is a must and the most important without it your phone could be unusable if the files become corrupt and you don't have a backup
DATAFS is user data
FACTORYFS is the system partition
HIDDEN if you are on Jelly Bean this adds to and extends the system partition
UMS is your internal sdcard (probably better ways to backup then a dd)
Even if you backup don't restore the SBL partitions since if something goes wrong it will screw your phone and they are not damaged if your phone boots at all if they get damaged you will be paying to get your phone jtaged
One thing though, since this is not under /dev/sdX, is it possible to use dd on these /dev/block/ ?
Never done that before and what is the difference between a block and a device?
Hi all,
i am trying to make a dual boot kernel for the Galaxy note 2, using the siyah kernel source code.
I have to change the partition layout in his ramfs, but i need the Galaxy s3 partition layout so i can figure out what i need to change it to.
Would someone please be able to:
open a terminal on your rooted phone,
Type: "ls -l /dev/block/platform/dw_mmc/by-name" in to the terminal
And then copy and paste the Result you get from that to this post.
If someone could please do that, i would be very greatful
Thanks
Cheers
Corey
Anyone??
Cheers
Corey
Here you go:
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOOT -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOTA0 -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOTA1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 Dec 15 21:15 CACHE -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 Dec 15 21:15 EFS -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 Dec 15 21:15 HIDDEN -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Dec 15 21:15 OTA -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 Dec 15 21:15 PARAM -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Dec 15 21:15 RADIO -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 Dec 15 21:15 RECOVERY -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 Dec 15 21:15 SYSTEM -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Dec 15 21:15 USERDATA -> /dev/block/mmcblk0p12
Verzonden door mijn GT-I9300 met xda premium
coolhof said:
Here you go:
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOOT -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOTA0 -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 Dec 15 21:15 BOTA1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 Dec 15 21:15 CACHE -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 Dec 15 21:15 EFS -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 Dec 15 21:15 HIDDEN -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Dec 15 21:15 OTA -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 Dec 15 21:15 PARAM -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Dec 15 21:15 RADIO -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 Dec 15 21:15 RECOVERY -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 Dec 15 21:15 SYSTEM -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Dec 15 21:15 USERDATA -> /dev/block/mmcblk0p12
Verzonden door mijn GT-I9300 met xda premium
Click to expand...
Click to collapse
Thanks heaps, that's just what I needed.
Thanks again
Cheers
Corey
Sent from my GT-N7100 using Tapatalk 2
STOCK FIRMWARE FOR E2303 FLASHABLE ZIP
UPDATE: Uploading because this time IT WORK! Thanks to @TheVektor for updater-script! But this isn't pre-rooted, because it not flash SuperSU. But it's still awesome because if you have problems with flashmode or other you can flash this as a recovery zip! Tested on E2303 with TWRP. Made with PRFCreator
alby_var said:
STOCK PRE-ROOTED FIRMWARE FOR E2303 FLASHABLE ZIP
Hey guys! I had a problem entering flashmode and the only way for unbrick my phone was enter into recovery/flash a zip or fastboot flash.
For this, i made a pre-rooted firmware with PRFcreator. Now I am testing it. It will not install a recovery because xzdualrecovery is not compatible with our device. That means you have to flash it manually before start installing this.
STATUS: RECOVERY NOT INSTALL ZIP FILE....
Download: testing and uploading...
Click to expand...
Click to collapse
Hey! I'm interested in this ROM, my device has a locked bootloader and I think this would solve out the issue of rooting without unlocking the bootloader. I can test the ROM. My model is: E2306
Do you have any finished projects?
Quien mucho abarca poco aprieta
rascayus said:
Quien mucho abarca poco aprieta
Click to expand...
Click to collapse
English please
Don'te bite more than you can chew
I think every thread you have created is pointless. "Uploading"... yeah great.
Maybe get something uploaded first, then create a thread instead of having multiple threads that are pointless...
I respect your efforts but still
Guys, the rom are completed, the problem is that we haven't a working updater-script file. It is needed for flash roms, and I am working to make one that work. I can upload the rom and give you the link, but if it not flash, where is the sense in that?
Code:
if
run_program("/tmp/busybox", "ls", "/dev/block/platform/msm_sdcc.1/by-uuid/F9CDF7BA-B834-A72A-F1C9-D6E0C0983896") != "0"
then
abort("Error: UUID link to system partition does not exist");
endif;
assert(package_extract_file("system.ext4", "/dev/block/platform/msm_sdcc.1/by-uuid/F9CDF7BA-B834-A72A-F1C9-D6E0C0983896"));
M4 Aqua (E2303) does not have "msm_sdcc.1" and "by-uuid" folders or whatever is it....
We have MMC device partitions:
Code:
lrwxrwxrwx root root 1970-02-06 11:48 DDR -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-02-06 11:48 FOTAKernel -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-02-06 11:48 LTALabel -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-02-06 11:48 TA -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-02-06 11:48 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-02-06 11:48 alt_aboot -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-02-06 11:48 alt_hyp -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-02-06 11:48 alt_rpm -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-02-06 11:48 alt_s1sbl -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-02-06 11:48 alt_sbl1 -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-02-06 11:48 alt_tz -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-02-06 11:48 apps_log -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-02-06 11:48 boot -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-02-06 11:48 cache -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-02-06 11:48 config -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-02-06 11:48 fsg -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-02-06 11:48 hyp -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-02-06 11:48 modem -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-02-06 11:48 modemst1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-02-06 11:48 modemst2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-02-06 11:48 oem -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-02-06 11:48 persist -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-02-06 11:48 rdimage -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-02-06 11:48 rpm -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-02-06 11:48 s1sbl -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-02-06 11:48 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-02-06 11:48 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-02-06 11:48 system -> /dev/block/mmcblk0p30
lrwxrwxrwx root root 1970-02-06 11:48 tz -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-02-06 11:48 userdata -> /dev/block/mmcblk0p29
So we need create updater-script using similar formats:
Code:
run_program("/tmp/busybox", "ls", "/dev/block/mmcblk0p30") != "0"
AND
assert(package_extract_file("system.ext4", "/dev/block/mmcblk0p30"));
Im not 100% sure this is the problem, but i hope it can help for you.
Edit:
OK! zip flashing finished (system flashed!), but supersu not installed by updater-script... idk why.
My updater-script: http://pastebin.com/8Lg7UseV
Ohh! Really Really Really thank you!! Now i can unbrick my phone and finally complete the roms!
alby_var said:
STOCK FIRMWARE FOR E2303 FLASHABLE ZIP
UPDATE: Uploading because this time IT WORK! Thanks to @TheVektor for updater-script! But this isn't pre-rooted, because it not flash SuperSU. But it's still awesome because if you have problems with flashmode or other you can flash this as a recovery zip! Tested on E2303 with TWRP. Made with PRFCreator
Click to expand...
Click to collapse
Its flashable zip too... not important pre-rooted or not after flashing is done, simple you can install supersu.zip too. :good:
But You try to build pre rooted Rom?
Wysłane z mojego E2303 przy użyciu Tapatalka
Later I will try to make a flashable working prerooted, tomorrow i will upload it ( i tried today but still at 60% uploading) but for now I will complete de-bloated and other projects....
Ok, I uploaded to Mediafire but it not give me the link.... I am uploading again to Mega and its at 30%
alby_var said:
Ok, I uploaded to Mediafire but it not give me the link.... I am uploading again to Mega and its at 30%
Click to expand...
Click to collapse
And ?? Can you upload pre rooted Rom ?
I not successfully can upload it. All hosting websites stop uploading or still for 2-3 days and i have to shut down pc.
Upload it to google drive and share link,ty
Stock firmware for e2303 flashable zip
Link?
26.1.a.2.167/r12a
Can someone explain what means R12A in 26.1.A.2.167/R12A ?
so, does anybody have this flashable stock rom? I could really use it right now...
First of all credit for this goes to arpruss - https://github.com/arpruss/cve2019-2215-3.18.
Just download and install the apk from here https://github.com/arpruss/cve2019-2215-3.18/raw/master/release/app-release.apk
Then open the app and click install. You are done
WARNING: once you have a root shell do not modify system files as that will result in a bricked system until we figure out a way to unlock the bootloader.
Permanent root suggestion
Hi, guys, after this great achievement, permanent root might be desirable.
I'll tell you a story...I've always loved qwerty phones and one of the rare phones I've always wanted is NEC Terrain (distributed by AT&T). Unfortunately AT&T has locked it to its network and I found no working solution for unlocking it for other SIM cards (please let me know if you know of a working SIM unlock service!), BUT I've always wanted to gain permanent root privileges for this device. The story of NEC Terrain is very similar to Palm Phone PVG100 (Pepito):
NEC Terrain was released by AT&T and the bootloader locked, while Palm Phone PVG100 (Pepito) was released by Verizon and the bootloader locked...
NEC company is not on the market anymore and Palm company is in a similar condition, which makes contacts with the company difficult and the hope of updates to be released unlikely...
Code for NEC Terrain was developed by enthusiasts (https://github.com/android-rooting-tools/android_run_root_shell) similar to arpruss code for Palm Phone PVG100 (Pepito) (https://github.com/arpruss/cve2019-2215-3.18)...
Temporary root solution for NEC Terrain was achieved (https://github.com/x29a/nec_terrain_root) like root solution for Palm Phone PVG100 (Pepito) was achieved (https://github.com/arpruss/cve2019-2215-3.18/tree/master/release)...
For NEC Terrain a creative permanent root solution was developed by x29a (https://github.com/x29a/nec_terrain_root/blob/master/terroot/README.md) and now my suggestion is that we might want to follow his steps for Palm Phone PVG100 (Pepito)!
Here are the details of "HOW ALEX-KAS DID IT"!:
https://forum.xda-developers.com/showpost.php?p=61542922&postcount=186
Does anyone of you find this path convincing?
greatjack1 said:
First of all credit for this goes to arpruss - https://github.com/arpruss/cve2019-2215-3.18.
Just download and install the apk from here https://github.com/arpruss/cve2019-2215-3.18/raw/master/release/app-release.apk
Then open the app and click install. You are done
WARNING: once you have a root shell do not modify system files as that will result in a bricked system until we figure out a way to unlock the bootloader.
Click to expand...
Click to collapse
Hi there, please have a look at the attached pictures and let me know what might be wrong...I mean, what is the app-release.apk file you added to your post supposed to be doing?
And what exactly does the "Install on boot" optional tickbox do?
StormSeeker1 said:
Hi there, please have a look at the attached pictures and let me know what might be wrong...I mean, what is the app-release.apk file you added to your post supposed to be doing?
And what exactly does the "Install on boot" optional tickbox do?
Click to expand...
Click to collapse
Really wierd, it worked for me. Let me look a little deeper
greatjack1 said:
Really wierd, it worked for me. Let me look a little deeper
Click to expand...
Click to collapse
Do I have to run or install that .apk AFTER having spawned the root privileged shell or in substitution for it?
What is it supposed to be doing?
---------- Post added at 11:14 PM ---------- Previous post was at 11:11 PM ----------
greatjack1 said:
First of all credit for this goes to arpruss - https://github.com/arpruss/cve2019-2215-3.18.
Just download and install the apk from here https://github.com/arpruss/cve2019-2215-3.18/raw/master/release/app-release.apk
Then open the app and click install. You are done
WARNING: once you have a root shell do not modify system files as that will result in a bricked system until we figure out a way to unlock the bootloader.
Click to expand...
Click to collapse
May I ask you to please put the list of the commands needed for spawning the root privileged shell back in your tutorial? I think it helps people a lot
Oh, and, people, do you know why, when I have the root shell, I'm not able to get the following command executed?
setprop sys.usb.config diag,adb
I get the following response:
setprop: failed to set property 'sys.usb.config' to 'diag,adb'
Why is there three threads about this?
Mattzees said:
Why is there three threads about this?
Click to expand...
Click to collapse
People started them independently and each one is on a specific thing, but all things are connected (there are interconnections and it's not always clear if rooting helps unlocking bootloader or if unlocking bootloader helps permanently rooting or if for compiling custom recoveries (TWRP) one needs root or bootloader unlocking), so these threads have a reason to exist and there are overlaps, but feel free to let people know if you want to merge something!
StormSeeker1 said:
Do I have to run or install that .apk AFTER having spawned the root privileged shell or in substitution for it?
What is it supposed to be doing?
---------- Post added at 11:14 PM ---------- Previous post was at 11:11 PM ----------
May I ask you to please put the list of the commands needed for spawning the root privileged shell back in your tutorial? I think it helps people a lot
Oh, and, people, do you know why, when I have the root shell, I'm not able to get the following command executed?
setprop sys.usb.config diag,adb
I get the following response:
setprop: failed to set property 'sys.usb.config' to 'diag,adb'
Click to expand...
Click to collapse
try dial this code
Code:
###2324#
freezex said:
try dial this code
Code:
###2324#
Click to expand...
Click to collapse
IT WORKS! WHERE DID YOU FIND THIS CODE (AND OTHERS), freezex?! (I had tried lots of them from other phones with no success)
StormSeeker1 said:
IT WORKS! WHERE DID YOU FIND THIS CODE (AND OTHERS), freezex?! (I had tried lots of them from other phones with no success)
Click to expand...
Click to collapse
Guys, I was finally able to read Non-Volatile memory values using freezex's secret code for enable debugging, installing the USB drivers that popup when you choose on the phone the USB option "Drivers CD-ROM" after connecting it to the PC, using "QPST Configuration" tool and "QXDM" tool.
I tried to replace the initial value "2251799813754906" with "68787503589", which, according to my understanding, should cover all Italian LTE bands (please confirm and let me know if there is a way to reverse lookup code 2251799813754906 to see what bands are included inside of it).
The value I entered persisted after reboot and I was able to read the new value with QXDM.
Unfortunately I'm still seeing only a 3G icon on the notification bar...any idea on the cause of this behavior, guys?
A lot of values are there, can you please let me know if changing any of those values might help unlocking the bootloader?
PAY ATTENTION: After having enabled Diagnostic Mode (with freezex's secret code), Windows Device Manager recognizes the phone as "ALCATEL HS-USB Diagnostics 903A (COM6)"; does the fact that it comes from Alcatel give us any hint on what to do?
Also, people, do you find any free space not used by any partition to try NEC Terrain trick?
Here's some information I took from my PVG100:
127|Pepito:/data/local/tmp # df
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 1358904 2764 1356140 1% /
tmpfs 1439680 752 1438928 1% /dev
/dev/block/dm-0 2999516 2218028 781488 74% /system
/dev/block/dm-1 1499760 881984 617776 59% /vendor
tmpfs 1439680 0 1439680 0% /mnt
/dev/block/mmcblk0p52 1998672 6156 1992516 1% /fotadata
/dev/block/mmcblk0p29 237536 400 237136 1% /cache
/dev/block/mmcblk0p12 12016 8448 3568 71% /dsp
/dev/block/mmcblk0p1 85968 81600 4368 95% /firmware
/dev/block/mmcblk0p30 28144 480 27664 2% /persist
/dev/block/dm-2 21667804 7631300 14036504 36% /data
/data/media 21667804 7631300 14036504 36% /mnt/runtime/default/emulated
See also this output:
Pepito:/dev/block/platform/soc/7824900.sdhci/by-name # ls -l
total 0
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 DDR -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 aboot -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 abootbak -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 apdp -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 boot -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 cache -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 cmnlib -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 cmnlib64 -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 cmnlib64bak -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 cmnlibbak -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 config -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 devcfg -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 devcfgbak -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 devinfo -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 dip -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 dpo -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 dsp -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 fotadata -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 fsc -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 fsg -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 keymaster -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 keymasterbak -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 keystore -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 limits -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 logdump -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 mcfg -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 mdtp -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 misc -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 modemst1 -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 modemst2 -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 mota -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 msadp -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 oem -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 persist -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 recovery -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 redbend -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 rpmbak -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 sbl1 -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 sbl1bak -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 sec -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 simlock -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 splash -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 ssd -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 syscfg -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 system -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 traceability -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 tunning -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 1970-01-02 06:36 tzbak -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 userdata -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 1970-01-02 06:36 vendor -> /dev/block/mmcblk0p28
I was able to push the "parted" utility to the phone, after having found a version already compiled for ARMv8 processors (and the Qualcomm SnapDragon 435 inside the PVG100 is an ARMv8).
This is the output I get:
127|Pepito:/data/local/tmp # ./parted /dev/block/mmcblk0 print
Model: MMC GD6BMB (sd/mmc)
Disk /dev/block/mmcblk0: 31.3GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 67.1MB 155MB 88.1MB fat16 modem msftdata
2 201MB 201MB 1024B fsc
3 201MB 201MB 8192B ssd
4 201MB 202MB 524kB sbl1
5 202MB 202MB 524kB sbl1bak msftdata
6 202MB 203MB 524kB rpm
7 203MB 203MB 524kB rpmbak msftdata
8 203MB 206MB 2097kB tz
9 206MB 208MB 2097kB tzbak msftdata
10 208MB 208MB 262kB devcfg
11 208MB 208MB 262kB devcfgbak
12 208MB 225MB 16.8MB ext4 dsp msftdata
13 225MB 227MB 1573kB modemst1
14 227MB 228MB 1573kB modemst2
15 268MB 268MB 32.8kB DDR
16 268MB 270MB 1573kB fsg
17 270MB 270MB 16.4kB sec
18 270MB 272MB 1573kB tunning
19 272MB 273MB 1049kB traceability
20 336MB 337MB 1049kB simlock
21 337MB 340MB 3170kB redbend msftdata
22 340MB 351MB 11.5MB splash
23 403MB 404MB 1049kB aboot
24 404MB 405MB 1049kB abootbak msftdata
25 405MB 472MB 67.1MB boot
26 472MB 539MB 67.1MB recovery
27 539MB 3760MB 3221MB ext4 system
28 3760MB 5371MB 1611MB ext4 vendor
29 5436MB 5704MB 268MB ext4 cache
30 5704MB 5738MB 33.6MB ext4 persist
31 5771MB 5772MB 1049kB devinfo
32 5838MB 5840MB 1049kB misc
33 5840MB 5840MB 524kB keystore
34 5840MB 5840MB 32.8kB config
35 5840MB 6109MB 268MB oem
36 6174MB 6174MB 32.8kB limits
37 6241MB 6242MB 524kB mota msftdata
38 6242MB 6243MB 1049kB dip
39 6243MB 6276MB 33.6MB mdtp
40 6276MB 6277MB 524kB syscfg
41 6277MB 6281MB 4194kB mcfg msftdata
42 6308MB 6309MB 1049kB cmnlib
43 6309MB 6310MB 1049kB cmnlibbak
44 6310MB 6311MB 1049kB cmnlib64
45 6311MB 6312MB 1049kB cmnlib64bak
46 6312MB 6313MB 1049kB keymaster
47 6313MB 6315MB 1049kB keymasterbak
48 6375MB 6376MB 262kB apdp
49 6376MB 6376MB 262kB msadp
50 6376MB 6376MB 8192B dpo
51 6376MB 6443MB 67.1MB logdump
52 6443MB 8590MB 2147MB ext4 fotadata msftdata
53 8590MB 31.3GB 22.7GB userdata
StormSeeker1 said:
Do I have to run or install that .apk AFTER having spawned the root privileged shell or in substitution for it?
What is it supposed to be doing?
---------- Post added at 11:14 PM ---------- Previous post was at 11:11 PM ----------
May I ask you to please put the list of the commands needed for spawning the root privileged shell back in your tutorial? I think it helps people a lot
Oh, and, people, do you know why, when I have the root shell, I'm not able to get the following command executed?
setprop sys.usb.config diag,adb
I get the following response:
setprop: failed to set property 'sys.usb.config' to 'diag,adb'
Click to expand...
Click to collapse
StormSeeker1 said:
IT WORKS! WHERE DID YOU FIND THIS CODE (AND OTHERS), freezex?! (I had tried lots of them from other phones with no success)
Click to expand...
Click to collapse
I was googling something like "alcatel diagnostic code",and found it in this funny page. LoL
http://huaweisolarinverter.com/q16el/zav.php?juc=alcatel-6055u
freezex said:
I was googling something like "alcatel diagnostic code",and found it in this funny page. LoL
http://huaweisolarinverter.com/q16el/zav.php?juc=alcatel-6055u
Click to expand...
Click to collapse
Well...congratulations
Folks, might this be helpful?
https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html
https://www.emergingdefense.com/blog/2019/5/20/how-to-put-a-qualcomm-phone-into-edl-mode
People, I had an idea! Look here:
https://www.verizonwireless.com/support/knowledge-base-200052/
From the previous page, it looks like Verizon allows for enabling fastboot!
I tried chatting with them or getting a contact, but it looks like they require you to be their customer to listen to you. Can you find a way to contact them and kindly ask for a fastboot enable solution for Palm PVG100? Is there any user of this forum able to help us (possibly somebody who is currently using Verizon as a provider)?
https://www.verizonwireless.com/support/contact-us/
All those GitHub links are dead. Please advise.
Also what is the root.zip with a file names root in it? Is that the APK or something else (no extension).
Thanks again. Very exciting stuff.
greatjack1 said:
First of all credit for this goes to arpruss - https://github.com/arpruss/cve2019-2215-3.18.
Just download and install the apk from here https://github.com/arpruss/cve2019-2215-3.18/raw/master/release/app-release.apk
Then open the app and click install. You are done
WARNING: once you have a root shell do not modify system files as that will result in a bricked system until we figure out a way to unlock the bootloader.
Click to expand...
Click to collapse
bensdeals said:
All those GitHub links are dead. Please advise.
Also what is the root.zip with a file names root in it? Is that the APK or something else (no extension).
Thanks again. Very exciting stuff.
Click to expand...
Click to collapse
Hi, bensdeals
unfortunately arpruss removed his repository from github:
https://forum.xda-developers.com/showpost.php?p=80702567&postcount=164
Luckily another user, which I thank a lot (ilikenwf) has a mirror of what has been done so far:
https://forum.xda-developers.com/showpost.php?p=80702567&postcount=167
The root.zip file contains a file with no extension, which is not an apk package, but an executable compiled for the architecture of the CPU and for the operating system that PVG100 has.
Here's how to run the "root" file inside the package:
On windows open a CMD shell in the folder where "adb.exe" and "root" files are, then:
adb push root /data/local/tmp
adb shell
chmod +x /data/local/tmp/root
cd /data/local/tmp
./root
See below what you get (notice the # sign, meaning root user as opposed to the $, meaning regular user):
adb shell
Pepito:/ $ chmod +x /data/local/tmp/root
Pepito:/ $ cd /data/local/tmp
Pepito:/data/local/tmp $ ./root
MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xffffffc059c51980
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xffffffc03d8db4a0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0xffffffc066664000
CHILD: Finished write to FIFO.
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffc059c51980
MAIN: stack = ffffffc066664000
MAIN: Clobbering addr_limit
PARENT: clobbering at 0xffffffc066664008
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69648
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xffffffc066664000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = ffffffc000000000
MAIN: searching for selinux_enforcing
MAIN: setting root credentials with cred offset 670
MAIN: UID = 0
MAIN: enabling capabilities
MAIN: SECCOMP status 0
MAIN: disabled selinux enforcing
MAIN: no whitelist, so all callers are welcome
MAIN: root privileges ready
MAIN: popping out root shell
Pepito:/data/local/tmp #
Does this help?
Thanks, that does work in achieving root. Question, you indicated modifying any system files would brick the device. Without an app to grant root access to other apps (supersu), then there isn't much we can do. Have you attempted to do anything else besides running this script?
... About your unlocking bands via editing nv data. Once you have root you can use the Network Signal Guru app to see if you have unlocked the bands. This doesn't necessarily mean those bands will work.
bensdeals said:
Thanks, that does work in achieving root. Question, you indicated modifying any system files would brick the device. Without an app to grant root access to other apps (supersu), then there isn't much we can do. Have you attempted to do anything else besides running this script?
... About your unlocking bands via editing nv data. Once you have root you can use the Network Signal Guru app to see if you have unlocked the bands. This doesn't necessarily mean those bands will work.
Click to expand...
Click to collapse
I'll have a look at the Network Signal Guru app, thanks. About that warning, it wasn't me writing it...and I'm a bit worried of trying modifying the system without having any ROM to reflash in case of brick (nor a working way to perform the flashing)...is there anyone who can help us with this?
I've just installed the Network Signal Guru app...but it looks like it requires root privileges, do you confirm? Also, how should I use it to get the LTE bands I'm using? Is it part of the free functionalities? What are paid functionalities?
It gives you the ability to disable active bands.. what it will do for you is tell you if you did successfully unlock and enable a band. You can then disable all the other bands with th tool. All via the free version with root.
Not sure if you can run it after rooting from the adb shell with root or what is consider problematic towards bricking your device.
StormSeeker1 said:
I'll have a look at the Network Signal Guru app, thanks. About that warning, it wasn't me writing it...and I'm a bit worried of trying modifying the system without having any ROM to reflash in case of brick (nor a working way to perform the flashing)...is there anyone who can help us with this?
I've just installed the Network Signal Guru app...but it looks like it requires root privileges, do you confirm? Also, how should I use it to get the LTE bands I'm using? Is it part of the free functionalities? What are paid functionalities?
Click to expand...
Click to collapse
StormSeeker1 said:
Well...congratulations
Folks, might this be helpful?
https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html
https://www.emergingdefense.com/blog/2019/5/20/how-to-put-a-qualcomm-phone-into-edl-mode
People, I had an idea! Look here:
https://www.verizonwireless.com/support/knowledge-base-200052/
From the previous page, it looks like Verizon allows for enabling fastboot!
I tried chatting with them or getting a contact, but it looks like they require you to be their customer to listen to you. Can you find a way to contact them and kindly ask for a fastboot enable solution for Palm PVG100? Is there any user of this forum able to help us (possibly somebody who is currently using Verizon as a provider)?
https://www.verizonwireless.com/support/contact-us/
Click to expand...
Click to collapse
The context of that fast boot was an older Qualcomm feature which put your phone into a hibernation state so that it would boot quicker it isn't releated to the bootloader fastboot. Also to answer your question about the alcatel driver that is just what windows picks the driver to be by default when it sees one of the many qualcomm debug modes..
deadman96385 said:
The context of that fast boot was an older Qualcomm feature which put your phone into a hibernation state so that it would boot quicker it isn't releated to the bootloader fastboot. Also to answer your question about the alcatel driver that is just what windows picks the driver to be by default when it sees one of the many qualcomm debug modes..
Click to expand...
Click to collapse
Thank you for clarifying; anyway, about the drivers, when you set the USB mode on the phone after connecting it to the PC, you have the option to connect it as a virtual CD drive, containing the drivers, so drivers (I don't know which ones) come from the phone itself (maybe this is unusual, but that read-only emulated CD partition exists on this phone).
StormSeeker1 said:
Thank you for clarifying; anyway, about the drivers, when you set the USB mode on the phone after connecting it to the PC, you have the option to connect it as a virtual CD drive, containing the drivers, so drivers (I don't know which ones) come from the phone itself (maybe this is unusual, but that read-only emulated CD partition exists on this phone).
Click to expand...
Click to collapse
That is used fairly often normally it's a setup exe to install them. Which depending on if it contains a driver for the mode your in it would override the Alcatel branded one which in reality is just there because both Alcatel and palm are TCL brands now.