BOUNTY FOR UNLOCKED BOOTLOADER FOR SONY TABLET S
$103 PLEDGED!
Following the successful root of our devices, one would expect that more developer support should come to Sony Tablet S. Yet, having root is but one of the two 'holy grails' which will turn our devices into hot properties.
As such, I suggest we begin a second bounty, this time for the first person to successfully unlock the bootloader and provide a working proof of concept for its implementation*. Given that the ICS update will (likely) remove our root, we will still be back to square one unless someone can couple the first success with a working unlocked bootloader which will finally let us install recovery and hopefully install custom ROMs or customized official ROMs.
I hope we can get as many people aboard as possible, and at least some of the usual suspects from the root equivalent bounty topic.
*The Rules:
'Unlocking the bootloader' refers to: An exploit, method or application/software which unlocks the bootloader and allows us to install custom recoveries, kernels or ROMs.
To earn the bounty, you simply have to find the exploit which will allow the above first. You do not have to develop a recovery, or a kernel or a ROM, but you must provide with a working proof of concept, i.e. with a way which allows us to verify that the bootloader has been completely unlocked and that other developers can use this method to install recovery, kernel and ROMs.
Here's hoping there are some who will take this new challenge up with renewed vigour, now that root is here!
The pledgers:
1. grcd: $12
2. condi: $10
4. wintermute000: $10
5. kvssvarma: $10
6. [email protected]: $25
7. eldron: $16 [Pledged via PM]
8. xaviorffviii: $20
NOTE: THIS TOPIC ALSO CONTAINS AN ACTIVE TECHNICAL CONVERSATION REGARDING THE TOPIC. SEE HERE AND FOLLOW ENSUING CONVERSATIONS.
10$ from me
$10 from me too
Is there actually any evidence that the bootloader is locked? Keep in mind there's a difference between a locked bootloader and a bootloader that doesn't support flashing by default.
A truly locked bootloader (like HBOOT on HTC devices or Motorola's MBM bootloader) actually verifies a digital signature on the boot or recovery partition before booting it, so it's not possible to run custom ROMs without using workarounds like 2nd init.
On the other hand, some bootloaders don't allow you to *flash* images by default, but if you manage to get root and flash a new recovery or boot image, it will boot without complaint.
Unless someone has a reason to believe otherwise, it might be possible that the Sony Tablet S falls into the second category. Now that root has been achieved, it's possible to flash custom recovery images by writing to a block device using ADB.
It's definitely worth trying this out. Someone who knows what they're doing should create a full backup of the original recovery partition (using "dd" from a root shell) and flash a custom recovery image to the appropriate block device and see what happens when you try to boot into recovery mode. There's a chance it "just works".
You are right about this. If you could provide a little bit more information I would be willing to try it out myself. Sometimes you have to treat everyone as a complete newbie. I have a degree in Computing -- although I have never professed it and I am now in an entirely different academic field (Sociology/Cultural Anthropology), and to be entirely frank, I am adept at following instructions but not trying things on my own which might brick my device
Well, the first step is easy: make a backup of the existing recovery partition.
Load up an ADB shell and type "su" to assume root privileges. Next, you can make an exact copy of the recovery image by using dd:
dd if=/dev/block/recovery of=/sdcard/recovery.img
This is assuming you have enough room on your SD card to fit the recovery image. At this point, it would be helpful if you could pull that off the phone ("adb pull /sdcard/recovery.img") and get it in the hands of someone who knows what they're doing.
The next step involves flashing a recovery image to the device. Basically just the reverse of the previous step:
dd if=/sdcard/new_recovery.img of=/dev/block/recovery
Where you've placed a new recovery image on the SD card as "new_recovery.img". Of course, this is the part where someone with experience needs to do some work. I doubt most custom recoveries are going to work right off the shelf. You'll have to get someone who's used to developing custom recoveries to get involved to port it to the Sony Tablet S.
'ls' od /dev/block:
loop0
loop1
loop2
loop3
loop4
loop5
loop6
loop7
mmcblk0
mmcblk0p1
mmcblk0p10
mmcblk0p11
mmcblk0p2
mmcblk0p3
mmcblk0p4
mmcblk0p5
mmcblk0p6
mmcblk0p7
mmcblk0p8
mmcblk0p9
mmcblk1
mmcblk1p1
platform
svold
vold;
Detailed structure:
# find
find
.
./vold
./vold/179:11
./vold/179:10
./vold/179:9
./vold/179:8
./vold/179:7
./vold/179:6
./vold/179:5
./vold/179:4
./vold/179:3
./vold/179:2
./vold/179:1
./vold/179:0
./svold
./svold/179:17
./svold/179:16
./loop7
./loop6
./loop5
./loop4
./loop3
./loop2
./loop1
./loop0
./mmcblk1p1
./mmcblk1
./mmcblk0p11
./mmcblk0p10
./mmcblk0p9
./mmcblk0p8
./mmcblk0p7
./mmcblk0p6
./mmcblk0p5
./mmcblk0p4
./mmcblk0p3
./mmcblk0p2
./mmcblk0p1
./platform
./platform/sdhci-tegra.2
./platform/sdhci-tegra.2/mmcblk1p1
./platform/sdhci-tegra.2/by-num
./platform/sdhci-tegra.2/by-num/p1
./platform/sdhci-tegra.2/by-name
./platform/sdhci-tegra.2/mmcblk1
./platform/sdhci-tegra.3
./platform/sdhci-tegra.3/mmcblk0p11
./platform/sdhci-tegra.3/mmcblk0p10
./platform/sdhci-tegra.3/mmcblk0p9
./platform/sdhci-tegra.3/mmcblk0p8
./platform/sdhci-tegra.3/mmcblk0p7
./platform/sdhci-tegra.3/mmcblk0p6
./platform/sdhci-tegra.3/mmcblk0p5
./platform/sdhci-tegra.3/mmcblk0p4
./platform/sdhci-tegra.3/mmcblk0p3
./platform/sdhci-tegra.3/mmcblk0p2
./platform/sdhci-tegra.3/mmcblk0p1
./platform/sdhci-tegra.3/by-num
./platform/sdhci-tegra.3/by-num/p11
./platform/sdhci-tegra.3/by-num/p10
./platform/sdhci-tegra.3/by-num/p9
./platform/sdhci-tegra.3/by-num/p8
./platform/sdhci-tegra.3/by-num/p7
./platform/sdhci-tegra.3/by-num/p6
./platform/sdhci-tegra.3/by-num/p5
./platform/sdhci-tegra.3/by-num/p4
./platform/sdhci-tegra.3/by-num/p3
./platform/sdhci-tegra.3/by-num/p2
./platform/sdhci-tegra.3/by-num/p1
./platform/sdhci-tegra.3/by-name
./platform/sdhci-tegra.3/mmcblk0
./mmcblk0
Unfortunatelly:
# dd if=/dev/block/recovery of=/sdcard/recovery.img
dd if=/dev/block/recovery of=/sdcard/recovery.img
/dev/block/recovery: cannot open for read: No such file or directory
Ah, some devices have a "recovery" symlink and others don't. Process of elimation it is.
Try typing "mount", or "cat /proc/mounts". This will list all currently mounted filesystems and which block devices are mounted. That way we can eliminate which block devices *aren't* the recovery partition.
For the record, in case this wasn't clear, I don't own a Tablet S and have never actually physically touched one. Otherwise I'd just do it myself. ;-)
10 bucks USD pledged from me
djrbliss said:
Ah, some devices have a "recovery" symlink and others don't. Process of elimation it is.
Try typing "mount", or "cat /proc/mounts". This will list all currently mounted filesystems and which block devices are mounted. That way we can eliminate which block devices *aren't* the recovery partition.
For the record, in case this wasn't clear, I don't own a Tablet S and have never actually physically touched one. Otherwise I'd just do it myself. ;-)
Click to expand...
Click to collapse
if you need djrbliss i mounted QuickSSHD on my tablet!!!
10 usd from me.
djrbliss said:
Ah, some devices have a "recovery" symlink and others don't. Process of elimation it is.
Try typing "mount", or "cat /proc/mounts". This will list all currently mounted filesystems and which block devices are mounted. That way we can eliminate which block devices *aren't* the recovery partition.
For the record, in case this wasn't clear, I don't own a Tablet S and have never actually physically touched one. Otherwise I'd just do it myself. ;-)
Click to expand...
Click to collapse
Let me know if you want to set TeamViewer session with me.
This way we can work out whatever is possible.
Just the output of the following commands will be fine:
adb shell "ls -l /dev/block"
adb shell "cat /proc/mounts"
djrbliss said:
Just the output of the following commands will be fine:
adb shell "ls -l /dev/block"
adb shell "cat /proc/mounts"
Click to expand...
Click to collapse
adb shell "ls -l /dev/block"
Code:
brw------- root root 254, 0 2012-02-09 00:21 dm-0
brw------- root root 254, 1 2012-02-09 00:21 dm-1
brw------- root root 254, 2 2012-02-09 00:21 dm-2
brw------- root root 7, 0 2012-02-09 00:20 loop0
brw------- root root 7, 1 2012-02-09 00:20 loop1
brw------- root root 7, 2 2012-02-09 00:20 loop2
brw------- root root 7, 3 2012-02-09 00:20 loop3
brw------- root root 7, 4 2012-02-09 00:20 loop4
brw------- root root 7, 5 2012-02-09 00:20 loop5
brw------- root root 7, 6 2012-02-09 00:20 loop6
brw------- root root 7, 7 2012-02-09 00:20 loop7
brw------- root root 179, 0 2012-02-09 00:20 mmcblk0
brw------- root root 179, 1 2012-02-09 00:20 mmcblk0p1
brw------- root root 179, 10 2012-02-09 00:20 mmcblk0p10
brw------- root root 179, 11 2012-02-09 00:20 mmcblk0p11
brw------- root root 179, 2 2012-02-09 00:20 mmcblk0p2
brw------- root root 179, 3 2012-02-09 00:20 mmcblk0p3
brw------- root root 179, 4 2012-02-09 00:20 mmcblk0p4
brw-rw---- root system 179, 5 2012-02-09 00:20 mmcblk0p5
brw------- root root 179, 6 2012-02-09 00:20 mmcblk0p6
brw-rw---- root system 179, 7 2012-02-09 00:20 mmcblk0p7
brw------- root root 179, 8 2012-02-09 00:20 mmcblk0p8
brw------- root root 179, 9 2012-02-09 00:20 mmcblk0p9
drwxr-xr-x root root 2012-02-09 00:20 platform
drwxr-xr-x root root 2012-02-09 00:20 svold
drwxr-xr-x root root 2012-02-09 00:20 vold
adb shell "cat /proc/mounts"
Code:
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/mmcblk0p1 /configs ext2 ro,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p9 /log ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/vold/179:11 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso
8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.halfbrick.ageofzombies-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortn
ame=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.jakyl.spirithd-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixe
d,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/com.playcreek.DeathWorm-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname
=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
Here is my config...
Android version 3.2.1
Kernel version 2.6.36.3 [email protected] #1
Build number THMAS0182400
# mount
Code:
# mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/mmcblk0p1 /configs ext2 ro,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p9 /log ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/svold/179:17 /mnt/sdcard2 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.outfit7.talkingginapro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.jakyl.tilestormhd-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/com.outfit7.talkingbenpro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-3 /mnt/asec/com.quoord.tapatalkxdapre.activity-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-4 /mnt/asec/com.outfit7.talkingtom2-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-5 /mnt/asec/com.outfit7.talkingroby-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-6 /mnt/asec/com.eamobile.tetris_eu-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-7 /mnt/asec/com.outfit7.talkingtompro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-8 /mnt/asec/com.fullfat.android.flickgolf-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
# cat /proc/mounts
Code:
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/mmcblk0p1 /configs ext2 ro,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p9 /log ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/svold/179:17 /mnt/sdcard2 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.outfit7.talkingginapro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.jakyl.tilestormhd-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/com.outfit7.talkingbenpro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-3 /mnt/asec/com.quoord.tapatalkxdapre.activity-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-4 /mnt/asec/com.outfit7.talkingtom2-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-5 /mnt/asec/com.outfit7.talkingroby-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-6 /mnt/asec/com.eamobile.tetris_eu-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-7 /mnt/asec/com.outfit7.talkingtompro-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/dm-8 /mnt/asec/com.fullfat.android.flickgolf-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
# ls -l /dev/block
Code:
brw------- root root 254, 0 2012-02-09 22:46 dm-0
brw------- root root 254, 1 2012-02-09 22:46 dm-1
brw------- root root 254, 2 2012-02-09 22:46 dm-2
brw------- root root 254, 3 2012-02-09 22:46 dm-3
brw------- root root 254, 4 2012-02-09 22:46 dm-4
brw------- root root 254, 5 2012-02-09 22:46 dm-5
brw------- root root 254, 6 2012-02-09 22:46 dm-6
brw------- root root 254, 7 2012-02-09 22:46 dm-7
brw------- root root 254, 8 2012-02-09 22:46 dm-8
brw------- root root 7, 0 2012-02-09 22:45 loop0
brw------- root root 7, 1 2012-02-09 22:45 loop1
brw------- root root 7, 2 2012-02-09 22:45 loop2
brw------- root root 7, 3 2012-02-09 22:45 loop3
brw------- root root 7, 4 2012-02-09 22:45 loop4
brw------- root root 7, 5 2012-02-09 22:45 loop5
brw------- root root 7, 6 2012-02-09 22:45 loop6
brw------- root root 7, 7 2012-02-09 22:45 loop7
brw-rw---- root root 7, 8 2012-02-09 22:46 loop8
brw------- root root 179, 0 2012-02-09 22:45 mmcblk0
brw------- root root 179, 1 2012-02-09 22:45 mmcblk0p1
brw------- root root 179, 10 2012-02-09 22:45 mmcblk0p10
brw------- root root 179, 11 2012-02-09 22:45 mmcblk0p11
brw------- root root 179, 2 2012-02-09 22:45 mmcblk0p2
brw------- root root 179, 3 2012-02-09 22:45 mmcblk0p3
brw------- root root 179, 4 2012-02-09 22:45 mmcblk0p4
brw-rw---- root system 179, 5 2012-02-09 22:45 mmcblk0p5
brw------- root root 179, 6 2012-02-09 22:45 mmcblk0p6
brw-rw---- root system 179, 7 2012-02-09 22:45 mmcblk0p7
brw------- root root 179, 8 2012-02-09 22:45 mmcblk0p8
brw------- root root 179, 9 2012-02-09 22:45 mmcblk0p9
brw------- root root 179, 16 2012-02-09 22:45 mmcblk1
brw------- root root 179, 17 2012-02-09 22:45 mmcblk1p1
drwxr-xr-x root root 2012-02-09 22:45 platform
drwxr-xr-x root root 2012-02-09 22:45 svold
drwxr-xr-x root root 2012-02-09 22:45 vold
#
---------- Post added at 09:06 AM ---------- Previous post was at 09:02 AM ----------
I'll give 25 $ if we can have custom recovery and roms...
Just made the much deserved contribution to djrbliss, now onto the next bounty!
Put me down for $20!
Seeing as there haven't been any recent pledges/developments, I want to reiterate (and bring new attention) this topic pledge and focus. Even if the method is simple (and was available to us right from the beginning), the person who will first discover a way to install custom recoveries and ROMs will get the amount above. If it is simple, this is one more reason to get on with this! Let's hope some more pledges come our way. Root was important, but here is where things get really important -- after all if the Sony ICS update blocks Root and our current exploit, then we will be virtually left with the choice of staying in 3.2 or losing what we've gained.
Let's see some more support for this topic!
I'm getting custom ROM withdrawal...... ROFL
(thats what happens when your first droid was a nexus)
grcd said:
Seeing as there haven't been any recent pledges/developments, I want to reiterate (and bring new attention) this topic pledge and focus. Even if the method is simple (and was available to us right from the beginning), the person who will first discover a way to install custom recoveries and ROMs will get the amount above. If it is simple, this is one more reason to get on with this! Let's hope some more pledges come our way. Root was important, but here is where things get really important -- after all if the Sony ICS update blocks Root and our current exploit, then we will be virtually left with the choice of staying in 3.2 or losing what we've gained.
Let's see some more support for this topic!
Click to expand...
Click to collapse
Custom recovery was in the works as well as init.d scripts. However, I broke the device and am now having a difficult time getting my new tab to be recognized by adb and rooted. Hoping updating it will fix that. If so, I have a modded 3e recovey nearly working. As for the bootloaders, we need a kernel DEV...lol... I have sent a shot out to some kernel DEVs and am hoping for some help from them...
thomas.raines said:
Custom recovery was in the works as well as init.d scripts. However, I broke the device and am now having a difficult time getting my new tab to be recognized by adb and rooted. Hoping updating it will fix that. If so, I have a modded 3e recovey nearly working. As for the bootloaders, we need a kernel DEV...lol... I have sent a shot out to some kernel DEVs and am hoping for some help from them...
Click to expand...
Click to collapse
That's certainly good news. I will be looking forward to this. If two devs participate for the bounty, I will be happy to come to a solution in order to split the reward between them. Perhaps I can assign people into two different teams who will give bounties to each person separately.
I would like to copy a block that contains userdata to SD or a PC.
The author of undelete suggested to use:
adb shell su cat /dev/block/platform/msm_sdcc.1/by-name/userdata > /home/data_image.dat
I connected my phone to a PC and wrote in powercmd:
adb shell
su
cat /dev/block/mmcblk1p1 > /home/data_image.dat
sh: can't create /home/data_image.dat: No such file or directory
What am I doing wrong?
The second question is how to find out what block contains userdata? I just guessed it might be in mmcblk1p1.
When I write "mount" I get:
mount
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/secure tmpfs rw,relatime,mode=700 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/[email protected] /system ext4 ro,noatime,noauto_da_alloc,commit=1,data=ordered 0 0
/[email protected] /data ext4 rw,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/[email protected] /cache ext4 rw,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/[email protected]_f /protect_f ext4 rw,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/[email protected]_s /protect_s ext4 rw,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/block/vold/179:97 /storage/sdcard0 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:97 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /storage/sdcard0/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.outfit7.talkingtom2free-1 ext4 ro,dirsync,nosuid,nodev,noatime 0 0
/dev/block/dm-1 /mnt/asec/com.skype.raider-1 ext4 ro,dirsync,nosuid,nodev,noatime 0 0
/dev/block/dm-2 /mnt/asec/com.VAMflax.ChopperMike-1 ext4 ro,dirsync,nosuid,nodev,noatime 0 0
I tried going into this dir and ls -al it:
[email protected]:/dev/block/platform # ls -al
ls -al
drwxr-xr-x root root 2015-07-08 11:57 mtk-msdc.1
[email protected]:/dev/block/platform/mtk-msdc.1 # ls -al
ls -al
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1 -> /dev/block/mmcblk1
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1p1 -> /dev/block/mmcblk1p1
For some reason mtk-msdc.0 is not visible via ls -al!? But I can cd to it:
[email protected]:/dev/block/platform/mtk-msdc.0 # ls -al
ls -al
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0 -> /dev/block/mmcblk0
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0boot0 -> /dev/block/mmcblk0boot0
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0boot1 -> /dev/block/mmcblk0boot1
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p2 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p3 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p4 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p5 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk0p6 -> /dev/block/mmcblk0p6
So, according to https://blog.avast.com/2014/07/09/android-foreniscs-pt-2-how-we-recovered-erased-data/ that uses "mount" to discover the block for userdata, my userdata is located at /[email protected] But I'm not sure how can I access this directory.
Another thing I don't understand:
[email protected]:/dev/block/platform/mtk-msdc.1 $ ls -al
ls -al
drwxr-xr-x root root 2015-07-08 11:57 by-num
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1 -> /dev/block/mmcblk1
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1p1 -> /dev/block/mmcblk1p1
[email protected]:/dev/block/platform/mtk-msdc.1 $ su
su
[email protected]:/dev/block/platform/mtk-msdc.1 # ls -al
ls -al
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1 -> /dev/block/mmcblk1
lrwxrwxrwx root root 2015-07-08 11:57 mmcblk1p1 -> /dev/block/mmcblk1p1
[email protected]:/dev/block/platform/mtk-msdc.1 #
As you can see, my phone ACER Z130 uses "by-num" instead of "by-name" for some reason.
I also wonder why after su I cannot see this dir in ls -l.
Also, some more tries:
D:\Program Files\PowerCmd>adb shell su cat /dev/block/mmcblk1p1 > /home/data.img
The system cannot find the path specified.
D:\Program Files\PowerCmd>adb shell su cat /dev/block/mmcblk1p1 > /data.img
sh: /dev/block/mmcblk1p1: can't execute: Permission denied
So, after reading for hours about how to do that, I'm still stuck.
Also, note, that it seems that on my phone internal mem and sdcard might be reversed in order. At least File Manager shows that sdcard0 has the content of the sd, and sdcard1 has the content of internal memory.
Ok, I did:
2|[email protected]:/ # ls -al
lrwxrwxrwx root root 1970-01-01 07:00 [email protected] -> /dev/block/mmcblk0p6
Ok, found that userdata.
cat /proc/partitions
179 6 2585728 mmcblk0p6
df
/dev 236M 52K 236M 4096
/mnt/secure 236M 0K 236M 4096
/mnt/asec 236M 0K 236M 4096
/mnt/obb 236M 0K 236M 4096
/system 756M 632M 124M 4096
/data 2G 1G 488M 4096
/cache 251M 4M 246M 4096
/protect_f 8M 4M 4M 4096
/protect_s 8M 4M 4M 4096
/storage/sdcard1 2G 1G 438M 4096
/storage/sdcard0 3G 3G 539M 32768
And:
Filesystem volume name: <none>
Last mounted on: /data
Filesystem UUID: 57f8f4bc-abf4-655f-bf67-946fc0f9f25b
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal resize_inode filetype needs_recovery extent sparse_super large_file
Filesystem flags: unsigned_directory_hash
Default mount options: (none)
Filesystem state: clean
Errors behavior: Remount read-only
Filesystem OS type: Linux
Inode count: 163840
Block count: 646176
Reserved block count: 0
Free blocks: 115667
Free inodes: 157106
First block: 0
Block size: 4096
Fragment size: 4096
Reserved GDT blocks: 95
Blocks per group: 32768
Fragments per group: 32768
Inodes per group: 8192
Inode blocks per group: 512
Last mount time: Wed Jul 8 11:57:16 2015
Last write time: Wed Jul 8 11:57:16 2015
Mount count: 1
Maximum mount count: -1
Last checked: Wed Jul 8 11:57:10 2015
Check interval: 0 (<none>)
Lifetime writes: 95 GB
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
First inode: 11
Inode size: 256
Required extra isize: 28
Desired extra isize: 28
Journal inode: 8
First orphan inode: 131321
Default directory hash: tea
Journal backup: inode blocks
So, I assume the size of the block is about 2.5GB?
Ok, so how can I copy it now to my PC (preferable) or to SD?
dd if=/dev/block/mmcblk0p6 bs=4194304 of=/storage/sdcard0/data.img
adb pull /storage/sdcard0/data.img /Users/????/Desktop/data.img
or try this (i dont know if it will work)
adb shell su -c 'cat /dev/block/mmcblk0p6' > /Users/????/Desktop/data.img
if that doesn't work try this
adb shell 'su -c 'cat /dev/block/mmcblk0p6'' > /Users/????/Desktop/data.img
you need admin rights to write data.img in C:\ , so put your desktop folder.
Ok,
I managed to do that. Now I have the image and I would like to recover the deleted/corrupted contacts2.db file. Any suggestions how to do that?
Blackion said:
Ok,
I managed to do that. Now I have the image and I would like to recover the deleted/corrupted contacts2.db file. Any suggestions how to do that?
Click to expand...
Click to collapse
Boot into linux and mount the image,
Code:
[email protected] ~ # mount /path/to/data.img /mnt
[email protected] ~ # cd /mnt
[email protected] /mnt # nautilus .
Also please quote me or mention me if you're replying to me, I don't get a notification if you don't do it.