[DEV][WiP] ramdisk-hijack - load custom ramdisk [4.3] - Xperia SP Android Development

Ramdisk Hijack - what is it?
- We are trying to load a custom ramdisk in order to be able to load a non-Sony based ROM on a locked bootloader using 2nd-init. This is a work in progress.
How can I help?
- My source code is here: https://github.com/keiranFTW/huashan_ramdisk-hijack also, you will find how to install this on there too.
You'll probably wonder why I'm trying to hack the stock ramdisk in - because my phone is my only device, I also need to use it as a phone. Once I can fix things this way I can move to using CyanogenMod Ramdisk.
Progress? CyanogenMod is currently booting on the phone but there are lots of non-working features.
This is not a ROM, do not install this unless you know what you are doing.
On completion I will give you this in form of an update.zip
#keiran

---

Any developers willing to help me out here?

---

I am busy with personal work, will check this out later... FYI you can't boot everything on same kernel... Specific kernel patches are required for some ROMs... Without those patches crucial rom features may not work...
Sent from my C6902 using xda app-developers app

---

DooMLoRD said:
I am busy with personal work, will check this out later... FYI you can't boot everything on same kernel... Specific kernel patches are required for some ROMs... Without those patches crucial rom features may not work...
Sent from my C6902 using xda app-developers app
Click to expand...
Click to collapse
I know this, and some of these kernel patches can be loaded as a module or even the ROM source code edited to suit the needs of the stock kernel.
Edit: I have had many people asking me if kexec could work, and the answer is no, probably not. Why? Because it requires a in-kernel patch as well as a module and so it is not possible to get it to work as we cannot flash a new kernel.
I have an idea and I'll start to merge changes soon
Sent from my C5303 using Tapatalk

---

I am not experienced in kernel dev but maybe i can contribute in limited extent.
Unluckily, i also got "NO" in bootloader unlockable and very dissappointed to see that.
I hope someone will be able to find an alternative.

---

Have you looked at this?
http://www.xda-developers.com/android/locked-bootloader-xperia-s-and-want-cm10-no-problem/
Work in peace...
OP
can you link me to some good references about chroot? I got the basic understanding, want to try it on linux on my laptop.
Closest analogy i can draw is the linux live cd, which runs the OS live without installation. If thats the case, and if we succeed in this process, we could use some partition to dump cm and run it from there.
But lets not get too far, im still in infancy stage.
Regards
Yasir
finally Got the basics of what you are doing... You are essentially doing the same thing letama atis112 and company did to run cm10 usng stock kernel, but hijacked stock ramdisk to run cm ramdisk.... Seems a good idea but will only work for CM10 (4.1 based) and later when locked bootloader gets 4.3, we could get cm10.2 as well. If you are doing the same thing they did, then hopefully it will work soon. If its something different, then wish u luck, ill keep tracking ur progress.

---

Yes, he is trying to have it done the same way as letama, atis and others with one minor difference - we don't have pre_hwconfig.sh, so he's trying with chargemon. Older ramdisk Keiran's github worked fine, but after some commits he made it doesn't boot. When I try with older ramdisk and newest step2.sh, everything except sdcard works fine. I have an idea - what if we kill every process with every possible way(killall5, pkill,etc) and then start it manually, by calling them from /system/bin? Maybe it's the way.
Some offtop here:
Maybe the kernel from leak works on locked BL's? If DooM haven't changed anything in it - it's very possible. Maybe someone with 4.3 leak on their phone would try locking the bootloader?(Of course only if that person knows how to unbrick, if something goes wrong).

---

MrSteve555 said:
Yes, he is trying to have it done the same way as letama, atis and others with one minor difference - we don't have pre_hwconfig.sh, so he's trying with chargemon. Older ramdisk Keiran's github worked fine, but after some commits he made it doesn't boot. When I try with older ramdisk and newest step2.sh, everything except sdcard works fine. I have an idea - what if we kill every process with every possible way(killall5, pkill,etc) and then start it manually, by calling them from /system/bin? Maybe it's the way.
Some offtop here:
Maybe the kernel from leak works on locked BL's? If DooM haven't changed anything in it - it's very possible. Maybe someone with 4.3 leak on their phone would try locking the bootloader?(Of course only if that person knows how to unbrick, if something goes wrong).
Click to expand...
Click to collapse
I assume you have the same issue of unlockable BL? anyways, i am waiting for 4.3 so that after playing with, we can try and run cm10.2 at least... + miui

---

I've redone your work, and i can succesfully hijack ramdisk...
I've CM booted up, but:
1. graphical glithes (i know the solution)
2. no baseband
3. no sdcard (inner, external)
But it's improvement
Source: https://github.com/dh-harald/hijack-ramdisk-huashan

---

dh.harald said:
I've redone your work, and i can succesfully hijack ramdisk...
I've CM booted up, but:
1. graphical glithes (i know the solution)
2. no baseband
3. no sdcard (inner, external)
But it's improvement
Source: https://github.com/dh-harald/hijack-ramdisk-huashan
Click to expand...
Click to collapse
If my girlfriend would let me and I was near you I would kiss you right now :*
Jokes aside, I think I might be able to fix SD card and the rest
Sent from my C5303 using Tapatalk

---

I dont think any processes with late_start class are working... This would explain SD and also network.
Try:
/system/bin/sdcard /data/media /mnt/shell/emulated 1023 1023
/system/bin/qseecomd
/system/bin/secchand
Anything really..
When I was hijacking ramdisk before but loading the stock ramdisk just for testing I also lost network as well as sdcard, and I'm sure that I lost WiFi too. A possible solution would be *not* to stop these services maybe?
Sent from my C5303 using Tapatalk

---

New source code is at: https://github.com/keiranFTW/huashan_ramdisk-hijack
- Updated to work with Android 4.3
- Using 2nd-init instead of chroot
- Recovery included (not sure if working)
#keiran

---

hijack
Hy
I modified the hijack source and recompiled the cm10.2 was.
hijack
dev tree
vendor blobs
I made a new thread on xda.

---

bagyusz said:
Hy
I modified the hijack source and recompiled the cm10.2 was.
hijack
dev tree
vendor blobs
I made a new thread on xda.
Click to expand...
Click to collapse
Hey,
Thanks, your changes have helped a lot, so I have expanded on them to make it possible to integrate into AOSP more easily. I also use /system/bin/chargemon instead of system/bin/wipedata, it is earlier in boot process.
I also might want to note that you are not killing all processes, you need awk {'print $2'} instead of awk {'print $2'}
But yeah, great work.. you did what many others couldnt.
My repositories:
dev tree
vendor blobs
hijack
Feel free to add pull requests, and i can add you to the repository if you like.
Keiran

---

If only this could be done in other devices, as I also have a locked Xperia, but it's a Live Walkman. Unfortunately it also has the Unlock Bootloader: "NO", so if could also be ported to other devices it would be great. Not forcing or pushing you, but trying something more updated than 4.0.4 would be great

---

is this...?
@KeiranFTW & @bagyusz
sick work guys way to not never give up and accomplish what was thought to not be possible goes without saying one of the best development breakthroughs this year!
hey, in either of your opinions would this in some way be portable to our locked as **** bls on S4 Verizon and AT&T? We havent had ASOP capabilities or 4.4 for that matter yet and everyone is stuck on safestrap 4.3 stock kernels. Any help on this would be much appreciated. Its either trying to port this method or trying that new AnyKernel2.0 today not trying to hard brick heh

---

msm7x27
KeiranFTW said:
.
Click to expand...
Click to collapse
would this method work on any msm7x27 after pointing partitions ?? @KeiranFTW

---

deleted.

---

I still don't know what you're talking about. eace
Sent from my C5303 using Tapatalk

---

concerning hijack
KeiranFTW,
i am sorry to bother you with what may or may not be a 4 square dev question(s).
can i attempt something similar without building custom kernel? ( i read evrything i can but, lack funds for proper hardware so am limited.)
can i alter the insmod-ing of kernel modules to come as close to the beginning of the boot process as possible and have hardware functional in spite of slaying zygote/android userspace ?
this thread http://forum.xda-developers.com/showthread.php?t=1937328 outlines a means to
mount?load? a loop device from init.rc
my thought is as i have a gt-p5210 x86 device it might be possible to fire up (no matter how ugly)
a livecd or straight forward ext4 linux.img.
I would be interested in any insight/ideas you may have toward that end.
thank you for your time.
m