Today, I finally have found where to post for newbies, so I post, thought 4 hours ago I posted on androidforums.
Here is very difficult to operate with this site, and to use this site for with android devices is quite impossible. Only in windows, and not every comfortable. Anyway, I see, that is the first university on the net
Click to expand...
Click to collapse
.
just enter in google: tablet h007 and you shall see the specification, cos I can`t post link now. If anyone has the backup for this model, it shall be about 560 MB. Let me know, not to trouble anyone.
The tablet was rooted by kingoroot, but as you know or not, kingoroot, offers root acces, as the 1 service started, when the device is on, but it does not provide general full root settings, as for example when we are in the recovery menu.
I used some kernel tuner application, and I did not make any backups at all. I edited the file with this application, called build.prop, where I change the attribute of user for superuser. In that way, I though, I could get permissions of full root, I did that, because, I could not see my system partition generally, only from total commander, I could see and do whatever I want. After, I rebooted, and the problem started.
I attach here, my device specifications: Which I watched, while I could use the device:
Android system recovery 3e with sw version: alps.kk1.mp1.v2.11. It is on the photo though but with the different name.
MS board: d95b
Mt6582 (Chip)
All the rest is on the photo
foto.lovestudio.biz/image.uploads/30-07-2015/original-9ec17e355b096718359535e5af42aa4c.png
I have windows vista 32bit 2 service pack.
MTKdroidTools, the application I tried, 4 different versions, 1, last, and 2 in the years, when my phone was produced. It does not read my phone, saying, it is not present. Though all 4 kind of drivers are installed, even adb device driver is installed and all is perfect, all is connected.
The only thing I can use in this mtkdroidtools is adb terminal. I enter there the following command: adv devices, which shows some number of device connected with sideload.
Something like that:
List of devices attached
01234565ABCDEFG recovery
but at the place of recovery, I have
List of devices attached
01234565ABCDEFG sideload
Then, after reading stack-exchange site, I understand, that now I can enter the system partition to get my build.prop file, to change superuser for user as it was before and to return in back to the device, and get my phone worked. But I can`t do that. Cos as I stated before, the device is rooted only by kingoroot, and I works only as the 1 st. service inside android operating system, but not in recovery menu.
So I cant use the following command to get it right. Cos when I enter any of them, but first of all, I enter: adb usb - it says: error: closed
You can then copy the file off the phone:
adb pull /system/build.prop c:\build.prop
You can now edit it in any text editor (recommend Notepad++ because it will preserve the Unix style line endings,) and then copy it back to the phone:
adb push c:\build.prop /system/build.prop
To work with adb terminal, of course I am in the recovery menu and I enter inside ADB SIdeload Application.
I know how to deal as you see, with this problem, but I can`t get to the file, to the system partition in the whole, cos as I understand, the phone is not rooted.
So guys, let`s see what happens next, I am looking forward to your suggestions.
lovestudio said:
.
just enter in google: tablet h007 and you shall see the specification, cos I can`t post link now. If anyone has the backup for this model, it shall be about 560 MB. Let me know, not to trouble anyone.
The tablet was rooted by kingoroot, but as you know or not, kingoroot, offers root acces, as the 1 service started, when the device is on, but it does not provide general full root settings, as for example when we are in the recovery menu.
I used some kernel tuner application, and I did not make any backups at all. I edited the file with this application, called build.prop, where I change the attribute of user for superuser. In that way, I though, I could get permissions of full root, I did that, because, I could not see my system partition generally, only from total commander, I could see and do whatever I want. After, I rebooted, and the problem started.
I attach here, my device specifications: Which I watched, while I could use the device:
Android system recovery 3e with sw version: alps.kk1.mp1.v2.11. It is on the photo though but with the different name.
MS board: d95b
Mt6582 (Chip)
All the rest is on the photo
foto.lovestudio.biz/image.uploads/30-07-2015/original-9ec17e355b096718359535e5af42aa4c.png
I have windows vista 32bit 2 service pack.
MTKdroidTools, the application I tried, 4 different versions, 1, last, and 2 in the years, when my phone was produced. It does not read my phone, saying, it is not present. Though all 4 kind of drivers are installed, even adb device driver is installed and all is perfect, all is connected.
The only thing I can use in this mtkdroidtools is adb terminal. I enter there the following command: adv devices, which shows some number of device connected with sideload.
Something like that:
List of devices attached
01234565ABCDEFG recovery
but at the place of recovery, I have
List of devices attached
01234565ABCDEFG sideload
Then, after reading stack-exchange site, I understand, that now I can enter the system partition to get my build.prop file, to change superuser for user as it was before and to return in back to the device, and get my phone worked. But I can`t do that. Cos as I stated before, the device is rooted only by kingoroot, and I works only as the 1 st. service inside android operating system, but not in recovery menu.
So I cant use the following command to get it right. Cos when I enter any of them, but first of all, I enter: adb usb - it says: error: closed
You can then copy the file off the phone:
adb pull /system/build.prop c:\build.prop
You can now edit it in any text editor (recommend Notepad++ because it will preserve the Unix style line endings,) and then copy it back to the phone:
adb push c:\build.prop /system/build.prop
To work with adb terminal, of course I am in the recovery menu and I enter inside ADB SIdeload Application.
I know how to deal as you see, with this problem, but I can`t get to the file, to the system partition in the whole, cos as I understand, the phone is not rooted.
So guys, let`s see what happens next, I am looking forward to your suggestions.
Click to expand...
Click to collapse
I am sorry, so no one knows, on 3 sites, no one knows. let me know, then I shall not check every hour this post. I t`s better to know, that nothing possible, that believe that smth. is possible. thanks.
Related
Hello:
I'm a buyer of an Iview 760TPC (chinese 1.3Mpx camera version).
The reason I'm writing is because its some days reading and trying things to get everything unlocked, and seems that is really impossible to flash a new firmware or to get root. I'm getting really mad.
- I have managed to get adb recognize the tablet on linux and on windows. Despite of that, I get "adbd cannot run on production builds".
- If I do an 'adb shell', I get a prompt (with no superuser privileges). If I try to 'su', I get a "Passwd:" prompt , so I cannot get a superuser prompt to remount the filesystems, neither push any file to /system.
Browsing, I see there's no 'su' on /system/bin but there's on /system/xbin. Is a read-only filesystem and I cannot push anything.
- I installed root explorer but cannot mount R/W the filesystems.
- Installed Busybox installer. Says that the tablet is rooted, but when I try to install busybox, says that I have not permissions. Same if I try one of the upgrade menus of superuser. There are not privileges.
- I tried many times, to flash a firmware with the livesuit method, but the tablet is not being recognized. When I do the combination to enter the flashing mode, it boots a like a recovery with 4 options:
1) erase user data partition
2) enter adfu
3) upgrade firmware from sdcard
4) exit menu
I'm interested in the 3er option, but I can't find any information of the process itself (where to put the firmware, if its the same img as with the livesuit method, and what name needs to have the file)
There's also an ADFU mode, that I don't understand, but windows recognizes a new device when I enter there (but there's no driver or information I can found). The screen gets like a bit of white color, and the only way to exit from there is to press home+power buttons without the usb cable.
I've tried superoneclick but it doesn't work because there's not 'su' binary. Same happens with the installers of the CWM, not working because there's no 'su' (so I could flash a file with any kind of name)
Any help would be aprecciated. Sorry for my engrish and for asking so much, but I don't know how to proceed ;-)
Thanks
What version of Android is the device running? You could try manually pushing an exploit binary (e.g. zergrush) onto the device and executing to get temp root, at which point you should be able to mount /system as R/W and then push the su binary to /system/bin
The exploit binary to use would depend on the version of Android though. zergrush is for 2.3 I think (maybe 2.3.something). For early versions of ICS (4.0), there is mempodroid (might have spelt that wrong).
EDIT: Also, everything you can do over ADB, you could do by installing SSHDroid on the device and connecting via SSH from a computer.
Thanks a lot for your answer SifJar:
The tablet comes with ICS 4.0.3 and 3.0.8 kernel.
Superoneclick has the psneuter and zergRush exploits(neither of those seem to work for me).
Found this thread:
http://forum.xda-developers.com/showthread.php?t=1461736
Edit: It does not work for me:
./adb shell
[email protected]:/ $ chmod 777 /data/local/mempodroid
[email protected]:/ $ /data/local/mempodroid 0xd9ec 0xaf47 sh
/system/bin/sh: /data/local/mempodroid: not executable: magic 7F45
Thanks
Installed SSHDroid from the Play Store, but does not work either.
I get:
Can't generate RSA keys: sh <stdin>[1]: /data/data/berserker.android.apps.sshdroid/dropbear/dropbearkey: not executable: magic 7F45
Don't really know what else can I do.
Thanks
mempodroid requires a different offset for each device. "0xd9ec 0xaf47 sh" is for the Eee Pad Transformer Prime. You need to get the right offset for your device. You can try this to do that: http://forum.xda-developers.com/showthread.php?t=1612591
EDIT: But it looks like your device may not be able to run standard Android binaries, which would be quite an inconvenience for trying to root it.
SifJar said:
mempodroid requires a different offset for each device. "0xd9ec 0xaf47 sh" is for the Eee Pad Transformer Prime. You need to get the right offset for your device. You can try this to do that: http://forum.xda-developers.com/showthread.php?t=1612591
EDIT: But it looks like your device may not be able to run standard Android binaries, which would be quite an inconvenience for trying to root it.
Click to expand...
Click to collapse
I think I should reflash a new firmware from that recovery that has from factory, but there's no way I can do it. I mean, it is supposed to have an special mode that you enter with a button combination and to flash then with livesuit, but in this chinese clone, does not seem to work that combination of buttons.
From the recovery, ADFU seems to mean Actions Device Firmware Update. There's some information here http://wiki.s1mp3.org/USB_modes
- If I put the device in ADFU mode, windows ask for an USB driver (that I don't have or does not exist either)
- Another thing. There's a flashing from sdcard, that seems to support, but there's no information or manual of where is supposed to put the firmware, the name of the file or if it needs to be zipped (and what file/s inside and names),...
Thanks
It's possible the flashing from sd card supports standard update .ZIPs. You could try this one, it's a ZIP that should work for rooting most Android devices I believe. Superuser.zip
(This is from a topic on the HTC Explorer phone, but there is nothing specific to that phone in the ZIP as far as I know)
EDIT: This ZIP doesn't overwrite the firmware or anything, all it does is add su, busybox and Superuser to the existing /system partition.
EDIT: If selecting the "Update firmware from SD card" option doesn't give the option to browse for a ZIP, rename it to "update.zip" and place it in the root of the card and try again.
SifJar said:
It's possible the flashing from sd card supports standard update .ZIPs. You could try this one, it's a ZIP that should work for rooting most Android devices I believe. Superuser.zip
(This is from a topic on the HTC Explorer phone, but there is nothing specific to that phone in the ZIP as far as I know)
EDIT: This ZIP doesn't overwrite the firmware or anything, all it does is add su, busybox and Superuser to the existing /system partition.
EDIT: If selecting the "Update firmware from SD card" option doesn't give the option to browse for a ZIP, rename it to "update.zip" and place it in the root of the card and try again.
Click to expand...
Click to collapse
Thanks a lot. Does not have a browsing option so I need to know the needed name. Does not seem to work with the update.zip method
Does it try to install update.zip and give an error or does it say there is no update on the SD card?
Also, can you try and extract the su binary you said is in /system/xbin and post it here? There's something I would like to check.
EDIT: From adb shell, type the following, without quotes, "cat /proc/cpuinfo" and post the output here please
EDIT: Another silly suggestion - you could try guessing the password su asks you for. Maybe it's something obvious like "root" or "admin".
SifJar said:
Does it try to install update.zip and give an error or does it say there is no update on the SD card?
Also, can you try and extract the su binary you said is in /system/xbin and post it here? There's something I would like to check.
EDIT: From adb shell, type the following, without quotes, "cat /proc/cpuinfo" and post the output here please
Click to expand...
Click to collapse
Seems that it does not even try to update, no error message, nothing. I tried putting the update.zip in both /sdcard (internal sdcard) and /sd-ext (microsd)
Code:
[email protected]:/ $ cat /proc/cpuinfo
system type : actions-atv5201
processor : 0
cpu model : MIPS 74Kc V5.0 FPU V0.0
BogoMIPS : 719.25
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0460, 0x0868]
ASEs implemented : mips16 dsp
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
I have attached the 'su' binary from /system/xbin
Also:
Code:
$file su
su: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (uses shared libs), with unknown capability 0xf41 = 0x756e6700, with unknown capability 0x70100 = 0x1040000, stripped
But the table description of the manufacturer, says that has an Allwinner A10 (Cortex A8). Does not seem to be true, right?
Thanks
Looks like a MIPS processor then, not an ARM as most android devices have. That explains why exploit don't run and SSH didn't work, both use code compiled for ARM processors. It also means a standard su binary won't work on that device. You'll need one compiled for MIPS.
Does the update from sd card give any sort of error?
No. It does not say anything. I'll try to find the right update.zip for the MIPS architecture. Perhaps it could work.
Edit: Found this https://rapidshare.com/files/2288417520/Superuser-3.0.7-mips32r2-ics_signed.zip , but does not seem that I can flash it from the recovery with the update.zip method
Thanks a lot Sifjar
I'm afraid I'm now out of suggestions. The last piece of advice I can give is try and find an official update for the tablet from the manufacturer and investigate the format of that update, to try and identify how an update should be formatted/named for your device.
Thank you SifJar. You helped me a lot to find what happens with this tablet ;-)
I've read from more people, buying Allwiner A10 tablets on efox, and receiving different ones (lower specs and usually MIPS based). I'd not recommend to buy to this seller because it does not even answer your questions or does give you support.
I'm pretty sure, that could be one of the clones of the Ainol Novo7 Paladin/Basic. I'll try to find it
dreamer_ said:
Thank you SifJar. You helped me a lot to find what happens with this tablet ;-)
I've read from more people, buying Allwiner A10 tablets on efox, and receiving different ones (lower specs and usually MIPS based). I'd not recommend to buy to this seller because it does not even answer your questions or does give you support.
I'm pretty sure, that could be one of the clones of the Ainol Novo7 Paladin/Basic. I'll try to find it
Click to expand...
Click to collapse
Well I believe from a bit of reading about the Ainol tablet you should be able to type "adb remount" and then "adb root" to get root access from adb on that tablet. Then you can push a MIPS su binary to the device and be done with it. But it depends how close a clone it is whether the same will be true for your tablet I guess.
EDIT: Have you found any way to access a fastboot mode? (Possibly the command "adb reboot bootloader" would work) If the bootloader isn't locked, you may be able to extract the system.img, root the img and then flash it back with fastboot. Although that is something I have only heard about, I have no experience in how one would go about rooting the system.img. (Extracting it from the phone and flashing back isn't overly hard).
I have tried both things with no success. The remount, fails and I don't have root access then (and R/O Filesystems)
adb reboot bootloader, just reboots the device
I have found a post from a guy http://tabletrepublic.com/forum/other-tablets/actions-cpu-android-tablet-actions-atm7013-1-3ghz-cpu-2087.html#post20776, that seems to have my same tablet (or both tablets seem to be the same MIPS based).
I still think that could be a novo 7 basic/paladin clone and it does have the same recovery and the DFU mode. I'm downloading the tools and FW from the paladin, but seems to be impossible to find anything more about my tablet.
Thanks
dreamer_ said:
I have tried both things with no success. The remount, fails and I don't have root access then (and R/O Filesystems)
adb reboot bootloader, just reboots the device
I have found a post from a guy http://tabletrepublic.com/forum/oth...ctions-atm7013-1-3ghz-cpu-2087.html#post20776, that seems to have my same tablet (or both tablets seem to be the same MIPS based).
I still think that could be a novo 7 basic/paladin clone and it does have the same recovery and the DFU mode. I'm downloading the tools and FW from the paladin, but seems to be impossible to find anything more about my tablet.
Thanks
Click to expand...
Click to collapse
This is one of the big issues with China based devices. Not only is it have really limited development they tend to use none standard hardware so none of the current things work on it. Then toss in the fact that the hardware is not always what it is said to be.
Sent from my SGH-I897 using Tapatalk 2
The USB drivers for the novo paladin, didn't work for me....If I only could flash a CWM recovery for my tablet, perhaps I could then flash the superuser.zip with the 'su' binary that SifJar said.
zelendel said:
This is one of the big issues with China based devices. Not only is it have really limited development they tend to use none standard hardware so none of the current things work on it. Then toss in the fact that the hardware is not always what it is said to be.
Click to expand...
Click to collapse
Yes...my problem has been mainly that in the efox website, they are basically lying you in the product description, and selling a thing that is not true.
Casually, there's also an IVIEW tablet on the market, exactly like mine, made only for the chinese market (without the IVIEW letters and 1.3mpx camera)...and that was what I thought I bought, a chinese IVEW (and my mistake)
You really need to see the cpuinfo to see that, and not everybody will do it....
Thanks
If you download this: usbview.zip
You can use it to find the vendor ID (app shows it as IdVendor) for your device (put it in the DFU mode thing first), and then you could try using fastboot and specifying the vendor ID with -i argument, it might work without drivers then (not sure if this is right, but I think something similar was done with the Kindle Fire)
just try something like
Code:
fastboot -i 0xFFFF devices
replacing 0xFFFF with the vendor ID from that app, to see if it detects it at all
Thanks. Does not seem to return anything (a return). It works with '-i device' at the end of the line.
Code:
fastboot.exe devices -i 0x10D6
ADB does give me this:
Code:
c:\sonec>ADB\adb.exe devices
List of devices attached
Actions Semi. 23711DF4 device
hey everyone long story short i rooted my tablet a while back and started having problems so i flashed a new rom and the wifi isnt working.
I went to androidfiles.org and clicked nabi 2 and download wifi-fix, ota update and stock zip rom and flashed those three zip files ( i compressed them) in twrp.. its booting up and everything but wifi isnt working. ive read a lot of peeps are having wifi probs. I have a xda link for my exact device and you guys tell me wut the hell im supposed to do. its got all kinds of stock roms and ota updats and stuff,... which one do i use wtf do i do. should i go one at a time from lowest to biggest, do i even need ota updates or w./e that is?!?!?!? please help guys my chirstmas is becoming a nightmare... its my only internet source.. i had to come all the way to the dang library for this crap.. please help!!!!! heres the link that might give u guys an idea on how to help.. heres the stock roms and stuff
http://forum.xda-developers.com/wiki/Fuhu_nabi_2 thank you!!!!!
duuude im baked said:
hey everyone long story short i rooted my tablet a while back and started having problems so i flashed a new rom and the wifi isnt working.
I went to androidfiles.org and clicked nabi 2 and download wifi-fix, ota update and stock zip rom and flashed those three zip files ( i compressed them) in twrp.. its booting up and everything but wifi isnt working. ive read a lot of peeps are having wifi probs. I have a xda link for my exact device and you guys tell me wut the hell im supposed to do. its got all kinds of stock roms and ota updats and stuff,... which one do i use wtf do i do. should i go one at a time from lowest to biggest, do i even need ota updates or w./e that is?!?!?!? please help guys my chirstmas is becoming a nightmare... its my only internet source.. i had to come all the way to the dang library for this crap.. please help!!!!! heres the link that might give u guys an idea on how to help.. heres the stock roms and stuff
http://forum.xda-developers.com/wiki/Fuhu_nabi_2 thank you!!!!!
Click to expand...
Click to collapse
Thought I would share some info I found when I ran into the wifi problem on my daughter's nabi. I did some searches on the internet and the typical answer I found for solving the wifi issue was "reset the device" or "unroot and return to stock rom - flash all updates and reroot". Being a glutton for punishment, and the fact I didn't want to reset the device, I searched and searched and was able to fix my daughter's wifi without doing a reset or unroot/reroot. Before I get into it I wanted to mention that wifi failures can happen for a number of reasons so while this worked for myself, it may not work for you.
Some prerequisites:
Most importantly; you need a rooted device. If you do not have root access you will not be able to write files or access the commands to fix the issue I am about to outline.
Some knowledge of linux would be helpful, but not necessarily required.
Lets get started:
Warning! It goes without saying but I will say it anyways - you can mess up your nabi by rooting it. Some of the commands below could mess up your nabi bad. If this scares you then you probably should not proceed any further. I am not responsible for any damage you do to your nabi.
Commands are listed between ' and ' - do not use the ' when inputing the commands.
Note: The first two/three steps are not necessary but they do give you insight as to how I was able to determine my problem. If following this doesn't fix the problem for you the logcat output may give you some important info that you can google that may help you fix your particular problem.
Note: Steps 5 and on can be skipped if you have a text editor (vi or nano) on your device. If you have a text editor loaded simply edit the conf file directly.
1. You will need to run the command 'adb logcat' in a command-line window and in your appropriate directory. Adb is available as part of the android sdk but can also be found stand alone since most people do not need the sdk.
2. Try to turn on the wifi. You should see the output of your adb logcat window scroll some data. If the wifi is not attempting to turn on at all sometimes you can move between the settings options then go back to the wifi settings and move the slider. If you cannot get your wifi to turn on you can scroll the window up and attmept to find the data from when the device started up. In the output you should see lines that talk about wlan0 and probably something that says "failed" somewhere. In my case I could see where the wlan0 enabled but then a few lines down it said something about "Line: 25 failed" and "failed to parse file".
3. The file is actually a configuration file used by the wifi kernal module/driver. In my case this file had become corrupted.
4. Set adb in root mode (won't work if the device does not have root access) by running 'adb root' at the command-line. You may need to click on an "allow root permission" window on the actual device after running this command.
5. Run 'adb pull /data/misc/wifi/wpa_supplicant.conf' from command-line. If this does not work then do the following:
a. Run 'adb shell' from command line.
b. 'su'
c. 'cat /data/misc/wifi/wpa_supplicant.conf' - copy the output from the command and paste into a text editor (see note in step 6 on why NOT to use notepad).
d. Save the file as wpa_supplicant.conf, preferrably in the same diretory as adb.
e. 'exit' twice should exit you from the adb shell and return you to your command-line. If all else failes a "ctrl-c" should drop you out of adb.
6. Use a text editor to open wpa_supplicant.conf. The file should be located int he same directory as adb. If you are using Windows I would strongly suggest you NOT use notepad. Notepad will typically change all the EOLs (End Of Line) from \n to \r\n which will really mess things up worse.
7. In the file you should see "network={" entries. There maybe one entry, there maybe many entries. You can remove all lines between "network={" and "}" including the latter themselves. If you see your 'home' network listed you can leave it as the only entry and make sure its priority is set to 1 but it maybe better to remove it as well just in case it contains part of the corrupted data.
8. Save the file.
9. Do 'adb push wpa_supplicant.conf /data/misc/wifi/wpa_supplicant.conf' from command-line. If this does not work then do the following:
a. Run 'adb push wpa_supplicant.conf /sdcard/wpa_supplicant.conf' from command-line.
b. Run 'adb shell'
c. 'su'
d. 'dd if=/sdcard/wpa_supplicant.conf of=/data/misc/wifi/wpa_supplicant.conf'
e. Do 'exit' twice to exit the adb shell. If all else fails then a "ctrl-c" should drop you ot of adb.
10. If the wpa_supplicant file was corrupted then the wifi should now be able to enable and you should now be able to connect to a network.
I hope this is helpful to at least a few people.
Hi all,
EDIT
Thanks to techdudester on the second page, getting rid of the malware is now even easier!
Just flash the image he found here with the following procedure and you're good to go!
Instruction:
1. Flash the new ROM.
a. Get the ROM here . (Use this ROM only if you have a Venstar V140D tablet!)
b. Follow the linked tutorial to install the flash software and flash the new ROM on your device with: Phoenix Suit.
Voila, ready!
Enjoy your malware free tablet!
Tips and tricks. (or something...)
Get adb working (needed for all the other tricks down below):
1. Download the Google development tools (sdk) here and install them on your computer. I assume you have windows 7 installed during the rest of this tutorial.
2. Connect your device to your computer and make sure it is installed correctly.
a. Connect your device while its powered on via USB to your pc.
b. Go to Start, right click "My Computer" and select "Properties". Click "Device Manager".
c. Right click the Android device with the exclamation mark and select "Update Driver Software...".
d. Select "Browse my computer for driver software".
e. Select "Let me pick from a list of device drivers on my computer".
f. Keep "Show All Devices" selected and click Next.
g. Click "Have Disk..." and click "Browse..."
h. You can find the drivers in the "SDKInstallLocation"\sdk\extras\google\usb_driver directory and click OK. Replace SDKInstallLocation with the location that you selected during installation of the SDK.
i. Select the "Android ADB Interface" driver from the list and click Next.
j. Confirm installation by clicking on "Yes". Sometimes you also have to click on "Install" if a screen pops up to ask you again if you really want to install the driver...
k. Click "Close".
To use it:
Open a command prompt (in search type "cmd" followed by ENTER) and go to the following directory ""SDKInstallLocation"\sdk\platform-tools".
If you want a backup of your tablets system directory (highly recommended!) use:
"adb pull /system C:\system"
where C:\system is the target location on your local computer where you want the backup of the system directory.
Remove the update package (this doesn't work for updating the tablet, so, useless.)
adb remount
adb shell
cd system/app
rm Update.apk
exit
Remove the unwanted apps (dragonfire.apk etc)
adb remount
adb shell
cd system/preinstall
rm *
exit
If you would like to have your tablet in the correct time zone after factory reset, you will have to adjust the build.prop file.
First you need to get it to your pc so you can edit it:
in the command prompt window and at the same location as in the tutorial above type "adb pull /system/build.prop C:\temp\build.prop".
Just in case, make a copy of the build.prop in Windows Explorer so you always have the original file if something goes wrong.
Now you can edit the build.prop, but DON'T EDIT IT WITH THE WINDOWS NOTEPAD! Use Notepad++ or similar to edit the build.prop.
After you made the changes (and be careful here, you could end up with a tablet that does not want to boot up, solution further down below) you have to upload the file back to your tablet.
in the command prompt type:
adb remount
adb push C:\temp\build.prop /system/build.prop
adb shell chmod 644 /system/build.prop
Don't forget the last line! If you do not chmod the file (set the correct permissions) your tablet will not boot up.
Changes in the build.prop:
Time zone:
Default time zone is "persist.sys.timezone=Europe/London"
you can change this to your locale time zone like "persist.sys.timezone=Europe/Amsterdam" (for the netherlands )
Search the internet for valid time zones.
Change the default language:
The default language is determined by these two values in the build.prop:
persist.sys.language=en
persist.sys.country=US
For dutch change them to:
persist.sys.language=nl
persist.sys.country=NL
and again, search the internet for valid language values.
Higher brightness after factory reset:
Add the following line to the build.prop file (at the top of the file)
ro.ph.def_brightness=225
You pushed the build.prop without changing the permissions:
No problem. Just connect your booting tablet to the PC, install the driver if its not installed correctly like explained in the tutorial, and then change the rights via adb. It's no problem that it's not fully booted!
in a command prompt in the adb directory:
adb remount
adb shell chmod 644 /system/build.prop
adb reboot
If you pushed a wrong non functioning build.prop, just use this method to push the original build.prop (you know, the copy you made ) back to the device (followed by setting the correct permissions of course).
Remove the (in my opinion) irritating boot sound:
adb remount
adb shell
cd system/media
rm boot.wav
exit
rom download
can you provide another way to download the rom file ,i cant seem to get the registration process to work
stevethesignguy865 said:
can you provide another way to download the rom file ,i cant seem to get the registration process to work
Click to expand...
Click to collapse
I have dropped it here. Hope this helps
I bought the same tablet for my daughter. She's (and so am I) suffering from a lot of annoying popups and ads.
Thanks for sharing your instructions here, very hard to find them!
Since I'm a complete newbie: one important question. When you flash the ROM, all of the apps (games) will be removed I guess?
Second question: can you put the stock rom on a different location? Both of the links (including Filedropper) don't contain any files...
Thanks!
1ce/ said:
I bought the same tablet for my daughter. She's (and so am I) suffering from a lot of annoying popups and ads.
Thanks for sharing your instructions here, very hard to find them!
Since I'm a complete newbie: one important question. When you flash the ROM, all of the apps (games) will be removed I guess?
Second question: can you put the stock rom on a different location? Both of the links (including Filedropper) don't contain any files...
Thanks!
Click to expand...
Click to collapse
Yes, all applications will be removed. As soon as you configure the tablet again with the same gmail account, it will probably start installing the applications and games automatically, but in game progress will be lost for most (not online) games.
I am re-uploading the file. Will update this post with the link as soon as it finishes
edit: upload finished, get it while its there LINK
BlueFlame said:
edit: upload finished, get it while its there LINK
Click to expand...
Click to collapse
Great! Thanks for the swift response. The file is about 307 MB. Is this correct? I'll start working on it, probably this weekend. I'll keep you posted.
1ce/ said:
Great! Thanks for the swift response. The file is about 307 MB. Is this correct? I'll start working on it, probably this weekend. I'll keep you posted.
Click to expand...
Click to collapse
Yes, thats correct. Once unpacked it will be around 520 MB.
Good luck!
Hi BlueFlame,
Thanks for the post. Is it possible to get the image uploaded again? Would be much appreciated.
Maylar said:
Hi BlueFlame,
Thanks for the post. Is it possible to get the image uploaded again? Would be much appreciated.
Click to expand...
Click to collapse
On request. You can find it here. (Adjusted link. Stored on Google Drive)
Thanking you. Very much appreciated.
Thank's for a fantastic procedure... Worked very well.
First step doesn't work for me: Phoenixsuit gives an error: 'Open Firmware failed'
with three possible reasons:
- firmware version is too old
- firmware format is broken
- firmware is used by other application.
Version used: 1.0.6
Firmware file: a33_599x_v11_1024x600_gc0308_2035_1015a.img
Any ideas?
1ce/ said:
First step doesn't work for me: Phoenixsuit gives an error: 'Open Firmware failed'
with three possible reasons:
- firmware version is too old
- firmware format is broken
- firmware is used by other application.
Version used: 1.0.6
Firmware file: a33_599x_v11_1024x600_gc0308_2035_1015a.img
Any ideas?
Click to expand...
Click to collapse
Is that the firmware that I provided?
If not, try to download it again.
If so, I think that your tablet has a newer firmware than this one. You could contact the seller of your tablet for the current (latest) firmware for this tablet.
If you get a newer firmware, please share
Image file invalid
Hi Blueflame,
I've tried to re-flash, but at some point i'm getting the message at livesuit V1.11 that the image file is invalid.
It's the 3rd time i have downloaded the file, what could be cause of this error?
Greetz Mike
mcwheelz said:
Hi Blueflame,
I've tried to re-flash, but at some point i'm getting the message at livesuit V1.11 that the image file is invalid.
It's the 3rd time i have downloaded the file, what could be cause of this error?
Greetz Mike
Click to expand...
Click to collapse
Not sure. Will upload it again this weekend just to be sure that it's not my uploaded image. (I will let you know once I've done that)
You can, on the other hand, contact the supplier (where you bought the tablet) and ask them for the latest version of the ROM. I would also be interested in that
BlueFlame said:
Not sure. Will upload it again this weekend just to be sure that it's not my uploaded image. (I will let you know once I've done that)
You can, on the other hand, contact the supplier (where you bought the tablet) and ask them for the latest version of the ROM. I would also be interested in that
Click to expand...
Click to collapse
Uploaded again! same link (just made it a new version in Google Drive).
Open Firmware failed - possible solution
1ce/ said:
First step doesn't work for me: Phoenixsuit gives an error: 'Open Firmware failed'
with three possible reasons:
- firmware version is too old
- firmware format is broken
- firmware is used by other application.
Version used: 1.0.6
Firmware file: a33_599x_v11_1024x600_gc0308_2035_1015a.img
Any ideas?
Click to expand...
Click to collapse
Try to put the image file in a directory without special characters (i.e. c:\temp). Worked for me.
wundabua
Te real FIX is In!
Ok, i have one of these allwinner, Venstar, "whatever", A33 D140v tablets. It had all the usual problems and more, because the first thing I tried, was to use the built in recovery to "restore to factory". This made things even worse, because after the recovery, I couldn't reach the Google authentication servers.
I am pro tech with 25 years in the trenches and I have to admit this thing really threw me for a loop, because I spent an entire day researching the solution, installing Android SDK, drivers, Phoenix Suit, Live Suit, etc. These were all very complicated "solutions" that took me exactly nowhere. I finally found the answer in a rather stupid Youtube video.
The REAL answer is actually very quick and easy compared to all these other recommended methods.
In the first place, model V140d image is only used for these infected tablets. The actual model is V11 and once you use the quick restore method I discovered, you will have a malware free V11 model. The whole secret to this method, is the fact that these units were designed to be quickly, automatically and completely restored in less that 5 minutes through the use of their built in micro SD slot.
Imagine that!
If you check your tablet that came new in the box as something other than V140d, the method I used will most probably not work for you.
Anyway, the quick method I discovered, can be seen on my own tech support site. To find it, Google: Just Call Techdude
Then click on the support link at the top of the page on my site and all will be revealed.
techdudester said:
Ok, i have one of these allwinner, Venstar, "whatever", A33 D140v tablets. It had all the usual problems and more, because the first thing I tried, was to use the built in recovery to "restore to factory". This made things even worse, because after the recovery, I couldn't reach the Google authentication servers.
I am pro tech with 25 years in the trenches and I have to admit this thing really threw me for a loop, because I spent an entire day researching the solution, installing Android SDK, drivers, Phoenix Suit, Live Suit, etc. These were all very complicated "solutions" that took me exactly nowhere. I finally found the answer in a rather stupid Youtube video.
Click to expand...
Click to collapse
Hi techdudester,
The combination "pro tech with 25 years in the trenches" and "very complicated "solutions"" sounds a bit strange.
But either way, a THANK YOU is in order!
The ROM you found works on my tablet (flashed yesterday) and so far so good. No popups and no unwanted application downloads!
I will adjust my initial post to incorporate this image.
Hello Fire users
I am not really a newbie but until today I have worked only with Samsung devices.
My daughter got an Fire HD 6 in the christmas days and we started to play around and we have done all updates up to 5.3.1.1. But it's not running perfectly for my wishes. I have read thats it's possible to root the tablet incl. TWRP, xposed framework and go with this up to 5.3.1.1 but it's hard to read out what I have exactly to do because there are many warnings when to do something and when not.
Could you please help what to do exactly? ADB is running and phone is recognizing on Mac and Windows...
Thanks for your help ?
cuki3r3k83bln said:
Hello Fire users
I am not really a newbie but until today I have worked only with Samsung devices.
My daughter got an Fire HD 6 in the christmas days and we started to play around and we have done all updates up to 5.3.1.1. But it's not running perfectly for my wishes. I have read thats it's possible to root the tablet incl. TWRP, xposed framework and go with this up to 5.3.1.1 but it's hard to read out what I have exactly to do because there are many warnings when to do something and when not.
Could you please help what to do exactly? ADB is running and phone is recognizing on Mac and Windows...
Thanks for your help
Click to expand...
Click to collapse
From latest news, OS 5.3.1 can't be rooted(directly). You'll need to downgrade to 4.5.3, root, and go back to 5.3.1 as explained here
If you want to feel android experience, you can either install custom launcher and Play Store from here or just totally install Cyanogenmod 11 from here
Killa8 said:
From latest news, OS 5.3.1 can't be rooted(directly). You'll need to downgrade to 4.5.3, root, and go back to 5.3.1 as explained here
If you want to feel android experience, you can either install custom launcher and Play Store from here or just totally install Cyanogenmod 11 from here
Click to expand...
Click to collapse
@Killa8, as I mentioned HERE in more detail, the procedure for downgrading to 4.5.3 doesn't appear to be explained in the linked tutorial. Any help would be greatly appreciated! I'm trying to root and install CM on my daughter's tablets as they find Android to be far more intuitive than FireOS. Many thanks!!!
Downgrade to 4.5.3 and root as seen here (skip step 1): https://forum.xda-developers.com/fire-hd/general/how-to-downgrade-to-4-5-3-root-device-t3139351
Jump down to the 2nd post here: https://forum.xda-developers.com/fire-hd/general/how-to-upgrade-to-lollipop-root-gapps-t3163950 and install TWRP on your device.
Then go to post 1 where it says "1) boot into TWRP, and, in a single session (!!!!!)" and follow the directions. MAKE SURE YOU USE THE RIGHT BOOTLOADERS!!
Enjoy rooted FireOS 5.3.1
RadRacer said:
Downgrade to 4.5.3 and root as seen here (skip step 1): https://forum.xda-developers.com/fire-hd/general/how-to-downgrade-to-4-5-3-root-device-t3139351
Jump down to the 2nd post here: https://forum.xda-developers.com/fire-hd/general/how-to-upgrade-to-lollipop-root-gapps-t3163950 and install TWRP on your device.
Then go to post 1 where it says "1) boot into TWRP, and, in a single session (!!!!!)" and follow the directions. MAKE SURE YOU USE THE RIGHT BOOTLOADERS!!
Enjoy rooted FireOS 5.3.1
Click to expand...
Click to collapse
Thank you for this! I was having the same issue as the OP and this solved it.:good:
geoyou said:
Thank you for this! I was having the same issue as the OP and this solved it.:good:
Click to expand...
Click to collapse
Can you tell me how you installed TWRP? the 2nd post of the page is confusing to me.
NVM i found a video tutorial
I've seen too many threads mentioning 5.3.1 and implying that 5.3.1.1 is the same.
Even if that is the case, all the tutorials I have read left me scratching my head at various points. So here is a walkthrough of what I just went through to root my Kindle fire HD 6
It's now running 5.3.1.0 and will stay there for the time being (unless I can get solid answers on 5.3.1.1).
I started with this tutorial thread but I found it easy to make mistakes and I ended up bricking my device (fortunately the unbrick iso is very good and the tutorial video is excellent).
So here is my procedure. Doing this on Windows is probably less involved thanks to the bat file in one of the steps.
Start by getting the stuff you will need together.
You will need ROMs from here.
Specifically, the 4.5.3 and 5.3.1.0 ROMs.
The 4.5.3 file name is update-kindle-20.4.5.3_user_453011120.bin
The 5.3.1.0 file name is update-kindle-20.5.5.2_user_552153420.bin
Note: The version number on that second file makes no sense to me, and I made a mistake trying to flash the wrong one in TWRP. Here is the correct name for reference. You might change the file names to reflect the version number.
Go ahead and change the extension of the 5.3.1.0 bin file to zip instead. TWRP will need it this way.
Download the stock recovery image. There is a link at the bottom of the second post in the tutorial thread I linked above. Or you can just click here.
Grab the WindowsAutoTWRP_v03.zip from the tutorial thread (or click here).
It has the Windows ADB executable and drivers in it so it will save you some hassle on a Windows machine.
For Macs, I found a video from RootJunkie.com that linked to tools at http://rootjunkysdl.com/files/?dir=Adb%20Fastboot%20Files. I was able to do everything from my Mac with these.
As a side note, the video I found these on was https://www.youtube.com/watch?v=iv0VcNM8IAw, but it's not important to watch.
It will help to gather zips and APK files you will need right now as well.
Get a copy of ES file explorer, Kingroot (I used the APK, but if you have a windows system, it might be easier to use the Windows version instead), and an android launcher of some sort.
For additional images, you will need the following:
From the tutorial thread: make_space_v02.zip
Supersu.zip linked at https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip
Xposed which if you follow the link from the tutorial through the forum thread should lead you here: http://dl-xda.xposed.info/framework/sdk22/arm/. I grabbed xposed-v87-sdk22-arm.zip
flash Pico (Uni) GAPPS for 5.1 which again, if you follow all the links, will take you here: https://basketbuild.com/filedl/devs?dev=osm0sis&dl=osm0sis/gapps/tk_gapps-modular-pico%28uni%29-5.1.1-20150920-signed.zip.
Make sure you have all the files gathered in one place, it's really helpful.
If you are using a Mac, you will also need Android File Transfer at https://www.android.com/filetransfer/.
Something optional that might help is a USB OTG cable or one of those USB drives that support USB OTG with its own micro USB connector. It's not necessary but it might help if you need to get files to your tablet in TWRP.
At this point, I'm going to go into Mac instruction mode. If you know that the Windows command prompt is sort of like the terminal application on OS X, that you don't use ./ path specifies on windows, etc, you should be able to come up with some
Once you have everything in place, shut down your Kindle Fire 6.
On your computer, open a terminal window and get to where you unzipped your ADB tools.
The simple way is to type cd followed by a space then drag the folder with your tools from finder to the terminal widow so you get something like cd /users/me/abd
The actual path will be dependent on your system.
This terminal window should remain open for the entire process. It will make life easier.
Hold volume up and turn the Kindle Fire on. You should enter recovery.
Back at your computer type ./adb devices
Your kindle should show up there. When it does, go back to your tablet and select "apply update from ADB".
Then, from the terminal, enter ./adb sideload 4.5.3 file name is update-kindle-20.4.5.3_user_453011120.bin
If you just type ./adb sideload then drag the file into the terminal window, it will fill the name and path out for you.
Note that this all seems kind of like the video I linked above but we are downgrading to 4.3.5 instead as the tutorial thread says we should.
Once that's done, you end up back at the recovery screen. I went ahead and did a wipe data/factory reset. I don't know if this is necessary though.
When you get into 4.5.3, you need to shut down wifi if you are not prompted through new device setup.
If you are prompted, just skip it.
You may need to enable debugging. Go to setting, device options, find the serial number field and tap it 7 times.
Open the now revealed developer console and toggle "enable ADB" so it's on.
Install the APKs you downloaded earlier.
Use ./adb install <name of ES file explorer apk>
If you're on Windows, you can go ahead and run the Windows root util.
If you are on a Mac, install the Kingroot APK using the ./adb install command.
If you go the APK route, Kingroot requires a wifi connection. This will expose you to Amazon's OTA updates. You will need to watch your Kindle carefully at this point.
The download with probably download but as long as you don't let it sleep, it should not reboot and install.
Kingroot may take a couple of tries to get root.
As soon as it does, turn off wifi!
After that, open ES file explorer, give it root permissions, then navigate to the root folder, then to cache. Look for a bin file there. If there is nothing, you didn't get the OTA update pushed to you. If you did, delete it. See post 5 in this thread: https://forum.xda-developers.com/kindle-fire-hdx/help/deleting-downloaded-update-t3100573
To prevent any OTA relapses until we can go further, use ES file explorer to rename /system/etc/security/otacerts.zip. I replaces the first o and last p with _ characters.
It should be safe to turn on wifi at this point.
If you deleted a bin file in /cache, you aren't out of the woods yet. The Kindle could still reboot on you and it will give you the red ! but I found booting into recovery then just rebooting the Kindle caused it to work itself out after a couple tries.
We should be good to go for TWRP at this point.
In the terminal type ./adb shell
When the shell opens type su
Grant the shell permissions on the Kindle
Type exit twice.
On a Mac, we cannot run the bat file included in the WindowsAutoTWRP_v03.zip file.
But here are the commands to enter manually:
./adb devices
./adb install gscript-android.apk
./adb shell "mkdir /sdcard/gscript"
./adb push gscript /sdcard/gscript/
./adb shell "cp /sdcard/gscript/flash_453_stay.sh /data/local/tmp/"
./adb shell "ls /data/local/tmp/"
./adb shell "su -c 'chmod 777 /data/local/tmp/flash_453_stay.sh'"
./adb shell "su -c 'sh /data/local/tmp/flash_453_stay.sh'"
Once complete open ES file explorer again
DELETE sdcard/gscripts/s5.4.1_113_stock_recovery_uboot.zip!!!!!!!
It's too easy to mistakenly flash this in TWRP and it WILL brick your kindle.
We will now copy those zip files we downloaded earlier onto the Kindle.
I used the Android file transfer unity to put them in the scripts folder but copying them to Downloads on the Kindle might be easier.
If you are a command line type of person, you can also use the adb push command.
You want to copy over the following:
The 5.3.1.0 file name is update-kindle-20.5.5.2_user_552153420.bin
5.5.2_1534_stock_recovery_uboot.zip
UPDATE-SuperSU-v2.46.zip (or whatever the current version you downloaded is)
make_space_v02.zip
xposed-v87-sdk22-arm.zip (or whatever the version you downloaded is. The version could have changed after I wrote this.)
tk_gapps-modular-pico(uni)-5.1.1-20150920-signed.zip (again, based on what version was available when you downloaded it)
It might be a good time to sideload that extra launcher you downloaded earlier. I didn't need it, but you might.
Again the command is ./adb install <apk file name>
In the terminal, type ./adb reboot recovery.
You *should* end up in TWRP.
These next steps are important to do in one go. Don't exit TWRP until you have installed all the zip files you copied over.
The order in the tutorial thread is the 5.3.1.0 system image, the recovery image, the make_space zip, the Supersu zip, the xposed zip, and the tk_gapps-modular-pico(uni)... zip.
Do all this from the Install menu in TWRP. I did not try to queue up all the zip files at once, I don't know if that would work.
If you forgot to copy a file, TWRP should allow you to copy files via a USB cable to your tablet.
If you do this on a Mac and Android file transfer craps out on you as it did with me, that is where the USB OTG cable comes in handy. But lets hope you copied everything or that the USB connection doesn't crap out on you.
Select the wipe menu, then advanced wipe. Check the cache and dalvik cache. Once done use the back arrow and swath the "swipe to factory reset" slider.
If you are brave, you can just reset and wait through the fire logo.
If you are trying to follow along with the tutorial I linked, reboot while holding volume up to see what recovery you land in. If it's not TWRP, proceed.
When you finally get to Android, you can use ES file explorer as one way to check for root privileges. I'm sure there are others.
I'm no expert, but if you run not problems with the Kindle Fire HD 6 (4th gen) and you started with 5.3.1.1, I can tell you some of the pitfalls I ran into and how I got out of them.
Excellent guide, thanks elementcarbon12!
I'm a total new comer to rooting and getting my hands dirty with android (although I am a long time linux user), and i made it work, and now have a fire hd 6 that I can sort the way I want it!
I did encounter a few problems though, first, I did not do a factory reset /data wipe after the downgrade and ended up in a boot loop. This was easily sorted by using the "adb reboot recovery" command, doing the data wipe/reset and then holding down power for 20 sec.
Everything was smooth sailing again until the reboot out of TWRP after installing the ZIP files. I did the wimps reboot to recovery to make sure I didn't get TWRP, which I didn't, so rebooted to get into android, however I entered a boot loop again. This time a simple hold the power for 20 sec and then turn on worked and the system started it's 'optimization'.
Upon completion, i still had root, although ES and my chosen launcher had gone, so had to reinstall them. No problems there though.
So thank you very much for collection all of the information and links from other pages into this one easy to follow post!
hi guys i have a question I'm on cm11 on fire hd 6 i also have a android backup of 4.5.3 my question is I'm note sure what boot loader i have at one point it did have 5xxx on it but not sure what version can i just side load 5.4.0 and be okay since the stock rom was put back to 4.5.3 thats how i installed cm11 or does it need boot loader from a 5xxx rom
Hello,
I recently got a hand on Yuntab K107, ARM MT8752, Android 5.12 Bootloader unlocked. Everything worked fine until factory reset, after that Google play store and other gapps stopped working (play store checking info, then goes black and freezes for a while).
Tablet is rooted from factory by kingroot, I tried finding TWRP/CWM for this tablet to reflash gapps but I failed. I also tried Magic TWRP installer and MTK droid tools. Magic TWRP installer acts like it's working but no results. MTK droid tools refuses to find my device even if i tried every driver possible and cleared wrong drivers with USBDeview.
I also tried flashing gapps manually thru root explorer by unpacking gapps files and matching system file structure also no luck.
Then I backed up the stock recovery and tried flashing few custom TWRP's that some post suggested may work (you guessed it - it didn't work) It just hangs on the first booting screen then it surrenders after a while and reboots back into android.
Do you know about any TWRP/CWM that might work on this tablet or any other way to repair gapps if recovery is not necessary?
Thanks
I also rooted it with kingroot but havnt any custom recovery but i doing some experiment. Let se what it will result
I should be able to compile TWRP for you
I have one of these K107 tablets but it is running Android 7 and so far I have been unable to root it. Because you guys have root you should be able to download adbd Insecure by chainfire and follow this guide to Fetch the boot.img file by Extracting the boot.img directly from the device:
you will first have to determine the (sadly device-specific) path to the storage device where boot.img's content can be retrieved. I know two methods for this:
ls /dev/block/platform/*/by-name/ (where * covers yet another device-specific folder name, chances are it is the only directory below platform/), the exact name to search is also platform dependent but makes usual sense (some examples: boot, LNX (acronym for "Linux")). The files in this directory are actually symbolic links and some people bother to manually go to the target, but I recommend sticking with the higher level name based path which, while longer, remains less error prone. So you will end-up with a path like /dev/block/platform/sdhci-tegra.3/by-name/LNX.
On some (older?) devices, the right device could be found by investigating the output of cat /proc/mtd. If you see the device mtd2 associated to the "boot" label, then you will use the path /dev/mtd2.
Now:
From the phone's developer menu:
Enable debugging on your phone,
Allow root access to ADB (this step applies to phones running CynogenMod, other devices may require some potentially more complex procedure),
Connect it to your computer (and from there to the VM guest if you are running Android tools from within a virtual machine).
If this is not already done, I recommend to manually start the ADB server on the computer's side, this will allow you to directly validate the RSA key on device's side without affecting the behavior of the following ADB commands:
adb start-server
Then switch ADB in root mode:
adb root
Finally, you should be able to directly extract the boot.img file from the device using such command (the source and destination path and names are given as examples, adapt them to your needs and preferences):
adb pull /dev/block/platform/sdhci-tegra.3/by-name/LNX ./boot.img
The command will copy the whole partition, both used and free space, so don't be surprised that the resulting boot.img file will be larger than the original boot.img file coming with the stock ROM .zip file, the content itself remains similar.
Once the transfer is finished, disconnect the phone and don't forget to disable both debugging and root access from the developer menu.
Then upload the boot.img and I will build TWRP and test it on my tablet for you