Alright, so the root filesystem image is in /mnt/system/androidmerged.squashfs.secure
So do a temp root, copy to /mnt/storage, and then a adb pull gets it over.
The squashfs itself is offset by 256 bytes, so:
losetup -o 256 /dev/loop0 ./androidmerged.squashfs.secure
At this point, the FS can be mounted or unsquashfs can be used to extract it.
So, what's the first 256 bytes? The secure implies some type of signature, but what kind, and what else is in all those bytes?
I'm not feeling brave enough to try just grabbing the first 256 bytes and appending a modified squashfs image to it on my device just yet, but if others try please report back. (On both if it works, and if not what it takes to recover the unit.)
how big is it? can you upload it somewhere? (or would this be illegal?)
damm.. i need my 101!
chulri said:
how big is it? can you upload it somewhere? (or would this be illegal?)
damm.. i need my 101!
Click to expand...
Click to collapse
75 MB - uploading now
Edit: And up: http://hotfile.com/dl/88050103/f99f306/androidmerged.squashfs.secure.html
thx!
how would you replace the root fs image on the device?
chulri said:
how would you replace the root fs image on the device?
Click to expand...
Click to collapse
Connect via ADB, do a temproot, put the file in /mnt/storage, then copy it into /mnt/system overwriting the existing file. /mnt/storage is an ext3 filesystem mounted read/write, however I simply do not know if it will be possible to recover the unit if there is some kind of signature verification and we fail due to a modified image.
Again, someone braver then I should make this attempt and let us know how it goes.
The source did not give all that many hints, but I need to dig through in some more detail.
zelch said:
Connect via ADB, do a temproot, put the file in /mnt/storage, then copy it into /mnt/system overwriting the existing file. /mnt/storage is an ext3 filesystem mounted read/write, however I simply do not know if it will be possible to recover the unit if there is some kind of signature verification and we fail due to a modified image.
Again, someone braver then I should make this attempt and let us know how it goes.
The source did not give all that many hints, but I need to dig through in some more detail.
Click to expand...
Click to collapse
If the unit will still boot to recovery could a full wipe and reinstall of the base AOS over USB get it back up and running?
krohnjw said:
If the unit will still boot to recovery could a full wipe and reinstall of the base AOS over USB get it back up and running?
Click to expand...
Click to collapse
Recovery shouldn't be part of the FS so at worst, you'd have to do a format/firmware install.
You can do a full system wipe/format from recovery. it's not in any damageable storage by us without flashing a new recovery image.
Interesting about the front 256 bytes. It must be a signature. Not sure what good rebuilding the squashfs will do as it'll still be read only but it's a start. We could at least update the system properly and install the appropriate apps. Maybe in make some of the system dirs symlinks to writable locations possibly.
Permroot, giving us a filesystem mounted RW and not no-suid.
Ideally, I'd like to have decent support for the internal storage being ext3 without nosuid, but first we need to be able to replace the root filesystem image.
Other notes..
Looking at the hexdumps, the 256 byte chunk does not contain the start of the md5, sha1, sha224, sha256, sha384, or sha512 checksums.
The most troubling option which comes to mind is that it is the right size for a RSA 2048 bit block, hopefully not.
Anyone have ideas on how to find the initramfs image that the bootloader is feeding the kernel?
For that matter, has anyone tried taking apart the OS update images?
zelch said:
For that matter, has anyone tried taking apart the OS update images?
Click to expand...
Click to collapse
I think the aos file or the responsible installer/updater should give us a lot of information about how this stuff can be updated.
chulri said:
I think the aos file or the responsible installer/updater should give us a lot of information about how this stuff can be updated.
Click to expand...
Click to collapse
Agreed.
It looks like usr/bin/abcbox in the root filesystem has something to do with the update process.
zelch said:
Agreed.
It looks like usr/bin/abcbox in the root filesystem has something to do with the update process.
Click to expand...
Click to collapse
And it definitely is!
On a rooted device:
Code:
/usr/bin # PATH=$PATH:/tmp
/usr/bin # ln -s /usr/bin/abcbox /tmp/cramfschecker
/usr/bin # cramfschecker
USAGE: cramfschecker FILENAME
/usr/bin # cramfschecker /mnt/system/androidmerged.squashfs.secure
cramfschecker : check against 2.0.54
cramfschecker verification OK
Anyone with some ARM disassembly skills feeling up to taking abcbox apart to see how it's doing the signature check?
And so I've been digging into this, and it turns out that this is really quite similar to how the Gen 7 Archos 5 IT is locked.
The signature there is a RSA + MD5 signature, which is really the worst case as that means a 2048 bit RSA key, so we're kinda screwed there.
http://strazzere.com/blog/?p=320 has a good description of the situation on the 5IT. Getting a flash_unlock binary should be fairly trivial, so perhaps we can tamper with the key store to add additional keys.
ah zelch, this is good stuff.
i'm gonna diff the archos gpl kernel, looking for changes at mtd stuff. maybe we can build a kernel module which enables r/w access to stage1
edit: or do we already have r/w access?
This stuff is all pretty interesting to read, but if I'm reading this correctly (and it is entirely possible I'm not) it looks kind of like this device is going to be a total pain in the ass to root, and it may take a considerable amount of time for us to get there.
Can someone who is more knowledgeable on this sort of thing verify that? Thanks for all your hard work guys. It's appreciated.
its definitly not going to be that easy as other android devices were but would it be so interesting if it wouldn't be so hard to root?
While that's true, it will make it a bigger triumph when it is finally rooted, the tinkerer in me is dying to mess with roms on this device and see what it can really do once it's cracked open. Keep up the great work guys, I'm following with baited breath.
Write to stage1 appears to exist, and indeed looking at /proc/mounts /mnt/rawfs is mounted rw. Looking at the kernel source, write support should Just Work.
So, looking through /mnt/rawfs avboot is clearly the boot loader which verifies stuff, but we lack source for it.
I have absolutely no knowledge of ARM asm, and screwing this up will absolutely brick your device, quite possibly beyond repair. (And I wouldn't bet on ArchOS being willing to replace it either, I sure wouldn't.)
So, anyone with the right background willing to step in here?
I'll keep digging, perhaps we can still find the answers.
Note: avboot has some strings which reference a development kernel, this bears some additional hunting.
I still haven't got my A101, but its finally on its way to my home.
can you please upload these files and give me kind of a tree of the folder structure?
Partitions are something we usually don't need to mess with - probably shouldn't mess with. That said - to understand how things work, it would be nice to peek around and look. I have enough experience with linux to be dangerous but not enough to answer my question on the gtab. I know there are multiple partititons - clockwork mod can wipe some. I see when I do nvflash that a bunch of partitions are restored. When we repartition with clockwork we set the size of only one partition to 2040 and the swap partition to 0 - what about all the others? Now, if I use terminal emulator or can get up to what I think is the root directory. In linux I could use fdisk -l and it would show me the various partitions. It doesn't produce any output here. I'm sure I just don't understand the structure so I'm not phrasing the command properly. There is also probably another place that would clue me in as to what partitions are mounted where but I don't know it. Anyone have any ideas for me?
Hi everyone,
I am eager to try out ICS' disk encryption feature. One thing is it requires that /data is in ext4 format. This is on a SonyEricsson Active and the default FS type for /data is yaffs2.
I've tried a few different things but I'm not getting anywhere. I've also seen a few threads here with posts of zip files that should do it but none for the SE Active. I would like to try this from the Recovery mod CLI. I already have ICS 9.2 installed and running on it no problem.
Any suggestions?
Thanks! I hope this is the right forum to post this in.
Hello,
I want to edit an ext4 file with Windows XP and and I haven't found a solution despite extensive research.
Thank you in advance !
https://www.paragon-software.com/home/extfs-windows/
Thanks but I don't want to access to an ext4 partition but I want to edit a file, like this :
http://image.gilawhost.com/14/04/24/vgg34udp.png
Then I've no clue, sorry. As far as I knew it was only partitions that are ext4, not extensions.. Must be something unique to Archos stuff perhaps.
According to this answer (specifically the part "Since Archos uses a very different (and encrypted) filesystem partitions scheme"), I would say you're not able to open that file (at least not without cracking the encrypthion Archos uses. Which would be another subject.
I've created a single primary Ext2 partition in my phone's external SD card but Android refuses to mount it automatically. Whenever I attempted to mount it manually it kept throwing the error "mount operation not supported on transport endpoint".
How can I mount it?
Using (SlimKat) Android 4.4.2.
EDIT: I'm now able to mount it only manually but have to specify ext4 as its filesystem -- why and will it make a difference since ext2 is non-journalled? Also, I tried adding a mount entry in /fstab.smdk4x12 but it was deleted upon reboot; does this mean no manual entries are allowed in that file and I will instead have to hack my own /init-xx.rc file to manually mount the partition at boot time?
miguelg_ said:
I've created a single primary Ext2 partition in my phone's external SD card but Android refuses to mount it automatically. Whenever I attempted to mount it manually it kept throwing the error "mount operation not supported on transport endpoint".
How can I mount it?
Using (SlimKat) Android 4.4.2.
EDIT: I'm now able to mount it only manually but have to specify ext4 as its filesystem -- why and will it make a difference since ext2 is non-journalled? Also, I tried adding a mount entry in /fstab.smdk4x12 but it was deleted upon reboot; does this mean no manual entries are allowed in that file and I will instead have to hack my own /init-xx.rc file to manually mount the partition at boot time?
Click to expand...
Click to collapse
Why not just reformat to ext4?
es0tericcha0s said:
Why not just reformat to ext4?
Click to expand...
Click to collapse
Ultimately that's what I'll need to do but was hoping to use the non-journalled ext2. Is it not supported by Android or it the case that only some versions support it (in which case, what idiocy!)?
Have to say I'm beginning to truly hate Android. They might as well build their own kernel such that Linux (and by implication UNIX) is removed from the mix for they have completely butchered this OS. I suppose this is what happens when egos larger than the world are responsible for designing software; NIH syndrome.
Answering myself: if anyone is wondering how to automount a partition at boot time, you'll have to create your own init script and place in /system/etc/init.d/.
Well, realistically, the amount of people that have any use for mounting ext2/3/4 etc partitions is a very small % of users. Most people with android phones don't even know what Linux is, much less know about different kinds of partitions and what they are used for - or have a need for it. 99% of things you would NEED to do on a phone would be covered by the fat32 and exFat types. Of course, here on XDA, you'll find plenty of posts, guides, complaints about it, etc but there's obviously a certain type of user that seeks out or finds XDA and are more inclined to know of or have use for more technical things like this.
As far as auto-mounting the script on boot, you have to be rooted with init.d enabled and not all phones have full /system RW capabilities to even add stuff like that even when rooted. This is rare, but there's some HTCs and others like that. Often times there are ways around, but just saying, it's not a universal thing.
es0tericcha0s said:
Well, realistically, the amount of people that have any use for mounting ext2/3/4 etc partitions is a very small % of users. Most people with android phones don't even know what Linux is, much less know about different kinds of partitions and what they are used for - or have a need for it. 99% of things you would NEED to do on a phone would be covered by the fat32 and exFat types. Of course, here on XDA, you'll find plenty of posts, guides, complaints about it, etc but there's obviously a certain type of user that seeks out or finds XDA and are more inclined to know of or have use for more technical things like this.
Click to expand...
Click to collapse
That doesn't excuse the fact that they've deliberately crippled the OS. As an example, the FAT filesystems don't support symbolic links, which means that if you want to move any data outside of internal storage for whatever reason, you pretty much need an extX partition. Besides, those people (the vast majority) who don't know and don't care about the internals of their devices aren't the ones creating software for said devices in the first place. We are. And so these technical aspects matter and are relevant to us, not the masses.
es0tericcha0s said:
As far as auto-mounting the script on boot, you have to be rooted with init.d enabled and not all phones have full /system RW capabilities to even add stuff like that even when rooted. This is rare, but there's some HTCs and others like that. Often times there are ways around, but just saying, it's not a universal thing.
Click to expand...
Click to collapse
Didn't know about that limitation. Can you not remount the rootfs with RW privileges? And do you mean to say that some devices don't even support init.d; if so, what mechanism do they have in place?
miguelg_ said:
That doesn't excuse the fact that they've deliberately crippled the OS. As an example, the FAT filesystems don't support symbolic links, which means that if you want to move any data outside of internal storage for whatever reason, you pretty much need an extX partition. Besides, those people (the vast majority) who don't know and don't care about the internals of their devices aren't the ones creating software for said devices in the first place. We are. And so these technical aspects matter and are relevant to us, not the masses.
Didn't know about that limitation. Can you not remount the rootfs with RW privileges? And do you mean to say that some devices don't even support init.d; if so, what mechanism do they have in place?
Click to expand...
Click to collapse
Well, cripple might be a bit of hyperbole considering it's not something most people would need. I get your point though, it is weird that it's not native since it works with Linux generally. You can link symbolically to FAT systems while rooted with something like this:
https://play.google.com/store/apps/details?id=com.devasque.fmount
And yes, the tech people are creating software for these devices, but they are made for the general public, because that's who buy 90% of these things.
Could you please clarify what you said earlier on the read-only init.d and even some devices not supporting it? Again, thanks for your input, es0tericcha0s.
miguelg_ said:
Could you please clarify what you said earlier on the read-only init.d and even some devices not supporting it? Again, thanks for your input, es0tericcha0s.
Click to expand...
Click to collapse
Sure. Most android devices, actually I can't think of any of the top of my head, don't come with native init.d support or even have init.d that is not accessible. It's just not there. It's enabled in almost all custom roms, or you can add it yourself to many stock roms via a couple different ways like this:
https://play.google.com/store/apps/details?id=com.androguide.universal.init.d
As far as the system RW issue, some phones, like many newer HTCs, have the system protected so that you can make changes to the /system while booted, no problem, but once you reboot, all the changes will get undone. Very annoying. Example:
https://www.youtube.com/watch?v=KV3YaMBnEYI