Hey All
I'm new to Android but not linux.
Bought cheap Allwinner type 5.1.1 tablet - 10.6" Fusion5 108 Octa Core Android Tablet PC
rooted it using KingRoot, messed around with Supersume to remove KingRoot and now device won't boot properly. Using adb I can see dmesg is complaining about debuggered which is actually now a zero byte file. su won't work now and I don't have the rights to fix it.
Before I did any of this the first thing I did as root was backup the mmc partitions to a USB stick.
The bootloader and recovery areas have not been changed.
Can I use my system partition backup to create a update.zip for use in recovery mode?
Or maybe in fastboot though I'm currently having problems getting fastboot to see my tablet whether I use linux or windows so recovery mode fix prefered..
lol
Looks like the solution is to post here, and then find a partial answer 5 minutes later.
fastboot command on linux didn't work (despite adb working, udev configured etc)
Then tried with manufacturer id
fastboot -i 0x1f3a
then works
Then did
fastboot -i 0x1f3a erase system
fastboot -i 0x1f3a flash system /home/user/android/13-11-16/system
It complained that about magic so I suspect this DIDN'T work. although data was sent.
fastboot -i 0x1f3a reboot
and device came up in a graphical environment asking for wireless password. Judging by network trace on my router I think it might be trying to download a factory image over the Internet. Will see.
Bit confused as my system parition backup is like 900Mb but when I did flash system I think it said device reported size was 32MB approx. More to learn
OK
The 32Mb was referring to buffer size, so can confirm system flash did work.
Device was booting, getting to graphical environment, and then trying to connect some web servers - not sure why really but seem to have got past that point.
Now can't install apps - get stuff like
W/art ( 9462): Unable to open /data/dalvik-cache/. to delete it's contents: Permission denied
W/art ( 9462): Unable to open /data/dalvik-cache/arm to delete it's contents: Permission denied
W/art ( 9462): Could not create image space with image file '/system/framework/boot.art'. Attempting to fall back to imageless running. Error was: Unable to relocate image '/system/framework/boot.art' from '/system/framework/arm/boot.art' to '/data/dalvik-cache/arm/[email protected]@boot.art': Only the zygote can create the global boot image.
Think /data is corrupt so will flash my backup of that.
I'm more thinking outloud at this point rather than expecting people to do it for me But I'll post anyway if that's ok if only for my own reference - though any insights by all means.
Can't flash data backup.
Ended up with 13Gb file from mmc copy when system was working so after img2img didn't seem to be working used ext2simg on it as it was a ext image.
Created a more reasonable sparse 887335016 file.
fastboot wouldn't flash it though complaining that data partition was unknown. Searching seems to suggest that sometimes the bootloader doesn't know about all partitions (though it does about system which was flashed ok).
Tried playing with other recovery environments. Not willing to flash anything at this point so trying flashboot boot <img>. No luck so far - device just stays on bootloader splash screen. Probably not great that this device is a Allwinner A38 to which there doesn't seem to be huge support at the moment.
Even tried flashboot boot <recovery partition dump> file I made and that doesn't work.
Trimmed the first 0x800 so image starts with kernel code without joy.
A binwalk of the initrd image inside the dump shows a init.recovery.sun8i.rc file, and a default.prop with
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
in init
# Always start adbd on userdebug and eng builds
on property:ro.debuggable=1
write /sys/class/android_usb/android0/enable 1
start adbd
So assuming default.prop is used (I'm still learning) then that's why I can't adb when in recovery mode. Seems stupid to design it that way.
I'm thinking if I can restore data partition it will fix the can't install apps problem, though perhaps the /system part is fundamentally busted. If I can reinstall KingRoot and root again I assume the device will be usable as it would effectively undo my supersume attempt to remove it.
Env partition dump I made used by the bootloader there is
Code:
boot_normal=sunxi_flash read 40007800 boot;boota 40007800 boot
boot_recovery=sunxi_flash read 40007800 recovery;boota 40007800 recovery
Usage:
sunxi_flash read command parmeters :
parmeters 0 : addr to load(hex only)
parmeters 1 : the name of the part to be load
[parmeters 2] : the number of bytes to be load(hex only)
if [parmeters 2] not exist, the number of bytes to be load is the size of the part indecated on partemeter 1
Click to expand...
Click to collapse
So maybe I need to specify the correct memory location when I'm fastboot boot'ing
There's no image type header specifing load address at the start of the recovery part dump I made.
Didn't manage to boot the recovery image - don't know why but a challenge for another day. Would probably be easier with UART access or similar to see what is actually happening.
In the end I mounted my /system backup on my linux server, cleaned it of KingRoot crap, and flashed it. Now everything is fine! Except no root access and the script I added to give me it comes us as unlabeled in selinux and isn't accessible.
The learning journey continues
og0 said:
Didn't manage to boot the recovery image - don't know why but a challenge for another day. Would probably be easier with UART access or similar to see what is actually happening.
In the end I mounted my /system backup on my linux server, cleaned it of KingRoot crap, and flashed it. Now everything is fine! Except no root access and the script I added to give me it comes us as unlabeled in selinux and isn't accessible.
The learning journey continues
Click to expand...
Click to collapse
I know this is a 2 year old thread... but does the OP still have that firmware that fixed the tab??
I have a Fusion5_108 with the A83T allwinner processor, stuck in a boot loop, wont get past the 'no command' screen when trying to recover,
think my only option is to make an sd card with a working firmware on it, and load it onto the devise like that, but i cant find a firmware or anything for this tablet
Related
hi, i recieved a eris from a friend of mine with the intentions on fixing it and using it. when i power it on there's just a black backlit screen.. no splash, nothing. if i plug usb in it goes to a htc screen with 4 triangles in the corners. i've tried the ruu update and it gives an 110 error at the end saying something about files not found, i unhooked the usb and it went to a white screen with hboot 1.49 , n s-on n all that stuff.. and it showed info from the ruu, and it showed that the system and boot(or recovery, i cant remember exactly) failed and they were red. i can connect with fastboot but not with adb.. is there anything i can do to atleast get the phone working.. fastboot oem boot doesnt work for me, it just gives a long list of errors
fastboot will do nothing useful for you if you have the 1.49.0000 S-ON bootloader.
The basic definition of a brick for the Eris is this:
1.49.0000 S-ON bootloader + no recovery + non-booting OS = brick
So, let's review.
1) You have 1.49.0000 S-ON. There is no PB00IMG.zip available to you that can change that using Hboot (without performing some magic with a custom recovery first), and fastboot is worthless with S-ON. So, no go there.
2) You didn't mention (or your description was lacking detail) what happens when you try to go into the Hboot menu (cold start with Vol-Down+End). From there you might be able use the menu to try to launch the recovery boot, to see whether (a) it is the stock recovery, (b) it is a custom recovery, or (c) it fails to start. You should try that next.
If that doesn't work, try a cold start with Vol-Up + End. (You need to keep holding both the buttons down until the screen lights up). That is an alternate way to get to the recovery (when a 1.49.xxxx bootloader is on the phone).
If you have a "stock" recovery, you will see a splash screen with an image of the phone and a triangle with an exclamation point in it. (Pressing Vol-Up+End after you see that splash screen will show a blue menu). If you have Amon_RA's custom recovery, you will see a green menu.
3) If your kernel boots, but the OS is "hanging", there is a remote possibility that you can initiate a factory reset from the "hung" OS. This is a long shot, but you power up the phone normally and then press together Vol-Up+Send+End after waiting a couple of minutes. This might make it bootable. (As I said, "long shot". The fact that you have 1.49.0000 on the phone suggests that the prior owner tried some things - and apparently failed at it.)
bftb0
thanks for the response
i tried all of that just now and all i get is a black backlit screen unless i connect usb which gives me a black screen with HTC n four exclamation point triangles in the corners. and there isnt anything i can do from that screen and its bricked huh?
SoSicWiTiT said:
thanks for the response
i tried all of that just now and all i get is a black backlit screen unless i connect usb which gives me a black screen with HTC n four exclamation point triangles in the corners. and there isnt anything i can do from that screen and its bricked huh?
Click to expand...
Click to collapse
That's not a very good sign. I will say, however, that it is very strange that you can get the phone into RUU mode but not have a working bootloader - those two observations are mutually exclusive.
For grins, you could check to see if perhaps your Vol-Up/Vol-Down keys are broken by doing the following:
- Cold start the phone by pressing Send + End simultaneously (make sure to press Send first so that you are not initiating a normal boot; hold both keys down until the screen lights up). Make sure you pull the battery and have the USB cable disconnected when you pull the battery before you try this (to insure that the phone is "really" off).
If that works, the phone will be in Fastboot mode. You might be able to get into Hboot (but not recovery if your Vol-Up/Vol-down keys are broken) at that point with the command
Code:
fastboot reboot-bootloader
from a USB-connected PC.
Under normal circumstances, you can navigate from Fastboot Mode to Hboot and then from there to the Recovery boot - but this requires working Vol-Up or Vol-Down keys.
There is a very, very slim chance that if you can get Hboot launched this way (that is "fastboot reboot-bootloader")... and try to apply the Leak-V3 "PB00IMG.zip" file. If I recall correctly, you don't need Vol-Up/Vol-Down to apply an HTC PB00IMG.zip file - just the trackball press.
I'm not optimistic though - I think that the Leak-V3 (and all other Leak PB00IMG.zip) files probably will just fail with "Main Version is Older Messages".
As for other avenues of approach, there are no publicly known exploits of the RUU mode (= oem-78 mode).
Good luck
well
actually after staying up n working at it for 48 hours, i'm halfway done with a solution...and maybe the first ruu exploit.
i decided to run the 2.1 RUU and after it does its install wizard thing, i navigated to the temp folder where it installed all the files. i took the root rom (pb00img.zip) n renamed it to "rom.zip" then over wrote the version in the temp folder and started the ruu (clicked next and what not).. it failed as usual with error 110.. but afterward i noticed my phone says
pb00100 xc ENG S-OFF
HBOOT-1.49.2000
and before i did the file swap and ruu it said
pb00100 XC ENG S-ON
HBOOT-1.49.0000
so now i might be able to flash a custom recovery thru fastboot since i have s-off now
if not.. still.. its progress
Hmmm, interesting.
Whether or not that qualifies as new behavior sort of depends on what your "friend" did to the phone prior to getting it into the nearly bricked state. If they had previously run the jcase "Flash any RUU" method, then the Root ROM would have "taken" with the Hboot method... although in your case, since you "couldn't get there from here", my hat's off to you for a clever way of making the best of what you have!
Since you have the S-off bootloader, you might be tempted to direct-boot Amon_Ra without even bothering to flash it:
Code:
fastboot boot recovery-RA-Eris-v1.6.2.img
to see if your phone springs to life... congrats if you see a menu!
bftb0 said:
Since you have the S-off bootloader, you might be tempted to direct-boot Amon_Ra without even bothering to flash it:
Code:
fastboot boot recovery-RA-Eris-v1.6.2.img
to see if your phone springs to life... congrats if you see a menu!
Click to expand...
Click to collapse
i did that right after i seen it say "S-OFF". i get to the menu but when i try to flash a rom it gives me an error after formatting system.
Code:
E:Can't symlink /system/xbin/arp
E:Failure at line 65:
symlink /system/xbin/busybox SYS
TEM:xbin/arp
and after hours or more reading, everything is pointing to the boot and system partitions being corrupted by a bad flash of some sort.
i think i might have hit the end of the road..
EDIT
i managed to somehow get all the regular hboot, fastboot, n recovery to work and flashed amon_ra and can get to it from volup+power.. even got the 3 skateboarding droids on normal power on..
but cant flash any roms , from amon's ( gives the error above )or pb00img from hboot (at the end has "failed-PU" next to system..)
any idea's?
I have a couple ideas (still typing them up) ... in the meantime, if you boot Amon_RA and then open up a shell from the PC ("adb shell") and then
- check the output of "dmesg" to insure that the MTD partition table is still intact; you should see something like this towards the beginning of the boot log:
Code:
NAND_EBI2_ECC_BUF_CFG: 1ff
flash_id: 5501bcec size 20000000
Creating 6 MTD partitions on "msm_nand":
0x00001ff60000-0x000020000000 : "misc"
0x000002c60000-0x000003160000 : "recovery"
0x000003160000-0x0000033e0000 : "boot"
0x0000033e0000-0x00000dde0000 : "system"
0x00000dde0000-0x000015fe0000 : "cache"
0x000015fe0000-0x00001ff60000 : "userdata"
- try mounting (in turn) each of /system, /data, /sdcard, e.g.:
Code:
mount /sdcard
mount /data
mount /system
/cache should already be mounted.
Which mounts fail?
bftb0
The scenario you describe has come up before - or at least very similar symptoms.
Note that Nandroid restore will fail because it uses standard Unix tools such as "rm" to clear filesystems, so if a partition will not mount because of a corruption issue, nandroid will fail. I suppose that the same thing is true of the /sbin/recovery utility running underneath the booted recovery kernel (but I have not read the source code to verify that it is attempting to "mount" the filesystems first - if it didn't do that, it would need to understand the raw format details of yaffs2, and I think that is a stretch).
Unfortunately the filesystem formatting tools provided by Amon_RA do not include tools for repairing the mtd (NAND flash) - they are for the SD card/ extN filesystems. It is my impression, however, that the "yaffs2" filesystem is "format free" - meaning that a clean (Flash memory) "yaffs2" filesystem is simply a bunch of zero'ed pages - no superblocks, or Inode lists, - none of that. This suggests that the equivalent of "dd if=/dev/zero of=/dev/mtd/mtdNNN bs=..." could "repair" a yaffs2 file system by simply wiping it... but let's try something a little less crude than that (see below).
I had one of the file systems in my phone in this state at one time and I was able to repair the problem by reflashing the Root ROM - otoh, XDA user "stick" tried this and it seemed to produce a permanent brick in his case, so I am reluctant to recommend you do that. (You might, however, want to perform the jcase "Flash any RUU" hack to the "misc" partition so that you have flexibility to apply any PB00IMG.zip file)
Because the "flash_image" tool (in /sbin/flash_image in Amon_RA) writes both boot images and yaffs2 image files to arbitrary mtd partitions (and raw binary files to "misc"!), there is a chance that it is merely the equivalent of "dd for the MTD device" - so that you could "repair" a corrupted yaffs2 filesystem by simply overwriting it with a valid yaffs2 image file. The repair strategy here would be to:
- Unpack any PB00IMG.zip file and move the contents to a folder on the SD card. (Verify the md5sums of the files on the SD card before you use them - use this reference)
- Use "flash_image" from Amon_RA to flash the corresponding image file for the offending ("won't mount") partition, e.g.
Code:
flash_image system /sdcard/unpacked-PB00IMG/system.img
If this succeeds, see if you can "mount /system".
bftb0
PS Don't try flashing "system.img" using fastboot. However it is engineered (by the HTC bootloader) it will fail due to space issues. It is possible that the HTC bootloader uses the /cache partition to temporarily stage the file, which is only 130 MB compared to 159.5 MB for the /system partition - but whatever the explanation, the experimental result is that that on the Eris, you can not flash /system from fastboot. All the other partitions, no problem - but not the /system partition.
thanks,
i tried what you suggested and it let me mount all 3 of those partitions, and i tried using flash_image to flash the system.img i extracted and in return got a million and one errors..
starting with mtd: ECC error soft 0 hard 1 (continuing until about a hundred something)
then
mtd: not writing bad block at (basically the entire /system hex range)
then finally
error writing system: no space left on device
SoSicWiTiT said:
thanks,
i tried what you suggested and it let me mount all 3 of those partitions, and i tried using flash_image to flash the system.img i extracted and in return got a million and one errors..
starting with mtd: ECC error soft 0 hard 1 (continuing until about a hundred something)
then
mtd: not writing bad block at (basically the entire /system hex range)
then finally
error writing system: no space left on device
Click to expand...
Click to collapse
Was the partition table information correct? (I have seen innocuous "write error" messages on my phone, but they only occurred on regular block boundaries - not for every page; but in that case I don't think I ever saw an "out of space" message. Assuming everything was performed correctly, your phone is behaving as if large blocks of flash memory are being skipped due to "bad blocks")
Did you unmount the filesystems prior to doing the writes?
That is very mystifying.
If you can mount /system, or /data, what happens when you go in and do a
Code:
mount /system
cd /system
rm -rf /system/*
mount /data
cd /data
rm -rf /data/*
cd /
If those succeed, unmount everything
Code:
cd /
for x in /system /data /sdcard ; do
umount $x
done
Run an Amon_RA "wipe data/factory reset", and try and flash a ROM.
???
bftb0
One other thing you could try - I have never used it, so I don't know what effect it will have - is to use fastboot mode to erase the "system" and "data" partitions, and see if that has any effect on your ability to flash a ROM.
In fastboot (boot w/ Send+End) mode:
Code:
fastboot erase system
fastboot erase data
And then afterward boot into Amon_RA and try flashing a ROM.
I suppose you could also erase the boot partition this way, but you probably ought to do them one at a time just to minimize erase operations - and then if an operation fails in Amon_RA, examine the log file at
Code:
adb shell cat /cache/recovery/log
to see if it provides further elaboration on the nature of the error(s).
bftb0
Something else to try:
The symptoms you have (esp. since it appears that /system and /data will mount correctly) appear as if you "run out of space" when flashing ROMs to NAND. I suppose that could occur if somehow a bunch of pages in flash memory got (erroneously) marked invalid. Unless there is some means to clear flash memory so that bad page indicators are cleared, there is no way to reclaim those pages. (It is my impression that brand new NAND flash chips are already programmed with bad pages pre-marked)
It would be nice if the partition erase function of fastboot actually performed the page reclaim/retesting/re-marking operation - but there is no way to know whether that happens, as the HTC bootloader acts as the interpreter of "fastboot commands" passed over the wire (USB). It is free to implement whatever bad page management strategy that HTC desires - and frankly, a "never reclaim bad pages" policy is fairly reasonable when you consider that most consumer phones are flashed perhaps only 3 or 4 times in their lifetime - if that.
Something to try: if you perform a manual wipe of either /system or /data (after mounting them), do a "df" to see how much free space the kernel thinks they have - for a normal phone, that should be pretty darn close to the partition size. E.G.
Code:
> adb shell
# mount /system
# df /system
# mount /data
# df /data
# umount /system
# umount /data
# exit
>
If it seems "short" by a substantial amount, try installing a "small footprint" ROM, such as CELBFroyo 3.2 - it only uses about 100216 KB (97.9 MB).
Just a thought; I realize this is grasping at straws, but there is little for you to lose (which you knew right from the get-go).
bftb0
wow seriously i appreciate all the help you've provided , you need a donate button lol.
the system partition is 66% used (bad blocks im guessing) after a format leaving 59,648 useable
but the data partition is fine with 1% used. and 162,176 usable
but i havent lost all hope yet and this is entertaining me.
custom mtd maybe..swap /data to mtdblock3 (the bad one, system) and and /system to mtdblock5 (where data currently is).. or use a memory card idk?
here's where i got the idea
http://forum.xda-developers.com/showthread.php?t=717874
SoSicWiTiT said:
the system partition is 66% used (bad blocks im guessing) after a format leaving 59,648 useable
Click to expand...
Click to collapse
Holy crap!
For grins, could you do a "cat /proc/yaffs" and post up the section for the "system" partition? (You need /system to be mounted when you run that command).
Here's what mine looks like after performing an erase with fastboot, booting into Amon_RA, and then mounting it:
Code:
Device 1 "system"
startBlock......... 0
endBlock........... 1359
totalBytesPerChunk. 2048
nDataBytesPerChunk. 2048
chunkGroupBits..... 0
chunkGroupSize..... 1
nErasedBlocks...... 1359
nReservedBlocks.... 5
blocksInCheckpoint. 0
nTnodesCreated..... 0
nFreeTnodes........ 0
nObjectsCreated.... 200
nFreeObjects....... 96
nFreeChunks........ 86976
nPageWrites........ 0
nPageReads......... 0
nBlockErasures..... 0
nGCCopies.......... 0
garbageCollections. 0
passiveGCs......... 0
nRetriedWrites..... 0
nShortOpCaches..... 10
nRetireBlocks...... 0
eccFixed........... 0
eccUnfixed......... 0
tagsEccFixed....... 0
tagsEccUnfixed..... 0
cacheHits.......... 0
nDeletedFiles...... 0
nUnlinkedFiles..... 0
nBackgroudDeletions 0
useNANDECC......... 1
isYaffs2........... 1
inbandTags......... 0
I wonder what your "nRetireBlocks" count is.
I only poked around in the HTC "msm_7k" kernel code a little while ago for some clues, so I'm no expert. There does not seem to be any useful knobs to turn by using mount options.
Because Flash filesystems have to deal with new bad pages as they develop, I'll bet the phone could be completely fixed if there was a way to clear the bad pages - ( if they were actually bad, then on the first write use the write would fail, the pages would be marked bad, and the FS driver would recover gracefully - just as normally happens).
But as you say, that would probably require a custom kernel at the minimum with patches to the mtd driver. I do wonder if the kernel driver for the MTD device exposes any hooks (ioctls, etc) that would let you write a (privileged) userspace app which could wipe the raw pages status info.
This YAFFs doc suggests that certain tuning operations can be performed by writing options to /proc/yaffs, including control of tracing. One of the things that seems possible to control is the number of write attempts per page.
I'll have a look at your URL; no promises, though.
bftb0
[ Edit ] PS - do you have any idea what your friend did to get the phone in this state? Maybe flashing a ROM with really, really low battery? It seems hard to believe that an actual hardware problem occurred - moreover, this is not the first phone where very similar symptoms were exhibited.
I'm wondering if a busybox with mtd-utils compiled in might be of some assistance; in particular the "flash_eraseall" tool. (Perhaps use it with the "-N" option?)
lookit recent versions of the "flash_erase.c" code (excerpted from above Git link):
Code:
static void display_help (void)
{
printf("Usage: %s [options] MTD_DEVICE <start block> <block count>\n"
"Erase blocks of the specified MTD device.\n"
"Specify a count of 0 to erase to end of device.\n"
"\n"
" -j, --jffs2 format the device for jffs2\n"
[COLOR=green][B] " -N, --noskipbad don't skip bad blocks\n"[/B][/COLOR]
" -u, --unlock unlock sectors before erasing\n"
" -q, --quiet display progress messages\n"
" --silent same as --quiet\n"
" --help display this help and exit\n"
" --version output version information and exit\n",
PROGRAM_NAME);
}
(I don't have that version of busybox - I see references made to it in a few posts here on XDA, but I don't know it's origin or where to get it)
bftb0
[ Edit ] looked around for a bit and couldn't find anything pre-built; looks like you might have to build mtd-utils using the NDK for Android. Time for bed for me; here's the link to the mtd-utils project.
i found out that my friend installed rom manager n clockwork recovery and did a flash that failed then ran the 2.1 ruu thinking it would fix it. and that's how the phone got to the state i started with.
i actually got a rom to flash (kinda) with some info from that link i posted. i patched my recovery with files from that link which gave it a custom mtd (table) , i shrunk cache and used the extra space to make up for the bad blocks in system and bind mounted cache to and ext partition on my sd card... and all would be great BUT i realized that the boot partition is corrupt too.. ( which makes sense, since clockwork is known to corrupt both)
so my solution was to flash boot.img to recovery and just boot normally with volup+powerand use amon ra by "fastboot boot " if i need to.
but i cant flash the zip file that patches the kernel to boot using the custom mtd because it's script copies,unpacks,patches then repacks boot.img from /boot but my boot.img is on recovery so im either going to have to edit the .sh in the zip or have someone do the whole custom mtd thing and use the same mtdpartmap.txt and have them nandbackup then give me the boot.img from the backup folder so i can flash it to recovery.
OR have someone manually patch my boot.img file... but i highly doubt i'm going to be able to figure that out or find anyone todo it.
and i'll post the system section of that command in a second.
SoSicWiTiT said:
i found out that my friend installed rom manager n clockwork recovery and did a flash that failed then ran the 2.1 ruu thinking it would fix it. and that's how the phone got to the state i started with.
i actually got a rom to flash (kinda) with some info from that link i posted. i patched my recovery with files from that link which gave it a custom mtd (table) , i shrunk cache and used the extra space to make up for the bad blocks in system and bind mounted cache to and ext partition on my sd card... and all would be great BUT i realized that the boot partition is corrupt too.. ( which makes sense, since clockwork is known to corrupt both)
so my solution was to flash boot.img to recovery and just boot normally with volup+powerand use amon ra by "fastboot boot " if i need to.
but i cant flash the zip file that patches the kernel to boot using the custom mtd because it's script copies,unpacks,patches then repacks boot.img from /boot but my boot.img is on recovery so im either going to have to edit the .sh in the zip or have someone do the whole custom mtd thing and use the same mtdpartmap.txt and have them nandbackup then give me the boot.img from the backup folder so i can flash it to recovery.
OR have someone manually patch my boot.img file... but i highly doubt i'm going to be able to figure that out or find anyone todo it.
and i'll post the system section of that command in a second.
Click to expand...
Click to collapse
I was going to say, holy crap that's a lot of work - but then I've been struggling for a couple hours trying to build mtd-utils (or at least "flash_erase"). I've got all the Makefiles happy (by dropping non-essential parts of the build that require "libuuid"), but now I'm struggling with the linker/toolchain issues to try to avoid the hassles of dynamic link libraries for Amon_RA.
I still think that whatever it is that Clockwork does to get all those flash pages marked as if they are bad is a software error or some sort - so that if you can get
flash_eraseall -N
to do its thing on mtd3, you will recover all those "bad" pages in the system partition. (It is hard to believe that massive physical damage to eeprom would only show up in one or two logical partitions).
Cheers.
bftb0
FWIW,
SoSicWiTiT said:
OR have someone manually patch my boot.img file... but i highly doubt i'm going to be able to figure that out or find anyone todo it.
Click to expand...
Click to collapse
Have a look at this android-dls.com tutorial if you haven't already seen it. Use "split_bootimg.pl" to split apart the boot image into the kernel and compressed ramdisk, and then the ramdisk is just a gzipp'ed "cpio" archive.
The hardest bit about this is finding a verstion of "mkbootimg" - there are some floating around on XDA, or you can build it from the github sources.
It's not too bad, the only secret sauce is the load address for the Eris, which is 0x11200000
This is an excerpt from a shell script I use for repacking boot images - it's the essential part (everything else in the script is just glue).
Code:
mkbootimg --kernel ${_KFIL} --ramdisk new-${_RAMDGZ} --cmdline 'no_console_suspend=1 console=null' --base 0x11200000 --output new-${_BNAM}
i edited the shell script thats supposed to patch it to the best of my abilities (changed all boot.img txt to recovery.img) and it has mkbootimg and everything it needs in the zip, so im going to replace the script in the zip and try flashing it...
and something weird just happened.. i forgot i put boot.img for my rom on /recovery . so in shell just now, i typed reboot recovery expecting amon RA and the phone booted into the os???
even though i patched amon ra with custom mtd to install the rom ( system :300,000 - enough to skip bad blocks, cache: 30,000 ) my boot.img is mtd is set to see 176,000 right?
EDIT
i think i flashed that zip with my version of the script earlier to see what happened and i guess it worked..
Code:
C:\droid\tools>adb shell
sh-3.2# df /system
df /system
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/block/mtdblock3 307200 229296 77904 75% /system
sh-3.2# df /cache
df /cache
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/block/mtdblock4 61440 36500 24940 59% /cache
sh-3.2# df /data
df /data
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/block/mtdblock5 101888 2608 99280 3% /data
sh-3.2#
Hi
I've done a bit of searching but can't find anything too specific to what I'm trying to do. Basically we have 10 Android tablets, and I want to make them all standardised e.g. have the same Apps on, configured in the same way (e.g. enterprise wireless network added).
Now the thing is if anyone messes around with them I want a really easy way to restore them to the original config which I've done.
One way I thought was to configure one fully, install Titanium Backup on it, do a full backup of apps/system data etc, and put the backup onto an SD card. Then I already have the base ROM on an SD card so if theres any problems, I can just flash the ROM over it again, install TB, and restore all the data. Would this be suitable to do to duplicate the data onto 10 tablets, and also restore the data if required?
The other thing I looked into was customising a ROM myself, don't want to do anything too tricky it'll just be a case of removing all the preinstalled crap I don't want, preloading the Apps we do want, and if possible preloading the wireless key and getting rid of the first boot initial set up wizard.
PS I've looked at installing CWM and doing whole image backups, but supposedly the tablet isnt supported (its an Ainol Novo 7 Elf 2)
Any advice would be great, hopefully theres some fairly straight forward way of managing this
Thanks
One of the reasons I integrated a full blown GNU/Linux on my devices, was the need to run full and automated backups. If you are looking into the possibility making a custom ROM, this might be a solution for you as well. I'm using BackuPC to run backups nightly, backing them up as any other GNU/Linux machine (using tar over ssh).
See the link in my signature for more information about this.
kuisma said:
One of the reasons I integrated a full blown GNU/Linux on my devices, was the need to run full and automated backups. If you are looking into the possibility making a custom ROM, this might be a solution for you as well. I'm using BackuPC to run backups nightly, backing them up as any other GNU/Linux machine (using tar over ssh).
See the link in my signature for more information about this.
Click to expand...
Click to collapse
Hi
Thanks for the reply, not too sure this would be the right option for us. I don't really need to take nightly backups, I just need to make a backup of a preconfigured image, and then put that image onto 10 other devices. Then I want to keep the original backup and have an easy way to restore it onto any devices which have been messed up. Sort of like image cloning for PCs, I want to prepare a base image, and then flash it over all the devices.
fro5tie said:
Hi
Thanks for the reply, not too sure this would be the right option for us. I don't really need to take nightly backups, I just need to make a backup of a preconfigured image, and then put that image onto 10 other devices. Then I want to keep the original backup and have an easy way to restore it onto any devices which have been messed up. Sort of like image cloning for PCs, I want to prepare a base image, and then flash it over all the devices.
Click to expand...
Click to collapse
Ok, I see. Compile the image to you likings (boot image and system partition), and then flash it using fastboot onto you devices.
Hi
Does anyone have any more thoughts on this?
I have experimented with Titanium Backup and this seems to work quite well. I have installed a ROM, and customised it e.g. installed the apps I need and configured the apps, wireless settings and home screens etc. Then I do a full apps + system backup in TB to my SD card.
Then the plan is, I can reflash the ROM onto the other device, install TB and then restore this backup. This saves my user state and wireless settings etc.
Only problems is when I flash the ROM, I have to go through all the initial set up again and also remove some preinstalled apps which I dont want. Any ways around this?
There must be something I'm missing. Why don't you install the device, walk through the setup, remove the bloatware you don't want and then dumps the disk partitions into images you flash the other devices with using fastboot? This way you'll get'em cloned, isn't it this you want..?
Of course there's still some tinkering needed once restored/cloned, such as giving them individual Google accounts etc, but you can easily fix this without re-running the setup wizard.
kuisma said:
There must be something I'm missing. Why don't you install the device, walk through the setup, remove the bloatware you don't want and then dumps the disk partitions into images you flash the other devices with using fastboot? This way you'll get'em cloned, isn't it this you want..?
Of course there's still some tinkering needed once restored/cloned, such as giving them individual Google accounts etc, but you can easily fix this without re-running the setup wizard.
Click to expand...
Click to collapse
Hi
Yes that's what I want to do! How would I go about dumping the disk into an image and then flashing?
fro5tie said:
Hi
Yes that's what I want to do! How would I go about dumping the disk into an image and then flashing?
Click to expand...
Click to collapse
There are several methods. Some boot loaders (such as nvflash for tegra based devices) can actually read back the disk partitions to a computer via the USB port. You can also on the tablet read the raw mtd device with busybox/dd. I assume you've unlocked the bootloader and gain root access to the device, since this is a requirement for flashing them as well. A third alternative is using busybox/tar, and then recreate the filesystem image using mkyaffs (or if ext3/ext4 even easier, just loopback mount an image on you linux maching to unpack the tar archive to). Once you got the images (system and userdata partitions), you flash the devices with "fastboot flash system system.img" and "fastboot flash userdata data.img". I don't believe you'll need to tamper with the other partitions.
kuisma said:
There are several methods. Some boot loaders (such as nvflash for tegra based devices) can actually read back the disk partitions to a computer via the USB port. You can also on the tablet read the raw mtd device with busybox/dd. I assume you've unlocked the bootloader and gain root access to the device, since this is a requirement for flashing them as well. A third alternative is using busybox/tar, and then recreate the filesystem image using mkyaffs (or if ext3/ext4 even easier, just loopback mount an image on you linux maching to unpack the tar archive to). Once you got the images (system and userdata partitions), you flash the devices with "fastboot flash system system.img" and "fastboot flash userdata data.img". I don't believe you'll need to tamper with the other partitions.
Click to expand...
Click to collapse
Hi
Thanks for the quick reply, much appreciated.
Unfortunately you've lost me a bit here!
Yes the device is rooted, I dont have a linux machine though.
Any chance you'd be able to provide some more specific instructions? The device is a chinese tablet from manufacturer Ainol, the model is a Novo 7 Elf 2. Unfortunately there isn't much discussion on these online so specific help is hard to find!
fro5tie said:
Any chance you'd be able to provide some more specific instructions? The device is a chinese tablet from manufacturer Ainol, the model is a Novo 7 Elf 2. Unfortunately there isn't much discussion on these online so specific help is hard to find!
Click to expand...
Click to collapse
I can provide you specific answers to specific questions, but I have no experience of the tablet in question, so you'll have to do some digging yourself first. Make sure it supports fastboot, investigate what the proprietary bootloader is capable of, see how/if you can obtain an original image etc.
One maybe easier solution, especially if you plan to restore the tablets on a regular basis, is to only make a new boot image to reflash the devices with. The only modification done is that you change the /init.rc script to mount /data and /system from the SDcard instead of from the internal nand disk device.
Once this is done, you'll power up and run the installation wizard and everything on your master tablet. Then power it down, and clone the SDcard. This SDcard now contains everything, so you'll simply restore a device by replacing its SDcard with a copy of this master card. I guess it's easier to clone a SDcard than reflashing several internal partitions. Easier to make the master as well - you don't need to dd or tar them, they are already in "image" format. If you can get hold of the original firmware, this should be quite easy without the need to preserving data from the device itself.
fro5tie said:
Any chance you'd be able to provide some more specific instructions?
Click to expand...
Click to collapse
Issue the commands "cat /proc/mtd" and "mount" on your device at command prompt (e.g. via "adb shell" or the "ConnectBot" terminal app). This shows you if the device allows you to copy the boot image from it. Paste in the output into this thread. If you believe the "clone the tablet via the SDcard" is a good solution for you, the process is in short terms something as below;
Copy the boot image to the sdcard:
# dd if=/dev/mtd/mtd2ro of=/mnt/sdcard/boot.img bs=2048 (device dependent of contents of /proc/mtd)
Remove the sdcard, insert into a computer, split the boot image info kernel + initramfs. Read http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images for instructions about how to work with the boot.img file. I really recommend a GNU/Linux environment for this.
Then edit /init.rc replacing the "mount yaffs2 [email protected] /system" with "mount ext3 /dev/block/mmcblk0p2 /system" for system and data (use p3 for data partition, the device name may be different on your tablet, see mount output).
Create an SDcard with three partitions: #1 vfat (standard), #2 and #3 ext3. Insert into you device and boot it up again.
# mount -t ext3 /dev/block/mmcblk0p2 /root
# cd /system
# tar cf - . | (cd /root ; tar xf - )
# umount /root
# mount -t ext3 /dev/block/mmcblk0p3 /root
# cd /data
# tar cf - . | (cd /root ; tar xf - )
# umount /root
This copies your partitions to the SDcard. Shutdown the tablet again.
Make a new boot.img using the instructions in the link above, using the edited init.rc script.
Now you can non-destrutive give this a try.
Place you tablet in fastboot mode (often vol-up (or vol-down) during power on).
$ fastboot devices
This vill verify the tablet is in fastboot mode. It should be listed. Then:
$ fastboot boot boot.img
Note here, only BOOT the tablet, do NOT use the "flash" keyword. This in case of the image isn't working, you'll just have to restart you tablet, and no harm's done.
Look around. Do a "mount" command. Everything works? Mount shows /data and /system from sdcard? Perfect. Now you can reflash it. Shutdown and flash:
$ fastboot flash boot boot.img
Now the device will use /data and /system from the SDcard every time. Customize your device, and then clone your SDcard and try it in tablet #2 you'll booting with your new boot.img and the cloned SDcard. Verify that #tablet #2 is a perfect clone of tablet #1. It is? Now you can flash the boot,img into all your tablets.
--------------------
But don't forget, there may be other solutions as well, maybe more suitable. This you'll have to investigate yourself.
And the usual disclaimer - you can probably not follow above by the letter. There sure is some obstacle you'll have to overcome, something non-standard, etc.
Also keep the original boot.img file for safekeeping in the case you want to restore the device's boot image some day.
Wow! Thanks for the info! This is really helpful, I need to set aside a bit of time to work through this and have a look. Thanks again its really appreciated, I'll be back with info once I've had chance to give it a go!
I certainly can't offer more detailed info than the fellow from Sweden who seems to really know his stuff...but what about making a nandroid backup of your fully configured reference tablet (I'm assuming all tablets are rooted). Ensure all your tabs have CWM recovery and copy your nandroid file to each one.
If any of your fleet get 'corrupted' you can simply restore the original, fully configured ROM.
In fact that sounds too obvious..likely I missed something about your scenario which precludes this option from consideration!
Good luck mate.
tweeny80 said:
I certainly can't offer more detailed info than the fellow from Sweden who seems to really know his stuff...but what about making a nandroid backup of your fully configured reference tablet (I'm assuming all tablets are rooted). Ensure all your tabs have CWM recovery and copy your nandroid file to each one.
If any of your fleet get 'corrupted' you can simply restore the original, fully configured ROM.
In fact that sounds too obvious..likely I missed something about your scenario which precludes this option from consideration!
Good luck mate.
Click to expand...
Click to collapse
Hi
Yes that was my first thought as well, tablets are rooted yes but there is no CWM for the tablet. Its an obscure Chinese branded tablet.
Unless there is another way to do nandroid backups?
hmm tricky situation. Catch 22 ! From what I know, your best bet is to backup all possible things through Titanium Backup given that you don't have the use of Nandroid backups. You can include wifi settings, messages etc but it's modular & not systemic.
I did a quick google search with no luck - time to upgrade your fleet dude :-0
Best of luck.
Hello,
I recently got a hand on Yuntab K107, ARM MT8752, Android 5.12 Bootloader unlocked. Everything worked fine until factory reset, after that Google play store and other gapps stopped working (play store checking info, then goes black and freezes for a while).
Tablet is rooted from factory by kingroot, I tried finding TWRP/CWM for this tablet to reflash gapps but I failed. I also tried Magic TWRP installer and MTK droid tools. Magic TWRP installer acts like it's working but no results. MTK droid tools refuses to find my device even if i tried every driver possible and cleared wrong drivers with USBDeview.
I also tried flashing gapps manually thru root explorer by unpacking gapps files and matching system file structure also no luck.
Then I backed up the stock recovery and tried flashing few custom TWRP's that some post suggested may work (you guessed it - it didn't work) It just hangs on the first booting screen then it surrenders after a while and reboots back into android.
Do you know about any TWRP/CWM that might work on this tablet or any other way to repair gapps if recovery is not necessary?
Thanks
I also rooted it with kingroot but havnt any custom recovery but i doing some experiment. Let se what it will result
I should be able to compile TWRP for you
I have one of these K107 tablets but it is running Android 7 and so far I have been unable to root it. Because you guys have root you should be able to download adbd Insecure by chainfire and follow this guide to Fetch the boot.img file by Extracting the boot.img directly from the device:
you will first have to determine the (sadly device-specific) path to the storage device where boot.img's content can be retrieved. I know two methods for this:
ls /dev/block/platform/*/by-name/ (where * covers yet another device-specific folder name, chances are it is the only directory below platform/), the exact name to search is also platform dependent but makes usual sense (some examples: boot, LNX (acronym for "Linux")). The files in this directory are actually symbolic links and some people bother to manually go to the target, but I recommend sticking with the higher level name based path which, while longer, remains less error prone. So you will end-up with a path like /dev/block/platform/sdhci-tegra.3/by-name/LNX.
On some (older?) devices, the right device could be found by investigating the output of cat /proc/mtd. If you see the device mtd2 associated to the "boot" label, then you will use the path /dev/mtd2.
Now:
From the phone's developer menu:
Enable debugging on your phone,
Allow root access to ADB (this step applies to phones running CynogenMod, other devices may require some potentially more complex procedure),
Connect it to your computer (and from there to the VM guest if you are running Android tools from within a virtual machine).
If this is not already done, I recommend to manually start the ADB server on the computer's side, this will allow you to directly validate the RSA key on device's side without affecting the behavior of the following ADB commands:
adb start-server
Then switch ADB in root mode:
adb root
Finally, you should be able to directly extract the boot.img file from the device using such command (the source and destination path and names are given as examples, adapt them to your needs and preferences):
adb pull /dev/block/platform/sdhci-tegra.3/by-name/LNX ./boot.img
The command will copy the whole partition, both used and free space, so don't be surprised that the resulting boot.img file will be larger than the original boot.img file coming with the stock ROM .zip file, the content itself remains similar.
Once the transfer is finished, disconnect the phone and don't forget to disable both debugging and root access from the developer menu.
Then upload the boot.img and I will build TWRP and test it on my tablet for you
Greetings all,
This is a fully should-have-had-more-coffee-before-attempting scenario, but hoping there's still a way I can get data back.
*Backstory*
Have a Pixel 2 XL. Decided to try out Android P beta through the opt-in. Used it for a while, decided there were too many bugs that affected my daily usage, opted-out of Beta. What I didn't realize was that after downgrading back to Android O, the phone would perform a factory wipe on the /userdata folder. There's a specific subfolder on that partition that I'm hoping I can do a data recovery on.
*The Story so Far*
After spending a day googling and coming up to multiple XDA posts & few blog entries about data recovery on android, I have done the following.
- gain root devices using Magisk to flash patched boot image
- found that the /userdata is located at /dev/block/sda13 symlinked from /dev/block/platform/soc/.../by-name/userdata
- see that the most probable way of getting files back is to pull the entire partition over as a raw file, then use TestDisk (or qPhotoRec) to try and perform a data recover on the file as you would a normal drive, since there are few, if any, tools that will run recovery directly on the device.
*The Problem*
The research led me to attempting to run the following command as a binary safe transfer of the partition.
Code:
adb exec-out "su -c 'cat /dev/block/sda13'" > userdata.raw
However when I run that, while it does start creating the userdata.raw file on my local machine, it gets to ~4gb, then the file just stops getting any larger and I've let it sit for over an hour. The command in adb never times out or returns to a prompt, it's like it just stops transferring the output from adb into the file. I know the size of the userdata partition is ~65gb from going into shell and looking at it.
I've also tried various chmod hacks of temp setting 777 on the file just to see if I can do an adb pull on it, however nothing I'ved tried so far yields anything other than a Permission Denied when I try that.
Does anyone have any ideas on how I can get a complete transfer of the userdata partition over to my local drive so I can run data recovery on it?
Hey all. Looking for some help with my userdata.img file. Here's the story:
I smashed my Galaxy S5 screen so it and the digitizer were not working. The phone was running Lineage OS and was encrypted with full disk encryption.
I booted into TWRP recovery and unlocked the disk using
Code:
adb twrp decrypt <password>
After this, I used dd to make an image of the block device which /data was mounted from (in my case it was /dev/block/mmcblk0p26). I dd'ed this to a file called userdata.img.
Since then I got a new S5, flashed TWRP and installed Lineage once again.
From here, what I've managed to do is dd the userdata.img file back onto the same block device which I dd'd it from.
After this I booted the phone and was taken to a page saying that the phone is encrypting. After a few minutes the phone reboots.
This boots the phone up fine, without asking to unlock the encryption. But quickly after this I start getting lots of errors including Process system is not responding and the phone and wifi causing crashes. Worst of all, after a few minutes the phone crashes and puts me at a screen which says "Phone is starting". During this time, the phone is still accessible by adb. I can also see in the time before this happens that all my apps and their content are still present.
The main reason I want to boot my phone again is to take a backup of one of my apps which contains lots of old and important messages which it is only possible to do from within the app's settings menu (due to encryption used in the app).
I can see a few ways I could do this:
1) Is there any way I can emulate the phone using the userdata.img file I took?
2) Is there any way I can modify any file the /data partition after dd'ing the userdata.img file so that encryption does not start on next boot. I think this might be causing the errors.
Hope someone can help with this!
Thanks