hacking a old discontinued android tv box(airtel internet tv, codename: ganesa) - Android Q&A, Help & Troubleshooting

A old thread about the same topic: https://forum.xda-developers.com/android/software-hacking/rooting-set-box-lge-sh960s-airtel-t3826462
So I have temp root using dirty-cow and have tried to edit default.prop to get adb by usb. didnt work, all are mounted read-only. tried remounting, fail, turning off SELinux, fail. heres the shell:
Code:
$ adb shell
[email protected]:/ $ /data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-a>
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (9804) and destination file size (17920) differ
[*] size 17920
[*] mmap 0xb6d64000
[*] currently 0xb6d64000=464c457f
[*] using /proc/self/mem method
[*] madvise = 0xb6d64000 17920
[*] madvise = 0 17449
[*] /proc/self/mem 10931200 610
[*] exploited 0 0xb6d64000=464c457f
[email protected]:/ $ /system/bin/run-as
uid /system/bin/run-as 2000
uid 0
0 u:r:runas:s0
context 0 u:r:shell:s0
[email protected]:/ # Hehehe
/system/bin/sh: Hehehe: not found
127|[email protected]:/ # which touch
/system/bin/touch
[email protected]:/ # touch Hi.txt
touch: 'Hi.txt': Read-only file system
1|[email protected]:/ # mount -o rw,remount /system
mount: Permission denied
255|[email protected]:/ # ls -ladZ sys
sys/ system/
255|[email protected]:/ # ls -ladZ system
drwxr-xr-x root root u:object_r:system_file:s0 system
[email protected]:/ # setenforce 0
setenforce: Couldn't set enforcing status to '0': Permission denied
1|[email protected]:/ # sestatus
/system/bin/sh: sestatus: not found
127|[email protected]:/ # cat
^C
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ # cat /etc/selinux/config
/system/bin/sh: cat: /etc/selinux/config: No such file or directory
1|[email protected]:/ # cd etc
[email protected]:/etc # ls
18p
NOTICE.html.gz
audio_effects.conf
audio_policy.conf
bluetooth
clatd.conf
dhcpcd
event-log-tags
fallback_fonts.xml
fonts.xml
gps.conf
hosts
media_codecs.xml
media_codecs_google_audio.xml
media_codecs_google_tv.xml
media_codecs_google_video.xml
media_codecs_performance.xml
media_profiles.xml
mkshrc
permissions
ppp
preloaded-classes
recovery-resource.dat
security
sysconfig
system_fonts.xml
wifi
[email protected]:/etc # touch lol
touch: 'lol': Read-only file system
1|[email protected]:/etc # mount -o rw,remount /
mount: Permission denied
255|[email protected]:/etc # su mount -o rw,remount /
/system/bin/sh: su: not found
127|[email protected]:/etc # sudo mount -o rw,remount /
/system/bin/sh: sudo: not found
127|[email protected]:/etc #
127|[email protected]:/etc #
so can I know why I am denied even tho I am root? Also can some-one guide me to write a blob extraction script? There is no fastboot.

as its a Android Marshmallow (6.0) device try to dump boot.img and flash modified magisk_patched.img on locked bootloader. Magisk has an option to by-pass dm-verity. this is confirmed method on some Mediatek devices, if you are lucky this will work
Code:
ls -d $(find /dev/block -name by-name)/*
cat /dev/block/.../by-name/boot > /sdcard/boot.img
if that works, adb pull the img, patch with Magisk Manager, make sure you have enabled both checkboxes for preserve encryption + keep AVB/dm-verity, push it back to device and try to flash
Code:
cat /sdcard/magisk_patched.img > /dev/block/.../by-name/boot
however, if the img is flashed and dm-verity is preventing from boot this is a permanently brick

FaIl
aIecxs said:
as its a Android Marshmallow (6.0) device try to dump boot.img and flash modified magisk_patched.img on locked bootloader. Magisk has an option to by-pass dm-verity. this is confirmed method on some Mediatek devices, if you are lucky this will work
Code:
ls -d $(find /dev/block -name by-name)/*
cat /dev/block/.../by-name/boot > /sdcard/boot.img
if that works, adb pull the img, patch with Magisk Manager, make sure you have enabled both checkboxes for preserve encryption + keep AVB/dm-verity, push it back to device and try to flash
Code:
cat /sdcard/magisk_patched.img > /dev/block/.../by-name/boot
however, if the img is flashed and dm-verity is preventing from boot this is a permanently brick
Click to expand...
Click to collapse
I dont have full root i guess: find: /dev/block: Permission denied

check /proc/partitions for two similar partitions with 10 or 16 MB one of these should be boot. try to dump the partition (for example on my device it's mmcblk0p7)
Code:
cat /proc/partitions
cat /dev/block/mmcblk0p7 > /sdcard/mmcblk0p7.img
if that fails try to disable selinux
Code:
echo 0 > /sys/fs/selinux/enforce
or
echo 0 > /data/local/tmp/enforce
mount -o bind /data/local/tmp/enforce /sys/fs/selinux/enforce
chmod 0644 /sys/fs/selinux/enforce
chown 0.0 /sys/fs/selinux/enforce
chcon u:object_r:selinuxfs:s0 /sys/fs/selinux/enforce

Can someone help with steps to root the device and backup current ROM

seniornoob58432 said:
A old thread about the same topic: https://forum.xda-developers.com/android/software-hacking/rooting-set-box-lge-sh960s-airtel-t3826462
So I have temp root using dirty-cow and have tried to edit default.prop to get adb by usb. didnt work, all are mounted read-only. tried remounting, fail, turning off SELinux, fail. heres the shell:
Code:
$ adb shell
[email protected]:/ $ /data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-a>
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (9804) and destination file size (17920) differ
[*] size 17920
[*] mmap 0xb6d64000
[*] currently 0xb6d64000=464c457f
[*] using /proc/self/mem method
[*] madvise = 0xb6d64000 17920
[*] madvise = 0 17449
[*] /proc/self/mem 10931200 610
[*] exploited 0 0xb6d64000=464c457f
[email protected]:/ $ /system/bin/run-as
uid /system/bin/run-as 2000
uid 0
0 u:r:runas:s0
context 0 u:r:shell:s0
[email protected]:/ # Hehehe
/system/bin/sh: Hehehe: not found
127|[email protected]:/ # which touch
/system/bin/touch
[email protected]:/ # touch Hi.txt
touch: 'Hi.txt': Read-only file system
1|[email protected]:/ # mount -o rw,remount /system
mount: Permission denied
255|[email protected]:/ # ls -ladZ sys
sys/ system/
255|[email protected]:/ # ls -ladZ system
drwxr-xr-x root root u:object_r:system_file:s0 system
[email protected]:/ # setenforce 0
setenforce: Couldn't set enforcing status to '0': Permission denied
1|[email protected]:/ # sestatus
/system/bin/sh: sestatus: not found
127|[email protected]:/ # cat
^C
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ #
130|[email protected]:/ # cat /etc/selinux/config
/system/bin/sh: cat: /etc/selinux/config: No such file or directory
1|[email protected]:/ # cd etc
[email protected]:/etc # ls
18p
NOTICE.html.gz
audio_effects.conf
audio_policy.conf
bluetooth
clatd.conf
dhcpcd
event-log-tags
fallback_fonts.xml
fonts.xml
gps.conf
hosts
media_codecs.xml
media_codecs_google_audio.xml
media_codecs_google_tv.xml
media_codecs_google_video.xml
media_codecs_performance.xml
media_profiles.xml
mkshrc
permissions
ppp
preloaded-classes
recovery-resource.dat
security
sysconfig
system_fonts.xml
wifi
[email protected]:/etc # touch lol
touch: 'lol': Read-only file system
1|[email protected]:/etc # mount -o rw,remount /
mount: Permission denied
255|[email protected]:/etc # su mount -o rw,remount /
/system/bin/sh: su: not found
127|[email protected]:/etc # sudo mount -o rw,remount /
/system/bin/sh: sudo: not found
127|[email protected]:/etc #
127|[email protected]:/etc #
so can I know why I am denied even tho I am root? Also can some-one guide me to write a blob extraction script? There is no fastboot.
Click to expand...
Click to collapse
Can you help me the steps you used to root via ditry cow?

aIecxs said:
check /proc/partitions for two similar partitions with 10 or 16 MB one of these should be boot. try to dump the partition (for example on my device it's mmcblk0p7)
Code:
cat /proc/partitions
cat /dev/block/mmcblk0p7 > /sdcard/mmcblk0p7.img
if that fails try to disable selinux
Code:
echo 0 > /sys/fs/selinux/enforce
or
echo 0 > /data/local/tmp/enforce
mount -o bind /data/local/tmp/enforce /sys/fs/selinux/enforce
chmod 0644 /sys/fs/selinux/enforce
chown 0.0 /sys/fs/selinux/enforce
chcon u:object_r:selinuxfs:s0 /sys/fs/selinux/enforce
Click to expand...
Click to collapse
How to disable selinux?

Related

xrecovery i wish it for my x10 mini pro

hi all xrecovery released by zdzihu !!!!!!!! Thank you
for now you must go here http://forum.xda-developers.com/showthread.php?p=9913723#post9913723
thanks for all who have testet and postet here
now for me here is closed
I would like to have xrecovery on my X10mini, so i tried to make some edits in that, but no success.
I already posted my finding to xrecovery X10 thread, so i post it here again:
For x10 mini, i think, there should be event1 instead of event2 i "chargemon" file
Tried with "getevent" in adb
I see then some feedback on the "Sony Ericsson" boot screen while i keep pressing "back"
When i stop pressing, then goes logo, then reboot and booting normally
I think "mtdblocks" are different from X10 - this is for x10 mini:
dev: size erasesize name
mtd0: 0ce00000 00020000 "system"
mtd1: 03200000 00020000 "cache"
mtd2: 00040000 00020000 "appslog"
mtd3: 0d3c0000 00020000 "userdata"
P.S. sorry for bad English
x10 big one
Code:
dev: size erasesize name
mtd0: 00440000 00020000 "appslog"
mtd1: 06f40000 00020000 "cache"
mtd2: 160a0000 00020000 "system"
mtd3: 1d100000 00020000 "userdata"
x10 mini
Code:
dev: size erasesize name
mtd0: 0ce00000 00020000 "system"
mtd1: 03200000 00020000 "cache"
mtd2: 00040000 00020000 "appslog"
mtd3: 0d3c0000 00020000 "userdata"
x10 mini pro
Code:
dev: size erasesize name
mtd0: 0ce00000 00020000 "system"
mtd1: 0d3c0000 00020000 "userdata"
mtd2: 03200000 00020000 "cache"
mtd3: 00040000 00020000 "appslog"
I have also tried several times to make it work on my mini (E10i) just by changing blocks, but no luck.
I always get an error ine this line:
mount -o rw -t yaffs2 /dev/block/mtdblock2 /data/local/tmp/xrecovery
Invalid argument.
Hope this works..
peetr_ said:
I would like to have xrecovery on my X10mini, so i tried to make some edits in that, but no success.
I already posted my finding to xrecovery X10 thread, so i post it here again:
For x10 mini, i think, there should be event1 instead of event2 i "chargemon" file
Tried with "getevent" in adb
I see then some feedback on the "Sony Ericsson" boot screen while i keep pressing "back"
When i stop pressing, then goes logo, then reboot and booting normally
I think "mtdblocks" are different from X10 - this is for x10 mini:
dev: size erasesize name
mtd0: 0ce00000 00020000 "system"
mtd1: 03200000 00020000 "cache"
mtd2: 00040000 00020000 "appslog"
mtd3: 0d3c0000 00020000 "userdata"
P.S. sorry for bad English
Click to expand...
Click to collapse
ok thanks here the output from getevent in adb
- from x10i big
C:\android-sdk\tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# getevent
getevent
add device 1: /dev/input/event5
name: "qwerty"
add device 2: /dev/input/event4
name: "8k_handset"
add device 3: /dev/input/event3
name: "compass"
add device 4: /dev/input/event2
name: "es209ra_keypad"
add device 5: /dev/input/event0
name: "es209ra_keypad"
add device 6: /dev/input/event1
name: "es209ra_touch"
-fom x10 mini pro
C:\android-sdk\tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# getevent
getevent
add device 1: /dev/input/event4
name: "systemconnector"
add device 2: /dev/input/event3
name: "qwerty"
add device 3: /dev/input/event2
name: "cy8ctma300_ser"
add device 4: /dev/input/event1
name: "compass"
add device 5: /dev/input/event0
name: "mimmi_keypad"
Hmm, ok see the difference in the chargemon
cat /dev/input/event2 > /dev/keycheck& -think here to change the event2 to event0 for pressing keypad
i will try it and report later
Zocker Tko said:
ok thanks here the output from getevent in adb
- from x10i big
C:\android-sdk\tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# getevent
getevent
add device 1: /dev/input/event5
name: "qwerty"
add device 2: /dev/input/event4
name: "8k_handset"
add device 3: /dev/input/event3
name: "compass"
add device 4: /dev/input/event2
name: "es209ra_keypad"
add device 5: /dev/input/event0
name: "es209ra_keypad"
add device 6: /dev/input/event1
name: "es209ra_touch"
-fom x10 mini pro
C:\android-sdk\tools>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# getevent
getevent
add device 1: /dev/input/event4
name: "systemconnector"
add device 2: /dev/input/event3
name: "qwerty"
add device 3: /dev/input/event2
name: "cy8ctma300_ser"
add device 4: /dev/input/event1
name: "compass"
add device 5: /dev/input/event0
name: "mimmi_keypad"
Hmm, ok see the difference in the chargemon
cat /dev/input/event2 > /dev/keycheck& -think here to change the event2 to event0 for pressing keypad
i will try it and report later
Click to expand...
Click to collapse
Just in case you could also check mini:
Code:
C:\Users\The Fear Itself>adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# getevent
getevent
add device 1: /dev/input/event4
name: "systemconnector"
add device 2: /dev/input/event3
name: "qwerty"
add device 3: /dev/input/event2
name: "compass"
add device 4: /dev/input/event1
name: "robyn_keypad"
add device 5: /dev/input/event0
name: "synaptics-rmi-touchscreen"
Thank you in advance
ok first !!!warning for the x10 mini users!!!, because i think you cant remove your akku, is it right? Maybe you can brick your phone!
My Tests are only for the X10 mini pro
ok why
i have changed in the chargemon for my x10 mini pro!!!
cat /dev/input/event0 > /dev/keycheck&
so i installed the xrecovery make a reboot and press the menu back button after SE logo screen. In the first mom i thougt i have bricked my phone, because it was still on the SE logo, so i removed my akku and started again my phone and it booted normally
but the good thing is, my phone will do something, think it will go into the xrecovery but it cant.
sry for bad english
Zocker Tko said:
ok first !!!warning for the x10 mini users!!!, because i think you cant remove your akku, is it right? Maybe you can brick your phone!
My Tests are only for the X10 mini pro
ok why
i have changed in the chargemon for my x10 mini pro!!!
cat /dev/input/event0 > /dev/keycheck&
so i installed the xrecovery make a reboot and press the menu back button after SE logo screen. In the first mom i thougt i have bricked my phone, because it was still on the SE logo, so i removed my akku and started again my phone and it booted normally
but the good thing is, my phone will do something, think it will go into the xrecovery but it cant.
sry for bad english
Click to expand...
Click to collapse
You dont need to remove the battery in mini, i've got "other" methods.
But anyway, if you find the proper sequence of events, please post it here so maybe we could do something for mini too!
So i tried almost everything with mtdblocks and still no success.
I figured out, there is no way to mount mtdblock2 into anything else then /system or /data or /cache and maybe something else, but not into the folder with xrecovery.tar only
My last try was copying busybox and chargemon to /system/bin,
made the directory /xrecovery, copied there xrecovery.tar, changed some permissions,
mounted mtdblock0 to /xrecovery (also changed in chargemon),now there was system folder together with xrecovery.tar then restarted.
On back pressing, something happend - i think xrecovery.tar decompressed, then was logo, restart, normal boot (longer), but phone partially bricked (i think busybox) - malfunctions - bad root, no app2sd, bad adb shell, cannot reinstall busybox - but maybe all of this because of bad permissons.
Then with ESfile explorer i saw the /xrecovery folder disappeared.
I don´t have no idea what else to try. And i am tired of this now
P.S. Sorry for bad English
peetr_ said:
So i tried almost everything with mtdblocks and still no success.
I figured out, there is no way to mount mtdblock2 into anything else then /system or /data or /cache and maybe something else, but not into the folder with xrecovery.tar only
My last try was copying busybox and chargemon to /system/bin,
made the directory /xrecovery, copied there xrecovery.tar, changed some permissions,
mounted mtdblock0 to /xrecovery (also changed in chargemon),now there was system folder together with xrecovery.tar then restarted.
On back pressing, something happend - i think xrecovery.tar decompressed, then was logo, restart, normal boot (longer), but phone partially bricked (i think busybox) - malfunctions - bad root, no app2sd, bad adb shell, cannot reinstall busybox - but maybe all of this because of bad permissons.
Then with ESfile explorer i saw the /xrecovery folder disappeared.
I don´t have no idea what else to try. And i am tired of this now
P.S. Sorry for bad English
Click to expand...
Click to collapse
hi, bad to hear
maybe you can root your phone again with the z4root app from market or search here for it, i believe z4root installs busybox too with right permissions
or you can try with rootexplorer, when it works to set the right permissions for busybox for group r-,w-,e- and others r-,e-
hope it will help you
have you tried using the "init" files from your phone i.e replace the ones in xrecovery.tar ??
the only other thing I'd suggest is copying the busybox scripts in sbin to the /system/bin folder. from what I can see the above script just places the busybox file into system/bin. It doesn't actually unpack it.
Contrarian said:
have you tried using the "init" files from your phone i.e replace the ones in xrecovery.tar ??
the only other thing I'd suggest is copying the busybox scripts in sbin to the /system/bin folder. from what I can see the above script just places the busybox file into system/bin. It doesn't actually unpack it.
Click to expand...
Click to collapse
thanks, hope i understand you right
i have look into the xrecovery.tar
i saw the default.prop and the init and init.rc, hmm think i can change the "inits" with the from my phone, i will try it.
hmm, and about busybox, yes busybox goes to sytem/bin folder and is working.
check with busyboxinstaller it is v.1.15.3, or what did you mean with actually unpack it?
edit: ok changed the "inits" but no luck
another thing, test for mounting with adb
on my x10i big (xrecovery work)
-#mount -o rw -t yaffs2 /dev/block/mtdblock0 /data/local/tmp/xrecovery --works
on my x10i pro
-#mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount: Invalid argument
Zocker Tko said:
thanks, hope i understand you right
i have look into the xrecovery.tar
i saw the default.prop and the init and init.rc, hmm think i can change the "inits" with the from my phone, i will try it.
hmm, and about busybox, yes busybox goes to sytem/bin folder and is working.
check with busyboxinstaller it is v.1.15.3, or what did you mean with actually unpack it?
edit: ok changed the "inits" but no luck
another thing, test for mounting with adb
on my x10i big (xrecovery work)
-#mount -o rw -t yaffs2 /dev/block/mtdblock0 /data/local/tmp/xrecovery --works
on my x10i pro
-#mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount: Invalid argument
Click to expand...
Click to collapse
if you mount system
/data gets mounted to...
weird
changed inits here events and mtdblocks
no succes
i hangs on boot when i press buttons
i did the root explorer methode g script methode and adb shell methode
ok at first thanks for helping and testing
ok what have we done
-changed the mtdblocks to the right paths in the chargemon and xrecovery.sh
-changed the event in the chargemon for pressing the menu back button
-changed the "inits" in the xrecovery.tar with our owns from phone
ok all these changes, i think are korrekt.
but i believe this is the point why we cant get it to work, because we cant mount the mtdblock for "appslog".
on my x10i pro
-#mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount: Invalid argument
on the mini the same with mtdblock2
on my x10i (big) i can mount it
so any ideas for mounting the mtdblock for "appslog" in an other way/command?
Zocker Tko said:
on my x10i pro
-#mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount -o rw -t yaffs2 /dev/block/mtdblock3 /data/local/tmp/xrecovery
mount: Invalid argument
on the mini the same with mtdblock2
on my x10i (big) i can mount it
so any ideas for mounting the mtdblock for "appslog" in an other way/command?
Click to expand...
Click to collapse
I believe in it. In my opinion is the key.
That's defintely where the error occurs. For some reason it won't recognize the mount point when booting.
Just an observation I've made - you can't write to /dev directory (partition). can you see if it's possible on the X10. Can you even chmod 777 this.
Sorry about the long post but us x10 mini/pro owners need to use more bandwidth on this site anyhow. This is from init.rc if anyone can see an attack point.
on pre-init
# /sbin/fotainit is part of fota. If the system is running a fota upgrade, then fota will
# reboot the system when finished.
exec /sbin/fotainit
on init
sysclktz 0
loglevel 3
# start master reset
exec /sbin/mr
# Check if flash was aborted.
exec /sbin/checkabortedflash
# setup the global environment
export PATH /sbin:/system/sbin:/system/bin:/system/xbin
export LD_LIBRARY_PATH /system/lib
export ANDROID_BOOTLOGO 1
export ANDROID_ROOT /system
export ANDROID_ASSETS /system/app
export ANDROID_DATA /data
export EXTERNAL_STORAGE /sdcard
export BOOTCLASSPATH /system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar
# Backward compatibility
symlink /system/etc /etc
symlink /sys/kernel/debug /d
# create mountpoints and mount tmpfs on sqlite_stmt_journals
mkdir /sdcard 0000 system system
mkdir /system
mkdir /data 0771 system system
mkdir /cache 0770 system cache
mkdir /config 0500 root root
mkdir /sqlite_stmt_journals 01777 root root
mount tmpfs tmpfs /sqlite_stmt_journals size=4m
mount rootfs rootfs / ro remount
write /proc/sys/kernel/panic_on_oops 1
write /proc/sys/kernel/hung_task_timeout_secs 0
write /proc/cpu/alignment 4
write /proc/sys/kernel/sched_latency_ns 10000000
write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
write /proc/sys/kernel/sched_compat_yield 1
write /proc/sys/kernel/sched_child_runs_first 0
# Create cgroup mount points for process groups
mkdir /dev/cpuctl
mount cgroup none /dev/cpuctl cpu
chown sytem system /dev/cpuctl
chown system system /dev/cpuctl/tasks
chmod 0777 /dev/cpuctl/tasks
write /dev/cpuctl/cpu.shares 1024
mkdir /dev/cpuctl/fg_boost
chown system system /dev/cpuctl/fg_boost/tasks
chmod 0777 /dev/cpuctl/fg_boost/tasks
write /dev/cpuctl/fg_boost/cpu.shares 1024
mkdir /dev/cpuctl/bg_non_interactive
chown system system /dev/cpuctl/bg_non_interactive/tasks
chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
# 5.0 %
write /dev/cpuctl/bg_non_interactive/cpu.shares 52
# mount mtd partitions
# Mount /system rw first to give the filesystem a chance to save a checkpoint
mount yaffs2 [email protected] /system
mount yaffs2 [email protected] /system ro remount
# We chown/chmod /data again so because mount is run as root + defaults
mount yaffs2 [email protected] /data nosuid nodev
chown system system /data
chmod 0771 /data
# Divert into charge-only mode if started by the charger.
# Chargemon will simply exit if the system was started normally.
exec /system/bin/chargemon
# Create dump dir and collect dumps.
# Do this before we mount cache so eventually we can use cache for
# storing dumps on platforms which do not have a dedicated dump partition.
mkdir /data/dontpanic
chown root log /data/dontpanic
chmod 0750 /data/dontpanic
# Collect apanic data, free resources and re-arm trigger
copy /proc/apanic_console /data/dontpanic/apanic_console
chown root log /data/dontpanic/apanic_console
chmod 0640 /data/dontpanic/apanic_console
copy /proc/apanic_threads /data/dontpanic/apanic_threads
chown root log /data/dontpanic/apanic_threads
chmod 0640 /data/dontpanic/apanic_threads
write /proc/apanic_console 1
# Same reason as /data above
mount yaffs2 [email protected] /cache nosuid nodev
chown system cache /cache
chmod 0770 /cache
# This may have been created by the recovery system with odd permissions
chown system system /cache/recovery
chmod 0770 /cache/recovery
#change permissions on vmallocinfo so we can grab it from bugreports
chown root log /proc/vmallocinfo
chmod 0440 /proc/vmallocinfo
# create basic filesystem structure
mkdir /data/misc 01771 system misc
mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
mkdir /data/misc/keystore 0700 keystore keystore
mkdir /data/misc/vpn 0770 system system
mkdir /data/misc/vpn/profiles 0770 system system
# give system access to wpa_supplicant.conf for backup and restore
mkdir /data/misc/wifi 0770 wifi wifi
chmod 0770 /data/misc/wifi
chmod 0660 /data/misc/wifi/wpa_supplicant.conf
mkdir /data/local 0771 shell shell
mkdir /data/local/tmp 0771 shell shell
mkdir /data/data 0771 system system
mkdir /data/app-private 0771 system system
mkdir /data/app 0771 system system
mkdir /data/property 0700 root root
# create dalvik-cache and double-check the perms
mkdir /data/dalvik-cache 0771 system system
chown system system /data/dalvik-cache
chmod 0771 /data/dalvik-cache
# create the lost+found directories, so as to enforce our permissions
mkdir /data/lost+found 0770
mkdir /cache/lost+found 0770
# double check the perms, in case lost+found already exists, and set owner
chown root root /data/lost+found
chmod 0770 /data/lost+found
chown root root /cache/lost+found
chmod 0770 /cache/lost+found
# SEMC: Discretix DRM change start
mkdir /data/DxDrm 0777
mkdir /data/DxDrm/fuse
# SEMC: Discretix DRM change end
on boot
exec /system/bin/verify_odex
# basic network init
ifup lo
hostname localhost
domainname localdomain
# set RLIMIT_NICE to allow priorities from 19 to -20
setrlimit 13 40 40
# Define the oom_adj values for the classes of processes that can be
# killed by the kernel. These are used in ActivityManagerService.
setprop ro.FOREGROUND_APP_ADJ 0
setprop ro.VISIBLE_APP_ADJ 1
setprop ro.SECONDARY_SERVER_ADJ 2
setprop ro.BACKUP_APP_ADJ 2
setprop ro.HOME_APP_ADJ 4
setprop ro.HIDDEN_APP_MIN_ADJ 7
setprop ro.CONTENT_PROVIDER_ADJ 14
setprop ro.EMPTY_APP_ADJ 15
# Define the memory thresholds at which the above process classes will
# be killed. These numbers are in pages (4k).
setprop ro.FOREGROUND_APP_MEM 1536
setprop ro.VISIBLE_APP_MEM 2048
setprop ro.SECONDARY_SERVER_MEM 4096
setprop ro.BACKUP_APP_MEM 4096
setprop ro.HOME_APP_MEM 4096
setprop ro.HIDDEN_APP_MEM 5120
setprop ro.CONTENT_PROVIDER_MEM 5632
setprop ro.EMPTY_APP_MEM 15360
# Write value must be consistent with the above properties.
# Note that the driver only supports 6 slots, so we have HOME_APP at the
# same memory level as services.
write /sys/module/lowmemorykiller/parameters/adj 0,1,2,7,14,15
write /proc/sys/vm/overcommit_memory 1
write /proc/sys/vm/min_free_order_shift 4
write /sys/module/lowmemorykiller/parameters/minfree 1536,2048,4096,5120,5632,15360
# Set init its forked children's oom_adj.
write /proc/1/oom_adj -16
# Tweak background writeout
write /proc/sys/vm/dirty_expire_centisecs 200
write /proc/sys/vm/dirty_background_ratio 5
# Permissions for System Server and daemons.
chown radio system /sys/android_power/state
chown radio system /sys/android_power/request_state
chown radio system /sys/android_power/acquire_full_wake_lock
chown radio system /sys/android_power/acquire_partial_wake_lock
chown radio system /sys/android_power/release_wake_lock
chown radio system /sys/power/state
chown radio system /sys/power/wake_lock
chown radio system /sys/power/wake_unlock
chmod 0660 /sys/power/state
chmod 0660 /sys/power/wake_lock
chmod 0660 /sys/power/wake_unlock
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/class/leds/keyboard-backlight/brightness
chown system system /sys/class/leds/lcd-backlight/brightness
chown system system /sys/class/leds/button-backlight/brightness
chown system system /sys/class/leds/jogball-backlight/brightness
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/module/sco/parameters/disable_esco
chown system system /sys/kernel/ipv4/tcp_wmem_min
chown system system /sys/kernel/ipv4/tcp_wmem_def
chown system system /sys/kernel/ipv4/tcp_wmem_max
chown system system /sys/kernel/ipv4/tcp_rmem_min
chown system system /sys/kernel/ipv4/tcp_rmem_def
chown system system /sys/kernel/ipv4/tcp_rmem_max
chown root radio /proc/cmdline
# Define TCP buffer sizes for various networks
# ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.wifi 4095,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.umts 4094,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.edge 4093,26280,35040,4096,16384,35040
setprop net.tcp.buffersize.gprs 4092,8760,11680,4096,8760,11680
class_start default
## Daemon processes to be run by init.
##
service console /system/bin/sh
console
# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
disabled
# adbd on at boot in emulator
on property:ro.kernel.qemu=1
start adbd
on propertyersist.service.adb.enable=1
start adbd
on propertyersist.service.adb.enable=0
stop adbd
service servicemanager /system/bin/servicemanager
user system
critical
onrestart restart zygote
onrestart restart media
service vold /system/bin/vold
socket vold stream 0660 root mount
service nexus /system/bin/nexus
socket nexus stream 0660 root system
disabled
#service mountd /system/bin/mountd
# socket mountd stream 0660 root mount
service debuggerd /system/bin/debuggerd
service ril-daemon /system/bin/rild
socket rild stream 660 root radio
socket rild-debug stream 660 radio system
user root
group radio cache inet misc audio system
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
socket zygote stream 666
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart media
service media /system/bin/mediaserver
user root
group system audio camera graphics inet net_bt net_bt_admin
service bootsound /system/bin/playmp3
user media
group audio
oneshot
service bootanim /system/bin/bootanimation
user graphics
group graphics
disabled
oneshot
service dbus /system/bin/dbus-daemon --system --nofork
socket dbus stream 660 bluetooth bluetooth
user bluetooth
group bluetooth net_bt_admin
service bluetoothd /system/bin/bluetoothd -n
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
# init.rc does not yet support applying capabilities, so run as root and
# let bluetoothd drop uid to bluetooth with the right linux capabilities
group bluetooth net_bt_admin misc
disabled
service hfag /system/bin/sdptool add --channel=10 HFAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service hsag /system/bin/sdptool add --channel=11 HSAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service opush /system/bin/sdptool add --channel=12 OPUSH
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service pbap /system/bin/sdptool add --channel=19 PBAP
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service installd /system/bin/installd
socket installd stream 600 system system
service flash_recovery /system/etc/install-recovery.sh
oneshot
# SEMC: Discretix DRM change start
service dx_drm_server /system/bin/DxDrmServerIpc -f -o allow_other /data/DxDrm/fuse
service drmbackup /system/bin/drmdbbackup
user system
oneshot
# SEMC: Discretix DRM change end
service racoon /system/bin/racoon
socket racoon stream 600 system system
# racoon will setuid to vpn after getting necessary resources.
group net_admin
disabled
oneshot
service mtpd /system/bin/mtpd
socket mtpd stream 600 system system
user vpn
group vpn net_admin net_raw
disabled
oneshot
service keystore /system/bin/keystore /data/misc/keystore
user keystore
group keystore
socket keystore stream 666
service dumpstate /system/bin/dumpstate -s
socket dumpstate stream 0660 shell log
disabled
oneshot
# Set the startup flag to boot complete, run on property change
service setssflagbc /system/bin/startupflag bootcomplete
user root
oneshot
disabled
on property:dev.bootcomplete=1
start setssflagbc
Contrarian said:
That's defintely where the error occurs. For some reason it won't recognize the mount point when booting.
Just an observation I've made - you can't write to /dev directory (partition). can you see if it's possible on the X10. Can you even chmod 777 this.
Click to expand...
Click to collapse
hi, thanks how can i do that?
and to change the init.rc in Xrecovery.tar with our own from phone, think that will not work, because thy are different. You see the post of init.rc from Contrarian
and this is the init.rc from xrecovery.tar
on init
export PATH /sbin
export ANDROID_ROOT /system
export ANDROID_DATA /data
export EXTERNAL_STORAGE /sdcard
on boot
ifup lo
hostname localhost
domainname localdomain
class_start default
service recovery /sbin/recovery
service adbd /sbin/adbd recovery
what about the init from our phone and in xrecovery.tar, its too much for me when i opend in notepad++, to see any differences. I will post later the init.rc from my x10i (Big),so we can see evtl. differences.
ok here are my init.rc from my x10i (big) at first view i saw no differences.
on pre-init
# /sbin/fotainit is part of fota. If the system is running a fota upgrade, then fota will
# reboot the system when finished.
exec /sbin/fotainit
on init
sysclktz 0
loglevel 3
# start master reset
exec /sbin/mr
# Check if flash was aborted.
exec /sbin/checkabortedflash
# setup the global environment
export PATH /sbin:/system/sbin:/system/bin:/system/xbin
export LD_LIBRARY_PATH /system/lib
export ANDROID_BOOTLOGO 1
export ANDROID_ROOT /system
export ANDROID_ASSETS /system/app
export ANDROID_DATA /data
export EXTERNAL_STORAGE /sdcard
export BOOTCLASSPATH /system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar
# Backward compatibility
symlink /system/etc /etc
symlink /sys/kernel/debug /d
# create mountpoints and mount tmpfs on sqlite_stmt_journals
mkdir /sdcard 0000 system system
mkdir /system
mkdir /data 0771 system system
mkdir /cache 0770 system cache
mkdir /config 0500 root root
mkdir /sqlite_stmt_journals 01777 root root
mount tmpfs tmpfs /sqlite_stmt_journals size=4m
mount rootfs rootfs / ro remount
write /proc/sys/kernel/panic_on_oops 1
write /proc/sys/kernel/hung_task_timeout_secs 0
write /proc/cpu/alignment 4
write /proc/sys/kernel/sched_latency_ns 10000000
write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
write /proc/sys/kernel/sched_compat_yield 1
write /proc/sys/kernel/sched_child_runs_first 0
# Create cgroup mount points for process groups
mkdir /dev/cpuctl
mount cgroup none /dev/cpuctl cpu
chown system system /dev/cpuctl
chown system system /dev/cpuctl/tasks
chmod 0777 /dev/cpuctl/tasks
write /dev/cpuctl/cpu.shares 1024
mkdir /dev/cpuctl/fg_boost
chown system system /dev/cpuctl/fg_boost/tasks
chmod 0777 /dev/cpuctl/fg_boost/tasks
write /dev/cpuctl/fg_boost/cpu.shares 1024
mkdir /dev/cpuctl/bg_non_interactive
chown system system /dev/cpuctl/bg_non_interactive/tasks
chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
# 5.0 %
write /dev/cpuctl/bg_non_interactive/cpu.shares 52
# mount mtd partitions
# Mount /system rw first to give the filesystem a chance to save a checkpoint
mount yaffs2 [email protected] /system
mount yaffs2 [email protected] /system ro remount
# We chown/chmod /data again so because mount is run as root + defaults
mount yaffs2 [email protected] /data nosuid nodev
chown system system /data
chmod 0771 /data
# Divert into charge-only mode if started by the charger.
# Chargemon will simply exit if the system was started normally.
exec /system/bin/chargemon
# Create dump dir and collect dumps.
# Do this before we mount cache so eventually we can use cache for
# storing dumps on platforms which do not have a dedicated dump partition.
mkdir /data/dontpanic
chown root log /data/dontpanic
chmod 0750 /data/dontpanic
# Collect apanic data, free resources and re-arm trigger
copy /proc/apanic_console /data/dontpanic/apanic_console
chown root log /data/dontpanic/apanic_console
chmod 0640 /data/dontpanic/apanic_console
copy /proc/apanic_threads /data/dontpanic/apanic_threads
chown root log /data/dontpanic/apanic_threads
chmod 0640 /data/dontpanic/apanic_threads
write /proc/apanic_console 1
# Collect ramconsole data
copy /proc/last_kmsg /data/dontpanic/last_kmsg
chown root log /data/dontpanic/last_kmsg
chmod 0640 /data/dontpanic/last_kmsg
# Same reason as /data above
mount yaffs2 [email protected] /cache nosuid nodev
chown system cache /cache
chmod 0770 /cache
# This may have been created by the recovery system with odd permissions
chown system system /cache/recovery
chmod 0770 /cache/recovery
#change permissions on vmallocinfo so we can grab it from bugreports
chown root log /proc/vmallocinfo
chmod 0440 /proc/vmallocinfo
# create basic filesystem structure
mkdir /data/misc 01771 system misc
mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
mkdir /data/misc/keystore 0700 keystore keystore
mkdir /data/misc/vpn 0770 system system
mkdir /data/misc/vpn/profiles 0770 system system
mkdir /data/misc/dhcp 0770 dhcp dhcp
mkdir /data/misc/wifi 0770 wifi wifi
mkdir /data/misc/wifi/sockets 0770 wifi wifi
mkdir /data/system 0775 system system
mkdir /data/system/wpa_supplicant 0770 wifi wifi
# give system access to wpa_supplicant.conf for backup and restore
chmod 0770 /data/misc/wifi
chmod 0660 /data/misc/wifi/wpa_supplicant.conf
chown wifi wifi /data/misc/wifi/wpa_supplicant.conf
mkdir /data/local 0771 shell shell
mkdir /data/local/tmp 0771 shell shell
mkdir /data/data 0771 system system
mkdir /data/app-private 0771 system system
mkdir /data/app 0771 system system
mkdir /data/property 0700 root root
mkdir /data/radio 0770 radio radio
# create dalvik-cache and double-check the perms
mkdir /data/dalvik-cache 0771 system system
chown system system /data/dalvik-cache
chmod 0771 /data/dalvik-cache
# create the lost+found directories, so as to enforce our permissions
mkdir /data/lost+found 0770
mkdir /cache/lost+found 0770
# double check the perms, in case lost+found already exists, and set owner
chown root root /data/lost+found
chmod 0770 /data/lost+found
chown root root /cache/lost+found
chmod 0770 /cache/lost+found
# In Device Diagnostics (IDD)
mkdir /data/idd 0755 idd idd
mkdir /data/semc-checkin 0773 system system
mkdir /data/semc-checkin/int 0773 system system
mkdir /data/tombstones 0755 system system
mkdir /data/crashsms 0777 system system
mkdir /data/crashsms/crashes 0777 system system
# SEMC: Discretix DRM change start
mkdir /data/DxDrm 0777
mkdir /data/DxDrm/fuse
# SEMC: Discretix DRM change end
# Semc Discretix change start
service drmbackup /system/bin/drmdbbackup
user system
oneshot
# Semc Discretix change end
on boot
exec /system/bin/verify_odex
# basic network init
ifup lo
hostname localhost
domainname localdomain
# set RLIMIT_NICE to allow priorities from 19 to -20
setrlimit 13 40 40
# Define the oom_adj values for the classes of processes that can be
# killed by the kernel. These are used in ActivityManagerService.
setprop ro.FOREGROUND_APP_ADJ 0
setprop ro.VISIBLE_APP_ADJ 1
setprop ro.SECONDARY_SERVER_ADJ 2
setprop ro.BACKUP_APP_ADJ 2
setprop ro.HOME_APP_ADJ 4
setprop ro.HIDDEN_APP_MIN_ADJ 7
setprop ro.CONTENT_PROVIDER_ADJ 14
setprop ro.EMPTY_APP_ADJ 15
# Define the memory thresholds at which the above process classes will
# be killed. These numbers are in pages (4k).
setprop ro.FOREGROUND_APP_MEM 1536
setprop ro.VISIBLE_APP_MEM 2048
setprop ro.SECONDARY_SERVER_MEM 4096
setprop ro.BACKUP_APP_MEM 4096
setprop ro.HOME_APP_MEM 4096
setprop ro.HIDDEN_APP_MEM 5120
setprop ro.CONTENT_PROVIDER_MEM 5120
setprop ro.EMPTY_APP_MEM 23040
# Define the resolution for OHD Camera Application
setprop ro.media.enc.hprof.vid.width 320
setprop ro.media.enc.hprof.vid.height 240
setprop ro.media.enc.lprof.vid.width 320
setprop ro.media.enc.lprof.vid.height 240
# Write value must be consistent with the above properties.
# Note that the driver only supports 6 slots, so we have HOME_APP at the
# same memory level as services.
write /sys/module/lowmemorykiller/parameters/adj 0,1,2,7,14,15
write /proc/sys/vm/overcommit_memory 1
write /proc/sys/vm/min_free_order_shift 4
write /sys/module/lowmemorykiller/parameters/minfree 1536,2048,4096,5120,5120,23040
# Set init its forked children's oom_adj.
write /proc/1/oom_adj -16
# Tweak background writeout
write /proc/sys/vm/dirty_expire_centisecs 200
write /proc/sys/vm/dirty_background_ratio 5
# Adjust socket buffer to enlarge TCP receive window for high bandwidth
write /proc/sys/net/ipv4/tcp_adv_win_scale 1
# Permissions for System Server and daemons.
chown radio system /sys/android_power/state
chown radio system /sys/android_power/request_state
chown radio system /sys/android_power/acquire_full_wake_lock
chown radio system /sys/android_power/acquire_partial_wake_lock
chown radio system /sys/android_power/release_wake_lock
chown radio system /sys/power/state
chown radio system /sys/power/wake_lock
chown radio system /sys/power/wake_unlock
chmod 0660 /sys/power/state
chmod 0660 /sys/power/wake_lock
chmod 0660 /sys/power/wake_unlock
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/class/leds/keyboard-backlight/brightness
chown system system /sys/class/leds/lcd-backlight/brightness
chown system system /sys/class/leds/button-backlight/brightness
chown system system /sys/class/leds/jogball-backlight/brightness
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/module/sco/parameters/disable_esco
chown system system /sys/kernel/ipv4/tcp_wmem_min
chown system system /sys/kernel/ipv4/tcp_wmem_def
chown system system /sys/kernel/ipv4/tcp_wmem_max
chown system system /sys/kernel/ipv4/tcp_rmem_min
chown system system /sys/kernel/ipv4/tcp_rmem_def
chown system system /sys/kernel/ipv4/tcp_rmem_max
# USB Function framework
# chown system system /sys/devices/platform/msm_hsusb_periphera/composition
# USB Gadget framework
chown system system /sys/devices/platform/android_usb/composition
chown root radio /proc/cmdline
chmod 0666 /dev/msm_snd
# SEMC:LC: Have LC added following items?
mkdir /dev/socket/sensors 0777 system system
chmod 0666 /sys/devices/platform/msm_sdcc.2/polling
# SEMC:LC: end
#write access to sysrq-trigger
chown root system /proc/sysrq-trigger
chmod 0220 /proc/sysrq-trigger
# Define TCP buffer sizes for various networks
# ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.wifi 4095,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.umts 4094,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.edge 4093,26280,35040,4096,16384,35040
setprop net.tcp.buffersize.gprs 4092,8760,11680,4096,8760,11680
class_start default
## Daemon processes to be run by init.
##
service console /system/bin/sh
console
# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
disabled
# adbd on at boot in emulator
on property:ro.kernel.qemu=1
start adbd
on propertyersist.service.adb.enable=1
start adbd
on propertyersist.service.adb.enable=0
stop adbd
# Enabled port-bridge for 'eng' builds
service esheep-sh /system/bin/sh /init.esheep.sh
user root
oneshot
service servicemanager /system/bin/servicemanager
user system
critical
onrestart restart zygote
onrestart restart media
service vold /system/bin/vold
socket vold stream 0660 root mount
service nexus /system/bin/nexus
socket nexus stream 0660 root system
disabled
#service mountd /system/bin/mountd
# socket mountd stream 0660 root mount
service debuggerd /system/bin/debuggerd
service ril-daemon /system/bin/rild
socket rild stream 660 root radio
socket rild-debug stream 660 radio system
user root
group radio cache inet misc audio system
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
socket zygote stream 666
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart media
service media /system/bin/mediaserver
user root
group system audio camera graphics inet net_bt net_bt_admin
service bootsound /system/bin/playmp3
user media
group audio
oneshot
service bootanim /system/bin/bootanimation
user graphics
group graphics
disabled
oneshot
service dbus /system/bin/dbus-daemon --system --nofork
socket dbus stream 660 bluetooth bluetooth
user bluetooth
group bluetooth net_bt_admin
service bluetoothd /system/bin/bluetoothd -n
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
# init.rc does not yet support applying capabilities, so run as root and
# let bluetoothd drop uid to bluetooth with the right linux capabilities
group bluetooth net_bt_admin misc
disabled
service hfag /system/bin/sdptool add --channel=10 HFAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service hsag /system/bin/sdptool add --channel=11 HSAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service opush /system/bin/sdptool add --channel=12 OPUSH
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service pbap /system/bin/sdptool add --channel=19 PBAP
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service installd /system/bin/installd
socket installd stream 600 system system
service flash_recovery /system/etc/install-recovery.sh
oneshot
# SEMC: Discretix DRM change start
service dx_drm_server /system/bin/DxDrmServerIpc -f -o allow_other /data/DxDrm/fuse
# SEMC: Discretix DRM change end
service racoon /system/bin/racoon
socket racoon stream 600 system system
# racoon will setuid to vpn after getting necessary resources.
group net_admin
disabled
oneshot
service mtpd /system/bin/mtpd
socket mtpd stream 600 system system
user vpn
group vpn net_admin net_raw
disabled
oneshot
service keystore /system/bin/keystore /data/misc/keystore
user keystore
group keystore
socket keystore stream 666
service dumpstate /system/bin/dumpstate -s
socket dumpstate stream 0660 shell log
disabled
oneshot
# Set the startup flag to boot complete, run on property change
service setssflagbc /system/bin/startupflag bootcomplete
user root
oneshot
disabled
service iddd /system/bin/iddd
user idd
group idd log
on property:dev.bootcomplete=1
start setssflagbc
# SEMC: DRM key activation
service suntrolkac /system/bin/suntrolkac
user root
oneshot
# SEMC: DRM key activation

[Q][I9100] logo.jpg protected while mount -o remount,rw /dev/block/stl6 /mnt/.lfs

I am a newbye and don't have right to post into http://forum.xda-developers.com/showthread.php?t=1136699
I want to delete logo.jpg into /dev/block/stl6 and I am unable to delete it...
Here what I did:
Code:
[alpha] adb shell
$ su
# mount -o remount,rw /dev/block/stl6 /mnt/.lfs
# cd /mnt/.lfs
# cp /mnt/sdcard/logo.jpg /mnt/.lfs/logo.jpg
cp: can't create '/mnt/.lfs/logo.jpg': File exists
# cp /mnt/sdcard/logo.jpg /mnt/.lfs/logo0.jpg
# ls -l logo0.jpg
-rwxrwxrwx 1 root root 75573 Jan 1 1970 /mnt/.lfs/logo0.jpg
# cp logo0.jpg logo.jpg
cp: can't create 'logo.jpg': File exists
# cp -f logo0.jpg logo.jpg
cp: can't create 'logo.jpg': File exists
# rm logo.jpg
rm: can't remove 'logo.jpg': Operation not permitted
# rm -f logo.jpg
rm: can't remove 'logo.jpg': Operation not permitted
# cp /mnt/sdcard/logo.jpg /mnt/.lfs/logo1.jpg
# ls -l /mnt/.lfs/logo1.jpg
-rwxrwxrwx 1 root root 75573 Oct 26 22:14 /mnt/.lfs/logo1.jpg
# rm logo1.jpg
rm: can't remove 'logo1.jpg': Operation not permitted
# exit
$ exit
[alpha] echo "what's the **** ?"
what's the **** ?
[alpha] adb shell
$ su
# mount -o remount,rw /dev/block/stl6 /mnt/.lfs
# cd /mnt/.lfs
# chattr -i logo.jpg
chattr: reading flags on logo.jpg: Not a typewriter
# rm logo.jpg
rm: can't remove 'logo.jpg': Operation not permitted
# exit
$ exit
[alpha] echo "what's the **** ???"
what's the **** ???
Any help would be appreciated.
That file system is not well supported as such we don't currently have the ability to replace or modify any existing files. Only create new ones.
If you did the all steps in that thread you would end up with a empty partition so that you can create the logo.jpg. If you want to change the logo later you have to re-flash the empty partition again.
shadowofdarkness said:
That file system is not well supported as such we don't currently have the ability to replace or modify any existing files. Only create new ones.
If you did the all steps in that thread you would end up with a empty partition so that you can create the logo.jpg. If you want to change the logo later you have to re-flash the empty partition again.
Click to expand...
Click to collapse
So strange to read that: now I know and I thank you for information.
I will read the tuto but I think about about some adb commands...
As I found:
- in /init.rc "mount j4fs /dev/block/mmcblk0p4 /mnt/.lfs"
- in /sbin/ "mke2fs mkfifo mkfs.ext2 mknod mkswap mktemp mkyaffs2image "
- in /system/xbin/ "mkdosfs mke2fs mkfifo mkfs.ext2 mkfs.minix mkfs.reiser mkfs.vfat mknod mkpasswd mkswap mktemp"
- /sbin/parted
I wondering if it is possible to :
case A.
- umount /dev/block/mmcblk0p4
- mkfs.ext2 /dev/block/mmcblk0p4
- modify /init.rc to have "mount ext2 /dev/block/mmcblk0p4 /mnt/.lfs" in a way I have to find out : maybe a 'sed -i "s/mount j4fs \/dev\/block\/mmcblk0p4/mount ext2 \/dev\/block\/mmcblk0p4/"' into the image I have to reflash?
- a backup could be 'dd if=/dev/block/stl6 of=/sdcard/param.lfs bs=4096'
- and do what I want without the overwritting problem on /mnt/.lfs?
case B.
- umount /dev/block/mmcblk0p4
- do a "dd if=/dev/null of=/dev/block/mmcblk0p4 bs=4096 count=2048" as param.lfs size is 8388608
- mount j4fs -w /dev/block/mmcblk0p4 /mnt/.lfs
- copy what I backuped with the good logo.jpg
- and have the good logo.jpg on this nasty j4fs filesystem
Maybe a C case could be to use gparted ?
As it is my first step as an android newbye, any advice would be appreciated...

[Q] rm / chown -> "Operation not permitted" on my rooted device

HI,
I can't delete "/system/etc/install-recovery.sh" on my rooted device.
Code:
[email protected]:/ $ su
su
[email protected]:/ # mount -o remount,rw /system
mount -o remount,rw /system
[email protected]:/ # cd /system/etc
cd /system/etc
[email protected]:/system/etc # rm install-recovery.sh
rm install-recovery.sh
rm failed for install-recovery.sh, Operation not permitted
255|[email protected]:/system/etc # chown shell install-recovery.sh
chown shell install-recovery.sh
Unable to chown install-recovery.sh: Operation not permitted
10|[email protected]:/system/etc #
Anyone knows why ?
(My device is Redmi 1 by the way)
Thanks.
Slash

Broken cache (17mb or less) fix script (samsung I9000)

Hi all,
I've been looking around to solve my /cache problem of it being only 17MB.
Found a temporary fix but that needed to be implemented or executed every boot up.
And since I am to lazy or stupid to remember that every boot I search for another solution ...
Combined a script from someone else with some stuf I found somewhere else...
Descriptions are in the code....
This code works on my samsung I9000 with Full Advance Rom final 6.0.1:good::good:
Code:
#!/system/bin/sh
# stratosk - 27/07/2011
# Modified by Dutchpatriot 26/06/2017
# Works on Full advance Rom with I9000
# Change params
# Check your partitions name /cache
# Need to be root via ADB or root via device
# with the command : mount
# This fix is only needed when /cache has arround 17mb!!!
# run this command as root in ADB shell as root
# To be able to execute this you need to change file system from read-only to rewritable
# as root exec this command: mount -o rw,remount /system
# Paste this text in a file called cachefix.sh
# command : vi cachefix.sh
# If you like me, and arn't that good with vi
# I will attach a cachefix.sh to this post as
# cachefix.txt rename it to cachefix.sh
# give the cachefix.sh the right permissions
# chmod 777 cachefix.sh
# Run this once!
# sh /LOCATION_OF_SCRIPT/cachefix.sh
# or
# ./LOCATION_OF_SCRIPT/cachefix.sh
#
# when ran once the /data/local
# and all went well has a
# cache.img file
# This is now mounted as /cache
# command to see or verfy: mount
# /cache is now as big as you made it under
# CREATE A FILE 500mb
# Every time you reboot the 99Tcachefix script in /etc/init.d/ will be executed!
#
# adb root
# adb shell
# remount / and /system writable
mount -o rw,remount /
mount -o rw,remount /system
# EDIT the right old cache partitio /dev/block/mtdblock3 to fit yours!!!
# Makes script in /etc/init.d named 99Tcachefix so it will be executed on boot
echo "#!/system/bin/sh \n umount /dev/block/mtdblock3 \n losetup /dev/block/loop7 /data/local/cache.img \n mount -t ext4 /dev/block/loop7 /cache \n chown system.cache /cache \n chmod 770 /cache" >> /system/etc/init.d/99Tcachefix
# assign the right permissions to be executed as root but not edited
#There is a very neat trick in every Linux which will allow you to do so. It is called the SetUI bit.
#Keep in mind that you will need to have the permissions locked down tight in this file for this to be secure.
#Make the file owned by root and group root:
#sudo chown root.root <my script>
#Now set the SetUID bit, make it executable for all and writable only by root:
#sudo chmod 4755 <my script>
# Keep in mind if this script will allow any input or editing of files, this will also be done as root.
# source https://askubuntu.com/questions/167847/how-to-run-bash-script-as-root-with-no-password
# Leave as is!
chown root.root /system/etc/init.d/99Tcachefix
chmod 4755 /system/etc/init.d/99Tcachefix
# Check if dir is there else Create Dir LEAVE AS IS
if [ -d "/data/local" ]; then
echo "directory /data/local already there!"
echo "Showing dir /data/local"
sleep 3
ls "/data/local"
sleep 2
else
# create dir
mkdir /data/local
echo "Directory /data/local created"
fi
# create a file 500mb (change if you like count=XXXXXX)
dd if=/dev/zero of=/data/local/cache.img bs=1024 count=500000
# create ext4 filesystem LEAVE AS IS!!
mke2fs -F -T ext4 /data/local/cache.img
# my cache partition is called /dev/block/mtdblock3 see whats yours is called and
# change this to yours!!!
umount /dev/block/mtdblock3
# mount LEAVE AS IS!!!
losetup /dev/block/loop7 /data/local/cache.img
mount -t ext4 /dev/block/loop7 /cache
chown system.cache /cache
chmod 770 /cache
# Remount / and /system as read-only again
mount -o ro,remount /system
mount -o ro,remount /
sleep 3
echo "Now after reboot this (cache) partition will be back!"
sleep 10
echo "All done, if there where no errors you can now delete cachefix.sh"
echo "If your new /cache partition is mounted with the given size than all is good"
echo "These are the configurations now"
# exec df command to show config now
df
sleep 10
exit
With this your /cache will be changed to whatever values you give in the code...
For safety remove the cachefix.sh afterwards...
Added cachefix.txt, download and rename to cachefix.sh
Greets,
Dutchpatriot

Problem with secure settings

Hi all,
im using a rooted samsung galaxy note 3 with lollipop
i have installed tasker to automate a few things ...
in addition i have installed the app "secure settings" to open the lookscreen
because of the message from secure settings in "System+ Module", that "Root access was not detected. The System+ module requires root access to function, i try the following:
Found on https://www.reddit.com/comments/3uf5bn ....
---------------------------------
adb shell
su
mount -o remount,rw /system
touch /sbin/su /system/bin/su /system/xbin/su
mount -o remount,ro /system
exit
reboot
---------------------------
im using Android Debug Bridge version 1.0.41
Version 28.0.3-5475833 <-- i think that's the latest version
C:\adb>adb shell
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /system
[email protected]:/ # touch /sbin/su /system/bin/su /system/xbin/su
touch: usage: touch [-alm] [-t YYYYMMDD[.hhmmss]] <file>
1|[email protected]:/ # exit
1|[email protected]:/ $ exit
C:\adb>adb shell
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /system
[email protected]:/ # touch /sbin/su /system/bin/su /system/xbin/su <-- don't work
touch: usage: touch [-alm] [-t YYYYMMDD[.hhmmss]] <file>
1|[email protected]:/ # exit
1|[email protected]:/ $ exit
C:\adb>adb shell
[email protected]:/ $ su
[email protected]:/ # touch /sbin/su <-- tried single step
255|[email protected]:/ # < -- is that the problem?
----------------------------
please help me ....
thanks Mikel

Categories

Resources