The tablet is a Billow X103, nearly 2 years old with Android 7.0 1Gb Ram 16G memory and 32G SD. There are no TWRP/CWM recovery boot .imgs and none of the regular one click root apps work. Processor is a Mediatek 8320 I believe.
The bootloader is unlocked. There is no update for it so no OTA or stock firmware files. Where can I obtain a payload.bin for this tablet. Is it possible to extract it from the device with Python/Payload dumper etc so that I can use it to obtain the Boot.img in order to root it with Magisk. I have contacted the manufacturer, they did not reply. Any ideas anyone?
Android 7 OTAs don't contain payload.bin
Thanks, OK I did not know that, So How do I go about getting root on this device, with only the device available, ie there is no stock firmware apart from that on the device itself?
I should have asked how can I extract the boot.img from the device ?
boissano said:
I should have asked how can I extract the boot.img from the device ?
Click to expand...
Click to collapse
You for example run a DOS script like this
Code:
@echo off & setlocal ENABLEDELAYEDEXPANSION
set "adb=C:\ADB-FASTBOOT-R30\adb.exe"
set "dev=" & set "name=" & set /a success=0
!adb! devices
!adb! shell "mkdir -p -m755 /data/local/boot"
for /f "tokens=1,4 delims= " %%a in ('!adb shell "cat proc/mtd"') do (
set "dev=%%a" & set "name=%%b"
echo !name! | findstr /C:"boot" >nul
if !errorlevel! EQU 0 (
set "dev=!dev::=!""
!adb! shell "dd if=/dev/mtd/!dev! of=/data/local/boot/boot.img bs=4096"
set /a success=1
goto :done_backup_boot
)
)
:done_backup_boot
if !success! EQU 1 (
!adb! pull /data/local/boot/boot.img C:\boot.img
)
endlocal & exit
FYI: Haven't tested it. It's on you to fix bugs if given.
boissano said:
I should have asked how can I extract the boot.img from the device ?
Click to expand...
Click to collapse
By using SP Flash tool...
boissano said:
So How do I go about getting root on this device ...?
Click to expand...
Click to collapse
Android is rooted when the SU-binary is present in Android OS. Because in your case you can't access Android's /system partition ( means: mount /system partition as RW), you have to put SU-binary into non-system-critical /data partition - for example into /data/superuser , and afterwards give this binary the necessary rights via chmod and chown commands.
CXZa said:
By using SP Flash tool...
Click to expand...
Click to collapse
Without root which is the final aim, SP Flash tool does not access the firmware, it is only OK to flash a cooked boot.img
jwoegerbauer said:
You for example run a DOS script like this
Code:
@echo off & setlocal ENABLEDELAYEDEXPANSION
set "adb=C:\ADB-FASTBOOT-R30\adb.exe"
set "dev=" & set "name=" & set /a success=0
!adb! devices
!adb! shell "mkdir -p -m755 /data/local/boot"
for /f "tokens=1,4 delims= " %%a in ('!adb shell "cat proc/mtd"') do (
set "dev=%%a" & set "name=%%b"
echo !name! | findstr /C:"boot" >nul
if !errorlevel! EQU 0 (
set "dev=!dev::=!""
!adb! shell "dd if=/dev/mtd/!dev! of=/data/local/boot/boot.img bs=4096"
set /a success=1
goto :done_backup_boot
)
)
:done_backup_boot
if !success! EQU 1 (
!adb! pull /data/local/boot/boot.img C:\boot.img
)
endlocal & exit
FYI: Haven't tested it. It's on you to fix bugs if given.
Click to expand...
Click to collapse
Something along these lines looks to be the best way, it looks daunting but not much worse than rooting an HTC 10 years ago. Next time I will get wifey an easily rootable tablet with 4GB of ram to start. She plays games designed by **** developers where ram requirements increase with every update currently at 95% of total.
jwoegerbauer said:
Android is rooted when the SU-binary is present in Android OS. Because in your case you can't access Android's /system partition ( means: mount /system partition as RW), you have to put SU-binary into non-system-critical /data partition - for example into /data/superuser , and afterwards give this binary the necessary rights via chmod and chown commands.
Click to expand...
Click to collapse
Thanks ,will check this out too!
boissano said:
Without root which is the final aim, SP Flash tool does not access the firmware, it is only OK to flash a cooked boot.img
Click to expand...
Click to collapse
Okay, have fun!
Related
hello, hope i post it in the right place, if not, please move it.
i bought the phone coolpad 7236, based on snapdragon 200 msm8212 chip.
i found out that i got the chinese version of the firmware, so the seller gave me a link for the multi language firmware: http://www.mediafire.com/folder/7g49chcyb7gdy/ROM_for_Coolpad_7236
there are some files there, offical flashtool, quallcom flash files (to be used with the flashtool), drivers, and an archive containg a script that should replace the entire system folder via adb.
i translated the .cmd file and here it is:
@echo off
%~d0
CD "%~d0%~p0"
set id=7236
taskkill /F /IM tadb.exe >nul 2>nul
taskkill /F /IM bdadb.exe >nul 2>nul
taskkill /F /IM sjk_daemon.exe >nul 2>nul
taskkill /F /IM romaster_daemon.exe >nul 2>nul
taskkill /F /IM AndroidInterface.exe >nul 2>nul
taskkill /F /IM adb.exe >nul 2>nul
adb.exe kill-server >nul 2>nul
echo .
echo The ROM for models£º%id%
echo .
echo Flash this ROM, please brush into the bottom of the package custom 7236
echo.
echo Brushing the bottom package, the phone is switched, the screen splash screen again after connecting USB
echo.
echo Note: During the brush machine, the phone screen is blank, do not operate the phone buttons until the phone automatically restart
echo.
title %id% ¹ú¼Ê°æ By Kyle
pause
:flash
color 1B
cls
adb -d push boot.img /tmp/.
echo Begin transmission system file, about 300M, wait. . . .
adb -d push system7236.tar.gz /tmp/.
adb -d shell mount /data
adb -d shell mount /system
adb -d shell rm -r /system/*
adb -d shell rm -r /data/*
adb -d shell tar -zxvf /tmp/system7236.tar.gz -C /
adb -d shell dd if=/tmp/boot.img of=/dev/block/platform/msm_sdcc.1/by-name/boot
adb -d shell reboot
echo Finished, the phone will automatically enter recovery, the recovery interface, you can directly select reboot system now
pause
exit
Click to expand...
Click to collapse
as you can see, it deletes the system folder and should put the contents of the archive as new system folder.
unfortunally this only made the first step, as soon as the script deleted the system folder, the phone stopped working.
i tried using adb shell to do it manually, but it didn't complied to simple commands as "dir" "ls" "cp" "pull" "push", the phone became a brick.
then i tried using the flashtool, the company says that in order to use it you should dial
#*20110606#
Click to expand...
Click to collapse
and then choose test mode or something in order to allow the flashtool put it in download mode, obiously i can't do that now. i figured that when i hold the power button the screen turns white, making the phone discoverable as quallcom hs-usb diagnostics or something like this, it doesn't work with the flashtool (it searches for qdloader device).
then i tried dumping system.img from other coolpad 7236 device, i used this tutorial: http://forum.xda-developers.com/showthread.php?t=2450045 and i got 800MB file, the fastboot refused to get it, then i used this fastboot: http://forum.xda-developers.com/moto-x/moto-x-qa/solved-img-vzw-xt1060-to-flash-fastboot-t2493814
waited for 30 minutes, but it was stuck on sending.
also, i couldn't get the fastboot to work, i tried to flash the boot.img that the seller gave me in the link, but the fastboot got stuck in "writing", the fastboot also ignored simple commands such as reboot.
the stocvk recovery is not helping either because i don't have signed update.zip for it.
is there anything else to do beside sending it back to china?
and, is there any GOOD WAY to replace the contents of the system folder (in case i get another chinese like this) without bricking the phone?
Figured it out, nevermind
kkffiirr said:
Figured it out, nevermind
Click to expand...
Click to collapse
Hi,
I'm new to all this. And I am having a Coolpad 7236 currently. It is also in Chinese and I do not know how to read that....Sigh...
Good phone with some flaws.
I'm interested in rooting it and flushing out the software to install a new one but I do not know how.
Can help?
Thanks
iandroid.co.il/forum/viewtopic.php?f=190&t=179082&hilit=7236
Use Google translate
Hi. I have the same problem. I am not able to follow the guide from the link you provided. Can you please put in simple terms how I can flash the multi language firmware in my coolpad. If yes, that would be a great help for me
Thanks.
wow, very old post...
here are the steps:
1. install adb drivers, get adb software, set the phone to enable usb debugging and root it with root genius.
2. download the system dump from: https://mega.co.nz/#!9JRTmYyD!MgZR1CITlfUMFM5FUtBlkVCg7u97djHYg8rkmudRbtc
3. download the kernel dump from: https://mega.co.nz/#!EBIH1TRZ!hfesnz3FkZXnaEHw6T5sA1DH98spXAGY594j-0HU-Hw
4. copy the files from 2 and 3 to the phone storage root.
5. start adb shell session by:
Code:
adb -d shell
6. enter the following commands:
Code:
su
dd if=/mnt/sdcard/boot.img of=/dev/block/platform/msm_sdcc.1/by-name/boot
dd if=/mnt/sdcard/system.img of=/dev/block/platform/msm_sdcc.1/by-name/system
note: the first dd shouldn't take much time, while the second might be long, be patient and wait for it to finish, and then reboot
Thanks, kkffirr... The link for Kernel dump is not working.... It says the file has been removed! ?
The Imperium said:
Thanks, kkffirr... The link for Kernel dump is not working.... It says the file has been removed!
Click to expand...
Click to collapse
try this
https://mega.nz/#!IZpwgIJA!hfesnz3FkZXnaEHw6T5sA1DH98spXAGY594j-0HU-Hw
I have been trying for more than a week now, but not able to root the phone... This is so annoying...
The Imperium said:
I have been trying for more than a week now, but not able to root the phone... This is so annoying...
Click to expand...
Click to collapse
it worked for me with root genius back then
Hi I am having a problem trying to flash my g610f/DD phone. I tried removing the FRP lock with FRP Hijacker by Hagard and it totally messed up the phone where its boot looping. I've read and tried almost all the solutions on this website for that model phone. When I flashed the stock rom it is saying Re-Partition Failed in odin. Also on the phone it says in red "secure check fail". The current binary displays as Custom and the FRP lock is on.
I need some help since I tried a lot of solutions and none of them work.
Thanks,
A phone's NAND flash ( storage memory ) is divided into partitions, each of them is of fixed size. When you try to flash a ROM what contains partitions that exceed the size of already existing partitions then you will run in such a trouble. To get rid off of this you would have to completely clean / format the existing partitions ( except the EFS partition !!! ) before re-flashing a ROM. This can be achieved with ADB / Fastboot commands.
Generic Batch-file Example ( untested ! ) :
Code:
@echo off & setlocal
set "ROM=C:\stockrom.zip"
if NOT exist "%ROM%" ( goto :end )
set "PIT=%TEMP%\pit.txt"
adb devices
adb shell "cd /"
adb shell "ls -d" > %PIT%
if NOT exist "%PIT%" ( goto :end )
adb reboot bootloader
fastboot devices
for /f "tokens=9 delims= " %%a in ( "%PIT%" ) do (
if NOT [%%a]==[] (
echo %%a | findstr /I /C:"/EFS" > nul
if %ERRORLEVEL% NEQ 0 (
set "pn=%%a"
set "pn=%pn:~1,0%"
fastboot format %pn%
)
)
)
del /F /Q "%PIT%"
fastboot flashall %ROM%
fastboot reboot
:end
endlocal & @echo on & exit
Read also here: https://technastic.com/odin-nand-erase-samsung/
Hi Thanks for your reply. I can boot into the recovery mode now but when I tried to run the adb commands it gives me an error closed. Also try to install a stock rom it says custom rom block FRP lock.
itwayne said:
Hi Thanks for your reply. I can boot into the recovery mode now but when I tried to run the adb commands it gives me an error closed. Also try to install a stock rom it says custom rom block FRP lock.
Click to expand...
Click to collapse
In Recovery Mode you can't run most of ADB subcommands as for example "adb shell", this because Android OS isn't running.
jwoegerbauer said:
In Recovery Mode you can't run most of ADB subcommands as for example "adb shell", this because Android OS isn't running.
Click to expand...
Click to collapse
How can I format the partitions to get a stock rom on then if adb cant do it.
Thanks,
Hello,
I received a BV9900E a few days ago. it's a nice Rugged phone.
But... I would like to put a custom launcher with custom widgets and custom animated wallpaper. But if I shut down the phone, I lost all my settings, the widgets and wallpaper. All must be reinstalled, and/or reconfigured.
I try to use whiteliste, did several tries and try various solutions found on the net but nothing helped ... I lose everything on each restart. Only stock widgets work.
I think I have found the beginning of an explanation here: https://bbs.blackview.hk/viewtopic.php?t=532725
But for edit Build.prop, i have to root the phone.
I am not an expert for rooting phone and try like on the Blackview topic, but i don't find BV9900E/Android 10 specific stock ROM for now.
I only can find the BV9900E_S1_200929 rom and not the BV9900E_EEA_S900AA.
I try to root with the BV9900E_S1_200929 rom, Adb, magisk, but nothing happend.
Any solution is welcome !
Thank you in advance for your answers.
Modèle : BV9900E
System : Android 10
Num serie : BV9900EQEE002138
Build : BV9900E_EEA_S900AA_V1.0_20201103V04
Rooting a phone's Android doesn't require to re-flash phone's Stock ROM. A phone's Android is rooted when su binary got installed on it.
To prepare rooting you have to
Unlock phone's bootloader
Disable Android's DM-Verity & AVB locks
Flash a Custom Recovery like TWRP what is at 100% suitable to phone
To root Android you have to
Flash by means of this Custom Recovery SuperSU.zip or similar
Ok, thank's jwoegerbauer...
Unlock bootloader is ok. but impossible To disable DM-Verity and there is no TWRP for the BV9900E yet...
And i don't know, it's very strange because i can't mount system when i am on recovery mode for example.
Blackview has only one answer: It's not possible to do that.
I am not an expert with the handling of phones but I am not quite bad with technology either. I already had 2 phones that I ended up rooting but there, I do not succeed. I may have to wait a bit because this phone is brand new, the solutions may come from someone more expert than me.
Disabling Android's SElinux, DM-Verity & AVB is achieved by running specific ADB / Fastboot commands.
Mouning /system RW requires Android is rooted
Compile TWRP at your own if none matching available.
Ok, that sounds simple to you.
But when I search the internet there are thousands of answers that go in all directions ... It is not so easy for the uninitiated like me.
Do you have some links for illustrate what you say?
To disable the mentioned 3 locks you may consider to run a Windows CMD script like this draft
Code:
@echo off & setlocal ENABLEDELAYEDEXPANSION
pushd "%~dp0"
set "adb=C:\ADB-FASTBOOT-R30\adb.exe"
set "fastboot=C:\ADB-FASTBOOT-R30\fastboot.exe"
set "su=C:\SU-Binary\su"
set "tmpdir=%TEMP%\%RANDOM%%RANDOM%"
set "su_binary_location=/data/local/superuser"
set "su_tmp=!su_binary_location!/su"
set /a cnt=0"
mkdir "!tmpdir!" 2>nul
if NOT exist "!tmpdir!\" ( goto :end )
set "dev=" & set "name="
!adb! devices
!adb! shell stop
call :install_temporary_root
!adb! shell "mkdir -p -m0666 /data/local/vbmeta"
for /f "tokens=1,4 delims= " %%a in ('!adb shell "!su_tmp! -c 'cat proc/mtd'"') do (
set "dev=%%a" & set "name=%%b"
echo !name! | findstr /C:"vbmeta" >nul
if !errorlevel! EQU 0 (
set "dev=!dev::=!""
!adb! shell "!su_tmp! -c 'dd if=/dev/mtd/!dev! of=/data/local/vbmeta/!name! bs=4096'"
!adb! pull /data/local/vbmeta/!name! "!tmpdir!"
set /a cnt+=1
)
)
!adb! shell "rm -Rf /data/local/vbmeta"
if !cnt! EQU 0 ( goto :end )
!adb! shell "!su_tmp! -c 'setenforce 0'"
!adb! reboot fastboot
!fastboot! devices
for /f "tokens=*" %%a in ('dir /B "!tmpdir!"') do (
set "vbmeta_img=%%a"
if NOT [!vbmeta_img!]==[] (
set "vbmeta_partition=!vbmeta_img:.img=!"
!fastboot! --disable-verity --disable-verification flash !vbmeta_partition! "!tmpdir!\!vbmeta_img!"
)
)
!fastboot! reboot
:end
rmdir /S /Q "!tmpdir!" 2>nul
!adb! shell start
popd
endlocal & exit
rem
:install_temporary_root
!adb! shell "mkdir -p -m0755 !su_binary_location!" 2>nul >nul
!adb! push !su! !su_binary_location! > nul
!adb! shell "chmod 0777 !su_tmp!"
!adb! shell "chown 0.2000 !su_tmp!"
goto :EOF
where you of course have to adjust the pathname of ADB & Fastboot executables and the SU-binary
FYI: Have not tested such a script, it's on you to fix bugs if any given.
With regards to compile a TWRP at your own:
look inside here.
I also bought a bv9900e and have managed to unlock the bootloader, as guided here : LINK
Can i get some help with compiling TWRP ?
Good day, I would like to know how to go about rooting a logic L61 smartphone seeing as it isn't listed in rooted devices section. Is it possible that the phone gets bricked while being rooted, does it support root? I just want to be able to increase my display colour saturation, which is very dull for some reason, but I need root access. Please and thank you for your help.
You may consider to temporarily root phone's Anndroid what has no side-effects.
jwoegerbauer said:
You may consider to temporarily root phone's Anndroid what has no side-effects.
Click to expand...
Click to collapse
How do I temporarily root?
Ricardo Paddyfoot said:
How do I temporarily root?
Click to expand...
Click to collapse
To give you an idea how this can get achieved here excerpt of one of my Windows CMD-scripts
Code:
set and_arch=64 & set retval=
for /f %%a in ('!adb! shell "getprop ro.product.cpu.abilist64"') do ( set retval=%%a )
if [!retval!]==[] ( set and_arch=32 )
set su_binary=%CD%\SU-Binaries\ARM\!and_arch!\su
if not exist "!su_binary!" ( echo !su_binary! not found & goto :end )
!adb! shell "mkdir -p -m644 !data_partition!/local/tmp"
!adb! shell "mkdir -p -m644 !data_partition!/local/etc"
!adb! push !su_binary! !data_parttion!/local/tmp/ >nul
!adb! shell "chmod 0755 !data_partitio!/local/tmp/su"
As you may realize the SU-binary is simply copied into Android, can then be used immediately.
Thanks for the help, I was trying to use magisk to root my phone (android 10) however my device is not supported for twrp so I can't install it, Is there any other way to root android 10? Also I don't have a PC and have zero coding knowledge. I would be so happy if I could just use the sa2ration app.
Would also love to do this but need guidance. I have a PC. So I just need pointing in the right direction...
Hi Friends
One of my friend has accidently reset his "one plus 7T" phone to factory mode .
I want to recover photos and videos from this phone.
As phone memory is hidden by manufacturers and is not accessible easily , I want some help to make image of phones internal memory.
I have read that I will have to do following so that memory will be accessible -----
1) Root the phone.
2) Enable USB debugging in developer options.
Is anything else is also required besides this ? Is there any highly reliable software / hardware ( not like cellebrite which is exorbitanatly costly) which can root the phone irrespective of make /android version ?
I am fearful that if something goes wrong in the process phone may get damaged permanantly .
How safe it is to root the phone ?
Can someone pls. suggest a good software having inbuilt drivers of all latest phones and which will make forensic imaging of phone's memory ?
Thank you.
You already know it:
1. Phone's Android must be rooted
2. USB-Debugging must got enabled
If these 2 requirements are fulfilled then you can fetch the partition that holds the userdata via dd command.
Here example of a related UNTESTED Windows command script:
Code:
@echo off & setlocal
set "dump_directory=userdata"
set "dump_location=C:\USERDATA"
rmdir /S /Q "%dump_location%"
mkdir "%dump_location%"
adb devices
for /F "tokens=1,9,11 delims= " %%a in ('adb shell "su -c 'ls -al /dev-block/platform/*/by-name' 2>/dev/null"') do (
set "characteristics=%%a" & set "directory=%%b" & set "block=%%c"
if NOT "?%characteristics%"=="?" (
set "type=%characteristics:~0,1%"
if "%type%"=="l" (
if "%directory%"=="%dump_directory%" (
adb shell "su -c 'mount -o rw,remount %block% /%directory%'"
adb exec-out "dd if=%block% bs=4096 | gzip" > %dump_location%\%directory%.img.gz
goto :dump_done
)
)
)
)
:dump_done
endlocal & @echo on & exit
hi jwoegerbauer
Thank you so much for your help. Can you pls. suggest any windows pc based app ? I am absolutely not proficient in terminal command level work so will prefer any app. which will make sector by sector Image of the memory.
Thanks again
I don't make use of 3rd-party-apps: I do all by means of Windows command scripts ( read: BAT files what by nature are apps ) utilizing ADB as shown above.