Develop Bugs

[23/Jan/2012][NST][1.1] Current book cover screensaver + custom shutdown image

UPDATE 23/01/2012:
Added support for content on sd-card (BETA). Further details on this post.
UPDATE 03/01/2012:
WARNING: some users reported troubles starting custom launcher and application after installation of this mod; a full backup before installation of this mod is strongly suggested!
UPDATE 27/12/2011:
Added custom shutdwown image mod.
UPDATE 18/12/2011:
Complete refactoring of Hack; now it's based on firmware 1.1.
Older firmware (1.0 and 1.0.1 no more supported).
Hi all,
i made a modification on Nook Simple Touch to use, as screensaver, the cover of the current reading book (i.e. the last book opened in the stock reader application).
Of course, it's necessary that the book has a cover (i.e. the cover is shown in the library application); on contrary, the default screensaver will be displayed (i.e. "authors").
Usage:
to activate the "current reading book cover screensaver: go to settings / screen / screensaver and select the new option, called "Current reading book image";
to set the custom shutdown image: copy an image called "shutdown.png" inside folder "screensavers" of Nook internal drive, when the Nook is connected with USB; the image "shutdownLowBattery.png" is displayed in case the Nook turns off due to low battery.
If the images are not found, the default ones are used.
Thanks to:
XorZone for it's really useful modification "Edit n/reading now/side btns/RecentApps+ActivityPicker+ForceOrient";
WARNING: as usual, modifying system files you may risk to brick your Nook, unless you know what you are doing. You are strongly advised to make a full backup before proceeding. I don't take any responsibility if you decide to apply this mod.
WARNING-2: this modification could only be appied on firmware 1.1 .
Installation:
download and unpack one of the attached files:
screensaver-hack-110-xor.zip in case you are using XorZone mod to improve button mappings etc..;
screensaver-hack-110.zip otherwise (i.e.: you are just using plain firmware from B&N);
verify that the archive you downloaded contains these 4 files:
android.policy.jar [needed only for "current book cover screensaver"];
services.jar [needed only for "current book cover screensaver"];
Settings.apk [needed only for "current book cover screensaver"];
framework.jar [needed only for "custom shutdown image"];
please consider that if you want to apply just one of the 2 modification included, you may limit the execution of next steps just to the relevant files as listed above;
(optional) make backup of original files, in case of problems with the modded ones (in case you revert to original files, remember to set the permissions of the original files, and delete the dalvik-cache)
remount system partition r/w
Code:
adb shell mount -o rw,remount -t ext2 /dev/block/mmcblk0p5 /system
copy the downloaded files to Nook
Code:
adb push android.policy.jar /system/framework
adb push services.jar /system/framework
adb push framework.jar /system/framework
adb push Settings.apk /system/app
change the permission
Code:
adb shell chmod 644 /system/framework/android.policy.jar
adb shell chmod 644 /system/framework/services.jar
adb shell chmod 644 /system/framework/framework.jar
adb shell chmod 644 /system/app/Settings.apk
delete dalvik-cache
Code:
adb shell rm /data/dalvik-cache/[email protected]@[email protected]
adb shell rm /data/dalvik-cache/[email protected]@[email protected]
adb shell rm /data/dalvik-cache/[email protected]@[email protected]
adb shell rm /data/dalvik-cache/[email protected]@[email protected]
delete packages.xml [needed only for "current book cover screensaver"] (it will be regenerated at next boot; optionally make a backup also of this file, in case of troubles)
Code:
adb shell rm /data/system/packages.xml
(optional) due to packages.xml regeneration, it's possible (in my case it occurred) that now when you turn on the NST, the demo mode starts automatically; in any case, it's turned off as soon as you click any button, so it doesn't make any harm; but, if you want, you can simply delete the apk to get rid of it:
Code:
adb shell rm /system/app/DemoMode.apk
reboot your Nook
Code:
adb reboot
Thanks to user persichini, it's also available an alternative installation guide using RootExplorer directly from Nook (i.e. no need of ADB commands): in any case, please take into account that the same considerations about the relevance of modified files (in case you only want to install either "current book cover screensaver" or "custom shutdown image").
In case of issue, please provide the logcat log. You can redirect the log to a file (logcat.log) with the ADB command (launch it when Nook is booting to have all useful info):
Code:
adb logcat > logcat.log
Hit Ctrl+C to stop logging.
Hope you will enjoy it!
PS: as soon as i will have time, i will post sources, so you can build the mod by yourself (meanwhile, if you need them, just decompile and compare to original files of firmware 1.1 )
PS2: attached to this message you can also find 2 nice possible shutdown / lowBattery images.

I know you said that it's not compatible with v1.0.1, but is there a reason why you don't have v1.0.1 firmware on your nook? It's been out since July/August and works just as (un)well with the rooting scripts out there.

nickveldrin said:
I know you said that it's not compatible with v1.0.1, but is there a reason why you don't have v1.0.1 firmware on your nook? It's been out since July/August and works just as (un)well with the rooting scripts out there.
Click to expand...
Click to collapse
mostly, just because i'm lazy! and on changelog it's just mentioned that 1.0.1 hav some improvement on wifi, that i don't use at all.
In any case, this doesn't matter for my mod, since i downloaded the manual upgrade file from B&N, so that it would be easy to apply the mod to 1.0.1. I just need to find some time. I hope i will do it during the week-end.
Regards

traycold said:
mostly, just because i'm lazy! and on changelog it's just mentioned that 1.0.1 hav some improvement on wifi, that i don't use at all.
In any case, this doesn't matter for my mod, since i downloaded the manual upgrade file from B&N, so that it would be easy to apply the mod to 1.0.1. I just need to find some time. I hope i will do it during the week-end.
Regards
Click to expand...
Click to collapse
Okay thank you! I will look forward to the 1.0.1 release.

Another option is to use Cool Reader 3. It has Nook Simple Touch features (e.g.: type of refresh - full, fast; you can map the physical buttons) and, starting with cr3.0.51-20, it automatically creates one folder (currentbook) in screensavers and saves the current book's cover in that directory (deleting all others when the current book is changing). You can then choose that directory in the standard screensaver option of your Nook.
Not to mention other nice touches not present in the standard reader (showing the clock and the battery percentage or bars while reading a book, very customizable).

Yeah, problem encountered when I try reading or going into settings.. here's the log:
http://pastebin.com/fGGJVnGQ
I'm using 1.0.0
EDIT: Restored the backuped files, reader's back online, settings still not working :[
This particular error appears when I'm trying to launch the settings panel:
Code:
No Activity found to handle Intent { act=android.settings.SETTINGS flg=0x14400000 }
Touching the wifi icon doesn't open up any popup, it just fast reboots the nook

koltzu said:
Yeah, problem encountered when I try reading or going into settings.. here's the log:
http://pastebin.com/fGGJVnGQ
I'm using 1.0.0
EDIT: Restored the backuped files, reader's back online, settings still not working :[
Touching the wifi icon doesn't open up any popup, it just fast reboots the nook
Click to expand...
Click to collapse
hi,
sorry for your issue.
Actually, i also had some issue just opening the wifi-tab of the settings. I didn't found it before simply because i don't use wifi at all, so normally i don't have any reason to open it!
To solve this issue, you just need to update the file settings.apk, following the instruction on post 1. I updated the file "Settings.apk" in the firtst post.
In your case, if you reverted to original file, then there is no trace left of my modification, so i really don't understand what may occur. It could be useful to get a complete logcat trace since boot. To do so, launch the logcat command, as soon as the Nook is booting (tipically, as soon as the Nook drive appears on Windows): this way, you don't miss the first log lines that could help understanding your issue.
Additional advices: check that, after reverting to original files, you set the right permissions; wipe dalvik-cache:
Code:
adb shell rm /data/dalvik-cache/*.*

Thanks for the answer, I did as you told and the settings started working [by using your apk] but the reader died again. Replaced it again by using my files and the reader started working while the settings menu stopped working.
I seem to be unable to do a logcat while booting [can't connect through cable for some reason].
I blame all of these problems on my own previous tinkering with my nook.
Luckily I have a backup that I've done before rooting the nook. I'll just restore it and try again on a 'clean' and newly rooted Android system as soon as I get my hand on a microSD card.
If I bang into any more problems after restoring, I'll let you know

Any update on this? Possibly getting it to work on the (yes just released) v1.1 update?

I'm interested to see if this has been worked on anymore? Is there any plans for bring this to V1.1? I would love to use this on my nook.

persichini said:
I'm interested to see if this has been worked on anymore? Is there any plans for bring this to V1.1? I would love to use this on my nook.
Click to expand...
Click to collapse
hi, i will try and find the time to make the updates for firmware 1.1 as soon as possible (possible, this week-end).
Regards

traycold said:
hi, i will try and find the time to make the updates for firmware 1.1 as soon as possible (possible, this week-end).
Regards
Click to expand...
Click to collapse
Hey tray - thanks a lot!
But many of us here have already installed modified versions of android.policy.jar and services.jar...it's not possible to release a patcher, right? Can't ask for too much, and don't mean to be belittling your contributions...
And, btw, I'm seeing all these different patches here...does anybody have a primer on patching these jars? Or at least some intro? I'd google it but I'm not quite sure what to search for...

traycold said:
hi, i will try and find the time to make the updates for firmware 1.1 as soon as possible (possible, this week-end).
Regards
Click to expand...
Click to collapse
That would be awesome if you did bring it to 1.1. I under stand developers have lives outside of development thank you for your time.

traycold said:
hi, i will try and find the time to make the updates for firmware 1.1 as soon as possible (possible, this week-end).
Regards
Click to expand...
Click to collapse
Since you are going to patch Reader.apk, how hard would it be to modify it so that it can be launched from standard drawer as any other app?
It would be great to be able to add a big icon (e.g. with Desktop VisualizeR) to the home page that opens the book your currently reading...

traycold said:
hi, i will try and find the time to make the updates for firmware 1.1 as soon as possible (possible, this week-end).
Regards
Click to expand...
Click to collapse
Hey trey- instead of releasing a jar file, which many of us have modified, what about just giving us whatever you modify in the smalis, and then we go ahead and apply the patch ourselves?

You could also take the stock 1.0.0 files and make the patches yourself.

LOL, right, if I knew just what the heck I was looking for...

LastSilmaril said:
LOL, right, if I knew just what the heck I was looking for...
Click to expand...
Click to collapse
You don't need to know! Decompile the original files, decompile the files from this thread (apktool). Make a diff of the to decompiled folders (diff -crB folder_with_decompiled_stock_files folder_with_decompiled_files_from_this_thread > diff.patch ). Now you know what has been changed and you can try to use the patch with the 1.1 files.

mali100 said:
You don't need to know! Decompile the original files, decompile the files from this thread (apktool). Make a diff of the to decompiled folders (diff -crB folder_with_decompiled_stock_files folder_with_decompiled_files_from_this_thread > diff.patch ). Now you know what has been changed and you can try to use the patch with the 1.1 files.
Click to expand...
Click to collapse
Thanks...I've never had to really use diff for anything before so I never really thought about it. I'll try it out, but likely not today - I need a break from Nook testing/hackery already (see my dhcp thread...)

bump.........

[FIX/TOOL] Backup/Restore/Fix IMEI & Data Restore Tool v3.5 - Updated 03/22/2013!!!

[FIX/TOOL] Backup/Restore/Fix IMEI & Data Restore Tool v3.5 - Updated 03/22/2013!!!
USE THIS AT YOUR OWN RISK AS QPST WILL FLASH JUST ABOUT ANYTHING YOU TELL IT TO. I AM NOT RESPONSIBLE IF YOUR PHONE BECOMES MORE BRICKED THAN IT ALREADY IS, EXPLODES, OR TRANSFORMS INTO A SITH LORD AND ATTACKS YOU WITH A LIGHT SABER!
Verizon Users please refer to this thread HERE for IMEI and Roaming fix.
Click for Screenshots in Post #4
FILES YOU WILL BE NEEDING
DOWNLOAD QPST V2.7.378 from HERE
(if you have build version 2.7.385 please let me know)
Fix for Data Issues (Stuck on EDGE/2g) see Post # 3
(Sasktel users custom App has not been updated for you guys cause I am still in need of additional data)
How to get to DIAG Mode
**AOSP ROMs to get to DIAG Mode see Post #2
Option1:Stock ROM (Stock Dialer) dial *#7284#.
Option 2: Stock ROM (No Stock Dialer) flash this file HERE!
Install QuickShortcutMaker.
Open it and type IOT in the search box.
Click on the entry that says IOTHiddenMenu / IOTHiddenMenu / com.android.hiddenmenu/com.android.hiddenmenu.IOTHiddenMenu
Click OK
STOCK ROMS: In the hidden menu or PhoneUtil menu select USBSettingsMenu choose the correct mode and click ok.​
To get started put phone into RMNET + DM + MODEM mode (DIAG Mode)
Connect your phone to your computer using your USB cable (Stock cable will work best no guarantees with any other cable).
You might need these if your phone won't connect USB Drivers.
Look in device manager under ports and serials you should see your phone there.
Now open QPST Configuration click on ports tab and then on Add new port button type in COM## where ## is the port number your phone is connected to.
To make a backup:
Open Software Download from the Start Clients menu.
Click on the Backup tab.
Make sure your phone is listed under port.
Select a location to save your backup (recommended).
Click Start and wait for it to finish.
You should now have a QCN file of your NV Data.
Save the file in a safe place.
To restore:
Open Software Download from the Start Clients menu.
Click on the Restore tab.
Make sure your phone is listed under port.
Select the location you saved your backup to.
Click Start and wait for it to finish.
The phone will attempt to restart if it fails don't panic just manually reboot your phone it may take longer than usual but you should be fine.
IMEI Injection:
Please see Post #3 for IMEI Injection + Data Restore All in one App and Instructions
or
Inject IMEI with QPST
Open RF NV Item Manager from the bin folder found in Program Files folder/Qualcomm/QPST
(RF NV Manager is no longer accessible from the start menu or from inside QPST Configuration).
Click on Setting menu in RF NV Item Manager and select Comport.
Select your phone from the list of ports and click ok.
Go to File menu and select Read From Phone.
You will get a list of NV items and their values from your phone.
Look for item NV_UE_IMEI_I it will be item number 550 you can do a search for it using the search.
If you are unable to find it you will need to add it in
Go to Option => Customize NV Item List.
Then look for the item on the left and move it to the right.
Click OK now you should be able to find it.
NEVER ADD AN ITEM THAT YOU DO NOT KNOW THE CORRECT VALUE FOR YOU CAN DAMAGE YOUR PHONE IF YOU DO SO!​
On the right you will see a set of 9 text boxes this is where your IMEI should be.
Click the Hex Check Box.
The Hex values for your IMEI will consist of no more than 2 characters per a box and must match your IMEI or it will not take the values you enter. The IMEI is also listed in a special order so you must follow this guide to ensure your IMEI is correct. The first box will always be an 8.
Example if your IMEI was: 954091051099226 then the boxes would look like this:
8
9a
45
90
01
15
90
29
62​
Click on the button Write NV to write the values to your phone.
Once they have been written reboot your phone and check to see if your IMEI has been restored.
If IMEI is correct and you are stuck on EDGE/2g go to Post #3.
Remember to go back into the Hidden Menu and set your USB Settings back to MTP + ADB once you are done!!!!
________________________________________________________________________________________________
Thread Rules:
Do not ask how to spoof IMEI or how to clone IMEI you will be ignored!
Do not answer someone who asks for information on IMEI spoofing or cloning!
Please do not ask questions unless you have used the Search option!!
Please do not use this thread as a place to settle out any ill feelings towards each other or any other developments!!!
Please do not ask questions that have already been answered!!
Please do help each other when at all possible!!
Don't hesitate to have fun while we all try to figure this problem out!
If I do not answer you right away it's not because I don't like you it's because I have a family, a job, a life outside of development that needs tending to!!
Also thanks to jroyalty, zmore, drothenberger, David Dee, PureMotive, Bigbyte.me, GerardAnthony, Amoamare, <>, XDA, and everyone who donated their phone data for research =)
DX
I don't ask for donations (I do this cause I enjoy it) but a nice latte every now and then late at night is quite refreshing while developing...lol

________________________________________________________________________________________________
AOSP Roms
Added scripts as downloadable files for those who may want them that way.
Place phone in and out of DIAG Mode by running these scripts.
Script to enter DIAG Mode (RMNET + DM + MODEM Mode)
Code:
echo 0 > /sys/class/android_usb/android0/enable 0
echo smd,bam > /sys/class/android_usb/android0/f_rmnet/transports
echo diag > /sys/class/android_usb/android0/f_diag/clients
echo 1 > /sys/class/android_usb/android0/f_acm/instances
echo rmnet,acm,diag > /sys/class/android_usb/android0/functions
echo 1 > /sys/class/android_usb/android0/enable
Script to return to MTP(eject first)
Code:
echo "" > /sys/devices/virtual/android_usb/android0/f_mass_storage/lun_ex/file
echo 0 > /sys/devices/virtual/android_usb/android0/enable
echo "mtp,acm,adb" > /sys/class/android_usb/android0/functions
echo 1 > /sys/devices/virtual/android_usb/android0/enable
vold

Custom App updated current support is for AT&T, T-Mobile, Bell, Telus, and Rogers. I am in need of anyone with a working Sasktel phone in order to get this working for Sasktel.
Updated to version 3.5. Added IMEI Injection Checkbox.
Download - SGS3 Data Restorer App
This custom app will create a QCN file that can be restored to your phone after you inject your IMEI back into your phone and find yourself with data connection issues. This is only used if you had lost your IMEI and did not have a backup created!!
Instructions:
Create a QCN backup of your phone using QPST (see OP for instructions).
On a Windows Vista or higher computer download the app and install it.
Once installed, close the app.
Go to start menu, you will find app under DanX and run it.
(If there are any new updates the app will find it.)
Select your Carrier
If you need your IMEI injected then click the checkbox next to "Inject IMEI"
Upload your QCN backup into the app.
If you clicked the checkbox a window will pop up at this time asking for your IMEI.
**Enter it exactly how you see it on the back of your phone.
Select a save location and create a save name.
Verify that your IMEI is correct.
Click "IMEI Verified" button.
Wait and the QCN should be generated.
Go to the location where you saved the QCN.
Go to QPST and restore file into your phone (see OP for instructions).
Manually reboot your phone.
If you have a slow connection still but you're no longer on 2g reboot again.
If you still a have slow connection after that consider flashing stock again through Odin and then generate another backup using this app.
You can also try flashing a different modem and then generate another backup using this app.
If it still is not working respond to this thread.
I do not guarantee any success and results may vary on how badly you have screwed your phone!
I am not responsible if you screw your phone worst than it already is as QPST is a deadly phone weapon use it at your on risk.
DX
I cannot guarantee release times as I do this on my spare time but I promise I will try to keep this updated as long as I can. Though the coffee may keep me up I do sleep every now and then if you used the app and you liked it please donate it pays for coffee.

Screenshots
Great emergency resource.
Now everyone can start flashing again like it's going outta style.
--------------------------------------------------------------------------------------------------
EDIT: Added some screenshots of the process to reassure whomever it helps:
1_SAM_GS3_EXPLOITER_By_GeeK_finished.png
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
1b_Hidden_menu_screenshot_montage.jpg
2_win7_drivers_after_changing_to_RMNET_DM_MODEM.png
3_QPST_InstallShield.png
4_Device_Manager_Phone_COM_Port.png
5_QPST_Add_New_Port.png
6_QPST_Port_Added.png
7_QPST_Software_Download_BackupNV.png
8_QPST_RF_NV_Manager_WRITE_IMEI_TO_NV.png
This last screenshot is for people who haven't already backed up their IMEI but want to try forcefully writing it back. The example 15-digit IMEI number I used (but didn't actually write) was: 123456789012345

Awesome.
If confirmed, please make an app that we can all donate too. This will be most beneficial to you and the community.
Thank you for the countless nights
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2

I'm more interested in the IMEI injection. If someone has already lost their IMEI and can simply inject their original IMEI back into the phone then we're golden (not that you shouldn't have a backup just in case, but it's nice nevertheless).

Haha look whose got their own thread! great work man look forward to this being confirmed so we can all breathe a sigh of relief!
Sent from my SGH-I747 using Tapatalk 2

Thanks man! You are a life saver for many. Your work is much appreciated.

The only thing I'm confused is secured and unsecured kernel.
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2

As soon as this is confirmed working I think it will be time to fulfill our promise of donating to the one who solved this issue

We need links to insecure kernels for Canadian carries unfortunately

rgoyena said:
The only thing I'm confused is secured and unsecured kernel.
Click to expand...
Click to collapse
An "insecure" kernel is one in which adb automatically gets root access. This is required for GeeK's mod to work. If you are on UCALEM, you can flash the one from here. (There are others, too.)
If you're running the LG1 stock kernel, you can install the "adb insecure" app. Run it and click the box to make your kernel insecure, then use GeeK's mod. This is what I did and it worked perfectly.
EDIT: "adb insecure" should work for any kernel, including the Canadian ones.

rgoyena said:
The only thing I'm confused is secured and unsecured kernel.
Click to expand...
Click to collapse
Just to add to what drothenberger said: in secure mode, when you adb shell into your phone, you have to use 'su' post-login to become root:
Code:
$ adb shell
[email protected]:/ $ su
[email protected]:/ #
This is a pain, because you can't directly do stuff like "adb push foobar.apk /system/app/" without being root first, which is what the insecure mode fixes. Newer versions of CyanogenMod also now have a root settings menu that gives you even finer grained control of this.

It does work for Can carriers, I confirmed that in the other thread. Take a look at my mini guide there: http://forum.xda-developers.com/showthread.php?p=29462669
Sent from my SGH-I747M using XDA Premium HD app

I'm running faux kernel for att.
About adb. Now this is a problem for me. Never used it and always tried to avoid using it. Lol
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2

rgoyena said:
I'm running faux kernel for att.
About adb. Now this is a problem for me. Never used it and always tried to avoid using it. Lol
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2
Click to expand...
Click to collapse
kernel doesn't matter as long as it is stock. The app will make it insecure. Adb is something essential if you are flashing.
Sent from my SGH-I747M using XDA Premium HD app

Hey this is awesome! I hope it is confirmed working! I have one quick question. When you say that you have to be on a stock rom, do you mean "stock" stock as in, the stock rom the phone came out of the box in, or does it still work on a stock based rom (like a debloated/deodex rom, with mods etc?)

drothenberger said:
An "insecure" kernel is one in which adb automatically gets root access. This is required for GeeK's mod to work. If you are on UCALEM, you can flash the one from here. (There are others, too.)
If you're running the LG1 stock kernel, you can install the "adb insecure" app. Run it and click the box to make your kernel insecure, then use GeeK's mod. This is what I did and it worked perfectly.
EDIT: "adb insecure" should work for any kernel, including the Canadian ones.
Click to expand...
Click to collapse
I'm on LG1 and I used adb insecure, purchased from the Market (gotta support Chainfire, the man rocks!). It all worked flawlessly for backing up my IMEI.

ViralCipher said:
Hey this is awesome! I hope it is confirmed working! I have one quick question. When you say that you have to be on a stock rom, do you mean "stock" stock as in, the stock rom the phone came out of the box in, or does it still work on a stock based rom (like a debloated/deodex rom, with mods etc?)
Click to expand...
Click to collapse
stock based, not aosp. I am on k747 Sammy kernel and it worked
Sent from my SGH-I747M using XDA Premium HD app

SOOOO happy now I can start flashing away when i get my s3 on monday!

Unlock bootloader on GT-I9250 without wipe and without root

Hi! After latest OTA update I was left with an unbootable Galaxy Nexus (zygote couldn't start) and I lost root (su needed activitymanager up). So I needed to unlock to revive the phone, but I really didn't want to lose my data. After some exploration I could come up with a way to unlock bootloader without wipe and without root. I have seen several questions about this here and this was deemed impossible, so I decided to share my findings and expect they might help someone. Should work with GSM tuna phones.
Components for success:
— unlocking without wipe via putting a byte in param partition (needs root):
[1] http://forum.xda-developers.com/showthread.php?t=1650830&page=15
— OMAPFlash, a low-level utility for manipulating and flashing chipset (usually used to unbrick phones)
[2] http://forum.gsmhosting.com/vbb/f63...9250-galaxy-nexus-gt-i9100g-gt-i9300-1465412/
Take the two of them and you have a solution. I could successfully flash unlock byte to param partition using OMAPFlash.
A sketch of a guide:
1. Boot windows xp, download OMAPFlash (http://d-h.st/XNv), connect a turned off phone without battery, install drivers for omap device. (Mod edit: I've updated the download link.)
2. Dump a part of param partition. You don't need to dump the whole partition, but I think it is safer if you dump a sector-aligned area (512*n). I used 4KB (8 sectors).
Code:
OMAPFlash -omap 4 -2 -p OMAP4460_TUNA_8G_HS_PRO -t 36000 chip_upload [email protected] 1000 param.img
chip_upload is for downloading data from device memory
[email protected] is the start of params partition (check /sys/block/mmcblk0/mmcblk0p4/start, multiply by sector size 512 and convert to hex)
1000 is to copy 4KB.
Sometimes the process stalls (esp if you try to download larger dumps), just reconnect and retry.
3. Verify that the content is similar to first 4 KB of the dumps of param partitions attached in the thread [2]. For me they matched entirely.
4. Change the byte at offset 124 (0x7C) from 01 to 00.
Code:
echo -ne "\x00" | dd obs=1 count=1 seek=124 of=param.img conv=notrunc
5. Flash it back to the device.
Code:
OMAPFlash -omap 4 -2 -p OMAP4460_TUNA_8G_HS_PRO -t 36000 chip_download [email protected] param.img
Reboot, you are unlocked.
Additional links:
[3] http://forum.gsmhosting.com/vbb/f634/gt-i9250-pinout-enjoooy-1463061/ GT-I9250 JTAG pinout. Not directly releavant to the guide, but I found it while searching for solution, thought that can help someone in future.

Additional reading
The dangers of OTA when you have root, or why I was stuck with an unbootable phone at all
I learned the hard way that OTA may cause unpleasant results if you are trying to preserve root and mess with filesystem.
I was trying to preserve root in a way similar to one used by rootkeeper apps: put a copy of su somewhere in /system and make it immutable. So I went and put my su to /tts (thought that it's unprobable that OTA will do something there), and made it immutable.
And then the update came. As part of the the update process it copied a new version of /system/usr/share/zoneinfo/zoneinfo.version file and the file got 660 perms (package_extract_dir("system", "/system") in the update_script). Then it went on to recursively fix permissions so that the mentioned file would be made readable (set_perm_recursive(0, 0, 0755, 0644, "/system")). But the set_perm_recursive was met by immutable su in tts directory, chmod returned error and the recursive process was stopped before it got to zoneinfo.version file. So the latter file remained unreadable.
Unfortunately during startup zygote preloadsClasses, static constructor in some sqlite class needs DateFormat, and DateFormat reads zoneinfo. And fails cause it's unreadable. Exception, System.exit. Phone boot stuck.
To work my copy of su needs to send a message to ActivityManager service using binder. I wrote a dirty mock for AM but servicemanager didn't accept my fraud, it checked uid. I tried to bypass preloadClasses with overflowing system file descriptors count to prevent zygote from reading preload class list, but somehow it didn't succeed. Thus the only option I had was unlocking bootloader.
So it may end bad if you mess with /system on a stock rom with locked bootloader and want to receive OTA. It may seem natural, but sometimes the changes seem irrelevant, and then a chain of small failures leads you to loss of everything: boot, root, and data.

This is great work! Kudos to you for figuring it out.
By the way, where did you find the syntax for OMAPFlash commands?

efrant said:
This is great work! Kudos to you for figuring it out.
By the way, where did you find the syntax for OMAPFlash commands?
Click to expand...
Click to collapse
There are some docs in OMAPFlash_tuna.zip package. The most interesting is OMAPFlash.txt that lists options and commands and has some examples.
Also I was lucky that there is a complete example for unbricking GT-I9250 in Targets/Projects/tuna. This is where I took the options specific for this device.

nichtverstehen said:
There are some docs in OMAPFlash_tuna.zip package. The most interesting is OMAPFlash.txt that lists options and commands and has some examples.
Also I was lucky that there is a complete example for unbricking GT-I9250 in Targets/Projects/tuna. This is where I took the options specific for this device.
Click to expand...
Click to collapse
Exactly. I haven't needed this yet, but i had looked in those board files, cross examining with omap 4460 manual that can be found on the web. Thanks for sharing.
I was not aware that JTAG method had been found. Great news.
Sent from my i9250

Works!
Awesome - this worked for me! Unlocked, unrooted, TAKJU Galaxy Nexus w/JB 4.2.2. I used OMAPFlash_tuna.zip (download link).
I had issues when the downloaded param.img file was long, so I replaced 1000 with 200 in the commands. Regardless, it still took me probably 5-10 tries on each command to get it working (unplugging and replugging the phone in between), and sometimes it would freeze up and I'd have to restart Windows. If it takes longer than 5 seconds, you should press Ctrl+C and restart that step.
My problem was that one of my volume buttons is messed up, and as a result the fastboot screen doesn't work - Windows doesn't detect a fastboot device, and none of the hardware buttons or the touchscreen works either. As a result I needed to unlock the bootloader without using fastboot (oem unlock), and this did the trick!
Also, on Windows, I downloaded a hex editor (i.e., HxD) to do the editing. My modified param.img (only 512 bytes) is attached as well.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Thank you!!! It worked for me too!
The volume buttons on my Galaxy Nexus didn't work and I can't recharge the battery via USB. The USB works only as data connection. Despite all these issues on my phone, it worked for me too!!
I replaced the size in the commands from 1000 to 400 (1024 bytes = 2*512), and I had to put the battery on the phone.

Sweet jesus I cannot express enough gratitude for this post. While I was a little worried about bricking my device, it would up working perfectly.
A couple of confusing points for anyone out there trying to do this:
- The dump / reflash should only take a few seconds each. If it hangs, cancel and re-start the process.
- Install the drivers with the device OFF but plugged in. You will have an OMAP device without a driver in your device manager. Update the device driver and you're good to go.
- I didn't know how to get the dd command to work on windows, so I also went the Hex editor route it it worked flawlessly
- The only snag I ran into was that it did not boot into my flashed CWM after doing an "adb reboot recovery" from the stock rom. It went back to the stock android recovery. From there I did "fastboot boot cwmrecovery.img" and installed my rom and gapps. After that initial boot, it rebooted into recovery just fine! It seems like a weird glitch (maybe just a one-off).
Cheers

techobrien said:
- Install the drivers with the device OFF but plugged in. You will have an OMAP device without a driver in your device manager. Update the device driver and you're good to go.
Click to expand...
Click to collapse
This is a critical step right here. This thread either should be linked on the 101 FAQ if it's not already or stickied.
a maguro wrote this.

techobrien said:
- The only snag I ran into was that it did not boot into my flashed CWM after doing an "adb reboot recovery" from the stock rom. It went back to the stock android recovery. From there I did "fastboot boot cwmrecovery.img" and installed my rom and gapps. After that initial boot, it rebooted into recovery just fine! It seems like a weird glitch (maybe just a one-off).
Cheers
Click to expand...
Click to collapse
Sounds like you are getting hit with the /system/recovery-from-boot.p file. When you boot into Android, this file checks to see if you have stock recovery...if not, it replaces it with stock recovery. You can rename, move, delete the file safely. It shouldn't exist in custom ROMs, which would explain why after installing a ROM and Gapps you were fine.
This is pretty cool. Nice find OP.

cupfulloflol said:
Sounds like you are getting hit with the /system/recovery-from-boot.p file. When you boot into Android, this file checks to see if you have stock recovery...if not, it replaces it with stock recovery. You can rename, move, delete the file safely. It shouldn't exist in custom ROMs, which would explain why after installing a ROM and Gapps you were fine.
This is pretty cool. Nice find OP.
Click to expand...
Click to collapse
This post thread have not been getting the attention it deserves..
Beamed from my Maguro.

cupfulloflol said:
Sounds like you are getting hit with the /system/recovery-from-boot.p file. When you boot into Android, this file checks to see if you have stock recovery...if not, it replaces it with stock recovery. You can rename, move, delete the file safely.
Click to expand...
Click to collapse
Good to know for next time round. The flimsy headphone ribbon cable is the bane of my existence and it seems like a somewhat common problem. I didn't think that the custom rom would touch the bootloader so I was confused, but /system/ makes sense. Thanks for the tip.

Just in case anybody was wondering, this method also worked for my Verizon GNex LTE. I also used a HEX editor.

Hi,
i'm thinking to use this method to unlock my Nexus' bootloader, in order to gain root privileges without wiping the memory.
This because i need to try and undelete files i have lost on my phone, to do this i need the root but i can't use the normal procedure that would wipe forever all the data i need to restore.
As i am new to this kind of operations, i never even rooted my Android phones, i wanted to ask if this procedure can fit my situation, and if there are any risks....
Thank you very much
EDIT: It worked perfectly!!
Thank you very much!!

Did anybody try it on MAGURO device? Does it require any change in the procedure?

Um... The op (and others) did it on a maguro? After all, the title says "on GT-I9250".

Isn't a i9250 a Maguro?
Beamed from my Grouper

Mod edit: removed quote of the OP.
Is WinXP really required for this process or will it work on newer versions of Windows ie Win8?

mielli1 said:
Is WinXP really required for this process or will it work on newer versions of Windows ie Win8?
Click to expand...
Click to collapse
Please do not quote the first post of threads when you reply.
As for your question, if you can get the driver to install on Windows 8, the program will work fine. The driver installs fine in Windows 7 by the way.
Don't forget to disable driver signature verification if you are trying to install drivers in Windows 8.

Windows 8 - stuck at installing drivers
beekay201 said:
This is a critical step right here. This thread either should be linked on the 101 FAQ if it's not already or stickied.
a maguro wrote this.
Click to expand...
Click to collapse
I have a Nexus with a broken volume up button, so am trying this method as a way of unlocking the bootloader and rooting my device.
When I plug the powered off device into the usb port, constantly get the sounds of a device being inserted, and then unplugged (two different beeps.) This continues until I unplug the phone.
Is this the step where I should get a "found new hardware" notification? It is not happening for me, and I'm wondering if this is Windows 8 related.
FYI - I have already disabled driver signature verification.

[BOOT-ON-CHARGE] LG Pro Lite D680 - Developer help needed.

LG Pro Lite D680
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Boot On Charge
Non-generic feature for commercial purposes
URGENT NEED! - WILL DONATE​
What we need:
I am looking for an urgent solution to boot-on-charge LG D680 cell phone, I am asking for help to developers who have experience on this area. The subject is related to unlock the bootlaoder, fastboot and custom rom. I understand the task is not simple, I am looking forward to donate whoever hacks the non generic feature.
What we do:
We provide video service through LG D680 cell phone (Also known as LG Pro Lite D680), the phone has 3G connection and is plugged to the power supply when is working.
Problem:
Most of the day the phone is plugged and working properly, however when the weekend comes the cell phone is unplugged and the energy is completely consumed. Currently, when the power is back to the cell phone we need to start the cell phone MANUALLY by pressing the power on button.
Goal:
We need the phone to be booted into the OS automatically when is plugged into the power USB cable (the phone initial status is powered off).
Possible Solutions / Alternatives:
Unlock the bootloader and run fastboot command fastboot oem off-mode-charge 0.
Continue our research, based on the steps described below (see LG D680 experience)
Replace charge animation with boot file command /system/bin/reboot (see Huawei experience below replacing ipod file).
Finding a custom ROM that already contains a Boot on Charge behaviour.
Finding a custom ROM that at least has “Power On Schedule” feature (AOSP certificate permissions level).
Finding a generic Android vestion with “Power On Schedule”.
Cellphone specifications:
PLATFORM
OS - Android OS, v4.1.2 (Jelly Bean), upgradаble to v4.4.2 (KitKat)
Chipset - Mediatek MT6577
CPU - Dual-core 1 GHz Cortex-A9
GPU - PowerVR SGX531
Previous work and research:
We did this "boot on charge" research in two types of cell phones. One is HUAWEI G730 and the other is LG D680. Fortunately, it worked fine in G730, but we haven’t the same results up to now on LG D680.
In Huawei G730, we replaced charging animation located at /system/bin/ipod with an ipod file containing “/system/bin/reboot” and worked like charm!
LG D680, we could not find the animation file, but we found that it might be inside the boot image. We did some research in order to modify it, but we got blocked (someone might continue our steps if useful).
HUAWEI G730 Extended Procedure:
Since this phone has a Mediatek chipset, the “battery animation” app is running on /system/bin folder. Is running with the filename ipod. The main task is to exchange ipod content (which is originally binary) to an ipod file with this content: /system/bin/reboot.
So, create a brand new file called ipod, and wrote the line in there. We transferred the file to the phone via adb push, as shown in next steps below.
Copy procedure: So, we set our phone to USB Debugging Mode, then we connected it to the PC, and run the following script:
adb shell mkdir /storage/sdcard0/carga/ (We created a folder to store files being pushed from the PC to the phone)
adb push ipod /storage/sdcard0/carga/ (We are pushing the file to the storage folder within the phone)
adb shell "su -c 'mount -o rw,remount -t ext4 /dev/block/mmcblk0p5 /system'" (This step is very important, here we remount the /system folder with read-write permissions. Only doing this we will be able to copy programmatically the “hacked” file ipod to /system/app. Look out that we used mmcblk0p5 because the system folder is mapped there in this phone. You can check this running cat /proc/dumchar_info)
adb shell "su -c 'chattr -i /system/bin/ipod'" (doing this we took out immutability to the original file ipod)
adb shell "su -c 'cp /system/bin/ipod /storage/sdcard0/carga/ipod.old'" (just creating a backup file from the original ipod)
adb shell "su -c 'rm /system/bin/ipod'" (here we are removing original ipod file)
adb shell "su -c 'cp /storage/sdcard0/carga/ipod /system/bin/'" (now we copy the new file ipod to the destination folder)
adb shell "su -c 'chmod 755 /system/bin/ipod'" (change the permission ro rwx-rx-rx)
adb shell "su -c 'mount -o ro,remount -t ext4 /dev/block/mmcblk0p5 /system'" (we remount the /system folder with read-only permissions)
adb shell "su -c 'reboot'" (Finally we reboot the phone)
RESULT: Whenever you plug in the phone to the charger when it is off, it will try to boot on the battery animation, but instead, it will be redirected to a “reboot” command, which in turn will be redirecting execution to the O.S.
LG D680 Procedure:
We found that this phone also has a Mediatek chipset. Moreover, it also has a file called ipod within /system/bin. But in this case, the bootloader image doesn’t call ipod whenever it displays the battery animation. So we had to check where is mapped the boot image on the phone by executing adb shell "cat /proc/dumchar_info". As the picture shows, the boot image (bootimg) is mapped in /dev/block/mmcblk0, from offset 0x1200000, and with size 0x900000.
We tried the following steps, in order to test if we were able to download / upload booting without bricking the phone:
We copy bootimg partition to boot.img by doing adb shell "su -c dd if=/dev/block/mmcblk0 of=/storage/sdcard0/boot.img bs=1024 skip=18432 count=9216’. (Skip and Count are measured on KBytes, and those values are offset and size translated from hexa to dec).
Then we did the inverse operation by executing: adb shell "su -c dd if=/storage/sdcard0/boot.img of=/dev/block/mmcblk0 bs=1024 seek=18432”
RESULT: The phone WASN’T bricked, and reboot normally (obviously without any change on bootimg).
Because these steps worked, we went even further, this time by unpacking and repacking boot.img file. The steps done were:
Same as (b)
We pulled boot.img file from the phone to a folder within the PC, and then we unpacked the image with bootimg.exe as the picture shows below. One interesting fact is that the pulled file sized almost 9MB.
Then we repacked it without any change inside the image, as the picture shows below. The “repacked” image is now on file “boot-new.img”, but its size is almost 7.4MB. We don’t know why we have this difference.
Same as step (ii) on (b).
RESULT: The phone resulted in a SECURITY_ERROR. It is weird because we didn’t change anything. We didn’t tried further since we are not able to unpack-repack the same image, and loading it successfully.
Edited: The security error can be avoided please follow the just below instructions.
Avoid Security Error:
In order to avoid the security error above mentioned, you need to edit the default.prop file (located at /bootimg/initrd)
Change the value from 1 to 0.
FastBoot Note LG:
Fastboot is a solution performing these commands, the problem is that the bootloader is locked for these operations on the generic vesion:
fastboot oem unlock
fastboot oem off-mode-charge 0
fastboot oem lock
fastboot reboot
The command "adb reboot bootloader" does not enter on fastboot upon reboot. There seems to be an opened option while booting on "Download Mode". What I did find out is that when you go into "Download Mode" a new ADB Device is detected on my computer however no driver matched the device. I assume fastboot could be avilable on Download Mode. I have been suggested by romulocarlos to Install the drivers on LG's website however did not work out.
Files:
For making the tests your will need the system.img, boot.img images files. If you brick your phone and want to un-brick the phone please follow this guide [Guide] LG G PRO LITE- Unroot/Unbrick - flash official factory firmware. Currently we are using this kdz image.
Forum:
G Pro Lite D680 Android Development at Android General.
XDA considered the case and opened a new forum for the phone. Thanks very much laufersteppenwolf (aka Wolf), MikeChannon (forum moderator) and svetius.
Conclusion:
We have reached this spot and need help from more advanced hackers. As you guys can see, we have been working hard to trying to hack the boot-on-charge feature on the D680 however has not been yet possible. There is no precedent on this phone on custom CWM & TWRP and custom roms yet therefore the is no out of the box solution as on many other phones (i.e. cyanogen list). We have also tried XDA University practices with no results.
I am ready to donate whoever would help us in solving this problem, its an urgent matter that needs to be solved as soon as possible. I will reward a developer by making a donation.
Appreciate very much the help in advance and reading.
Best,
Jose

Well, it's not that easy without having the actual device, but it'd help quite a bit if you could upload a system dump as well as the boot.img

laufersteppenwolf said:
Well, it's not that easy without having the actual device, but it'd help quite a bit if you could upload a system dump as well as the boot.img
Click to expand...
Click to collapse
Hi laufersteppenwolf,
Congratulations for your achievements and career, amazing.
I am hereby sharing two link resoruces to download what you have asked for, system.html containing the system.img and boot.html containing boot.img. Please let me know if you have problems downloading.
I understand the side effects of not having the cellphone by your side, hope we can mitigate it with the image files you are asking. As extended solution I can open a vnc session or whatever remote tool you can consider.
Thanks so much for the answer and support.
Best,
Jose

JoseVigil said:
Hi laufersteppenwolf,
Congratulations for your achievements and career, amazing.
I am hereby sharing two link resoruces to download what you have asked for, system.html containing the system.img and boot.html containing boot.img. Please let me know if you have problems downloading.
I understand the side effects of not having the cellphone by your side, hope we can mitigate it with the image files you are asking. As extended solution I can open a vnc session or whatever remote tool you can consider.
Thanks so much for the answer and support.
Best,
Jose
Click to expand...
Click to collapse
I am DL'ing the files now, but please use another hoster, as 4shared is not allowed on XDA

laufersteppenwolf said:
I am DL'ing the files now, but please use another hoster, as 4shared is not allowed on XDA
Click to expand...
Click to collapse
Hi laufersteppenwolf,
Thanks for clarifying, I was not aware 4shared was not allowed. I am changing the hosting and updating the link.
Cheers,
Jose

Alright, what I have done so far is I have unpacked the boot image and the ramdisk, edited the ramdisk so it shoud execute /system/bin/reboot when the phone boots because of the charger. Then I repacked both and signed the boot.img again so the bootloader would accept it.
The result, however, is a bootloop. I am just not yet sure whether it is caused by a "false alarm" (the ramdisk always thinking the phone is being booted because of a plugged in charger) or caused by either the bootloader or other low-level security checks. But I also doubt that, as the bootloader seems to accept the repacked image (doesn't show the security error screen).
But I currently do not have any logs, which is why all this is wild guessing. So the highest priority now is to get some proper logs so I know what's going on

laufersteppenwolf said:
Alright, what I have done so far is I have unpacked the boot image and the ramdisk, edited the ramdisk so it shoud execute /system/bin/reboot when the phone boots because of the charger. Then I repacked both and signed the boot.img again so the bootloader would accept it.
The result, however, is a bootloop. I am just not yet sure whether it is caused by a "false alarm" (the ramdisk always thinking the phone is being booted because of a plugged in charger) or caused by either the bootloader or other low-level security checks. But I also doubt that, as the bootloader seems to accept the repacked image (doesn't show the security error screen).
But I currently do not have any logs, which is why all this is wild guessing. So the highest priority now is to get some proper logs so I know what's going on
Click to expand...
Click to collapse
Hi Wolf,
Great advance! Keep the great work up .
I have made some modifications on the original post. Yes you are right, the bootloader friendly accepts the original image and we have figured out the security error. We have found on our end that you need to edit the default.prop file (located at /bootimg/initrd) and set ro.secure to value 0. I also added the files to the post (yet to change the server origin on the boot.image though), added the kdz image to unbrick. Also appended the new forum for the phone.
I appreciate that you have favored to create the forum for the G Pro Lite D680 Android Development. Its great that we can help the community with our achievements.
Best,
Jose

JoseVigil said:
Hi Wolf,
Great advance! Keep the great work up .
I have made some modifications on the original post. Yes you are right, the bootloader friendly accepts the original image and we have figured out the security error. We have found on our end that you need to edit the default.prop file (located at /bootimg/initrd) and set ro.secure to value 0. I also added the files to the post (yet to change the server origin on the boot.image though), added the kdz image to unbrick. Also appended the new forum for the phone.
I appreciate that you have favored to create the forum for the G Pro Lite D680 Android Development. Its great that we can help the community with our achievements.
Best,
Jose
Click to expand...
Click to collapse
ro.secure doesn't trigger the security checks, this prop is only for other things like adb on early boot, enabling adb remount, adb as root by default,...
I also set ro.secure to 0 in the builds I sent you, so that's not the cause of the issue

@JoseVigil
I have some pretty good news The phone now does exactly what you want it to do, as soon as you plug in the charger, the phone boots into offline charging mode, but then directly reboots again into the normal system.
The reboot is not that nice, but it's by far the easiest, as well as safest, way to do it.
Turns out, LG did a pretty sloppy job, giving me adb access to the device when in offline charging mode, giving me the chance to read which process is running and patching the binary to run my hack before actually executing the binary. And that's it. A few lines of bash code and you're good to go
Now my question, do you want me to write a tiny script to do all the work patching the system, or shall I just explain what to do?

laufersteppenwolf said:
@JoseVigil
I have some pretty good news The phone now does exactly what you want it to do, as soon as you plug in the charger, the phone boots into offline charging mode, but then directly reboots again into the normal system.
The reboot is not that nice, but it's by far the easiest, as well as safest, way to do it.
Turns out, LG did a pretty sloppy job, giving me adb access to the device when in offline charging mode, giving me the chance to read which process is running and patching the binary to run my hack before actually executing the binary. And that's it. A few lines of bash code and you're good to go
Now my question, do you want me to write a tiny script to do all the work patching the system, or shall I just explain what to do?
Click to expand...
Click to collapse
You are the man Wolf!
Its great that you have been able to find a workaround.
Yes, ideally both. I would appreciate if you can write the script so we can run it on our rooted phones pragmatically and a brief description of what it does (comprehensive from reading the script too) with implementation steps to reproduce too.
With the script I will do the proper test on my end and provide you feedback in case we have an issue. I will place the donation the coming week early on right after the test, I will be pleased that you get your reaward .
Once that, I think It would be pertinent though that we can expose how far we have reached with our research. If you agree, we can set the ground for someone (either me or you or anyone) to get a bootable customized boot image and unlock the door for CM.
I would love to see this running on CM. But I also know we have to be realistic, as you mentioned, this could be a hell of a work to have a working custom recovery, the device tree and blobs with kernel (almost XDA University I have not been able to deal with too).
It has been a lot of fun and a pleasure to know you and interact with you. I hope this is our first experience.
Thanks very much for the great work.
Best,
Jose

JoseVigil said:
You are the man Wolf!
Its great that you have been able to find a workaround.
Yes, ideally both. I would appreciate if you can write the script so we can run it on our rooted phones pragmatically and a brief description of what it does (comprehensive from reading the script too) with implementation steps to reproduce too.
With the script I will do the proper test on my end and provide you feedback in case we have an issue. I will place the donation the coming week early on right after the test, I will be pleased that you get your reaward .
Once that, I think It would be pertinent though that we can expose how far we have reached with our research. If you agree, we can set the ground for someone (either me or you or anyone) to get a bootable customized boot image and unlock the door for CM.
I would love to see this running on CM. But I also know we have to be realistic, as you mentioned, this could be a hell of a work to have a working custom recovery, the device tree and blobs with kernel (almost XDA University I have not been able to deal with too).
It has been a lot of fun and a pleasure to know you and interact with you. I hope this is our first experience.
Thanks very much for the great work.
Best,
Jose
Click to expand...
Click to collapse
Alright, in the attachment I have uploaded the script, including all needed files in order to execute it. The script will also tell you what it's about to do before doing it, so in case you run into issues, you know where to look into
So, what the installer script is going to do:
It will first of all push a script temporarily to the internal sdcard, then it will back up /system/bin/rtcd to /system/bin/rtcd_original, as we need to execute it later again. Next it will copy the script over from the sdcard to /system/bin/rtcd, replacing the original binary (and setting the correct permissions to both modified files). As the last step it will delete the temp file from the sdcard again.
That's all the installer script does.
The actual "magic" is inside the script being pushed to /system. It gets executed before starting chargemon and reads out the devices boot mode. If the boot mode is charger, it executes /system/bin/reboot. Otherwise it executes the original binary in /system/bin/rtcd_original.
And that's about it As simple as it could only be
Regarding further development, up until now, every device I own received a werewolf kernel, and I'm not planning on making an exception for this phone
I will definitely keep on looking into it, though it will not be as high on my priorities list as this workaround was
I will most likely open a new thread in the next couple of days, stating my findings regarding the phone/boot image/bootloader.

@JoseVigil @laufersteppenwolf
I'm New In Rom Developing . But I Think This Can Help You To Find Security Checks

I need lg g pro lite dual d686 custom twrp recovery i cant find anywhere plz provide working recovery link for d686 as iam new it seems custom recovery for specific d686 dosnt exits so share tested link for d686
Sent from my LG-D686 using xda Forums PRO

Hello I need boot on charge on my LG E460 with MTK. I done ipod change, rctd replace from laufersteppenwolf file without results. I can't went into fastboot mode of course to set oem mode charge for 0
Phone have root, bootloader unlock, busybox and supersu. Any suggestions?

Maxjimme said:
I need lg g pro lite dual d686 custom twrp recovery i cant find anywhere plz provide working recovery link for d686 as iam new it seems custom recovery for specific d686 dosnt exits so share tested link for d686
Sent from my LG-D686 using xda Forums PRO
Click to expand...
Click to collapse
TWRP RECOVERY
http://forum.xda-developers.com/optimus-g-pro/d680-development/d686-unsecured-boot-img-twrp-2-8-7-x-t3163144

Same Problem here with LG E460. Is there a solution for fastboot mode with this device?

hi, do you think this script could work on a LG G Pro 2 ?

hi guys, any chance i could get this working on a chinese mediatek device running kitkat 4.4.2 ??

How I got my Sprint LG G2 (LS980) to work on T-Mobile - Guide with Screenshots

I have a Sprint LG G2 (LS980) that I wanted to use on T-mobile. There is a ton of info scattered in various threads on achieving bits and pieces of this task, but nothing I could follow straight through to get it done. I did not come up with any of the info in here, I just assembled it to form a guide that I used to successfully get my LS980 working on T-Mobile. Thanks to all the hard work of everyone else who wrote the apps I used, and those who came up with the exploits that made it all possible.
(Also, I wrote this in HTML before I realized I had to use BBCode here. I used a HTML to BBCode converter, so if something looks formatted weird, let me know, I might have overlooked it)
Apps Used
RootBrowser
RadioSwitcher
RootChecker
ChangeAPN
ROMToolbox Lite
Flash Stock Rom
Based on steps here.
Downloads
Download firmware and dll files for your specific phone model
I used LS980ZVA_01.tot& LGLS980_20130904_LGFLASHv151.dll
Download LGDrivers
File name: 'LGUnitedMobileDriver_S51MAN313AP22_ML_WHQL_Ver_3.13.2.exe'
Original article says to get the Verizon Drivers if you're doing a verizon phone, however since I'm dealing specifically with the Sprint LS980 I didn't get them.
Download LGFlashTool v1.8
Download MegaLock.dll
Install LG Drivers
Run the downloaded file 'LGUnitedMobileDriver_S51MAN313AP22_ML_WHQL_Ver_3.13.2.exe'
Click Next through the prompts, they require no real configuration.
If successful, you should get a prompt:
LG United Mobile Driver Installed Successfully.
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Setup LG Flash Tool
Run the downloaded file Setup_LGFlashTool_1.8.1.1023.exe
Click Next through the prompts, nothing needs unique configuration. It will install by default to C:\LG\LGFlashTool\
Copy the downloaded MegaLock.dll from earlier into C:\LG\LGFlashTool, and over-write the one that is already there.
Boot into Download Mode
Plug usb cable to computer
On the phone, hold volume up and plug other end of usb cable into phone
Screen will show 'Download Mode'
The screen will then show 'Firmware Update'
The device is now in Download Mode and ready to be flashed
Configure Port for Phone
Open Device Manager and expand Ports (COM & LPT)
Right click LGEAndroidNet USB Serial Port and choose Properties
In the Properties window click the Port Settings tab, then click Advanced
In the Advanced Settings window, set the COM Port Number to COM41 and click OK
The entry in Device Manager should show as having COM41 now.
Flash the Phone
Run LGFlashTool as Administrator
"C:\LG\LGFlashTool\LGFlashTool.exe"
In the Model Config window that opens:
Check Select Manual Mode
DLL:"C:\LG G2\LGLS980_20130904_LGFLASHv151.dll"
S/W:"C:\LG G2\LS980ZVA_01\LS980ZVA_01.tot"
Click Ok
In the LG Flash Tool screen click the Yellow Arrow to Start
The Port 1 box should, after a second, show Ready!
If the Port 1 box does not start showing processing after a few seconds, unplug the phone then plug it back in. This should start it.
As it processes, the phone may reboot a couple times (I never counted how many times)
At 94% my phone will restart, and the app will show 'Waiting 120 sec for reboot'. When the phone restarts at this point, it is loaded into the OS and waiting to be configured. I have never gotten the Flash Tool it to hit 100% successfully, despite being in the phone. I have not seen this to be a problem yet.
Once inside the phone, close the Flash Tool.
Root the Device
The device has to be in debug mode before it can be rooted with this method.
Enable Debug Mode
Open Apps| Settings
Select About Phone
Choose Software Information
Click Build Number 7 times. After about 4 clicks you will see feedback indicating remaining clicks until you are a developer
You are now 3 steps away from being a developer.
Click to expand...
Click to collapse
After 7 clicks, you will see a popup that says:
You are now a developer!
Click to expand...
Click to collapse
Back out to the root of Settings and choose Developer options
In the Developer Options, check USB Debugging
Root the device
Download IOroot here.
Extract the downloaded ioroot.zip
Run ioroot.bat as Administrator
A cmd window will launch and show:
enable ADB connection..
Developer Options unlocked and ON.
USB debugging ON.
Accept RSA key fingerprint.
Press any key to continue...
Click to expand...
Click to collapse
On the Phone, click OK when prompted for Allow USB Debugging?
On the Computer, press ENTER to advance the batch
The batch script will next pause showing:
USB Connection Mode needs to be toggled.
Toggle USB mode to another setting and then back again.
Ex.
Charge Mode to MTP then MTP back to Charge.
Ethernet Mode to MTP then MTP back to Ethernet.
Sometimes unplugging USB and then plugging back in helps.
Then press ENTER to confirm ADB root...
--------------------------------------------------------
Click to expand...
Click to collapse
On the Phone, switch the USB mode to a different option,then switch it back.
On the Computer, press ENTER to advance the batch script
The batch will show:
adbd is already running as root
uid=0(root) gid=0(root)
If you do NOT see uid=0(root) gid=0(root) above then
it is likely your device firmware is not supported or
USB mode was not toggled properly. You can try to
run the script again or..
PRESS CTRL+c to stop this script...
If you DO see uid=0(root) gid=0(root) mentioned above...
CONGRATS.. Rooted ADB is now confirmed.
You will have a rooted ADB shell but no apps on the
phone will be able to access root functions.
PRESS ENTER to backup EFS and continue with full root.
PLEASE NOTE!
Continuing with full root can trip LG's rootchecker.
This means your phone will show ROOTED in Download mode.
You can remove root flag by flashing stock firmware...
.bin .cab .tot or .kdz
If you do not want to possibly invalidate your warranty
press CTRL+c to stop this script...
--------------------------------------------------------
Press any key to continue . . .
Click to expand...
Click to collapse
Make sure you see uid=0(root)gid=0(root) as shown in the screenshot above
Press Enter to continue The script will next show:
Backing up EFS...
6144+0 records in
6144+0 records out
3145728 bytes transferred in 0.626 secs (5025124 bytes/sec)
6144+0 records in
6144+0 records out
3145728 bytes transferred in 0.617 secs (5098424 bytes/sec)
2978 KB/s (3145728 bytes in 1.031s)
2977 KB/s (3145728 bytes in 1.031s)
________________________________________________________
EFS partitions now in ioroot folder on computer
named modemst1.img and modemst2.img
They will come in handy in case of an emergency.
Store them somewhere you won't lose them.
Press ENTER to continue with full root.
--------------------------------------------------------
Press any key to continue . . .
Click to expand...
Click to collapse
Press Enter to continue
The script will show:
Mounting system, pushing su binary...
2525 KB/s (121260 bytes in 0.046s)
WARNING: generic atexit() called from legacy shared library
0 KB/s (629 bytes in 1.000s)
Rebooting Phone.
________________________________________________________
You should hopefully now be fully rooted!!
IOroot complete.
Confirm root with Root Checker app from Play Store.
--------------------------------------------------------
Press any key to continue . . .
Click to expand...
Click to collapse
The phone should reboot and be rooted now.
Check Root with Root Checker
If nothing went wrong, the phone should be rooted now. To make sure, we can use Root Checker. (there are probably other apps that will do this as well, but I used this one)
Download, install, and launch RootChecker
In the application, click Verify Root
It should return back showing
Congratulations! this device hasroot access!
Click to expand...
Click to collapse
Unlock SIM
Steps here are from this article. I am just writing it out here with notes that helped me.
Download and install Root Browser (I only had success using version 2.2.3.)
Download ls980SIMunlockFinal.rar
Extract ls980SIMunlockFinal.rar (I used 7-zip)
Replace 'Carrier' folder
Within the extracted contents, copy the 'Carrier' folder onto the phones internal storage (I copied it to Internal Storage\Downloads)
On the Phone, open Root Browser and navigate to where the Carriers contents were copied
Note: My screenshots show me copying the files from where I copied the files to in Internal Storage\Downloads (storage\sdcard0\Downloads)
Click Storage
Click sdcard0
Click Download
Long press carrier
Click copy
Click the green back arrow until you're back at root
Click Paste
When prompted, choose to overwrite.
Note: Alternatively, you could rename the original 'carrier' folder for safekeeping... I never did though.
carrier already exists. Do you want to overwrite it?
Click to expand...
Click to collapse
Reboot the phone.
Replaceapns-conf.xml
From original post - "To make APNs stick automatically"
Note: I later add a new APN, despite having replaced the apns-conf.xml here. I honestly don't know if this step is necessary for that reason, but I did it in my process, so I'm adding it here.
Within the extracted contents, copy the apns-conf.xml onto the phones internal storage (I copied it to Internal Storage\Downloads or root\storage\sdcard0\download)
On the Phone, open Root Browser and navigate to where the apns-conf.xml was copied
Long press the apns-conf.xml and choose copy
Navigate to root\etc, and click paste
When prompted to overwrite, choose Yes
Note: Again, you could rename the original to keep a backup.
Navigate to root/data/data/com.android.providers.telephony/databases
Delete/Rename telephony.dband mmssms.db
Note: I didn't actually delete the telephony.db and mmssms.db originally, and I still had success. But I also don't know what deleting those so they can be rebuilt does, so I included the steps.
Reboot the phone.
Update build.prop
Backup build.prop
Open Root Explorer and navigate to root\system
Long press build.prop and choose Copy, then click Paste to create a backup.
Edit build.prop
Download and install ROMToolbox Lite.
We're going to use the Build Properties application included in the Toolbox for editing the build.prop.
Open Root Explorer and navigate to root\system
Click build.prop and choose to open with Build Properties
If you get the Welcome screen, click OK
Locate and click on each of the following settings, and set the Value as shown below, and click Save
persist.service.crash.enable=1
ro.build.target_operator=spr
ro.carrier=spr
Reboot the phone.
Switch the Radio
Download and install RadioSwitcher (I only had success with version 1.2.)
Open Radio Switcher, and set the Preferred network type to LTE/GSM/WCDMA
Create a New APN
Despite replacing the apns-conf.xml earlier, I still ended up having to create a new APN.
Download, install, then open ChangeAPN
Click Menu and choose New APN
Here are the settings I used in the APN from here
Name:*T-MOBILE
APN:*epc.tmobile.com
Proxy:<Leave in Blank>
Port:*<Leavein Blank>
Username:*<Leavein Blank>
Password:*<Leavein Blank>
Server:*<Leavein Blank>
MMSC:*http://mms.msg.eng.t-mobile.com/mms/wapenc
MMSproxy:*<Leavein Blank>
MMSport:*<Leavein Blank>
MCC:310
MNC:260
Authenticationtype:*<Leavein Blank>
APNtype:default,supl,mms
APNProtocol:Leave it to the Default one
Click to expand...
Click to collapse
Click Menu then Save
Reboot the phone
Notes
After all of this was complete, I had the LS980 working on my T-Mobile SIM card successfully. Some other threads I've read discussed installing recoveries like TWRP to make a backup, but every time I tried, it ended up causing a boot loop, so I ultimately didn't do it. From what I can tell it is not a necessity to simply get the phone to work on T-Mobile. Once all the settings/changes have been made, I just popped in my SIM Card from my other phone and it worked fine.
Known Issues
Since we got it running on T-Mobile, there are a few issues that we've been facing.
Unable to call some numbers
When trying to make calls, ff the number does not have a 1 at the beginning, I get a crash.
Unfortunately, the process com.android.phone has stopped.
Click to expand...
Click to collapse
Adding a '1' before the number has corrected it.
This article lists another possible more permanent fix, that I will eventually try out:
If you want to fix this manually, Follow the following fix found by jsergio123)
*To fix the issue of the com.android.phone process crashing when you don't dial a 1 in front of the number edit the /data/data/com.android.providers.settings/databases/settings.db file with a SQLlite editor and change in the "system" table "assist_dial" and "assist_dial_init_db_check" to "0". If you don't see those 2 rows then you can add them. Fix permissions, wipe cache and reboot.
Click to expand...
Click to collapse
Text Messages, and Multimedia Messages Fail to send
When trying to send texts, or picture messages, I was getting regular failures.
This article had a solution.
1. In dialer press ##443336772#, you will get a 6 digit SPC code, remember it!
2. In dialer press ##DATA# , this will take you to hidden Data settings
3. Select MMSC
4. Hit Edit, you will be prompted for your SPC code, enter it
5. Now have 3 options: Set URL, Gateway, and Set Port. Set all
My working settings:
Set URL: http://mms.msg.eng.t-mobile.com/mms/wapenc
Gateway: 10.12.0.2
Set Port: 80
6. Reboot

3g not working on My lg g2 ls980 plz solve it.

Moin. said:
3g not working on My lg g2 ls980 plz solve it.
Click to expand...
Click to collapse
See the section of the article on switching your radio.

Thank you Fuzz1303. This is, without question, the most thorough tutorial available for using an LS980 on a domestic GSM carrier. After weeks of trying to piece together various threads explaining the process, I stumbled upon your tutorial and BINGO, it was a cake walk. Again, thank you.
Now that it's done, will the unlock stick through custom ROM flashing? I have installed TWRP.

bibbin said:
Thank you Fuzz1303. This is, without question, the most thorough tutorial available for using an LS980 on a domestic GSM carrier. After weeks of trying to piece together various threads explaining the process, I stumbled upon your tutorial and BINGO, it was a cake walk. Again, thank you.
Now that it's done, will the unlock stick through custom ROM flashing? I have installed TWRP.
Click to expand...
Click to collapse
I dealt with the same sort of headache flashing mine, so I'm glad this helped.
As for the unlock sticking, I'm not totally positive. I never played much with the custom roms just as I kept having issues and finally got tired of battling it.

It is easier to get a Nexus 5 instead.

Fuzz1303 said:
I dealt with the same sort of headache flashing mine, so I'm glad this helped.
As for the unlock sticking, I'm not totally positive. I never played much with the custom roms just as I kept having issues and finally got tired of battling it.
Click to expand...
Click to collapse
Once again, thanks for this spectacular tutorial. FYI, my G2 is still chugging along strong and I'm safely running Resurrection Remix. I started with Lollipop and moved on to Marshmallow. So happy. Thanks.

I need help, I just get "adbd cannot run as root in production builds
uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:toolbox:s0" and have no idea how to fix... help please!