Code:
[B][I][COLOR="Red"][SIZE="3"]I am not responsible for bricked devices, dead HDDs, animals
activist campaigns, or any H/W damage caused by you following these
directions. YOU are choosing to make these modificiations, and
you, yourself take responsibility for doing these modifications
to your device.
You can do serious H/W damage to your SATV or even your computer
by doing any of this. So, you have been warned! [/SIZE][/COLOR][/I][/B]
First of all, you should pay your thanks to @Luxferro for mapping out the entire partition array, and building the chart that does all the calculations for using another disk size.
He also proved that it was indeed possible to modify your GPT header to another sized drive.
None of this would have been possible, if it was not for him.
Also thanks to @Tilator for initiating his thread, and proving it was possible to swap your HDD for something else.
1. Preparations and disassembling the SATV
Well, to begin with you should have a working linux environment set up. This can easily be a live CD/DVD/USB. Or you can do it from a virtual environment. You can use DD for Windows now, follow guide as normally.
You should have a hex editor with CRC32 calculating capabilities. I recommend HxD:
https://mh-nexus.de/en/downloads.php?product=HxD
Yes, that is for Windows, I use Linux for all the writing/dumping, but I prefer my Windows hex editor.
It's worth to know, that your device should be bootloader unlocked, and preferably newly factory reset.
Also, an autotool has been made now to do this GPT header edit. See post #3.
Then you can go open up the SATV by prying off the bottom of the casing. I managed to do this with my fingernails. A small plastic pry tool can be used as well.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Then you remove the 2 wire sets from the plugs to give more working room. There is 2 sets of tape holding the wires and the HDD in place as well.
There is (on mine at least) just one screw with a small bracket holding the HDD in place, you will need a T6 driver to remove it.
Gently lift the black latch/lock on the connector to the secondary board, then the FCC connector will be easily out.
Then it is just a matter of gently loosening the adhesive on the FCC strip from the HDD and pull out the SATA connector.
With the HDD out, you will have to connect it to your Linux setup somehow. I used an enclosure with a USB3 connection.
With the HDD recognized in the computer, the time has now come to clone you HDD.
You could as well use the bin files Tilator has provided, but if you want your own genuine Netflix ESN, you should use your own.
If you want to use DD for Windows, please continue the guide from post #2. After finishing that part, come back to this post and skip to the hex editing part.
2. Dumping the data from the SATV SSHD
In a terminal window you start by listing the drives:
Code:
sudo -s
fdisk -l
This is to determine which drive you are working with. Remember that the DD command does't care which drive you specify, it will destroy your main drive if you ask it to.
The you continue by dumping the first 6899870 blocks of data to a bin file:
Code:
dd if=/dev/sd[B]X[/B] of=firstpart.bin count=6899870
This will give you a raw image file of all the partitions up until the /data partition which is better left out (it will come later).
Then continue by dumping the last 5120 bytes of data which contains the partition array and the GPT header:
Code:
dd if=/dev/sd[B]X[/B] bs=512 skip=976773158 of=lastpart.bin
EDIT: 26th August 2016, @anchung.chen has experimented with aligning the partitions to Advanced Format 4096 byte sectors (4K alignment). This supposedly gives better performance especially on SSD drives.
It's worth to know that this most likely breaks the OTA updates, as they might write partitions on block level rather than on a file level. OTA updates seems to be working.
Also, anchung.chen has had problems unlocking the bootloader on the 4K aligned disk.
@ahmed68
Reports that TWRP doesn't work well when trying to flash SuperSU.
Please see follow these steps to write the bin files with 4K alignment:
Start by downloading the ELF executable programmed by anchung.chen from this post:
http://forum.xda-developers.com/showpost.php?p=68300570&postcount=44
Patch the lastpart.bin the following way (2TB disk size):
Code:
./shield_pro_new_disk_gpt_calculator-0.3 lastpart.bin [B]2000398934016[/B] lastpart4k.bin
This will recalculate the GPT header to match the 2TB disk, but also rewrite the partition array.
Then continue by writing the firstpart.bin in 2 steps instead of just one:
Code:
if=firstpart.bin of=/dev/sd[B]X[/B] bs=512 count=69888
Code:
dd if=firstpart.bin of=/dev/sd[B]X[/B] bs=512 skip=69790 seek=69888 count=6830080
These 3 steps effectively moves the partitions 16-32 to match 4K alignment structure.
And finish off by writing the lastpart4k.bin:
Code:
dd if=lastpart4k.bin of=/dev/sda[B]X[/B] bs=512 seek=[B]3907029158[/B]
This completes the guide, no more steps needed.
You can now disconnect your HDD. These 2 files also counts as a backup of your SATV (not with settings as userdata was not copied).
Now connect your new SSD in the enclosure.
You can easily start by writing the firstpart.bin:
Code:
dd if=firstpart.bin of=/dev/sd[B]X[/B]
3. Hex-editing the partition array and the GPT header
In your linux terminal load up the block count (called sectors in linux language) of the new drive:
Code:
fdisk -l
A 2 TB disk should have a total block count of 3907029168, but a smaller disk would have a smaller block count, so use fdisk -l to determine this.
Or if you use DD for Windows you have the output from dd --list to work with.
The lastpart.bin must be edited before we can write it on the new disk.
So use the spreadsheet provided by @Luxferro in this post:
http://forum.xda-developers.com/showpost.php?p=67996717&postcount=189
In the column at the buttom right that says disk size, you change the value to match you new disk. In this example for the 2TB it should be 2000398934016 (bytes). This value should be taken from fdisk -l as well.
Now it gets a little hairy!
In the spreadsheet you should start with the buttom value marked out in purple under the row called "Last LBA". This should be E8E0888E:
Open up lastpart.bin in HxD and navigate to offset 00000FA8. There you should find the 4 bytes 0E 60 38 3A illustrated in this picture:
This value is in a format called reverse byte ordering, so to put in your new calculated value, you will have to arrange it like this: 8E 88 E0 E8. Input that value instead of the bytes already there like this picture:
While we are in this particular position in the lastpart.bin we might as well do the CRC32 of the partition array.
Now make a selection containing the 64 bytes or 4 empty lines underneath the line having UDA written in ASCII, and all the way to the top of the file, offset 00000000 to 00000FF0 like in this picture:
In the drop-down menu, choose Analyzis->Checksums and generate a CRC-32 checksum (Not checksum-32).
It will come up in the buttom screen of HxD, and should read 6B CF E5 7D
Navigate to the buttom of the file which contains the GPT header. It should start with an ANSI text reading "EFI PART".
In offset 00001258 you should find the value of the original CRC-32 value containing the bytes 0E 02 C5 DC.
Replace this, again reversing the bytes from your newly calculated CRC-32 value like this: 7D E5 CF 6B:
Now we are actually almost finished! In the spreadsheet all the way to the right, you will find 4 hexadecimal values marked in purple.
First is the position of the GPT header, and the second is the position of the backup GPT header. Since there is only 1 on the SATV, these values are both the same.
Write them into the GPT header on offset 00001218, and 00001220, again reversing the bytes like illustrated in the picture:
Same goes for offset 00001230, Last Usable LBA, and offset 00001248, Starting LBA of array of partition entries.
This brings us to the last thing on the table, the CRC32 of the GPT header itself.
The CRC is located on offset 00001210 and should have the bytes 46 C9 88 78 already there.
Just write 00 00 00 00 to blank them out:
Now make a selection of the GPT header containing the beginning of the header, and to the last written byte before all the zeroes:
In the drop-down menu, choose Analyzis->Checksums and generate a CRC-32 checksum (Not checksum-32).
It will come up in the buttom screen of HxD, and should read 46 9F 24 38
Again, write it instead of the 4 bytes with zeroes reversed like this:
This completes the matter, now just save your work in HxD and write it to the end of your drive.
To do this we need the total block count from the HDD that you fetched in the beginning of the guide from the fdisk -l output, should be 3907029168
The lastpart.bin is 5120 bytes which is the same as 10 blocks of 512 byte length.
So, 3907029168 minus 10 is 3907029158 and put into your DD-line like this:
Code:
dd if=lastpart.bin of=/dev/sda[B]X[/B] bs=512 seek=[B]3907029158[/B]
Or like this if you use DD for Windows:
Code:
dd if=lastpart.bin of=\\?\Device\Harddisk[B]X[/B]\Partition0 bs=512 seek=[B]3907029158[/B]
4. Assembling SATV and finishing up
Now at last, put in your new disk in the SATV and assemble everything back together.
If it doesn't boot in the first try, you could try another cold boot (give it 15 min.).
If that won't do it, you might have to wipe the DATA partition from the fastboot menu.
To cold boot into fastboot, follow this (taken from "http://developer.download.nvidia.com/mobile/shield/ROM/SHIELD_ATV/OTA-1.1/HowTo-Flash-Recovery-Image.txt"):
Code:
HW method:
- Disconnect power cable
- Insert USB OTG cable and make sure to connect other end to a host PC
- Connect power cable to SHIELD
- Quickly start pressing power button for ~3 seconds
- Do not hold the button and connect power supply afterwards
- HDMI TV should be always connected to SHIELD
And format the /DATA partition from fastboot like this:
Code:
fastboot format FS:EXT4 /data
Or do a fastboot oem unlock of the SATV.
Hopefully you will now have a SATV with an upgraded SSD/HDD!
DD for Windows part
Guide for Windows, using dd for Windows by John Newbigin
Download the dd utility from: http://www.chrysocome.net//dd
Code:
[SIZE="4"]
[COLOR="Red"]
WARNING! Using DD for Windows from a command prompt with administrator privileges is DANGEROUS!
If you specify your Windows drive as output file/device, it WILL destroy the partition!
[/COLOR]
[/SIZE]
Code:
[B][I][COLOR="Red"][SIZE="3"]I am not responsible for bricked devices, dead HDDs, animals
activist campaigns, or any H/W damage caused by you following these
directions. YOU are choosing to make these modificiations, and
you, yourself take responsibility for doing these modifications
to your device.
You can do serious H/W damage to your SATV or even your computer
by doing any of this. So, you have been warned! [/SIZE][/COLOR][/I][/B]
So, I used a Windows 10 Pro environment to test this. I think any Windows version based on the NT architecture will be working.
Extract the dd.exe and as the path you want to extract to, use this: "%USERPROFILE%\AppData\Local\Microsoft\WindowsApps"
This gives you the ability to use DD system wide.
Plug in the HDD from your SATV. The disk will be unreadable to Windows as it has no known filesystem. Windows might pop up asking you to format the drive. You MUST ignore that, and press cancel!
Open up a command prompt with administrator privileges. You can do this with Windows key+X to bring up a menu, then choose Command Prompt (administrator).
Navigate to a folder where you want to work from. It doesn't matter where, as you just have to have space enough to store the bin files.
If you need a refreshment in navigating the commnd prompt, you can read up on it here:
http://www.pcstats.com/articleview.cfm?articleid=1723&page=3
Now, run the command
Code:
dd --list
This gives you a lot of information. It even gives you the total byte count of your harddisk drives.
Navigate a little up to locate the right disk:
In this example I didn't use my SATV HDD, but another 750GB HDD I had lying around. The SATV SSHD will have a size of 500107862016 bytes.
Be careful that you choose the right drive to work on, and you also have to find the one that has the device string "\\?\Device\HarddiskX\Partition0".
And X will have to be equivalent to the harddisk number that Windows has assigned to your device.
The you continue by dumping the first 6899870 blocks of data to a bin file:
Code:
dd if=\\?\Device\Harddisk[B]X[/B]\Partition0 of=firstpart.bin count=6899870
This will give you a raw image file of all the partitions up until the /data partition which is better left out (it will come later).
Then continue by dumping the last 5120 bytes of data which contains the partition array and the GPT header:
Code:
dd if=\\?\Device\Harddisk[B]X[/B]\Partition0 of=lastpart.bin skip=976773158 bs=512
You can now disconnect your HDD. These 2 files also counts as a backup of your SATV (not with user settings, data partition was not copied).
Now connect your new SSD in the enclosure. Use dd --list again to determine the right disk to use, and please be careful not to mix up your Windows drive or another drive which contains important data.
You can easily start by writing the firstpart.bin:
Code:
dd if=firstpart.bin of=\\?\Device\Harddisk[B]X[/B]\Partition0
Please continue the rest of the guide in first post.
Hi All:
Thank Luxferro, Tilator and hallydamaster for your hard works, so we could replace the SSHD on shield-pro-tv with any SSD or HHD.
I wrote a small program to do all calculations and generate the new lastpart.bin directly.
usage : ./shield_pro_new_disk_gpt_calculator Input_bin_file New_disk_size_in_byte Output_bin_file
It is for 64-bit Linux PC. Any comments are welcome. And if you like, the source code will be opened.
Well, I think it is quite straightforward to use it. This program just generates the modified lastpart.bin from your original lastpart.bin and disk size (byte) of new SSD/HHD which you will migrate to.
For example of hallydamaster guide, the new 2TB disk has 2000398934016 bytes and 3907029168 sectors. Then
Using following command to generate the correct lastpart.bin for the new 2TB disk.
Code:
./shield_pro_new_disk_gpt_calculator lastpart.bin 2000398934016 new_lastpart.bin
Using following command to write the correct lastpart.bin to the new 2TB disk.
Code:
sudo dd if=new_lastpart.bin of=/dev/sdX bs=512 seek=3907029158
Thanks for the guide.
Does anyone know the performance penalty for using a regular 2TB HDD?
anchung.chen said:
Hi All:
Thank to Luxferro, Tilator and hallydamaster hard works, so we could replace the SSHD on shield-pro-tv with any SSD or HHD.
I wrote a small program to do all calculations and generate the new lastpart.bin directly.
usage : ./shield_pro_new_disk_gpt_calculator input_bin_file disk_size_in_byte output_bin_file
It is for 64-bit Linux PC. Any comments are welcome. And if you like, the source code will be opened.
Click to expand...
Click to collapse
Well, I suppose we have the guide for educational purposes then!
Please, tell something about how to use it.
tech3475 said:
Thanks for the guide.
Does anyone know the performance penalty for using a regular 2TB HDD?
Click to expand...
Click to collapse
I know that another user here @ahmed68 just did his with a SATV, AFAIK.
I don't think it was an SSD atleast.
hallydamaster said:
Well, I suppose we have the guide for educational purposes then!
Please, tell something about how to use it.
Click to expand...
Click to collapse
Well, I think it is quite straightforward to use it. This program just generates the modified lastpart.bin from your original lastpart.bin and disk size (byte) of new SSD/HHD which you will migrate to.
For example of your guide, the new 2TB disk has 2000398934016 bytes and 3907029168 sectors. Then
Using following command to generate the correct lastpart.bin for the new 2TB disk.
Code:
./shield_pro_new_disk_gpt_calculator lastpart.bin 2000398934016 new_lastpart.bin
Using following command to write the correct lastpart.bin to the new 2TB disk.
Code:
sudo dd if=new_lastpart.bin of=/dev/sdX bs=512 seek=3907029158
anchung.chen said:
Hi All:
Thank Luxferro, Tilator and hallydamaster for your hard works, so we could replace the SSHD on shield-pro-tv with any SSD or HHD.
I wrote a small program to do all calculations and generate the new lastpart.bin directly.
usage : ./shield_pro_new_disk_gpt_calculator input_bin_file disk_size_in_byte output_bin_file
It is for 64-bit Linux PC. Any comments are welcome. And if you like, the source code will be opened.
Click to expand...
Click to collapse
have any example how to use it or only run in term ./shield_pro_new_disk_gpt_calculator input_bin_file disk_size_in_byte output_bin_file
plz help I wont to gen gpt for 64gb sd card. I have boot.img for sd card and usb only for l4t Ubuntu thanks.
ahmed68 said:
have any example how to use it or only run in term ./shield_pro_new_disk_gpt_calculator input_bin_file disk_size_in_byte output_bin_file
plz help I wont to gen gpt for 64gb sd card. I have boot.img for sd card and usb only for l4t Ubuntu thanks.
Click to expand...
Click to collapse
You are supposed to do:
Code:
./shield_pro_new_disk_gpt_calculator lastpart.bin 68719476736 lastpart64gb.bin
But take the byte value you get from your own fdisk -l output.
Also, if you are going to use this for Linux and not android, I don't think it will work. The GPT layout that the SATV Pro uses is not standard.
hallydamaster said:
You are supposed to do:
Code:
./shield_pro_new_disk_gpt_calculator lastpart.bin 68719476736 lastpart64gb.bin
But take the byte value you get from your own fdisk -l output.
Also, if you are going to use this for Linux and not android, I don't think it will work. The GPT layout that the SATV Pro uses is not standard.
Click to expand...
Click to collapse
hallydamaster thank you for help
now i use the orig. sshd under ubuntu 14.04 L4T 24.1 i wont to make sdcard for linux and sshd for android to use shield in 4k tv android the best .
I think Nvidia should put boot loader and kernel on internal emmc's for both 16GB and 500GB SATVs rather than keeping significantly different ROM versions for 16GB and 500GB SATVs.
It'd save Nvidia and users time by doing so.
It seems much simpler to add HDDs of any size to 16 GB SATV if the HDD cable is available.
yahoo2016 said:
I think Nvidia should put boot loader and kernel on internal emmc's for both 16GB and 500GB SATVs rather than keeping significantly different ROM versions for 16GB and 500GB SATVs.
It'd save Nvidia and users time by doing so.
It seems much simpler to add HDDs of any size to 16 GB SATV if the HDD cable is available.
Click to expand...
Click to collapse
I certainly agree with that, seems they had a brain fart when deciding how to build the pro. Could be great if we could somehow convert the pro version to boot from internal EMMC.
hallydamaster said:
I certainly agree with that, seems they had a brain fart when deciding how to build the pro. Could be great if we could somehow convert the pro version to boot from internal EMMC.
Click to expand...
Click to collapse
I have serial console print out from 16GB SATV:
http://forum.xda-developers.com/showpost.php?p=67973969&postcount=303
I'm wondering what the output would be for SATV Pro when the HDD is disconnected.
If the first stage boot loader (TegraBoot?) is smart enough, it could check emmc for boot loader.
yahoo2016 said:
I have serial console print out from 16GB SATV:
http://forum.xda-developers.com/showpost.php?p=67973969&postcount=303
I'm wondering what the output would be for SATV Pro when the HDD is disconnected.
If the first stage boot loader (TegraBoot?) is smart enough, it could check emmc for boot loader.
Click to expand...
Click to collapse
That's indeed interesting, lot of info in that output!
I'm pretty sure that @Tilator had someone send him a copy of a complete rip of the EMMC from a 16GB SATV.
He then wrote it to the EMMC on the Pro, which is just empty. It didn't boot with it, but I'm not sure if he tried booting it without the HDD in it.
Cloud be interesting to try though.
Unfortunately I don't really have the time to read up on UART and solder wires on my board to try this. :-/
Not for the time being at least.
i will try to flash satv pro from satv and see it must save in emmc , I wont to make sd card like recovery for satv and satv pro I try repack the partition but bot work I need to edit boot.img #include <sys/mount.h>
#include <unistd.h>
#include <linux/reboot.h>
#include <fcntl.h>
extern char **environ;
int main(int argc, char **unused) {
mount("/dev", "/dev", "devtmpfs", 0, NULL);
mount("/dev/mmcblk0", "/dest", "ext4", 0, NULL);
// mount Android system
// mount("/dev/mmcblk0p1", "/mnt", "ext4", 0, NULL);
mount("/dev", "/dest/dev", NULL, MS_BIND, NULL);
chroot("/dest");
chdir("/");
char * const argv[] = { "/sbin/init", NULL };
execve(argv[0], argv, environ);
}
must change mmcblk0 to mmcblk0p1 ,mmcblk1p1 or sda21/32
---------- Post added at 08:40 PM ---------- Previous post was at 08:20 PM ----------
I take this flash.sh from tegra jetson-tx1
flash.sh: Flash the target board.
# flash.sh performs the best in LDK release environment.
#
# Usage: Place the board in recovery mode and run:
#
# flash.sh [options] <target_board> <root_device>
#
# for more detail enter 'flash.sh -h'
#
# Examples:
# ./flash.sh <target_board> mmcblk0p1 - boot <target_board> from eMMC
# ./flash.sh <target_board> mmcblk1p1 - boot <target_board> from SDCARD
# ./flash.sh <target_board> sda1 - boot <target_board> from USB device
# ./flash.sh -N <IPaddr>:/nfsroot <target_board> eth0 - boot <target_board> from NFS
# ./flash.sh -k LNX <target_board> mmcblk1p1 - update <target_board> kernel
# ./flash.sh -k EBT <target_board> mmcblk1p1 - update <target_board> bootloader
can anybody edit the boot.img to
1. mmcblk0p1 for emmc
2. mmcblk1p1 for sdcard
I think its most work
i flash satv pro from satv i now it come not bootable then i will remove hdd and boot to linux when run sudo fdisk -l i see 2 part of hdd first mmcblk0 (emmc) and sdx its sda in android by dd if=/dev/sdx of=firstpart.bin count=6899870
then dd if=firstpart.bin of=/dev/mmcblk0 and dd if=lastpart.bin of=/dev/mmcblk0 bs=512 seek=xxxxx (xxxxx i will take it from fdisk -l -10) then i most to delete boot patition from sda by sudo fdisk /dev/sda21 # input d , w .
now we have a work satv non pro , i need to use ubuntu in emmc and android in sda for that we must make the first boot img for dualOS like (Geekbox Lollipop Lubuntu dualOS)
http://forum.geekbox.tv/viewtopic.php?f=12&t=3198
anybody have any edia plz help.
ahmed68 said:
now we have a work satv non pro
Click to expand...
Click to collapse
You can boot to Android from emmc (mmcblk0) of SATV Pro without HDD?
Does recovery mode work for SATV Pro without HDD?
Is this fix working with the 3.2 update from a few weeks ago? I'd like to duplicate more of my movies onto my SATV Pro now that the Plex Server is installed.
ahmed68 said:
i flash satv pro from satv i now it come not bootable then i will remove hdd and boot to linux when run sudo fdisk -l i see 2 part of hdd first mmcblk0 (emmc) and sdx its sda in android by dd if=/dev/sdx of=firstpart.bin count=6899870
then dd if=firstpart.bin of=/dev/mmcblk0 and dd if=lastpart.bin of=/dev/mmcblk0 bs=512 seek=xxxxx (xxxxx i will take it from fdisk -l -10) then i most to delete boot patition from sda by sudo fdisk /dev/sda21 # input d , w .
now we have a work satv non pro , i need to use ubuntu in emmc and android in sda for that we must make the first boot img for dualOS like (Geekbox Lollipop Lubuntu dualOS)
http://forum.geekbox.tv/viewtopic.php?f=12&t=3198
anybody have any edia plz help.
Click to expand...
Click to collapse
Hi ahmed, can you please clarify if you had it boot without the HDD?
You cloned the HDD partitions onto the EMMC? And then removed the boot partition from the HDD, and then it booted anyway?
revoman said:
Is this fix working with the 3.2 update from a few weeks ago? I'd like to duplicate more of my movies onto my SATV Pro now that the Plex Server is installed.
Click to expand...
Click to collapse
This procedure will just clone your HDD to another disk, this should be totally independant from Android, unless ofcourse Nvidia would do something to break this.
Maybe I'm the only one who would like to put a smaller HD on my shield TV. Can someone tell me if a 128GB SSD is larger enough or the smaller disk is 256GB?
TIA Polve
Related
So I got to the part where know I know my partitions are off. Heres what I get with the print command in parted:
Code:
/dev/block/platform/mmci-omap-hs.1 # parted /dev/block/mmcblk0
parted /dev/block/mmcblk0
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk0
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
print
print
Model: MMC M8G2FA (sd/mmc)
Disk /dev/block/mmcblk0: 7734MB
Sector size (logical/physical): 512B/512B
Partition Table: loop
Number Start End Size File system Flags
1 0.00B 7734MB 7734MB ext2
I have the mmcblk0p1.img, mmcblk0p2.img, ect... on my computer. How would one use these to restore the partitions so I can install twrp and install stock os?
Messing with the partition table is one slip away from brickage...
Sent from my SAMSUNG-SGH-I777 using xda premium
Well, I am bricked.
I just said screw it and got a new one free from bestbuy.
http://forum.xda-developers.com/showthread.php?t=1388996
a good reading on cold night. also factory cable is not a bad thing
danij3l said:
http://forum.xda-developers.com/showthread.php?t=1388996
a good reading on cold night. also factory cable is not a bad thing
Click to expand...
Click to collapse
The partition tables got nuked while being stuck in fastboot mode, so a factory cable isn't gonna help anything. Repartitioning when there aren't any partition tables built can't help either.
Hoping to rev FIREFIREFIRE sometime this weekend with a partition table initializer. This plus the USB boot should give people a way out. It's already in there but I don't think the partition map is right. Maybe I could add an extra command for alternate partitioning so we don't run into this problem...
pokey9000 said:
Hoping to rev FIREFIREFIRE sometime this weekend with a partition table initializer. This plus the USB boot should give people a way out. It's already in there but I don't think the partition map is right. Maybe I could add an extra command for alternate partitioning so we don't run into this problem...
Click to expand...
Click to collapse
How would we install a new version of FFF if we don't have any partitions?
You don't. If the partition table is broken, then likely the CPU will default to USB boot, where you can use Rekindle to run FFF.
pokey9000 said:
You don't. If the partition table is broken, then likely the CPU will default to USB boot, where you can use Rekindle to run FFF.
Click to expand...
Click to collapse
Ah. I see what you mean. I'm sending mine back tomorrow anyway, so this will definitely help people who get nuked partition tables from booting unstable-ish kernels.
And FFF can now restore your partition table. Custom partitions is still TBD.
Get it here.
It's best to set "unit mib" in parted!
Thanks to to all for this useful thread. But I have an additional suggestion:
When starting parted and before issuing a 'print' command, one should issue the command:
Code:
unit MiB
which causes parted to print sizes and boundaries in binary megabytes, i.e., 1MiB = 1024KiB, where 1KiB = 1024 bytes, which is the numbering system still used for RAM chips, but not much else, since marketers prefer the numbering system that makes their product appear bigger. That way, the numbers given by parted are exact and non-overlapping. When numbers are entered in conformity with this presentation, they should be written with the suffix MiB, without any space after the number. Please keep in mind that, in this format, the end of one partition is the 1MiB block before the start of the next one. When the default decimal format is used, the end of one partition will be the in the same 1MB block as the start of the next partition, which hides the actual point of division, which could be anywhere in that 1MB block, depending on where an actual binary boundary falls.
Also note that each block is specified by its offset (in MB or MiB) from the beginning of some larger space, probably /dev/block/mmcblk0. It would make more sense to specify the end of a partition as the offset in MiB to the first byte following the partition, as most disk management programs do. I don't know why parted does it differently.
Ok, I posted this question in 2 other threads that had info on the process (will delete the posts when this one goes live), but no responses after a couple of days. One of them is old though.
I have TWRP 2.1.1 installed. ADB seems to be working normally. Superuser is working fine after booting to android. I'm running a custom ICS ROM (Energy); read that stock ROM can cause issues repartitioning.
I started with this How-to as it looked very straight forward.
I start throwing the commands at ADB and here's what I got for my efforts:
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
~ # su
su
/sbin/sh: su: not found
~ # cd /data
cd /data
/data # ls
ls
/data #
decided to go ahead and check the mount command:
Code:
~ # mount
mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
~ #
and parted just for giggles:
Code:
~ # parted /dev/block/mmcblk0
parted /dev/block/mmcblk0
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk0
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
print
print
Model: MMC MMC08G (sd/mmc)
Disk /dev/block/mmcblk0: 7818MB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
1 131kB 262kB 131kB xloader
2 262kB 524kB 262kB bootloader
3 524kB 11.0MB 10.5MB dkernel
4 11.0MB 212MB 201MB ext4 dfs
5 212MB 229MB 16.8MB recovery
6 229MB 296MB 67.1MB ext4 backup
7 296MB 307MB 10.5MB boot
8 307MB 312MB 5243kB ext4 splash
9 312MB 849MB 537MB ext4 system
10 849MB 2041MB 1192MB ext4 userdata
11 2041MB 2309MB 268MB ext4 cache
12 2309MB 7690MB 5380MB fat32 media
(parted)
Ok, so that much worked. Now I tried to shrink 12 so I could double the size of 9. I want to get Switchme set up for his/her profiles and 500MB just isn't going to cut it.
That's when I hit a brick wall:
Code:
(parted) resize 12 2846 7690
resize 12 2846 7690
resize 12 2846 7690
Error: Unable to satisfy all constraints on the partition.
(parted)
One thing that jumps out at me right away is this:
Code:
adb shell
~ # su
su/sbin/sh: su: not found
It seems you are not actually rooted.
To check, enter:
Code:
adb shell
ls /system/xbin
If you don't see "su" in the list, then you don't have root permissions, which would probably prevent you from doing what you need to accomplish.
That's what I was wondering, but apps are able to ask for and receive root permission from within the ROM. SU does exist, just not where the shell is looking when in recovery.
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
~ # ls /system/xbin
ls /system/xbin
ls: /system/xbin: No such file or directory
~ #
I did an ls /system/xbin from adb shell and from Terminal Emulator within Android and both returned a long list containing SU.
TWRP provides an unsecured (unsecure? insecure?) boot. Whatever the terminology, it gives you immediate access to root privileges. Apparently CWMR (which was used in the OP of the thread you used) does not and so that author had to use su. For TWRP, it's not necessary and not even available. You already have root privileges as indicated by the hash prompt.
I tried resizing my /sdcard partition and it worked fine with the command you tried. I'm not sure what's going on with your storage device that it wouldn't resize it for you. At first I thought it might be mounted, but your mount command shows otherwise and parted gave me a different error when I had it mounted.
I don't know if this is going to help you, but you might try giving it the "MB" suffix in your numbers....
Code:
resize 12 2846MB 7690MB
Maybe even try changing units to bytes and giving the resize command byte sized boundaries.
Code:
unit B
print
will show you the numbers in bytes and you'd have to use the "B" suffix as in the "MB" example above.
If none of that works, you can always remove and remake the partition. For example...
Code:
rm 12
mkpartfs primary fat32 <start> <end>
name 12 media
You'd obviously need to insert acceptable boundaries for the start and end into that command. It might even be easier to just remove all 9, 10, 11, and 12 and remake/rename them, but remember 9, 10, and 11 are ext4 filesystems so the above mkpartfs command needs to be tweaked accordingly.
One thing I noticed while I was experimenting with the partition table this morning... all of the existing partitions have been allocated in 128MB chunks. I have no idea if this affects performance. I'd imagine you'd only need to stick to the 512B sector sizes, but you might want to stay with those conventions if it's not too inconvenient for you.
If you mess up the partition table, you can always go back to fastboot mode in FFF and use the...
Code:
fastboot oem format
feature to bring your partition table back to stock.
Good luck.
Wow, excellent response. Just the kind of detail I was hoping to get and it confirmed a few suspicions I had while searching the kindle threads. I'll report back on my degree of success when I get some free time to tinker.
I have a nandroid backup (also saved to PC) just in case and saved the partition table as-found. If everything gets hosed and I do an oem format I can just restore that and go or try from square one again, yes?
Sent from my TBolt with the XDA App using 1 opposable thumb
ProfEngr said:
Wow, excellent response. Just the kind of detail I was hoping to get and it confirmed a few suspicions I had while searching the kindle threads. I'll report back on my degree of success when I get some free time to tinker.
I have a nandroid backup (also saved to PC) just in case and saved the partition table as-found. If everything gets hosed and I do an oem format I can just restore that and go or try from square one again, yes?
Sent from my TBolt with the XDA App using 1 opposable thumb
Click to expand...
Click to collapse
I'd say that's a safe bet. Just be very careful about handling partitions 1 and 2 because those two are critical to getting anything to boot on your device. As long as you don't touch the xloader in partition 1 and have FFF installed in partition 2, you can rebuild the rest of it.... in theory. I only say "in theory" because I've never actually had to do it, but I don't see why it wouldn't work.
A couple of additional things I figured out after you put me to work with parted....
It looks like parted doesn't know how to make an ext4 filesystem, so mkpartfs balks if you tell it to make one. You'll have to use mkpart which just makes the partition, but not the filesystem. Then exit out of parted and use mke2fs, which despite its name knows how to make an ext4 filesystem. Like this for the cache partition...
Code:
mke2fs -T ext4 /dev/block/mmcblk0p11
The other thing is that parted sets a "msftres" flag on the fat32 filesystem it makes. The flag apparently is to tell the OS that it's reserved for Windows, or something like that. I didn't have a problem mounting in Linux and MacOS X, but the stuff I've read seems to indicate that older OS's have a problem with it. Unfortunately, the version of busybox on TWRP doesn't have a module to make a fat32 filesystem. I'm looking around to see how to get around that.
In any case, this should get you most of the way there. I'll followup if I find something out.
Ok. I used to run n*x, but use only M$ right now. Haven't touched a 'mac' since Jr High (IIgs)
Sent from my TBolt with the XDA App using 1 opposable thumb
ProfEngr said:
Ok. I used to run n*x, but use only M$ right now. Haven't touched a 'mac' since Jr High (IIgs)
Sent from my TBolt with the XDA App using 1 opposable thumb
Click to expand...
Click to collapse
I have a IIgs sitting in the basement... but it's not a mac, it's an Apple ][.
Found the last piece...
Code:
/system/bin/newfs_msdos /dev/block/mmcblk0p12
will make a fat32 filesystem correctly. I think that's all you'll need.
EDIT: OK, I must have been half asleep when I posted the above. That binary is on the stock system software I had mounted. There's nothing on TWRP to create a fat32 filesystem correctly.
Yeah, ][e was my first computer that didn't crash at the drop of a keystroke. Had an Adam tape drive model, but it froze up constantly.
Sent from my TBolt with the XDA App using 1 opposable thumb
So, I met with success following the repartition thread and tweaking it with your suggestions. I didn't quite move and many MB around as I thought, but it was enough to move me a little farther down the road with SwitchMe. At least it doesn't tell me I don't have enough memory for a 2nd profile now.
I still think it has issues with ICS or EnergyROM itself. When I created a new profile and rebooted to it I was stuck on Nova launcher instead of GO like the main profile. Strange.
I'll consider this thread to have fulfilled its usefulness. Thanks again for the help.
no device found
ProfEngr said:
So, I met with success following the repartition thread and tweaking it with your suggestions. I didn't quite move and many MB around as I thought, but it was enough to move me a little farther down the road with SwitchMe. At least it doesn't tell me I don't have enough memory for a 2nd profile now.
I still think it has issues with ICS or EnergyROM itself. When I created a new profile and rebooted to it I was stuck on Nova launcher instead of GO like the main profile. Strange.
I'll consider this thread to have fulfilled its usefulness. Thanks again for the help.
Click to expand...
Click to collapse
I get
(parted)
Error: No device found
Retry/Cancel
[How to] determine dd parameters for all LG G4 models
IMPORTANT:
Only for advanced users!
You are an advanced user if you know exactly what you are doing.
You are an advanced user if you know what to do if something went wrong.
You are NOT an advanced user if you know how to do copy+paste.
You can bring your smartphone into a state, so it no longer works.
I am not responsible for anything. The following instructions are only suggestions.
Hello,
everyone knows how to root the LG G4 with the "low effort root" method.
They copied the system partition to an ".img" file, rooted it and copied it back to the "system" partition.
Many users wonder how to get the right parameters for the "dd" commands.
Please read the complete guide and be sure that you understand it until you execute a command!
Information:
Code:
dd if=/inputfile bs=8192 count=12345 of=/outputfile
if = Input File
of = Output File
bs = Blocksize in bytes (default is 512 - to increase copy speed use multiple of 512 e.g. 8192)
count = how many blocks
skip = skip blocks before start reading
seek = skip blocks before start writing
more info: http://man7.org/linux/man-pages/man1/dd.1.html
There are different models of the LG G4 on the market.
We know that the system partition is different depending on the model of the G4.
As an example I will show you how to calculate the parameters for the LG G4 H815 (International Model).
What you need:
Windows with Send_Command.exe
Instructions:
At first we need to know where the "system" partition starts (first sector) and how big it is (partition size).
I used the first method to find these values. But I recommend the second method because it's easier.
First method (difficult method, extracting the GPT and using "gdisk" in linux to read the partition info)
What you need:
Linux with "gdisk" installed
Instructions:
Put your smartphone to "Download Mode" and connect it to the Send_Command.exe command prompt.
We need to copy the partition table to the internal storage.
The partition table of GPT (GUID Partition Table) has a size of 16384 bytes and starts at LBA2.
Each LBA has a size of 512 bytes. Because we start at LBA0 we need to add 1024 bytes.
In summary 16384 + 1024 = 17408 (bytes).
Execute the following command:
Code:
dd if=/dev/block/mmcblk0 bs=1 count=17408 of=/data/media/0/gpt_backup.img
Enter "LEAVE" to restart your phone.
You will find the (very small) file "gpt_backup.img" on your internal storage.
Switch to Linux:
Copy the file to your Linux and open the terminal. Then type this:
Code:
gdisk /yourpath/gpt_backup.img
Some warnings will occur. Ignore them.
You will see:
Code:
Command (? for help):
Enter "p" and hit "enter".
You will get a list of the partitions.
Scroll up a bit and check that you see:
"Logical sector size: 512 bytes"
Scroll down and look for the "system" partition.
You will find a line similar to this:
Code:
47 884736 9363455 4.0GiB FFFF system
Now you know the number of the "system" partition is "47".
You will see:
Code:
Command (? for help):
Type "i" and hit "enter".
You will be asked the partition number.
Enter it and hit "enter".
You will see something conatining lines similar to this:
Code:
First sector: 884736
Last sector: 9363455
Partition size: 8478720
Partition name: 'system'
We need the values from "First sector" and "Partition size".
Second method (easier method, just using "adb shell" to read the partition info)
What you need:
adb shell
usb debugging enabled
To get the "logical sector size" use:
cat /sys/block/mmcblk0/queue/logical_block_size
It should be 512
smason said:
To find in any smartphone the offset and the size of /system:
$ adb shell
[email protected]:/ $ ls -la /dev/block/bootdevice/by-name/system
ls -la /dev/block/bootdevice/by-name/system
lrwxrwxrwx root root 2015-01-02 10:50 system -> /dev/block/mmcblk0p47
[email protected]:/ $ cd /sys/block/mmcblk0/mmcblk0p47
cd /sys/block/mmcblk0/mmcblk0p47
[email protected]:/sys/block/mmcblk0/mmcblk0p47 $ cat start
cat start
884736
[email protected]:/sys/block/mmcblk0/mmcblk0p47 $ cat size
cat size
8478720
[email protected]:/sys/block/mmcblk0/mmcblk0p47 $
so:
offset = 512 * 884736 = 452984832
partition size = 512 * 8478720 = 4341104640
Cheers!
Click to expand...
Click to collapse
So "first sector" is the value from "cat start" (884736).
The "partiton size" is the value from "cat size" (8478720).
Now the mathematics (using the values from above):
Logical sector size = 512 (I never saw something different on LG G4 smartphones)
Assuming bs=8192
skip and seek: "First sector" * "Logical sector size" / bs
884736 * 512 / 8192 = 55296
count: "Partition size" * "Logical sector size" / bs
8478720 * 512 / 8192 = 529920
That was an example for the H815 (International Model).
Use your own values to calulate the "dd" parameters!
Back to Windows:
Put your smartphone to "Download Mode" and connect it to the Send_Command.exe command prompt.
Now you can copy your "system" partition to "system.img" with the following command:
Code:
dd if=/dev/block/mmcblk0 bs=8192 skip=55296 count=529920 of=/data/media/0/system.img
Replace the values with the ones you calculated for your model!
Now you could copy the "system.img" to your Linux and root it or do everything else you want.
Important: Do NOT delete the original "system.img" from your internal storage as long as you are not 100% sure your G4 is stable.
If your modifications don't work, you can copy back the original "system" partition (with "dd").
To copy the modified "system_changed.img" back to the "system" partition use the following command:
Code:
dd if=/data/media/0/system_changed.img bs=8192 seek=55296 count=529920 of=/dev/block/mmcblk0
Replace the values with the ones you calculated for your model!
Important: Be sure to use "skip" when reading and "seek" when writing.
The "dd" command should take about a minute.
Did the instructions help you?
Please give a "Thanks!"
Thank you
Hi,
thanks for this great post.
I just have one question. With your formulas and using 8K block size, I get a floating point number as result. So I used a block size of 4K instead, and I get an even number. This seems better to me so I went with it, as I believe smaller block sizes are always ok?
I'm just wondering one thing which seems not right to me. My system partition is reported to be 2.5GB:
Partition number (1-42): 39
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: A8725BAA-9E45-B2F8-8FA3-8C972F60F0CF
First sector: 836608 (at 408.5 MiB)
Last sector: 6074573 (at 2.9 GiB)
Partition size: 5237966 sectors (2.5 GiB)
Attribute flags: 1000000000000000
Partition name: 'system'
So with the formulas:
FACTOR 512 / 4096 = 0.125
skip and seek: "First sector" * "Logical sector size" / bs
836608 *FACTOR = 104576
count: "Partition size" * "Logical sector size" / bs
8478720 * FACTOR = 1059840
If I now run the dd command:
dd if=/dev/block/mmcblk0 bs=4096 skip=104576 count=1059840 of=/storage/external_SD/system.img
I get a file system.img which is 4096 MB. Should it not be 2.5GB as my original system partition?
If I use bs=512 (the default) and type
dd if=/dev/block/mmcblk0 bs=512 skip=836608 count=8478720 of=/storage/external_SD/system.img
I get a system.img of the right size (bit over 2.5GB).
I think the block size to use for "skip" is to be specified with the option ibs=XXX, not bs=XXX which only applies to "count" (according to man dd). I tried the ibs option, but the command then just doesn't work on Send_Command.exe. It doesn't even print an error but simply returns immediately.
Cheers
Jen
Hi,
which phone do you have?
Your calculation seems wrong. It's ok to use BS with 4k. I could be a bit slower then 8k, but that doesn't matter.
BUT: Look at your "count" value. Your partition size is 5237966. You used 8478720 (the value from my G4(H815EU) example). Thats wrong!!!
How to calculate with 1k and your values:
bs=1024
skip=836608*512/1024=418304
count=5237966*512/1024=2618983
Please check my calulation!!!
It's interesting, that the Send_Command shell has access to your external sd card...
I think the block size to use for "skip" is to be specified with the option ibs=XXX, not bs=XXX which only applies to "count" (according to man dd).
Click to expand...
Click to collapse
No. "bs" is the right parameter.
If you use "bs" it sets "ibs" and "obs" to the value of "bs".
Just do "dd --help" on a linux system for more details.
Hi Dominik,
oh my, how embarrassing I actually did take the wrong value from the example you posted. I used my value (the 5237966) for calculating the parameters with bs=8K, and got a floating value, so tried 4K instead... and the wrong value must have snug in. Oups.
I also get floating value on 4K now that you've pointed my mistake out:
5237966 * 512/4096= 654745.75
If I rounded this up, would this not mean that I copy a tiny bit of the next partition on the image? And if I then use the image to restore, would I not run the risk to damage something in the following partition?
Anyway, it's not a huge drama as I can just use bs=512 and it works.
Yes I have access to the SD card, the image also has copied there successfully. I was also surprised because I read in the forums that it's not possible.
I found it out with the "df" command, as the SD was listed there. I needed to use it because there's no room on my internal storage (it's a ridiculous 8GB on the LG H735) to store the image there.
My system partition is only 2.5GB so I don't think I have to reformat, but you are right it would be better to use ext4.
Ok
I removed my information about formatting the sd card.
You dont't have to format it. FAT32 is ok.
So you can use your sd card on systems which don't support ext4 too.
I have the LG G4S (H735). It's unusable without rooting as it only has 8GB internal memory. That's why I'm trying to root it now.
jen.magnolis said:
I have the LG G4S (H735). It's unusable without rooting as it only has 8GB internal memory. That's why I'm trying to root it now.
Click to expand...
Click to collapse
Ok, good luck.
Please open a new thread if you have questions about rooting your phone.
Or is there already one? Maybe these?
http://forum.xda-developers.com/g4/help/rooting-lg-h735-g4-beat-t3192491
http://forum.xda-developers.com/g4/general/lg-g4s-world-root-lg-devices-t3231759/page7
Oh. Just saw that you are already there
dominik-p said:
Ok, good luck.
Please open a new thread if you have questions about rooting your phone.
Or is there already one? Maybe these?
http://forum.xda-developers.com/g4/help/rooting-lg-h735-g4-beat-t3192491
http://forum.xda-developers.com/g4/general/lg-g4s-world-root-lg-devices-t3231759/page7
Oh. Just saw that you are already there
Click to expand...
Click to collapse
I just created a new thread too to focus on the particular problem I have:
http://forum.xda-developers.com/g4/general/rooting-lg-g4s-h735-t3243549
this guide helped in dumping boot and recovery partitions.
thank you very much sir! i successfully dumped my boot and recovery partition using dd in my mediatek device by following your guide.
sparksthedev said:
thank you very much sir! i successfully dumped my boot and recovery partition using dd in my mediatek device by following your guide.
Click to expand...
Click to collapse
Congratulations
Did you use the first (more komplex) oder the second method for your device?
I saw that you had problems in this thread:
http://forum.xda-developers.com/showthread.php?p=65907557#post65907557
And you wrote a guide for MTK devices here:
http://forum.xda-developers.com/general/general/guide-dumping-boot-img-recovery-img-t3339530
This doesn't work with the LG G4, but I think it will help many others.
Thank you
My sister asked me to root her phone. It seems more complicated than anything I did in the past (HTC Wildfire, Galaxy Core Plus, Xperia M4A).
I tried this tutorial and it kinda worked, but I can't mount image I got, so it's useless (image, not tutorial!).
Phone is LG-H736 (Beat). I got this result in gdisk:
Code:
Partition number (1-42): 39
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: A9520AE6-ABC6-F107-E8FE-B37C4C30CB77
First sector: 836608 (at 408.5 MiB)
Last sector: 6074573 (at 2.9 GiB)
Partition size: 5237966 sectors (2.5 GiB)
Attribute flags: 1000000000000000
Partition name: 'system'
The 8K bs gave me floating point result, so I used 0,5K.
So the dd command were:
Code:
dd if=/dev/block/mmcblk0 bs=512 skip=836608 count=5237966 of=/storage/external_SD/system.img
BTW, I had access to SDCard and I didn't need to open ports...
EDIT: I got the system.img. The problem was I haven't got enough space on SD card.
But now I bricked it...
https://forum.xda-developers.com/g4/help/softbricked-g4-beat-lg-h735-t3959237
I wanted to create a thread so as to report any unique findings from the internet realm and my own discoveries surrounding the Vernee Apollo Phone. The aim is to bring resources together to encourage development and to release utilities and roms.
Please post your own discoveries and updates!!!
This is NOT a "Vernee Apollo Lite" nor a "Vernee Apollo X" thread even though some information maybe relevant.
Device Name and Specs
Vernee Apollo.
Device Model =K15TA_A
Official Product Website
Official Product Forum
http://www.devicespecifications.com/
Vernee Apollo - Antutu Benchmark v6.2.7.
Score 92,235.
3D: 19159
UX: 38097
CPU: 27535
RAM: 7444
Helio X25 MT6797 Family System on a Chip (SoC) Comparison
Vernee Apollo deploys a X25 MT6797T.
https://en.wikipedia.org/wiki/MediaTek#Octa-_and_deca-core
https://www.mediatek.com/products/smartphones/mt6797-helio-x20
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ADB and FASTBOOT Modes
The Vernee Apollo's bootloader supports Fastboot. The Recovery mode supports the Android Debugging Bridge (ADB) . To access, perform the button sequence below. A menu will appear allowing you to cycle through option to either boot into the recovery partitio,n or to start the Fastboot service.
ADB service is also available also within the Android desktop if you enable USB Debugging in the revealed developers settings menu. You will most likely need to accept a signed key issued from the managing computer for the service to communicate!
Accessing Bootloader Menu
Buttons: [Top-Volume] + [Power-Button] for 8 Seconds.
When the phone is shutdown, hold both buttons at same time from for 8 seconds. The Bootloader menu will appear and then release buttons.
Using Bootloader Menu
Button: [Top-Volume] = Cycle selection.
Button: [Bottom-Volume] = Choose selected item.
With the high screen resolution it maybe hard to see the text-options. There should be three;
1. Recovery, (Boot into Recovery partition with ADB.)
2. Fastboot, (Start Fastboot server.)
3. Normal. (Proceed to boot normally.)
Using Recovery Mode and Menu
When you boot the Recovery partition you will be meet with a failed Android icon on the stock Vernee release rom. ADB will be accessible from here. Note: The Recover menu will cause the ADB server to fail. If you want to display the recovery menu options then perform the following during the failed Android icon screen.
Buttons: [Top-Volume] + [Power-Button] pulsing till the menu appears.
Fastboot
If you plan to develop on your Apollo or to install future community roms then it's advisable to unlock your storage partitions. Unlocking will allow you to change partitions but doing so will void software warranty clauses, and in the process scrub all your personal data from the phone so it's best to do it before installing personal content.
To unlock the phone issue the following command through Fastboot. You will be asked to confirm.
Code:
fastboot oem unlock
Engineering Mode
Enter the following phone number in Android desktop
Code:
Dial *#*#3646633#*#*
Phone Test Options
Alternatively there is a phone test mode available at low level with less options. Whilst the phone is shutdown, press the following.
Buttons: [Bottom-Volume] + [Power-Button] for 8 Seconds.
A test menu will appear and is in simplified Chinese.
SIMS
If your phone is not receiving data over 4G or 3G, Google on another computer "apn" "YOURMOBILEPHONEPROVIDER" "YOURNATION". Example;
Code:
"apn" "vodafone" "uk"
You should find links to technical settings for your data provider's access. Then enter them in by navigating to;
Settings>More>Mobile network settings>Access point names>CLICK-YOUR-LOCKED-ON-PROVIDER>THEN-CONFIRM-SETTINGS
USB
Device USB Coding
Code:
System Mode:
ID 0e8d:201d MediaTek Inc.
ADB Mode:
ID 0e8d:2008 MediaTek Inc.
Fastboot Mode
ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo
Microsoft Windows VCOM Drivers
On Microsoft systems you will need to have drivers installed so as to communicate with the Mediatek phone.
MediaTek DA USB VCOM (Android) Driver 3.0.1504.0 for Windows 7/Windows 8.1
MediaTek DA USB VCOM (Android) Driver 3.0.1504.0 for Windows 10
UART Ability?
I haven't opened the phone yet but if anyone does please capture images of the circuit board. If there are UART pins on the board it may have a root shell piped to the interface. A UART (universal asynchronous receiver/transmitter) in this sense is a device that couples serial communications port to USB to run a terminal over.
Vernee Official Rom Images & "Over The Air" Updates
Official Product Downloads/Support
VerneeX25_Recovery_OriginalStock_v1p0 (Thx to Relief66)
Download (2016-12) ROM "full_k15ta_a-ota-1482441792.zip"
Download (2017-01) ROM "full_k15ta_a-ota-1484567521.zip" (Creating .img from .dat files works!)
Download (2017-07) ROM "full_k15ta_a-ota-1499861676.zip"
Download (2017-07) OTA Patch "20170712201130-OTA.rar"
Note: "20170712201130-OTA.rar" is only designed to update "full_k15ta_a-ota-1482441792.zip" image.
Flashing Partitions
There are three main ways to flash;
1. using "Smart Phone Flash Tool",
2. Fastboot flash command,
3. via internal software like a root bash shell or routine from recovery.
Partition Table
Code:
system logical drive = 2621.44MB [= 2684354560 bytes = 5242880 x 512blocks]
recovery logical drive = 16.384MB
Scatter file from OTA
----------------------------
preloader 0x0
pgpt 0x0
recovery 0x8000
para 0x1008000
custom 0x1088000
expdb 0x13c88000
frp 0x14688000
nvcfg 0x14788000
nvdata 0x14f88000
metadata 0x16f88000
protect1 0x18f88000
protect2 0x19788000
seccfg 0x1a000000
oemkeystore 0x1a800000
proinfo 0x1aa00000
md1img 0x1ad00000
md1dsp 0x1c500000
md1arm7 0x1c900000
md3img 0x1cc00000
scp1 0x1d100000
scp2 0x1d200000
nvram 0x1d300000
lk 0x1d800000
lk2 0x1d880000
boot 0x1d900000
logo 0x1e900000
tee1 0x1f100000
tee2 0x1f600000
keystore 0x1fb00000
system 0x20800000
cache 0xc0800000
userdata 0xdb000000
flashinfo 0xFFFF0080
sgpt 0xFFFF0000
recovery.fstab
------------------
# mount point fstype device [device2]
/boot emmc boot
/cache ext4 /dev/block/mmcblk0p4
/data ext4 /dev/block/mmcblk0p5
/misc emmc misc
/recovery emmc recovery
/sdcard vfat /dev/block/mmcblk0p6
/system ext4 /dev/block/mmcblk0p3
live fstab via "cat /fstab.mt6797"
------------------------------------------
# 1 "vendor/mediatek/proprietary/hardware/fstab/mt6797/fstab.in"
# 1 "<built-in>"
# 1 "<命令行>"
# 1 "vendor/mediatek/proprietary/hardware/fstab/mt6797/fstab.in"
# 20 "vendor/mediatek/proprietary/hardware/fstab/mt6797/fstab.in"
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system /system ext4 ro wait
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/userdata /data ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,resize,encryptable=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/metadata,
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/cache /cache ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect1 /protect_f ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect2 /protect_s ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvdata /nvdata ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvcfg /nvcfg ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/custom /custom ext4 ro wait
/devices/mtk-msdc.0/11230000.msdc0* auto vfat defaults voldmanaged=sdcard0:auto
/devices/mtk-msdc.0/11240000.msdc1* auto auto defaults voldmanaged=sdcard1:auto,encryptable=userdata
/devices/soc/11270000.usb3_xhci* auto vfat defaults voldmanaged=usbotg:auto
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/frp /persistent emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvram /nvram emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/proinfo /proinfo emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk /bootloader emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk2 /bootloader2 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/para /misc emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot /boot emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/recovery /recovery emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/logo /logo emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/expdb /expdb emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/seccfg /seccfg emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee1 /tee1 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee2 /tee2 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/scp1 /scp1 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/scp2 /scp2 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/md1img /md1img emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/md1dsp /md1dsp emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/md1arm7 /md1arm7 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/md3img /md3img emmc defaults defaults
Raw block partition label and user/group
-----------------------------------------------------
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/proinfo u:object_r:nvram_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/nvram u:object_r:nvram_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/nvdata u:object_r:nvdata_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/frp u:object_r:frp_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/expdb u:object_r:expdb_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/misc2 u:object_r:misc2_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/logo u:object_r:logo_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/para u:object_r:para_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/tee1 u:object_r:tee_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/tee2 u:object_r:tee_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/seccfg u:object_r:seccfg_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/userdata u:object_r:userdata_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/cache u:object_r:cache_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/recovery u:object_r:recovery_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/protect1 u:object_r:protect1_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/protect2 u:object_r:protect2_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/keystore u:object_r:keystore_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/oemkeystore u:object_r:oemkeystore_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/boot u:object_r:boot_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/persist u:object_r:persist_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/system u:object_r:system_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/nvcfg u:object_r:nvcfg_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/md1img u:object_r:md_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/md1dsp u:object_r:dsp_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/md1arm7 u:object_r:md_block_device:s0
/dev/block/platform/mtk-msdc\.0/[0-9]+\.msdc0/by-name/md3img u:object_r:md_block_device:s0
On my rooted phone I can check the UUID of the partitions. (You may need BusyBox installed to use blkid command!).
Code:
adb shell
su
blkid
displays;
Code:
/dev/block/loop0: LABEL="iAmCdRom" TYPE="iso9660"
/dev/block/loop1: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/zram0: TYPE="swap"
/dev/block/mmcblk0p3: LABEL="custom" UUID="0f1095f4-0ece-e656-b6ac-e2ce104d5722" TYPE="ext4"
/dev/block/mmcblk0p6: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p7: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p9: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p10: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p28: LABEL="system" UUID="da594c53-9beb-f85c-85c5-cedf76546f7a" TYPE="ext4"
/dev/block/mmcblk0p29: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p30: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk1p1: UUID="0508-0E13" TYPE="vfat"
Modifying Partitions
Modify partitions often means Users hacking the commercial roms and that means extracting out the important files to work with. The most important blocks are the system-partition which holds the operating system, then the recovery-partition which pole vaults Users with low level tools and abilities, like startup phone root powers. Noting many modern phone root modes, deploy on the recovery-partition rather than modify the system-partition, so as to retain full compatibility and retention of abilities, when conducting "Over the Air" / OTA updates from the manufacturer.
There are two popular platforms to hack on. 1. on native Linux including the phone itself, and 2. on a Microsoft Windows platform with Linux style utilities.
To ready a partition, to then modify it, and to then save it for flashing has many steps. One should obtain the manufacturer's rom or OTA update, to seek out the latest images and files to utilise.
In this example of hacking an official rom, we will be using "full_k15ta_a-ota-1484567521.zip". Utility executables are readily available in repositories related to your Linux distribution, like AUR on Archlinux.
Linux - ACCESSING SYSTEM IMAGE TO MODIFY
1.) Extract the zip file to a new folder. The directory should be something like this structure.
Code:
.../tinysys-scp.bin
.../logo.bin
.../lk.bin
.../md1rom.img
.../system.patch.dat
.../type.txt
.../custom.new.dat
.../custom
.../custom/cip-build.prop
.../custom/app-res
.../custom/app-res/quicksearchbox-res
.../custom/app-res/quicksearchbox-res/quicksearchbox-res.apk
.../custom/app-res/android-res
.../custom/app-res/android-res/android-res.apk
.../custom/app-res/browser-res
.../custom/app-res/browser-res/browser-res.apk
.../custom/app-res/launcher3-res
.../custom/app-res/launcher3-res/launcher3-res.apk
.../custom/media
.../custom/media/audio
.../custom/media/audio/notifications
.../custom/media/audio/notifications/Leaf.ogg
.../custom/media/audio/notifications/Pure.ogg
.../custom/media/audio/notifications/Triumph.ogg
.../custom/media/audio/notifications/Vernee_n002.ogg
.../custom/media/audio/notifications/The_time_tunne.ogg
.../custom/media/audio/notifications/Jump.ogg
.../custom/media/audio/notifications/Whisper.ogg
.../custom/media/audio/notifications/Vernee_n001.ogg
.../custom/media/audio/notifications/Cuckoo.ogg
.../custom/media/audio/notifications/Cleverer.ogg
.../custom/media/audio/notifications/Meteor.ogg
.../custom/media/audio/notifications/Bongo.ogg
.../custom/media/audio/notifications/Ripples.ogg
.../custom/media/audio/notifications/Whistle.ogg
.../custom/media/audio/notifications/Gift.ogg
.../custom/media/audio/alarms
.../custom/media/audio/alarms/ClassicAlarm.ogg
.../custom/media/audio/alarms/Waltz.ogg
.../custom/media/audio/alarms/Vernee_a001.ogg
.../custom/media/audio/alarms/GoodLuck.ogg
.../custom/media/audio/alarms/Foredawn.ogg
.../custom/media/audio/alarms/Vernee_a002.ogg
.../custom/media/audio/alarms/MorningSunShine.ogg
.../custom/media/audio/alarms/Walking_in_the_rain.ogg
.../custom/media/audio/ringtones
.../custom/media/audio/ringtones/Call_of_love.ogg
.../custom/media/audio/ringtones/Spring.ogg
.../custom/media/audio/ringtones/New_life.ogg
.../custom/media/audio/ringtones/Menuet.ogg
.../custom/media/audio/ringtones/Vernee_r004.ogg
.../custom/media/audio/ringtones/Heartbeat.ogg
.../custom/media/audio/ringtones/Vernee_r005.ogg
.../custom/media/audio/ringtones/Technology.ogg
.../custom/media/audio/ringtones/Longing.ogg
.../custom/media/audio/ringtones/Vernee_r002.ogg
.../custom/media/audio/ringtones/Vernee_r003.ogg
.../custom/media/audio/ringtones/Westlake.ogg
.../custom/media/audio/ringtones/Vernee_r001.ogg
.../custom/media/audio/ringtones/Progress.ogg
.../custom/media/audio/ringtones/Journey.ogg
.../custom/media/audio/ringtones/GuitarPop.ogg
.../custom/media/audio/ringtones/Cloud.ogg
.../custom/media/audio/ringtones/Capriccioso.ogg
.../custom/media/audio/ringtones/IceWorldPiano.ogg
.../custom/plugin
.../custom/plugin/FwkPlugin
.../custom/plugin/FwkPlugin/FwkPlugin.mpinfo
.../custom/plugin/FwkPlugin/FwkPlugin.apk
.../custom/plugin/Signatures
.../custom/plugin/Signatures/mplugin_guard.xml
.../custom/etc
.../custom/etc/resources.xml
.../custom/bootani
.../custom/bootani/shutanimation.zip
.../custom/bootani/bootanimation.zip
.../custom/customprop
.../custom/customprop/custom.prop
.../system.new.dat
.../custom.patch.dat
.../md1arm7.img
.../md3rom.img
.../preloader_k15ta_a.bin
.../md1dsp.img
.../scatter.txt
.../custom.transfer.list
.../file_contexts
.../boot.img
.../META-INF
.../META-INF/CERT.SF
.../META-INF/MANIFEST.MF
.../META-INF/CERT.RSA
.../META-INF/com
.../META-INF/com/android
.../META-INF/com/android/metadata
.../META-INF/com/android/otacert
.../META-INF/com/google
.../META-INF/com/google/android
.../META-INF/com/google/android/update-binary
.../META-INF/com/google/android/updater-script
.../trustzone.bin
.../system.transfer.list
.../sdat2img.py
2.) the images we are looking for are either the system-partition or the recovery-partition to modify. In this case there is only the system and it's held in the file "system.new.dat", a 1.6 gigabyte file. We know from the partition tables above that the system-partition is 2.6GB wide, so this image is either compressed or short. Most partitions deployed on Android for updating are compressed in what's called a sparse format.
We need to uncompress any sparse file before we can work with it or mount it, but the issue in this case is the image is also in "dat" structure, which means we need to unsparse using structured data held in "system.transfer.list". Here we use "sdat2img" executable to create the file "system_fullsize.img";
Code:
sdat2img system.transfer.list system.new.dat system_fullsize.img
Alternatively if the file was not a dat format, we could simply unsparse using;
Code:
simg2img system.img system_fullsize.img
3.) Now that we have the full image we can mount it as a file-system to tinker with it. Example of making a mount point and mounting it;
Code:
sudo mkdir /system
sudo mount -t ext4 -o loop ./system_fullsize.img /system/
You can now modify the image simply by changing the files in the directory mounted on. After changes you can save out and attempting to flash it back to the phone for your custom system.
Linux - CAPTURING THE MOUNT BACK TO AN IMAGE FILE
1.) After we have modified the mounted system-partition we need to save it back out for flashing if you want to see your changes live on the phone.
Labelling (If desired). We can name the mount to enforce block-labels. In this case the loop device was "loop0" used to mount the image. (Check which loop-device was used when performing this. eg: lsblk) Here we are going to label it "system"..
Code:
e2label /dev/loop0 system
It maybe important to set the partition UUID the same as the manufacturer uses so the the mounting process finds the correct partition to mount at boot. We know the system partitions UUID from the above discovery details;
Code:
UUID="da594c53-9beb-f85c-85c5-cedf76546f7a"
We can set the mounted image's UUID to suit the original before creating a new;
Code:
sudo tune2fs /dev/loop0 -U da594c53-9beb-f85c-85c5-cedf76546f7a
Here we capture out the device to an "ext4" format file-system image. The length option, being 2684354560 bytes. Labelling option "-a" with name "system".
Code:
sudo make_ext4fs -s -l 2684354560 -a system system_modded.img /system/
2.) To flash your image, Android's recent "fastboot" utility will allow for unsparse and sparsed images to be flashed. I have broken down the fastboot process into each step.
CAUTION: fastboot writes over your phone's partition blocks. If you are not skilled in this area of computing them research "fastboot" before use.
Note: current I have not found out why this process is incompatible with Vernee Apollo. The images I write back are not operational even though they flash properly. My hunch is that I may need to enforce an ISO/image UUID the same as the manufacturers, but I haven't tested this yet.
Code:
fastboot -w
fastboot format system
fastboot flash system ./system_modded.img
If we want to sparse the file before flashing;
Code:
img2simg system_modded.img system_modded_sparse.img
If we want to create a sparse dat structured image;
Code:
img2sdat ./system_modded.img
Linux - ACCESSING RECOVER IMAGE TO MODIFY
An Android recovery image is really three items in one image. There is a compressed kernel (zImage) used to run a recovery system, a ramdisk (initrd.img), and configuration file. The ramdisk "initrd.img" holds the operating system files used by the recovery kernel. Note the bootimage partition/image is a similar structure to a recovery-image.
If you need a similar development community then the Xiaomi Redmi Pro is a similar phone due to its Mediatek Helio x25 but it uses a different cameras, screen and sensors. Modifying and tweaking settings in their recovery images can work on your Vernee Apollo X25.
To extract the sub held files (bootimg.cfg, zImage, initrd.img);
Code:
abootimg -x recovery.img
To unpack a ramdisk "initrd.img";
Code:
mkdir initrd
cd initrd
sudo zcat ../initrd.img | cpio -idmv
To pack files whilst in your ramdisk directory ''/initrd";
Code:
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
To pack back up components into a recovery rom;
Code:
abootimg --create recovery_new.img -f bootimg.cfg -k zImage -r initrd.img
Alternatively;
Code:
mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel ./zImage --ramdisk ./newramdisk.cpio.gz -o recovery_new.img
Software
Chainfire SuperSU Release Announcement
F-Droid. Alternative App Store for public domain software.
.
Known Recovery Image Developers
Cleopatra Bianchi
https://forum.xda-developers.com/general/rooting-roms/vernee-apollo-helio-x25-twrp-root-t3554788
Known ROM Developers
Cleopatra Bianchi
https://forum.xda-developers.com/general/rooting-roms/vernee-apollo-helio-x25-roms-fix-t3561019
Vernee Apollo X25 General Resource Sites
http://www.needrom.com/ Vernee/ApolloX25
.
Hardware
Protective Covers
Silicone and more rigid covers are becoming available for the Vernee Apollo. Make sure you don't get a Lite version as it wont fit.
Those looking for more range and are willing to mod, the Lenovo K5 Note is very similar in dimensions to the Apollo X25, but the headphone jack, volume and power buttons are slightly off. Modding a K5 Note case will require cutting holes for the headphone jack, buttons, speaker holes, and possibly for the flash. Clear covers will allow the flash to work. Make sure the camera and finger scanner is a complete open section on any K5 cover!
https://www.aliexpress.com/item/Ver...-Shell-Back-Cover-For-Vernee/32799796884.html
TWRP Vernee Apollo Helio X25
Cleopatra Bianchi said:
Click to expand...
Click to collapse
http://bbs.vernee.cc/forum.php?mod=viewthread&tid=1721&extra=page%3D1
Cleopatra Bianchi said:
http://bbs.vernee.cc/forum.php?mod=viewthread&tid=1721&extra=page%3D1
Click to expand...
Click to collapse
I left it up to you to post. I hope people comment on what they think. I'm working on my own images so I can't install others at the moment to give an opinion. Readers please note I can't verify the security on this share. Do not take any compromising actions.
I'm super busy so not sure when I will have my own solutions.
How I wish I had more knowledge. This piece of Hw (Raw Hw?) has a lot of potential, but lacks interest of any developer adapt/adopt it....
The conditions are there (lets hope the owners free the code, as they have done with its small brother), and let's hope there are enough and good drivers for the chosen Hw.
Just to encourage your efforts.
Regards
I agree
lots of good hardware and poor software...I hope in this community
At the moment I found these "bad" things about this phone:
1) you can't choose to view the battery percentage in the upper bar
2) you have to set the APN manually or you can't use internet
3) you can't turn volume up or down if the screen is switched off
I've kind of hit a wall with modding the system image to root it. The system images I produce are just not compatible with flashing. They flash but no desktop runs on the phone. Tried both sparse and raws. and I've got the partition size correct. Mount point is set properly to "system" and they're ext4 images.
I'm building Chainfire's version of ext4_utils, specifically the make_ext4fs util. If that doesn't work then I'll build Google's version. Long process as you need SELinux headers which takes ages to install. There maybe a bug in older versions that's causing the trouble. Other thoughts, there maybe a different padding method or bit plane for storing file system nodes. I may need SELinux builds of executables just to get the job done as I did notice in a hex.diff that the original image has SELinux stamps in it. I need more investigation to know why that's so.
It would be nice if Cleopatra Bianchi chimed in if She knows the issue or has even been down this road before, so to speak.
Hi, E8
Do not know even if this could be valuable, but the sources of the lite version are there. I suppose they are taking the same engineering approaches with the big brother... or not...
but would check
Regards
jrotaetxe said:
Hi, E8
Do not know even if this could be valuable, but the sources of the lite version are there. I suppose they are taking the same engineering approaches with the big brother... or not...
but would check
Regards
Click to expand...
Click to collapse
I'll look into it as the scripts may indicate the process to image creation. Cheers.
TWRP and ROOT - successfully tested !
https://forum.xda-developers.com/general/rooting-roms/vernee-apollo-helio-x25-twrp-root-t3554788
Such a cool phone, but sending it back. Doesn't work with US carriers
Stock firmware in Flash Tool
Cleopatra Bianchi said:
TWRP and ROOT - successfully tested !
https://forum.xda-developers.com/general/rooting-roms/vernee-apollo-helio-x25-twrp-root-t3554788
Click to expand...
Click to collapse
I look forward to flash the stock firmware in Flash Tool. I foolishly made a phone of brick, all backups lost.
stock firmware
myextasy said:
I look forward to flash the stock firmware in Flash Tool. I foolishly made a phone of brick, all backups lost.
Click to expand...
Click to collapse
A working stock firmware will be here very soon.
Please be patient, I am working on that.
Cleopatra Bianchi said:
A working stock firmware will be here very soon.
Please be patient, I am working on that.
Click to expand...
Click to collapse
Anyway to unlock bands to get it working in US ???
myextasy said:
I look forward to flash the stock firmware in Flash Tool. I foolishly made a phone of brick, all backups lost.
Click to expand...
Click to collapse
You can easily restore the phone using the official zip rom. Place it on a micro sdcard and install via the Bootloader menu. Instructions are on the forst comment on how to get to the bootloader menu and then recovery. If you're destroyed your recovery partition but still have fastboot access then you can use the system image within the official rom to flash the system partition with a bit of modifications.
I've been super busy so I haven't had the time to work on my own version of the TWRP Recovery.
How can I find the drivers ? When I google search I only find the one for Apollo lite
Do not believe you can "unlock" US bands, as they differ from EU/ASIA system.
Anyway, trying is (almost) free. The worst thing can happen is a brick
Regards
Device: Technisat MIB STD2 PQ nav
This device does not have serial shell .
But I successfully hacked the emmc filesystem
Now serial port has a shell
Step1.
Desolder the EMMC chip
Step2.
Dump EMMC chip via SD card reader
Step3.
qemu-img convert -f raw d:\682C_EMMC_DUMP.bin -O vmdk d:\682c.vmdk
Step4.
Start QNX x86 vmware machine to modify the 682c.vmdk
Step5.
modify the file /fs/hd1-qnx6/tsd/bin/system/startup
add following line
--------------------
echo ser1 "/bin/login -f root" qansi-m on > /tmp/ttys
/sbin/tinit -f /tmp/ttys &
--------------------
Save the file
Step6.
Shutdown QNX6 VM
Step7.
qemu-img convert -f vmdk d:\682c.vmdk -O raw C:\682C_EMMC_DUMP.bin
Step8.
write C:\682C_EMMC_DUMP.bin to EMMC via SD card reader
Step9.
Solder the EMMC chip back
done.
Can you post the dump please?
Please, can you post some images?
mengxp said:
Device: Technisat MIB STD2 PQ nav
This device does not have serial shell .
But I successfully hacked the emmc filesystem
Now serial port has a shell
Click to expand...
Click to collapse
Was you able to access to the image? Could you post the image file?
THX in andvance and greetings
Metanol
mengxp said:
Device: Technisat MIB STD2 PQ nav
This device does not have serial shell .
But I successfully hacked the emmc filesystem
Now serial port has a shell
Step1.
Desolder the EMMC chip
Step2.
Dump EMMC chip via SD card reader
Step3.
qemu-img convert -f raw d:\682C_EMMC_DUMP.bin -O vmdk d:\682c.vmdk
Step4.
Start QNX x86 vmware machine to modify the 682c.vmdk
Step5.
modify the file /fs/hd1-qnx6/tsd/bin/system/startup
add following line
--------------------
echo ser1 "/bin/login -f root" qansi-m on > /tmp/ttys
/sbin/tinit -f /tmp/ttys &
--------------------
Save the file
Step6.
Shutdown QNX6 VM
Step7.
qemu-img convert -f vmdk d:\682c.vmdk -O raw C:\682C_EMMC_DUMP.bin
Step8.
write C:\682C_EMMC_DUMP.bin to EMMC via SD card reader
Step9.
Solder the EMMC chip back
done.
Click to expand...
Click to collapse
Can you tell which chip is the EMMC chip? there are quite some FBGA chips on board. Or maybe a picture?
Found the emmc chip its an MTFC8GLWDQ-3M AIT Z, cant get a datasheet of it. Maybe someone has it for me?
Hi there!
The pinout is standard, just look for EMMC LFBGA 100 pin.
It's funny to see the title, hacking this unit is not about getting console access, there's a lot more than that. Good luck!
thanks i was expecting that, looks like the data lines ,clk and cmd, all go throug an resistor array 22ohm. maybe its possible to remove the array and read chip onboard. so there is no need for BGA soldering.
I know, this is just a starting point, lets start with chancing some start screens.. that must be possible and than see how to modifie the FEC key handling.
---------- Post added at 10:01 PM ---------- Previous post was at 10:00 PM ----------
thanks i was expecting that, looks like the data lines ,clk and cmd, all go throug an resistor array 22ohm. maybe its possible to remove the array and read chip onboard. so there is no need for BGA soldering.
I know, this is just a starting point, lets start with chancing some start screens.. that must be possible and than see how to modifie the FEC key handling.
anybody have PCB connection for download Emmc without desolder?
Have tried it in couple of units and unfortunately still cannot send anything to the unit on serial port
Which version of QNX VMWare do U use?
mengxp said:
Device: Technisat MIB STD2 PQ nav
This device does not have serial shell .
But I successfully hacked the emmc filesystem
Now serial port has a shell
Step1.
Desolder the EMMC chip
Step2.
Dump EMMC chip via SD card reader
Step3.
qemu-img convert -f raw d:\682C_EMMC_DUMP.bin -O vmdk d:\682c.vmdk
Step4.
Start QNX x86 vmware machine to modify the 682c.vmdk
Step5.
modify the file /fs/hd1-qnx6/tsd/bin/system/startup
add following line
--------------------
echo ser1 "/bin/login -f root" qansi-m on > /tmp/ttys
/sbin/tinit -f /tmp/ttys &
--------------------
Save the file
Step6.
Shutdown QNX6 VM
Step7.
qemu-img convert -f vmdk d:\682c.vmdk -O raw C:\682C_EMMC_DUMP.bin
Step8.
write C:\682C_EMMC_DUMP.bin to EMMC via SD card reader
Step9.
Solder the EMMC chip back
done.
Click to expand...
Click to collapse
5C0 035 680 C hi is this for this MIBSTD2? anyone have any success ? ive read about the patches etc is there any other way ?
mengxp said:
Device: Technisat MIB STD2 PQ nav
This device does not have serial shell .
But I successfully hacked the emmc filesystem
Now serial port has a shell
Step1.
Desolder the EMMC chip
Step2.
Dump EMMC chip via SD card reader
Step3.
qemu-img convert -f raw d:\682C_EMMC_DUMP.bin -O vmdk d:\682c.vmdk
Step4.
Start QNX x86 vmware machine to modify the 682c.vmdk
Step5.
modify the file /fs/hd1-qnx6/tsd/bin/system/startup
add following line
--------------------
echo ser1 "/bin/login -f root" qansi-m on > /tmp/ttys
/sbin/tinit -f /tmp/ttys &
--------------------
Save the file
Step6.
Shutdown QNX6 VM
Step7.
qemu-img convert -f vmdk d:\682c.vmdk -O raw C:\682C_EMMC_DUMP.bin
Step8.
write C:\682C_EMMC_DUMP.bin to EMMC via SD card reader
Step9.
Solder the EMMC chip back
done.
Click to expand...
Click to collapse
As I see this only gives you a shell access. Not a complete hack of system like activating all functions and removing component protection on device, does not it ?
Can you post the dump please?
Can you post the dump please?
Hello
do you have idea how we can remove Component protection? I need make retrofit with 100% clean components but Skoda auto cannot remove CP because dotn have online data for Old car and New radio.....grrrrr....
thank you for more info....
Hey guys, anyone here willing to share any version of firmware files for VW MIB2 (preferably v0343 or newer) or anyone willing to make full dump of the VW MIB2's flash?
reading MMC without desoldering
Maybe somebody found a way to read eMMC without desoldering chip?
Harman mib2 pro unit
Hi I have Harman discovery pro mib2 unit black screen green menu corrupt anybody know how to recover
vierchatura said:
Maybe somebody found a way to read eMMC without desoldering chip?
Click to expand...
Click to collapse
I have propper tools and knowledge and when ISP pinout exist U can use ISP for eMMC chip.
bell38 said:
Hi I have Harman discovery pro mib2 unit black screen green menu corrupt anybody know how to recover
Click to expand...
Click to collapse
I can help you. Write PM