{How To} Downgrade SPRINT Desire 626s to Lolipop (Edit Misc Partition) - Desire 626 General

You have to use the dd method to flash the misc.img.
do this in adb.
adb shell
su
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/misc.img
exit
exit
adb pull /sdcard/misc.img
Then post a link to your misc.img so I can edit it for you.
Or just post the backup of your misc.img. You did make one I hope.
Always make a backup before you change things. That's a golden rule.
If not no big deal this time. But get in that habit.
If you didn't make a backup then let me know.
Also put the phone in download / fastboot mode.
type
fastboot getvar all
Post that info for me. It should look like
C:\Windows\system32>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_a32eul
(bootloader) version: 1.0
(bootloader) imei: 352678075675006
(bootloader) version-main: 1.23.1550.3
(bootloader) boot-mode: download
(bootloader) version-baseband: 01.01_U113251151_47.00.51016G
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PM911000
(bootloader) cid: 11111111
all:
finished. total time: 0.015s

@BigCountry907 thanks a lot for your time. So I pulled the misc.img and zipped it which I have attached to this comment. However, it's that of metro PCs that flashed and I didn't make a backup of the Sprint one sadly. Going forward, I will make backups before editing anything. These are the details of my fastboot getvar all
bootloader) kernel: lk
(bootloader) product: htc_a32ewhl
(bootloader) version: 1.0
(bootloader) imei:
(bootloader) version-main: 1.00.0000.0
(bootloader) boot-mode: download
(bootloader) version-baseband: [email protected]
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PM920000
(bootloader) cid: 11111111
all:
finished. total time: 0.080s
As regards moving comments from the previous thread, I think the best way would be to identify the mod of the 626 thread and mail him to do the moving

@doyin116
It's not a good idea to post your imei #
I do it cause my device isn't activated and I'm lazy.
But if your phone is activated I think they could identify you by imei.
Or someone might try to use it.
Edit your post and take that out.
Also I notice your cid is set to supercid.
If you are s-off you don't even need to edit the misc to downgrade.
Are you s-off.

@doyin116
Try and flash the regular marshmallow RUU from HTC.
We will just start fresh that way.
The misc image for your phone
(bootloader) version-main: 1.00.0000.0
Should be. version-main: 1.00.000.0. ,---Notice 3 digits and not 4 in the 3rd set.
Flashing the RUU will put everything back and then we will work on the downgrade

BigCountry907 said:
@doyin116
It's not a good idea to post your imei #
I do it cause my device isn't activated and I'm lazy.
But if your phone is activated I think they could identify you by imei.
Or someone might try to use it.
Edit your post and take that out.
Also I notice your cid is set to supercid.
If you are s-off you don't even need to edit the misc to downgrade.
Are you s-off.
Click to expand...
Click to collapse
@BigCountry907 thanks for the heads up, I've removed the imei. Yeah I'm S-off and set to supercid. I guess I have to try flashing the ruu again, will do that and get back to you
Update:
I'm glad to report that I successfully downgraded to 5.1. @BigCountry907 I guess the next step now is building a custom kernel to flash. How's that going?

@BigCountry907 please is there any update on the creation of a custom kernel for the Sprint 626s?

@ doyin116
I will see what I can do.
I've been jumping around between my projects thus not really finishing any specifically.
Are you good with ADB?
I have not generated a flashable zip so you will need to use adb to copy the modules to the device and flash the kernel with fastboot.
At any rate I will attempt to do this today.

@doyin116
I have the sprint kernel ready to rock.
Let me put it all together and write an instruction how to get it all loaded.
You must have ADB on the computer in order to load everything right.
I hope you know how to use adb.
I will give you the commands but it is up to you to get this custom kernel and modules installed correctly.
Be back momentarily

Loading Custom Kernel For Sprint
Ok Here We Go.
1 ) Download the zip file " kernel-a32ewhl.zip"
2 ) Unzip the file
Create a folder somewhere on the computer.
Move kernel-a32ewhl.zip into that folder.
Unzip the kernel-a32ewhl.zip in that folder
You should see all of the following
A ) File "a32ewhl-boot.img" <<<<------ ( This is the kernel / boot image )
B ) Folder "modules" <<<<------ ( This is all the modules not including the required symlinks )
a. There are 2 modules "itson_module1.ko" & "itson_module2.ko" These have not been re compiled. I don't have source code for these.
The version has been set correctly for the new kernel so they should run hopefully.
The modules have something to do with Sprint Activation so check and make sure activation is working right.
b. There are 4 Moc_ modules. Theese are for crypto and affect running paid for apps. They should work since the kernel version is
set right. If you have any paid for apps test them.
c. The rest of the modules have been built with the new kernel and will be no trouble. Be sure to test wi-fi well. We might need an
adjustment.
C ) Folder "wcnss" these are configuration files for the wi-fi. Since we rebuilt the wlan module I recommend using these configuration files.
Some of the configuration can be changed and settings changed. You can look into that if you want. But we are not going there today.
3 ) Copy everything to the external sd card.
PLEASE FOLLOW ALL THESE INSTRUCTIONS EXACTLY !!
Make a folder on the external sdcard called new-kernel. You can do this with the phone connected to the computer or with the sdcard in a card reader connected to the computer.
Copy the modules folder inside of the new-kernel folder
Copy the wcnss folder inside of the new-kernel folder
Copy the a32ewhl-boot.img to the place on your computer where you can use fastboot.
If you are running windows search for fastboot.exe using file explorer.
Copy a32ewhl-boot.img to the same folder as fastboot.exe
Open a command window and cd to the directory where fastboot.exe is in.
Similar to
cd c:\android\sdk\platform-tools\
If you type dir
You should see fastboot.exe and a32ewhl-boot.img in the list of files.
4 ) Install the new modules into the phone
After you have copied all the files to the sd card and put the sd card in the phone and rebooted the phone.
Connect the phone to the computer via USB.
PAY ATTENTION HERE THEESE STEPS ARE CRUCIAL>
Start a shell as root.
Code:
adb shell
su
Re-Mount /system as read write. ( ERRORS ARE NOT ACCEPTABLE )
Code:
mount -o rw,remount,rw /system
Remove all exsisting Modules
Code:
rm -rf /system/lib/modules/
rm -rf /system/etc/firmware/wlan/prima/WCNSS_cfg.dat
rm -rf /system/etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
rm -rf /system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin
Copy new modules
Code:
cp -rf /sdcard2/new-kernel/modules/ /system/lib/modules/
Copy new wcnss config
Code:
cp /sdcard2/new-kernel/wcnss/WCNSS_cfg.dat /system/etc/firmware/wlan/prima/WCNSS_cfg.dat
cp /sdcard2/new-kernel/wcnss/WCNSS_qcom_cfg.ini /system/etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
cp /sdcard2/new-kernel/wcnss/WCNSS_qcom_wlan_nv.bin /system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin
Re-Create all symlinks
Code:
ln -s /system/lib/modules/pronto/pronto_wlan.ko /system/lib/modules/wlan.ko
ln -s /system/lib/modules/moc_crypto.ko.3.10 /system/lib/modules/moc_crypto.ko
ln -s /system/lib/modules/crypto_test_mod.ko.3.10 /system/lib/modules/crypto_test_mod.ko
ln -s /system/lib/modules/moc_crypto_api_tmpl.ko.3.10 /system/lib/modules/moc_crypto_api_tmpl.ko
ln -s /system/lib/modules/moc_platform_mod.ko.3.10 /system/lib/modules/moc_platform_mod.ko
Set the file permissions.
Code:
chmod 0644 /system/lib/modules/pronto/pronto_wlan.ko
chmod 0644 /system/lib/modules/ansi_cprng.ko
chmod 0644 /system/lib/modules/core_ctl.ko
chmod 0644 /system/lib/modules/crypto_test_mod.ko
chmod 0644 /system/lib/modules/crypto_test_mod.ko.3.10
chmod 0644 /system/lib/modules/dma_test.ko
chmod 0644 /system/lib/modules/ecryptfs.ko
chmod 0644 /system/lib/modules/evbug.ko
chmod 0644 /system/lib/modules/gpio_axis.ko
chmod 0644 /system/lib/modules/gpio_event.ko
chmod 0644 /system/lib/modules/gpio_input.ko
chmod 0644 /system/lib/modules/gpio_matrix.ko
chmod 0644 /system/lib/modules/gpio_output.ko
chmod 0644 /system/lib/modules/ice40-hcd.ko
chmod 0644 /system/lib/modules/itson_module1.ko
chmod 0644 /system/lib/modules/itson_module2.ko
chmod 0644 /system/lib/modules/mcDrvModule.ko
chmod 0644 /system/lib/modules/mcKernelApi.ko
chmod 0644 /system/lib/modules/moc_crypto.ko
chmod 0644 /system/lib/modules/moc_crypto.ko.3.10
chmod 0644 /system/lib/modules/moc_crypto.ko.sig.3.10
chmod 0644 /system/lib/modules/moc_crypto_api_tmpl.ko
chmod 0644 /system/lib/modules/moc_crypto_api_tmpl.ko.3.10
chmod 0644 /system/lib/modules/moc_platform_mod.ko
chmod 0644 /system/lib/modules/moc_platform_mod.ko.3.10
chmod 0644 /system/lib/modules/msm-buspm-dev.ko
chmod 0644 /system/lib/modules/mtd_nandbiterrs.ko
chmod 0644 /system/lib/modules/mtd_nandecctest.ko
chmod 0644 /system/lib/modules/mtd_oobtest.ko
chmod 0644 /system/lib/modules/mtd_pagetest.ko
chmod 0644 /system/lib/modules/mtd_readtest.ko
chmod 0644 /system/lib/modules/mtd_speedtest.ko
chmod 0644 /system/lib/modules/mtd_stresstest.ko
chmod 0644 /system/lib/modules/mtd_subpagetest.ko
chmod 0644 /system/lib/modules/mtd_torturetest.ko
chmod 0644 /system/lib/modules/radio-iris-transport.ko
chmod 0644 /system/lib/modules/spidev.ko
chmod 0644 /system/lib/modules/texfat.ko
chmod 0644 /system/lib/modules/wlan.ko
chmod 0644 /system/etc/firmware/wlan/prima/WCNSS_cfg.dat
chmod 0644 /system/etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
chmod 0644 /system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin
Now boot the phone to download mode if everything was successful. :good:
From the terminal command window on the computer flash the new boot image.
REMEMBER
Open a command window and cd to the directory where fastboot.exe is in.
Similar to
cd c:\android\sdk\platform-tools\
If you type dir
You should see fastboot.exe and a32ewhl-boot.img in the list of files.
Code:
fastboot flash boot a32ewhl-boot.img
If all went well then hit the reboot button.
You should now be running my custom kernel for sprint.
Let us know please.......You are the First.

I forgot to mention.
The kernel is compiled with a custom optimized toolchain.
Hopefully you see some performance improvement.
After your running go to about phone in your settings and check the kernel version your running.
It should be the following if your running the new kernel.
Linux version 3.10.49-perf-ga4f8dc4 ([email protected]) (gcc version 4.9.4 20160726 (optimized) (UBERTC-4.9.4) ) #1 SMP PREEMPT Thu Nov 17 14:09:00 EST 2016
This is the original kernel version.
Linux version 3.10.49-perf-ga4f8dc4 ([email protected]) (gcc version 4.7 (GCC) ) #2 SMP PREEMPT Fri Nov 6 18:11:47 CST 2015

@BigCountry907 thanks a lot. I will read the steps over and over to get them correctly and get back to you when I've flashed the kernel with a screenshot

@BigCountry907 after
adb
su
I did # mount -o rw,remount,rw /system and this came up:
Usage: mount [-r] [-w] [-o options] [-t type] device directory
And with the thought that this is the normal result it was to come up with, I proceeded to remove the modules but at the end of every module, it wrote : read-only e.g rm: /system/lib/modules/ansi_cprng.ko: Read-only but I proceeded to Re-create sym links but the first sym link brought at the end 'file exists'. At this point, I knew something was wrong
What could I be doing wrong?

@doyin116
First make sure you are using this command.
mount -o rw,remount,rw /system
# should be at your shell command line allready.
If you typed #
That is the problem.
also -o is lower case O not number Zero.
Just in case.
You have to remember.
In linux or android. It's not like windows.
Every letter counts. And uppercase lowercase must match exactly.
Windows don't care about case, but android and linux do.
LINUX and linux and Linux would be considered the same file in windows.
In android world these would be considered 3 different files.
I double checked the command.
mount -o rw,remount,rw /system
It is working on my end so I am not sure why your having trouble.
Your boot-loader needs to be unlocked.
Your phone must be rooted.
If you are s-off this shouldn't be a problem. I never had trouble even with s-on.
At any rate you will need system mounted as RW in order to load the new modules.
Try again one line at a time.
copy and paste
Code:
adb shell
su
mount -o rw,remount,rw /system
The command should not reply back with anything in the terminal.
It will just go to the next line.
Your terminal will look similar to this.
Make sure you have the # and not $.
Code:
[email protected]:~$ adb shell
[email protected]_a13wlpp:/[COLOR="Red"] $[/COLOR] su
[email protected]_a13wlpp:/[COLOR="DarkGreen"] #[/COLOR] mount -o rw,remount,rw /system
[email protected]_a13wlpp:/ #
Every command that is posted above must complete without any errors.
If you are getting any errors post a screenshot.
Note I have added a section of commands in the flashing guide to set the file permissions.
Make sure to go back and do that too.

@BigCountry907 the problem was rather than mount -o rw,remount,rw /system, I added spaces between rw, remount and rw before /system. Will go through it again when I get home

@BigCountry907 everything was going on smoothly until I got to cp /sdcard2/new-kernel/wcnss/WCNSS_qcom_wlan_nv.bin /system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin and it came up with cp: /system/etc/firmware/wlan.prima/WCNSS_qcom_wlan_nv.bin: No such file or directory error and everything command I put in from then on came up with a no such file or directory error. Any advice please?

Check your sdcard and see if the files are actually there.
If you got all the modules installed then go ahead and flash the kernel.
The phone should boot ok.

BigCountry907 said:
Check your sdcard and see if the files are actually there.
If you got all the modules installed then go ahead and flash the kernel.
The phone should boot ok.
Click to expand...
Click to collapse
After many trials and errors, I was able to write the commands but after flashing the kernel via fastboot, my phone kept bootloping. I had to flash the stock boot.img back

Well flashing the stock boot image back is the way to go. You can also flash the ruu again to restore everything to default. That is the good thing.
I'm not 100% sure why the kernel will not boot for you.
I believe that the bootloader is not allowing the custom kernel to boot.
Even though the device is s-off and unlocked I think depending on carrier the bootloader is still verifying the signature of the kernel.
I have tried to load the spcs ruu on my metro and it flashes and loads but there is some kind of security that will not allow the rom to run. Actually the rom is running but the homescreen gets covered by the HTC boot-logo. I know it is booted up because when i press the power button I get the normal power off menu that you get when your booted into the rom.
I need to do some more testing. I have successfully booted the custom kernel I sent you on my metro-pcs.
The metro pcs is the the gen unlocked version. hence the a32eul.
I am downloading some more ruu's that I have access to to do some testing.
Either we are going to have to replace your radio and bootloaders or flash a ruu that accomplishes the same.
I have a JTAG box showing up tomorrow so If I brick my device I can fix it.
I would guess you are not in the same boat.
So we can try flashing the gen-unlocked ruu on your device. But I need to flash it on mine and make sure sprint is available in the ruu as a carrier.
Otherwise I am not sure how you will get all the settings like PRL ect. for sprint installed.
Worse case scenario I might have to make a sprint ruu with the replaced bootloader and radio from the unlocked ruu.
These are the kind of things I like to figure out.

BigCountry907 said:
Check your sdcard and see if the files are actually there.
If you got all the modules installed then go ahead and flash the kernel.
The phone should boot ok.
Click to expand...
Click to collapse
BigCountry907 said:
Well flashing the stock boot image back is the way to go. You can also flash the ruu again to restore everything to default. That is the good thing.
I'm not 100% sure why the kernel will not boot for you.
I believe that the bootloader is not allowing the custom kernel to boot.
Even though the device is s-off and unlocked I think depending on carrier the bootloader is still verifying the signature of the kernel.
I have tried to load the spcs ruu on my metro and it flashes and loads but there is some kind of security that will not allow the rom to run. Actually the rom is running but the homescreen gets covered by the HTC boot-logo. I know it is booted up because when i press the power button I get the normal power off menu that you get when your booted into the rom.
I need to do some more testing. I have successfully booted the custom kernel I sent you on my metro-pcs.
The metro pcs is the the gen unlocked version. hence the a32eul.
I am downloading some more ruu's that I have access to to do some testing.
Either we are going to have to replace your radio and bootloaders or flash a ruu that accomplishes the same.
I have a JTAG box showing up tomorrow so If I brick my device I can fix it.
I would guess you are not in the same boat.
So we can try flashing the gen-unlocked ruu on your device. But I need to flash it on mine and make sure sprint is available in the ruu as a carrier.
Otherwise I am not sure how you will get all the settings like PRL ect. for sprint installed.
Worse case scenario I might have to make a sprint ruu with the replaced bootloader and radio from the unlocked ruu.
These are the kind of things I like to figure out.
Click to expand...
Click to collapse
I'I'm not based in the U.S so getting the prl setting won't matter to me. The end game of all this is I can't get 3G and 4G to work in my country apparently because of some limitations Qualcomm made even though I've flashed the necessary bands that apply in my country through QPST. All I just need is something to remove the restrictions that prevent me from using 3g and 4g. I'm really frustrated nothing is working. Thanks anyways for trying to help

@doyin116
Are you using sprint as a carrier.
If not let me know what carrier you are using.
Either way follow my instructions below.
Ok Here we go.
I have an Idea. It's a little tricky but it should work.
You will need to follow my instructions to the letter.
First thing I want you to do is get your phone back to factory state.
#1 Flash the Lollipop RUU that I gave you before.
#2 Make sure you are S-off and Super CID 11111111 and boot loader is unlocked.
#3 Make sure you activate the phone and have everything working.
#4 Install TWRP Recovery and make a full backup select /system /system image /data /boot
I need to upload the general unlocked RUU for you to flash.
So I will do that now.
Let me know when you have completed the above steps.
What were gonna try is to flash the developer RUU.
Unfortunately it dosen't have sprint as a option for carrier.
So once we have the developer RUU installed we will install your backup in twrp.
Only to restore the /system /system image and /data.
Then maybe your sprint activation and settings will stick.
But you will still have the unlocked radio and bootloader.
Like I said let me know when your have done the previous steps.

Related

Dealing with busybox LS output in Windows

If you are using ADB Shell on a Windows machine and try to LS with busybox on your phone it will add color coding along with directory and file names.
To get rid of this you need only need to type [1] in the command prompt.
If you would like an LL type function added you can also put in [2].
[1] alias ls='ls --color=never'
[2] alias ll='ls -la --color=never'
Is there any way to get these aliases to stick?
The aliases go away every time I open a new ADB Shell. :\
##########edit1
I found that you can use PuTTYcyg to properly display the colors if you have Cygwin installed on your machine.
I just selected "Cygterm" for "Connection type" and put "adb shell" in "Command (use - for login shell)".
I would still like to have an alias for LL at least if we can figure out a way to get the aliases to stick.
Thanks!
##########edit2
In case people have no idea what I'm talking about.
Busybox LS output with color in Windows CMD:
Code:
# ls
ls
←[1;34mcache←[0m ←[1;36metc←[0m ←[1;34mroot←[0m
←[1;34mconfig←[0m ←[1;32minit←[0m ←[1;34msbin←[0m
←[1;36md←[0m ←[1;32minit.desirec.rc←[0m ←[1;34msdcard←[0m
←[1;34mdata←[0m ←[1;32minit.goldfish.rc←[0m ←[1;34msqlite_stmt_journals←[0m
←[0;0mdefault.prop←[0m ←[1;32minit.rc←[0m ←[1;34msys←[0m
←[1;34mdev←[0m ←[0;0mlogo.rle←[0m ←[1;34msystem←[0m
←[1;34memmc←[0m ←[1;34mproc←[0m
Busybox LS output without color in Windows CMD:
Code:
# ls --color=never
ls --color=never
cache etc root
config init sbin
d init.desirec.rc sdcard
data init.goldfish.rc sqlite_stmt_journals
default.prop init.rc sys
dev logo.rle system
emmc proc
And now color just looks like one of the weirdest words to me after looking at it for so long....
COLOR.
I got an LL going if anyone is interested. Basically using this guys instructions but making it for ll instead of dir.
1) Create a file named ll in /system/xbin
With this in it [NO COLOR]:
Code:
#!/system/xbin/sh
ll(){
ls -la --color=never [email protected]
}
ll [email protected]
OR
With this in it [COLOR]:
Code:
#!/system/xbin/sh
ll(){
ls -la [email protected]
}
ll [email protected]
2) Set file ownership/permissions
Get an ADB Shell:
Code:
cd /system/xbin
chown 0 ll
chmod 755 ll
The LL command will work immediately after setting ownership/permissions on the LL file. It's a workaround for now but works great.
Updated first post.
Not at all
The shortest way to do it is:
Code:
# alias ls="ls --color=never"
What I wonder is how to get rid of the annoying ECHO..
Long term fix?
Any better ways to fix this? I never used to have this problem, but all of a sudden, after messing with ADB over WiFi, now I do have this problem
http://forum.xda-developers.com/showthread.php?p=14564633
The alias only works for a single cmd session
update
ScottHW said:
Any better ways to fix this? I never used to have this problem, but all of a sudden, after messing with ADB over WiFi, now I do have this problem
Click to expand...
Click to collapse
Small update: I noticed that I actually only have the problems with ls -al when the phone is fully booted. When I use adb booted in Recovery (CWM) the file listings are fine.
It's possible that I have never used adb while the phone is fully booted before, and just assumed that the Recovery behavior was universal and when I got the funky behavior, it wasn't messing around with ADB, it was just because I didn't know what "normal" was.
Short term fix is still just to use an alias for ls
But you have to redo it every time you restart adb

Change the boot sound w/o re-flash the ROM for G7

1. Prepare a short mp3 and name it android_audio.mp3
2. Put the mp3 under the adb folder
3. Save the following code as !bootaudio.bat (I use this name)
4. Turn your phone into ADB debugging mode
5. run !bootaudio.bat
6. Reboot your phone and have fun!
This should work on almost all G7
Tips: During the boot animation, the volume would change twice. So I suggest insert 1 second before the audio for escaping from the volume changing side-effect.
Code:
adb shell mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
adb shell rm /data/local/android_audio.mp3
adb push android_audio.mp3 /data/local/
adb shell rm /system/customize/resource/android_audio.mp3
adb shell ln -s /data/local/android_audio.mp3 /system/customize/resource/android_audio.mp3
adb shell ls -l --color=never /data/local
adb shell ls -l --color=never /system/customize/resource/
adb pull /system/customize/CID/default.xml
pause
Script description:
Mount the system path to enable writing access.
Remove the original boot sound if it exists.
Push your mp3 into the data/local, where the bootanimation.zip is.
Make a link to data/local/android_audio.mp3
List the two affected pathes for you to confirm the result
Pull the default.xml out from the phone, if you find it not work after reboot, you can check the xml to see what the actural fullpath it is using. And manually change the script to try again.
My current boot sound is attached to the thread.
Hi there, I have an error when trying to link beacause the folder does not exist... may I create it manually?!

EVO Shift Temp Root for 2.3.3 and HBoot Downgrade

To downgrade your HBOOT to go back to 2.2 visit this link http://forum.xda-developers.com/showthread.php?t=1255474
This will allow you to flash 2.2 to perm root the phone
If you wish to help with perm root status for Android 2.3.3, please visit this thread http://forum.xda-developers.com/showthread.php?t=1218580
Thanks to everyone in this post who has helped get this far. You will need to have the Android SDK installed and working knowledge of ADB and basic file system structure.
Major help from minneyar
TEMP ROOT Instructions:
Download http://tinyw.in/1lI
Unzip if required and put in your ADB folder
Launch command prompt and navigate to your ADB folder
adb push fre3vo /data/local/tmp/
adb shell
chmod 777 /data/local/tmp/fre3vo
/data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF (if this doesn't work, try rebooting phone)
Download these 2 files here and put them in your ADB directory: http://forum.xda-developers.com/showthread.php?p=14927732#post14927732
exit back to command prompt if you aren't there already
adb push Superuser3-beta1.apk /data/app/
adb push su-3.0-alpha7 /data/local/tmp
adb shell (should now see # instead of $)
cd /data/local/tmp
chmod 777 su-3.0-alpha7
./su-3.0-alpha7
cd /
mount -o remount,rw -t rootfs rootfs /
rm vendor
mkdir vendor
mkdir vendor/bin
cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su
chmod 4755 /vendor/bin/su
You now have temp root. Disregard any notification about outdated SU binary. Root will go away if you reboot. If you reboot your phone you can obtain root again by just running the following
adb shell
chmod 777 /data/local/tmp/fre3vo
/data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
adb shell (should now see # instead of $)
cd /data/local/tmp
chmod 777 su-3.0-alpha7
./su-3.0-alpha7
cd /
mount -o remount,rw -t rootfs rootfs /
rm vendor
mkdir vendor
mkdir vendor/bin
cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su
chmod 4755 /vendor/bin/su
I haven't found a way to re-root after rebooting without connecting to a PC
Type su and see if it gives you root permissions
Sent from my MiuiSpeedy
says su: not found.
You are saying you cannot install the superuser app? From reading in the Evo3D forums, you could install Superuser, even without being rooted, but it obviously won't allow root access, until you run a root exploit.
Try rebooting the phone, installing superuser, run fre3vo, and then try the adb shell, and su method.
This is getting interesting. Hopefully you are on to something.
Stuke00 said:
See screenshot. Doesn't the # mean temp rooted? Tho I cannot install SU and Root Explorer isn't working. Anything else I need to do first or something?
Click to expand...
Click to collapse
Looks hopeful!
tokuzumi said:
You are saying you cannot install the superuser app? From reading in the Evo3D forums, you could install Superuser, even without being rooted, but it obviously won't allow root access, until you run a root exploit.
Try rebooting the phone, installing superuser, run fre3vo, and then try the adb shell, and su method.
This is getting interesting. Hopefully you are on to something.
Click to expand...
Click to collapse
Okay let me clarify
I can install SU but it wouldn't install the binaries. I did all of the above. Says su: not found.
I then tried something else.
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cat /system/bin/sh > /system/bin/su
# chmod 4755 /system/bin/su
I was then able to get the SU binaries to install but Titanium Backup says:
"Busybox works but the "su" command does not elevate to root: "whoami" reports "app_135" instead of root/uid 0.
then su from the command prompt was saying "link_image[1935]: 3160 missing essential tablesCANNOT LINK EXECUTABLE" and now back to su: not found again....
I don't know enough about linux commands to give you any real info. Like in the other thread, talk to agrabren, to see what he has to say.
tokuzumi said:
I don't know enough about linux commands to give you any real info. Like in the other thread, talk to agrabren, to see what he has to say.
Click to expand...
Click to collapse
Yeah I tweeted him with what I could provide with 160 characters. Just waiting now.
Well here's a tweet he put out a couple of hours ago.
@agrabren: For those with the SHIFT, it's a known bug in my code that we missed the address. One too many zeroes in the list. I'll try to fix it soon.
Sent from my PG06100 using XDA App
crump84 said:
Well here's a tweet he put out a couple of hours ago.
@agrabren: For those with the SHIFT, it's a known bug in my code that we missed the address. One too many zeroes in the list. I'll try to fix it soon.
Sent from my PG06100 using XDA App
Click to expand...
Click to collapse
Yeah he posted that right after I gave him the memory address for the exploit. Just means that I did it the manual way through debugging. At least I think so... hopefully soon!
Good news, everybody! I have successfully acquired temp root on my Shift!
First, fre3vo has to be pointed at the right address. After copying it over to my phone, I did "adb shell" and then ran it like so:
/data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
That printed out a message that it found an exploit and kicked me out of the shell. After doing "adb shell" again, I got a command prompt. I tried installing the 2.3.6.3 version of Superuser, but it complained about being unable to install "su"; I tried to find a separate su binary and copy it over manually, but it didn't work due to a linker error.
After searching around, I found a beta version of Superuser 3:
http://forum.xda-developers.com/showthread.php?p=14927732#post14927732
First I uninstalled the old version of Superuser and then used adb to install the new one from that thread. I ran it and it said it was unable to install su, so I downloaded the version of su provided there and installed it manually. The process went something like:
Code:
adb push su-3.0-alpha7 /data/local/tmp
adb shell
# cd /data/local/tmp
# chmod 4755 su-3.0-alpha7
# ./su-3.0-alpha7
# mount -o remount,rw -t ext3 /dev/block/mmcblk0p26 /system
# cat su-3.0-alpha7 > /system/bin/su
# chmod 4755 /system/bin/su
I don't know if explicitly running "./su-3.0-alpha7" is necessary, it just seemed like a good idea at the time. I don't know if everybody's block device will be named "mmcblk0p26", I used "mount" to figure out what was mounted at /system.
Anyway, after all that was done, I ran Superuser again and it didn't complain. To test it out, I started up Wireless Tether. It asked me for superuser permissions, which I granted it, and it's working fine.
Root successful!
Good job!!
Sent from my Speedy HTC EVO shift on XDA Premium app
I followed those steps exactly and got what I would call a partial root. Some of the 'you need root' errors are gone but "su" still results in 'not found' even though "mkdir su" results in 'file exists.'
mmcblk0p26 exists on this unit.
The weirdest part is that Adfree will accept the device as rooted and with superuser but says it can't find a partition to modify. And after a reboot root is definitely gone.
I think you're on to it but it isn't quite there yet.
It seems to be fully temprooted to me; I have to redo it if I reboot, but otherwise it's working perfectly. After following the steps I listed above, running "ls -l /system/bin/su" should produce this output:
Code:
# ls -l /system/bin/su
ls -l /system/bin/su
-rwsr-xr-x root root 22228 2011-07-25 19:14 su
If it says "No such file or directory" instead, then the su binary isn't in the right place.
Looking back over what I wrote, I think I left out a step -- if you were following what I listed exactly, it probably won't work, because I forgot to change to the /data/local/tmp directory. I'll update that...
Update: after playing around with it for a while, something is definitely not quite right. Everything works fine at first; I've tested Wireless Tether and Titanium Backup and they're both fine. After leaving my phone for a while and coming back, though, applications that try to get root access mysteriously fail. The dialog prompt doesn't even appear.
Going back into the adb shell, /system/bin/su is still there, but trying to run "su" causes this to happen:
Code:
# su
su
link_image[1935]: 3802 missing essential tablesCANNOT LINK EXECUTABLE
But if I use cat to overwrite su and then chmod it again, everything works. su must somehow be getting modified by something else and replaced with a bad version... but I'm not sure where to look.
I caught something like that.
I think there should be a chmod 777 su-3.0-alpha7 after cd /data/local/tmp
minneyar said:
It seems to be fully temprooted to me; I have to redo it if I reboot, but otherwise it's working perfectly. After following the steps I listed above, running "ls -l /system/bin/su" should produce this output:
Code:
# ls -l /system/bin/su
ls -l /system/bin/su
-rwsr-xr-x root root 22228 2011-07-25 19:14 su
If it says "No such file or directory" instead, then the su binary isn't in the right place.
Looking back over what I wrote, I think I left out a step -- if you were following what I listed exactly, it probably won't work, because I forgot to change to the /data/local/tmp directory. I'll update that...
Update: after playing around with it for a while, something is definitely not quite right. Everything works fine at first; I've tested Wireless Tether and Titanium Backup and they're both fine. After leaving my phone for a while and coming back, though, applications that try to get root access mysteriously fail. The dialog prompt doesn't even appear.
Going back into the adb shell, /system/bin/su is still there, but trying to run "su" causes this to happen:
Code:
# su
su
link_image[1935]: 3802 missing essential tablesCANNOT LINK EXECUTABLE
But if I use cat to overwrite su and then chmod it again, everything works. su must somehow be getting modified by something else and replaced with a bad version... but I'm not sure where to look.
Click to expand...
Click to collapse
YES! I have root! I was able to install a screenshot app and test it this is amazing progress! Thanks for that.
So now when I reboot, you have to do the entire thing again? SU and all?
Stuke00 said:
So now when I reboot, you have to do the entire thing again? SU and all?
Click to expand...
Click to collapse
Yes, every time you reboot you'll have to redo the whole process, including running fre3vo and then copying su into /system/bin. Hopefully somebody will figure out a permanent root soon.
Wow those SU binaries are disappearing before I even reboot! Already gone and I haven't rebooted the phone
I think I had that issue too. I just couldn't believe the files just disappeared and thought I did something wrong somewhere.
Would a logcat help anyone at all? Anything I should look for?

[Q] /system/bin 100% full?

Hi,
I unrooted and ran the 4.5.141 update. I'm now on Android OS 2.3.6. I am now trying to follow the directions to re-root from here: http://www.android-advice.com/2012/root-the-motorola-atrix-4g-running-4-5-141/
However, when I get to the step where I run the command:
Code:
cp /preinstall/su /system/bin/
I get the error "cp: write error: No space left on device" which I thought was very odd....so, I ran the command
Code:
df /system/bin
and the output I see is:
Code:
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/block/mmcblk0p12
326071 326068 3 100% /system
Is this possible? How do I get su back on to /system/bin?
How can it be that the /system partition is full? Is there a way to resize it, if that's the case?
Please help!!!
did you do step 6 before step 4
check this out THIS
Obviously, otherwise it won't work. My problem is that /system has no free space. How is that possible?
quordandis said:
Obviously, otherwise it won't work.
Click to expand...
Click to collapse
a simple 'yes', without 'tude, would have sufficed.
Ok, here's what I had to do to make this work. First, you have to check if you have Superuser.apk saved in /system/app. If you do, delete it (you'll reinstall this later).
Since I also wanted to install the latest version of Swype, first, rename /system/lib/libSwypeCore.so to /system/lib/libSwypeCore.so.bak
Then, cp /system/app/Swype.apk /sdcard/Swype.apk.bak
After you've copied the stock Swype to the sdcard, then rm /system/app/Swype.apk
This should provide you with enough room on /system to cp /preinstall/su /system/bin/su
The rest should follow accordingly.
-Q

[HOWTO] Add init.d to stock ROM + a few other goodies

I have been resisting the urge to flash a custom ROM for a bit, but I really miss having init.d support. So I read a few threads for other phones and rolled my own.
Warnings
I borrowed bits and pieces from various places. If you don't know what init.d is, you probably don't want to do this. If you aren't willing to take responsibility for bricking your tablet, don't do this. Seriously, the risk of bricking is very low, but if you aren't comfortable booting into an adb shell from recovery, maybe this is not for you. Strongly suggest a nandroid backup before you get started so if you totally bork things you can just hit rewind.
Note: The latest CWM may prompt you on a reboot that the ROM may overwrite the bootloader and offer to fix it for you. Don't do that. The init.d hack takes over the bootloader install script, but does not change your bootloader! If you accidentally do let it fix things for you, just rebuild the install-bootloader.sh file. The other steps should be fine.
Prerequisites
First, you need root, busybox, and some sort of terminal (either adb, or some terminal you like using on the tablet).
I have found that I like Busybox Installer (from the market; https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer) but for some reason it doesn't create new symlinks unless you click advanced install.
Let's get to it!
In the shell (don't type # or anything after #):
Code:
su # get root
mount -o remount,rw /system # get access to /system (4.04 seems to mount ro as is usual; seems like the original mounted rw)
which run-parts # if you don't see /system/xbin/run-parts you need to install/reinstall busybox; if it is somewhere else, note it
mkdir /system/etc/init.d
Create a file called sysinit -- we are going to put it in /system/bin. You can edit it in place with vi, mount your tablet and edit it on your computer, or create it on the computer and push it via adb. Whatever.
Here's the file (you do need the # and the things after it in the file!):
Code:
#!/system/bin/sh
export PATH=/sbin:/system/sbin:/system/bin:/system/xbin
/system/bin/logwrapper /system/xbin/run-parts /system/etc/init.d
Note that if your run-parts is not in /system/xbin (from the which command) then fix the above to reflect your reality.
In the shell, make it executable
Code:
chmod 755 /system/bin/sysinit
Now go in the init.d directory and create some things you want to run at start up. For example:
Code:
cd /system/etc/init.d
echo '#!/system/bin/sh' >99test # note: you do need the first # in this line but not the 2nd!
echo 'date >>/data/tmp/init.d-log.txt' >>99test
chmod 755 99test
Here's a more practical one (yes, you need the # signs). Name it something like 10diskperf -- don't forget to chmod it.
Code:
#!/system/bin/sh
# Set disk read aheads to 1024
chmod 777 /sys/block/mmcblk0/queue/read_ahead_kb
echo "1024" > /sys/block/mmcblk0/queue/read_ahead_kb
chmod 777 /sys/block/mmcblk1/queue/read_ahead_kb
echo "1024" > /sys/block/mmcblk1/queue/read_ahead_kb
chmod 777 /sys/devices/virtual/bdi/179:0/read_ahead_kb
echo "1024" > /sys/devices/virtual/bdi/179:0/read_ahead_kb
Or here is one to tweak some TCP parameters (25sysctl):
Code:
#!/system/bin/sh
sysctl -w net.core.rmem_max=524288
sysctl -w net.core.wmem_max=524288
sysctl -w net.ipv4.tcp_rmem=6144 87380 524288
sysctl -w net.ipv4.tcp_wmem=6144 87380 524288
Whatever files you put in, you need to remember to make them executable (chmod 755).
Finally, you need to kick it all off at start up. The hack for that is we are going to create /system/etc/install-recovery.sh which apparently runs on each boot.
Code:
cd /system/etc
echo '#!/system/bin/sh' >install-recovery.sh
echo '/system/bin/sysinit' >>install-recovery.sh
chmod 755 install-recovery.sh
Tips and troubleshooting
If you are too lazy to cut and paste I have the files here (View attachment init.d-support.zip) that you can just move to the right places and change permission. If you are really lazy there is lightly tested install script below.
I like to try running the whole thing before a reboot to see if I get any errors:
Code:
/system/etc/install-recovery.sh
I'd suggest putting the 99test file in first. Verify that you get the expected file in /data/tmp and then reboot and check again. Then you can remove 99test.
Same goes for adding new scripts. Try running them from the shell to see if they throw errors before you reboot!
If you have trouble, see if this looks right:
Code:
ls -ld /system/etc/install-recovery.sh /system/bin/sysinit /system/etc/init.d /system/xbin/run-parts
-rwxr-xr-x root root 39 2012-07-14 10:00 install-recovery.sh
-rwxr-xr-x root root 140 2012-07-14 10:01 sysinit
drwxrwxrwx root root 2012-07-14 10:10 init.d
lrwxrwxrwx root root 2012-07-14 09:55 run-parts -> /system/xbin/busybox
For the brave
The install-init.d zip file (View attachment install-init.d.zip) contains a lightly tested script that SHOULD do the install steps for you.
Send the file to your android to someplace that can execute code (e.g., /system/xbin; I had to use adb to put it on the sdcard and then move it to /systemxbin in the shell since I don't have the adb root kernel installed).
Code:
cd /system/xbin # or wherever you have it
chmod 755 install-init.d
./install-init.d
It performs rude checks to see if init.d exists, and tries to handle moving or missing busybox. It only installs 99test as a script.
Let me know if this works or doesn't work for you.
For the extra brave: There is no reason this should only work on the Samsung. This ought to work on pretty much most stock ROMs as long as they execute install-recovery.sh on start up.
Scripts
What do you put in your init.d? If you post anything cool I'll put it up here in the op.
One that gave me some real gains in I/O performance required a new version of the tune2fs executable. By default, it is part of busybox but the busybox one only has a few simple options. I've included a stand alone version and the script 10disktune here View attachment disktune.zip. Unpack the zip and put the 10disktune in /system/etc/init.d (don't forget to chmod) and put tune2fs in /system/bin (chmod that too). Note that busybox has one in /system/xbin but the script specifically calls out the one in /system/bin.
Here's one that will zipalign your apks on each boot
Code:
#!/system/bin/sh
for apk in /data/app/*.apk ; do
zipalign -c 4 $apk
ZCHECK=$?
if [ $ZCHECK -eq 1 ]; then
zipalign -f 4 $apk /cache/$(basename $apk)
if [ -e /cache/$(basename $apk) ]; then
cp -p -f /cache/$(basename $apk) $apk
rm /cache/$(basename $apk)
fi;
fi;
done;
Fin
Corrections welcome. I considered using exec or . to load some of this into one shell but given that it runs once at startup, I figured it is fine as is.
All files for reference
View attachment init.d-support.zip
View attachment install-init.d.zip
View attachment disktune.zip
Great guide, gonna try it tonight.
Sent from a GNote, hell yeah!
SirRhor said:
Great guide, gonna try it tonight.
Sent from a GNote, hell yeah!
Click to expand...
Click to collapse
I'm curious how it went. If you ran into any issues, let me know so I can update the op. Thanks!
Hmm did anyone get this to work?
wd5gnr said:
Hmm did anyone get this to work?
Click to expand...
Click to collapse
I did it on my Galaxy Nexus.
It works great, I had a bit of problem with the sysinit file, but when I downloaded your zip file and used your sysinit, it worked, so it must be a problem from my side
Thanks for this, I can finally use "Odex Me"
aavan said:
I did it on my Galaxy Nexus.
It works great, I had a bit of problem with the sysinit file, but when I downloaded your zip file and used your sysinit, it worked, so it must be a problem from my side
Thanks for this, I can finally use "Odex Me"
Click to expand...
Click to collapse
Great, just wanted to be sure I hadn't made any typos/errors in the guide.
A lot of init.d files collected here: http://forum.xda-developers.com/showthread.php?t=1227269
Also build.prop things, etc.
Thanks, I use your guide and worksperfect for my RK3066 devices. Very simple to understand all steps and what we are doing to our system, perfect for me. Thanks again dude
Melch1zedeK said:
Thanks, I use your guide and worksperfect for my RK3066 devices. Very simple to understand all steps and what we are doing to our system, perfect for me. Thanks again dude
Click to expand...
Click to collapse
Glad to help!
What is thhe utility of this?
moliverac8 said:
What is thhe utility of this?
Click to expand...
Click to collapse
Init.d is how Linux and many Android (which is kind of Linux, after all) systems manage executing commands on boot up.
The /etc/init.d files run in numerical order as root and you can do things like change system settings, manipulate the file system, etc.
See the init.d section linked below for some ideas.
http://forum.xda-developers.com/showthread.php?t=1227269
Question? what is the difference in this method and running a script?
wd5gnr said:
Init.d is how Linux and many Android (which is kind of Linux, after all) systems manage executing commands on boot up.
The /etc/init.d files run in numerical order as root and you can do things like change system settings, manipulate the file system, etc.
See the init.d section linked below for some ideas.
http://forum.xda-developers.com/showthread.php?t=1227269
Click to expand...
Click to collapse
I use the "swap memory script" and was wondering if it would also work this way with the init.d If so would there be any benefit this way over the current way of running it one way or the other? One drawback I see running the script as is is that I have to wait once the system has fully booted until the script has run and I see the Smanager screen to let me know that my memory has been remounted.
Thanks for the info and the learning process.
Here is the script and the link.
http://forum.xda-developers.com/showthread.php?t=1961097
Code:
sleep 5
mount -o remount,rw /
mount -t vfat -o umask=0000 /dev/block/vold/179:25 /mnt/sdcard
sleep 5
mount -o bind /data/media /mnt/extSdCard
As long as the device is ready to mount at boot time and doesn't get remounted, ought to work. Backup and try it
External memory wasn't ready
wd5gnr said:
As long as the device is ready to mount at boot time and doesn't get remounted, ought to work. Backup and try it
Click to expand...
Click to collapse
Thanks for the guide, but I think that the external memory was not ready to be mounted at that time. it didn't see the card till after boot. It was worth a shot, Reverted back to the script in /data and all worked again,
Note: I didn't find /system/xbin/run-parts however, I did find /system/bin/run-parts and changed the path to reflect that, I don't think this was an issue but I'm not 100% sure.

Categories

Resources