yashsingh1/xdaforums huggingface dataset:
[Acer Iconia A500] dhruvmp:
I thought that the problem was that the recovery expects signed files, not necessarily the bootloader itself. Well I guess the bootloader itself may not be secure from what you found?

Have you guys sorted out the correct partitions after the dump, or is that you have been working on?
[Acer Iconia A500] thor2002ro:
i think we cant remake the image file correctly... because i unpacked the recovery then repacked it and when i replaced recovery with the repacked recovery i still received SOS error....
[Acer Iconia A500] dhruvmp:
It is some sort of checksum verification? Unless their is something in the recovery.img that is verified during flashing.

Is there an internal system log created during recovery flash that shows the verification process? I know the lack of open source makes all this very difficult.
[Acer Iconia A500] thor2002ro:
doesn't keep any log the only difference is that original image is 5mb and repacked is 3mb but that's because the original image is 00-ed to 5mb... maybe that's the problem...
[Acer Iconia A500] aDigitalPhantom:
has anyone figured out what aboot is for, and is it normal for /boot not to be mounted on a running device?

has anyone seen this? remove the .txt for correct filename
[Acer Iconia A500] thor2002ro:
dont know what aboot is for... its linked to the data partition and i have 20gb of data... so no dump there...
[Acer Iconia A500] daveba:
Yes that's old news. Read here.
[Acer Iconia A500] lpachuong:
is it just me or st is wrong? after I flash the update.zip, i can't see my tablet from my computer =(
[Acer Iconia A500] SirDVV:
Ok I'm sure I'm wrong but has anyone tried this?

http://www.hard-reset.com/acer-iconia-tab-w500-hard-reset.html

Its for w500 but maybe it works the same way.
[Acer Iconia A500] dhruvmp:
I can't imagine that would work given that is a windows tablet with totally different hardware and underlying firmware.

I wonder if anyone has made anymore progress with trying to edit the update.zip by adding in some custom recovery. I know thor tried but his recovery.img was a different size. I wonder if editing the stock recovery.img could be more useful, or at least stealing the header from that img and adding it to the custom recovery, if that is possible.
[Acer Iconia A500] dc13:
he did use the stock recovery.
[Acer Iconia A500] dhruvmp:
Ok, now I understand, he repacked it with the same stock recovery and it gave him an error.

That would make me think their is some internal checksum verification, especially if all of the file contents are the same.

Damn them for not making this open source.

On another note:

Engadget posted an article about us getting 3.1!!!!!:D

http://www.engadget.com/2011/05/17/acer-iconia-tab-a500-and-asus-eee-pad-transformer-getting-androi/

On another note, I am fairly optimistic about the prospect of update for us in the future. The A100 got pushed back to H2 2011. It is very similar hardware from my understanding, which hopefully means they are getting it ready for Ice-Cream Sandwich!!!
[Acer Iconia A500] takenone:
Has anyone thought of telling Acer that they are violating the Open Source Policy for the AndroId operating system? If I remember correctly it was on these grounds that the folks working on the Huawei Ascend got their source. And this is only fair, as Android is a completely open source project. I dont really think that Acer is entitled to decide if they are going to release the recovery are they? I mean Acer isn't really allowed to bend Google's open source project and policies regarding it are they?
[Acer Iconia A500] digitalyz:
Didn't google decide 3.0 wasn't going to play by those rules and that's why no

Aosp for honeycomb?
[Acer Iconia A500] aDigitalPhantom:
i know i am a noob at this....but why is there a file named "keys" in the stock recovery? sorry if this has been covered before.
[Acer Iconia A500] Euclid's Brother:
Since HC3.1 is supposed to come out in a few weeks, doesn't that mean we'll finally have a legit recovery? or am I way off base?
[Acer Iconia A500] thor2002ro:
been thinking the same thing... but they are not violating the android open source(google didnt release the honeycomb source :( ), the violation is in linux kernel... thats a GPL license...
[Acer Iconia A500] takenone:
Maybe they want to wait more over until its 100% stable and more established, because from what I've noticed, almost all of the devices have some quirk or another. Maybe its just not stable enough and they don't want to admit it? Hehe but yeah I did read that they are going to release it, but not yet. And I'm assuming that when they do release it, it's going to come with all kinds of red tape as far as devices go. Aside from the stability of the platform itself, they also have a rather large concern with people porting this os over to phones, as they truly designed it for tablets.

In other words, I think they want all the firsts on this one, because needless to say, developers and the community have set a rather HUGE bar for Google in terms of what we want in our Android devices :-)
[Acer Iconia A500] sp3dev:
Could you contact your local acer support and request the source code for linux kernel in accordance with the terms of GPL? I have myself tried to do some week ago or so and was silently trolled by their bureaucrats - the american support office refused to handle my request as my device S/N is for eastern europe and the russian one refused because the device has not been officially launched here yet.
[Acer Iconia A500] dhruvmp:
I agree with what someone had said in another post. I think Google is not releasing the open source because they did such a poor job in programming. They did announce that they would be releasing it eventually, I wonder if it will be when 3.1 comes out for all devices.
[Acer Iconia A500] webfly2:
I did, but they told me that it's googles fault.

They said:

"Leider können wir Ihnen auch die Kernel-Source-Codes nicht zu senden, da diese von Google bisher noch nicht freigegeben wurden.

Ob und wann die Codes freigegeben werden liegen leider nicht in der Entscheidungsgewalt von Acer. Diese Entscheidung trifft allein Google."

-----------------------------------------------------------------------------

"Unfortunately, we can't send you the kernel-source-codes either, because they are not released by google at the moment.

If an when the codes will be released is not a decision made by acer. That decision is only made by google."

Sry for my bad English^^
[Acer Iconia A500] thor2002ro:
that's a bunch of bull**** "android kernel"(the linux kernel) is not owned by google...

and another thing... here's the generic kernel http://android.git.kernel.org/?p=ke...g;h=refs/heads/android-tegra-2.6.36-honeycomb

so the kernel is public... we need the customized one that acer made...
[Acer Iconia A500] Slowie911:
I have just sent them the following message

Customer ------- 18/05/2011 03.43 PM (UK time)

Is it possible to provide the custom Linux Kernel which acer has for this tablet as it is licensed under the GPL.

the generic kernel is here

http://android.git.kernel.org/?p=ke...g;h=refs/heads/android-tegra-2.6.36-honeycomb

this is not a google owned kernel and it is illegal to withhold the code as shown in the GPL license which the code is under

i have also signed up with my work email which is a solicitors so hopefully ill get a decent response

*UPDATE*****

the response i got off acer online support was

Dear ***********,

Thank you for contacting Acer UK.

Regarding your enquiry, we provide support for technical issues related to hardware and basic support on software if they are inoperable. This particular issue requires an extra ability of experts advice and we have a dedicated support services that are great for answering on " How to" questions. These support agents provide their "best efforts" in resolving these sort of issues. We request you to contact them and the contact number 0906 706 8000 (0.50 £ /Min).

For further assistance please do not hesitate to e-mail or contact us on 0871 760 1000 (UK), 0818 202 210 (Eire).

Regards

Rakesh Vankayala

Agent ID 1168

Acer UK Online Technical Support Team

so they want me to pay to ask a question on whether they are going to continue to ignore the fact that they are breaking the law or are they going to supply me with the kernel
[Acer Iconia A500] takenone:
Trust me, they don't want to give it up because they know that's what people really need right now. But in regards to the Hineycomb source, Wikipedia proved what I said right somewhat.

http://en.wikipedia.org/wiki/Android_(operating_system)

I'm not even going to try and say Wikipedia is wrong because I'm sure they have hit men to fix that, so I'm taking it that the Honeycomb source, will in fact be releases after 3.1, or as its referred to strangely, and I mean wow even for google, Ice Cream Sandwhich.

This is scheduled for anytime soon, and this is from the mouth of Google. (And wikepedia :-) )

Edit: After further investigating, it seems that the honeycomb source will in fact never be released because it is in fact a broken platform in a sense.

http://www.geek.com/articles/mobile...-source-will-never-exist-on-its-own-20110510/

The update to 3.1 is actually for preparation of the Ice Cream Sandwhich, which will be a unifying of the 3.1 and 2.3 systems to create a more "familiar" feel across the platforms. We may be able to get the kernel, but it will take some working of Acer. Unfortunately we will most likely never see the honeycomb source.

Sorry to be the bearer of bad news folks.
[Acer Iconia A500] Shigster:
I just had a lengthy call with level 2 customer support.

Basically they told me that they are unable to release the kernel because apparently that's all dealt with internal affairs (the programmers don't talk to the public and are not allowed to be contacted)

I had to be transferred to customer escalation but they asked me to register my product. I kinda got afraid so I didn't purse so if anyone wants to go ahead and ask to be transferred straight to customer escalation and see what happens.

Yeah it seems that they have no idea what is going on at customer support and all internal affairs is off limits.
[Acer Iconia A500] eBug:
I contacted Acer Spanish support office some 3 weeks ago, requesting access to kernel source code as per GPL. I didn't get any answer.
[Acer Iconia A500] dhruvmp:
These are the portions of your dump that I am very interested in, can anyone with real knowledge of these systems chime in?

ro.build.fingerprint=acer/picasso_generic1/ventana:3.0.1/HRI66/eng.hermit.20110318.221911:user/release-keys

\\assuming this is just device identification

ro.build.tags=release-keys

\\same

ro.bootloader=unknown

\\why is the bootloader uknown (or are they hiding it?)

ro.bootmode=unknown

\\why is the bootmode unknown, it should know what mode it is booting into

ro.debuggable=0

\\can we make this =1 :D?

ro.factorytest=0

\\factory test mode?

sys.settings_secure_version=2

\\change system settings to be insecure? :rolleyes:

I am wondering if all it would take is to make the system debuggable, or see what the xoom has in its loadup and compare the two.
[Acer Iconia A500] tabaddict:
http://xdaforums.com/showthread.php?p=13922610

Allow me to shamelessly plug my own recent thrad in this context. You mention a need for donor / sacrifice devices and I might just have one of those. Refer to thread for details and conditions.
[Acer Iconia A500] eBug:
Just emailed gpl-violations.org tonite. Here's their answer:
[Acer Iconia A500] thor2002ro:
nice.. maybe we get some sources out of them...
[Acer Iconia A500] seraphimserapis:
I already mailed them this error on 04/29 because Acer was very unpolite via Twitter. I described them everything I knew and answered some mails from them.

Hopefully they can force Acer to publish the sources soon..
[Acer Iconia A500] pancoasts:
Has anyone checked how they did it on Asus http://androidroot.mobi/asus-eee-pad-transformer-tf101-root-cwm-recovery/.
[Acer Iconia A500] brunsbanjo:
Maybe this helps!

EDIT:

I just realized that acer is using a "APK preinstaller" after factory reset...
[Acer Iconia A500] dhruvmp:
Did anyone figure out the partitions yet?

If so, then we should be able to just edit CWM and flash it to the recovery partition?
[Acer Iconia A500] sp3dev:
Did i guys tell you security sucks^W^W acer sucks?

Okay. Basically, acer, like other vendors, has used the stupid container format for rom images from android sdk, the one tagged 'msm-radio-update'. You can grab the script to pack updates into the format from http://www.opencodes.org/node/16. Now this was good news.

To flash the update, you need to write it to the cache partition (mmcblk0p4.. be careful. i have mistyped and erased mmcblk0p3 and lost some 2 hours before i figured that if you adb push to /data/local, files are executable. my luck i had a root shell opened so i could dd the system without using update.zip)

If i wrap the original recovery dumped from the device using this script, it flashes alright (one note though - we need to verify flashing offsets in the file.. oops), but if i modify it, it complains about checksum when booting.

So, what now? Acer's using signed bootloader. The images must be signed with Acer private key and the bootloader checks them (using public keys which are stored somewhere). To access nvflash, one needs to know the secure boot key. If we find alternative ways to flash recovery and kernel (maybe we just need to fix offsets), we can just install a custom second stage bootloader to load custom kernels. If not - the only thing left for us is kexec'ing from acer original kernel which still won't let you use custom kernel in android but will be useful to boot a kernel to load the system from sd card - I personally want to get a real gnu/linux with X11 running here. And if further updates fix security holes and leave us rootless - we're in trouble. The problem is that if the trusted bootloader is implemented properly (which I am more than sure... because it was not done by HTC or Qualcomm who always leave lots of security holes) we cannot even patch it. So our hopes are that either we can flash custom recovery or that acer officially unlocks the bootloader (on the one hand, iconia's not tied to any carrier so no reason in locking it. on the other one, acer's already being hostile to the community)
[Acer Iconia A500] thor2002ro:
you sure you are right? i didnt see the "msm-radio-update" header while checking the images...
[Acer Iconia A500] sp3dev:
Yeah, you didn't see it because the flashed ones don't contain it. This header is the part of android standard upgrade routine. To try out, do the following

1. Get the asus script from the url

2. get a copy of your recovery (the original one) and make an update package

bash makeblob recovery rcvr_dump rec.img

3. on the device, dd if=rec.img of=/dev/block/mmcblk0p4 (you need to write to the cache partition)

4. Reboot. Now, the bootloader finds the update tag in the cache partition and update recovery. When done, the device will reboot.

You can verify it works - if you flash a modified one, entering recovery will fail. If you then flash the original, it will succeed//
[Acer Iconia A500] tabaddict:
So, this is about as tight as the locked Motorola bootloaders?

I wonder... if the Asus has it as well, could it maybe be some kind of new policy dictated through Google themselves? They want a unified system with a highly controlled visual appearance that is unique to be recognized. So in that regard it would make sense. Whats with the Xoom? Locked down like our tablets as well?
[Acer Iconia A500] kudakeru:
The Xoom and the Transformer have been blown wide open. Google made Motorola release with an unlocked bootloader in exchange for being the first Honeycomb device.
[Acer Iconia A500] thor2002ro:
the asus guys had luck thats all... in the early days they got a devices with no signature checks and used that... but now asus loocked stuff similar to what we have...

edit:

research:

the blob that asus locked with had

EBT -> bootloader

LNX -> kernel

SOS -> recovery

now I think we can write the bootloader with a blob but how do we get a full bootloader from a device?
[Acer Iconia A500] sp3dev:
You know, these modern devices are made to make you hurt every time you try to escape from the security bootloader. Basically, if you flash the bootloader that's not properly signed, you'll get a brick - the security bootloader will just reboot the device every time it finds the wrong signature.

So, the first thing to find out is which kind of signature the images in the device memory have and where the signature is stored (one way would be to make a dump of mmc start (like first 10 mb of mmcblk0), then flash an update.zip that will replace linux boot partition with a new one and make a binary comparison with a new dump. If it's not a cryptographic digest like aes256 or rsa but a simple checksum, it can be fixed. Otherwise I'm out of ideas - the bootloader (the one that does check if the images are valid) may be stored in some other memory chip or in the cpu's internal memory (like in qualcomm chips). It may be that the secure boot key can be reset temporarily, but I doubt such a hack can survive soft reset so even if it is possible, we'll have to find ways to load the security bootloader from a running linux installation. Which is itself not too hard - the main problem is to get a dump of all bootloaders just to see how they work

If any attempts to bypass the bootloader fail, there's another plan yet - doing a kexec boot. We cannot modify initrd, but we can replace the first service that starts from /system with a boot menu that will allow either to continue booting or load a custom kernel via kexec. That's what Atrix 4G guys are planning to do.
[Acer Iconia A500] markklok:
Sry for asking it many time already.. But still looking for a image.img with Dutch language
[Acer Iconia A500] sp3dev:
Try installing MoreLocale on your current rom. I have tried it now (I have the German rom) and was able to choose both Dutch and Russian language and looks like Dutch is fully supported - i.e., all dialogs seem to be changed
[Acer Iconia A500] markklok:
thnx for the suggestion gonna look at it now :)
[Acer Iconia A500] thor2002ro:
here is mmcblk0 dump ~30mb

http://www.mediafire.com/?h690zp8cm3kb8ay
[Acer Iconia A500] sp3dev:
here is my dump of some partitions

http://www.mediafire.com/?9n7np448spn4gd4

mmc start is in the file "head". apart from different contents of the 'marker' block (that's what i call 0xfe0 bytes at every 0x40000 bytes - i assume it's some kind of NAND ECC data) it is interesting that my partition table is at 1 megabyte and your is at two megabytes from start
[Acer Iconia A500] webfly2:
What do I have to do to get a Dump???
[Acer Iconia A500] thor2002ro:
here are the asus

bootloader

,

kernel

and

recovery

the locked versions maybe we can find something...
[Acer Iconia A500] Shigster:
Do we know exactly what the Asus people did to get around the locked recovery? I know they had done it before Asus made it easier for them.
[Acer Iconia A500] richardtrip:
@sp3dev + @thor2002ro:

Did you check the update.acer.zip? there's an EC folder with EC_flash and ec.rom. Maybe we can find something in there. You can run the binary on the device and flash the ec.rom file with it. looks like a somewhat crippled version that can only write atm. /sys/EcControl/ECflashMode=1 on write.
[Acer Iconia A500] thor2002ro:
EC_flash is a weird one... I disassembled it and I think it flashes the bootloader(lots of boot block flash strings)...

and has some strings linking to ENE Flash Utility for ARM platform...

edit:

EC_flash usage:

"Usage: EC_flash [-bbl] [-e1] [-e2] RomF"

" -bbl Flash boot block too "

" -e1 Erase EC EEPROM 116K - 120K "

" -e2 Erase system EEPROM 120K - 128K "

also stuff related to "HTC_ril"
[Acer Iconia A500] sp3dev:
I have uploaded some kexec binaries and the sources for the kernel module. It ain't worky. Basically, kexec is broken heavily for armv7 although there are reports of it working on omap3. but for cortex A9 we need to modify some stuff like flushing caches. Basically what I want to do is to create a simple program that will draw direcly to the framebuffer (or well.. port LK bootloader) and implement my own kexec replacement (to make it simpler and be able to debug) but that's not going to happen soon - I'm busy with some university stuff this week and then I want to finish porting android to my phone..

http://www.mediafire.com/?7ij4gh9jupk0n40

I suggest that we make a separate topic for discussing bootloader and ways to circumvent security and ask some mod to move our posts there
[Acer Iconia A500] thor2002ro:
kexec doesnt work with armv7... checkout SE X10

https://github.com/freexperia/FreeXperia/tree/master/boot_tools

they used a kernel module then launching a separate boot.img with a separate loader...

all sources are there...

edit: only problem we got i didnt find a suitable bash script to hijack we can even have recovery like this...
[Acer Iconia A500] Fumetsu:
Question for some of the devs here:

If you were to ask Acer USA for files/info/whatever needed to help development support of the Iconia - what would you ask for? My company has a large account and does a lot of business with Acer and I was going to try to work some of my contacts to reach someone higher up on the food chain to show us powerusers some love. I'm a poweruser but not a dev, so I dont know what specifically to ask for or what specifically is needed. I think they may be more encouraged to do so with the Acer being the #1 selling Honeycomb tablet on the market at the moment.

Can't make any promises, but if we can get anything close to the inside support the Asus guys have I think this may help us a lot.
[Acer Iconia A500] kudakeru:
The biggest thing is going to be kernel source, but we could definitely use some information on the bootloader and package signing as well.
[Acer Iconia A500] splatoid:
Another idea

This is way out of my experience level but I work on Japanese scales and meat wrappers and not only do we have key codes but we also have touch screen pressure points to hold upon start up. On our bakery printers we hold the left corner touch screen with you thumb and then power up and that brings us into a recovery mode. And some of the other scales we have we have to hold three fingers spaced down one side of the screen and power up for the same.

Just food for thought...
[Acer Iconia A500] huxflux2003:
Even if we had the kernel source, we would be unable to flash a custom built kernel due to the locked bootloader.
[Acer Iconia A500] kudakeru:
I think it's possible via kexec to insert a custom boot menu and load a kernel from there. Without kernel sources to build off of, a custom kernel is pretty unlikely.
[Acer Iconia A500] sp3dev:
As for kernel sources, they *must* release them according to the license agreement but kernel is actually quite trivial to reimplement as tegra boards are very similiar. I'd rather ask them for the possibility to unlock the bootloader and flash custom images. Maybe in exchange we'll lose warranty - but that's obvious
[Acer Iconia A500] lpachuong:
ASUS already released the source code. Don't know what takes ACER so long.
[Acer Iconia A500] eliteone:
Lets just hope that the comming update will bring an unlocked bootloader, and some kernel sources.....
[Acer Iconia A500] Fumetsu:
Thanks for the info. I'll work my Acer contacts and see what I can get. If they can be convinced that they're perceived as hostile to the Android developer community and their competitors aren't, maybe they'll be more inclined to help us out.

Just to add, I'm thankful to the development here for all your work trying to unlock this thing for us to play with. Keep up the great work! :D
[Acer Iconia A500] eliteone:
Good luck my friend....... I believe we are all pulling for you:-) and maybe if you do suceed, the the fun can begin :-)
[Acer Iconia A500] _motley:
Thx for your help. Please also check out this post if you haven't seen it already, for my current perspective on things.

http://xdaforums.com/showpost.php?p=14035351&postcount=173