yashsingh1/xdaforums huggingface dataset:
[Android General] schriss:
You tried this method? http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

or this: http://www.mydroidworld.com/topic/9778-how-to-create-an-insecure-boot-image/

Here I found something new:

abootimg

abootimg-pack-initrd

abootimg-unpack-initrd

can install them after adding mirror:

deb http://ubuntu.mirror.cambrium.nl/ubuntu/ quantal main universe

abootimg seems a nice tool to unpack, repack and also update boot.img, so for example could try to update existing boot.img with modified ramdisk.

Problem 1: when trying to update existing boot.img with edited ramdisk, it fails ebcause new ramdisk file always is bigger than original. I don't know how to workaround that yet. Maybe it has to do with sizes and addresses we get when we do abootimg -i boot.img, that creates bootimg.cfg file with variables and there is Bootsize variable there.

Problem 2: abootimg works, but the other two I can't seem to be able to run/execute. But they do seem to be installed. It would be nice to use pack/unpack for dealing with ramdisk. Ideas?

Problem 3: when using abootimg to create new boot.img from existing zImage and new ramdisk AND providing that bootimg.cfg file as parameter it complains about size being too big. I assume its related to problem 1 and Bootsize variable in bootimg.cfg.
[Android General] Ivalex:
something to work with tonight, when my ladies are sleeping :p

thanks for your diggin

---------- Post added at 05:18 PM ---------- Previous post was at 05:14 PM ----------

anyway the second link, is the procedure i tried yesterday with my fedora installation.

---------- Post added at 05:23 PM ---------- Previous post was at 05:18 PM ----------

in addition I tried also feeding fastboot with kernel and ramdisk kept apart, so that the boot.img is built by fastboot itself, but this is even worst as the image is loaded, but boot is stuck.

cheers
[Android General] schriss:
Problem 3: when using abootimg to create new boot.img from existing zImage and new ramdisk AND providing that bootimg.cfg file as parameter it complains about size being too big. I assume its related to problem 1 and Bootsize variable in bootimg.cfg.

I have edited bootimg.cfg and simply removed bootsize variable, then it allows to build newboot.img. If it boots is another quation...
[Android General] schriss:
I assume you used cmdline parameter taken from our original boot.img, not the one used in the tutorial?
[Android General] Ivalex:
Correct, had to adapt the commands to our image.

Inviato dal mio PadFone 2 con Tapatalk 2
[Android General] schriss:
I tried the whole procedure of editing boot.img again but used abootimg this time to unpack and repack boot.img.

Then I compare them in HEX editor and header is almost identical, with just 2 or 4 bytes different which is expected because ramdisk had different size and resulting boot.img is also slightly different.

It's built from WWE, it's here: https://dl.dropbox.com/u/45827235/newboot.img

Can someone try booting see if it at least tries to boot? Oh, ramdisk is modified there too, It's insecure.
[Android General] Ivalex:
downloading... wait a couple of mminutes

---------- Post added at 12:36 AM ---------- Previous post was at 12:31 AM ----------

nope, it doesn't even try rebooting, stuck on fastboot mode... sorry
[Android General] oroo708:
nice bootanimation for padfone
[Android General] schriss:
In my case when zipping ramdisk back it was the same 1194 block. But resulting file was slightly bigger.

The tools we use to put boot.img back together should create proper boot header based on provided files and their sizes.

When you hex edit new boot.img I wonder if there is just few specific numbers in header that needs fixing, I can imagine overwriting entire header with modified ramdisk would break it because of different size.
[Android General] schriss:
How about this one?

https://dl.dropbox.com/u/45827235/createdboot.img

and I wonder if its difficult to build our boot.img from asus provided sources instead of modifying...
[Android General] Ivalex:
Tks I'm trying this.

I'm thinking about the same. Let's see what We can do with kernel src

Inviato dal mio PadFone 2 con Tapatalk 2
[Android General] schriss:
I think it wont boot, I see 3 addresses missing now.

---------- Post added at 04:08 PM ---------- Previous post was at 04:03 PM ----------

Here it is fixed: https://dl.dropbox.com/u/45827235/createdboot.img
[Android General] oroo708:
Custom PadFone Boot Animation

Just create a nice bootanimation for our devices.

Requirement:

-Rooted devices.

-File Manager w/root access.

Here are the link

How:

-Backup or copy stock bootanimation from /system/media/bootanimation.zip

-Push the new bootanimation directly to /system/media/

*stock bootanimation may be required for updating firmware*

hope you guys like it. :)
[Android General] schriss:
Another one:

https://dl.dropbox.com/u/45827235/createdboot2.img

and the previous one with fixed header:

https://dl.dropbox.com/u/45827235/createdboot.img
[Android General] schriss:
I just noticed that original boot.img has these numbers at offset of 240 and none of our repacked boot.img have it.

Googled: "SDK2.0", new format for boot.img/recovery.img is introduced. it's almost same as common boot.img format for android. unpackbootimg/mkbootimg can be used to unpack/repack it with one exception... there is SHA1 hash value in header of boot.img (offset 0x240 bytes).
[Android General] schriss:
Here I just added the same SHA1 from original boot.img to previously built files at same offset 0x240:

https://dl.dropbox.com/u/45827235/createdboot2-s.img

https://dl.dropbox.com/u/45827235/createdboot-s.img

---------- Post added at 06:37 PM ---------- Previous post was at 06:24 PM ----------

For the first time abootimg would allow me to update original asus boot.img with new ramdisk, without unpacking/repacking boot.img, so here it is:

https://dl.dropbox.com/u/45827235/updatedboot.img

---------- Post added at 06:54 PM ---------- Previous post was at 06:37 PM ----------

Updated with different ramdisk:

https://dl.dropbox.com/u/45827235/updatedboot2.img
[Android General] Ivalex:
I did this already, without success, I'm going to try with the latest img's you provided in your last post.

---------- Post added at 09:12 PM ---------- Previous post was at 09:07 PM ----------

... not working. by the way is not rebooting. which kernel are you using? WWE?
[Android General] schriss:
It's TW actually.

---------- Post added at 08:18 PM ---------- Previous post was at 08:16 PM ----------

Disappointing, I hoped Updated would work

---------- Post added at 08:35 PM ---------- Previous post was at 08:18 PM ----------

I was basing all my modified boot.img on boot.img from TW_A68_9_8_8_55_otauser.zip
[Android General] Ivalex:
.... ok see below

https://docs.google.com/open?id=0B1Mk9grJJzgYcWRKTGs1blB0NUk

that's my boot.img, modified. with this I'm able to initiate the reboot, is the one that give's me that strange phone status (QHUSB_DLOAD). which at the end provide me access to a partition of the phone, which looks VERY sensitive...

maybe you can playing with this, using abootimg and send me back.
[Android General] schriss:
Updated ramdisk: https://dl.dropbox.com/u/45827235/boot_new_updated.img

I simply used abootimg to put my ramdisk in there

---------- Post added at 09:00 PM ---------- Previous post was at 08:55 PM ----------

When I unpack your boot img and try open ramdisk, its not valid, it shows 1.7GB file inside.
[Android General] Ivalex:
not working, still this undefined phone state.
[Android General] riadrene:
Hello

Sorry for my bad english is was in all german forums never can me help you my last chance!!!!

I want root my Asus Padfone 1 under 4.0.4

I post something step by step instructions on how I did it!

Both firmware downloaded

Phone connected to the PC and USB debugging and unknown origin (tick set) enabled

First 9_18_8_41 unpacked zip file placed on the map.

Second Asus mobile phone pressed again made to Silent button.

3 It is the boot menu

4 file, select it loads the firmware

5 Then do wipe data / factory reset (all data is gone)

Have been trying for about 10 times because of the

6 USB debugging and Unknown sources enabled (check mark set)

7 RootDebugfs.bat used phone goes off twice and then Superuser installed.

8 Voodoo OTA RootKeeper downloaded from the App Store!

Down 9 Voodoo OTA RootKeeper opened on the phone and Protect root (super user releases the right for Voodoo OTA RootKeeper)

Although the description is Secure root is determined by mean I hope so!

All hooks are placed every 5

Superuser app installed

Device rooted

Root permission granted

system supports root protection

Protected su copy available

10 You can now backup and temp press Delet su un root I have not even made in the first attempt to flash it up!

have also been the Temp button to Protect un root root down to try it if it is because it does not work out for me to flash brought up nothing.

11 loaded Root Checker from the app store and I have full root right!

12 Version V9.20.2.14 (WW) is placed on the card, only the Zip

13 How to get mobile again make the dress again Silent key to the boot menu

14 Firmware boot raussuchen and

15 Mobile starts up go to OTA and it happens not go on but there is no refresh button.

Have also set only 2 tick of 5

Once installed superuser

and

system supports root protection

or it was

Protected su copy available

can not remember exactly!

So what am I doing wrong, can you help me somewhere I have to do something wrong?
[Android General] dwitmer1989:
agreed

Haha I agree... kinda don't want to have to plug my phone into my tablet for it to be worth using.... some sort of wireless sync like the tablet talk app where the phone and tablet are connected via wifi would be better... just my opinion.
[Android General] vokolyn:
One suggestion for the next ROM update. Allow customization of sequence in the quick settings icons in the notifications bar. Doesn't make sense to have to scroll to get to Bluetooth icon on the right especially for drivers.

Also I miss the Samsung style "slide left for sms, slide right for call" functionality within the contact list from the app or dialer. That's really handy.

Any way to make the SuperNote multitask simultaneously like what they have done with Note 2?
[Android General] schriss:
What was the modification? Ramdisk seems damaged. Can you also upload original boot.img that boots fine for you? I'll replace ramdisk there.

Sent from my PadFone 2
[Android General] schriss:
I think it's all because of boot header.

When its not good - there is no boot at all.

When its overwritten from original boot.img, it boots half way, because that header is also not entirely correct (because ramdisk is changed), so it boots to a point where it supposed to extract ramdisk and fails. When I manually unpack your modified boot.img and try to extract ramdisk, it fails too.

So I assume we do get the ramdisk modification right, we just simply can't get proper boot header values for our modified boot.img so it never boots properly.

Maybe we need to learn from original boot.img, the header values it has and the contents (zImage and ramdisk) and their sizes.

One of the links we posted earlier is where the guy analyses corrupt boot.img explains all that with these hex numbers but we were focusing on ramdisk modification all the time.
[Android General] riadrene:
Please help me
[Android General] watsonanna45:
got my Samsung Galaxy S III Phone

I am very happy ..today i got my lovely phone so soon thank u electronic bazzar.
[Android General] xdej:
searching inside a compressed .gzipped stream file

Try these lines (on a linux on liveCD or liveUSB or Virtual Machine, for security reason and possible bugs):

LC_ALL=C LANG=C script -a log_debug.txt # this line should not be incuded in a .bash file
echo Now creating a new file log_debug.txt to log everything. The comment about LC_ALL put grep in binary mode.
echo 'Following line locates the kilobyte containing "ro.secure=1" in compressed stream (do this on a computer with not much memory available, a few firefox -no-remote would eat the memory satisfyingly)':
{
while dd bs=1024 count=1 2> /dev/null ; do
echo dd >&2
done < boot.img | zgrep -q 'ro.secure=1'
} 2>&1 | wc -l > kB_estimation
kB_estimation=`cat kB_estimation`
echo
echo Now looking for an estimation more precise than $kB_estimation kB. Truncating and uncompressing at most 80 times to obtain it:
kB_offset=$kB_estimation
offset=0
for step in 10000000 1000000 100000 10000 1000 100 10 1 ; do
while {
dd bs=1024 count=$kB_offset 2> /dev/null
dd bs=1 count=$offset 2> /dev/null
} < boot.img | gunzip -c 2> /dev/null | grep -q 'ro.secure=1'
do
echo -n `expr $kB_offset '*' 1024 + $offset`' '
previous=$offset
kB_previous=$kB_offset
offset=`expr $offset - $step`
while test $offset -lt 0 ; do
offset=`expr $offset + 1024`
kB_offset=`expr $kB_offset - 1`
done
done
offset=$previous
kB_offset=$kB_previous
done
echo
echo The =1 is coded in byte `expr $kB_offset '*' 1024 + $offset` of boot.img!
echo Try to patch boot.img to obtain a =0 instead of the =1. If you are lucky, it may be a modification of one bit. There is a CRC to adapt, though.
echo now finishing the file log_debug.txt with exit
exit

If you happen to obtain the =0 but nothing after and a wrong CRC, you may use the gzopen call with append mode ("ab" mode) and append the end of cpio archive with gzwrite ; gzclose will compute a good CRC.
[Android General] Ivalex:
schriss,

I made it work! I've just booted with an insecure boot.img. I'll explain later but it seems, the problem was not on dimension, but on memory addresses, and above all, abootimg shows there's a secondaddr value which might represent a secondary ramdisk.

anyway, I've here a boot.img that allow me to boot with a default.prop modifed (ro.secure=0).... but, there's a but of course.

adb rooting looks still hard to get.

adb root command is denied

same as adb push

.... what if we need also an insecure kernel?
[Android General] schriss:
That's a step forward :)

I remember tutorial mentioned to boot insecure, then go to Developer options and enable debug mode. Then try adb again.

And yes I read something about modified kernel too, simply replaced adb that's when running gives root access, BUT none of the rooting tutorials mention this.

---------- Post added at 04:42 PM ---------- Previous post was at 04:33 PM ----------

how about these:

adb shell mount -o remount,rw /system

adb push su /system/bin/

adb push Superuser.apk /system/app/

adb push busybox /system/xbin/

adb shell

chmod 06755 /system/bin/su

chmod 0644 /system/app/Superuser.apk

chmod 04755 /system/xbin/busybox

cd /system/xbin

busybox –install /system/xbin/

exit

exit

---------- Post added at 04:44 PM ---------- Previous post was at 04:42 PM ----------

This also mentions re-enabling USB Debug after insecure is booted:

Now we have to soft-boot an insecure boot image by typing fastboot boot boot.img into the command prompt

When the phone has rebooted, open settings, and go to Settings -> Applications -> Development and check in the USB debbuging option.

Now execute all of these following commands, after each other, in the command prompt:

adb root

adb remount

adb push su /system/bin

adb push Superuser.apk /system/app

adb shell chmod 06755 /system/bin/su

adb shell chmod 06755 /system/app/Superuser.apk

Now your device should be rooted and ready.

---------- Post added at 04:45 PM ---------- Previous post was at 04:44 PM ----------

If all that doesn't work then we might be simply missing the other setting in default.prop, but somehow not all tutorials mention it...
[Android General] oroo708:
+1

love seeing progress u guys been doing. :good:

would wanna see this kinda thing with the 1st gen PF. but there is no one would dare to do it.. :(
[Android General] Ivalex:
Tks.

My way of dealing with smartphone is "if unrooted is useless"

Inviato dal mio PadFone 2 con Tapatalk 2
[Android General] ando roido:
I will sell my PF 1 if the development will stay so slow. I want to ROOT and change ROMs!
[Android General] Burley1:
Bad opinion in my opinion. One cell phone plan one device not 2 devices and 2 lines.
[Android General] harpik3d:
Oops! wrong thread :o
[Android General] Ivalex:
Know What, googling around it looks that to have a full root access via adb We need to use insecure adb as well... the good method would be to compile adb.c with a specific setting. If not done the adb won't connect as root. Once done, believe we're ready

Inviato dal mio PadFone 2 con Tapatalk 2
[Android General] schriss:
For adb root, yes. Some people want adb root.

But doesn't seem required for remount and push.

Anyways, if you Google for insecure adb, I think it's available already, just not sure if there is free version. That would need to go into zImage I think?

Sent from my PadFone 2
[Android General] schriss:
ADB (see the official documentation for ADB) allows a PC or a Mac to connect to an Android device and perform certain operations. One such operation is to launch a simple shell on the device, using the command adb shell. The real question is what user do the commands executed by that shell process run as. It turns out that it depends on the value of an Android system property, named ro.secure. (You can view the value of this property by typing getprop ro.secure either through an ADB shell or on a terminal emulator on the device.) If ro.secure=0, an ADB shell will run commands as the root user on the device. But if ro.secure=1, an ADB shell will run commands as an unprivileged user on the device.

So maybe after insecure is booted, please check secure status with the above commands. Maybe it's still 1.

---------- Post added at 09:33 AM ---------- Previous post was at 09:28 AM ----------

also:

To get a privileged shell you need to modify the following lines to the given values in the default.prop file

---------- Post added at 10:03 AM ---------- Previous post was at 09:33 AM ----------

Found some hacky hacky tutorial :D seems a bit extreme compared to all other tutorials, its the HEX edit way I guess ;)

http://samsunggalaxysforum.net/f8/d...l-insecure-unix-cmd-line-26113.html#post26200

---------- Post added at 10:25 AM ---------- Previous post was at 10:03 AM ----------

So to be clear, this:

adb shell mount -o remount,rw /system

does not work after you boot insecure?
[Android General] Ivalex:
attached the default.prop pulled from my device.

strange also. "adb root" doesn't give me errors, but looks then root is not ensured, and yes the remount or the manual mount of sys as root is denied.

also service.adb.root is 1, nevertheless no chance to push su
[Android General] schriss:
Then it's puzzling.

What about booting insecure and:

getprop ro.secure either through an ADB shell or on a terminal emulator on the device
[Android General] Ivalex:
ro.secure is 0...
[Android General] schriss:
and USB Debugging enabled?
[Android General] ekoandrew:
Waiting on the Jelly Belly update, after that back to rooting the phone. From what i know from asus insiders told me, the root on JB will harder. I dont know about that, my hands itches for cracking. XD

Using Nexus 4 while waiting on Padfone2 JB update.
[Android General] Ivalex:
Tonite I'm trying to replace adbd In ramdisk with an insecure version.

I'|| report results.

Inviato dal mio PadFone 2 con Tapatalk 2
[Android General] Ivalex:
Supersu working on padfone 2 A68

..... TO WHOM IT MAY CONCERN!!!

you might wanna look at the below screenshots

we gooooooot da root!!! :D
[Android General] schriss:
Very nice! Now what to do with it ;)

Oh yea, dumping recovery partition to build CWM. CWM once built can also be tested by booting it first, safe :D

Can you document everything? :D

---------- Post added at 09:16 PM ---------- Previous post was at 09:14 PM ----------

This:

Anyway, first thing I would do is to dump stock recovery and build CWM so that everything would be possible going forward.

CWM building seems straightforward, upload stock recovery and click button: http://builder.clockworkmod.com/

Dumping stock recovery, not sure if these are the steps but found this:

Commands are as follows via ADB:

adb shell dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/stock-recovery.img

adb pull /sdcard/stock-recovery.img
[Android General] Ivalex:
mmmh looks amazing let's do it.

yes can write down a sort of procedure. do you think it is possible to open a separate thread?

... ah by the way tks for the support given:good:
[Android General] schriss:
Separate thread as in for Padfone 2 hardware? XDA refuses to create it, I think.

We might just create new one in Android General to separate PF1 from PF2, like "Asus Padfone 2", or we just keep going here forever on these hundreds of pages...
[Android General] Ivalex:
no not a separate section or subforum. just a new thread in Android General as you're suggesting.

ok I'm trying to prepare some sort of guide, and if ok, you canduplicate it in the padfoneforum. I see you're also a member overthere.
[Android General] oroo708:
congrats to both of you and all PF2 community.

u got unlock bootloader and root. :victory:

next step for u guys are to port CWM(should not be that hard) and start creating custom ROM!!!:good:

---------- Post added at 09:07 AM ---------- Previous post was at 09:02 AM ----------

I would say that u should open new thread in this section under the name (PadFone 2 unlocking/root) then after u port CWM u can update it.

this will keep the thread clean from other general matters and just focus on helping people with what u guys just did.

wanna see what u guys can achieve next time. n again, congrats
[Android General] Ivalex:
new thread here

click on me
[Android General] schriss:
But this thread is not dead yet, right? :D

There is CWM to be built :p That will open the doors to Custom ROMs :laugh:
[Android General] hackbob:
I hope not and maybe a dedicated For Dev thread?

I'll have some days off work and I want to start working on kernel source and hopefully cm9 after we get CWM
[Android General] Ivalex:
we might just want to add a new thread or expand the one I just opened.

either is ok. and maybe xda will award us with a dedicated section :D
[Android General] benthian89:
i think you should save your efforts for cm10 instead.. It is lurking round the corner
[Android General] lezink:
rooted 4.0.4

Hello !

I can confirm that the routing how-to from page 256 on this thread worked flawlessly (well, nearly) for my WW_padfone

Following the exact steps (except for the files : I used WW files instead of CH)

Note that it won't work with the last OTA 9.20.4.22 !! (update from recovery returns an error message for me

U must use OTA # 9.20.2.14 for the update+root to work

only hard time I had was force closing of acore process after the rooting process (something to do with contacts sync if i understood well)

what i did : download and run ota rootkeeper (to save root status + to temp-unroot) >> download OTA 9.20.4.22 >> run OTA >> restore root with rootkeeper.

and "voila" : welcome back my old apps & games from my hd2 sdcard

Thanx a lot !!!!!
[Android General] parsandroid:
That's great
[Android General] oroo708:
everyone are going for CM10 now..hehehe..

nwy if the same ppl still doing the tools, just continue CWM on the same thread there.. if anyone port custom ROM then it will be on different thread..
[Android General] Burley1:
I'm just sharing with the group

I wanted to get a screen protector for the pf2 and the zagg screen cover for a galaxy s2 supersonic ATT version work and has the proper cut outs for the camera and sensors the sides are perfect and the bottom is a little short but does okay.

As for the tab dock I used an asus cover and had to hole punch the camera because the pf2's camera is different the all the other models.