yashsingh1/xdaforums huggingface dataset:
[Barnes & Noble Nook Tablet] hkvc:
my minimal exploring wrt 2ndinit code, init rc scripts, init code, toolbox code etc.

Hi Adamoutler/All,

I had a look at a old code I got of 2nd-init. It basically RESTARTS INIT program. Which means with ROOT access if we CHANGE the init.rc or the init.omap4430.rc file and do some other minor setup(needs to be identified with looking at init flow and some experimenting), we should be able to run init once again and get what we want mounted and or run potentially.

Ie this DOESNT allow kernel/bootloader to be replaced live or so. If you are talking about/know about a diffrent 2ndinit please do provide link to it.

Coming back to this 2NDINIT, if one REPLACES the appropriate MOUNT commands in init.omap4430.rc file, we should be able to mount from SD instead of emmc. Good that bn didnt use the code in init to decide the mount source devices as done for mtd, otherwise we would have had to modify init program also. Inturn if we do it for SYSTEM and DATA partitions it should do. As cache doesnt seem to have anything usefull in it atleast on my nt.

NOTE: On further exploring The reason install-recovery.sh (caution: not secure boot chain - haven't looked) checks only 2k is because that is the size of android img file header.

NOTE: Google as done a good job of implementing all commands used in init rc files with in init program itself, so we cant get immediate control of user-space boot/init flow ;-(, except for tricks like 2ndinit fairly late in the flow by replacing one of the services in /system/bin or by running manually later. Initially thought of trapping the commands in toolbox and use the replaced toolbox to gain control, but cunning google :-) as stopped it from beginning, unless a device vendor does something stupid in init rc files. Also all the core libraries (c and java) seem to have hashs against them, how secure these are not sure, but don't see any reason why it won't be properly checked. otherwise replacing bionic would have allowed to trap the commands in init ;-(. (Not sure what I was think when I told replacing bionic library would allow to trap init, rather init in itself cann't be trapped by replacing bionic because it is statically built, however external programs called from init can be trapped, however they can always be directly replaced with root access).

NOTE: What I have mentioned above is based on what I have gone thro currently wrt the source codes and scripts. I haven't tried the 2nd init program on the target yet. But if it works as expected, we should be able to replace partitions used and also programs run.

sent from my android device
[Barnes & Noble Nook Tablet] AdamOutler:
I put together The All-In-One Nook Tablet HackPack based heavily on what has been discovered here as well as many of my own tools and findings.

My device is still out. Initial JTAG scan was unsuccessful. It would appear that they utilized Secure JTAG on the chain. The device ID showed up as a bunch of "0"'s followed by a single "1". This would appear to be a dead end. I will be researching restoration of the device via SDCard and USB though.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
That’s very unfortunate :( hopefully you'll find another method :)
[Barnes & Noble Nook Tablet] LiuAnshan:
Is there anything someone not well versed in this deep HW and software stuff can do to assist you all? When I get home from work I plan to try and laurel the posts on the B&N forum again.

Nexus S 4G 4.0.3
[Barnes & Noble Nook Tablet] hkvc:
My exploration with 2ndinit

Hi All,

I did spend sometime on 2ndinit, but looking at things it appears as if, 2ndinit is not hijacking init at least for me. Debugging bit further into the logic, what I found is that

a) Wait failing wrt PTRACE_ATTACH'd process locking/stopping

b) PTRACE_SETREG required to set the PC to control the jump seems to be failing. (Have to check if SETREG where PC doesn't change works or not)

However all hope is not lost

a) PTRACE_ATTACH in itself is not failing (Surprised as technially one shouldn't be able to attach to init process, but good for us)

b) PTRACE_POOKDATA seems to be working

Later I or someone else will have to try and modify the logic for init hijacking to use POOKDATA to carpet bomb the location around which init normally loops or runs with few nops or jumps followed by the required reg setting (ie with POOKED CODE) and execve call and hope that init naturally picks it up and triggers the execve.

Reason why I have put it out here, is because if someone else is also trying similar thing then there is data to cross reference/verify the behaviour noticed, as well as to clarify/get clarity if I have got something wrong somewhere, i.e if someone else has succeeded with the original 2ndinit or similar strategy.

OTHER Observed behavior

a) service call reboot 1 (forgot tried few hours back) seems to reboot along with reseting of the /data partition (Not sure if this a global Android behaviour or specific to NookTab)

b) f-droid.apk is a good package which is accepted by the provided package installer thro the Nook browser, in case one messes up the nook and is restoring back. This is to allow getting access to the development settings as well as install terminal, etc apps thro f-droid. I am assuming it is a good opensource based apk respository

c) the factory.zip in the factory partition of Nook tablet allows one to restore back to default/factory/shop nook setup, again if one messes up the boot process at the init level while experimenting. One requires to copy this to the root of a sdcard and name it to one of the zip file names specified in uboot (got by strings uboot(forgot the exact name)) from factory.zip or got from /bootloader partition dump or ...
[Barnes & Noble Nook Tablet] hkvc:
Partial Success with my own very simplified experimental 2ndInit (2ndihkvc)

Hi All

As I mentioned yesterday, I was not able to get the SETREGS to succeed in setting PC required for the current 2nd-init logic, nor wait was waiting to lock the process, SO I tried a new and simpler alternate method for triggering/execve the init process a 2nd time using only POKE and it seems to have succeeded. I am guessing this based on my nooktablet having got messed up and it keeps rebooting again and again when it reaches my logic potentially. I have to restore back to factory settings and try afresh in the morning (Well it is almost morning ;-) now here) with few more debug messages to pin point it fully.

The code I am injecting directly into init process is in the attached txt file which is actually a .s (assembly file). (NOTE: Currently I am not handling environment variables, not sure if that is causing my boot to keep looping).

In turn the logic to hijack the init process and inject the code is as simple as

Step1) PTRACE_ATTACH

Step2) PTRACE_GETREGS

Step3) PTRACE_POKETEXT (Regs.ARM_pc, code to inject)

Step4) PTRACE_CONT

Step5) PTRACE_DETACH

I will upload the hijack code in a day or two - however the jist of the logic is above, if anyone wants to experiment on their own.

NOTE: The code is very simple and experimental and expects the pc address to be known before hand to massage the .s file appropriately.

NOTE: The above algo with the corresponding .s file is still EXPERIMENTAL and also requires additional shell scripts to get access to the boot flow to trigger the hijack. And the current code will break the nooktab booting, so don't experiment this logic and the .s file unless you know what you are doing.

NOTE: I am not that much into Custom Roms etc, so don't expect anything much shortly wrt Custom Roms etc, this is just a experimentation for myself and to feel happy inspite of BN removing some useful features like sideloading as well as forcing a signed bootloader on everyone.
[Barnes & Noble Nook Tablet] hkvc:
Bit more exploration with init hijacking - 2ndihkvc src package for EXPERIMENTATION

Hi,

NOTE: Source code package is attached with this message. However this is WIP and provided for anyone wanting to EXPERIMENT on their own parallel to me. Because I think the basic logic is done now. It is more of cleaning up the init rc files and or killing some additional tasks before restarting init or some such things HOPEFULLY (NO harm in hoping and being positive :-). HOWEVER NOTE that the current version will loop your boot and fail. I have put a timed triggering logic to try and reduce the risk, check out the documents in the package, but it can factory reset or worst case wipe your partitions and render the nooktab dead.

After yesterdays initial init hijacking, I have cleaned up the .s file so that it passes the Args properly as well as added the environment variables set by Android by default. Also the ptrace code I have updated to do relocation (using a simple custom table) of injected code. Also rather than a minimal ptrace code, I have put a bit more full fledged one with my logic as well as skrilax's logic as well as reg dumping and few other stuff to help experimenters.

In turn I have cross verified, that init is actually getting restarted and it is running thro the scripts and setting up the properties as specified by my modified default.prop as well as in the process rerunning all the commands/services/prgs.

However some where beyond rild/vold sequence it seems to be blocking and looping the boot. Also I had modified the init a bit, have to check that also once later.

Enjoy and experiment
[Barnes & Noble Nook Tablet] AdamOutler:
I just want to say that you're doing good work. I'be been subscribed and get instant email notification whenever a new post is made. You're doing great things.

I have got my device back and am setting up UART currently. DIY to come.

Once I finish with UART, I will be working on obtaining detailed logs and researching recovery techniques by deleting one partition at a time beginning with recovery and working through u-boot and finally X-Loader. Once we have this level of knowledge, any brick will be recoverable. I can't help just yet with your side, but I want to work bottom-up on restoration before really modifying anything. We need to know our limits before pushing this device. I feel that's very important.
[Barnes & Noble Nook Tablet] hkvc:
Omap Bootroms Note - and possible risks

Hi Adamoutler/All,

Not sure if you have worked with Ti Omap chips before or not. In case not much, then I want to let you know that because of the builtin Bootrom code with support for multiple modes of booting - USB, UART, SD Card, eMMC, NOR/OneNAND, ..., whose boot sequence in turn can be configured thro pull ups/downs, if SD Card is configured to have higher priority than eMMC, then what ever happens to eMMC, one can always boot or factory reset the device (provided the factory image is not doing any checks on eMMC). Similarly if USB or UART have higher boot priority than eMMC, then even they can be used for the same. The only requirement is that we have the right signed (in this case) MLO(x-loader), UBoot, Kernel and Ramdisk+Recovery. And most probably the factory.zip file has the right set of these images.

If someone has a spare NookTab to destory/risk, then one should get the factory.zip out and then wipe all the partitions and see if the tab can be recovered using the factory.zip appropriately renamed in the microsd card.

NOTE: If the boot sequence is to our advantage i.e some other available device has higher priority than eMMC, then the ONLY risk with unbricking will be if BN OEM has put any additional conditional checks in signed firmware wrt boot or recovery modes to verify or check some thing on eMMC and then decide to continue or not. Other wise, it will be pretty unbrickable.
[Barnes & Noble Nook Tablet] AdamOutler:
Tried using fastboot

OMAP44XX SDP # fastboot
Acclaim Board.
Device Serial Number: 66E6000600000001
Fastboot entered...

adam@Adam-Desktop:~$ fastboot oem unlock
< waiting for device >

drat

adam@Adam-Desktop:~$ heimdall-frontend
adam@Adam-Desktop:~$ cd Desktop/
adam@Adam-Desktop:~/Desktop$ fastboot flash boot boot.img
< waiting for device >

darn....

that's not going to work.
[Barnes & Noble Nook Tablet] AdamOutler:
Here's the kernel parameters:

OMAP44XX SDP # printenv
bootargs=
bootdelay=0
baudrate=115200
ipaddr=128.247.77.90
serverip=128.247.77.158
netmask=255.255.254.0
bootfile="uImage"
commonbootargs=androidboot.console=ttyO0 console=ttyO0,115200n8 mem=448M@0x80000000 mem=512M@0xA0000000 init=/init rootwait vram=32M,82000000 omapfb.vram=0:5M@82000000
sdbootargs=${commonbootargs} root=/dev/mmcblk1p2 rw
stdin=serial
stdout=serial
stderr=serial
bootlimit=9
altbootcmd=mmcinit 1; booti mmc1 recovery
serialnum=2014760059814007
bootcmd=mmcinit 1; booti mmc1 recovery
filesize=1
bootcount=6

Environment size: 527/131068 bytes
OMAP44XX SDP #

Anyone know what that bootfile="uImage" is?

Now... let me make a little tiny change and see if I can boot...

OMAP44XX SDP # setenv serialnum=2014760058914008
OMAP44XX SDP # saveenv
Type 'y' or 'Y' to Save Environment to NOWHERE..

Looks like these parameters can't be saved with the saveenv command. There may be another way though...
[Barnes & Noble Nook Tablet] hkvc:
He hee heeeeeee

Do I see a uboot prompt there!!!!!!!!!!!!:-) dont tell me they forgot about it.

Now ideally

A) if we use the uboots' boot commands, the chances are they have the signature check potentially there. So less likely to help

B) hoping the secure boot logic in omap4 isnt a active entity but a passive one, we should replace BN uboot with our own uboot / minimal loader code

B.1) one can download a new/ alternate binary code to run from either emmc itself or uSd or uart itself using the commands in existing bn uboot. And inturn jump to that and take over boot flow.

Note: the device id one passes to mmc commands in uboot is what can be used to switch between uSD or emmc. Unless they have disabled the code, which seems less likely.

This would mean as far as a good omap4 board with lcd for experimentation is concerned, nooktablet is good.

sent from my android device
[Barnes & Noble Nook Tablet] j_dev:
Don't know a whole lot on the subject, but the bootfile="uImage", along with the ip addresses, seem to be just standard OMAP4 env vars. It looks like uImage is the kernel, which is the file that is looked for (potentially) by the bootcmd. (Source: Google 'Alternative boot methods for OMAP' it should be the first post. I can't post URLs yet)

Although not exploitable, the bootlimit set at 9 is interesting - explains why after the 8th reboot (or 9th boot) it jumps into recovery.

I am continuing to research this, I'll post back if I find anything interesting.
[Barnes & Noble Nook Tablet] davewuvswaffles:
Oh sweet jesus let this be the case.
[Barnes & Noble Nook Tablet] jairuncaloth:
Have we tried bringing up a custom kernel with fastboot?

Format is "fastboot -c 'kernelcmdline' boot /path/to/zImage"

Here's an example of booting a custom kernel into debian from my SD card on my N1.

fastboot -c 'root=/dev/mmcblk0p2 rw rootfs=ext2 init=/sbin/init \
rootwait noinitrd' boot ./zImage

fastboot can also boot custom images as well but I'm not as familiar with the syntax.
[Barnes & Noble Nook Tablet] Goncezilla:
The Nook Color utilized Uboot too. Some good garb on Uboot can be found here (completly open source)

free-electrons.com/doc/u-boot.pdf

(sorry noob who can't post full links yet)

Can we just build a uImage that boots into CWM?
[Barnes & Noble Nook Tablet] AdamOutler:
We can't use CWM. If we boot into it, it wont provide any useful tools.
[Barnes & Noble Nook Tablet] 424aca:
Ship

Can probably lend you my nook

message me on where to
[Barnes & Noble Nook Tablet] AdamOutler:
Alright... Here's our entry point... Make a FAT sdcard, mark it with the "boot" flag, then add a file called MLO.

It's not much to look at now, but I can confirm that simply adding or deleting the file called MLO will cause the device to hang.

UART:

Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Checking power button state... PRESSED. OK
Could not read bootloader!
X-Loader hangs

It just sits there with a black screen and you must either remove the battery, or hold power+N for 10 seconds, then press power again.

That line "Could not read bootloader!" comes out of the MLO from the sdcard... It's booting from SD
[Barnes & Noble Nook Tablet] AdamOutler:
I attempted to use a hex editor and change

Could not read bootloader!

to

Could not read helloworld

and it did not work. the device would not boot... I will try some other things... however it would appear that xLoader (MLO) is totally verified.
[Barnes & Noble Nook Tablet] Goncezilla:
T

Makes sense.

Is there anything we can pull from the NC uboot workaround? Aren't the kernels similar? The Nook Tab is the same hardware minus the Omap4, mic, memory, and locked bootloader :rolleyes:
[Barnes & Noble Nook Tablet] davewuvswaffles:
Let the games begin.
[Barnes & Noble Nook Tablet] dodgepot:
Adam, you're awesome. Keep up the great work!
[Barnes & Noble Nook Tablet] CelticWebSolutions:
Sounds promising! Maybe we'll get to catchup with the kindle fire after all!
[Barnes & Noble Nook Tablet] gwreedak:
Ditto!!

Wohoo!!! Ditto!!

~ G
[Barnes & Noble Nook Tablet] insafon:
just wanna rape the "Thanks" button but cant.....argh......
[Barnes & Noble Nook Tablet] mohawkx:
You guys are Flucking animals!!!!! I'm in total awe!!! I knew I shouldn't just throw in the towel but instead, keep the faith......awesome!.....just......awesome
[Barnes & Noble Nook Tablet] AdamOutler:
I just saw that it was in recovery... I guess there's still one more thing to work out.

init: Unable to open persistent property directory /data/property errno: 2
kxtf9 1-000f: IRQ TILT [10]
EXT4-fs (mmcblk0p9): recovery complete
EXT4-fs (mmcblk0p9): mounted filesystem with ordered data mode. Opts:
[XPERIA X8 Q&A, Help & Troubleshooting] sumith.vj866:
i got this msg while im trying to unlock the bootloader...what to do now????
[XPERIA X8 Q&A, Help & Troubleshooting] nhoc_maruko9x:
You must restart adb service. Open Task Manager and end all adb.exe process, then unlock bootloader again. Adb service will restart automatically.
[HTC Desire S] Kizzeeex:
http://xdaforums.com/show...244739&page=28 i downloaded HTC sense 3.5 from the link above, but how do i get it to be installed on my phone? It's a .zip file so i don't know which app to run in the folder..
[HTC Desire S] dan-fish:
After reading your post I dont recommend you do it but if you insist, you must tell us whether you're S-OFF and have root first.

If you're even more confused now, this thread is great

http://xdaforums.com/showthread.php?p=16000143
[HTC Desire S] emuinthebox:
you gotta do much reading around XDA Kizz.

as dan-fish said, you need root and s-off.

this thread taught me so much! http://xdaforums.com/showthread.php?t=1146601
[HTC Desire S] Kizzeeex:
Nope i'm not rooted.. then is there anyway to take screenshots? i have htc sense 2.1.. i tried MyPhone Explorer but there's no load screenshot button.. android sdk doesn't work for me as well :/
[HTC Desire S] enigmaamit:
Buddy, you're heading to the North Pole with a pair of Jeans and two T-shirts. Don't get me wrong, but i agree with dan-fish's assessment that you should do a lot of reading from the General section before you start contemplating flashing a ROM.

I mean no offence, and i'm not patronizing you, but from your questions above, it looks like you have absolutely no clue about s-off, rooting and eventually installing a custom ROM. I only emphasize this to keep you from accidentally bricking your device.

If you read all the guides in this forum (especially the excellent one by nodeffect), these questions will answer themselves on their own.

http://xdaforums.com/showthread.php?t=1186401

Cheers buddy! To be fore-warned is to be fore-armed!!
[HTC Desire S] olyloh6696:
Couldn't put it better myself dude :D
[Optimus One, P500, V General] HawkeyeWPR:
Some ROM's permitted to overclock the Optimus One to 867 MHz,but my one,cant do even 787 MHz,because appear an Kernel panic and they Shutting down,WHY? how to overclock more? and the difference between .32 and .35 kernel?(what are that numbers o.O?)
[Optimus One, P500, V General] Human_dude_007:
787 is stable ..

Overclocking beyond that will reduce the lifetime of the phone and its capacity to withstand overclocking ..787 is quite sufficient ..

from my LG-P500 using xda premium
[Optimus One, P500, V General] HawkeyeWPR:
but mu Optimus the maxium without Kernel panic is 768 MHz,if i put 787 MHz a random time they "kernelPanic" and shutdown :( uff why? i cant keep it at 787 :(
[Optimus One, P500, V General] Human_dude_007:
Might be it has lost its stability ..keep it @600for a few days and try overclocking later..

(806 used to give me kernel panics before but now it doesn't)
[Optimus One, P500, V General] HawkeyeWPR:
you can use your optimus with 806?????' HOW? *.*
[Optimus One, P500, V General] terratrix:
You can't that means you can't. Don't expect miracles, and currently i see no actual need for overclocking as system is smooth enough
[Optimus One, P500, V General] aayushARM:
O sh*t!!!! I can only go upto 727 mhz :X I stretch the slider above 727, and it suddenly crashes............:(
[Optimus One, P500, V General] engr_exxi:
672.. enough juice... i fear overheat :D
[Optimus One, P500, V General] Sorry2U:
Wrong thread, nothing such as Opimus One.
[Optimus One, P500, V General] knightnz:
You're better off sacrificing the ~2% difference for better stability.

Different CPU's have different tolerances.
[Optimus One, P500, V General] teddybig:
Why so much God dammit! 729 is like waaaaay more than enough.
[Sony Ericsson Xperia Neo, Pro] idpro:
dear friends,

is there any way to re-lock my xperia neo bootloader.

or official 4.0.2.A.0.42 ftf for Egypt.

thanks in advance
[Sony Ericsson Xperia Neo, Pro] tinyXperia:
http://www.google.com/url?q=http://...ds-cse&usg=AFQjCNHBh7RGRTBR2PCC71dlqYbbEduzdQ
[Sony Ericsson Xperia Neo, Pro] kormatoes:
And also in Q&A
[EVO Shift 4G General] tokuzumi:
While not Evo Shift related, but we should start seeing Sprint LTE phones late next year.

http://www.phonearena.com/news/Spri...-the-second-half-of-2012-likely-in-Q3_id24383

Let the rumors and hopes begin! :p

Quad core, AMOLED screen, and minimal manufacturer skinning (I know, I know, a pipe dream)
[EVO Shift 4G General] jsp254:
All this talk about lte, wimax, clearwire, etc. has brought me to realize I know very little about the subject. I thought 4G was 4G. Apparently there are differences. None of the carriers offer 4G where I live, the closest being verizon about 60 miles away. I guess I'm off to the world of google and wiki to do some researching.
[EVO Shift 4G General] VICODAN:
My Shift should last me until then.
[EVO Shift 4G General] tatonka_hero:
actually, none of the carriers anywhere in the country offer 4G, they offer somewhat advanced 3G that they've labeled as 4G. But that's a debate for a different place.

Chances are, if you don't have "4G" now, you sure as heck won't miss it if you get a phone that has "4G" capabilities and you're in an area that isn't covered by that service. I rarely use the "4G" on my Shift, because it's 150 miles to the closest site that has it. I think that's the case for a whole lot of people with the Shift, and other "4G" phones, especially on Sprint.

The LTE service Sprint is coming out with is supposed to be put in the same locations as their 3G within a year of the beginning of the rollout, so all 3G covered areas would also have LTE in theory (or so the rumors have said). That would actually make a difference in the phones people purchase, and make that extra $10/month for the "smartphone fee" worthwhile.

It's probably worth waiting on your upgrade until next fall to get the LTE phones if you're into the more advanced phones, but Wimax will still be supported (but not likely expanded), and of course they'll still have the 3G capabilities. Personally, I haven't decided whether I'll keep my Shift past my Feb upgrade or not, it'll depend on the condition of my Shift, the device rumors I'm hearing, and of course how much money I have to upgrade. It's my last yearly upgrade, so I have to actually buy a phone that I expect to last for two years.
[EVO Shift 4G General] VICODAN:
I'm in the same boat and I'm waiting for Q3 2012.