[Xoom Android Development] stachre:
[size=+1]STOCK ROOTED UPDATE PACKAGE BUILD PROCEDURE[/size]

For the curious and do-it-yourself types, this is how I produced this stock rooted update for the Motorola XOOM Wi-Fi MZ604 (US). I use Ubuntu, but this should also work on other *nix flavors, including OSX. The handy scripts provided by alansj for unpacking and repacking boot images, however, are not Windows friendly.

Ensure Android SDK is properly installed and configured on the workstation

Both adb and fastboot must be functioning properly in order to proceed. This procedure assumes that the directory containing adb and fastboot (or their symlinks) are in the PATH environment variable, allowing them to be called from anywhere.

Ensure perl, cpio, gzip, and gunzip, are properly installed and configured on the workstation

These are necessary to unpack and repack the boot image for modding.

Ensure unpack-bootimg.pl and repack-bootimg.pl scripts are properly installed and configured on the workstation (thanks, alansj)

HOWTO: Unpack, Edit, and Re-Pack Boot Images​

This procedure assumes that the directory containing these scripts (or their symlinks) are in the PATH environment variable, allowing them to be called from anywhere simply by their name. Note that some PERL configurations may require calling perl and passing the path to the script as an argument.

Ensure ClockworkMod Recovery is properly installed and configured on the device (thanks, solarnz, bigrushdog, koush, et al)

[Recovery] ClockworkMod 3.2.0.0 (R4c) Modded for Internal media [UPDATED 10/6]​

Also ensure that the ClockworkMod Recovery image is in the working directory on the workstation in case it needs to be reflashed.

Download su and Superuser.apk (thanks, chainsdd)

http://androidsu.com/superuser/​

Extract the ZIP file containing su and Superuser.apk into the working directory on the workstation.

Download stock images and previous OTA (Over The Air) update packages

3.0.1 HWI69 Images: http://developer.motorola.com/produ...utm_source=supportforums&utm_term=unlockboard

3.1 HMJ37 OTA: http://android.clients.google.com/p...signed-tervigon-HMJ37-from-HWI69.e379f0b9.zip

3.2 HTJ85B OTA: http://android.clients.google.com/p...igned-tervigon-HTJ85B-from-HMJ37.db223b6e.zip

3.2.1 HTK55D OTA: http://android.clients.google.com/p...gned-tervigon-HTK55D-from-HTJ85B.73617300.zip

3.2.1 HTK75D OTA: http://android.clients.google.com/p...gned-tervigon-HTK75D-from-HTK55D.01cd4f05.zip

4.0.3 IML77 OTA: http://android.clients.google.com/p...igned-tervigon-IML77-from-HTK75D.71a21bfe.zip

4.0.4 IMM76 OTA: http://android.clients.google.com/p...signed-tervigon-IMM76-from-IML77.0d062b3b.zip​

Note that the OTA update scripts check properties to see if the device is identified as "wingray". The above linked version of ClockworkMod Recovery identifies itself as "stingray", so you will get assert errors and the installation will fail. You can disable script asserts by using the toggle script asserts menu option (under install zip from sdcard), but keep in mind that this will allow you to install the updates out of order. The other, safer but more labor-intensive option is to edit the updater-script in each package and remove the "wingray" asserts.

Download the current stock OTA update package

Google hosts the OTA updates for the Motorola XOOM Wi-Fi MZ604 (US). The devices periodically check Google for updates, and when an update has been made available, it will be downloaded (usually to /cache/) with a notification presented to the user.

The full URL to the update package is output to the device log, which is available via logcat (adb logcat; DDMS; aLogcat app). The full URL can also be constructed from just the filename -- available in the device's /cache/ directory if downloaded, or often by searching the web -- by appending it to the following path:

http://android.clients.google.com/packages/ota/motorola_tervigon/

In this case, we find that the JRO03H update package's filename is f85d815e2b75.signed-tervigon-JRO03H-from-IMM76.f85d815e.zip, which yields the following URL:

4.1.1 JRO03H OTA: http://android.clients.google.com/p...igned-tervigon-JRO03H-from-IMM76.f85d815e.zip​

See also the note on the previous step regarding "wingray" asserts.

Save all stock OTA update packages to the hardware SDCard

These will be installed via ClockworkMod Recovery later in the procedure.

Connect the XOOM to the workstation via USB

Also verify that USB debugging is enabled in the settings on the device. The device should show up if the following command is run from a terminal/command prompt:

adb devices

Backup the device

This process is going to overwrite everything on the device, so backup using whatever method is preferred. ClockworkMod Recovery's Nandroid backup is a great option.

Flash stock images via fastboot

Unpack the zip file containing the stock HWI69 images into the working directory on the workstation and run the following commands from a terminal/command prompt:

cd <path to working directory>
adb reboot bootloader
fastboot flash boot boot.img
fastboot flash system system.img
fastboot flash userdata userdata.img

Keep this terminal/command prompt open, as it will be used further.

Install stock OTA updates via ClockworkMod Recovery

Reboot after each update to ensure that it completes -- bootloader updates (HMJ37 and HTK55D), for instance, are performed after rebooting -- but ensure the boot sequence is interrupted with the VolDown key and re-enter ClockworkMod Recovery before the boot animation begins, to prevent overwriting with stock recovery.

Without a bootloader update, press VolDown after waiting a few seconds on the red Motorola logo screen. If there is a bootloader update, however, it gets tricky; after the automatic reboot, wait about 14 seconds on the red logo before pressing VolDown. If nothing happens, reset (Power + VolUp) and try again. If the boot animation begins, try resetting but note that recovery was likely overwritten by stock, requiring a re-flash of ClockworkMod Recovery.

Repeat this procedure of installing and rebooting until the last update is complete and the device is back into ClockworkMod Recovery.

Perform a nandroid backup in ClockworkMod Recovery

This generates clean, current stock images with which to work, while also providing an easier starting point for any future mods.

Download and unpack the boot image

Run the following commands from the terminal/command prompt:

adb pull /sdcard/clockworkmod/backup/<directory name>/boot.img boot-stock.img
unpack-bootimg boot-stock.img

This will extract the kernel and ramdisk gzip files into the current directory, with the actual ramdisk files being unpacked into a subdirectory (boot-stock.img-ramdisk).

Modify default.prop in ramdisk

Open default.prop (located in the ramdisk subdirectory) in the preferred text editor and edit the following properties:

ro.secure=0
ro.allow.mock.location=1
ro.debuggable=1

ro.secure=0 is the most important, for it enables adb to run as root, which is necessary for remounting the system partition as read/write and install su.

Clean up any temp/backup files the text editor may have created in the ramdisk directory before proceeding.

Repack and flash the modified boot image

Run the following commands from the terminal/command prompt:

repack-bootimg boot-stock.img-kernel.gz boot-stock.img-ramdisk boot-root.img
adb reboot bootloader
fastboot flash boot boot-root.img
fastboot reboot

The device should now boot with a rooted boot image.

Install and configure su and Superuser.apk; remove recovery overwrite files

Remount the system partition as read/write and push the files using the following commands from the terminal/command prompt:

adb remount
adb push su /system/bin/su
adb push Superuser.apk /system/app/Superuser.apk
adb shell

Once in adb shell, configure the pushed files:

chown root.shell /system/bin/su
chmod 6755 /system/bin/su
ln -s /system/bin/su /system/xbin/su
chmod 644 /system/app/Superuser.apk

While still in adb shell, remove the recovery overwrite script and patch:

rm /system/etc/install-recovery.sh
rm /system/recovery-from-boot.p
reboot

The device should now boot fully rooted.

Extract the freshly rooted system image

Run the following command from the terminal/command prompt:

adb shell

Once in adb shell, dump the system image to the hardware SDCard:

dd if=/dev/block/platform/sdhci-tegra.3/by-name/system of=/storage/sdcard1/system-root.img
exit

Once back to the local prompt, pull the image to the working directory:

adb pull /storage/sdcard1/system-root.img

Configure the device and test

Ensure the device and apps function normally, including root apps.

Identify any updates outside of system and boot partitions (bootloader, userdata, etc.)

Open all OTA update packages in the preferred ZIP archive manager and go through each updater-script (located in /META-INF/com/google/android/) to determine if any additional updates have been made. This will require some understanding of edify script, which is straightforward and easy to read.

These additional updates will need to be included in the stock rooted update package in order to ensure safe update from any ROM.

Assemble the update package

This simple objective here is to package the rooted boot and system images, files for additional updates (if any), the updater-script with commands to perform the update, and any helper tools into an Android update package (essentially a ZIP file).

While this is a complicated task, it is made easier by starting with existing custom update packages and modifying their contents and script.

Test installation via ClockworkMod Recovery

Load other ROMS -- stock Honeycomb, custom ROM's, etc. -- and test the update using the procedure in the OP. Note that you may need to reflash ClockworkMod Recovery one final time at this point.

Restore personal device backup; dogfood

Restore the backup you made prior to flashing the stock images at the beginning of this procedure, and upgrade your device with the package you've built. Bask in glory.