yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] yuweng:
Wow, Master Shifu bgcngm dropping by to my thread, i feel so honor...

i actually learn this from Master Shifu bgcngm's blogspot...

In actual fact, MTK ROM Studio doesn't support MT6577, on default, it only let you save as MT6575_Android_scatter_emmc.txt

When rename & save as MT6577, it does work & the uploaded image as you said using the address from the same row recovery entry in the table, after unpacking turns out to be boot.img !

However, what you say is true for MT6573, the address from the same row does upload correct images... :laugh: i don't own a MT6575 so i can't confirm but from feedback by fellow xda member thru pm, it is confirmed it is the same for MT6575 & the offset is only for MT6577... :D
[Android Software/Hacking General [Developers Only]] bgcngm:
Hehe.. it seems that you really love Kung Fu Panda!

Regarding MTK ROM Studio, I believe that the latest version already supports MT6577.
[Android Software/Hacking General [Developers Only]] yuweng:
i think everyone loves Kung Fu Panda... :D

In fact, i'm a little bit like Po, the panda but i donno much about Kung Fu, Whoops, in mean android but manage to KANG one or two scripts...

And mostly MT65xx stuff i learn it from your blogspot & thread post, Master Shifu bgcngm, tq...

Yeah, you are right on the latest MTK ROM Studio, it does interpret the partition address correctly for MT6577... :laugh:

INNER PEACE to all... :D
[Android Software/Hacking General [Developers Only]] xheroxkefx:
I have a problem, at the SP flash tool uploading piece.

The red bar filles and goes to 100% after that nothing happens.. i tried waiting for 15minutes but the blue bar won't pop up :P

I have an HTC EVO 4G clone with the MTK6577

Greetings

// edit

it worked, missed an driver.

//edit2

at page 11 of the pdf, how do i open the kitchen? @ windows 7 x64?

//edit3

found out about cygwin, maybe usefull to add to the .pdf > cygwin + jdk for windows
[Android Software/Hacking General [Developers Only]] liquidini:
any news with the h2000+ mtk6577?

will it be possible for root?
[Android Software/Hacking General [Developers Only]] yuweng:
@liquidini

i thought andyle2k has already provided a solution here... :confused:

@xheroxkefx

hehe, got a fellow xda member ask me to update that too, me being lazy as some of the tuts are link to one another so if i do, i'll have to update all my tuts for that... :o

As dsixda's Android Kitchen now natively supports MT65xx, some of my tuts under my signature are considered obsolete so it'll be here as fyi only... :laugh:

However, most of the MT6573 stuff are still relevant so you'll have to read all of them as i don't repeat some of the requirements needed for later mods... :D
[Android Software/Hacking General [Developers Only]] xheroxkefx:
yuweng,

i did all steps like 10 times but i keep my original stock "factory mode" recovery

here are my images: http://www.sendspace.com/file/woctkd

please check the images if i did something wrong :)

Thanks in advance
[Android Software/Hacking General [Developers Only]] Hukulasche:
Where is the tutorial?

I can't find it in the first post.

Thanks
[Android Software/Hacking General [Developers Only]] bgcngm:
On the first post there's a button named "SHOW CONTENT"...
[Android Software/Hacking General [Developers Only]] liquidini:
i have 121022 version which doesnt work i think :o
[Android Software/Hacking General [Developers Only]] yuweng:
Mostly updated firmware/ ROM are for system only & seldom updates includes recovery so Andyle2k ported cwmr should work on your latest 121022 version too but its always the best to upload yours & port your own cwmr using my tuts... :cool:

Then use this guide here specific for H2000+ that i have found on www & it should work... :fingers-crossed:
[Android Software/Hacking General [Developers Only]] Axel_Stone:
Hello, guys! Sorry if I'm posting at the wrong topic, didn't find the right one. :(

Just bought Hero H2000+ and my camera looks upside down, did anyone solve it?

Or can anybody tell me where can I find any firmwares for this phone? I would like to try the latest one.

Thanks for you attention :)
[Android Software/Hacking General [Developers Only]] Dan-71:
Hi all.,

I just buy yesterday a Hero H2000+ with 121022 build number and I want to root it.

I downloaded SP Flash Tool v3.1224.01, but my recovery is 3e and i have not option mounts and storage.

Can you be so kind to tell me how to put CWM recovery on y new H2000+ ?
[Android Software/Hacking General [Developers Only]] liquidini:
thanks!!!will try it when i take the phone from my gfs hands hahahah
[Android Software/Hacking General [Developers Only]] Dan-71:
Both Andyle2k and guide from chinatechy (prety much the same) don`t work on my Hero H2000+ with 121022 build :(

---------- Post added at 06:02 PM ---------- Previous post was at 05:36 PM ----------

need to download all imagines is the message from smart phone flash that i receive:(
[Android Software/Hacking General [Developers Only]] xdwhat:
Just want to inform that I have a mt6577 GT-N9300+ Galaxy S3 clone and i rooted my phone with this procedure:

Rooting mt6577
[Android Software/Hacking General [Developers Only]] VINChe:
Where is the tutorial?
[Android Software/Hacking General [Developers Only]] bigrammy:
Here is tut by master [MENTION=4478781]yuweng[/MENTION] TUT here :good: I referred to it earlier but I had to rush out because I was late for a appointment :silly: Please follow yuweng's instructions and repeat the same procedure for obtaining your system.img, boot.img and recovery.img :highfive: then report back.

Just to be clear here are you already rooted ? or should I say already have an unsecured boot.img for your device :confused:

If you do then ADB would be the easy method :good:
[Android Software/Hacking General [Developers Only]] MrCabana:
I am having a problem.

My device will remount /system back to read-only right after I mount it read-write. Besides there's a a F#@#@# script somewhere reverting any changed files in /system.

Don't know what's causing it, so I thought I would just add su and busybox directly to boot.img to see if it works.
[Android Software/Hacking General [Developers Only]] x1123:
boot.img is containing binary kernel (kernel you have compiled from source ) and Ramdisk you can compiled binary kernel along with RAMDISK but CAN NOT put Su and Busybox in the Ramdisk or kernel or boot.img. To have wrotable /system mount point you must edit DEFAULT.PROP file THIS IS BRIEF EXPLANATION
[Android Software/Hacking General [Developers Only]] bigrammy:
OK slow down dude or you may end up with a paperweight if you carry on :laugh:

Let us just step back and start from the beginning :)

I have just had a quick look through your recent post's and it seems you have a H5000 phone :confused:

Because there are a few different H5000 phones around we need to identify your exact phone model.

Also we need to know if it is MTK6575 or MTK6577 SoC and the REAL Android version 2.3.6 or 4.0.4 I have a feeling yours maybe mtk6575 with v2.3.6 :eek:

If you purchased the phone from a web site please give the link to your phone or even the link to images of you phone. Just paste them as plain text in your reply If you cannot add live links yet.

I am almost certain there will already be .img files for your phone already extracted :cool:

Edit: I notice you say you can obtain temporary root if this is true just select debugging and the use adb to dd the recovery.img and boot.img to your sd card if file explorer will not let you just delete the install.recovery.sh or other rebuild scripts from the etc floder.

Please follow this post Here follow the instruction step by step if you have a mtk6575 device with real android version v2.3.6 which has been faked to look like v4.0.4
[Android Software/Hacking General [Developers Only]] bigrammy:
Wow :eek:

Thank you for your very detailed explanation and all is very clear now. I wish everyone would be this good :laugh:

You are probably better qualified than me [MENTION=5318726]MrCabana[/MENTION] because I have no idea about scripts except for minor edits I only use the tools and scripts what other gurus have wrote :o

Anyway back to your Phone after a little digging it seem's your phone is based on the zp500+ Mtk6577 with mt6628 wlan chip.

This phone is very hard to root successfully I know etotalk struggled and even zopo seem to have had problems too because the official rooted ROM by Zopo has had reports of a broken camera too the same as you reported on the Portuguese web site.

Looking through the root version and no doubt your unrooted version too there are two .img files that are not normally present in a normal ROM (See attached image) ramdisk.img and ramdisk_recovery.img these I suspect are the cause of your troubles as they will probably just rebuild the stock ROM every time you boot up or boot back to system :crying:

The camera probably does not work due to a bad rebuild script by the ramdisk.img but I have no experience of these type of .img or how they could be edited :eek:

I will continue my research but for now I think you may have to remain unrooted.

Here is the link to the zp500+ rooted version Here

EDIT: Forget the ramdisk theory Hehe they are not loaded during the flash so I guess they were just left in there after modding the ROM so things may still be possible. I will port the recovery to TWRP v2.5 for you to flash and we will see if that that can do the trick for you.

BTW what is your screen res? I will google it
[Android Software/Hacking General [Developers Only]] yuweng:
Hehe, one of the xda member here liquidini gave up rooting & has already sold his H2000+ when i informed him that i found out the reason why all rooting procedures fail...

it turns out that H2000+ & in fact the latest Lenovo S890 JB ROM is still using the old GB ROM format... :cowboy:

To gain 100% root access for your H2000+ rebrand, use the old techniques on the root.zip...

1) Copy su to system/bin instead to system/xbin

2) updater-script -> set perm to bin instead of xbin & reverse the symlink as below & it'll work... :fingers-crossed:

set_perm(0, 0, 06755, "/system/bin/su");
symlink("/system/bin/su", "/system/xbin/su");
[Android Software/Hacking General [Developers Only]] bigrammy:
The Master strikes again Hehe :D

Very interesting yuweng :eek:

Although I am not quite fully understanding this just yet I now have more to learn :rolleyes: :laugh:

Is it mtd for some partitions and ext4 for the other partitions :confused: I think the HTC DHD I just got through messing with used the same sort of config.

If we ported TWRP would it detect the correct way to root based on the mounts in the original recovery I guess not because we have to tell the port tool is it emmc or mtd :eek: Just thinking out aloud here :silly:
[Android Software/Hacking General [Developers Only]] yuweng:
Just stumble upon this by accident when i port Lenovo S890 JB ROM & i wondered why AK fail to cook a rooted Stock ROM out of it... :confused:

Then i download similar ROM cook by the Russian, they are really 'terror' in findings all related to MTK stuff...

Even TWRP auto-root fail to gain root b'cos it install su to system/xbin instead of bin... :D
[Android Software/Hacking General [Developers Only]] bigrammy:
Hi buddy, :highfive:

So would a simple edit of the rooting script in the TWRP compiler solve the issues then :confused: or would TWRP still have issues mounting certain partitions ?

I know TWRP would not work properly with the HTC DHD and Aroma installer combo and I was adviced to use 4ext recovery Here which is a awsome recovery too and can cope with ext3 and ext4 partitions (mtd)(yaffs2 requires ext3) or am I getting confused here :eek:

Anyway Its a shame we cannot add it to the list of recovery's for MTK65xx SoC.

My head is starting to hurt now I am going for a lay down :crying: :laugh:
[Android Software/Hacking General [Developers Only]] yuweng:
Yes -> if you use an edited root.zip that install su to system/bin with correct perm & symlink ( but in this case, it doesn't work for MrCabana) No -> TWRP auto-root will always install su to system/xbin

In fact, during my MT6573 time i've tried to port 4ext for mtd partition but not compatible & its close-source so even great DEVs can't compile it to make it work on MT65xx ... :(

yaffs is a totally different story... :o

Hehe, some MTK device are really hard to root...

Last resort, i would suggest you to cook your whole Stock ROM with AK, add root & busybox at AK or just port another compatible MTK ROM to your device...
[Android Software/Hacking General [Developers Only]] MrCabana:
Partial SUCCESS !!!!!

This [MENTION=1642356]Rick#2[/MENTION] guy opened up a new resource for me in his guide telling about some debugfs magical little program to be run into Android.

In the end, it turned out that my 3rd assumption was right :

I had to adapt [MENTION=1642356]Rick#2[/MENTION] script in order to work with my device though, his was pointing to mmcblk1p20 and mine should be mmcblk0p3. I can run debugfs to open that block read-write and operate flawlessly with it on the fly. Results are immediate and they survive reboots.

Now my only problem remains on mounting /system rw. Not this workaround of mounting somewhere else, but the /system itself. I have no idea why it keeps refuting remounts rw.

At least now I think i can reflash my stock boot.img (patched with ro.secure=0, of course) back in place and no more of running fragile scripts at boot time to move files around.

Thanks again, [MENTION=4478781]yuweng[/MENTION] and [MENTION=3924647]bigrammy[/MENTION] .
[Android Software/Hacking General [Developers Only]] x1123:
Hi MrCabana,

I just finihsed built aokp-JB (4.2.2) for dell venue. and don't know it is booting into device or not but I saw that system/bin/SU is symlinks from /system/xbin/SU ... see below screenshot :D .. i mean, it is probably today standard for Jelly Bean
[Android Software/Hacking General [Developers Only]] MrCabana:
Could any of you please pastebin.com to me the results of the commands bellow obtained from a fully rooted ICS device (with read-write working)?

# cat /init.rc

# cat /default.prop

# ls -l /system/bin

Thank you.
[Android Software/Hacking General [Developers Only]] bigrammy:
Hi MrCaban and [MENTION=3868181]x1123[/MENTION],

I have been busy at work so not had chance to even read fully the above post :eek:

Just quickly scanning through I suspect a busybox issue:confused: I also know etotalk.com engineers had a real problem rooting the phone too so I think we will have to just work through this little by little.

I will have a full read of your posts tonight and see if I can help in any way. :)
[Android Software/Hacking General [Developers Only]] bigrammy:
Ok guys I have the updater.script's from a rooted zp500+.

There are 2 updater scripts in the ROM :confused: I do not know if they follow on or if one is a fix for the previous :confused: Anyway I will upload them as is and maybe you guys can figure out exactly what is happening. :eek:

I know there is some kind of fix for the camera using binaries.

I hope this helps :fingers-crossed:

The Superuser.apk is contained in system/app in the ROM I have. :good:

There is also a file in system/xbin called "su"

I have zipped this file so I can upload it for you.

Sorry Please forget this statement your device is true. My reason for the comment was I was unsure of your device at that time and there are lots and lots of MTK6575 devices reporting to be android v4.0.4 but they are v2.3.6. :rolleyes:
[Android Software/Hacking General [Developers Only]] MrCabana:
Hello bigrammy,

The two scripts you pasted seem to be the same one (Linux has this thing of renaming old versions of files with "~" in the end).

I feels a bit scary though, it starts by formatting /system to replace with its own package. It also formats /data.

But don't take my word for that, I've never seen an update script for Android before :D.

Anyway, it's interesting to look at it and see how it sets permissions for system folders. I will have a closer look later tonight.

Could you please send me your /init.rc and /default.propp from a rooted device with ICS?

Thank you.
[Android Software/Hacking General [Developers Only]] x1123:
Again some naming policy in android looks vague :D updater-scripts is actually a script to install custom rom or updating rom, unless you have system.img or whole rom in CWR flashable file. Do not use this script. Formatting /system in flashing rom is the default option to ensure clean install and nothing file left from previous rom.

Basic default.prop file in GB, ICS

for jelly bean sometimes

some device with MTP, PTP capable

init.rc is highly device dependent and service design dependent .. just for your sample see attached
[Android Software/Hacking General [Developers Only]] MrCabana:
UPDATE:

I just found out that what is causing /system to revert to ro all the time is an attribute to the mount command that says "errors=remount-ro".

Tried the first-per-boot remount setting it as "errors=continue" and it didn't revert to ro, but the system went into problems.

Now I think all I need is to find the correct mount options for /system as well as where these attributes are located. They're not in init.rc and vold.fstab only has references to external SD card.

Suggestions will be appreciated.
[Android Software/Hacking General [Developers Only]] x1123:
This is based on experience since I have NO knowledge about this. /system by default is mount ro all time. In case user need rw , root ( su ) previllege is needed. This is what Superuse.apk for. on default.prop by using option ro.adb.secure=0 along with busybox, su,. superuser, adb gain root access. if you change the mount option error remount=rw AFAIK this is dangerous, since your device have writable /system all times.

If your intention just to delete some bloatware apk. use MT Droid Tools, gain temp root, click adb terminal which will send you to adb terminal with root access, delete everything you want. Device /system will back to ro upon reboot ..... you are safe :D
[Android Software/Hacking General [Developers Only]] bigrammy:
Yes I only uploaded it for you to compare and to see the permission settings and folder organization ;)

I will pop the init.rc and default.prop in a zip for you. They are taken from my phone that has a LeWa ROM which I ported to it from another device. :cool:

Maybe someone like master [MENTION=4478781]yuweng[/MENTION] could look at the updater.script and make sense of it for you because it is well above my pay grade :laugh: Your cat or dog may be able to help you with scripts more than I can :eek: :laugh:
[Android Software/Hacking General [Developers Only]] MrCabana:
That's the exact the problem. I can't mount rw not even temporary. I had just found out it's probably due to mount options set previously that is probably preventing the mounted partition /system to forward changes to the disk. I'm still digging the net for more information.

Since I can't mount rw, I can't delete APK's. That's why I want to set proper mounts so Superuser.apk or any other app can remount rw successfully.

Agreed. That's what it seems to do in the scripts [MENTION=3924647]bigrammy[/MENTION] gave us.

I wasn't trying to use your init.rc replacing the one I had, I just wanted to see if your mounting options were different.

Thank you very much. I compared your files with ones I have, and they are pratically identical. Just a few small changes, maybe due to hardware capabilities or something. That's frustrating, I was expecting to have different mounting options.

I love cats and dogs, but I don't have any :crying:. But I will surely ask the neighbor's if he has any idea about mounting Android partitions :p.

So, guys, here is what I'll be looking to do:

I have to find a way to instruct Android to mount /system properly. Maybe copy the same parameters it use for /data (which is rw by default). Despite of x1123 thought, I am not willing to leave it rw all the time. Of course ro has to be default. But in case an app needs to remount it rw temporary, it will be successful.

Do you happen to know where these mount options are located? As I said before, my /system/etc/vold.fstab doesn't relate to /system at all. It must be somewhere else because there's nothing in /default.prop either.

Ok, let me try to be more clear. I have this line in /init.rc "mount ext4 /emmc@android /system commit=1,noauto_da_alloc" and this is the last call in the script to mount /system. But, after the phone is fully loaded, mount shows the system partition as "/emmc@android /system ext4 ro,noatime,user_xattr,commit=1,barrier=1,data=ordered,noauto_da_alloc 0 0". See? Where is it getting these extra options from (ie. "noatime,user_xattr,barrier=1,data=ordered"). These are extras, not included in the last mount command I found in init.rc. Also, it won't be reverted to ro if I mount including option "errors=continue". The only conclusion is that it brings "errors=remount-ro" embeded implicitly.
[Android Software/Hacking General [Developers Only]] x1123:
MrCabana,

This is really interesting. I fallen in love with android phone since HTC G1 which I can not use for my daily bullet due to horrible battery life. In 2011 I joined the crowd in tweaking and playing arround with android phone for fun in the spare time, During my time with android I never heard about this, a "simple" thing but frustating :D ... Please keep us posted with your digging.

I only can assist you with some guessing, since I don't have a device like You. I have some Mt6577 (Lenovo P700i, OneScribe ZA985 by Zyrex. OPPO Find Piano) which I got by purchasing SOFT DEAD PHONE which today user prefer to sell brick phone at very cheap price (15% - 25% of New Selling Price) and get brand new one, by owning GTG-JTAG Pro, Volcano Box, and some other kind of box along with various JIG and Soldering tools, I bought soft brick devices and reviving with all box I have. So far only Dell Streak 5 still on "dead" and No Success to revive with the box. I just have wishful thinking, selling refurbished smart phone looks interesting.

back to android I'm wondering the scripts probably embed in the one or two of stock *.apk in the phone and finding this script will be like digging Jenghis Khan's treasures. If more vendor do this, rooting fest will be more challenging then :D.

You probably can try by logcating. Switch on phone with usb cable connect to pc and run logcatting since very beginning, who know there will be something output can give a clue. I don't understand whole android process, but post into pastebin or something and probably more eyes can see better .... I think cat and dog not included in this matter.
[Android Software/Hacking General [Developers Only]] MrCabana:
Update:

I found this website. Very interesting and looks a lot like my case, but I still have to figure out how can I repeat the guy's steps since my /system/bin doesn't have an "aba" file.

And this post shows how to make a sysro/sysrw script.

Will try both tomorrow.