yashsingh1/xdaforums huggingface dataset:
[Motorola Photon 4G] tdhite:
I don't have the tool chain loaded, but I can load that up, no prob. I'll need the kernel source and a config file, which I hope to get off the Motorola open source site, dunno, I'll look around.

But even if we get a kernel built, I'm confused how we will even load it since the video shows the normal assumption -- full clockwork mod, not merely a bootstrap. We only get bootstrap right now, which can't touch the loader.

Am I missing something, hopefully? Like packing the kernel set in a SBF, flash that and boot, then root and try to load clockwork mod, followed by the downgrade attempt? I might be thinking wrong there.
[Motorola Photon 4G] nickman529:
No no no. We port kexec and use our bootstrap. Kexec loads the custom kernel on a locked bl

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
I can try the best of my knowledge of I have done before..

Here is the source for kexec-tools:

(I'm not sure how to use this tool though?)

Maybe we can compile this tool and see how it works?

http://horms.net/projects/kexec/kexec-tools/

Edit:

Where is the source for the bootstap?
[Motorola Photon 4G] nickman529:
Thanks now we need compiling instructions.

Not sure hit up Google

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] tdhite:
Webtop will work fine -- we're not messing with that (imho). We need only muck the bootloader somehow. See my other note (to follow).

---------- Post added at 05:40 PM ---------- Previous post was at 05:34 PM ----------

Ok, kexec-tools are interesting, but not nearly sufficient. They are merely user-space tools to ask the kernel to 'reload itself in place with another kernel.' However, to even have that work, the original kernel must support kexec (in kernel build terms, the .config file for the kernel build *must* have CONFIG_KEXEC=y, likely CONFIG_KEXEC_JUMP=y as well, but not necessarily), otherwise it's futile -- the kernel will not reload (another kernel).

So, two things have to happen before compiling:

1) I need to see the original .config file so I can check if the CONFIG_KEXEC is set (I highly doubt it, but it doesn't hurt to look); then

2) We cross-compile a new kernel to load over that one with the kexec user-space tool (which we also cross-compile).

Compiling the kernel and kexec is easy == merely "make && make modules_install" for the kernel, and configure/make for the kexec tool (more or less).

I'll look at the .config when I find it.
[Motorola Photon 4G] nickman529:
The kernel is on motos open source site I think

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
My question is can we compile with Motorola Source? Is there a source on github somewhere? Normally manufactures do not release the full source with that being said we may not be able to compile from it..

EDIT:

Found this: Click on the "ZIP" next to "Clone in Windows" to download the full source..

https://github.com/johnjelinek/photon4g.motorola

Does anyone have the config to compile this or can we just use the default from the source?
[Motorola Photon 4G] nickman529:
Awesome. This'll be helpful
[Motorola Photon 4G] nickman529:
Tdhite take a look at that link it has some kernel info
[Motorola Photon 4G] tdhite:
Yes, we can compile new kernels -- Motorola gives relevant patches for the build and the config file is provided in the phones at /proc/config.gz). However ...

SCROOGED!

I attached the config file from my own photon, which shows clearly that kexec is not possible with 2.3.5 phones. First, CONFIG_KEXEC is not set in the kernel. If anyone happens to have a kernel with kexec *set*, that'd be great, but my hopes are almost zero. The OTA dumped the kernel and locked the bootloader so you can't even load another kernel. The kernel we have was built for this dump: Linux localhost 2.6.32.9 #2 SMP PREEMPT Mon Jun 11 21:27:05 EDT 2012 armv7l GNU/Linux. Note the date: Mon Jun 11 21:27:05 EDT 2012. Primed us for the kill ... then they shot us.

We need to keep thinking, but this route (kexec) is pretty much dead in the water -- Motorola, frankly, couldn't have been that negligent, but hey -- it was worth a shot, that's for sure (since they are malicious enough to harm their own customers).
[Motorola Photon 4G] anthony062991:
That is the kernel source directly from Motorola..

Also here is the source from the link:

http://sourceforge.net/projects/photon4g.motorola/files/

---------- Post added at 07:09 PM ---------- Previous post was at 07:00 PM ----------

Thanks for the config..

Can't we add kexec to be set in the kernel and recompile it? I mean isn't it possible to merge the kernel with kexec?

http://xdaforums.com/showthread.php?t=1773514
[Motorola Photon 4G] tdhite:
Hey now ....

Looking at the source, and how it was configured, I'm wondering if we can't actually exploit a hole they may have left us. Note this in the config file:

CONFIG_MODULES=y

# CONFIG_MODULE_FORCE_LOAD is not set

CONFIG_MODULE_UNLOAD=y

# CONFIG_MODULE_FORCE_UNLOAD is not set

CONFIG_MODVERSIONS=y

# CONFIG_MODULE_SRCVERSION_ALL is not set

. . .

CONFIG_SCSI_WAIT_SCAN=m

CONFIG_CRYPTO_RNG=m

CONFIG_CRYPTO_ANSI_CPRNG=m

That means we have the ability to 1) load modules; 2) unload modules; 3) exploit existing modules by extending their functionality (but have to play with the issues involved in 'CONFIG_MODVERSIONS' to get them to load since they unset the 'FORCE' options -- tough, but possible); and finally 4) create new modules (same issues).

Modules, of course, get kernel level access (though there's gates). This looks to me to be our best chance at messing with the system sufficiently to downgrade things (or, should we say 'upgrade' to some magic new version).

I have to ponder this, but it's a pretty easy game if an exploit comes into play. My photon has but two modules loaded:

$ /system/xbin/lsmod -a

Not tainted

dhd 234647 0 - Live 0xbf013000

vpnclient 66748 1 - Live 0xbf000000

interestingly, the three listed in the build are *not* loaded, which suggests we could play with them. I have to ponder this a bit. I need to study the kernel code as well, because the three modules went somewhere, but not in /lib/modules, which is where they would have been installed if Motorola wanted us to have them. No matter -- we can load and unload modules since the kernel allows it.

Gotta think a bit ...

---------- Post added at 06:22 PM ---------- Previous post was at 06:14 PM ----------

Nope -- unless we learn how to inject code into the running kernel -- whoof! Modules are a form of injection, but not at the level for of KEXEC.
[Motorola Photon 4G] anthony062991:
Vary interesting.. You are rite.. Normally the modules are loaded in /lib/modules but they are not there.. I do see dhd and vpnclient in /lib though..You think we can make a module to bypass this boot-loader? I don't know to much about modules?
[Motorola Photon 4G] tdhite:
They surely load the modules from the initrd, but no matter. That we can load modules means we just need to figure out an exploit of some sort and build a module to execute it. We will need a properly prepared source tree, but can will worry about that later.

---------- Post added at 07:29 PM ---------- Previous post was at 07:10 PM ----------

/system/lib has modules:

# /system/xbin/ls -l /system/lib/*.ko

-rw-r--r-- 1 root root 16644 Aug 1 2008 /system/lib/bcmsdio.ko

-rw-r--r-- 1 root root 291768 Aug 1 2008 /system/lib/bcmwimax.ko

--w-r--r-T 1 root root 290540 Aug 1 2008 /system/lib/dhd.ko

-rw-r--r-- 1 root root 0 Aug 1 2008 /system/lib/dummy.ko

-rw-r--r-- 1 root root 5960 Aug 1 2008 /system/lib/rmnet0_drv.ko

-rw-r--r-- 1 root root 5960 Aug 1 2008 /system/lib/rmnet1_drv.ko

-rw-r--r-- 1 root root 5960 Aug 1 2008 /system/lib/rmnet2_drv.ko

-rw-r--r-- 1 root root 5960 Aug 1 2008 /system/lib/rmnet3_drv.ko

-rw-r--r-- 1 root root 87440 Aug 1 2008 /system/lib/vpnclient.ko

As for whether we can blow by the bootloader -- no way, modules load far to late for that. But, given the kernel *can* do may things through modules, we have a pathway to *fix* the bootloader for our needs (hopefully).
[Motorola Photon 4G] anthony062991:
What do we need to do now?

I was looking at the kernel source and idk if this means anything but it talks about the boot loader?

https://github.com/johnjelinek/photon4g.motorola/blob/master/firmware/av7110/Boot.S

There is folder named fuse?

https://github.com/johnjelinek/photon4g.motorola/tree/master/fs/fuse
[Motorola Photon 4G] paco_1:
see this is the one you need
[Motorola Photon 4G] anthony062991:
What's the difference?

Edit:

Am I looking at the wrong kernel?
[Motorola Photon 4G] tdhite:
Dunno quite yet -- currently I'm tearing apart the kernel/ramdisk pair to see what they do. Interestingly, no chroot occurs. It appears the kernel unpacks the initrd, starts init, and that's it -- no chroot, no nothing. Not that it would be abnormal to do that, but it means modules are not loaded in initrd -- rather likely via udev or similar. Still, no matter, I just wanted to see what's up.

The bootloader remains the issue -- what we have to do is get it to go ahead and load a kernel even if the kernel has the wrong signature.

Like I said -- just have to ponder a bit as we see what the boot process actually does on this OTA crap. I admit I'm working from the bottom up, but that's how I hope to see an exploit of some sort somewhere along the chain.

-- Tom
[Motorola Photon 4G] nickman529:
I FOUND SOMETHING!!! Okay so we can load modules (but not kexec) what if we got a module to exploit the running init service to try ad hijack it with a 2nd init at next boot? ive been tinkering with the 2nd init idea
[Motorola Photon 4G] tdhite:
I'm not sure what we would go with another init ?? Maybe you have something you could shed light on for me.

With that asked, I can't figure something out, and I'm sure Mof knows the answer:

Why would simply dd'ing the old boot loader into the boot partition, then dd'ing they old kernel/ramdisk into the boot partition not work? Is a check on the bootloader somehow burned into the firmware somewhere?
[Motorola Photon 4G] anthony062991:
Is the bootloader part of the kernel? Are you trying to say replace the kernel with the old one? I don't think that would work?

Edit:

Do any of you have the latest kernel source in a zip?

Edit:

Why can't we configure the kernel without the fuse in it? Completely take it out of the kernel and flash to our phones?

OR try to configure the new kernel with the old one? idk if that is even possible?
[Motorola Photon 4G] anthony062991:
I found this thread: The DL link is dead though..

http://xdaforums.com/showthread.php?t=1180199

Also found this in the Motorola Defy forums:

(check out the apk)

It has a bunch of 2nd init stuff but it's for froyo base I think?
[Motorola Photon 4G] tdhite:
The bootloader is a separate block device (/dev/block/mmcblk0p1 -- I think (can't remember exactly at the moment)). I dd'd it out to a separate file and inspected it. There is a check on the signature of the boot device. So, I can freely dd things from it, or to it. Thus my question about overlaying it. Recognize that the bootloader is useless during normal phone ops, so with root access, anyone can overlay it and whatever is there 'should' be active on next boot.

The boot partition lives at /dev/block/mmcblk0p11. That's just a dd'd kernel/ramdisk pair. You can dd it out to a file, then use split_bootimg.pl to unpack it.

Given the two are available, and because I'm not a genius at the actual cold boot process that takes place, my question is what is wrong with the following:

1) ask someone with a 2.3.4 phone to dd their bootloader and boot partitions (block devices) to files and give them to us;

2) dd the old bootloader to (over) the bootloader partition;

3) dd the old kernel/ramdisk pair to the boot partition;

4) use bootstrap recovery to flash MOF's 2.3.5-ish ROM over the /system partition (that's what it does, in effect).

Boot the thing.

I know I'm missing something here, just don't know what. To be sure, since it would overlay the bootloader and boot partitions, it could easily brick a phone (likely a hard brick, not merely a soft brick) if incorrect.
[Motorola Photon 4G] nickman529:
We need someone to risk their photon

I think we can replace the bootloader. As long as we have a system to work with it. If marketplace that we may be able to boot mofs rom. But that doesn't solve the unlock necessarily
[Motorola Photon 4G] matt51:
Is the bootloader partition something that is loaded during boot from somewhere else? Kinda how the boot.img rewrites a bunch of things during OS startup?
[Motorola Photon 4G] nickman529:
The bootloader is what loads the entire system and the kernel and starts init. The kernel is the base for all services and processes on the device. Init is the thing that starts the services and all the other crap moto wants us to have (Or the stuff in your Rom of choice)

If we can hijack init we can make it call upon itself instead of the services and applications it normally does.

Before you say that wouldn't work... That's what we use 2nd Init for.

(When init is called by 2nd init it goes to sleep)

2nd init hijacks the init process and injects a CyanogenMod base into it. Then it starts changing what init does and makes init not boot the way it is supposed to.

Then after you have loaded a custom rom with 2nd init support (CM10 2nd init version) (The droid x2 had a CM10 with 2nd init.) the rom will load properly because of the hijack 2nd init did. Init can no longer call the moto process and the locked bl file. Therefore we are able to bypass the bootloader by jacking the init that makes moto crap start.

The problem is 1: Loading 2nd init properly and 2: Building a 2nd init rom. I need someone who can risk their device for the greater good and someone to help me build a rom

If anyone has a 2.3.4 photon who can help, that would be awesome.

And if anyone is willing to risk their photon to help with 2nd init (I have no clue what could possibly happen to the device other than a soft brick) that would be even better
[Motorola Photon 4G] nickman529:
tdhite: I'm not opposed to trying the block flashes, but I need a spare Photon (i dont have a spare one) So we need someone that can test it for us.
[Motorola Photon 4G] nickman529:
I got an idea. If we port 2nd init we can make a custom rom that will have the script to load the 2nd init kernel at boot and allow the custom rom to boot! We just need a port...
[Motorola Photon 4G] R2DeeTard:
I don't know how much help i can be, but i have a stock rooted 2.3.4 photon. I would be happy to test anything you have.
[Motorola Photon 4G] anthony062991:
Just a quick heads up!

I just found u-boot for tegra2 source up on github:

https://github.com/antmicro/u-boot-tegra2

If we can get this thing to compile correctly we might at least be able to make a bootable sdcard with CWM and this will bypass the bootloader for now..
[Motorola Photon 4G] nickman529:
Awesome!!!

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
I found in the /include/configs/harmony.h

https://github.com/antmicro/u-boot-tegra2/blob/master/include/configs/harmony.h

harmony is some type of androd tablet with tegra2 build in..

I was wondering if we can get that one to build and then see where to go from there..

My Linux in VM is messing up so I have to get it running again before I am able to try to compile this..

If you guys are running Linux fill free to try to compile this thing just make sure when you do the "make" command do "make hormony_config" first than "make".. Hope that help..
[Motorola Photon 4G] nickman529:
I am working on it right now
[Motorola Photon 4G] nickman529:
What board is in the Photon?
[Motorola Photon 4G] anthony062991:
What do you mean?

Chipset: Nvidia Tegra 2 AP20H

CPU:	Dual-core 1 GHz Cortex-A9

GPU: ULP GeForce

Here the specs for our phone:

http://www.gsmarena.com/motorola_photon_4g_mb855-3987.php
[Motorola Photon 4G] foxsdaddy67:
will this help?

http://en.wikipedia.org/wiki/Nvidia_Tegra#Tegra_2_series
[Motorola Photon 4G] anthony062991:
Thanks for the info why didn't I think of wiki? haha..

Well "harmony" and "Ventana" witch is our device is pretty much the same thing..

I really hope we can get this U-Boot to compile and boot up properly.

Then we can install custom roms and kernels without messing with anything from the system. (all from the SD card) if we can get that for..

---------- Post added at 05:59 PM ---------- Previous post was at 05:50 PM ----------

Guess what I found?!

U-boot-tegra for the "Ventana" Witch is the same processor as ours.. :)

https://github.com/muromec/uboot-tegra

Check out /include/configs/ventana.h

https://github.com/muromec/uboot-tegra/blob/chromeos-v2011.03/include/configs/ventana.h

This U-Boot should be 100% capable with our device!!

EDIT:

here is the thread I found it at:

http://xdaforums.com/showthread.php?t=1202541
[Motorola Photon 4G] nickman529:
Building now
[Motorola Photon 4G] twaffle:
Fuse's are literally 'burned' out electronically.
[Motorola Photon 4G] nickman529:
Ugh can anyone else try to compile this. i keep getting errors...
[Motorola Photon 4G] tdhite:
I'm out for a bit, but I can jump on setting up the tool chain. I run Linux, nothing else so I should be able to get set for building, just need a pointer to the latest tool chain.
[Motorola Photon 4G] nickman529:
When can you get to it?
[Motorola Photon 4G] tdhite:
Hour or so.
[Motorola Photon 4G] nickman529:
Sweet Im gonna give it a few more goes (no luck probably)
[Motorola Photon 4G] anthony062991:
Try the latest toolchain from here..

http://www.linaro.org/downloads/
[Motorola Photon 4G] nickman529:
I hope we can get this working. I've been doing research on uboot. It looks promising

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] xopher.hunter:
Wow I am impressed! I hardly ever drop in anymore since my photon is locked. Been abusing it ever since (keys in the same pocket as phone). If any of this is successful I will refurb a new one right away!

Thank you guys!
[Motorola Photon 4G] veritasaequita:
if you guys need any help ive got a stock photon sitting here for about a year now,its on 2.3.5 and ill run anything on it because otherwise its just going to set in a junk drawer forever.
[Motorola Photon 4G] anthony062991:
I will be off and on the rest of the day and tomorrow also.. If you guys get this to build let me know.. I hate to leave.. I'll see if I can take a look at it tomorrow if I get some time! Thanks everyone else for the support.. One of them has to build. Maybe we can get one of the devs that know a little more about kernels to help us idk?
[Motorola Photon 4G] nickman529:
Tdhite and I will work hard I'm sure!

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
We will be in touch I'm sure

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
U-Boot works really well on my nook hd! Just pop in the memory card and it's boots into cm10 and doesn't even touch the system. It would be impossible to brick because everything is ran off the sd card. If you take out the sd card it boots rite into the regular system.
[Motorola Photon 4G] tdhite:
Ok, nabbed the toolchain -- looks like it's a cross-compiling chain (x86 tools, output arm code). I'll just jin up an Ubuntu VM and start setting up the chain, then compile (hopefully) uboot. It's gonna take a while, so take a break all. I'm off tomorrow, plan to play with this (tonight too).
[Motorola Photon 4G] nickman529:
Dude thanks for all your support. And everyone else. I love the support from xda. Keep me updated td

Sent from my ICSish MoPho

using xda-developers app
[T-Mobile, Samsung Galaxy SIII] Cyberianrazr:
does anker 2200mah battery actually have more screen on time and usage than oem 2100mah? just wandering. seem like anker 2200mah is aroudn $8-15 cheaper then oem 2100...too good to be true?
[T-Mobile, Samsung Galaxy SIII] trein91:
It's around the same or perhaps marginally better but idc either way. I bought two batteries for 16 dollars and an external battery charger for 6 dollars with shipping. I really can't stand those who complain about battery life without trying to do anything about it lol.

OT: external power banks are sucky compared to spare batteries imo. Nothing beats replacing to a fully charged battery. (Instead of being hooked up to a troublesome cable all the time). Not even those retarded looking extended brick batteries lol. =p
[Nexus 4 Q&A, Help & Troubleshooting] FatalityBoyZahy:
Is it just me or is the headset icon removed from the status bar in JellyBean? I haven't seen one when I plug me headphones in.
[Nexus 4 Q&A, Help & Troubleshooting] xdviper:
Yeah it's removed. Would love to have it back though.
[Nexus 4 Q&A, Help & Troubleshooting] FatalityBoyZahy:
Thanks for your reply. I thought something was wrong with my headphone jack. lmao
[Galaxy Note GT-N7000 Q&A, Help & Troubleshooting] eddy_:
my mobile is galaxy note 1

GT-N7000

samsung kies updated the firmware to 4.04 via wifi

after that the wifi doesnt work if i try putting it on gives a pale green light cant go of or on and drains the battery

any help

thankx
[General Questions and Answers] funkyos:
I'm trying to get my father to use a spare android phone that I have. I he's a senior so accessibility is a big concern. I've used a launcher to make the text and icon size pretty big.

But now he's having trouble with simple taps. When he tries to hit an icon or button, he accidentally does a small swipe of the icon causing it not to load.

I've realized no apps or links run on the initial touch down event but on the release (as long as there isn't a swipe or hold). Is there a way to change this so that the touch down event activates links?

Any help is appreciated.
[TouchPad Themes and Apps] kingtuk1:
For full screen you should try full!screen by tsorn It's been working for me. I have been using the free version. The paid version you are supposed to be able to setup full screen for only the apps you want full screen when they are run.

I am running this on Jcsullins CM10 12/16.
[TouchPad Themes and Apps] Nathanation:
Thanks! Works on oats cm10 light rom
[TouchPad Themes and Apps] waynekirby:
You mean like expanded desktop mode in power menu?
[Nexus 4 Q&A, Help & Troubleshooting] itpromike:
I'm on ATT and it looks like I have the dreaded MMS failure issues. For example I often get group texts from iPhone users that send as MMS but they don't download for me. Any ideas?
[Galaxy S III Mini Q&A, Help & Troubleshooting] pitchblack5691:
Hi friends of xda!

I'm new to Samsung devices and my previous device is a Sony Ericsson xperia mini (excellent device) . But I understand that Samsung and Sony devices are very much differend from each other in terms of customizations, partition layouts etc.,

This device being a new device to the market i have few questions about I8190 and will be really thankful for your replies :thumbup:

1. Coming from a xperia in which I need to unlock the bootloader by using Sony unlock bootloader site but in Samsung I8190 how to unlock bootloader or will it readily accept unsigned images via fastboot out of the box??

2. Is there a separate partition for recovery like in other Samsung devices or just like in xperia mini the recovery is built inside kernel's ramdisk??

And I may ask questions which I can't find a proper answer. In this thread other I8190 users are also welcome to ask questions and share their knowledge too :)

Thanks!

#pitchblack5691#
[Galaxy S III Mini Q&A, Help & Troubleshooting] kicker63:
Oops!
[Galaxy S III Mini Q&A, Help & Troubleshooting] pitchblack5691:
Nobody??? :(

#pitchblack5691#
[Galaxy S III Mini Q&A, Help & Troubleshooting] nikufellow:
First of all let me welcome you to the club mate :D

* we have no fastboot - a download mode (odin mode) is there though . And bootloader is unlocked though sammy has a dirty trick up its sleeve to count the number of times we flash unofficial firmware - a line of code in the bootloader called 'flash counter'

*no separate partition for recovery its built into ramdisk

leap before you think