yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] 888jonathan:
Sorry, I don't really know what do you mean by "chmod 777 inside the telnet session", here's my result

shell@android:/ $ chmod 777 /data/local/tmp/busybox

shell@android:/ $ /data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234

shell@android:/ $ /data/local/tmp/busybox telnet 127.0.0.1 1234

Entering character mode

Escape character is '^]'.

shell@android:/ $ chmod 777 /cache

Unable to chmod /cache: Operation not permitted

10|shell@android:/ $ /data/local/tmp/busybox telnetd -l chmod 777 /cache

d -l chmod 777 /dev/block/mmcblk0 <

1|shell@android:/ $ cat /proc/dumchar_info

Part_Name Size StartAddr Type MapTo

preloader 0x0000000000c00000 0x0000000000000000 2 /dev/misc-sd

mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0

ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1

pmt 0x0000000000400000 0x0000000000100000 2 /dev/block/mmcblk0

pro_info 0x0000000000300000 0x0000000000500000 2 /dev/block/mmcblk0

nvram 0x0000000000500000 0x0000000000800000 2 /dev/block/mmcblk0

protect_f 0x0000000000a00000 0x0000000000d00000 2 /dev/block/mmcblk0p2

protect_s 0x0000000000a00000 0x0000000001700000 2 /dev/block/mmcblk0p3

seccfg 0x0000000000020000 0x0000000002100000 2 /dev/block/mmcblk0

uboot 0x0000000000060000 0x0000000002120000 2 /dev/block/mmcblk0

bootimg 0x0000000000600000 0x0000000002180000 2 /dev/block/mmcblk0

recovery 0x0000000000a00000 0x0000000002780000 2 /dev/block/mmcblk0

sec_ro 0x0000000000600000 0x0000000003180000 2 /dev/block/mmcblk0p4

misc 0x0000000000080000 0x0000000003780000 2 /dev/block/mmcblk0

logo 0x0000000000300000 0x0000000003800000 2 /dev/block/mmcblk0

expdb 0x0000000000a00000 0x0000000003b00000 2 /dev/block/mmcblk0

android 0x0000000040000000 0x0000000004500000 2 /dev/block/mmcblk0p5

cache 0x000000002bc00000 0x0000000044500000 2 /dev/block/mmcblk0p6

usrdata 0x0000000160220000 0x0000000070100000 2 /dev/block/mmcblk0p7

bmtpool 0x0000000001500000 0x00000000ff3f00a8 2 /dev/block/mmcblk0

Part_Name:Partition name you should open;

Size:size of partition

StartAddr:Start Address of partition;

Type:Type of partition(MTD=1,EMMC=2)

MapTo:actual device you operate

96 skip=8424 count=156928 | gzip > /cache/system.img.gz <

/system/bin/sh: can't create /cache/system.img.gz: Permission denied

/dev/block/mmcblk0: cannot open for read: Permission denied

skip=8424 count=156928 | gzip > /cache/system.img.gz <

/system/bin/sh: can't create /cache/system.img.gz: Permission denied

1|shell@android:/ $ chmod 777 /cache

Unable to chmod /cache: Operation not permitted

And I found out I can't tap on RUN button on my tablet in Network Utility

Please help, thank you.
[Miscellaneous Android Development] twu2:
How about save it to internal storage or external MicroSD storage?

change the /cache/system.img.gz to /storage/sdcard0/system.img.gz or /storage/sdcard1/system.img.gz

modify .toolkit.py

change /cache/system.img.gz to /storage/sdcard0/system.img.gz

and change /cache to /storage/sdcard0/ (don't forget the last / here.... it's a symbolic link, without / won't get the content of the directory)

I test it with my A1-810 (toolkit 0.8.1), it work perfect for me.
[Miscellaneous Android Development] 888jonathan:
I will give it a go, thanks for helping

But what about the permissions of /dev/block/mmcblk0 and /cache? What happened to them? And why couldn't I start telnet server from my tablet(As I said, I couldn't tap on "Run")?

Please reply
[Miscellaneous Android Development] twu2:
The permission denied error is from /cache, so change it to another path (can write data) will avoid this issue.

entonjackson, could you add an option to choose other storage to save system.img.gz, so we can solve this issue.
[Miscellaneous Android Development] 888jonathan:
Here's my result

root@jonathan-VirtualBox:/home/jonathan/adt-bundle-linux-x86-20131030/sdk/platform-tools# ./adb push /home/jonathan/busybox /data/local/tmp

439 KB/s (1062992 bytes in 2.363s)

root@jonathan-VirtualBox:/home/jonathan/adt-bundle-linux-x86-20131030/sdk/platform-tools# ./adb shell

shell@android:/ $ chmod 755 /data/local/tmp/busybox

shell@android:/ $ /data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234

shell@android:/ $ /data/local/tmp/busybox telnetd 127.0.0.1 1234

shell@android:/ $ dd if=/dev/block/mmcblk0 bs=4096 skip=8424 count=156928 | gz>

/dev/block/mmcblk0: cannot open for read: Permission denied

shell@android:/ $ chmod 755 /dev/block/mmcblk0

Unable to chmod /dev/block/mmcblk0: Operation not permitted

10|shell@android:/ $ dd if=/dev/block/mmcblk0 bs=4096 skip=8424 count=156928 |>

/dev/block/mmcblk0: cannot open for read: Permission denied

shell@android:/ $

Please help:(
[Miscellaneous Android Development] twu2:
typo? should be tenet here, not telentd.

after this, the prompt will be system@android, system user can read from mmcblk0.

like this:

shell@android:/ $ /data/local/tmp/busybox telnet 127.0.0.1 1234

/data/local/tmp/busybox telnet 127.0.0.1 1234

Entering character mode

Escape character is '^]'.

system@android:/ $ ls -la /dev/block/mmcblk0

ls -la /dev/block/mmcblk0

brw-rw---- root system 179, 0 2013-12-10 10:06 mmcblk0

---------- Post added at 02:02 PM ---------- Previous post was at 01:55 PM ----------

you can't launch telnetd from user shell, it will still own by shell, not system. so you can't change the role to system => permission denied.

in toolkit, it launch telnetd via engineer mode:

subprocess.call(adb + 'shell input keyevent KEYCODE_HOME', shell=True)

sleep(1.5)

subprocess.call(adb + 'shell am start -n com.mediatek.engineermode/.EngineerMode com.mediatek.connectivity/.CdsInfoActivity\n', shell=True)

sleep(0.5)

for _ in range(4):

subprocess.call(adb + 'shell input keyevent KEYCODE_DPAD_DOWN', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_ENTER', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "/data/local/tmp/busybox"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_SPACE', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "telnetd"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_SPACE', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "-l"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_SPACE', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "/system/bin/sh"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_SPACE', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "-p"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input keyevent KEYCODE_SPACE', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input text "1234"', shell=True)

sleep(0.1)

subprocess.call(adb + 'shell input tap 50 200', shell=True)

sleep(0.1)

if telnetd launch from engineer mode program, it own by system:

1|system@android:/ $ ps | grep busybox

ps | grep busybox

system 5930 1 1200 212 c01134b4 000c2138 S /data/local/tmp/busybox

if telnetd launch from shell, it own by shell:

shell@android:/ $ /data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234

/data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234

shell@android:/ $ ps | grep busybox

ps | grep busybox

shell 9309 1 1196 104 c01134b4 000c2138 S /data/local/tmp/busybox
[Miscellaneous Android Development] 888jonathan:
I thought it would work, I'm a newbie of linux systems.:p Now I have a problem is that I can't tap on the button "Run", it's greyed out. If it's okay for you, can we type in chinese instead here? http://apk.tw/thread-319523-1-1.html
[Miscellaneous Android Development] 888jonathan:
I still couldn't set up telnet server from tablet, so I used android terminal emulater instead. It didn't work.

jonathan@jonathan-VirtualBox:~$ cd /home/jonathan/adt-bundle-linux-x86-20131030/sdk/platform-tools

jonathan@jonathan-VirtualBox:~/adt-bundle-linux-x86-20131030/sdk/platform-tools$ ./adb shell

shell@android:/ $ /data/local/tmp/busybox telnet 127.0.0.1 1234

Entering character mode

Escape character is "^]".

096 skip=8424 count=156928 | gzip > /cache/system.img.gz <

/system/bin/sh: can"t create /cache/system.img.gz: Permission denied

/dev/block/mmcblk0: cannot open for read: Permission denied

gzip > /storage/sdcard0/system.img.gz <

/dev/block/mmcblk0: cannot open for read: Permission denied

u0_a135@android:/ $ ps | grep busybox

u0_a135 6084 1 1200 212 c0114b74 000c2138 S /data/local/tmp/busybox

shell 6119 6103 1196 192 ffffffff 00000000 S /data/local/tmp/busybox

u0_a135@android:/ $ chmod 777 /cache

Unable to chmod /cache: Operation not permitted

10|u0_a135@android:/ $ chmod 777 /dev/block/mmcblk0

Unable to chmod /dev/block/mmcblk0: Operation not permitted

10|u0_a135@android:/ $ su

/system/bin/sh: su: not found

127|u0_a135@android:/ $

Could anyone tell me why couldn't I tap on the "Run" button? I've already tried to restart my tablet. Please, someone help me!!:silly:
[Miscellaneous Android Development] entonjackson:
launch telnetd from engineering mode,

NOT

Terminal Emulator!!

launch telnet from adb
[Miscellaneous Android Development] 888jonathan:
I know, but I can't tap on the run button.:(
[Miscellaneous Android Development] entonjackson:
this is not normal behaviour... the same after reboot?
[Miscellaneous Android Development] 888jonathan:
I believe so, I tried to start telnet server with your toolkit first. It didn't work, so I did the same procedure manually from tablet but still no results.:(
[Miscellaneous Android Development] entonjackson:
don't believe. try it.

do a reboot. go to engineer mode. type in the command and look if RUN button is clickable or not.
[Miscellaneous Android Development] twu2:
new model? new firmware?

how about other command will enable the 'Run' button?

maybe acer (or MTK) fix this 'hole' for engineer mode....
[Miscellaneous Android Development] 888jonathan:
Nothing worked. Just like twu2 said, I did think of the possibility that Acer locked it up after firmware update. My current firmware number is Acer_AV052_A1-811_1.092.00_TWN_GEN1. Just upgraded my tablet about a week ago.

Please warn other users not updating firmware before we know the truth...

Edit: It's "RV08RC06" instead of "1.092.00"

---------- Post added at 05:36 PM ---------- Previous post was at 05:33 PM ----------

Old model but latest firmware, all of the commands are not working. If they fix the exploit, hope someone will find a new one. ;)
[Miscellaneous Android Development] entonjackson:
this is not the firmware version.

firmware version must have something like RV02RC22_TWN_GEN1

I will put a warning on the OP for users to not upgrade to this version

I think Acer is not happy about getting so much bricked devices because of failed root process... :angel:
[Miscellaneous Android Development] 888jonathan:
Sorry, my mistake.:silly: It's "RV08RC06" instead of "1.092.00"

I think Acer is not happy about getting so much bricked devices because of failed root process... :angel:<=I sent back my device twice because of root failures and told them it was their upgrading processes problems, haha. I still got it fixed for free. I'm so evil.
[Miscellaneous Android Development] entonjackson:
Maybe you could use some 3rd party Engineer Mode apk. because this is MTK related. Every device, based on MTK chip has Engineer Mode.
[Miscellaneous Android Development] 888jonathan:
Hi Entonjackson,

Do you think it's possible to flash su binary with update.zip in recovery mode? What kind of privileges do I have recovery mode?

Please reply, thank you:laugh:
[Miscellaneous Android Development] entonjackson:
I don't know about this. Sorry.
[Miscellaneous Android Development] 888jonathan:
It's fine, thanks a lot.:D
[Miscellaneous Android Development] fREAST:
By request i modified the new Xposed Installer (2.4.1) to work on the A1-810.

You can get it here.

I have not tested it, but it should work as i saw no other differences from the v2.3 files that i modified last time (and that worked).
[Miscellaneous Android Development] aldolo:
could you please start a new thread about xposed?
[Miscellaneous Android Development] muvensa:
Hi [MENTION=3392632]entonjackson[/MENTION] I have acer iconia a1-810. My firmware version is RV21RC02_WW_GEN1. I have rooted my device about 5months ago. And i want to update my device. But there isnt stock image for my firmware version. Could you supply it, or there is a option in toolkit: "Pull system.img.gz". Is it a solution for my problem?
[Miscellaneous Android Development] entonjackson:
No i cannot supply, because I don't own an A1-810.
[Miscellaneous Android Development] fREAST:
[MENTION=3392632]entonjackson[/MENTION] is it possible for you to add an option to say only apply a stock image? Or does this work with the option Root? Like if i use a stock system image and then select root it will only write that image and not do anything else concering root?

Thanks for your amazing work on this toolkit!
[Miscellaneous Android Development] entonjackson:
Bingo! :cowboy:
[Miscellaneous Android Development] muvensa:
[MENTION=3392632]entonjackson[/MENTION] i cannot update my rooted a1-810 with voodo root keeper. But the firmware version of update is existing here as update.zip. if i install it in recovery mode wiill my device be updated?
[Miscellaneous Android Development] fREAST:
Hello again [MENTION=3392632]entonjackson[/MENTION].

Read through this convo, and Kieran Foot said something about using this command to rewrite the system image/partition.

dd if=system.img of=/dev/block/mmcblk0 bs=2048 skip=???﻿

And i was wondering if you know anything about it?

I got ADB access using Maui META 3G to boot into Meta mode.

Also here is my dumchar_info if that helps.

Part_Name	Size	StartAddr	Type	MapTo
preloader 0x0000000000c00000 0x0000000000000000 2 /dev/misc-sd
mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0
ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1
pmt 0x0000000000400000 0x0000000000100000 2 /dev/block/mmcblk0
pro_info 0x0000000000300000 0x0000000000500000 2 /dev/block/mmcblk0
nvram 0x0000000000500000 0x0000000000800000 2 /dev/block/mmcblk0
protect_f 0x0000000000a00000 0x0000000000d00000 2 /dev/block/mmcblk0p2
protect_s 0x0000000000a00000 0x0000000001700000 2 /dev/block/mmcblk0p3
seccfg 0x0000000000020000 0x0000000002100000 2 /dev/block/mmcblk0
uboot 0x0000000000060000 0x0000000002120000 2 /dev/block/mmcblk0
bootimg 0x0000000000600000 0x0000000002180000 2 /dev/block/mmcblk0
recovery 0x0000000000a00000 0x0000000002780000 2 /dev/block/mmcblk0
sec_ro 0x0000000000600000 0x0000000003180000 2 /dev/block/mmcblk0p4
misc 0x0000000000080000 0x0000000003780000 2 /dev/block/mmcblk0
logo 0x0000000000300000 0x0000000003800000 2 /dev/block/mmcblk0
expdb 0x0000000000a00000 0x0000000003b00000 2 /dev/block/mmcblk0
android 0x0000000040000000 0x0000000004500000 2 /dev/block/mmcblk0p5
cache 0x000000002bc00000 0x0000000044500000 2 /dev/block/mmcblk0p6
usrdata 0x0000000160220000 0x0000000070100000 2 /dev/block/mmcblk0p7
bmtpool 0x0000000001500000 0x00000000ff3f00a8 2 /dev/block/mmcblk0
Part_Name:Partition name you should open;
Size:size of partition
StartAddr:Start Address of partition;
Type:Type of partition(MTD=1,EMMC=2)
MapTo:actual device you operate
[Miscellaneous Android Development] entonjackson:
Of course this command tells me something... this is the way the tabs are rooted.

What do you actually want to do?
[Miscellaneous Android Development] jchuillier:
Hello all,

I have a prolem with a friend's 810.

He wanted to root, I told him to follow the instructions there but he did not exactly....and now it bootloops but we can still access the recovery menu with vol up+start

Apparently he has followed the guide all the way, got the 0.81 toolbox, the drivers and the RV26RC06_PA_CUS1 image from the OP.

But after step has completed he did not plug it out but turn it off instead so step 4 is made but not step 5.

Is there a way to get out of this ?

I use mostly Windows but I can boot on a linux live USB if it helps.

Thanks for the help
[Miscellaneous Android Development] 888jonathan:
There's no update.zip for RV26RC06_PA_CUS1 A1-810 now, please send it back to Acer and I believe you can get it back free.
[Miscellaneous Android Development] jchuillier:
Hello, could you be more specific ?

He got the rv26 whatever from the OP in this thread.

What if i restart the flash procedure, he's bringing me the unit later to day and I just want to be prepared :)

It's confirmed that he can go to the recovery menu, factory wipe did nothing, select update from sdcard gives nothing since it's empty (the sd card slot).astboot gives nothing, it just stays there.

Can we have adb access from the recovery menu ?

Thanks
[Miscellaneous Android Development] entonjackson:
Why should he be more precise? He knows what he's talking about. There's no way to rescue the tab.
[Miscellaneous Android Development] treetop777:
When the tab is in bootloop, the toolkit can no longer communicate with it so trying to flash again won't work. For the hell of it, you can try renaming the file to update. zip and see what you get (which will most likely be nothing). I have been following this for a while and i can tell you, nobody have been able to recover the tab via ADB or fastboot. By all means see what you can do but as far as eveybody here it concerned, the tab is beyond repair (by us users).

So as previously suggested, send it to Acer; but hurry, cause at the rate they are getting them back, they may start to charge a fee! :laugh:
[Miscellaneous Android Development] entonjackson:
/proc/dumchar_info please
[Miscellaneous Android Development] fREAST:
I want to write a system.img.gz using ADB.

I looked into the python file from the toolkit and found the values to use for the dd command.

Will this work for writing a system.img.gz on my A1-810?

/data/local/tmp/busybox zcat system.img.gz | dd of=/dev/block/mmcblk0 bs=4096 seek=17664 count=262144

Edit: Looking through the toolkit.py again i remembered that the only way to get root/system priviliges is to start the telnet daemon within the mediatek engineermode app, this is right?
[Miscellaneous Android Development] entonjackson:
1. the command should be fine.

2. yes, telnet server on tab side is needed. you can start it over engineer mode
[Miscellaneous Android Development] jchuillier:
Hello,

Got a new one from the shop, they exchanged it as "DOA"....I love french consumer support :)

So now to prevent any other problem WHICH FILE TO I SEND ? From the list in the OP ?

Thanks for the help
[Miscellaneous Android Development] aldolo:
I'm writing to YOU, anonymous Acer employee. Here are my 10 euro for a full system update zip!!! Others will follow for sure!!!
[Miscellaneous Android Development] treetop777:
LOL I second that..!:laugh:

---------- Post added at 11:53 PM ---------- Previous post was at 11:46 PM ----------

Perform all updates then go to the tablet's settings > about. Look for the software version and download that EXACT one for the OP. I would suggest you try to root from scratch first because that way is most safe.

EDIT: If you have a A1-811, heed the warning in the OP.
[Miscellaneous Android Development] 888jonathan:
It's not possible to run the toolkit in recovery mode. In that case, the only way to fix the tablet is to use update.zip in recovery mode. Don't ask me how to make one, you won't be able to use it even if you make one by yourself. You can't have adb access on this tablet in recovery mode. Please send it back to Acer, it's impossible to fix it by yourself.:fingers-crossed:
[Miscellaneous Android Development] fREAST:
This is not entierly true, you can get adb access by using a program called Maui META 3G from MediaTek (Google it) and start the tab in META mode, then you have adb access.

However, you cant really do much since the only way to get system/root priviliges is to go trough the Engineer app (this is the "exploit" that is used to root the device) while the tab is booted up, so there's that.
[Miscellaneous Android Development] behtash:
hi

dear i cant find dumchar_info in proc folder but i have last log recovery for find all partion:

0 /tmp ramdisk (null) (null) 0 size_hint:0
1 /reserved hidden /dev/block/mmcblk0_none none 0 size_hint:164
2 /panic raw /dev/block/mmcblk0p1 none 0 size_hint:8
3 /factory ext4 /dev/block/mmcblk0p2 none 0 size_hint:32
4 /media vfat /dev/block/mmcblk0p3 none 0 size_hint:128
5 /cache ext4 /dev/block/mmcblk0p5 none 0 size_hint:896
6 /logs ext4 /dev/block/mmcblk0p6 none 0 size_hint:256
7 /system ext4 /dev/block/mmcblk0p7 none 0 size_hint:1344
8 /data ext4 /dev/block/mmcblk0p8 none -16384 size_hint:0
9 /mnt/sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0 size_hint:-1

have any way for root ASUS Fonepad 7 (ME372CG)???
[Miscellaneous Android Development] entonjackson:
i need 2 informations about /system partition.

this is seek and count values.
[Miscellaneous Android Development] NightFire123:
hi

I want to know how to unroot and get back to the stock rom?

I just unrooted my A3-A10 and just all the standard apps where installed.

Then I tried to reroot but I got an error within the toolkit.
[Miscellaneous Android Development] fredemi58:
acer a1 810

hello

i'm french and haven't a really good english speak.

i have a problem to root my tab a1 810, i do exactly the process to root and to the end i have already the message that the root is good but whe, i reboot my tab and after installing supersu, this application tell me that i don't root.

how can i resolve this problem

thank you to help me
[Miscellaneous Android Development] aldolo:
are you sure SU is not already there? try with rootcheck or something similar.
[Miscellaneous Android Development] fredemi58:
acer a1 810

Hi

Yes superuser tell me that there is no su binaries installed and rootchecker tell me that the tab isn't root
[Miscellaneous Android Development] Drakosha:
Hello.

Please, anyone with B1-710-L401 (8gb WiFi), can you post your system.img.gz ? I tried to root with the image posted in the first post, ended with bootloop, spent whole day fighting it, and now (thanks to the wonderful XDA) I can finally start the tablet in META mode, in which I have root ADB access with rw mounted filesystem, so basically I can do whatever I want - for example, issue the shell command dd if=system.img of=/dev/block/mmcblk0 bs=4096 seek=9448 count=262144 and restore system dir to its stock condition.

The only problem is that I don't have stock image :(

Please, help. Or, if anyone knows the reason of bootloop - I suspect it has to be somewhere inside build.prop - may be he would share the solution...

Thanks!

With great respect - Draco,
[Miscellaneous Android Development] entonjackson:
post /proc/dumchar_info and /system/build.prop here please.
[Miscellaneous Android Development] Drakosha:
Dumpchar

Hi.

I managed to get another the very same tablet, from which I've successfully pulled system.img.gz, now I'm trying to restore the bricked one. Here's the files you requested: in "New" folder there are files pulled from the bricked tablet (AFTER unsuccessful rooting), in "Orig" - same files from the second, 100% stock & working tablet.

P.S. For some reason the extracted system.img (1gb+) fails to be pushed in both /cache & /data/local/tmp folders. Can it be that there's simply not enough space? Tablet is completely empty. Can you please suggest the correct command line for restoring system from .gz archive directly? I have 100% working root shell, but after restore there will not be one, so I have one shot only - if tablet will not boot after restore, I won't be able to try again...