yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Androguide.fr:
You should be able to adb pull the log file from download mode before flashing stock with ODIN, but yeah that was just a hopeless attempt to find which particular files causes the device to hang.

The symlinks seem correct, but the problem is that there is no way to mount the symlinked partition other than with a custom kernel's initramfs as far as I know, (by editing /proc/mounts).

I was actually more thinking of something like dumping your current system partition to an image using dd and mount it, then installing the Rom onto this image, unmounting it and finally doing a raw write of the image to the /system partition.

I figure that if this works for flashing kernels with Flash Gordon, it might work for the system partition too.

But now I'm thinking if you guys have ODIN working, the best way is probably to just create an ODIN-compatible system.img of the Rom you want to flash.

Can one of you please post your /system/bin/make_ext4fs binary?
[Android Software/Hacking General [Developers Only]] thatbigmoose:
What do you mean about mounting the symlinked partition? We'd copy the actual /system/ partition to the symlinked one's location, then create the symlink. Maybe I'm not understanding but I thought that a symlink was pretty much like "look over here for that file.." which was done successfully on the EVO 4G with the /system/app/ folder because the system partition wasn't large enough for newer ROMs. If I'm wrong could you please go into more detail as to why? I'm genuinely curious.

Additionally, to flash a system.IMG with Odin it would have to be signed. Odin pushes the file to the device and then the boot loader returns whether or not that file is legit. If not, it's never even touched.

The idea of mounting a new /system/ image while the current one is in use sounds like a great idea though. Don't see why that wouldn't work :D would you like me to upload a dd of my /system?

Edit: How exactly do I use ADB in stock recovery? The closest thing I can see is "Apply update with ADB" and my phone will not connect with my computer despite the fact that my phone works great connected to my PC when the actual system is running.

Edit edit:
C:\Users\Moose\Desktop>adb devices
List of devices attached
d28fd891 sideload

C:\Users\Moose\Desktop>adb pull /sdcard/test.txt
error: closed

So I'm guessing the Android Debug Bridge won't be very useful for us to you know.. debug..
[Android Software/Hacking General [Developers Only]] echonc:
Here ya go this is from MF3
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Well a symlink is basically just a shortcut, for example on Ubuntu if you right-click a file to make a shortcut it will create a symlink to that file.

But the thing is, you can't create a symlink for something that already exists.

I mean for example, once you got the rom extracted on the sdcard, you cannot symlink /sdcard/bin/busybox to /system/bin/busybox because /system/bin/busybox already exists, so it's the same problem of having to replace the files on /system one way or another.

That adb error seems to be some evil Sammy work again... Can you adb shell?

And yeah, a dd would be nice, so we can know how big is the /system partition on the S4 Active and try to make an ODIN image with make_ext4fs
[Android Software/Hacking General [Developers Only]] thatbigmoose:
System.img.ext4 extraced directly from the MF1 Odin oneclick is 2,244,889,128 bytes

Edit: But I really am 99% sure that whatever file you're trying to flash needs to be signed - I dumped my own cache.img.ext4 from my device, threw it into a tarball and it failed to flash(auth fail)

But making an odin tarball out of just the cache.img.ext4 from the Odin oneclick works fine. Looks like anything modified won't flash. I chose to just test with cache because it'd cause the least amount of headache if I borked that

Edit: God damnit lol I flashed just a new cache image and odin must've thought it'd be a good idea to wipe my data partition
[Android Software/Hacking General [Developers Only]] thatbigmoose:
I just noticed you asked: no, you can't adb shell in recovery. I get just one instruction when I'm in this ADB mode on the device's screen and that is to push it an update file using the "adb sideload" command.

Let's just keep trying to get this figured out. Will be happy to try anything to work with you tomorrow after work(6PM est)

Also, I've been editing this post a lot as I figure things out, but before I go..

I want to dump the stock system image off of a device with 0 modifications so that it passes Odin's signature checks. Is there a way to do this? You need root to use dd and unfortunately rooting modifies some files in /system/. I'm trying to make an odin tarball of an official AT&T software update and I'm just unsure of how exactly to go about extracting the system partition for flashing via ODIN as it's formatted as ext4. If any one file is touched it won't flash. It has to be a carbon copy of the original. Any ideas?
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Damn, they really locked the hell out of that thing...

What's AdamOutler's progress with getting Heimdall to work? I can't seem to find the device-specific forum for the S4 Active.

About how to make the odin image, just pop a terminal emulator and issue:

make_ext4fs -l 2244889128 -a system /sdcard/system.img /system/

The resulting image should be flashable with Odin.

If it doesn't then maybe the image needs to be sparsed, so add the -s flag to the above make_ext4fs command
[Android Software/Hacking General [Developers Only]] joshuadjohnson22:
Thanks for your help btw.

XDA hasn't deemed us worthy of a forum yet. We are living here for now :-/
[Android Software/Hacking General [Developers Only]] Androguide.fr:
No problem. Hopefully I can help, I ain't no expert though, especially when it comes to low-level limitations such as this.

Has any of you tried flashing a custom kernel with Flash Gordon? (Well, actually, is there any custom kernel?)

Same question for CWM/TWRP.

The updater-script thatbigmoose posted yesterday installed kernel using the Flash Gordon-compatible way (write_raw_image() // dd). No guarantee that it'll work, but it could.
[Android Software/Hacking General [Developers Only]] joshuadjohnson22:
Sadly, no we have no custom kernels. Pretty much Geohot gave us root and disappeared. You are the first developer to help us out. Adam popped in once to give us a little info but that is it. We were holding hope that if the regular S4 got a bootloader exploit it would work on ours (since they are very similar phones besides the LCD and camera) and then development would take off. We have been hurting for someone with a brain like yours to at least guide us. Moose is the closest thing we have to someone who knows what he is doing.

Basically we just keep putting up bounties hoping a dev will show. We are even tempted to buy a dev an active just so he can play around with it and give us stuff ;)

For the technical stuff I will let moose respond because I don't know. I think he is working so we will hear from him a little later on.
[Android Software/Hacking General [Developers Only]] thatbigmoose:
We definitely can't use a custom kernel, no way no how. If we tried to flash a custom kernel or recovery, when we tried turning the phone on the bootloader would display a troll face and it will overwrite recovery and kernel with stock ones.

Whatever we do has to be done with the actual system running. Did you figure out if using the mount command to mount some image as system would work? If you want I can upload the system.IMG.ext4 from that Odin one click, wasn't sure if you still needed it or just wanted the size of the image.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Are you serious about the trollface? ><

Those guys really got into the Samsung vs AdamOutler/RalekDev bootloader war...

At this point, the only thing I guess would at least give us some insight is to try the kamikaze technique (http://xdaforums.com/showpost.php?p=44519609&postcount=115) and investigate the logs in order to see where the flashing fails, and possibly try again without overwriting that particular file, see if crashes at another point, and repeat the process until it flashes properly, hoping that the files which crash the system when replaced are compatible with the custom rom you're flashing.

I understand that we cannot pull the generated log from the device once it has crashed as adb pull/adb shell don't work, but I had an idea:

we can maybe redirect the stdout of the shell to /dev/log/main, effectively making it visible in the logcat you're grabbing while the script is running.

I couldn't give a go at dd-ing an image to the system partition just yet, but I'll try to find some time to try it on my s3.
[Android Software/Hacking General [Developers Only]] joshuadjohnson22:
If we find the files that make it crash would it be possible to make a Nandroid back up to restore everything (apps, data, hacks) and leave those files alone? That way we don't have to re-set up every time? That would be sweet.

I'm hoping moose can find that info, it sounds like that would be the way to go. Excited to see the possibilities, wish I could help but I would probably just slow you down.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Sure, you can use this nice script to make a nandroid backup without using recovery, but you obviously can't restore it : http://xdaforums.com/showthread.php?t=1620255

Anyway, if we manage to find our way around this, I'll put an app together to allow people to use the work-around easily without having to fiddle with terminal etc... So this backup/restore thing could be a nice feature to have too.

It's late here but I'll try to find some time tomorrow to try to dd a system.img to the partition and to see if executing a script and redirecting its stdout to /dev/log/main works

Oh, and about the make_ext4fs commad I posted, replace the 2245M with 2244889128 as the image needs to be of the exact same size for this greedy bootloader to accept it^^ (I'm editing the post, but just in case)
[Android Software/Hacking General [Developers Only]] olorolo:
Simply brilliant!

from a D3rped out m7
[Android Software/Hacking General [Developers Only]] thatbigmoose:
The kamikaze technique truthfully I don't think is feasible. There are most likely hundreds of files in use by the system at any given time and finding all of them sounds extremely time consuming. Once the device crashes, odining back, re-setting up the phone, enabling developer mode to use ADB again..

Did you try mounting an alternate system image from say /sdcard/ on your S3? How'd that work out?

Edit: Alright, make_ext4fs is hurting my brain. So I'm dumping the ext4fs off my dad's MF3 device with a different size of system.

cat proc/partitions shows his /system as being 2,457,600 blocks large. Now multiply that by the blockspacing which would be 4096, right? Which comes out to 10066329600 bytes or 9.4GB which is obviously wrong. How can I go about this? I feel like it's almost impossible to produce a system.img.ext4 that will pass Odin's ridiculous checks

Oh and yes odin images have to be sparsed
[Android Software/Hacking General [Developers Only]] joshuadjohnson22:
Is there a safe mode that you can boot into to limit the number of files running?
[Android Software/Hacking General [Developers Only]] thatbigmoose:
There actually is but AFAIK all it does is stops any user-installed apps from hooking into boot-completed or whatever it is in order for someone to find out if it's an installed app causing issues on their device. Won't help us any.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
It's not a matter of which files are running or not at all.

The script copies files one by one, if I add an echo "filename" at each line (or simply use the verbose option of cp) and we get the output it produces, we will be able to see which file caused the crash (being obviously the last outputed filename).
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Any ideas about my previous post?

All I need to do is get a proper dump of /system off an MF3 device. I can already get the modems, kernel, bootloaders etc.. Essentially at this point we're one file away from being able to get our phones onto the latest firmware up from a pre-release one. Of course, it's the one that I can't even begin to comprehend.

---------- Post added at 01:43 AM ---------- Previous post was at 01:29 AM ----------

We could probably just do that with adb push too, already outputs precisely which file it's copying.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Sure, to get the exact size of a partition in bytes, just use the fdisk applet of busybox, i.e:

su
busybox fdisk -l /dev/block/mmcblk0p9
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Yeah, but that would mean rewriting the updater-script with adb push commands instead.

the -v flag of cp outputs each file as it copies it, and I'm pretty sure we can redirect the stdout to the logcat, /dev/log/main is writable so there shouldn't be any issue getting the output.

I can't test it now, it's almost 2am here, I'll catch you guys tomorrow.
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Couldn't we just extract whatever ROM it is and then adb push system /system?
[Android Software/Hacking General [Developers Only]] Androguide.fr:
It woudn't preserve permissions afaik, and you don't want wrong permissions on libs or framework files., it would false the results of this little test.

EDIT: You could extract the rom on your pc, cd to the directory you extracted it to, open the script in a text editor and replace all occurences of cp with adb push, and add adb shell before every other command, if you wanna try it should work (but it's just as easy to replace all occurences of cp with cp -v and execute the script using ./flash_gordon.sh > /dev/log/main)
[Android Software/Hacking General [Developers Only]] thatbigmoose:
You're a lifesaver.

Disk /dev/block/mmcblk0p16: 2516 MB, 2516582400 bytes

4 heads, 16 sectors/track, 76800 cylinders

Units = cylinders of 64 * 512 = 32768 bytes

Gonna go grab my dad's phone and try to dump and flash again. Wish me luck but Odin is a hormonal ***** so I doubt it'll work

Edit: Yup, auth fail..
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Let's just cross our fingers and pray the Odin god:angel:
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Any idea how odin checks for the image signature or whatever?
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Nope, no clue. I do know that when I was dumping modem, bootloader, kernel etc.. what would happen was those files were zero-padded at the end and simply getting rid of that zero-padding made them pass Odin and flash perfectly.

I doubt the system partition is like that because it's an ext4 filesystem which would make use of all the space it had available, and we're not dumping a raw image but rather using the make_ext4fs command.

This is off-topic of what we're actually trying to do by the way, just so I'm not wasting your time. What I'm trying to do is make us be able to take an OTA update(us as in S4 Active users)

Think I'm just gonna go through the updater-script and cherry pick the files that it checks signatures on, replace those from within /system and we should be good to go. And then just flash the updated modems and whatnot with Odin.

Edit: Could flash gordon flash modems too? I'd think not because they're in use while the system is running.
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Wrote up a program that took all the needed apk's out of a system dump of a virgin device and then threw them into a folder on my desktop :D. Doubt the permissions were preserved though :/

Now I just need the modems off an MF2 device and an updater-script that will copy these files to the correct directories and fix permissions. :

I actually have some hope now. Just gotta hope these files that I'm overwriting don't crash /system

But my old question still stands. Could flash gordon flash modems? Like raw_flash?

Edit: Yeah permissions aren't preserved because I used adb pull onto a windows machine. Is there a fix permissions script flash gordon can run?
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Yeah sure you can use the script attached to this post to fix permissions afterwards. But basically if you're only adding apks, just chmod 644 them and you'll be good to go.

About the modem, it depends on how the updater-script you're passing to Flash Gordon handles it.

Basically, if the updater-script uses write_raw_image() then Flash Gordon will translate it to the corresponding dd command. If it uses binaries to package the image during the flashing, then Flash Gordon won't know what to do and will leave that line in Edify, untranslated.
[Android Software/Hacking General [Developers Only]] thatbigmoose:
I actually found a similar script. The problem is I need to fix permissions on more than just app. Namely lib, framework, bin, csc, etc..

Also discovered you can overwrite quite a few files using adb push and what will happen is if something causes a crash the device will kick back to the AT&T boot logo but adb will still be completely functional and you can push/pull and run scripts.

Anyway tomorrow I'm gonna note down the proper permissions for all the files I'm going to be pushing from MF2, and then push them with adb and use adb to set permissions.

Oh and I've made an odin package for flashing the new modems for now, works fine :D
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Nice, glad to hear there's at least a little progress :)
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Scratch that :/ stuck at bootlogo after replacing just /system/app and making 100% sure permissions were correctly set with that script from CWM/TWRP.

Looks like we still need a way to entirely overwrite /system. Must be missing some new modified files that these apps need to run.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Did you grab a logcat of the boot process hanging?
[Android Software/Hacking General [Developers Only]] thatbigmoose:
Nope, didn't even think to :(

Think it's a lost cause anyway, there will be far too many incompatibilities. The update I'm doing is from a firmware(MF1) to the latest(MF3) and I'm only actually replacing files that the updater-script checks the signatures on, but I'm not even taking into account anything that changed from MF1 -> MF2 including modifications to the kernel and modems.. Both of which changed every update. What I was trying was pretty much for ****s and gigs just to see if it would work.

I think our only hope is figuring out how to get the system into a submissive state so we can entirely overwrite it without issue. Did you try mounting a .img file as /system yet?

This may or may not be of use, but on some Sony Xperia devices devs were able to bypass the locked BL and boot into a custom recovery by(just my best guess based on reading the thread) hijacking a script that is run wayyy early in the boot sequence, in their case something to do with checking if the device is charging. They then replaced that script which was located in /system/bin with one that would load up CWM. Very crafty of those devs. Although I'm sure something like this would have already been attempted on locked Samsung devices ages ago. Here's the thread if it helps: http://xdaforums.com/showthread.php?t=1437840
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Yeah that could be nice to look into. Is there even a CWM/TWRP build for the Active though?

Do you have a /system/etc/install_recovery.sh in the stock rom?

I tried to flash a Rom with Flash Gordon, and possibly the thing that made it fail was replacing the sh binary, thus the app can't keep on with the cp command.

I guess cp copies by alphabetical order, as I saw the apps force-closing, but all went well, so /system/app has probably been correctly copied over, but then it passed-on to /system/bin and replaced sh, causing the shell session I was in to fail and the copy to stop. And chmod couldn't execute either as it's placed after the cp in the script.

In recovery, adb shell would return a permission denied, so I'm guessing that maybe setting the right permissions to the extracted rom in /sdcard/RecoveryEmulator/tmp could help even if the copying stops for another reason than replacing sh (like replacing cp^^).

I did try to dd a system.img I made from another rom, and the weirdest thing happened, after a minute of so of the command going-on, the screen directly turn black and displayed the Android emulator boot-animation, just sitting there.

I had never seen that happen in my life, I don't think I ever saw the emulator bootanimation being stored on the device anywhere either.

This needs more investigation too.

I'm thinking maybe we should move this discussion over to the S4 Active thread?
[Android Software/Hacking General [Developers Only]] joshuadjohnson22:
I did see a version of CWM for the international Active, we have locked BL so it can't be ODIN'ed.
[Android Software/Hacking General [Developers Only]] Androguide.fr:
Great News!

I have just successfully flashed CM 10.1 coming from Paranoid Android using a modified Flash Gordon'ed updater-script! (on my SGS3)

I am going to put a modified version of Flash Gordon together to automate the process, and shoot a little video to prove the concept.

So here's basically what I did:

The script mounts the content of the rom zip to /data/local/mnt

It runs a modified fix permission script on /data/local/mnt/system

It copies & overwrites /system folders one by one

It then goes on with the translated updater-script (mainly chown-ing/chmod-ing files/folders)

It fixes the permissions on the actual system partition

Reboots

Limitations

This method requires to keep /bin & /xbin from the previous rom (further investigation will help me narrow down the particular binaries), thus also keeps busybox install/symlinks

Some system apps and files might be left-over from previous install, due to the fact that we can't healthily wipe the system.

Maybe I'll find a way to make a diff of the ROM and the current /system partition in the app and make it delete files which don't exist in the ROM you're flashing.

This probably requires to wipe /data no matter what Rom you're flashing.

I'll try to get a test version up tomorrow for you to test.

Cheers :D
[Android Software/Hacking General [Developers Only]] thatbigmoose:
That's awesome man! Great work!

About the startup scripts, we don't have an install_recovery, at least not in the directory that you said. Although if we did find one early on in the boot sequence, we could probably get away with having that script scan the flash Gordon directory for any new files and then flash them, before the system actually starts up all the way. Maybe like that we can overwrite most everything except for sh.

Anyway, fantastic work. Can't wait to see that. Hopefully that'll let us flash MF3 since my only dilemma was overwriting /system.

Kind of OT: how hard do you reckon it would be to compile a version of CM that runs atop stock TW kernel?
[Android Software/Hacking General [Developers Only]] Androguide.fr:
I'm making some testing around. I've just tried doing the process backwards (flashing PA over CM10.1) and the flashing got cut because of the SELinux policies on CM, at one point when the libs are copied, busybox can't access its symlinks anymore. I'm gonna try without using busybox.

Anyway, it's still very rough and unstable, the left-over PA launcher was force-closing on me for example, I had to delete it with adb.

But hey, it's still something.

About your question, granted you have a cm build for a close-enough device in hardware, making a CM port shouldn't be too hard, it's just a matter of copy/pasting the right files between the two zips.

For a build, however, you'd need a proper device-tree and proper kernel sources, so that's another story.