[Xperia Z Original Android Development] [NUT]:
Reserved

For the ROM chefs and other devs on XDA:

I'm proud to donate the following to the dev-community on XDA, for anyone who wants to integrate it in his/her ROM or rooting tool, there is no need to ask for permissions: you can!

This hijacks the toolbox command 'ctrlaltdel' executed from init.sony-platform.rc line 13. It will take it's place in a similar way as the chargemon gets replaced to make the recoveries possible on locked bootloaders. As it is a symlink to /system/bin/toolbox there is NO need to create a copy to something else to make this work. The script that takes it's place is this:

#!/system/bin/sh

#####
#
# Completely demolish the RIC service and make sure the phone will survive a remount of /system
#
# Author: [NUT] from XDA
#

ARGS="$1 $2"

# Check busybox path and export it
if [ -x "/system/xbin/busybox" ]; then
export BUSYBOX="/system/xbin/busybox"
elif [ -x "/system/bin/busybox" ]; then
export BUSYBOX="/system/bin/busybox"
elif [ -x "/sbin/busybox" ]; then
export BUSYBOX="/sbin/busybox"
fi

# Mount rootfs rw, if it isn't already
ROOTFSMOUNTEDRO=`$BUSYBOX grep "rootfs ro,relatime" /proc/mounts | $BUSYBOX wc -l`
if [ "$ROOTFSMOUNTEDRO" = "1" ]; then
$BUSYBOX touch /tmp/remountedrootfs
$BUSYBOX mount -o remount,rw /
fi

# Edit the init.rc so the service never gets to start
$BUSYBOX sed -i '/"# Start RIC"/N;s/service ric /sbin/ric/#service ric /sbin/ric/g' /init.sony.rc
$BUSYBOX sed -i '/"#service ric /sbin/ric"/N;s/ class main/# class main/g' /init.sony.rc
$BUSYBOX sed -i '/"# class main"/N;s/ user root/# user root/g' /init.sony.rc
$BUSYBOX sed -i '/"# user root"/N;s/ group root/# group root/g' /init.sony.rc

# chmod the ric binaries so they can't start anymore, as a failsafe
if [ -x "/sbin/ric" ]; then
$BUSYBOX chmod 644 /sbin/ric
fi
if [ -x "/system/bin/ric" ]; then
$BUSYBOX chmod 644 /system/bin/ric
fi

# Make sure the RIC service gets killed if it manages to start up...
# This process will drop in the background and keeps running untill it did!
$BUSYBOX nohup /system/bin/killric.sh &

# Execute the actual command now
exec /system/bin/toolbox ctrlaltdel $ARGS

As you can see I'm spawning a process into the background to kill the RIC service. Even though I commented out the service in init.sony.rc it still manages to start up as init reads and buffers all of it's scripting before it actually starts to do anything... so the service will run regardless of the changes we make to it. This step was just for any form of runlevel change to prevent that from triggering a restart. As a secondary measure it disables the binary all the way by setting 644 permissions on it.

#!/system/bin/sh

#####
#
# Check RIC looper, it will exit as soon as it found and killed it!
#
# Author: [NUT] from XDA
#

DoesFileExist() {
if [ -f "/tmp/killedric" ]; then
return 0
else
return 1
fi
}

# As the init.rc scripts seem to be running parallel, lets kill ric if it got started.
until DoesFileExist
do

RICCHECK=`$BUSYBOX ps | $BUSYBOX grep "/sbin/ric" | $BUSYBOX wc -l`

if [ $RICCHECK -gt 1 ]; then

$BUSYBOX pkill -f /sbin/ric

fi

if [ $RICCHECK -eq 1 ]; then

$BUSYBOX touch /tmp/killedric

fi

$BUSYBOX sleep 2

done

exit 0

This does a loop every 2 seconds and tries to pkill /sbin/ric. When successful it will exit.

To double check if these 2 scripts did their job you can check /tmp for 2 empty files:

- /tmp/remountedrootfs

and

- /tmp/killedric

If they exist, checking the processlist should end up empty when trying to find killric.sh, ctrlaltdel and /sbin/ric. If so, on a locked bootloader, you can now safely remount /system and rootfs (/) and survive it :)

This is my gift to the community, enjoy a trouble free root experience with it!

Thanks go to:

[MENTION=2784807]DooMLoRD[/MENTION] for the chat about the init process

[MENTION=4293754]RoberM[/MENTION] for testing and suggestions, he found out pkill does successfully kill the ric process in .307

[MENTION=265575]fards[/MENTION] for the brainstorming in my .307 ROM thread

[MENTION=3379666]Carceri[/MENTION] for the brainstorming in my .307 ROM thread