yashsingh1/xdaforums huggingface dataset:
[Galaxy Tab 3 General] social-design-concepts:
https://github.com/android-ia/platform_bootable_droidboot/blob/release/android-4.1.1_r1-ia0/aboot.c :

static void cmd_boot(char *arg, void *data, unsigned sz)
{
fastboot_fail("boot command stubbed on this platform!");
}

My tethered cwm launcher is a service swap exploit it works by locating a service that is triggered by a fastboot oem command it utilizes a function built into droidboot that allows you to use fastboot flash < path to push file on > < file name > to push files to the device simular to adb push i push three file to the device :

i think thats been removed on the production version that ships with intel tablets

droidboot is nothing more than a aosp recovery v3 based when i go on lunch ill post some links and additional info hopefully sourceforge is back up today

good read coversation between Intel and Google about fastboot / droidboot
[Galaxy Tab 3 General] :
RGBX, RGBA and RGB

r2,

what i know is

rgbx ---> blue twrp

rgba ---> not blue twrp, it looks kind of orange/brown

so i guess the x and a "flip" the colors almost like a negative

what using rgb only does, i don't know :confused:

from here http://www.overnightprints.com/difference-between-cmyk-rgb

also from here http://www.fourcc.org/rgb.php
[Galaxy Tab 3 General] r2d23cpo:
[MENTION=4821597]social-design-concepts[/MENTION]

Thanks for hang around and provide your un-valuable experience with us.

I see., I have to admit I had not started to dig on code yet. But I definitely see "cmd_boot" has been strip-off code. Just a print label. So as it is you are right. Clearly other devices have "cmd_boot" operational. I could easily innocently assume that we can grab that code from them!. But I like to go with the flow. jijii so I can look into your " service swap exploit " to do the work in TAB3 10.1. Boy I like hacking! jijiji

Now, the problem with TAB3 10.1 right now, is that I do not even get to that part. fastboot is not answering basic commands like "fastboot devices". I need to allow fastboot to communicate to even start doing anything else.

Regards TCP. Google had place in the License Acceptance , that in KK 4.4.2 they are monitoring WIFI when device is in OFF. So I am not sure that TCP/WIFI "been removed on the production version that ships with intel tablets". I can see the manipulation on the *.rc too.

I what that TCP because I could monitor via adb WIFI/TCP while fastboot is using USB port!! Just a thought.

[MENTION=5864662]moonbutt74[/MENTION]

I did ask you only because I thought you had experience with TWRP. From your comment I guess i was right. I to do not know what they. I am happy enought with "rgbx ---> blue twrp". I do not mind on color, I just need it to function. Thanks buddy.
[Galaxy Tab 3 General] r2d23cpo:
[MENTION=4821597]social-design-concepts[/MENTION]

I do not mean to push you. I know you are a busy man. We can wait. But just to let you know we are interested in your "service swap exploit".

But when I can I am reading, and looking. Here are my findings.

A quick look reveals all this come from "(L)ittle (K)ernel based Android bootloader" at

codeaurora.org - master => h__ps://www.codeaurora.org/cgit/quic/la/kernel/lk/tree/?h=master&id=82117399ba17ea60b7f771c641ff5b1c9283bdc9

codeaurora.org - aboot.c => h__ps://www.codeaurora.org/cgit/quic/la/kernel/lk/tree/app/aboot/aboot.c?h=master&id=82117399ba17ea60b7f771c641ff5b1c9283bdc9

android.googlesource.com - master => h__ps://android.googlesource.com/kernel/lk/

android.googlesource.com - aboot.c => h__ps://android.googlesource.com/kernel/lk/+/master/app/aboot/aboot.c

So it is possible that we can substitute

static void cmd_boot(char *arg, void *data, unsigned sz)
{
fastboot_fail("boot command stubbed on this platform!");
}

and used this

void cmd_boot(const char *arg, void *data, unsigned sz)
{
unsigned kernel_actual;
unsigned ramdisk_actual;
static struct boot_img_hdr hdr;
char *ptr = ((char*) data);
if (sz < sizeof(hdr)) {
fastboot_fail("invalid bootimage header");
return;
}
memcpy(&hdr, data, sizeof(hdr));
/* ensure commandline is terminated */
hdr.cmdline[BOOT_ARGS_SIZE-1] = 0;
kernel_actual = ROUND_TO_PAGE(hdr.kernel_size);
ramdisk_actual = ROUND_TO_PAGE(hdr.ramdisk_size);
if (2048 + kernel_actual + ramdisk_actual < sz) {
fastboot_fail("incomplete bootimage");
return;
}
memmove((void*) KERNEL_ADDR, ptr + 2048, hdr.kernel_size);
memmove((void*) RAMDISK_ADDR, ptr + 2048 + kernel_actual, hdr.ramdisk_size);
fastboot_okay("");
udc_stop();
boot_linux((void*) KERNEL_ADDR, (void*) TAGS_ADDR,
(const char*) hdr.cmdline, LINUX_MACHTYPE,
(void*) RAMDISK_ADDR, hdr.ramdisk_size);
}

Remember all this is a guess. I have not even got TAB3 10.1 to respond to fastboot request.

Here a very nice introduction at whats on aboot/fastboot for the arm.

Reverse Engineering Android's Aboot=>h__p://www.newandroidbook.com/Articles/aboot.html?s
[Galaxy Tab 3 General] r2d23cpo:
Todays update.

I decided to search Dell Venue forum to dig for this so call "service swap exploit". I had hopes to find something new that could allow me to leave the hole I have cave myself in. jiji Well I still have hopes social-design-concepts experience can help us.

The sad part is that he is just talking about the common swap of recovery. It is like the swap of DEBUGGERD to mount and external drive CIFS and fool selinux. Well that is a perfect tool for Dell Venue secure recovery image. But in our case we do not need to do any of that we can manipulate boot and recovery at our will. As I said I still have hope that social-design-concepts have a magic wand hidden.

The problem I am having I think it is just the common Known Issue that Samsung had eliminated fastboot under kernel space. It was said that droidboot did implemented fastboot into recovery user space. I had hopes that it will work then. But it seems I am failing.

My best guess is that some how Samsung is filtering fastboot commands in the usb communication under Kernel and not allowing it to reach droidboot at recovery space. The other could be that in fact selinux is playing me a joke!. So for that I will use recovery exploit to fool selinux. But I have not many hope in that this will work. But since we are talking about "service swap exploit", it will be 57up1d not to try it..

Now the source of droidboot I found is a simplified version of the one used by [MENTION=4821597]social-design-concepts[/MENTION]. It has no menus and do not report failures as social-design-concepts one do. I have hope he can share his source code, to simplify our job. report when I can. Again if anyone is interested in the images I have build, or is curious how droiboot looks like under Tab3 I am willing to post. I do not do it because it take time and it seems no buddy has shown interest.
[Galaxy Tab 3 General] social-design-concepts:
can i see your ramdisk and its not my droidboot its intel / dells , i think the issue might have to do with bootmode and ro.hardware i have an alternative version of my service swap exploit that i use for loading other devices droidboot sessions. i hope to be more active after valentines day , hopfully this evening i can post some links for you to look at , have you looked into kexec booting anymore?
[Galaxy Tab 3 General] r2d23cpo:
Sure you can. But witch one of the 1 thouthands and one I have mod and tested!! jijijiji. I guess I will submit the Stock, TWRP- ilike to used this as a template becouse it allowme to boot in to recovery just by tiping recovery. And I will submit also a test with droidboot. I will do that in a few minutes, I will edit this sesion.

Can you tell me where in Dells site I can download droidboot with the menus?

I do like the menu, ie will b easily to modify and add to boot a TWRP recovery and a nebu item for linux. And for unknow reasons Dells droidboot complains at adb proving security keys for comunication. Eventhoght is an error, it shows that it infact is recieving commands from usb!! The one that I compiled show no error. I have no time jet to start moddifying to look for usb imputs.

Nop! I found droidboot menus and function a lot interesant. Still I was having trouble to manipulate kexec, switch_root and know I learn that new is pivot_root! I have not tested the last one. I have a filling selinux may be fooling so I decided to take a breake. I know I my self hijack this thread. Well not really all this boot manipulation will lets us find the best way to implement Native Linux.

Sorry for the typing errors I also am having issues with Firefox, if I let the machine rest of or go intto sleep Firefox will start up and start 15% of CPU resources!!! So I been debugging that too. Hopefuly I will add speling againg for next time. Give me an hour for the files.
[Galaxy Tab 3 General] r2d23cpo:
I am sorry had some trouble.

But here it is the following:

WARNING to the Reader.

Please note that these are just test articles.

They only been tested in P5210 wifi.

They are base on 4.2.2.

This are update.zip type of file that will install droidboot as your boot image. So you need to backup at least your boot image, so that you can reestablish it after you are done wit the test. We hope that the final product be a recovery type of image. But in order to test is better in a boot.img so that we can have TWRP to recover easily once we are done with the test. Writing boot.img can be dangerous if you do not know what you are doing. But it is harmless once you know how to deal with it.

droidboot-P5210-twrp_template+delvenue_bins_001.zip 18.7 MB

h__ps://mega.co.nz/#!TYMhUYYZ!Ks6xpmVabV93bMBdSVIN2SQ0s8PWbb58pZL-S8j1xL8

droidboot-P5210-twrp_template+droidboot_compiled_001.zip 19.0 MB

h__ps://mega.co.nz/#!uBNRiIrD!kH_FBy3cXjPtMXAU2UxsJo4a2FXSR9Tw1C-7fDp1Sqo

[MENTION=4821597]social-design-concepts[/MENTION] I know you are an expert but just to help you can look at the ramdisk by using

[DEV][TOOL] Android Image Kitchen - Unpack/Repack Kernel Ramdisk [Win/Android/Linux] => http://xdaforums.com/showthread.php?t=2073775

here is the windows link => http://xdaforums.com/attachment.php?attachmentid=2882243&d=1407086561
[Galaxy Tab 3 General] r2d23cpo:
[MENTION=5864662]moonbutt74[/MENTION]

Buddy I need you help again. Can you tell me what is the .config settings to ensure selinux is totaly disable on Kernel build? And I mean not even present.

I had build a kernel where I thought selinux was disabled. But then I made some test by stripping all selinux related files from the image and found that I lost su. I can not do "ls /sbin" or mode certain areas using adb shell!! Something like Command Not Permited.

So I guess selinux is still ON. files I strip are file_contexts, seapp_contexts & sepolicy.

The image that Dell Venu have for fastboot does not show any selinux related files. And I think is for Android 4.3!
[Galaxy Tab 3 General] :
r2,

hi, from what i can remember, change in security options, nsa selinux support = unset

and default security module to = unix discretionary access controls [UDAC]

m
[Galaxy Tab 3 General] r2d23cpo:
Thanks for the quick reply. Listen in 4.2.2 kernel there is no mention to selinux in the config!

In security module DAC is enable.

Regards missing su was in fact my mistake. I commented the part that reset adb to enable su!!

To all the readers. In the archive I posted previously I made a mistake, I also left the usb disabled!!! Oh boy. I have no time to upload the changes. It does not mater since in fact it is not answering to fastboot.

in init.rc file about line 41 there is a missing line write /sys/class/android_usb/android0/enable 1

#DB-The following 1line removed instead 8 lines added
#import /droidboot.init.${ro.hardware}.rc
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor 18D1
write /sys/class/android_usb/android0/idProduct D001
write /sys/class/android_usb/android0/functions adb
write /sys/class/android_usb/android0/iManufacturer ${ro.product.manufacturer}
write /sys/class/android_usb/android0/iProduct ${ro.product.model}
write /sys/class/android_usb/android0/iSerial ${ro.serialno}
[COLOR="Red"] write /sys/class/android_usb/android0/enable 1[/COLOR]

I mean if you want to see how it looks like, do not bather repairing the line. Again it makes no difference.

I guess the problem with fastboot is that it does not show the TAB3 as present in the USB port as a fastboot device. So I think the PC program do not send anything to tab because it first is waiting fo a valid device to show up.

Now do anyone of you know where I can get the source for the PC win7 or Linux fastboot??? I will like to look a the source to understand the mechanism..
[Galaxy Tab 3 General] :
r2,

this looks interesting as to fastboot

https://github.com/nekromant/fastbootd

from the readme

fastbootd - A heavily stripped down fastboot server

This is a hacky stripped down fastboot server that sits there and pushes kernel, optional initrd and/or secondstage to the board when it detects one. It requires no android buildsystem whatsoever, no dependencies can be easily cross-compiled. Simple as that, no other modes.

The story.

The story behind is: I needed something to push linux kernel over fastboot usb to odroid-x2 boards whenever they rebooted. Since odroid has ****ty network and cdc_ether looked better, I needed a tftp replacement. Fastboot was the only option here. And I needed the solution to work on an OpenWRT box.

Unfortunately android's fastboot utility is a huge pile of smoking crap that can't be built outside anroid buidsystem. Moreover, original fastboot has a whole load of weird dependencies and strange modes.

Srsly, people at google, if you're reading this - google the words "KISS" and "unix-way".

To make things even worse, they tend to malloc memory and NOT free it, since it's not designed to run as a daemon. I wasted a few hours to clean it up a little. That resulted in dropping most of weird modes, leaving only the basics I needed. I may not have cleaned all the memory leaks, so fastbootd just execl's itself after each run.
[Galaxy Tab 3 General] r2d23cpo:
That looks nice. I hope is what I need. Yes I had downloaded a Debian source it it just as the guy say all sort of wird checks. For example look at this

int match_fastboot_with_serial(usb_ifc_info *info, const char *local_serial)
{
if(!(vendor_id && (info->dev_vendor == vendor_id)) &&
(info->dev_vendor != 0x18d1) && // Google
(info->dev_vendor != 0x8087) && // Intel
(info->dev_vendor != 0x0451) &&
(info->dev_vendor != 0x0502) &&
(info->dev_vendor != 0x0fce) && // Sony Ericsson
(info->dev_vendor != 0x05c6) && // Qualcomm
(info->dev_vendor != 0x22b8) && // Motorola
(info->dev_vendor != 0x0955) && // Nvidia
(info->dev_vendor != 0x413c) && // DELL
(info->dev_vendor != 0x2314) && // INQ Mobile
(info->dev_vendor != 0x0b05) && // Asus
(info->dev_vendor != 0x0bb4)) // HTC
return -1;
if(info->ifc_class != 0xff) return -1;
if(info->ifc_subclass != 0x42) return -1;
if(info->ifc_protocol != 0x03) return -1;
// require matching serial number or device path if requested
// at the command line with the -s option.
if (local_serial && (strcmp(local_serial, info->serial_number) != 0 &&
strcmp(local_serial, info->device_path) != 0)) return -1;
return 0;
}

I can see how it drops connections that do not match certain profiles!. I was in the search for a valid serial number for a Google device.

Any way I will look at this. Thanks buddy, you are an Angel opss the Angel is the other guy jijiji

Odroids boards we again loping in mini PC/Andoid systems

[IMG="Odroid"]http://com.odroid.com/sigong/_Files/2012/201211/images/201211151702013304.jpg[/IMG]
[Galaxy Tab 3 General] r2d23cpo:
Report.

I study moonbutt74 susgetsed fastbootd sources and compare it to the original. But it was strip of most of the commands. It does not even do fastboot devices!! And was modified to implement flash types that we do not have on our device. Still it could have some value since it compiles just with "make" command.

As I said my test template was moonbutt74 TWRP. I just found that is base on KK 4.4.2. No wonders the image refuses to allow me to delete some files.

So as I said I had compile like a year ago CM10.1 kernel, recovery and boot images. I decided to used that then as my template and add then droidboot. Still no communication recognized by fastboot.

Now today I study fastboot and found that it filters and reject my manufactures , product and some variables that I do not quite understand. I think that one of those is the one that may be rejecting usb communication by fastboot. Well I am assuming that because I can see result in dmesg and lsusb. There is alway the chance that TAB do not respond to a special poll from fastboot. I am hoping that is not the case. I know I need to monitor/snif the usb line. The problem is that I do not own any device that I can use as a reference that in fact do fastboot!!

Any way just in case I did changed some of the values so that TAB responded with Google Nexus S Fastboot response. And here is the testimony, Still no communication.

lsusb

Bus 002 Device 031: ID 18d1:4e20 [COLOR="Blue"]Google Inc. Nexus S (fastboot)[/COLOR]

dmesg while booting in my new boot.img. First CLOVERVIEW, THANKS Angel_666 for this wonderful discovery.

Then my new transformed TAB3 10.1 into a Google Nexus with its fake serial number.

[41555.352426] usb 2-1.1: new high-speed USB device number 30 using ehci-pci
[41555.457651] usb 2-1.1: New USB device found, idVendor=8086, idProduct=09ee
[41555.457661] usb 2-1.1: New USB device strings: Mfr=2, Product=1, SerialNumber=3
[41555.457667] usb 2-1.1: Product: [COLOR="Red"]CLOVERVIEW[/COLOR]
[41555.457672] usb 2-1.1: Manufacturer:[COLOR="Red"] INTEL[/COLOR]
[41555.457676] usb 2-1.1: SerialNumber: 770CAA0BC8E12345
[41556.690301] usb 2-1.1: USB disconnect, device number 30
[41569.940444] usb 2-1.1: new high-speed USB device number 31 using ehci-pci
[41570.035516] usb 2-1.1: New USB device found, idVendor=18d1, idProduct=4e20
[41570.035526] usb 2-1.1: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[41570.035532] usb 2-1.1: Product: [COLOR="Blue"]GT-P5210[/COLOR]
[41570.035537] usb 2-1.1: Manufacturer: [COLOR="Blue"]Google[/COLOR]
[41570.035541] usb 2-1.1: SerialNumber: [COLOR="Blue"]35337508A20300EC[/COLOR]

adb devices

$ adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
[COLOR="Blue"]35337508A20300EC[/COLOR]	offline
[Galaxy Tab 3 General] r2d23cpo:
And for those that wonder what we are talking about

If you see the errors at the bottom of the photo. It is prove that there is USB communication with droidboot, But that is just adb poling the TAB3 for the encryption keys. No it is not fast boot.
[Galaxy Tab 3 General] r2d23cpo:
I decided to try out my sugestion and I got SOME WHAT relative good result!

$ ./fastboot devices
no permissions	fastboot
[COLOR="Blue"]35337508A2012345	fastboot
35337508A2012345	fastboot[/COLOR]
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
no permissions	fastboot
$

So it is showing 35337508A2012345	fastboot

We may have to study what we are commenting to only do the necesary. And hopefully that will eliminate some of those NONE valid devices.

In fact my 35337508A2012345 shows twice because I had set usb config as mtp,adb. So it is showing once for mtp and another for adb.
[Galaxy Tab 3 General] r2d23cpo:
Also as I said I do not own a device capable of fastboot. If any one can snif the port and post the data will help a lot.

d

Well what I wanted to say is that it may be possible that Samsung will BLOCK all fastboot communication. If that the case the we will be force to add adb applets. Yes I know that adb cmds are arriving at the TAB. So by moding bothe the sending and the receiver we can add what we need to adb, clearly we will rename it fastboot to fake the situation. jijiji
[Galaxy Tab 3 General] r2d23cpo:
Todays status.

I continue study fastboot and decided to change my manipulation. Instead of removing all safeguards, I add an exeption to vendor/product. Now it behave nicely.

$ ./fastboot devices
35337508A2012345	fastboot

and when I do

$ ./fastboot reboot
rebooting...

finished. total time: 0.000s

But nothing in fact happens on the TAB!!!!

I study a little more and had verify that in fact it select the correct device

lsusb
Bus [COLOR="Blue"]003[/COLOR] Device [COLOR="Red"]020[/COLOR]: ID 18d1:4e20 Google Inc. Nexus S (fastboot)

I added a orint lie on selected usb and it shows

usb =/dev/bus/usb/[COLOR="Blue"]003[/COLOR]/[COLOR="Red"]020[/COLOR]

I even try to sniff usb com but that is where I do not show to much com. But again since I do not have a good reference!! Not to much to do.

I am attaching a file for Linux called usbtest. I am hopping somebody with a device capable of doing fastboot can run it to see what a good device shows.

This is what my current setup shows whwn I run it

$ ./usbtest list
dev: csp=09/00/03 v=1d6b p=0003 ifc: csp=09/00/00
dev: csp=[COLOR="Blue"]00/00/00[/COLOR] v=[COLOR="Red"]18d1[/COLOR] p=[COLOR="Red"]4e20[/COLOR] ifc: csp=09/04/00 in
dev: csp=09/00/01 v=1d6b p=0002 ifc: csp=09/00/00
dev: csp=09/00/01 v=05e3 p=0606 ifc: csp=09/00/00
dev: csp=09/00/01 v=8087 p=0024 ifc: csp=09/00/00
dev: csp=09/00/00 v=1d6b p=0002 ifc: csp=09/00/00
dev: csp=ff/11/ff v=138a p=0018 ifc: csp=ff/00/00 in out
dev: csp=09/00/01 v=8087 p=0024 ifc: csp=09/00/00
dev: csp=09/00/00 v=1d6b p=0002 ifc: csp=09/00/00

This is what I think is the problem in Samsung

dev: csp=00/00/00 see all the 00's. Also si how only shoe "in". I have a feeling it should be "in out"
[Galaxy Tab 3 General] r2d23cpo:
LALALALA LALALALA

YA tengo fastboot trabajando en TAB3 10.1.

[MENTION=5864662]moonbutt74[/MENTION], [MENTION=1649190]Angel_666[/MENTION], [MENTION=4821597]social-design-concepts[/MENTION] & [MENTION=4365577]toneay[/MENTION]

Yes, after a week of studding the tedious code, and without knowing how it should really work, I go it. I knew something was wrong and I was force to compute manually to figure out why was the code that test USB driver failing. I end founding that Samsung put 5 extra bytes in the middle of the USB driver making it to failed. After catching the obstruction I added code to skip those 5 bytes and walaaa. Fastboot doing reboot commands. I have not test to program an image jet. Nor booting from an external image witch [MENTION=4821597]social-design-concepts[/MENTION]. said it should not work because was deleted. I guess that is next adding the missing code to see if booting revive.

So I general I will need to start on an original source and add an option to use -i <vendor id> + -p <product> + lets say -f <fail> so that if selected and failed to read length and skip length bytes, and retry driver, in that way no mater where or how many annoying bytes are place it can retry one more time. In this way It has the possibility to similar scenarios in other Samsung devices.

Well in fact I added some extra code in the TAB3 kernel to try to force the missing part of the driver to show. I guess I was wrong, it was there all the time just shifted by 5 bytes. But Still you know how is the code, one change and nothing work! jijiji.

Now we are close to have what the other Intell devices have an Easy Unbricable Solution. Angel_666 discovery of the Covertrail CPU to recover bootloaders + Easay ADB to upload images.

I need now the menu Droidboot Source Code to add the function to start TWRP+Linux. In this way Droidboot can share same recovery image. I see you guys later I should sleep I was awake all night.