yashsingh1/xdaforums huggingface dataset:
[Tilt, TyTN II, MDA Vario III General] zomig:
well i guess seeing as it cannot be installed on any other device apart from the Kaiser I dont see any reason not to post it up as no one apart from Kaisers owners can install it anyway.

Obviously if this causes an issue i will remove it immediately....

HERE
[Tilt, TyTN II, MDA Vario III General] sabesh:
Thx Zomig. Much appreciated!
[Tilt, TyTN II, MDA Vario III General] McHale:
Thanks! Just need to wait for the 8925 release now and see if there's anything else we're missing. :)

-Mc
[Tilt, TyTN II, MDA Vario III General] simoncells.com:
Hmmm....McHale- I doubt that AT&T will be releasing Tomtom with their units...
[Tilt, TyTN II, MDA Vario III General] McHale:
I'm sure they're not. I actually meant if they cripple the device in any way like removing the front camera. I still haven't seen an official release that says it has GPS.

-Mc
[Tilt, TyTN II, MDA Vario III General] ddevilx2:
I would have to say ATT would not release the unit with TomTom. You cannot buy separate maps from TomTom in the USA. So after your free city map you will have to purchase the entire package from TomTom for their full price.
[Tilt, TyTN II, MDA Vario III General] fsum242:
what did you rename it to? I am having the same issue - it installs fine but tomtom doesn't find any maps!

Thanks!

SDS
[Tilt, TyTN II, MDA Vario III General] kinvid:
I just installed TomTom Nav 6 with complete US/Canada 6.75. I got it to work but I'm not getting any nearby "stores" in the POI, only a list of same ones in the east coast. I'm in Los Angeles. Any help?
[Tilt, TyTN II, MDA Vario III General] gabriel31337:
I think you should not have any spaces in the folder's name, not sure.

Mine is named as:

SD:\TomTom__Western_and_Central_Europe\
[Tilt, TyTN II, MDA Vario III General] sning:
just downloaded that file and tried to install it on my phone, but its saying it needs a rom update :confused:
[Tilt, TyTN II, MDA Vario III General] TexasPenguin:
One of the reasons, not the ONLy reason, but ONE of the reasons why TomTom gives the No Maps found message when there are maps correctly installed is:

Go to Comm Manager > Blue Tooth settings > FTP tab and Uncheck "Enable Blutooth Explorer".

I have some theories why this works but nothing definitive.

I was pulling my hair out for a while before I discovered this by accident.
[Tilt, TyTN II, MDA Vario III General] ewingr:
I too get the "need rom update" error.

I did install 6.30 from the web site. I cannot find 6.32 there.

Another thing: from the CD, when I try to install the large US/Canada maps, it gets to about 96% then fails. So I've installed the various regional maps.

I'm going to go over now to the other TomTom thread here which appears to be the main TomTom thread, and see if I can get any thoguhts on knowing which maps to use when they overlap.
[Tilt, TyTN II, MDA Vario III General] sning:
did you buy 6.30 or just download it from somewhere as i cant find it anywhere :(
[Tilt, TyTN II, MDA Vario III General] zakiwashi:
try www.mininova.org or www.isohunt.com. i think you will be successful.
[Tilt, TyTN II, MDA Vario III General] stainlesspc:
My Dad and I both have a Tilt.

If we both load TomTom and get different maps can we swap them and they work ?
[Galaxy Note5 Q&A, Help & Troubleshooting] hondatech38:
does anyone know or have heard when they will bring the titanium silver note 5 to the U.S?I don't understand why Samsung would show all the colors at there release event but not make them available in the U.S.Wasn't the reason the release so early to beat the new Iphone and apple to the punch with sales.They have to be losing sales with limited color choices.I am sure the iphone 6s will be available with all there colors to buy right away.
[Galaxy S 5 Q&A, Help & Troubleshooting] Ops71:
Hello all

I am on stock rom XXU1BOH4 and since 2 days i receive with huge delay whats app messages.

Sometimes it works but sometimes it only works if i open whats app manualy.

Any ideas to solve the problem?

Thanks
[Amazon Fire Phone] veti:
since they have released this version of the fire os they have to provide the source code

see

http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic

you have just shown that the source code they releases for the kernel does not match the one used to build the kernel. This means it is a clear violation of the gpl and amazon is in breach and can be sued.

on another note.

are the drivers for the nfc and camera compiled as a module or into the kernel?
[Amazon Fire Phone] madushan1000:
They have yet to provide 4.6.3 and 4.6.4 kernel sources too.

I don't know exactly but in order for NFC and camera to work drivers are required and they are in fact compiled into the kernel.

The problem we currently have with NFC and camera is proprietary hal (hardware abstraction libraries) They are a part of Android and does not subject to GPL. Amazon changed the original android way how hal works and didn't release the sources!

by looking at the kernel drivers maybe we would be able to implement hal from scratch. But I don't see that intense dev support for fire phone. If you are up for it camera sources are at $KERNEL_DIR/kernel/qcom/3.4/drivers/media/platform/msm/camera_v2/
[Amazon Fire Phone] Moogagot:
Major MAJOR respect for all of you making the Fire Phone even better!
[Amazon Fire Phone] HerroYou:
[MENTION=5143031]madushan1000[/MENTION]

Could we do something like this to install a custom boot.img?

http://xdaforums.com/optimus-l9/general/guide-install-custom-roms-locked-t3249828
[Amazon Fire Phone] spudowiar:
I don't own this device but has anyone tried to see if kexec works?
[Amazon Fire Phone] madushan1000:
Nope, I was working on it. But then I got a job. It will be sometime before I can start working on it again.
[Amazon Fire Phone] :
Could someone please provide the config extracted from /proc/config.gz?

I can't find this on CM11 rom for some reason.
[Amazon Fire Phone] :
Building the kernel now.

Some bugs are in the code and -Wall and gcc-wrapper.py escalate the warnings.

I wonder if those errors are there on purpose XD

helloworld.ko loaded successfully :)

I was able to execute kexec without anything. Just the binary.

Will keep you posted - this hacking might take a while to figure it all out.

I already have 3.4 kernel from the amazon sources.

I have the kexec userland program.

What is left is a loadable kexec kernel module (if that is possible at all).
[Amazon Fire Phone] :
removed
[Amazon Fire Phone] madushan1000:
Where are you getting your kexec module sources from? BTW try using the original amazon kernal binary the phone is shipped with (we are sure it works). Don't use the custom kernel for the kexec tests (We don't know the custom kernel actually works)
[Amazon Fire Phone] :
Here is the thread I used as a starting point.

I will put up my "fork" on github after I get permission to do that :)

The userland part build like a charm once I took the compiler you recommended.

The kernel-module was tricky because the whole thing is modded like hell.

To be able to load I had to comment out some hard coded addresses and the calls to unresolvable symbols.
[Amazon Fire Phone] :
Okay the kernel gets loaded.

But

kexec -e shuts off the device.

strace doesn't help.

On the plus side:

Devices are shutdown

Look promising

I need a way to tail dmesg ...

Okay a lot of digging around and I found out that the reboot syscall doesn't work properly..

It doesn't look like it hits the kexec_module it looks more like it hits the actualy sys_reboot

Okay reboot syscall hits my reboot-hook.

But the softreboot doesn't work now.

Okay there is some kind of watchdog runnig which doesn't like my kexec.

I need to kill it - that should happen tomorrow.
[Amazon Fire Phone] madushan1000:
I hit the same wall when I tried to isolate the kexec code from the kernel itself to a module. I stopped working on it because I lacked the time. BTW the error you are facing now

is because memory allocator is trying to switch threads while you are in a syscall. it's because of lines like this

Try changing GFP_KERNEL to GFP_ATOMIC. Other than that, I have another suggestion. Try to get the kernel to run in a single core mode before running kexec code. This might simplify things. I don't know how to do this though.
[Amazon Fire Phone] :
The atmic error is gone now. It went away after I disabled the watchtog.

smp_disable() is what you are looking for - but this causes the system to hard_reboot ATM XD
[Amazon Fire Phone] madushan1000:
what happens if you kill every userlevel program before smp_disable()?
[Amazon Fire Phone] :
#define tomorrow

Okay .. I worked out the preemption thing.

At least it does something.

Still a black screen and the MSM_WATCHDOG is a ***** again.

It needs to be suspended .. at least that what I get from the code I read here.

If I remove the driver too early the output in /proc/kmsg stops ..

If I try to remove it too late ... well it causes a resched while atomic.
[Amazon Fire Phone] v6ser:
Have you asked help to any contributors in the amazon fire scene(Fire hdx, hd etc...)?

I'm sure that some developers would gladly give you a hand.
[Amazon Fire Phone] :
Hi v6ser,

I will open a thread in the Kindle Fire HDX forum and ask for some help.

I come to the following conclusion:

My module does definetly do something.

Jumping to 0xC0008000 should reinvoke the current kernel.

The kernel checks some stuff (I am depending on the diassembly of my self-build kernel) and disables interrupts ( that sucker :P) if something isn't right.

My module doesn't disable interrupts at all it doesn't even shutdown devices (ATM).

The moment my module is left the screen turns blank and no input in adb is possible anymore.

Either the systems faults somewhere or the kernel-code disables interrupts XD

I am currently thinking about disassembling the aboot.img and looking at how the kernel is invoked correcty.

While reading some string from it I found the following symbols XD

Unlock code is correct

Unlock code is NOT correct

There is a way to unlock the bootloader and at least the Strings are left in. Maybe the code is there too.
[Amazon Fire Phone] :
I am currently investigation how to print debugs from assembly (very interesting)
[Amazon Fire Phone] :
I will post again after I have serious progress - stay tuned!

Original work removed - total redesign in progress!
[Amazon Fire Phone] :
I worked around the preempt_disable crash again ... doing it by hand is more reliable (and more hacky)

smp_disable seems to work but all output stops and I can't keep debugging ...

A Simulator would be nice XD

And a SH-Coff disassembler too :D

Any ideas what I could use?

Or does anyone know how CM does their quick restart - it doesn't look like they actually cause the kernel to reboot.
[Amazon Fire Phone] ggow:
- Have you tried Hexrays IDA Pro?

- Soft reboot on CM restarts the Zygote process
[Amazon Fire Phone] madushan1000:
You can try radare2 (http://radare.org/r/) too. No GUI though. Only web UI/terminal UI. And it's free.
[Amazon Fire Phone] :
[MENTION=5749760]ggow[/MENTION]: Thanks for the CynanogenMod hint - No need to trace this further.

I will test both of them and see what I get.

I need a few parameters for the kernel :P

I still suspect smp_send_stop to crash the system somehow ... I can't explain it ATM but it looks crazy.

Disabling the Watchdog is a major pain - I just shutdown the device and it's silent. Kernel will remount those damn block-devices later on anyway ;)

Okay tested both - radare sure is something to keep around but doesn't support COFF at all :(

I tried several instances of binutils to build sh--coff ... they all fail at gas not supporting it :D
[Amazon Fire Phone] :
Finally found some code in the kernel that points out a major problem...

*

* This is normally called from the decompressor code. The requirements

* are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,

* r1 = machine nr, r2 = atags or dtb pointer.

..

What I am worried about is r1 - the machine number .. I can't find it anywhere

Okay I found a list ... checking against config now
[Amazon Fire Phone] madushan1000:
SH-Coff? are you trying to disassemble aboot? It's not SH-Coff, It's just a arm ELF + image header confusing your file utility. Read this http://newandroidbook.com/Articles/aboot.html
[Amazon Fire Phone] :
Yeah that's what I want to try.

After fooling around with kexec I need to find the correct arguments for the kernel registers.

A machine_number is required and currently this is 0xFFFFFFFF for some reason :P

Will see what I can do over the weekend.

I need to update the kexec version I am using .. this will be fun :D

I should have bookmarked that thread about the trouble with older versions and wrong kernel support ...

And of course .. the stuff I started from hacked around multiple things too...

No I read the dtb file and what do I find ... it's not valid ... oh yeah

On further inspection there is a little header before the realy device tree .. damn it XD need to strip that off

Got rid of that tiny header -- whatever it was ...

Now we have a kexec-2.0.11 running in userland and a more or less hacky kexec-module
[Amazon Fire Phone] madushan1000:
This is my kexec mod sources before I stopped working on it

https://github.com/madushan1000/kexec-mad

I have no idea which kexec-tools version I used because I have about 10 repos cluttering on my laptop :P (It's probably the one that uses a /dev/ driver to communicate instead of the syscall)
[Amazon Fire Phone] :
They are close to what I have.

The interrupt part is interesting.

Just one thing - Kodiac runs WATCHDOG_V2 - a totally different breed that little fellow XD

Thanks a bunch.
[Amazon Fire Phone] :
The current hang is related to disabling the non-boot CPUs. There should be a way around this :)

This a a debug-hell.

I need to shutdown all other cpus except for the boot-cpu ... that works now .. but after that there is no way to read /proc/kmesg unless it runs on the boot cpu .. which would need a reshed everytime it updates ... which is disabled by preempt disable :D

This is fun! :D
[Amazon Fire Phone] :
I am still stuck.

Disabling that watchdog is a PITA XD

And I can't confirm if the new kernel actually starts.
[Amazon Fire Phone] Angablade:
Have it print out hello world or something on boot to terminal. And just read the terminal.
[Amazon Fire Phone] :
Nice idea - but without interrupts or preemption this is nearly impossible ;)

The thing is in single thread mode and only kexec runs - not output or anything is possible anymore.
[Amazon Fire Phone] Angablade:
Mock up the kexec module to either make a sound or flash the light on the back. That way it can do it all in line.
[Amazon Fire Phone] :
The idea is great - but leaving interrupts enabled causes a system reboot.

Debugging the whole thing is a bigger task than I thought.

It will take a while to get further.

The thing I am struggenling with the most are the kernel paramters.

The registers need to be setup in a certain way.
[Amazon Fire Phone] Angablade:
Any update on the code?
[Amazon Fire Phone] :
Not really - I am still stuck at the verification of the correct content of the reboot-buffer.

I am still searching a way around the new WatchDog - this fellow barfs on everything.

I can disable the drivers and the device can't respond anymore.

I will need a lot more time to do this beside my normal job.
[Amazon Fire Phone] capt_planit:
[MENTION=5143031]madushan1000[/MENTION] Thanks for posting your source. Your module compiles and inserts without errors on my device (not a fire).

[MENTION=4204060]Okarin[/MENTION] You seem to have made some progress. I'd like to cherry-pick your code if you would upload it somewhere.
[Amazon Fire Phone] :
removeed
[Amazon Fire Phone] ggow:
Off topic but: http://bits-please.blogspot.com/2016/05/war-of-worlds-hijacking-linux-kernel.html

Sent to me via PM by [MENTION=7384095]blackroseblade[/MENTION]

Haven't had a chance to read through the details but looks of interest to us.
[Amazon Fire Phone] :
You suggest to rather hijack the whole kernel than loading ours?

Look at my code - I am currently hijacking and even injecting code into the kernel.

How else would I be able to get the kexec-syscall done?

I even went as far as hijacking some driver routines ;)

I don't see how anything else could be needed to make this successful. Maybe I didn't understand the whole thing but what I got was "we can rewrite the kernel symbol-table to overwrite any function-pointer in it with the one we like.
[Amazon Fire Phone] ggow:
Hi Okarin, your understanding of this stuff seems far greater that mine :)

That's why I posted it here. I'm playing catch-up.
[Amazon Fire Phone] :
Ah okay - sorry didn't meant to be harsh (just woke up).

What basically happens is that when doing a call in the kernel the symboltable is asked for the addr of that function.

I picked that up from the original sources in the first post of this thread.

By running as a kernel-module we have fully fledged permissions to add, remove or alter that table ;)

You article states about the same - it's not a bug it's a feature.

We can use all that to either - load the damn kernel and jump to it or be - see how many functions we can overrite with new one ... BRB

I am struggling now with loading the image again ... Invalid FDT buffer. .. is all I get... args ..

The idea instead of loading a whole new kernel is replacing every function in the symbol-table :D

I got it back to a point where it does stuff.

I am still confused over the dtb file vs the --atag version.

Both seem to do stuff :D

Currently it restarts the whole device again.

Maybe someone can take a look.

My HOWTO is pretty specific on how to do stuff to get to my point.

We need a way to stop the new Watchdog from resetting out SoC before the new kernel starts.
[Amazon Fire Phone] capt_planit:
I agree that Okarin has provided a bit more information in his github source. I have compiled his kexec-tools and modules. The kexec_load module doesn't build because of an issue here:

"firephone-kexec-master/kexec-module/sys.c: In function 'kernel_restart_prepare':...firephone-kexec-master/kexec-module/sys.c:76: error: 'enum umh_disable_depth' declared inside parameter list".

If I use the sys.c from delewer's V11 it compiles but has unresolved symbols (like his). Madushan's doesn't even have a sys.c and it builds and inserts fine. I should point out that my kmod.h is so ancient and crusty it doesn't even contain enum umh_disable_depth but I have dl'ed the latest from torvald's git and stuck that in the build folder to no effect. One of the missing symbols is a pretty big deal since I'm not sure how to provide it out of the kernel build tree (irq_to_desc). I'm still on page one for progress, with a "function not found error" when I try to load my image. There are many threads on xda about kexec. A fairly recent one featuring Tassador and Surge1224 suggests that nobody has yet suceeded in a kexec soft boot, only the hard reset option.
[Amazon Fire Phone] capt_planit:
Actually, I think, reviewing dmesg, it seems to get pretty far, considering that I have neither atag or dtb support at the moment. Here is a snip from my dmesg:

Movinand Checksum Confirmation Pass

load_kernel: loading boot image from 98304..

pit_check_signature (BOOT) valid.

No need to update kernel type.

ATAG_CORE: 5 54410001 0 0 0

ATAG_MEM: 4 54410002 20000000 40000000

ATAG_MEM: 4 54410002 1FF00000 60000000

ATAG_MEM: 4 54410002 20000000 80000000

ATAG_MEM: 4 54410002 20000000 A0000000

ATAG_SERIAL: 4 54410006 4300044d 4ad731dd

ATAG_INITRD2: 4 54420005 42000000 1108b8

ATAG_REVISION: 3 54410007 9

ATAG_CMDLINE: 81 54410009 'console=ram loglevel=4 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.debug_level=0x4f4c sec_log=0x200000@0x46000000 s3cfb.bootloaderfb=0x5ec00000 lcdtype=4358278 consoleblank=0 lpcharge=0 lpj=3981312 vmalloc=144m oops=panic pmic_info=67 cordon=cf5c65d721d68f71b433f9a5e9bc7869 connie=SM-C105A_ATT_ATT_USA_b9257beafab967a97a673d5b1c289a0e androidboot.emmc_checksum=3 androidboot.odin_download=1 androidboot.bootloader=C105AUCUAMJ2 androidboot.serialno=4300044d4ad731dd snd_soc_core.pmdown_time=1000'

ATAG_NONE: 0 0

Starting kernel at 0x40008000...

SWITCH_SEL(3)
[Amazon Fire Phone] madushan1000:
The guy who write this blog is awesome, I think the current blog series he is writing on exploiting QSEE is just might be the thing we were looking for. It's applicable for a huge range of Qualcomm android devices. I haven't got the chance to read all of them yet but we won't need a messy kexex hack if we can load the kernel directly from QSEE. (No watchdogs, no synchronization primitives, etc...)
[Amazon Fire Phone] madushan1000:
In the meantime, Don't update your phones!! :D
[Amazon Fire Phone] :
Did you compile the kernel as specified - you need to extract some information from already existing modules - like specified in my howto.

Additionally you don't need dtb support - just run kexec with --atags instead. The module should compile without errors.

The patch for the kernel needs to be applied too.

Can you show me the build log from your module build? Maybe I forgot something to write down.

Be sure to use my provided build.sh and setup your environment as neede.

The pathes for the compiler and the kernel are crucial.

For the kernel you need a module.symver in your kernel folder.

And the build.sh will finally build the module needed for kexec.

Just see if you can get to my point - I would love to join in on this again.

---------- Post added at 12:17 PM ---------- Previous post was at 12:15 PM ----------

I would say that a QSEE exploit is way more messy than kexec.

To my understanding Kexec is the way to go. The kernel supports it - with a little bit of love ;)

Privilege exploits are something I want to avoid. That's why I went down the kexec path.

---------- Post added at 12:23 PM ---------- Previous post was at 12:17 PM ----------

Haha - as If I could :D

I am stuck on my CM11 version because I don't want to mess anything up :P
[Amazon Fire Phone] madushan1000:
The problem with the kexec approach is getting the debug logs and stuff is hard and synchronization of multiple processors. With QSEE we don't have synchronization problems because it just works on a single processor.

I actually asked the author could we do this if we wanted to, It looks like it's an easy task of loading the kernel into somewhere in the userspace, go into QSEE and copy it over to the right memory address, and jumping to kernel start. The best thing about this is 95% of the exploit is already written. We just have to plug in the kernel loading part :D

Take a look at his reply (https://bits-please.blogspot.com/20...howComment=1463407994828#c7297531813692425019).

I can start working on this approach, But It'll take a little time since I'm kind of busy these days.
[Amazon Fire Phone] :
The kernel loading part is within the kexec-modules, maybe we can adapt that.

But yeah I am pretty busy too and won't get anything done until next weekend.

So the plan is : QSEE escalation - loading and hot-swapping the kernel ?

I will see what I can do next weekend.

The sources look rather wild - missing something like a Makefile there ;)

At least the documentation is great.
[Amazon Fire Phone] madushan1000:
Yeah, basically that's it. He already has some sample shellcode in there, we replace it whatever the kexec do to load the kernel there. I'll take a look too when I have some time! :)
[Amazon Fire Phone] capt_planit:
No worry Okarin. I'm sure your stuff works fine. The only part of your package I can't use is the kexec_load module. The issue with the unresolved symbols ties into the use of mmu_writeable.h which my target does not (natively) possess. That is why Madushan1000's module works for me, it utilizes an older implementation. Does anyone know how to use the kernel-dt program that we are building? I assume it is delewer's and that it (somehow) creates/modifies a dtb? Any insight with my errors? Esp. "ATAG_NONE: 0 0" that looks bad, and the one that is fatal (I think) "SWITCH_SEL(3)" what switch is this? Good luck with your new direction. I'll try to resist polluting your thread with my drivel.