yashsingh1/xdaforums huggingface dataset:
[Pixel C Android Development] ericvh:
Indeed, I tried the vanilla boot first following the instructions exactly, I just did the flash to see if that made a difference after the 'test' boot failed. It was easy enough to reflash with a recovery image. It does seem to be the case that booting with fastboot somehow messes with whatever encyrption is being used on the user data. Although perhaps the 'flashed' boot just didn't get far enough to trip over it.

---------- Post added at 06:13 AM ---------- Previous post was at 06:09 AM ----------

I have not tried fastboot flashing unlock yet, oem unlock is done however - that did force a factory reset, but from what I can tell Marshmellow always enforces an encrypted image. I got past the rounding error by appending zeros as you suggest. flashing back stock boot.img restored the device to normal use.

There appears to be a two stage boot, when I boot into the bootloader it has an option to enter fastboot, enter android recovery (which doesn't work), enter usb recovery (which doesn't work) and continue with the boot process. Neither fastboot nor ADB interact with the system when its in this state. Once I'm in fastboot mode on the tablet, I can see interact with fastboot. Its also worth noting that despite enabling developer mode, I can't see the tablet with adb when running.
[Pixel C Android Development] phhusson:
Ok, thanks. There will be many things to try :/

First, I generated an unsigned boot.img:

http://superuser.phh.me/nexus/ryu/MXB48K/boot-tmp.img

Can you test it?

Next step will be to factory reset with an unsigned recovery.img as well, then totally disable encryption in the fstab (I really hope it won't come to this...)

Further step would be to try to pack with ChromeOS tools ( https://android.googlesource.com/platform/external/vboot_reference/ )

In my understanding, "usb recovery" simply refers to the possibility to boot system from USB rather than internal storage.

When you speak of developer mode, are you speaking of standard Android developer mode? (I'm expecting to see a ChromeOS-like developer mode somewhere...)
[Pixel C Android Development] xploitnt:
I am welcome to testing. Just got my Pixel C and would love to help achieve root :) thank you for your work thus far and if needed let me know what I can do!
[Pixel C Android Development] ericvh:
Okay, will give unsigned a shot. About to jump on a plane to Europe so I may not be as responsive (and less likely to want to factory reset) for about a week.

I was speaking of android developer mode, not aware of any chromeos development mode. Depending on level of "commitment" I may consider just going for coreboot to Linux and ditching android all together. I'm assuming I can probably prototype that on my JTX1 which has a serial port and then prep images for the Chromebook -- but that would mean ditching android altogether which in some ways would be a shame. Dual boot is definitely the preference for me at the moment.
[Pixel C Android Development] phhusson:
Ok no problem.

That's unrelated, but I think I'll probably buy a Pixel C when we'll see first non-Android development (Or I might jump straight to it, I already did it for good old Toshiba AC100)

I almost expect Google to publish a ChromeOS image for Pixel C, or at least see an official Chromium OS....

Considering you definitely sound like the hacker-type. How does the keyboard feel? Do you feel you could code hours-long on it?

Also, since there is "usb recovery" mode, I think you could always dual-boot back to Android with a usb stick (ok, there is no usb type c usb stick yet, that means ugly cable ATM)

Linux4Tegra should make porting full-blown Linux very easy, including OpenGL/GLX
[Pixel C Android Development] ericvh:
boot-tmp.img has the same behavior.

My theory is fastboot is just there for reflashing via otg, not for actual booting and we'll need a chromeos wrapper + the payload burned to flash in order to get anywhere. I need to do some reading up on chromeos and coreboot and probably go thorugh and setup a chromeos enviornment.
[Pixel C Android Development] phhusson:
What has to be tested first is building from AOSP (i assume aosp tree is available for ryu?)
[Pixel C Android Development] ericvh:
Not sure. I briefly looked for the kernel source, but wasn't sure I found the right one. There's some stuff in there for Smaug, but I assume the android kernel is probably bit different (although it doesn't seem to be the same as the one on the JTX1 or the Nvidia Shield TV -- so google must be doing something a bit more aggressive than Nvidia is in their products).
[Pixel C Android Development] phhusson:
I'm still in hope to find who implements fastboot...

Can someone give me the result of:

fastboot getvar product

fastboot getvar kernel

This doesn't require oem unlock, and doesn't have any risk, so anyone with working fastboot can do that
[Pixel C Android Development] regime2008:
Just received my usb type c cable from Amazon! Adb is working fine for me, but the bootloader is acting funny for me. Working on it now, and I'll be more than happy to be a guinea pig
[Pixel C Android Development] Avalun:
I have a A Pixel C with usb c cable too, bus as I see at the moment, there is currently nothing to test?

The bootloader is already unlocked and I have to see that message 30 seconds at every boot.
[Pixel C Android Development] ericvh:
Trogdor:~ erivan01$ fastboot getvar product

product: dragon

finished. total time: 0.001s

Trogdor:~ erivan01$ fastboot getvar kernel

kernel: unknown variable

finished. total time: 0.001s
[Pixel C Android Development] phhusson:
Thanks

I finally found the fastboot implementation:

https://chromium.googlesource.com/chromiumos/platform/depthcharge/ branch factory-smaug-7265.B

I'm getting started reading the code.

Edit: For future reference, the board here is indeed smaug and not rush_ryu, cf fastboot product, it returns "dragon", while rush_ryu would return "google,ryu-revXX"

It seems like smaug is a fork of rush_ryu and rush_ryu has been abandonned (rush_ryu was K1 and smaug X1?)

Edit2: To confirm this is definitely a Chromebook. Its codename is ryu: NOT a fish (unlike all Nexuses since HTC G1), but a videogame hero (cf slide 7 of https://events.linuxfoundation.org/sites/events/files/slides/chrome.pdf )
[Pixel C Android Development] misteurz:
Hi,

Sorry for that dumb question, but can't we only flash the new supersu 2.62?

Envoyé de mon LG-H815 en utilisant Tapatalk
[Pixel C Android Development] Avalun:
Without a custom recovery, you will have bad luck getting this on your System-partition.

And for that is this thread for.

Which superuser app you flash at last, shouldn't matter.
[Pixel C Android Development] superchilpil:
You're actually right. And I assume this dev here it taking a similar approach.

The thing is you have to build the boot.img to achieve the system less root, and this current dev doesn't have the device to test so it will take a little time.
[Pixel C Android Development] superchilpil:
I got my use c cable today so later tonight and the next two days I'm free if you need anything tested.
[Pixel C Android Development] ZiggSVO:
my dumb self assumed I had a male to male type a laying around to just use with my a to c adapter...

nope sure dont lol

so cant test anything as of yet.
[Pixel C Android Development] superchilpil:
If we didn't already have enough proof that this was a Chrome OS device.

I have a feeling that until a dev can get the device in hand that we aren't going to see much development.

Looking around apparently the latest "K" build is for development. Im going to flash that to see the differences.
[Pixel C Android Development] phhusson:
Erf, I didn't expect them to implement getvar all

That's nice, thanks.

Funny, 30 seconds wait-time is usual chromebook developer mode -_-'

Hint: Press ctrl-d and see if it is faster

DO NOT PRESS SPACE (it factory resets and relocks on chromebooks)

fastboot is indeed a sort of a second stage, but as everything else:

Primary bootloader is coreboot, and then, "everything" (standard booting and fastboot) are done by depthcharge

(google chromeos depthcharge gives some insights)

I'm currently trying to implement Chrome's verified boot in the hope it will fix the problem. If it doesn't, I'll fallback to disabling encryption :(
[Pixel C Android Development] superchilpil:
Ctrl-D doesn't boot any faster.

Worth a shot though, the 30 second wait time is a pain.
[Pixel C Android Development] MrPhilo:
Is there anyway to disable encryption, or is that mostly boot/kernel based?
[Pixel C Android Development] mskip:
As with the Nexus device you need to flash a modified kernel with forceencrypt changed to encryptable in the fstab file. The device then needs wiping to force decryption of the device. I would try making one but i don't have the device and noone to test the repacked image. I don't know if there is anything different about repacking the pixel c image over other nexus images.

Mark.

Edit: I made a modified boot image if someone with an unlocked bootloader wants to test it. Don't flash it first just in case it doesn't work. Use fastboot boot boot-noforce-encrypt-mxb48j-ryu.img first to see if it boots. If it does then you can use fastboot flash boot *image* and then wipe the device. I will add this to my toolkit when I have it running.

BEWARE: If you flash the image and it does not work you will have to flash the stock rom to fix it.

test decryption boot image: http://skipsoft.net/tempuploads/boot_images/boot-noforce-encrypt-mxb48j-ryu.img
[Pixel C Android Development] superchilpil:
Is this based off the stock image or phhusson's?
[Pixel C Android Development] mskip:
Just the stock boot image with the above mod.

Mark.
[Pixel C Android Development] MrPhilo:
I will try this tomorrow when my Pixel C comes, I'm presuming the unlock method is same as my Nexus 6P
[Pixel C Android Development] mskip:
You need to enable oem unlock in developer options then boot to fastboot "adb reboot bootloader" and run "fastboot flashing unlock" to unlock the bootloader.

Mark.
[Pixel C Android Development] ]grimm[:
The result booting this image is the same as with phhusson's test image attempting to get root. The tablet gets boots until it reaches a "To start Android, enter your password" prompt and I'm unable to progress from there.
[Pixel C Android Development] mskip:
Is this on fastboot booting the image? Had you set a password at startup to decrypt the system? If the test image boots to a certain point then try fastboot flashing the image, then use fastboot format userdata to wipe the device. This should then decrypt the system and get rid of the password prompt.

You could also try using the default password for encrypted systems - default_password to see if that works on the encrypted system.

Mark.
[Pixel C Android Development] ]grimm[:
Yes, this was on fastboot booting the image. I had not enabled a password to boot, the tablet was wiped clean before booting. When I use the default password, it tells me that decryption was unsuccessful and prompts me to factory reset the device. I think this is the same experience that ericvh had with phhusson's boot images. Flashing the boot image and formatting userdata takes me to recovery when I try to reboot. I've done a flashing unlock on device as well, not that I think it's relevant to this issue.

I suspect this is a coreboot payload issue? I used have a first generation Chromebook Pixel where I was able to flash modified SeaBIOS payloads for what seemed to be a similar two-step booting process to Pixel C.
[Pixel C Android Development] streilu:
I got my Pixel and a USB Type C cable, so I'm also in with testing!

Gesendet von meinem Pixel C mit Tapatalk
[Pixel C Android Development] MrPhilo:
Just tried booting up, same result, password is wrong regardless what I type, worth a try though
[Pixel C Android Development] dkryder:
i tried this morning and i think it was the same result as your attempt.

Decryption unsuccessful

the password you entered is correct, but unfortunately your data is corrupt.

to resume using your tablet, you need to perform a facory reset...
[Pixel C Android Development] streilu:
Maybe this is caused by dm-verity? Is it running in our C's?

Gesendet von meinem Pixel C mit Tapatalk
[Pixel C Android Development] superchilpil:
im under the assumption that dm-verity only performs checks when the bootloader is locked

Right about now id jump at anything that would give us root, im not to concerned about encryption. If I want to use the device how id planned I need to root to mount my eternal HDD's
[Pixel C Android Development] phhusson:
You can test the nocrypt variant on http://superuser.phh.me/nexus/ryu/MXB48K/

It is as wild as it gets. Permissive su, no dm-crypt (FDE), no dm-verity
[Pixel C Android Development] ]grimm[:
I tested the nocrypt option and root functionality appears to work well. Thank you for this! Should the "eng" build be functional as well if we still want to use dm-verity and FDE?

I am seeing this bug when using the "nocrypt" boot image though: https://www.reddit.com/r/GooglePixe...tingssecurity_crashing_and_when_uninstalling/

I can't uninstall any applications and "security" crashes under settings when ever I try to access it. Everything goes back to normal when I boot the original boot image.
[Pixel C Android Development] phhusson:
The fact that this problem also appears on non-rooted firmware makes me think it's not because of root

Though it could be linked to encryption being disabled.

Can you test with the attached boot.img? It has encryption set to optional instead of forced
[Pixel C Android Development] ]grimm[:
This boot image takes me to the "To start Android, enter your password" screen again like your earlier boot images and also the "eng" image that you posted today.
[Pixel C Android Development] phhusson:
Yes, but I think doing a factory reset from recovery will work this time
[Pixel C Android Development] ]grimm[:
I just tried the factory reset and it reboots back into recovery once the reset completes, again like your original images did.
[Pixel C Android Development] phhusson:
Wow what? All the reports I had were mentioning the device booted, but then asked for password. Or did I misread?
[Pixel C Android Development] ]grimm[:
On first boot it prompts for the password. When the password is entered, it will say that the data is corrupt then prompt for a factory reset. Once you reset the device, it subsequently boots straight into recovery. This seems to happen with all of the images except for the "nocrypt" that posted earlier today.
[Pixel C Android Development] phhusson:
Can you flash this to vendor (fastboot flash vendor vendor_unsparse.img )? http://phhusson.free.fr/vendor_unsparse.img

It is original vendor partition without lib/hw/keymaster.dragon.so and lib64/hw/keymaster.dragon.so

My guess being that because of the "wrong" public key, keymaster is lost/not responding causing the reboot to recovery.

Deleting it should fallback FDE to keymaster-less ciphering, only scrypt.
[Pixel C Android Development] brando56894:
I should be getting my cable tomorrow so I'll be able to test this also. Root will make this the perfect laptop replacement.
[Pixel C Android Development] ]grimm[:
Perfect, I flashed the modified vendor image and new-boot.img and can now boot properly, have superuser access and the bug with the "security" option under settings and uninstalling applications is fixed. Thank you again for your hard work!
[Pixel C Android Development] rohmbd:
Subscribed
[Pixel C Android Development] phhusson:
Nice.

I'd like to fill a bugreport to Chrome team, but I need logcat.

Would you mind doing that additional test for me?

I'll need your adbkey.pub (~/.android/adbkey.pub on Linux) to make an adb-enabled boot.img if you agree
[Pixel C Android Development] ]grimm[:
adbkey.pub

Of course, I'm assuming that's my adb public key, correct? Thus it shouldn't be a problem for me to share it with you. How would you like me to send it to you? As an attachment on the forum?
[Pixel C Android Development] xploitnt:
I just want to thank you guys for your work/experimentation to get root working properly. I love my Pixel C, though root will make it so much better :silly:
[Pixel C Android Development] dkryder:
will supersu need to be flashed? also, did you flash busybox? i'll need to flash the "k" build later and then do this flash for root. i had flashed the first boot.img to my "j" build before i realized it said "k". smart, huh? anyway, flashing to "j" gave me a "no command" at boot. so i flashed your orig_boot to get boot again. then i realized that the orig_boot was probably from "k". thing is the "orig_boot" did boot ok on my "j" build. anyway, thanks for the work, i'll get it all flashed this afternoon and report how it goes for me.
[Pixel C Android Development] superchilpil:
Edit: I'll wait for a proper method.
[Pixel C Android Development] ]grimm[:
This is what I get:

target reported max download size of 268435456 bytes
Invalid sparse file format at header magi
erasing 'vendor'...
(bootloader) erasing flash
OKAY [ 0.088s]
sending sparse 'vendor' (121322 KB)...
OKAY [ 3.807s]
writing 'vendor'...
(bootloader) writing flash
OKAY [ 8.458s]
finished. total time: 12.353s

Also, I'm not able to reboot the device when I flash the boot image. Unless I manually boot the image using

fastboot boot new-boot.img

my device boots (or reboots) straight to recovery again.
[Pixel C Android Development] superchilpil:
This is what I get everytime.

Not sure what the issue is, I had an old fastboot installed so I updated but that did not help.

I also found a program to create a sparse file but I end up in recovery everytime i try and flash it so im not sure that its working properly.

Edit: If thats the case then maybe there's nothing wrong with my sparse file.. ill give booting it a shot.
[Pixel C Android Development] phhusson:
It feels like nothing's wrong, except that Windows is a bit annoying.

The "Invalid sparse file" is totally normal.

If you just wait like 5 minutes, it doesn't end?
[Pixel C Android Development] superchilpil:
If I wait it prompts me to close it.

So it seems my issue this whole time was I was flashing the boot image instead of just booting it.

So I finally got it to boot!

Edit: So for anyone that faces the same issue as me im going to post a link on AFH to the sparse vendor image I used

Here: https://www.androidfilehost.com/?fid=24345424848488347
[Pixel C Android Development] dkryder:
i have tried all of the boot images and this is the tail end of the fastboot flash process

writing 'boot'...

(bootloader) writing flash

FAILED (remote: image not multiple of block size)

finished. total time: 0.420s

i have never seen this message before so i do not know how to proceed.

earlier in the thread it was suggested that a "rounding" process was used as a work around , i have no idea what the "rounding" process is.
[Pixel C Android Development] phhusson:
I've reported the issues to Chromium OS team:

https://code.google.com/p/chromium/issues/detail?id=572784

https://code.google.com/p/chromium/issues/detail?id=572783
[Pixel C Android Development] superchilpil:
I had similar issues with the first image he posted. The boot-tmp.img works just fine.

Windows 10?
[Pixel C Android Development] dkryder:
yes, it is windows 10. the boot-tmp.img has been removed. or, at least i can not connect.

i have 4 boot and 1 vendor from phhusson

i have a modified vendor from you.

there was also a boot from mskip i have

i have not been able to get a good combo but at least i have it all sorted to a list and my adb/fastboot connections are ok

so i'm gonna run through it again later and see what happens. hey, at least the ice has broken on this issue.
[Pixel C Android Development] superchilpil:
So how I did it was I booted into fastboot and flashed the vendor img. Either one should be fine unless you have the issues I did. Then I fastboot booted the boot-tmp.img, it's imperative that you only boot it and not flash it. If you can't find that boot I can send it to you later, right now I'm away from my computer.

Then after it boots and prompts you to put in your password just enter 00000000 then it will say you need to factory reset.

Let it reset and before it boots boot it back into fastboot and boot the image again.

Then you should be rooted.
[Pixel C Android Development] dkryder:
'

ok. yes i would like that boot.img. whenever you have time.

all the boot.img i have are just under 10MB so google might let it pass. should work. thanks.

at what point do i flash the boot.img or do i just boot it until a fix is in?
[Pixel C Android Development] superchilpil:
You can't flash it, at least until Google issues a fix.

So this is basically a tethered root.

Also you should take your email down. I have it, so you won't get plagued with spam.
[Pixel C Android Development] kavey:
I've just unlocked my bootloader - that 30 second boot warning/delay is pretty annoying; hopefully that can be fixed at some point.

About to test this temp root but mainly need root for system r/w access - does this allow that or might we need to wait for 'full' root?
[Pixel C Android Development] phhusson:
Yes, this root has r/w access to /system

You can modify /system with this boot.img, and then boot back to original boot.img. This should boot after a red warning.
[Pixel C Android Development] ]grimm[:
As far as I can tell, the coreboot-based boot system on the Pixel C has no corresponding indicative mechanism to the yellow, orange, and red security warnings on Nexus devices running Marshmallow.

I apologize in advance as this is likely more if an informational inquiry than a meaningful suggestion for development. If the Pixel C can be booted with superuser access in a way that we can make persistent changes to the system partition, would it be possible to use this to bootstrap a root solution that could continue to be functional when booting with the original boot image?

Based on what I've seen in your scripts, my guess is that the answer is "no" because there's no way to inject an appropriate sepolicy after booting from a stock boot partition such that the su daemon could be launched in the proper security context so that su could function. Is this correct?
[Pixel C Android Development] phhusson:
So, you tried to change /system partition, switched back to original boot.img, and it rebooted directly to recovery?

Please note that to go from boot-...uncrypt... to original boot.img, a factory reset is needed.

I must say that I'd be really suprised from them not to implement it, since those states are described as part as android ""reference design"" https://source.android.com/security/verifiedboot/verified-boot.html

Though, checking depthcharge/coreboot source, I can't see where they would handle this...

Yup, that's the whole reason of system-less roots for Android M.
[Pixel C Android Development] brando56894:
I just booted using this image and it booted just fine, I installed phh superuser and it installed but ES File Explorer says that I don't have root....
[Pixel C Android Development] superchilpil:
That image just doesn't force encryption, it doesn't provide root.
[Pixel C Android Development] brando56894:
I've booted this one and root works perfectly! :D
[Pixel C Android Development] phhusson:
This should be fixed in r144. Can you check again?
[Pixel C Android Development] brando56894:
Actually after using that boot image for a little while I get occasional soft reboots, root still sticks since it's not a full reboot.

edit: just for the hell of it I decided to try and flash that same image and now when it boots up it gives the 30 second warning (like my HP Pavilion Chromebook did) and then tries to boot Android (Google splash screen), then it reboots and gives me the 30 second warning and then goes to Andy on his back with his chest open and it says "No command", which I'm assuming is the recovery partition.
[Pixel C Android Development] dkryder:
i tried all four of the new boot images, doing a boot boot.img and each one goes through the boot animation, asks for a password, entered password, password correct, needs reset, does reset, back to factory install.

i must be doing something wrong. is it required to flash the modified vendor? i'm not sure why it seems to work for others but not here.