yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] mrmazak:
well your cwm recovery was a big head start. Thanks.

I am gonna start merging the stock ram disk your recovery and test boot it.

When in cwm and pulled the images, they actually went into /data/media and when i rebooted and looked for them they were gone. I think this is either dm-verity or force ro on /system. Any suggestions?
[General Questions and Answers] vampirefo:
No, I won't suggest anything, be careful, Intel doesn't forgive. If you get it right you will have root, you get it wrong, you have a brick.
[General Questions and Answers] mrmazak:
I understand your position. And appreciate the headstart and I Donated to your efforts. Thanks

To anyone else working on this. This recovery changes your usb vendor id as it is, so the next time you connect , at least to fastboot mode you will need to update drivers.

from the ramdisk of this recovery in init.recovery.sofia3g.rc

on fs

write /sys/class/android_usb/android0/idVendor 0B05

write /sys/class/android_usb/android0/idProduct 7770

and

from stock ramdisk of stock recovery init.recovery.sofiaboard.rc

on fs

write /sys/class/android_usb/android0/idVendor 8087

write /sys/class/android_usb/android0/idProduct 08F4

should be simple edit, but not high on the list right now.

I just had to reload drivers after playing with this recovery and needed to search for why. Hoping this is only reason.

---------- Post added at 03:02 AM ---------- Previous post was at 02:58 AM ----------

I have the stock system and boot and recovery images pulled and posted a link back a few posts'

link here

https://xdaforums.com/general/help/rca-voyager-rct6873w42-rooting-help-t3485625/post70663610

we also have a cwm image to base off of.

It is by far not ready for flashing and not ready for wide public use at this point. But is good head start for development.
[General Questions and Answers] mrmazak:
Update:

not much progress yet. Still trying to get display to function in the ported recovery. Recovery originally came from an Asus Zenpad P01V:5.0.2. According to the default prop. And was most recently used for the Insignia 8 NS-08A7100.

thanks to [MENTION=2472806]vampirefo[/MENTION] for making it available and for making it in the first place

Recovery gives root prompt, but there is no way to know what the rom will do if changes are made. Take this as warning and reminder , that this is not a root for tablet but for developement

I am taking it slow. Step by step, do not want to make bricks this early on.

so far I have swaped in all stock init.rc files, all fstab files(including the ones in /ramdisk/etc), all ueventd files , most of lines in default.prop that relate to device info, the recovery.img-kernel, Still get an adb shell with # but now the display keeps switching from back light very low to on.

next step will be to make boot.img insecure and test if it boots.

update:2

I have three lines in default.prop

ro.adb.secure=0

ro.secure=0

ro.debuggable=1

I use "fastboot boot moddified-boot.img"

tablet starts and runs normal

when i use "adb root" the response is "restarting adbd as root"

but "adb remount" still says not running as root and to issue "adb root"

.....progress........

any help from this community is welcome
[General Questions and Answers] vampirefo:
Not that it matters but this recovery I originally built for Dell Venue 8 3830

https://xdaforums.com/dell-venue/general/dell-venue-8-cwm-unsecure-boot-recovery-t2866925

and was last used to root a Zenpad.

My CWM recovery has been used to root many different intels over the years, it's included in about every intel root package out there.

without having your device, I can't say or see what's happening to prevent the recovery from showing, perhaps pull the recovery logs will help, adb pull /tmp/revovery.log
[General Questions and Answers] mrmazak:
I told you, your name kept coming up. Every thread I found about root or recovery pointed at some point back to you.

Thank you for all have done.

first log showed could not connect to /etc/recovery.fstab

The stock /etc/recovery.fstab_emmc and _nand appearently did not link

I renamed the file to /etc/recovery.fstab and now getting cannot connect to vold invalid argument., But now the screen does not flash. And remains black screen dim backlight, (just like fastboot screen)

google found this same issue in this thread.

https://xdaforums.com/showthread.php?t=2619602

I checked for and added the "service vold " section and now the log is not showing error, but still not giving screen.

I have as far as I can for now. Still no screen and log has "can't open /dev/tty0: No such file or directory" as only error that I can tell. I have not found reference to it in either the stock or cmw recoveries.
[General Questions and Answers] vampirefo:
These logs don't help, cause they aren't from my recovery, they are from a modified version of my recovery.
[General Questions and Answers] mrmazak:
You are right, this is the first log. Before changes. But to me, i don't see helpfull difference.
[General Questions and Answers] vampirefo:
The recovery finds everything, so while in recovery type.

adb shell

/sbin/recovery
[General Questions and Answers] mrmazak:
prompt hangs at blank line waiting for device. nothing happened for about 5 minutes. hit "ctrl c" to exit and pull new log.

Don't know if this makes sense to you or not. From adb shell I cd /system. Then do "ls" only thing shown is lib folder, nothing else

I dont seem to be able to access anything from on the phone. And only access to a temp system. Meaning anything written while in recovery is removed on reboot.
[General Questions and Answers] vampirefo:
I don't understand the output, adb shell should give you #

/sbin/recovery should out something.

Try one line

adb shell /sbin/recovery
[General Questions and Answers] mrmazak:
I feel maybe device encryption might be making trouble. IDK

seems that recovery log shows mount points as expected but not mounted.

timing of screen shot is off. There is a blinking cursor below the the last line
[General Questions and Answers] vampirefo:
What does busybox df -h output?
[General Questions and Answers] mrmazak:
shows only cache is mounted

Filesystem Size Used Available Use% Mounted on

/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID070 411.7M 984.0K 402.2M 0% /cache
[General Questions and Answers] vampirefo:
That's all that should be mounted.
[General Questions and Answers] rpk3:
I am new, obvious.!

Been followimg this thread with great interest. Shout out to them those that were able to retreive an oem recovery for This beast of a hard to CRACK device.

Thx mrmazak, vampirefo

I am trying to throw an old debian setup on this tablet for something related to hud for my drone flights....
[General Questions and Answers] FrostEnticer:
Lucky Patcher?

So I made a tiny but of progress in bypassing the security, it seems that disabling Googles framework processes via lucky patcher seems to help interfere with verification, possibly might help with gaining access to what you guys need, hope it helps

I am using the actual tablet aswell

It also appears that disabling most of the access privileges to Googles routine services helps with direct access
[General Questions and Answers] mrmazak:
minor update.

the system img i had posted earlier was not complete. i did not notice that i ran out of space on my card when i was "dd" the image.

i have re-uploaded complete image.

still have not made recovery that has working display.

https://xdaforums.com/showpost.php?p=70663610&postcount=56
[General Questions and Answers] mrmazak:
I am still finding trouble using this recovery. I know it needs work, and I am trying. But it is mostly new territory here.

Problems I think I fixed :

1: There are several references in ramdisk files that call variable "${ro.hardware}" and from the named files in the ramdisk the expected result of the variable should be "sofia3g" but as the log shows that variable on this device is "sofiaboard". So replacing file names that have "sofia3g" with "sofiaboard" , made mounts availabe.

without the changes "/system" and "/external_sd" were not available.

2. Each time I try bot boot this recovery image then back to the rom or stock recovery I lost connection to my pc Drivers.

so I made these modifications:

from cwm both "init.rc" and "init.recovery.$.rc"

on these lines make the id numbers same as on stock versions of init.rc & init.recovery.$.rc

on fs
write /sys/class/android_usb/android0/idVendor ****
write /sys/class/android_usb/android0/idProduct ****

Now for the problem I think I have,

I cannot mount Data. I get invalid argument error.

I think maybe it is because the force encryption that android 6.0.1 has. And that is supported by the following line in fstab

from stock recovery ramdisk/etc/recovery.fstab

/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069	/data ext4 nosuid,nodev,nodiratime,noatime,noauto_da_alloc,discard,journal_async_commit,data=ordered wait,check,encryptable=footer

form stock recovery ramdisk/fstab.sofiaboard_emmc

/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 /data ext4 nosuid,nodev,nodiratime,noatime,noauto_da_alloc,discard,journal_async_commit,data=ordered wait,check,forceencrypt=footer

from intelCMW51 recovery ramdisk/etc/recovery.fstab

/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069	/data	ext4	nosuid,nodev,noatime,barrier=1,journal_async_commit,data=ordered,noauto_da_alloc,discard	length=-16384

from intelCMW51 recovery ramdisk/fstab.sofia3g

/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 /data ext4 nosuid,nodev,noatime,discard,barrier=1,data=ordered,noauto_da_alloc wait,check,encryptable=/factory/userdata_footer,length=-16384

I don't understand fully the flags used in this fstab, so I did not try to just switch the lines.

Is anybody else working on this?

If so, let me know if you get past this point, or if you know that I am heading in the wrong direction.
[General Questions and Answers] vampirefo:
You can't mount data, as it's encrypted, if you force mount data, tablet will soft brick.
[General Questions and Answers] fsebentley:
I have been playing with the cwm posted by vampirefo.

I have used it with no mods with same results as mrmazak.

With mods I can get all mounts ( change init.rc's and default.prop as well as fstabs matched to this tabs )

In niether case can I get any video other than the backlight.

Using the recovery image pulled from the Tab ( boot from fastboot boot recovery.img ) I get flashing backlight no video and no adb connect.

I Plan to work with the Stock Recovery in order to determine what the issue is with the display as it should work properly with this, any insight as to what may be preventing video is appreciated.
[General Questions and Answers] mrmazak:
When I boot the pulled stock recovery, I do get the video, but the android laying on its back keeps flashing. And there is text in the bottom of screen.

"API level 3. "

Something like that, same as when loading recovery that is installed on tablet. But I get error cannot mount cache

When I get home later I will take picture and post it

getting adb wasnt too hard, but seems pointless. There are almost no commands built in, no mount, ls, cat, shell all return same message as in the photo.

to get adb in stk recovery

1. six lines in default.prop need changed

line 9: ro.adb.secure=0
line 14: ro.secure=0
line 16: ro.debuggable=1
line 32: persist.sys.usb.config=mtp,adb
line 95: sys.rkadb.root=1
line 169: ro.adb.secure=0

additional
persist.service.adb.enable=1
persist.service.debuggable=1

this will get response from adb devices

response will be

"****sn****" unathorized

to get past that add your "ady_keys" to

ramdisk/data/misc/adb/

your keys will only be good for the pc that made them. You can get them either from your pc in /data/.android/adbkey.pub on linux or

C:/users/<user name>/.android on windows

or other android that has connected to adb on your pc in "/data/misc/adb/"
[General Questions and Answers] fsebentley:
Update

I have now had a semi-successful load of the CWM Modded with my fstab initrc and default.prop files.

Essentially I just pulled the sbin and resource folder contents from the CWM and inserted it into my recovery initrd image, I also made a couple of other modifications such as changing the secure adb settings in the default.prop this yielded boot up and adb, in adb I typed recovery at the command line and got the CWM screen. I was able to navigate, mount and unmount the system and cache but not much else. Now to fiddle with the mounts and try and fgure out what is killing the autostart o the recovery.

I also have to think that perhaps my own tab differs from yours at least slightly since the recovery I was originally attempting to boot was the one you posted, this one as I said before would not give anything but flashing backlight. I then Pulled my own recovery and was able to load it fully functional. It was using this that I was able to make the CWM work for me. It is possible that the download was damaged and I will attempt to re-download it and try yours again at some point to ensure compatibilty.
[General Questions and Answers] mrmazak:
That might make things even more difficult, if there are different versions of rct6873w42.

Since your pulled recovery is fully functioning, I verified my image by pulling it again, Same result. I get the error reading cache and screen cycles on off every 4 seconds.

On mine, the bootloader is in ORANGE state. I have a 30 second timeout screen on every boot saying bootloader is unlocked and device is not trusted. Does yours do that?
[General Questions and Answers] fsebentley:
I have the 30 second timeout on the bootloader as well. I have been looking for a method of disabling this but it appears to be embedded in the bootloader so until we can get one without this I think we are stuck with it. There is a possibility that there is a hidden command to do this in fastboot and I am also looking into that.
[General Questions and Answers] mrmazak:
just got a full auto matic load of cmw.

still checking on mounts,

I used the whole ramdisk from the cwm (with the mods to vender ID , and changes file names from *sofia3g* TO *sofiaboard*), and the kernel from stock recovery.

recovery loads on boot and system reboots on command. (no more needing to adb commands) Adb is #, but data still will not mount for me.

On exit cwm asks to fix root, I did not do this. [MENTION=2472806]vampirefo[/MENTION] has warned intel device not same as others, and this may lead to brick. I do not recomend try it, unless you are willing to risk loosing your device.

new img is in the google drive folder i linked before.

to make it easy i put it here

mount points still need adjusting, or as [MENTION=2472806]vampirefo[/MENTION] has said data can not be (force)mounted here because of encryption.

RECOVERY ATTACHMENT REMOVED, IT WAS NOT TOTALLY SAFE!!!! Test restore made soft-brick. I recovered but recovery needs work
[General Questions and Answers] mrmazak:
Today's update.

Data mount problem was defiantly caused from being encrypted.

I was able to modify the fstab in boot.img and then "fastboot format userdata" and "fastboot format cache", followed by "fastboot boot ./modified-boot.img"

the results were that my data partition was no longer encrypted. So I fastboot boot again the cwm . This Time data could mount.

You can see in photo all partitions listed can be mounted.

update:

I sucsessfullly flashed the modified boot.img so it is not "forceencrypt"

Then tried to flash the recovery and it does not boot from inside. I got very nervious. But was able to flash back the stock recovery

well not totally stock, I changed fstab of recovery also to remove the "forceencrypt" part and replaced with only "encryptable"

still "encryptable" because , just in case I missed something and it gets encrypted the vold will still take over and decrypt it.

Also made stock recovery have adb access because at this point there is no cwm inside the device it is only working with fastboot boot, and no way to get into fastboot with button combo. So with adb in stock recovery you should be able to "adb reboot fastboot" from recovery if needed, then get to cwm for restore feature

Steps to get to this point

adb and bootloader drivers are beyond the scope of this tut( it is assumed if you are here trying this you know how to find drivers)

1: enable developer options

2: enable oem unlocking

3: enable usb debugging

4: connect phone, open terminal, command "adb reboot fastboot"

5: command "fastboot flashing unlock" confirm by pushing volume button

6: command "fastboot format userdata" optional, as on reboot, recovery will do the format .

7: reboot phone , go through setup to get back to developer options

8: in terminal or command window "adb reboot fastboot"

9: "fastboot flash boot no-force-encrypt-boot.img"

10: "fastboot flash recovery no-force-encrypt-recovery.img"

11: "fastboot format userdata"

12: "fastboot format cache"

13: for root commands "adb reboot fastboot", then "fastboot boot rca-cwm-recovery.img"

14: either add my adb-keys to your .android folder on pc or unpack the recovery image and replace the keys with your own

adb-key used in recovery.img to get authorized access

QAAAAPUCaAKj5ubJYfY6HmaFYmvxnv1QzjWQeUKjDsEuHjjERFSJBTq3w0pGSU6eLjRpLZMs83UPgYwQQpZ0JaEpZ2Tdg6aB6g4a8hPR0X4JVBJWE9f5+n4oijbNx8JHvpYH91YgGRZTYEzmF2sSAIUlYs8ANcoM7AbKylCZ1ZKkH+Zo5RdhCB+PKy1uI/HkDo9uVq2ROBq0wkd8278JqLcmwWUoDAPBWELVcfLAm9fVa8YAdpxPd08hBGcACeu4OZLUxuhz0HLeSLmXLGGd8ds6X8vj4ZnGeyyTRMdI0VVpidbJjasvr67K2aiFdgqCdCl8Uxqjs8HOnmg0gwp7bsY2Vwgm6TnjE8jYSzMCaWGZ8/STnQ1TBwz7X4ba6cxN+f0J4F8bXdmp9OtjVvYB3NxGX08Wsl+ZtQVfzYKiOwAEOMO5jpOsxvS71m2p8/dFi+w3Npad3q7+cDDaiKW/vQyCgeGW1nz/3Ofdqa9+/EUgj2zfI8fJ6RQ8dc9CNkwhvNlkTvr9wkuuyXPXbLdyI71t8sZTNpWalqCQrVLe82HdPqKrkgOW8Maoja2/q5C4zTgpgmikbDxxhrhOMG6InHweXddgM31r6Aq6H0/NdkFxB1iSa8iNvepmsd2Kj9e7YK4ZI+EK99HucnA4Yg47A5gsNLUX8Eer0GLBtVKsmtoDY2YbgHdFbwEAAQA= unknown@unknown
[General Questions and Answers] mrmazak:
Now that there is a way to get to(custom) recovery if soft brick, I can continue to working on a root process.
[General Questions and Answers] mrmazak:
Do not use MY POSTED recovery to restore.

I just lost system and have not been able to reflash

The details:

After a successful backup with cwm, I tried to do restore. Big mistake. Recovery was not permitted to write to /system but it had just gotten permission to format it.

I exited cwm and at reboot was greeted with blank screen, only back light. Rebooted into stock recovery and it was also not allowed to mount /system.

Adb was working and I did reboot to fastboot. And tried to fastboot flash system. It returned with message about maximum download size and that image I was using was too large and wrong sparse type.

Rebooted again to stock recovery and tried to factory reset. That was last bad decision I could make. Now my adb-keys I had added to recovery got wiped somehow and I no longer have adb access, so no more access to fastboot, unless there is a hidden method to get in.

:) :) :)

. I was able to get back into adb after trying adb sideload

After adb got reauthorized. I was able to boot into fastboot then cwm. But still could not mount /system, and restore failed again, then I desperately tried to format /system with cwm. It worked. Now restore completed.
[General Questions and Answers] darkwingduhk:
thanks to everyone working on this

I also have this tablet and i'm desperate to root it! Whoever figures this out, I will gladly pay you!:good::laugh:

Also a big ol' thank you to everyone trying!
[General Questions and Answers] mrmazak:
After panicing over my "mini brick", and then finally restoring it.

I did try to use the automatic cwm recovery script to root.(the one , you get prompted to do when you exit cwm)

It did not work. Then i tried both SuperSU systemless V76 (did not recognize root.img and failed)

And SuperSU system V76 (did not work)

su binary did get added to both /system/bin and xbin. But installing SuperSU app did not see it or work.

And tried CWM-SuperSU-v0.96, this script failed with error 25. Then I tried to push the su and apk just like the script was supposed to. On reboot the app was there and opened, said it needed to update binary, then failed to install.

.......

........

So permissive boot may need to be next .

Side note.

I do like to automate repetitive things, so I put together a bootloader unlock/ no encrypt batch file and a reboot to cwm batch. Both are in my GitHub, so changes can be easily tracked.

project on GITHUB

https://github.com/mrmazakblu/RCA_RCT6873W42_bootloader-unlock_CWM_recovery_tethered-root
[General Questions and Answers] mrmazak:
Permissive boot.img is giving me a bit of trouble. Without kernel source I can't build a new one (not that I have even done that before). And the kernel command line of stock kernel already has "androidboot.selinux=permissive"

I tried to add an .sh file with "setenforce =0" , and I added an import command in the init.rc , but it either did not run or did not work.

I think the ROM supports unit.d so I will try to add command there next.

added dir "/etc/init.d" and made file "08setperm"(name irrelevant i think), inside file

#!/system/sh
setenforce 0

did not seem to change anything.

and after rebooted the folder I added is gone.

Next I added the /etc/init.d folder and the setperm file directly to boot.img No progress
[General Questions and Answers] fsebentley:
In the boot.img the bootimg.cfg controls the parameters of the boot.img this config file has the "cmdline =" parameter which is the kernel command line to be used on boot. Edit this (unedited it has the "androidboot.selinux=permissive" in there) If you change it there that should accomplish what you seem to be trying.

Currently i am at a standstill, during one of my tests of the recovery I made a mistake in reboot by unintentionally selecting the option to root.. (I was not reading closely enough and didnt notice the option until i had clicked it) in any case I am at softbrick and am looking for a means to unbrick..
[General Questions and Answers] vampirefo:
If you can't adb the device, there is no recovering it.

---------- Post added at 05:25 PM ---------- Previous post was at 05:22 PM ----------

You have to rebuild sepolicy, to get permissive boot, then use recovery to flash system root. Don't try systemless root on this device.
[General Questions and Answers] mrmazak:
Is the cfg file you refer to the same as "boot.img-cmdline" I get when I unpack the boot.img with "carlivimagekitchen" I am using on Windows?

About your brick, how bad is it?

Do you have recovery available?

Was the recovery that asked "root" installed or just booted?

---------- Post added at 11:35 PM ---------- Previous post was at 11:26 PM ----------

Well policy is not even close to familiar to me.

I did try comparing the one in your cwm to the one from RCA boot.img. I used winhex hex editor, the beginning is identical, then there is many unreadable sections, followed be the RCA one going into lots of permissions involving decrypting, .that's probably as far as I'm comfortable pushing things for now.

By the way congrats on the "Max". I had one in my cart since pre-order announment. But just didn't follow through with it.