[Miscellaneous Android Development] polartux:
I am sharing a full stock ROM for SGP BP2 (Blackphone 2) which I got directly from Silent Circle support.

This ROM is not rooted because it's original, would be awesome if someone will be able to root it before i do that :)

Kernel: 3.10.49-gc6cf2ab

OS: Silent OS 2.0.8 RC4

Based on: Android Lollipop 5.1.1 (r1) and contains some Cyanogenmod files.

AOSP build: LMY47V

AOSP branch: android-5.1.1_r1

Here is a Google Drive folder with ROM files:

https://drive.google.com/open?id=0BybUUdJE1dSZeUkxbE8wZUEtcHc

Folder contents:

BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip

This is a full stock ROM for models that contain letters 'RW' in their model name.

Example: BP2H001RW1 - letters "RW" indicate you should use that .zip

RW (ROW) means 'Rest of World'.

build.prop contents:

http://paste.debian.net/901606/

BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip

This is a full stock ROM for models that contain letters 'NA' and 'AM' in their model name.

Example: BP2H001AM1 - letters "AM" indicate you should use that .zip

NA means 'North America', AM means 'America'; probably the models being sold in that region are slightly different.

build.prop contents:

http://paste.debian.net/901680/

boot.img

I've extracted 'boot.img' from the .zip and uploaded aside, in case someone is looking only for kernel and initrd.

boot.img is same in both NA and ROW roms.

recovery.img

It's a stock android recovery image, I've got it with dd after flashing the BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip

md5sum:

afb4c7a26608d113b1b54da167fc0255 BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip
180021957910afc484c76f4a2246c491 BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
9e42e33b39244e8bfa6f250424c15270 boot.img
9c872f08f69a2b6cad93214c1089b03d recovery.img

sha1sum:

8164772318414d49389168495f732afb46467c1c BP2-OTA-2.0.8-RC4-candidate-NA-1460729363.zip
14010e518725146a8ebe52caf4723be4c69c3c9a BP2-OTA-2.0.8-RC4-candidate-ROW-1460729363.zip
a9bf9ce0a6f5b31860e228464fd3abbd9f232a57 boot.img
c76ea5c0ca330bf6dc2191d9db0bead1cac6d4c7 recovery.img

Known issues

Device name case mismatch ('bp2' vs 'BP2')

I wasn't able to reflash my device without modifying one file in a .zip

It may give you this error when you start updating:

This package is for "BP2" devices; this is a "bp2".

In that case you need to:

1) unpack a .zip file

2) find the file updater-script in the META-INF/com/google/android/ folder, which looks like:

get_device_compatible("BP2") == "OK" || abort("This package is for \"BP2\" devices; this is a \"" + getprop("ro.product.device") + "\".");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
show_progress(0.200000, 10);

3) change the letters 'BP2' to 'bp2', so the first line will look like this:

get_device_compatible("bp2") == "OK" || abort("This package is for \"BP2\" devices; this is a \"" + getprop("ro.product.device") + "\".");

4) Pack everything back into a .zip file

5) Apply the update using a new .zip file using stock recovery.

System image format

If you have a TWRP recovery instead of stock, you won't be able to flash the ROM from .zip (for some unknown reason it just doesn't flash a system partition)

You will need to extract the ROM .zip and use sdat2img tool to convert lollipop's system.new.dat format to system.img (raw format), after that you can flash system.img directly using TWRP or dd.

Follow this manual for Linux: http://xdaforums.com/showpost.php?p=57635842&postcount=2

For Windows: http://xdaforums.com/android/help/extract-dat-marshmallow-lollipop-easily-t3334117

Alternatively, you can flash stock recovery.img that I listed above, boot it and flash .zip from it directly.

Mounting /system with read-write using TWRP causes a bootloop

Thread: http://xdaforums.com/android/help/blackphone-2-bootloop-rw-mount-using-t3516862

Security vulnerabilities

This ROM is vulnerable for these attacks according to QuadRooter Scanner:

CVE-2016-2059 - "QuadRooter"

CVE-2016-2504 - Elevation of privilege vulnerability in Qualcomm GPU driver

You may need to upgrade to the latest Silent OS version using OTA updater in order to mitigate these.

On the other hand, you may root your device using one of these vulns before upgrading, whether there is a root method that using QuadRooter exploit (I believe there will be one soon).

Oh c'mon Silent Circle, you made it annoying, just let us use root privileges peacefully, we are aware of damn risks!

Useful information

/proc/mounts

rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,size=1481408k,nr_inodes=182626,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
none /var tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=770,gid=1000 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,size=1481408k,nr_inodes=182626,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
/dev/block/dm-0 /system ext4 ro,seclabel,relatime,discard,data=ordered 0 0
/dev/block/bootdevice/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/dev/block/bootdevice/by-name/persist /persist ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/dev/block/bootdevice/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/vold/179:65 /mnt/media_rw/sdcard1 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/block/dm-1 /data ext4 rw,seclabel,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0

/proc/partitions

major minor #blocks name

179 0 30539776 mmcblk0
179 1 512 mmcblk0p1
179 2 512 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 512 mmcblk0p8
179 9 512 mmcblk0p9
179 10 512 mmcblk0p10
179 11 1024 mmcblk0p11
179 12 1024 mmcblk0p12
179 13 1536 mmcblk0p13
179 14 1536 mmcblk0p14
179 15 1 mmcblk0p15
179 16 8 mmcblk0p16
179 17 10240 mmcblk0p17
179 18 10240 mmcblk0p18
179 19 65536 mmcblk0p19
179 20 32 mmcblk0p20
179 21 65536 mmcblk0p21
179 22 1536 mmcblk0p22
179 23 16 mmcblk0p23
179 24 32768 mmcblk0p24
179 25 1966080 mmcblk0p25
179 26 32768 mmcblk0p26
179 27 917504 mmcblk0p27
179 28 32768 mmcblk0p28
179 29 1024 mmcblk0p29
179 30 512 mmcblk0p30
179 31 512 mmcblk0p31
259 0 32 mmcblk0p32
259 1 27162575 mmcblk0p33
179 32 4096 mmcblk0rpmb
179 64 3855360 mmcblk1
179 65 3851264 mmcblk1p1
254 0 1950564 dm-0
254 1 27162575 dm-1