yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Rortiz2:
Worked on second time:

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb push mtk-su /data/local/tmp
mtk-su: 1 file pushed. 0.6 MB/s (30328 bytes in 0.049s)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
shell@Aquaris_M8:/ $ chmod 0755 /data/local/tmp/mtk-su
shell@Aquaris_M8:/ $ ./data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc0494349c0 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc05aba2680
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # getenforce
Enforcing
shell@Aquaris_M8:/ # exit
shell@Aquaris_M8:/ $ ./data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc04efbbe00 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc032dd9f80
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # getenforce
Permissive
shell@Aquaris_M8:/ #
[Fire HD 8 and HD 10 General] diplomatic:
Yep. :) Was wondering if anyone noticed...

Oh, that's good to know. Because I've improved things enough so that I haven't seen it fail to set selinux on my tablet since R7. And I've done a lot of tests. Will have to look into it...

BTW, since R9, has anyone seen an intermittent glitch with not getting UID 0 and a message line "Did not find own task struct"?
[Fire HD 8 and HD 10 General] Rortiz2:
I have not seen any errors with uid in all releases. See: (R9)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
shell@Aquaris_M8:/ $ ./data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc0303949c0 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc03a016280
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

PS: Tomorrow will try mtk-su in a 6752 device. If I can I will put results.
[Fire HD 8 and HD 10 General] joe8mofo:
HD8 2018 no such file or directory

I am unable to run mtk-su on the HD8 2018. If i run from adb shell or from termux I receive no such file or directory; despite the permissions being set correctly.

$ adb shell ./data/local/tmp/mtk-su -v

/system/bin/sh: ./data/local/tmp/mtk-su: No such file or directory

From termux I placed mtk-su in the /data/data/com.termux/files/home directory and I still get the same response of "No such file or directory" when trying to execute ./mtk-su -v

So for me the 2018 HD 8 temp root is not working.
[Fire HD 8 and HD 10 General] cybersaga:
You put a dot in front of "/data", which there shouldn't be. But running like "adb shell /data/local/tmp/mtk-su" won't actually give you a root shell. Run "adb shell" first, then run "/data/local/mtk-su -v".

In termux, you're probably just not in the right directory when you're running it. Use "ls" to see if mtk-su is in the current folder.
[Fire HD 8 and HD 10 General] Rortiz2:
The dot is correct. I used that command and it works. The problem seems to have not copied well mtk-su.
[Fire HD 8 and HD 10 General] k4y0z:
The dot is not correct!

It is only correct if you are currently in the root ("/") directory.

The dot denotes the current directory, so instead of an absolute path it is used as a relative path to the current directory.
[Fire HD 8 and HD 10 General] Rortiz2:
I imagine that first he should do adb shell and then use: ./data/local/tmp/mtk-su -v
[Fire HD 8 and HD 10 General] k4y0z:
No, just use the absolute path (no dot):

adb push mtk-su /data/local/tmp/
adb shell chmod 755 /data/local/tmp/mtk-su
adb shell
/data/local/tmp/mtk-su -v
[Fire HD 8 and HD 10 General] Rortiz2:
Ok. I just say that doing this works for me:

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb push mtk-su /data/local/tmp
mtk-su: 1 file pushed. 2.8 MB/s (30328 bytes in 0.010s)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
shell@Aquaris_M8:/ $ chmod 0755 /data/local/tmp/mtk-su
[COLOR="Red"]shell@Aquaris_M8:/ $ ./data/local/tmp/mtk-su -v[/COLOR]
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc0300b1ac0 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc03a135080
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # getenforce
Permissive
shell@Aquaris_M8:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
shell@Aquaris_M8:/ #

And your method also works:

shell@Aquaris_M8:/ $ /data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc04eef8f00 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc033bfa800
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # getenforce
Permissive
shell@Aquaris_M8:/ #
[Fire HD 8 and HD 10 General] bigrammy:
Form adb shell.

1. Place mtk-su on your internal sdcard.

Now open your termimal and type.

1.

adb shell

2.

cp /sdcard/mtk-su /data/local/tmp/

Notice the single space between "mtk-su" and "/data"

3.

cd /data/local/tmp

4.

ls

mtk-su should be shown if it is continue

5.

chmod 755 mtk-su

6.

./mtk-su -v

From Termux app.

Place mtk-su on your internal sdcard

Then from the termux app type the following one after the other.

1.

cp /sdcard/mtk-su $HOME

Notice the single space between "mtk-su" and "$HOME"

2.

cd $HOME

3.

ls

mtk-su should be shown if it is continue

4.

chmod 755 mtk-su

Notice the single space between "chmod" & 755 also between 755 & "mtk-su"

5.

./mtk-su -v

Make sure you do not double space or miss the ./ when you come run mtk-su
[Fire HD 8 and HD 10 General] k4y0z:
Yes, it works, because "adb shell" puts you in the root-directory, which isn't necessarily always true.

It's better to avoid using the relative path.
[Fire HD 8 and HD 10 General] Rortiz2:
Ok, thanks for the clarification and sorry for insisting that it worked qith the dot method.
[Fire HD 8 and HD 10 General] k4y0z:
Well it does work with the dot as you noticed ;)

It's just that it isn't the best way to do it and wouldn't work if you were in a different directory.

Try doing this for example:

adb shell
cd /sdcard
./data/local/tmp/mtk-su -v

and compare with this

adb shell
cd /sdcard
/data/local/tmp/mtk-su -v
[Fire HD 8 and HD 10 General] diplomatic:
That's too strict. I don't think it matters at all how many spaces there are between words. Just need at least 1.
[Fire HD 8 and HD 10 General] Rortiz2:
You're right:

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
shell@Aquaris_M8:/ $ cd /sdcard
[COLOR="red"]shell@Aquaris_M8:/sdcard $ ./data/local/tmp/mtk-su -v
/system/bin/sh: ./data/local/tmp/mtk-su: not found[/COLOR]
[COLOR="Lime"]127|shell@Aquaris_M8:/sdcard $ /data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 12
ADRP x21, 0xffffffc000cea000
Found add instr at offset 20
ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc00319a680 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc0742ca280
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 0/0
starting /system/bin/sh[/COLOR]
shell@Aquaris_M8:/storage/emulated/0 #
[Fire HD 8 and HD 10 General] k4y0z:
Exactly, because in this case "./data/local/tmp/mtk-su" gets expanded to:

/sdcard/data/local/tmp/mtk-su
[Fire HD 8 and HD 10 General] bigrammy:
Well you learn something new everyday on this forum & that's why I love it. :good:
[Fire HD 8 and HD 10 General] geminihc:
have a fire 8 hd 2016 (6th), ran semi-automated root v2.1 and all seems fine, supersu shows up and downloaded/installed latest supersu binary. however, it is not rooted as apps that require root does not ask me anything and doesnt work. root checker also says not rooted.

i rebooted, and now supersu immediately auto closes without errors when opening. and i cannot remove it...

how can i fix this?
[Fire HD 8 and HD 10 General] NFSP G35:
I had an issue on my 7th gen with supersu not prompting, so you have to set its default action to grant instead of prompt.

But if the app is crashing, you can't do that I guess...

Did you try clearing the data and cache for the app (through settings)?
[Fire HD 8 and HD 10 General] geminihc:
thanks, i just went to check clearing data/cache for supersu (it's under all apps), but the clear data button was greyed out though there is data. i can press clear cache but that doesnt do anything. nor can i force stop.

i feel like its stuck running (i enabled run on boot option or something like that when i did have it open for the 1st time), and i cannot uninstall it....

is there anyway i can remove it via root shelll? i do seem to be able to access root via the scripts and can type commands in the adb shell (i think? it says root# something something after i type su, but i dont know what else to type .
[Fire HD 8 and HD 10 General] NFSP G35:
adb uninstall <app package name>
[Fire HD 8 and HD 10 General] geminihc:
can u tell me what the supersu package name is...? simply supersu.apk says internal error
[Fire HD 8 and HD 10 General] MontysEvilTwin:
eu.chainfire.supersu.apk - you may need a root shell to uninstall it.
[Fire HD 8 and HD 10 General] :
On the first run of the app, set it to grant and be done with it. shouldnt have an issue after that. You can still use the root at boot option if you want. shouldn't bother anything. Sounds like you def want it setup right the first time. it's a known issue. are you guys disabling selinux? i wonder if that has anything to do with it?
[Fire HD 8 and HD 10 General] geminihc:
yes.. next time i will do that, right now just trying to remove it and do this over again. so i'm in the root shell, but still cant seem to remove it.. (see attached). am i typing the wrong thing or need to do something before doing this?
[Fire HD 8 and HD 10 General] :
You don't need root to uninstall a user app unless you installed it to system far as i know.

adb uninstall <app package name>

---------- Post added at 05:56 PM ---------- Previous post was at 05:56 PM ----------

may even want to see if there is a command you can run to reset data possibly, not sure
[Fire HD 8 and HD 10 General] geminihc:
uh oh.. looks like i might have bricked my hd8 as i went maybe too hard in deleting supersu. i was in root, and i went to system/xbin and deleted su , supolicy and daemonsu (these were files that i saw in the script being copied), so i thought it was ok to delete them. but i guess not..

my tab is now permanently stuck at the "FIRE" logo, even after wiping data/factory reset at the recovery menu.
[Fire HD 8 and HD 10 General] :
Ya, you def didn't want to do that. Your problem was the apk, not the binaries and such. Out of curiosity(havent messed with fire tablets since 5th gen) is your bootloader unlocked? is twrp possible? can all the security be patched out? can you flash modified kernel?

You will most likely need to start over and recover to stock. If twrp is possible and you guys dont have twrp, i could try to port one if you want?
[Fire HD 8 and HD 10 General] geminihc:
no the bootloader isnt unlocked, i dont think its possible with the 6th gen hd8 . i hope i can start over some how...

fixed: by sideloading firmware.. now to do it again.

does this work on the latest fire OS firmware?
[Fire HD 8 and HD 10 General] MontysEvilTwin:
You can do an ADB sideload of the software from recovery mode. Download the latest software for your tablet, or a version no earlier than the one you have installed, and place it the same folder as your adb files on your PC. Shut down your tablet by holding down the power button until it switches off, then hold down the the left volume button and power buttons at the same time to enter recovery mode. Select the adb sideload option, plug in the usb cable and issue the command 'adb sideload filename.bin' to reload the software: it may take about twenty minutes to complete. Then you will have to reroot and install SuperSU again.
[Fire HD 8 and HD 10 General] geminihc:
thank you so much, so yes i'm doing this AGAIN, fresh start :) so i recovered it with the latest amazon firmware , and i ran the latest mtk-su_r9 script and got this screen. am i rooted now?
[Fire HD 8 and HD 10 General] MontysEvilTwin:
You have a root shell, but you will still have to copy the su binary etc. into xbin and set permissions before installing the SuperSU app. There is a link in the first post in this thread that tells you how to do it.
[Fire HD 8 and HD 10 General] geminihc:
thanks, seems like somehting isnt right though. eventho it looks like i'm in root, all of the commands needed to do supersu says permission denied
[Fire HD 8 and HD 10 General] geminihc:
i have the exact same issue here, what exactly did the SEMIAUTOMATEDROOT do to fix your permission denied? did you simply run it..? v2.1?

i'm very stuck at this stage

---------- Post added at 05:03 AM ---------- Previous post was at 04:36 AM ----------

OK, i fixed that issue. I hope i am contributing to others who are also having "permission denied" issue, which seems to be the same as SUPERSU saying "root undetected". This is what i did:

the KEY was to spam "./mtk-su -c" ,if someone could explain why that worked, that would be great :)

Setting selinux_enforce

Switched selinux to permissive

starting /system/bin/sh

root@giza:/data/local/tmp # ls

ls

opendir failed, Permission denied

255|root@giza:/data/local/tmp # su

su

/system/bin/sh: su: not found

127|root@giza:/data/local/tmp # mount -o remount -rw /system

mount -o remount -rw /system

mount: Permission denied

255|root@giza:/data/local/tmp # mtk-su -c

mtk-su -c

/system/bin/sh: mtk-su: not found

127|root@giza:/data/local/tmp # ./mtk-su -c

./mtk-su -c

New UID/GID: 0/0

root@giza:/data/local/tmp #

root@giza:/data/local/tmp # mount -o remount -rw /system

mount -o remount -rw /system

root@giza:/data/local/tmp # cp /data/local/tmp/su /system/xbin/su

cp /data/local/tmp/su /system/xbin/su

root@giza:/data/local/tmp # cp /data/local/tmp/su /system/xbin/daemonsu

cp /data/local/tmp/su /system/xbin/daemonsu

root@giza:/data/local/tmp # cp /data/local/tmp/supolicy /system/xbin/

cp /data/local/tmp/supolicy /system/xbin/
[Fire HD 8 and HD 10 General] :
Why don't you guys post some outputs so others can take a look. easier to point out stuff when we can see what's going on.

This is unrelated but I would like to share some info I have garnered from various forms of testing and such. I know a guy with a newer alcatel brazilian only model running android 6. We have been trying to get into the phone for a while. mtk-su was the way in to begin with. since it's a newer phone, it has decent security. system somehow gets mounted to zram so any changes made to system get erased at boot. System is ro and can't be changed perm as of yet. A script was created that basically spams mount system rw, which allows a few second gaps of system being rw, long enough to push some supersu files and start the daemon. Now, pushing strictly supersu files and then opening supersu will get the update binary request, which does not complete, and canceling the update still doesnt allow the installed su binary to work, so no temp root. Basically supersu is a no go. Now fast forward ahead a bit of time., and this is what the process is looking like.

Use mtk-su to grant ADB shell temp root

run the script for system rw from that temp root adb shell

squeeze the supersu files minus su to their locations using the small system rw gaps and also rename mtk-su to su and push that where it goes

give those pushed files correct permissions

start the su daemon

Temporary Paydirt!!

you now have temp root on a ro system, locked bootloader, all security in place. You are bypassing the need for supersu all together as you have temp root that doesnt ask for permission. any app that wants root gets it automatically.

that makes a guy wonder what flashfire would do, could you flash proper supersu that way and have it be systemless?

can you run selinux switch and have selinux be permissive

on a non zram system setup, could you gain perm root by not having system reloaded every time

could you somehow get to and mount the real system(location of real system is known: mblck25 or something) on a zram system setup and then gain perm root

Anyways, this is just something that's been banging around in my head, slowly spilling out, with small strides being made. Alot of testing still needs to be done, the process tweaked and refined and alot of sleepless nights i'm sure. I know none of this pertains to the fire models but it does pertain to mtk-su and android hacking in general. Any thoughts, opinions, ideas, help is surely welcomed.
[Fire HD 8 and HD 10 General] bigrammy:
Android 6 did alcatel really go that deep for this device :confused:

The way I see things.

mtk-su is perfect for MTK devices that do not support SPFlashTool Like Sony, HTC, LG + Others that removed it's support or required a security file for it to be enabled.

All that's really required is a way to pull and push the boot.img, recovery.img, (dd) pull the fstab.xxxx of system/vendor /nvdata (Depending on Android version and OEM implementation) (cp)

So you could run Magisk on the stock boot.img (compile TWRP recovery if possible) edit the system and nvdata side fstab's dd back the .img's and cp or mv back the fstab's then your done.

If you have a TWRP you ported you may need to format /data unless you can get it working with encrypted data.

Works like this on most of my MTK devices but could be different for other OEM's
[Fire HD 8 and HD 10 General] diplomatic:
If you're getting permission denied errors, you do not need to "spam" mtk-su. (In fact, I would advise against ever spamming mtk-su.) This has been answered in the FAQ section almost since the beginning:

So if you're ever stuck with lack of permissions, calmly exit your current shell, then simply press the up key to call up your last command and Enter to run mtk-su again. Problem solved. You don't need the '-c' switch. That was just a coincidence. (Actually, I guess it ran a "nothing" command).
[Fire HD 8 and HD 10 General] diplomatic:
Yeah, good point. Editing the boot image would be the best way to get permanent root. But the catch is that it's risky. The bootloader must not be so locked down that it doesn't have support for unsigned or self-signed images, aka red state or yellow state. And if it doesn't boot your modified image, you have to have some way to restore the original from an outside channel. Usually, that means having a stock firmware ZIP and access to the recovery, because you won't have access to 'fastboot flash' of course.

I think the safest way to test the bootloader is to edit & flash the stock recovery image and try to boot to recovery. If that fails, your phone will just reboot to Android and restore the stock recovery automatically. But if it succeeds, that means you will be able to boot a modified boot image in theory. But there is still a risk because if you mess up the boot.img, you still have to restore the original somehow...