[Milestone 2 Android Development] r2beta0:
Credit for koush for Droid2 Bootstrap

Credit for edgardcastro for sharing lots of information about 2nd-boot on Milestone1

Credit for Skrilax_CZ for 2nd-init and sh hijack

If you just want to install 2nd-init on your phone you can skip the whole guide and flash update-2nd-init.zip into your phone. As usual I will not hold responsibility to any damages it may cause.

WARNING: Use this ONLY if you know exactly what you are doing. This guide will make major changes in the /system partition and may turn the phone inoperative. I won’t hold responsibility if you brick your phone or to any damages it may cause.

Pre-requisites: A computer with Android SDK and ADB drivers installed and working. It’s recommended to have RSD Lite 4.9 and the appropriate SBF image just in case anything goes wrong.

This guide was made using a Brazilian Motorola Milestone2 based on Brazil Retail SBF and a computer running Windows Vista 32-bits. I started it from the scratch by flashing my phone with RSD Lite 4.9 and performing a full data/cache wipe, just to make sure any changes were discarded.

Note: Commands that should be entered in command prompt will be listed as: “C:\> <command>”. Commands issued to ADB Shell will be listed as: “# <command>”.

1. Enable USB Debugging on your phone;

2. Get permanent root. I used the app z4root which can be found here on XDA;

3. Install Droid2 Bootstrap. It may be downloaded from Market to support the developer. More info here http://www.koushikdutta.com/2010/08/droid-x-recovery.html;

4. Open Droid2 Bootstrap and click “Bootstrap Recovery”;

5. Use bootstrap to reboot into Clockwork Recovery and backup your phone;

6. Reboot;

7. C:\> adb remount

8. # stop

9. # mkdir /system/etc/rootfs

10. # cp /*.rc /system/etc/rootfs

11. # mkdir /system/etc/init.d

12. # cp /system/bin/sh /system/bin/_sh

13. # cp /init_prep_keypad.sh /system/bin

14. C:\> adb push sh_hijack.sh /system/bin/

15. C:\> adb push 2nd-init /system/bin/

16. C:\> adb push sysinit /system/bin/

WARNING: at this point you should keep a terminal window (adb shell) opened before replacing the 'sh' binary. This is so because you wont be able to open a new abd shell window to run the chmod command.

17. C:\> adb push sh /system/bin/

18. # chmod 755 /system/bin/sh

19. # chmod 755 /system/bin/sh_hijack.sh

20. # chmod 755 /system/bin/2nd-init

21. # chmod 755 /system/bin/sysinit

22. # ln -s /system/bin/busybox /system/xbin/mount

23. # ln -s /system/bin/busybox /system/xbin/rmdir

24. # ln -s /system/bin/busybox /system/xbin/cp

25. # ln -s /system/bin/busybox /system/xbin/umount

26. # ln -s /system/bin/busybox /system/xbin/run-parts

27. # reboot

28. At this point you should be getting into Clockwork Recovery every time, no matter how many times you have rebooted or if you’ve taken the battery of or not. THIS IS NORMAL. It means that the 2nd-boot + sh hijack is working as it should. The boots into clock recovery are caused by a conflict between sh hijack and logwrapper hijack (used by Droid2 Bootstrap). Continue the guide to fix this issue.

29. In clock recovery menu go to: mounts and storage>mount /system;

30. Open ADB Shell again (it will be available in clockwork recovery as well);

31. # cp /system/bin/logwrapper.bin /system/bin/mylogwrapper

32. C:\> adb pull /system/etc/rootfs/

33. Open init.rc and init.mapphone_umts.rc into a text editor that preserves unix end-line format (e.g.: notepad++). Find all entries of “/system/bin/logwrapper” replacing for “/system/bin/mylogwrapper”.

34. In init.mapphone_umts.rc find entry for “exec /init_prep_keypad.sh” replacing for “exec /system/bin/init_prep_keypad.sh”. Add the following text to the end of this file to be able to run all scripts in /system/etc/init.d at boot time:

service bootscripts /system/bin/sysinit
class post-zygote_services
disabled
oneshot

35. Save and close.

36. C:\> adb push init.rc /system/etc/rootfs/

37. C:\> adb push init.mapphone_umts.rc /system/etc/rootfs/

38. # chmod 755 /system/etc/rootfs/init.rc

39. # chmod 755 /system/etc/rootfs/init.mapphone_umts.rc

40. Choose “Reboot system now” in clock recovery menu;

You’re all set! Now it is just a matter of changing the rc files in /system/etc/rootfs to customize your system boot.

If you want to log the system boot you may also copy the provided log-init.sh script into /system/etc/rootfs and uncomment the line “exec /log_init.sh” from my init.rc file. Doing so will create the /data/logcat.log file that may get huge in sometime.

2nd-init files and my modified *.rc files attached.

Have fun!

UPDATED to version 2.0.0 (froyo) this version exploits /system/bin/mount_ext3.sh instead of sh binary. It's a new method I developed in order of starting 2nd-init earlier but also keeping compatibility with Droid2bootstrapper (recovery takes place first). This might help me booting Leaked GB from 2nd-init, which wasn't possible on the previous version. Take note it's not ready yet to apply on GB.