How to: Root Eken M009F step by step (IMAGE HEAVY)

[terratek]

jrivera09:
I understand that much, but in a previous post you said:

Here is some info on the Ipaq connector, pins used
1,2,4,23,24

any chance you can elaborate on what those pins are used for on this tablet?

southoz:
unsure, but is mtd0 "ramdisk" the uboot? any chance you can dump it and look for hex 27 05 19 56 in the output?
cat /dev/mtd/mtd0 > /sdcard/mtd0.img (or similar to wherever you have the most free space)

nevermind, talked to tv, u0 is only available in a full update or via console. my console experiments yielded nothing, and searching found others with similar issues. waiting for a call back from seller to provide me with info on their supplier.... not holding my breath though, they probably took my number to call block me in the future :P

[southoz]

Yes the ramdrive.img was a uboot/PPC ramdisk.img with the uboot header and the additonal ARM bytes, once stripped I was able to deflate with gzip and then use cpio to extract the file structure and files. Now I have to try and put it back together with the required files.

I know there is space as I backed it up with cat /dev/mtd/mtd0 > /sdcard/sdcard2/mtd0.img and it came out as 2048 Kb and when hexedited it is the original ramdrive.img 166K but padded with FF in each byte out to the 2MB.

Tree of extracted files

Code: [Select]

adrian@ubuntu:~/temp/extract$ tree -L 5
.
|-- data
|-- default.prop
|-- dev
|-- init
|-- init.goldfish.rc
|-- init.rc
|-- proc
|-- sbin
|   |-- adbd
|   |-- emuinit
|   `-- HDMI
|-- sys
`-- system


In init.rc there is a line that is indicating that adbd is disabled - this might explain whats up with adb not working?

Code: [Select]

# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
    disabled

# adbd on at boot in emulator
on property:ro.kernel.qemu=1
    start adbd

on property:persist.service.adb.enable=1
    start adbd

on property:persist.service.adb.enable=0
    stop adbd

Take note the mtd6 directory is missing the ubiblk0 directory found in the gingerbread rom that the internal usb mounts with. This is where I need to shove the folder in the Froyo rom

Code: [Select]

$ ls /sys/devices/virtual/mtd/mtd6
uevent
dev
subsystem
type
flags
size
erasesize
writesize
subpagesize
oobsize
numeraseregions
name
power
mtdblock6
$ ls /mnt/emu
lost+found
$

[terratek]

so basically, for now, we are at clusterf*** status

just ripped apart the ramdisk from the m009f eken file..

default.prop
ro.debuggable=0
persist.service.adb.enable=0

adbd is in the sbin directory though, so it looks like everything is there to enable adb access, it's just disabled on this image

and from init.rc

Code: [Select]

# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
    disabled

# adbd on at boot in emulator
on property:ro.kernel.qemu=1
    start adbd

on property:persist.service.adb.enable=1
    start adbd

on property:persist.service.adb.enable=0
    stop adbd

service vold /system/bin/vold
    socket vold stream 0660 root mount
    ioprio be 2

service servicemanager /system/bin/servicemanager
    user system
    critical
    onrestart restart zygote
    onrestart restart media

service netd /system/bin/netd
    socket netd stream 0660 root system

service debuggerd /system/bin/debuggerd
pretty sure you already looked at this, just tossing it in for doc purposes... am still hoping to get the real firmware from these people at some point... if i don't hear back from them by friday, will call them again and see if any progress has been made.

wish i had my tablet here so i could at least get to the point you are at and mess with it a bit over here. good news is, i emailed the person borrowing the tablet and got a response, which means it is not sitting at the bottom of the gulf of mexico...

[southoz]

Check previous post I have amended at the same time you posted.

[terratek]

and this is where having my tablet would come in handy...

from the looks of it, we need to

change 0's to 1

change a bit of init.rc

rebuild file, and attempt a flash..

getting adb working obviously is not an end all solution, but may make it a bit easier to change things in realtime and work on the other issues.

let me know if you want me to do the edits and try to rebuild the file into a flashable img

[southoz]

I have got it back into the .cpio.gz format (have made the debug changes - wasn't sure about disabled so I have changed it to enabled in the init.rc and changed them to 1's in the prop) , should I simply append the original header I removed to the new file or is there a convoluted process for turning it back in the uboot/PPC image?

[terratek]

change 0's to 1 in default.prop (leave mock location 0)
change ro.secure=1 to 0  (this should enable console debugging, which in turn should enable serial out)

in init.rc change

service adbd /sbin/adbd
    disabled

to

service adbd /sbin/adbd
    enabled

i tried burning the ramdisk to a phone i have without the header, it worked... but, no clue on this tablet, so i would say save it in gz format, copy it, hexedit append the original header, and try them both... burning tools should just fail if it doesn't like the format

[southoz]

Here is where I am at:

Code: [Select]

./test.sh ramdisk.img
Checking for uImage magic word...
1+0 records in
0+1 records out
4 bytes (4 B) copied, 0.000142388 s, 28.1 kB/s
uImage recognized.
Extracting data...
2654+1 records in
331+1 records out
169919 bytes (170 kB) copied, 0.0294715 s, 5.8 MB/s
Checking for ARM mach-type...
3+0 records in
0+1 records out
3 bytes (3 B) copied, 0.000125597 s, 23.9 kB/s
Checking for zImage...
1+0 records in
0+1 records out
4 bytes (4 B) copied, 0.000137923 s, 29.0 kB/s
>>> ramdisk.img extracted to Image
adrian@ubuntu:~/M009F$ ls
Image  ramdisk.img  test.sh
adrian@ubuntu:~/M009F$ mv Image ramdisk.cpio.gz
adrian@ubuntu:~/M009F$ ls
ramdisk.cpio.gz  ramdisk.img  test.sh
adrian@ubuntu:~/M009F$ gzip -d ramdisk.cpio.gz
adrian@ubuntu:~/M009F$ ls
ramdisk.cpio  ramdisk.img  test.sh
adrian@ubuntu:~/M009F$
adrian@ubuntu:~/M009F$ mkdir extract
adrian@ubuntu:~/M009F$ cd extract
adrian@ubuntu:~/M009F/extract$ cpio -i -F ../ramdisk.cpio
538 blocks
adrian@ubuntu:~/M009F/extract$ ls
data          dev   init.goldfish.rc  proc  sys
default.prop  init  init.rc           sbin  system

Make changes and copy folder structure for the ubiblk0 folder

adrian@ubuntu:~/M009F/extract$ find -print | cpio -o -H newc -O ../ramdisk3.cpio

558 blocks
adrian@ubuntu:~/M009F/extract$ cd ..
adrian@ubuntu:~/M009F$ ls
extract  ramdisk2.cpio  ramdisk3.cpio ramdisk.cpio  ramdisk.img  test.sh  ubiblk0


[terratek]

not seeing any real issues, but i didn't try including a new dir/files

the command i used was
find . | cpio -o -H newc | gzip > ../ramdisk2.cpio.gz
cd ../
mv ./ramdisk2.cpio.gz /mnt/disk7/ramdisk.img
(disk 7 being my thumbdrive, working from memory as i am on win7 atm)

rebooted, duplicated the file and added the original header, then flashed it. both vers flashed, so.. may just be a wacky phone on my end (waterdamaged mytouch used for dev purposes)

[southoz]

Had to change file name from Ramdisk3.cpio to Image but it still fails with or without a header - so you don't have to boot into OS the tablet will go straight into Please pull out OTG line and restart after it finishes burning filesystem for system.img normally it also shows burning hRamdisk.

Next I will try just flipping the bits in default.prop so there is no change in the filesize - should be able to start the adbd from su as disabled is one byte more than enabled. Might be able to mount the correct mnt as rw from adb shell.

No luck and I assume is is because using the -H newc yeilds 539 blocks, where the original is 538

Tried odc format - 538 blocks - no luck

adrian@ubuntu:~/M009F$ file Image.cpio
Image.cpio: ASCII cpio archive (SVR4 with no CRC)

so newc is correct

Code: [Select]

adrian@ubuntu:~/M009F$ mkimage -T ramdisk -C gzip -n 'uRamdisk' \
> -d Image uRamdisk
Image Name:   uRamdisk
Created:      Wed Feb  1 20:03:54 2012
Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
Data Size:    170665 Bytes = 166.67 kB = 0.16 MB
Load Address: 0x00000000
Entry Point:  0x00000000
No Luck

Edited default.prop and init.rc - changes saved but are not persistant

From terminal su and start adbd - now when switched into debug mode the debug comes up at the top of the screen however still shows as USB Mass Storage in windows

[terratek]

Have you tried switching out drivers once it is in debug mode?

As for failed burn, the only thing i can think of is something in the header.. I compared two diff ramdisk.img files for the device, while the start of file and padding/start of gzip are the same, the rest is a bit diff.

Code: [Select]

27 05 19 56
58 D3 FA EF 4E C9 FB 3F
00 02 59 27 41
00 00 00 41 00 00 00
5C 5D 70 85
05 02 03 00 68 52 61 6D 64 69 73 6B
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 8B

Code: [Select]

27 05 19 56
05 64 09 F6 4E E5 C8 B4
00 02 B1 89 41
00 00 00 41 00 00 00
9A CB 85 12
05 02 03 00 68 52 61 6D 64 69 73 6B
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 8B
working on a truck right now, so will be in and out throughout the day.

[southoz]

Using Google Drivers as a starting point. Modification required to install Android ADB

Code: [Select]

;MID M009FClone
%SingleAdbInterface% = USB_Install, USB\VID_18D1&PID_1FD7
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_1FD7&MI_00
On a side note Chainfire3D has a open market option which has added some paid apps.


Update: While on the surface it looks like its working adb devices returns nil, the services list doesn't show adbd when using service check adbd is indicates not found. Any idea on how to get the adbd service to run from terminal?

[terratek]

easiest way is to remove drivers, then use superoneclick to force driver install

as for the adbd issue, thats just friggin odd.. you can always try it over wireless if it is just a usb issue..

turn on debugging, hit the terminal
su
setprop service.adb.tcp.port 5555
stop adbd
start adbd

then in win
cmd
cd to the folder with adb
adb connect android.ip.addy:5555

or grab (i think) adb wireless from the market

sorry for the long delay, finished working on the truck for the day, came in, router was dead, had to call around and find a replacement. on the plus side, picked up a buffalo, flashed it with dd-wrt, and all is well again, plus my voip is working better than ever :P

[southoz]

adbd is not running as a service therefore cannot be stopped and restarted, need to figure out how to get it running as a service.

[terratek]

no clue if this will work

setprop persist.service.adb.enable 1

[southoz]

Nope, also Gyro is not working - while it can be rooted this room needs a lot of work I think I will flash back to Gingerbread and work on the Ramdisk.img as this is not going anywhere.

[terratek]

After looking over everything, and i may be wrong, we will probably have to install uboot-mkimage to get anywhere with that. If you get to it before I do, run mkimage -l ramdisk.img to get the load and entry. I was planning on working on it a bit more after I source some parts for the dev comp, getting tired of dual booting.

[southoz]

Device was making some HDD like noises (that are now gone with Gingerbread) and with no moving parts I was getting a little concerned.

In Summary - Froyo

Pro
Working USB Mass Storage and Debug (just no debug daemon running)
Can be Rooted with Z4 Root
More Free Memory so runs better.

Cons
No internal SD (sdcard2 directory needed to be created each reboot) due to missing drivers (void.fstab could be overwritten)
No Gyro
Bad Noises
Crashes when it goes to sleep.

That's it below now have full control over ramdisk.img - thanks to Preceptor for pointing out that the compression byte is 0 not 1 - those silly Chinese programmers. Will look at it tomorrow in more detail and see if we can get gingerbreak working.

Code: [Select]

adrian@ubuntu:~/M009F$ ./mkbootfs extract > Image
adrian@ubuntu:~/M009F$ file Image
Image: ASCII cpio archive (SVR4 with no CRC)
adrian@ubuntu:~/M009F$ gzip -c Image > Image.gz
adrian@ubuntu:~/M009F$ rm Image
adrian@ubuntu:~/M009F$ mv Image.gz Image

adrian@ubuntu:~/M009F$ mkimage -A arm -T ramdisk -C none -a 0x41000000 -e 0x41000000 -n 'uRamdisk' \
> -d Image ramdisk.img
Image Name:   uRamdisk
Created:      Fri Feb  3 04:11:34 2012
Image Type:   ARM Linux RAMDisk Image (uncompressed)
Data Size:    154841 Bytes = 151.21 kB = 0.15 MB
Load Address: 0x41000000
Entry Point:  0x41000000
With the Gingerbread ramdisk.img any files / folders - except root that exist in other images ie system are not show so for example default.prop is persistent but init.rc is not

Put busybox su and superuser.apk in root - they appear but their permissions have changed

 

[terratek]

in default.prop, is ro.secure set to 0 or 1?
haven't tried this as my device will be back tomorrow (hopefully), if you create a bin directory under system and toss a file in it (even a blank test file) will it show up on the device after boot?
for the su binary, latest ver? if so what did the permissions and owner/group change to?

[southoz]

Yes I have modified default.prop and that is persistent. The files I put in root are there but there permissions have changed -  I will try the bin shortly.

My major concern is init.rc from ramdisk.img not being init.rc from the device root. The init.rc within device root looks to be the error out put of something. See below and you will get the picture. I suspect the are also significant errors in init.rc which are causing no end of problems.

From ramdisk.img with disable now enable on adbd.

Code: [Select]

on early-init
    start ueventd

on init

sysclktz 0

loglevel 3

# setup the global environment
    export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
    export LD_LIBRARY_PATH /vendor/lib:/system/lib
    export ANDROID_BOOTLOGO 1
    export ANDROID_ROOT /system
    export ANDROID_ASSETS /system/app
    export ANDROID_DATA /data
    export EXTERNAL_STORAGE /mnt/sdcard
    export ASEC_MOUNTPOINT /mnt/asec
    export LOOP_MOUNTPOINT /mnt/obb
    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar

# Backward compatibility
    symlink /system/etc /etc
    symlink /sys/kernel/debug /d

# Right now vendor lives on the same filesystem as system,
# but someday that may change.
    symlink /system/vendor /vendor

# create mountpoints
    mkdir /mnt 0775 root system
    #mkdir /mnt/sdcard 0000 system system
    #mkdir /udisk 0000 system system

# Create cgroup mount point for cpu accounting
    mkdir /acct
    mount cgroup none /acct cpuacct
    mkdir /acct/uid

# Backwards Compat - XXX: Going away in G*
    #symlink /mnt/sdcard /sdcard

    mkdir /system
    mkdir /data 0771 system system
    mkdir /cache 0770 system cache
    mkdir /config 0500 root root

    # Directory for putting things only root should see.
    mkdir /mnt/secure 0700 root root

    # Directory for staging bindmounts
    mkdir /mnt/secure/staging 0700 root root
    mkdir /mnt/secure/bgmount 0700 root root

    # Directory-target for where the secure container
    # imagefile directory will be bind-mounted
    mkdir /mnt/secure/asec  0700 root root

    # Secure container public mount points.
    mkdir /mnt/asec  0700 root system
    mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000

    #mount rootfs rootfs / ro remount
    # Filesystem image public mount points.
    mkdir /mnt/obb 0700 root system
    mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000

    write /proc/sys/kernel/panic_on_oops 1
    write /proc/sys/kernel/hung_task_timeout_secs 0
    write /proc/cpu/alignment 4
    write /proc/sys/kernel/sched_latency_ns 10000000
    write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
    write /proc/sys/kernel/sched_compat_yield 1
    write /proc/sys/kernel/sched_child_runs_first 0

# Create cgroup mount points for process groups
    mkdir /dev/cpuctl
    mount cgroup none /dev/cpuctl cpu
    chown system system /dev/cpuctl
    chown system system /dev/cpuctl/tasks
    chmod 0777 /dev/cpuctl/tasks
    write /dev/cpuctl/cpu.shares 1024

    mkdir /dev/cpuctl/fg_boost
    chown system system /dev/cpuctl/fg_boost/tasks
    chmod 0777 /dev/cpuctl/fg_boost/tasks
    write /dev/cpuctl/fg_boost/cpu.shares 1024

    mkdir /dev/cpuctl/bg_non_interactive
    chown system system /dev/cpuctl/bg_non_interactive/tasks
    chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
    # 5.0 %
    write /dev/cpuctl/bg_non_interactive/cpu.shares 52

# mount usbfs for 3G Dongle USB Driver
mount usbfs none /proc/bus/usb

on fs
# mount mtd partitions
    # Mount /system rw first to give the filesystem a chance to save a checkpoint
    mount yaffs2 mtd@system /system
    mount yaffs2 mtd@system /system ro remount
    mount yaffs2 mtd@userdata /data nosuid nodev
    mount yaffs2 mtd@cache /cache nosuid nodev

on post-fs
    # once everything is setup, no need to modify /
    #mount rootfs rootfs / ro remount

    # We chown/chmod /data again so because mount is run as root + defaults
    chown system system /data
    chmod 0771 /data

    # Create dump dir and collect dumps.
    # Do this before we mount cache so eventually we can use cache for
    # storing dumps on platforms which do not have a dedicated dump partition.
   
    mkdir /data/dontpanic
    chown root log /data/dontpanic
    chmod 0750 /data/dontpanic

    # Collect apanic data, free resources and re-arm trigger
    copy /proc/apanic_console /data/dontpanic/apanic_console
    chown root log /data/dontpanic/apanic_console
    chmod 0640 /data/dontpanic/apanic_console

    copy /proc/apanic_threads /data/dontpanic/apanic_threads
    chown root log /data/dontpanic/apanic_threads
    chmod 0640 /data/dontpanic/apanic_threads

    write /proc/apanic_console 1

    # Same reason as /data above
    #mount yaffs2 mtd@cache /cache nosuid nodev
    chown system cache /cache
    chmod 0770 /cache

# Mount user NAND partition
#    mkdir /mnt/emu
#    mount yaffs2 mtd@Local-disk /mnt/emu nosuid nodev
#    chown system system /mnt/emu
#    chmod 0777 /mnt/emu
   
    mkdir /mnt/sdcard
    chown system system /mnt/sdcard
    chmod 0777 /mnt/sdcard
   
#mkdir /mnt/sdcard1 0000 system system
#mkdir /mnt/sdcard2 0000 system system
#mkdir /mnt/udisk1 0000 system system
#mkdir /mnt/udisk2 0000 system system

    # by rex
    symlink /mnt/sdcard /sdcard
#symlink /mnt/sdcard1 /sdcard1
#symlink /mnt/udisk1 /udisk1
#symlink /mnt/udisk2 /udisk2

    # This may have been created by the recovery system with odd permissions
    chown system cache /cache/recovery
    chmod 0770 /cache/recovery

    #change permissions on vmallocinfo so we can grab it from bugreports
    chown root log /proc/vmallocinfo
    chmod 0440 /proc/vmallocinfo

    #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
    chown root system /proc/kmsg
    chmod 0440 /proc/kmsg
    chown root system /proc/sysrq-trigger
    chmod 0220 /proc/sysrq-trigger

    #change permissions on cmdine
     chmod 0755 /proc/cmdline

# create basic filesystem structure
    mkdir /data/misc 01771 system misc
    mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
    mkdir /data/misc/bluetooth 0770 system system
    mkdir /data/misc/keystore 0700 keystore keystore
    mkdir /data/misc/vpn 0770 system system
    mkdir /data/misc/systemkeys 0700 system system
    mkdir /data/misc/vpn/profiles 0770 system system
# give system access to wpa_supplicant.conf for backup and restore
#    mkdir /data/misc/wifi 0770 wifi wifi
#    chmod 0770 /data/misc/wifi
#    chmod 0660 /data/misc/wifi/wpa_supplicant.conf

    mkdir /data/misc/wifi 0770 system system
    mkdir /data/misc/wifi/sockets 0770 system system
    mkdir /data/system/wpa_supplicant 0770 system system
    mkdir /data/misc/dhcp 0770 dhcp dhcp

    mkdir /data/misc/tscal 0770 system system

    chown dhcp dhcp /data/misc/dhcp
    chmod 0770 /data/misc/wifi
    chmod 0660 /data/misc/wifi/wpa_supplicant.conf

    mkdir /data/local 0771 shell shell
    mkdir /data/local/tmp 0771 shell shell
    mkdir /data/data 0771 system system
    mkdir /data/app-private 0771 system system
    mkdir /data/app 0771 system system
    mkdir /data/property 0700 root root

    # create dalvik-cache and double-check the perms
    mkdir /data/dalvik-cache 0771 system system
    chown system system /data/dalvik-cache
    chmod 0771 /data/dalvik-cache

    # create the lost+found directories, so as to enforce our permissions
    mkdir /data/lost+found 0770
    mkdir /cache/lost+found 0770

    # double check the perms, in case lost+found already exists, and set owner
    chown root root /data/lost+found
    chmod 0770 /data/lost+found
    chown root root /cache/lost+found
    chmod 0770 /cache/lost+found

on boot
# basic network init
    ifup lo
    hostname localhost
    domainname localdomain

# set RLIMIT_NICE to allow priorities from 19 to -20
    setrlimit 13 40 40

# Define the oom_adj values for the classes of processes that can be
# killed by the kernel.  These are used in ActivityManagerService.
    setprop ro.FOREGROUND_APP_ADJ 0
    setprop ro.VISIBLE_APP_ADJ 1
    setprop ro.PERCEPTIBLE_APP_ADJ 2
    setprop ro.HEAVY_WEIGHT_APP_ADJ 3
    setprop ro.SECONDARY_SERVER_ADJ 4
    setprop ro.BACKUP_APP_ADJ 5
    setprop ro.HOME_APP_ADJ 6
    setprop ro.HIDDEN_APP_MIN_ADJ 7
    setprop ro.EMPTY_APP_ADJ 15

# Define the memory thresholds at which the above process classes will
# be killed.  These numbers are in pages (4k).
    setprop ro.FOREGROUND_APP_MEM 2048
    setprop ro.VISIBLE_APP_MEM 3072
    setprop ro.PERCEPTIBLE_APP_MEM 4096
    setprop ro.HEAVY_WEIGHT_APP_MEM 4096
    setprop ro.SECONDARY_SERVER_MEM 6144
    setprop ro.BACKUP_APP_MEM 6144
    setprop ro.HOME_APP_MEM 6144
    setprop ro.HIDDEN_APP_MEM 7168
    setprop ro.EMPTY_APP_MEM 8192

# Write value must be consistent with the above properties.
# Note that the driver only supports 6 slots, so we have combined some of
# the classes into the same memory level; the associated processes of higher
# classes will still be killed first.
    write /sys/module/lowmemorykiller/parameters/adj 0,1,2,4,7,15

    write /proc/sys/vm/overcommit_memory 1
    write /proc/sys/vm/min_free_order_shift 4
    write /sys/module/lowmemorykiller/parameters/minfree 2048,3072,4096,6144,7168,8192

    # Set init its forked children's oom_adj.
    write /proc/1/oom_adj -16

    # Tweak background writeout
    write /proc/sys/vm/dirty_expire_centisecs 200
    write /proc/sys/vm/dirty_background_ratio  5

    # Permissions for System Server and daemons.
    chown radio system /sys/android_power/state
    chown radio system /sys/android_power/request_state
    chown radio system /sys/android_power/acquire_full_wake_lock
    chown radio system /sys/android_power/acquire_partial_wake_lock
    chown radio system /sys/android_power/release_wake_lock
    chown radio system /sys/power/state
    chown radio system /sys/power/wake_lock
    chown radio system /sys/power/wake_unlock
    chmod 0660 /sys/power/state
    chmod 0660 /sys/power/wake_lock
    chmod 0660 /sys/power/wake_unlock
    chown system system /sys/class/timed_output/vibrator/enable
    chown system system /sys/class/leds/keyboard-backlight/brightness
    chown system system /sys/class/leds/lcd-backlight/brightness
    chown system system /sys/class/leds/button-backlight/brightness
    chown system system /sys/class/leds/jogball-backlight/brightness
    chown system system /sys/class/leds/red/brightness
    chown system system /sys/class/leds/green/brightness
    chown system system /sys/class/leds/blue/brightness
    chown system system /sys/class/leds/red/device/grpfreq
    chown system system /sys/class/leds/red/device/grppwm
    chown system system /sys/class/leds/red/device/blink
    chown system system /sys/class/leds/red/brightness
    chown system system /sys/class/leds/green/brightness
    chown system system /sys/class/leds/blue/brightness
    chown system system /sys/class/leds/red/device/grpfreq
    chown system system /sys/class/leds/red/device/grppwm
    chown system system /sys/class/leds/red/device/blink
    chown system system /sys/class/timed_output/vibrator/enable
    chown system system /sys/module/sco/parameters/disable_esco
    chown system system /sys/kernel/ipv4/tcp_wmem_min
    chown system system /sys/kernel/ipv4/tcp_wmem_def
    chown system system /sys/kernel/ipv4/tcp_wmem_max
    chown system system /sys/kernel/ipv4/tcp_rmem_min
    chown system system /sys/kernel/ipv4/tcp_rmem_def
    chown system system /sys/kernel/ipv4/tcp_rmem_max
    chown root radio /proc/cmdline

#add by bob
    chmod 644 /system/usr/keychars/qwerty.kcm.bin
    chmod 666  /dev/memalloc
    chmod 666 /dev/imapx200-vdec
    chmod 666 /dev/HDMI
    chmod 777 /dev/asysops
    chmod 777 /dev/icam0
    chmod 777 /dev/shm_so
    chmod 777 /dev/imapx200-camif
    chmod 777 /dev/graphics/fb0
    chmod 666 /dev/imapx200-venc
    chmod 666 /dev/soops
chmod 777 /dev/video0
    chown system.system /dev/memalloc
    chown system.system /dev/imapx200-vdec
    #chown system.system /dev/HDMI
    chown system.system /dev/asysops
    chown system.system /dev/shm_so
    chown system.system /dev/imapx200-camif
    chown system.system /dev/imapx200-venc
    chown system.system /dev/soops
chmod 777 /dev/video0

    chmod 0666 /dev/ttyUSB0
    chown radio radio /dev/ttyUSB0
    chmod 0666 /dev/ttyUSB1
    chown radio radio /dev/ttyUSB1
    chmod 0666 /dev/ttyUSB2
    chown radio radio /dev/ttyUSB2
    chmod 0666 /dev/ttyUSB3
    chown radio radio /dev/ttyUSB3
    chmod 0666 /dev/ttyUSB4
    chown radio radio /dev/ttyUSB4
    chmod 0666 /dev/ttyACM0
    chown radio radio /dev/ttyACM0
    chmod 0666 /dev/ttyACM1
    chown radio radio /dev/ttyACM1
    chmod 0666 /dev/ttyACM2
    chown radio radio /dev/ttyACM2
    chmod 0666 /dev/ttyACM3
    chown radio radio /dev/ttyACM3
    chmod 0666 /dev/ttyACM4
    chown radio radio /dev/ttyACM4
    chmod 0666 /dev/ttyHS0
    chown radio radio /dev/ttyHS0
    chmod 0666 /dev/ttyHS1
    chown radio radio /dev/ttyHS1
    chmod 0666 /dev/ttyHS2
    chown radio radio /dev/ttyHS2
    chmod 0666 /dev/ttyHS3
    chown radio radio /dev/ttyHS3
    chmod 0666 /dev/ttyHS4
    chown radio radio /dev/ttyHS4

#gps settings
    chmod 666 /dev/imapx200-gps
    chown system.system /dev/imapx200-gps

# Define TCP buffer sizes for various networks
#   ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
    setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
    setprop net.tcp.buffersize.wifi    4095,87380,110208,4096,16384,110208
    setprop net.tcp.buffersize.umts    4094,87380,110208,4096,16384,110208
    setprop net.tcp.buffersize.edge    4093,26280,35040,4096,16384,35040
    setprop net.tcp.buffersize.gprs    4092,8760,11680,4096,8760,11680

    class_start default

## Daemon processes to be run by init.
##
service ueventd /sbin/ueventd
    critical

service console /system/bin/sh
    console
#    disabled
#    user shell
#    group log

on property:ro.secure=0
    start console

# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
    enabled

# adbd on at boot in emulator
on property:ro.kernel.qemu=1
    start adbd

on property:persist.service.adb.enable=1
    start adbd

on property:persist.service.adb.enable=0
    stop adbd

service vold /system/bin/vold
    socket vold stream 0660 root mount
    ioprio be 2

service servicemanager /system/bin/servicemanager
    user system
    critical
    onrestart restart zygote
    onrestart restart media

service netd /system/bin/netd
    socket netd stream 0660 root system

service debuggerd /system/bin/debuggerd

#service ril-daemon /system/bin/rild
service ril-daemon /system/bin/rild -l /system/lib/libreference-ril.so
    socket rild stream 660 root radio
    socket rild-debug stream 660 radio system
    user root
    group radio cache inet misc audio sdcard_rw

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    socket zygote stream 666
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

service media /system/bin/mediaserver
    user media
    group system audio camera graphics inet net_bt net_bt_admin net_raw
    ioprio rt 4

service bootanim /system/bin/bootanimation
    user graphics
    group graphics
    disabled
    oneshot

service dbus /system/bin/dbus-daemon --system --nofork
    socket dbus stream 660 bluetooth bluetooth
    user bluetooth
    group bluetooth net_bt_admin

service bluetoothd /system/bin/bluetoothd -n
    socket bluetooth stream 660 bluetooth bluetooth
    socket dbus_bluetooth stream 660 bluetooth bluetooth
    # init.rc does not yet support applying capabilities, so run as root and
    # let bluetoothd drop uid to bluetooth with the right linux capabilities
    group bluetooth net_bt_admin misc
    disabled

service hfag /system/bin/sdptool add --channel=10 HFAG
    user bluetooth
    group bluetooth net_bt_admin
    disabled
    oneshot

service hsag /system/bin/sdptool add --channel=11 HSAG
    user bluetooth
    group bluetooth net_bt_admin
    disabled
    oneshot

service opush /system/bin/sdptool add --channel=12 OPUSH
    user bluetooth
    group bluetooth net_bt_admin
    disabled
    oneshot

service pbap /system/bin/sdptool add --channel=19 PBAP
    user bluetooth
    group bluetooth net_bt_admin
    disabled
    oneshot

service installd /system/bin/installd
    socket installd stream 600 system system

service flash_recovery /system/etc/install-recovery.sh
    oneshot

service racoon /system/bin/racoon
    socket racoon stream 600 system system
    # racoon will setuid to vpn after getting necessary resources.
    group net_admin
    disabled
    oneshot

service mtpd /system/bin/mtpd
    socket mtpd stream 600 system system
    user vpn
    group vpn net_admin net_raw
    disabled
    oneshot

service keystore /system/bin/keystore /data/misc/keystore
    user keystore
    group keystore
    socket keystore stream 666

service dumpstate /system/bin/dumpstate -s
    socket dumpstate stream 0660 shell log
    disabled
    oneshot

#service mountd /system/bin/mountd
#   socket mountd stream 0660 root mount

#service wpa_supplicant /system/bin/logwrapper /system/bin/wpa_supplicant -Dwext -ira0 -c /data/misc/wifi/wpa_supplicant.conf -dd
service wpa_supplicant /system/bin/wpa_supplicant -Dwext -iwlan0 -c /data/misc/wifi/wpa_supplicant.conf -dd
disabled
oneshot
#group system

#service dhcpcd /system/bin/logwrapper /system/bin/dhcpcd -d wlan0
#service dhcpcd /system/bin/logwrapper /system/bin/dhcpcd -d -B ra0
service dhcpcd /system/bin/dhcpcd -d -B wlan0
disabled
oneshot
#group system dhcp

#service dhcpcd1 /system/bin/logwrapper /system/bin/dhcpcd -d -B eth0
service dhcpcd1 /system/bin/dhcpcd -d -B eth0
disabled
oneshot

#on property:init.svc.wpa_supplicant=stopped
# stop dhcpcd

service gal /system/bin/inshal
oneshot

service emu /sbin/emuinit
oneshot

#This service is for HDMI feature on PAD
service HDMI /sbin/HDMI
oneshot

#service pppd_gprs /system/etc/init.gprs-pppd
# user root
# group radio cache inet misc
# disabled
# oneshot

###############################################################################
# Copyright (C), 2011-2012, Cathay Communication Co., LTD.
# usbdongle : 3G Dongle USB Driver
# Author    : Xu Lei
###############################################################################
service usbdongled /system/bin/usbdongled
user root
group radio cache inet misc
enabled
oneshot

service license /system/bin/permfd

service cpfile /system/bin/busybox cp /system/flash_player_20110406.apk /data/app/flash_player_20110406.apk
    oneshot
On device

Code: [Select]

Failed to open the file (java.io.IOException
at com.estrongs.android.pop.app.h.run(Unknown Source)
at java.lang.Thread.run(Thread.java:1019)
)
seriously if they could put together a decent firmware they would be dangerous, thinking of putting su etc into bin and move them with permissions using init.rc but I feel I need to put a debug marker in there to see where it is failing and throwing the above error but as usb is not working and I could not get 3G working it might be early

[terratek]

I have seen a very similar error before when playing with one of the phones. In my case it just ended up being a permission error, failed root so i couldn't read the file. Googled part of the error and it looks like some people have es file explorer throwing a similar error. Now that i think about it, i believe es was on the phone as well.

I'm going to call the supplier back and see if they ever picked up a copy of the right firmware.
If all goes well, they will be emailing me the firmware and uploading to the server.

[southoz]

Have su busybox and Superuser.apk in /bin - confirmed.

add the following lines to init.rc without luck before onboot.

Code: [Select]

  cp /usr/bin/su /system/bin/su
  cp /usr/bin/busybox /system/bin/busybox
  cp /usr/bin/Superuser.apk /system/app/Superuser.apk
  chmod 0777 /system/bin/su
  chmod 0777 /system/bin/busybox
  chmod 0777 /system/apps/Superuser.apk

My screw up its in android init language

Code: [Select]

  service cpfile /system/bin/busybox  cp /usr/bin/su /system/bin/su
  service cpfile /system/bin/busybox  cp /usr/bin/busybox /system/bin/busybox
  service cpfile /system/bin/busybox  cp /usr/bin/Superuser.apk /system/app/Superuser.apk
  chmod 0777 /system/bin/su
  chmod 0777 /system/bin/busybox
  chmod 0777 /system/apps/Superuser.apk
nope - 1000 monkeys at 1000 typewriters

you are right it is an ES issue - the filesizes match on my linux box and within OS and change when I make changes to init.rc so it is persistent.

[terratek]

no luck on the real firmware yet, emailed them this time, figure if i am enough of a pita they will either block me completely or supply the firmware. i'm kind of leaning towards ordering the capacitors to fix the monitor i scored for the linux box, fix it first, then if the firmware still hasn't shown up, start on the eken firmware.

it would give me some more time to research and figure out a starting point. plus we still don't know if the original firmware may be easier to mod (i'm leaning towards highly doubtable).

I will take a look at the init.rc in a few mins and see if anything jumps out and smacks me in the head.

[southoz]

Anyone got any links to the actual exploit that Gingerbreak uses (not how to use Gingerbreak but how the exploit works) so that I might try and craft the ramdrive.img/init.rc to be more Gingerbreak friendly while we wait.

Also no good

Code: [Select]

service cpfile /system/bin/busybox  cp /usr/bin/su /system/bin/su
    oneshot

service cpfile /system/bin/busybox  cp /usr/bin/busybox /system/bin/busybox
    oneshot

service cpfile /system/bin/busybox  cp /usr/bin/Superuser.apk /system/app/Superuser.apk
    oneshot

chmod 0777 /system/bin/su
chmod 0777 /system/bin/busybox
chmod 0777 /system/apps/Superuser.apk

[terratek]

this is the best writeup on it i have seen
http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/

I have the source for the apk, edited and ready to make 3 apks that ignore the searches in case our ver of 2.3.3 is actually the red headed child of froyo.. but... i kinda never made an apk before and the guy i was hoping would do it, hasn't..

[terratek]

i never bothered looking, is the power supply for this thing 5 or 9vdc?

[southoz]

Looking through the code it writes the files to /data/local/tmp/ this directory does not exist

PS is 5v 2A

Going to Add the directory to the ramdisk.img and see if it helps, it looks like they are making progress on the system.img also in the InfoTMIC file system thread.

No luck directory is empty once it boots, it would need to put into the system.img

[terratek]

welp, the supplier is now claiming they have 3 firmwares instead of 2 (e18, zt180, and one they haven't named)... as i specified it is not a zt180 or e18, not really sure why they haven't supplied the 3rd one yet...

i was about to suggest creating the dir and seeing what happens. (just read the update, that sucks)

i talked to the guy that was going to do the separate builds, he is having net issues and doesn't have eclipse configured for c++ yet. but, he is keeping up with the thread sporadically.

if the new firmware shows up, i will compare it to the eken firmware, if it is different, will upload it and link it... as long as it isn't another ext3 fs..

going to read over the other thread, it's been hectic here so haven't been keeping up as much as i should.

[terratek]

Southoz,
I have flashed the U0 from m009f as well as others and can confirm that the brick the device. I am now waiting for some assistance from the supplier as I can not find a U0 that will bring it back.
Is there anyone out there with a U0 file that will work on this device?

hopefully this is allowed... here is a link to the uimage i just got, if you have confirmed your tablet is the same one in this thread, and it is currently bricked, please try this.

http://www.filefactory.com/file/c246d9a/n/uImage

I have confirmed it is not using ext3, and have confirmed it is from a different image than the one we have been using.

-edit-

before anyone asks or thinks i am holding back firmware, only reason i released the uimage is to see if this is actually the right one for the device. as such, i need someone to test it on a bricked or partially bricked device...

IF it is the right one, i will up it to a host. if it is not, i will up it with some warnings about flashing it.

basically i don't want to jump the gun and say we finally have the stock firmware when we may not.

[southoz]

Unless we get more help I dont think we will be able to work with the system.img file, have tried ubifs, yaffs2 and jffs2 without luck. No one in the other thread is actively working on it and I am out of ideas.

Random notes:

Code: [Select]

install mtd-utils


sudo modprobe mtdblock
sudo modprobe nandsim first_id_byte=0x20 second_id_byte=0xac third_id_byte=0x00 fourth_id_byte=0x15 cache_file=/tmp/nandsim.bin
sudo modprobe ubi
sudo modprobe ubifs
sudo ubiformat /dev/mtd0
sudo ubiattach /dev/ubi_ctrl -m 0
sudo ubimkvol /dev/ubi0 -N system -s 184MiB
sudo ubiupdatevol /dev/ubi0_0 ~/M009F/gingerbread/system/system.img
sudo mount -t ubifs ubi0:system /mnt/ubi



[ 9782.682143] UBI: available PEBs:             2024
[ 9782.682221] UBI: total number of reserved PEBs: 24
[ 9782.682244] UBI: number of PEBs reserved for bad PEB handling: 20
[ 9782.682588] UBI: max/mean erase counter: 0/0
[ 9782.682615] UBI: image sequence number: 0
[ 9782.687571] UBI: background thread "ubi_bgt0d" started, PID 1998
[ 9927.442872] UBI error: ubi_create_volume: cannot create volume 0, error -28
[ 9993.400781] UBI error: ubi_create_volume: cannot create volume 1, error -17
[10284.723237] UBIFS error (pid 2050): ubifs_read_node: bad node type (0 but expected 6)
[10284.723267] UBIFS error (pid 2050): ubifs_read_node: bad node at LEB 0:0


sudo rmmod ubifs
sudo rmmod ubi
sudo rmmod nandsim
sudo rmmod mtdblock



adrian@ubuntu:~$ sudo modprobe nandsim first_id_byte=0x20 second_id_byte=0xac third_id_byte=0x00 fourth_id_byte=0x15 cache_file=/tmp/nandsim.bin
adrian@ubuntu:~$ dmesg | tail
[10751.440781] bits in sector size: 17
[10751.440793] bits in page size: 11
[10751.440805] bits in OOB size: 6
[10751.440821] flash size with OOB: 540672 KiB
[10751.440833] page address bytes: 5
[10751.450269] sector address bytes: 3
[10751.450293] options: 0x8
[10751.465667] Scanning device for bad blocks
[10751.472843] Creating 1 MTD partitions on "NAND 512MiB 1,8V 8-bit":
[10751.473381] 0x000000000000-0x000020000000 : "NAND simulator partition 0"

adrian@ubuntu:~$ sudo ubiformat /dev/mtd0
ubiformat: mtd0 (nand), size 536870912 bytes (512.0 MiB), 4096 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 4095 -- 100 % complete 
ubiformat: 4096 eraseblocks are supposedly empty
ubiformat: formatting eraseblock 4095 -- 100 % complete

adrian@ubuntu:~$ sudo ubiattach /dev/ubi_ctrl -m 0
UBI device number 0, total 4096 LEBs (528482304 bytes, 504.0 MiB), available 4052 LEBs (522805248 bytes, 498.6 MiB), LEB size 129024 bytes (126.0 KiB)

[11063.688224] UBI: max. allowed volumes:       128
[11063.688237] UBI: wear-leveling threshold:    4096
[11063.688250] UBI: number of internal volumes: 1
[11063.688266] UBI: number of user volumes:     0
[11063.688281] UBI: available PEBs:             4052
[11063.688295] UBI: total number of reserved PEBs: 44
[11063.688309] UBI: number of PEBs reserved for bad PEB handling: 40
[11063.688324] UBI: max/mean erase counter: 0/0
[11063.688339] UBI: image sequence number: 0
[11063.691280] UBI: background thread "ubi_bgt0d" started, PID 2108

adrian@ubuntu:~$ sudo ubimkvol /dev/ubi0 -N volume_name -s 184MiB
Volume ID 0, size 1496 LEBs (193019904 bytes, 184.1 MiB), LEB size 129024 bytes (126.0 KiB), dynamic, name "volume_name", alignment 1



modprobe mtd
modprobe yaffs2multi
modprobe mtdram
modprobe mtdchar
modprobe mtdblock
sudo dd if=~/M009F/gingerbread/system/system.img of=/dev/mtdblock0
sudo mount -t yaffs2 /dev/mtdblock0 /mnt/mtd

[  505.073064] yaffs: yaffs built Feb  5 2012 16:30:34 Installing.
[  508.954163] yaffs: dev is 32505856 name is "mtdblock0" rw
[  508.954190] yaffs: passed flags ""
[  508.954267] yaffs: yaffs: Attempting MTD mount of 31.0,"mtdblock0"
[  508.977010] yaffs: yaffs_read_super: is_checkpointed 0


sudo modprobe mtd
sudo modprobe jffs2
sudo modprobe mtdram
sudo modprobe mtdchar
sudo modprobe mtdblock
sudo dd if=~/M009F/gingerbread/system/system.img of=/dev/mtdblock0
sudo mount -t jffs2 /dev/mtdblock0 /mnt/mtd

[  429.706728] Empty flash at 0x06ae29fc ends at 0x06ae2b98
[  429.707114] Empty flash at 0x06ae4bb0 ends at 0x06ae4d4c
[  429.707194] Old JFFS2 bitmask found at 0x06ae63b4
[  429.707196] You cannot use older JFFS2 filesystems with newer kernels
[  429.707448] Empty flash at 0x06ae6d64 ends at 0x06ae6f00
[  429.707769] Empty flash at 0x06ae8f18 ends at 0x06ae90b4
[  429.708058] Empty flash at 0x06aeb0cc ends at 0x06aeb268
[  429.708308] Empty flash at 0x06aec630 ends at 0x06aed268
[  429.745907] Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
[  429.745933] empty_blocks 3297, bad_blocks 0, c->nr_blocks 4096