[DEV] Current Progress and Guides: CRACKED UBOOT!!! Roms and Kernels Comming Soon

CURRENT PROGRESS

adb connection: COMPLETE
adb root: COMPLETE
busybox:COMPLETE
permanent root: COMPLETE BY INDIRECT
GApps and Market: COMPLETE BY INDIRECT & Anlog
recovery mode: COMPLETE BY nemith

THANKS TO NEMITH

bootloader: Locked and Signed Irrelevant

uboot: CRACKED BY BAUWKS

THANKS TO BAUWKS
​

Loglud said:

bauwks method uses the flashing_boot.img to his advantage, and since it is not checked by security, effectively he has made an insecure uboot. While this is not an unlocked bootloader, it is a way to get around the security, and enable custom recovery and higher level processes to be run.

I have been looking at this line of code for a long time, and as im sure hkvc and bauwks saw it is a large (but 100% necessary) flaw:

distro/u-boot/board/omap4430sdp/mmc.c: 559 : setenv ("bootcmd", "setenv setbootargs setenv bootargs ${sdbootargs}; run setbootargs; mmcinit 0; fatload mmc 0:1 0x81000000 flashing_boot.img; booti 0x81000000");

Without this line of code, it would be impossible for any one but the factory whom could JTAG flash (but since it is secured, most likely they also have to make a flashing_boot.img).

Click to expand...

Click to collapse

1. 
   Install the andriod SDK that is required for your Operating system.
   
   NOTE: This will requries the SDK, and JDK both of which can be downloaded by clicking the links, downloading and installing it.
   
   
2. Run the andriod SDK Manager and Install "Andriod SDK Platform-tools"
   
   [*]Modify your adb_usb.ini file to read such as the following:
   
   
   Code:

   # ANDROID 3RD PARTY USB VENDOR ID LIST -- DO NOT EDIT.
   # USE 'android update adb' TO GENERATE.
   # 1 USB VENDOR ID PER LINE.
   0x2080

   This will be in your /home/{username}/.andriod/ folder for mac and linux
   This will be in your C:/Users/{username}/.andriod folder for Windows.
   
   
   ADB is now enabled for your device, however it is not ON your device. YOU MUST DO THIS EVERY TIME YOU WISH TO ADB INTO YOUR DEVICE.
   
   [*]To do this you will need to download any app, and attempt to install it.
   You can use this app if you need.
   
   [*]Click on the Package Installer, and then a prompt will pop up asking if you want change the settings to allow 3rd party apps.
   
   *DO NOT ENABLE IF YOU WISH TO ACCESS ADB*
   I am working on a way to have it enabled by default.
   
   [*]In the settings page you should see *2* USB Debuggin modes.
   
   [*]Press them both and accept the prompt.
   
   [*]PLUG IN YOUR DEVICE.
   Note* You should see the Android Development icon on the bottom of the screen.
   
   ADB will now be able to see your device. How ever you will need to restart the server before it sees it.
   

1. 
   Type in the following command (while in the folder with the zergRush Binary):
   
   Code:

   adb push ./zergRush /data/local

   [*]Once thats installed run this:
   
   Code:

   adb shell chmod 777 /data/local/tmp

   [*]And lastly:
   
   Code:

   adb shell /data/local/zergRush

   [*]You are now rooted (only for this reboot)

1. 
   Type in the following command while in the location where busy box was downloaded to:
   
   Code:

   adb push ./busybox /data/local

   [*]Busybox works by calling binaries from a file outside of /system/bin/. We must make this file by issuing the following command:
   
   Code:

   adb shell mkdir /data/busybox

   [*]Lets make sure we can install busybox without permission probles:
   
   Code:

   adb shell chmod  777 /data/local/busybox

   [*]Next install busybox in the folder:
   
   Code:

   adb shell /data/local/busybox --install

   [*]We now need to take the /system/folder, and mount it as a writeable folder:
   
   Code:

   adb shell mount -rw -o remount /dev/block/platform/mmci-omap-hs.1/by-name/system /system

   [*]Link it into bin:
   
   Code:

   adb shell ln -s /data/local/busybox /system/bin/busybox

   
   You now have busybox installed

1. 
   First we need to install the Superuser.apk:
   
   Code:

   adb wait-for-device install Superuser.apk
   adb remount

   [*]Next lets go ahead and push the su application up to the /data/local/ folder
   
   Code:

   adb push su /data/local/

   
   [*]Next we will need to change the permissions and cp su from the /data/local/ folder to the /system/bin/
   
   
   Code:

   adb shell chmod 4755 /data/local/su;mount -o remount,rw /dev/block/platform/mmci-omap-hs.1/by-name/system /system;busybox cp /data/local/su /system/bin

1. 
   First things first we need to download the GAPPS. The most reacent one is this one or get the most recent one here.
   [*] Unzip and navigate to the most root folder of that package in your shell.
   
   [*]We need to verify that adb is booting into root. To do this we can issue the command:
   
   Code:

   adb shell id

   If id doesn't return root then you will need to re-zergRush your device
   [*]Now it is time for us to export the apps to the directories.
   
   
   Code:

   adb shell mount -o remount,rw /dev/block/platform/mmci-omap-hs.1/by-name/system /system
   adb push system/app/CarHomeGoogle.apk /system/app/
   adb shell chmod 644 /system/app/CarHomeGoogle.apk
   adb push system/app/FOTAKill.apk /system/app/
   adb shell chmod 644 /system/app/FOTAKill.apk
   adb push system/app/GenieWidget.apk /system/app/
   adb shell chmod 644 /system/app/GenieWidget.apk
   adb push system/app/GoogleBackupTransport.apk /system/app/
   adb shell chmod 644 /system/app/GoogleBackupTransport.apk
   adb push system/app/GoogleCalendarSyncAdapter.apk /system/app/
   adb shell chmod 644 /system/app/GoogleCalendarSyncAdapter.apk
   adb push system/app/GoogleContactsSyncAdapter.apk /system/app/
   adb shell chmod 644 /system/app/GoogleContactsSyncAdapter.apk
   adb push system/app/GoogleFeedback.apk /system/app/
   adb shell chmod 644 /system/app/GoogleFeedback.apk
   adb push system/app/GooglePartnerSetup.apk /system/app/
   adb shell chmod 644 /system/app/GooglePartnerSetup.apk
   adb push system/app/GoogleQuickSearchBox.apk /system/app/
   adb shell chmod 644 /system/app/GoogleQuickSearchBox.apk
   adb push system/app/GoogleServicesFramework.apk /system/app/
   adb shell chmod 644 /system/app/GoogleServicesFramework.apk
   adb push system/app/LatinImeTutorial.apk /system/app/
   adb shell chmod 644 /system/app/LatinImeTutorial.apk
   adb push system/app/MarketUpdater.apk /system/app/
   adb shell chmod 644 /system/app/MarketUpdater.apk
   adb push system/app/MediaUploader.apk /system/app/
   adb shell chmod 644 /system/app/MediaUploader.apk
   adb push system/app/NetworkLocation.apk /system/app/
   adb shell chmod 644 /system/app/NetworkLocation.apk
   adb push system/app/OneTimeInitializer.apk /system/app/
   adb shell chmod 644 /system/app/OneTimeInitializer.apk
   adb push system/app/Talk.apk /system/app/
   adb shell chmod 644 /system/app/Talk.apk
   adb push system/app/Vending.apk /system/app/
   adb shell chmod 644 /system/app/CarHomeGoogle.apk
   adb push system/etc/permissions/com.google.android.maps.xml /system/etc/permissions/
   adb push system/etc/permissions/features.xml /system/etc/permissions/
   adb push system/framework/com.google.android.maps.jar /system/framework/
   adb push system/lib/libvoicesearch.so /system/lib/

1. 
   Go into adb shell or terminal emulator.
2. Issue command:
   
   Code:

   echo -n '0000' > /bootloader/BootCnt

3. Next reboot your device by conventional methods or issue:
   
   Code:

   reboot

4. Your nook will now restart and tell you it is resetting.
5. You now have a clean slate!

Indirect said:

Damn loglud, I ended up beating you to the root lol. Sorry about that! D:

Click to expand...

Click to collapse

kgingeri said:

I'm stuck... I get errors for #3 for busybox... errors like...

Code:

$ adb shell /data/local/busybox --install
busybox: /data/busybox/[: No such file or directory
busybox: /data/busybox/[[: No such file or directory
busybox: /data/busybox/addgroup: No such file or directory
.....
busybox: /data/busybox/yes: No such file or directory
busybox: /data/busybox/zcat: No such file or directory
busybox: /data/busybox/zcip: No such file or directory

So I logged into root via adb shell, set busybox permissions to execute and tried that but same messages?!

Also, adb won't let me 'remount' - (I thought i'd try to copy it direct to /system/bin)?

(I'm running from OSX, if that matters)

EDIT: and of course I'm getting...

Code:

$ adb shell ln -s /data/local/busybox /system/bin/busybox
link failed Read-only file system

$ adb remount
remount failed: Operation not permitted

Click to expand...

Click to collapse

kgingeri said:

Thanks Loglud, but I still had trouble using adb. It's like I don't have root from adb? I get permission errors on mkdir and remounting etc?
Weird that the 'adb shell mkdir /data/busybox' gave me permission errors?! It did work fine with the interactive adb shell - weird!?

After the initial 'push' command, I could install via:

Code:

mac-osx$ adb shell
$ su root
# cd /data/local
# chmod 755 busybox
# ls -l 
-rwxr-xr-x shell    shell     1745016 2011-11-21 00:21 busybox
# mount -rw -o remount /dev/block/platform/mmci-omap-hs.1/by-name/system /system
# mkdir ../busybox
# ./busybox --install

Also, is the line:

Code:

# ln -s /data/local/busybox /system/bin/busybox

not supposed to be

Code:

# ln -s /data/busybox /system/bin/busybox

Things went weird on me in the final step, but I did manage to get all the hard linked busybox files to show up in /system/bin eventually, so I'm a happy camper.


EDIT: PS my mount on data is as follows..

Code:

# mount|grep /data
/dev/block/platform/mmci-omap-hs.1/by-name/userdata /data ext4 rw,nosuid,nodev,noatime,errors=panic,barrier=1,data=ordered 0 0

EDIT2:
Hmmm... seems like maybe my /data folder has weird permissions - if so not sure why?...

Code:

# cd /
# ls -l | grep '\<data\>'
drwxrwx--x system   system            2011-11-21 18:25 data
# chmod 777 data

Click to expand...

Click to collapse

# ln -s /data/local/busybox /system/bin/busybox

kgingeri said:

Yeah, I'm root in the 'adb shell' because I 'su root' but adb commands fail from the Mac shell. I'll reboot my NT and give you the script. My /data permissions get reset when I reboot...

Here you are as it happens

MBAir$ ls busybox
busybox

MBAir$ adb push ./busybox /data/local
2881 KB/s (1745016 bytes in 0.591s)

MBAir$ adb shell mkdir /data/busybox
mkdir failed for /data/busybox, Permission denied​

Of course there is no point continuing until I do the following...

MBAir$ adb shell
$ su root
# chmod 777 /data
# exit
$ exit

MBAir$ adb shell mkdir /data/busybox

MBAir$ adb shell chmod 777 /data/local/busybox

MBAir$ adb shell /data/local/busybox --install

MBAir$ adb shell mount -rw -o remount /dev/block/platform/mmci-omap-hs.1/by-name/system /system
mount: Operation not permitted​

To get around the last error, I had to do another 'adb shell', 'su root' and do 'ln' commands manually.
(I actually ran a shell 'for loop' on the tablet, using all files found in /data/busybox as a list and issued ln commands for each against a copy of busybox in /system/bin)

Click to expand...

Click to collapse