[DEV] Dumping out the kernel, ROM, etc.

---

Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:

The following command would help to dump the kernel out (need su)

cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img

The following command should help to dump the /system/ out (need su)

cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img

Originally Posted by legion1911

If you dump with su you have su in the dump, no?
How about a temporary root solution?

Yes, dumping out the /system/ will contain su

But what it means is just dumping the /bin/su and /system/app/Superuser.apk inclusively.

After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.

Originally Posted by ardatdat

After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.

Please explain how to do it on Windows 7.

Sense this device is tegra we can use nvflash to dump almost any kind of stuff from device, but my problem is that when i try to read or read raw from device nvflash hangs, on this weekend i will try and see what i can debug from usbmon and maybe then i will have some clue, until the only good way is to raw copy of block partitions like you mentioned

by the way if this helps this is what i get in my bct file (dumped with bct_dump for chromeos but worked for me)

Version       = 0x00020001;
BlockSize     = 0x00004000;
PageSize      = 0x00000200;
PartitionSize = 0x01000000;
# Bootloader used       = 1;
# Bootloaders max       = 4;
# BCT size              = 4080;
# Hash size             = 16;
# Crypto offset         = 16;
# Crypto length         = 4064;
# Max BCT search blocks = 64;
#
# These values are set by cbootimage using the
# bootloader provided by the Bootloader=...
# configuration option.
#
# Bootloader[0].Version      = 0x00000001;
# Bootloader[0].Start block  = 224;
# Bootloader[0].Start page   = 0;
# Bootloader[0].Length       = 1345716;
# Bootloader[0].Load address = 0x00108000;
# Bootloader[0].Entry point  = 0x00108000;
# Bootloader[0].Attributes   = 0x00000004;

SDRAM[0].MemoryType                 = NvBootMemoryType_LpDdr2;
SDRAM[0].PllMChargePumpSetupControl = 0x00000008;
SDRAM[0].PllMLoopFilterSetupControl = 0x00000000;
SDRAM[0].PllMInputDivider           = 0x0000001a;
SDRAM[0].PllMFeedbackDivider        = 0x00000258;
SDRAM[0].PllMPostDivider            = 0x00000000;
SDRAM[0].PllMStableTime             = 0x0000012c;
SDRAM[0].EmcClockDivider            = 0x00000001;
SDRAM[0].EmcAutoCalInterval         = 0x00000000;
SDRAM[0].EmcAutoCalConfig           = 0xe0a61111;
SDRAM[0].EmcAutoCalWait             = 0x00000000;
SDRAM[0].EmcPinProgramWait          = 0x00000000;
SDRAM[0].EmcRc                      = 0x00000012;
SDRAM[0].EmcRfc                     = 0x00000027;
SDRAM[0].EmcRas                     = 0x0000000d;
SDRAM[0].EmcRp                      = 0x00000006;
SDRAM[0].EmcR2w                     = 0x00000007;
SDRAM[0].EmcW2r                     = 0x00000005;
SDRAM[0].EmcR2p                     = 0x00000003;
SDRAM[0].EmcW2p                     = 0x0000000b;
SDRAM[0].EmcRrd                     = 0x00000003;
SDRAM[0].EmcRdRcd                   = 0x00000006;
SDRAM[0].EmcWrRcd                   = 0x00000006;
SDRAM[0].EmcRext                    = 0x00000003;
SDRAM[0].EmcWdv                     = 0x00000003;
SDRAM[0].EmcQUseExtra               = 0x00000006;
SDRAM[0].EmcQUse                    = 0x00000007;
SDRAM[0].EmcQRst                    = 0x00000004;
SDRAM[0].EmcQSafe                   = 0x00000009;
SDRAM[0].EmcRdv                     = 0x0000000d;
SDRAM[0].EmcRefresh                 = 0x0000045f;
SDRAM[0].EmcBurstRefreshNum         = 0x00000000;
SDRAM[0].EmcPdEx2Wr                 = 0x00000004;
SDRAM[0].EmcPdEx2Rd                 = 0x00000004;
SDRAM[0].EmcPChg2Pden               = 0x00000006;
SDRAM[0].EmcAct2Pden                = 0x00000008;
SDRAM[0].EmcAr2Pden                 = 0x00000001;
SDRAM[0].EmcRw2Pden                 = 0x0000000f;
SDRAM[0].EmcTxsr                    = 0x0000002a;
SDRAM[0].EmcTcke                    = 0x00000003;
SDRAM[0].EmcTfaw                    = 0x0000000f;
SDRAM[0].EmcTrpab                   = 0x00000007;
SDRAM[0].EmcTClkStable              = 0x00000007;
SDRAM[0].EmcTClkStop                = 0x00000002;
SDRAM[0].EmcTRefBw                  = 0x000004e1;
SDRAM[0].EmcFbioCfg1                = 0x00000000;
SDRAM[0].EmcFbioDqsibDlyMsb         = 0x00000000;
SDRAM[0].EmcFbioDqsibDly            = 0x2f2f2f2f;
SDRAM[0].EmcFbioQuseDlyMsb          = 0x00000000;
SDRAM[0].EmcFbioQuseDly             = 0x2f2f2f2f;
SDRAM[0].EmcFbioCfg5                = 0x00000282;
SDRAM[0].EmcFbioCfg6                = 0x00000002;
SDRAM[0].EmcFbioSpare               = 0x00000000;
SDRAM[0].EmcMrsResetDllWait         = 0x00000000;
SDRAM[0].EmcMrsResetDll             = 0x00000000;
SDRAM[0].EmcMrsDdr2DllReset         = 0x00000000;
SDRAM[0].EmcMrs                     = 0x00000000;
SDRAM[0].EmcEmrsEmr2                = 0x00000000;
SDRAM[0].EmcEmrsEmr3                = 0x00000000;
SDRAM[0].EmcEmrsDdr2DllEnable       = 0x00000000;
SDRAM[0].EmcEmrsDdr2OcdCalib        = 0x00000000;
SDRAM[0].EmcEmrs                    = 0x00000000;
SDRAM[0].EmcMrw1                    = 0x0001008a;
SDRAM[0].EmcMrw2                    = 0x00020004;
SDRAM[0].EmcMrw3                    = 0x00030002;
SDRAM[0].EmcMrwResetCommand         = 0x003f0000;
SDRAM[0].EmcMrwResetNInitWait       = 0x0000000a;
SDRAM[0].EmcAdrCfg1                 = 0x00070303;
SDRAM[0].EmcAdrCfg                  = 0x01070303;
SDRAM[0].McEmemCfg                  = 0x00100000;
SDRAM[0].McLowLatencyConfig         = 0x80000003;
SDRAM[0].EmcCfg2                    = 0x00000403;
SDRAM[0].EmcCfgDigDll               = 0xe0000413;
SDRAM[0].EmcCfgClktrim0             = 0x00000000;
SDRAM[0].EmcCfgClktrim1             = 0x00000000;
SDRAM[0].EmcCfgClktrim2             = 0x00000000;
SDRAM[0].EmcCfg                     = 0x0001ff00;
SDRAM[0].EmcDbg                     = 0x01000020;
SDRAM[0].AhbArbitrationXbarCtrl     = 0x00010000;
SDRAM[0].EmcDllXformDqs             = 0x00000010;
SDRAM[0].EmcDllXformQUse            = 0x00000008;
SDRAM[0].WarmBootWait               = 0x00000001;
SDRAM[0].EmcCttTermCtrl             = 0x00000802;
SDRAM[0].EmcOdtWrite                = 0x00000000;
SDRAM[0].EmcOdtRead                 = 0x00000000;
SDRAM[0].EmcZcalRefCnt              = 0x00000000;
SDRAM[0].EmcZcalWaitCnt             = 0x0000001b;
SDRAM[0].EmcZcalMrwCmd              = 0x000a0056;
SDRAM[0].EmcMrwZqInitDev0           = 0x800a00ff;
SDRAM[0].EmcMrwZqInitDev1           = 0x400a00ff;
SDRAM[0].EmcMrwZqInitWait           = 0x00000001;
SDRAM[0].EmcDdr2Wait                = 0x00000000;
SDRAM[0].PmcDdrPwr                  = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgAPadCtrl    = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl2   = 0x08080040;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl    = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl2   = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl    = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2ClkCfgPadCtrl  = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CompPadCtrl    = 0x01f1f008;
SDRAM[0].ApbMiscGpXm2VttGenPadCtrl  = 0x00005500;

---------- Post added at 02:13 AM ---------- Previous post was at 01:59 AM ----------

Originally Posted by legion1911

Please explain how.

I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system

Welcome SPLESH!

1) Please give us a download link for the nvflash you use and let us know about your progress.

2) "I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system"

I do not use linux. How I do it in windows?



---------- Post added at 04:40 AM ---------- Previous post was at 03:41 AM ----------

Originally Posted by ardatdat

Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:

The following command would help to dump the kernel out (need su)

cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img

The following command should help to dump the /system/ out (need su)

cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img

Nice. How I do that on Windows 7?

Originally Posted by legion1911

Please explain how to do it on Windows 7.

on Windows 7 How?

Hi

Ok I will look to find a way to extract and pack it back or at least modify image itself (I do not have Windows and I will have to install it in virtualBox)

Look in this thread about magiciso (rfs and maybe ext4):
http://forum.xda-developers.com/showthread.php?t=879569

And of cause Linux reader (I can not verify it with image but i used it for real PC disk partitions):
http://www.diskinternals.com/linux-reader/

About nvflash, this thread have much info about it (it is for G Tablet but work as well on SGR, or maybe not so well but i will research more on it):
http://forum.xda-developers.com/showthread.php?t=861950

---------- Post added at 10:27 AM ---------- Previous post was at 10:06 AM ----------

To put device into nvflash mod you need:

1. unplug USB cable
2. turn device off
3. remove battery
4. press VOL_UP and VOL_DOWN and hold them
5. insert USB cable
6. press HOME for 1-2 sec
7. press POWER
8. verify device (windows should detect new device, on linux run lsusb and see for Nvidia Inc device)
9. release POWER, HOME, and VOL keys
10. on Windows install APX driver from post, on Linux run lsusb and look for Nvidia Inc device remember ID XXXX:XXXX (first part is vendor and do not change) and create udev rule for it with this line: SUBSYSTEM=="usb", ATTR{idVendor}=="0955", ATTR{idProduct}=="7f20", MODE="0660", GROUP="plugdev"
11. now you can run nvflash --sync (with out bootloader) just to verify it can connect

SPLESH!
I am so glad you are in this forum.

Greetings to Crimea!

May be I need use nvflash with USB JIG to be able to operate it will make one and try to operate with it on this weekend and will share my results with you guys

Hi

Can some one who rooted device but did not changed stock kernel post output of after su:

adb shell cat /sys/firmware/fuse/odm_production_mode > odm_production_mode.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_cfg >
sec_boot_dev_cfg.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_sel > sec_boot_dev_sel.txt

and probably all content of /sys/firmware/fuse will be useful for my investigation

I understand that this may be different among devices but just for reference this info will be interesting to look at