DFP-188, DFP-231, DFP-2311 BL7 Finally Rooted

Finally with help from people from many other forums Defy with BL7 was rooted.
For now we have no script to make it on the phone without wipe but I'm very happy that it's working.

Rooting Procedure

1. Wipe phone twice (2x make Wipe Data/Cache in stock recovery)
2. Flash 4.5.1-134 DFP-231 CN or 4.5.1-134 DFP-231 Retail.en.EU CEE (It doesn't matter what version of this two You flash but it must be the same with version from point 4).
3. Wipe again (Data/Factory Reset)
4. Flash rooted SBF 4.5.1-134 DFP-231 CN Rooted SBF Part.1, 4.5.1-134 DFP-231 CN Rooted SBF Part.2 or 4.5.1-134 DFP-231 Retail.en.EU CEE Rooted SBF

Thanks List:
- People from http://bbs.mfunz.com for ShellRoot and Rooted SBF
- coelho_ from XDA for help and translation ShellRoot procedure
- Joe31 from XDA for CEE Rooted SBF
- Math43 from XDA for links to CN Rooted SBF
- free2livefrom XDA for testing and helping with patching under linux
- and everyone who tried to help in this thread - THANK YOU

Old Post to let everyone know what we worked here.

Hi.
I created CEE 2.3.6 (BL7) Rooted version.
1. flash original CEE 2.3.6 (BL7) ROM: Link
2.Wipe
3. flash CEE 2.3.6 (BL7) Rooted version: Link

Ok I updated first post for everyone who is searching for root.

djkail said:

It looks like chinese forum succeded in root BL7! I was reading a spanish forum and someone posted it.

Original source:

http://bbs.mfunz.com/forum.php?mod=viewthread&tid=381759&highlight=


BL7SHELLROOT.zip:

http://www.mediafire.com/?ilkf2a6hf7jannb

ddsystem.zip:

http://www.mediafire.com/?isjd6n8fl46zg73

Thanks to manuelamadeo from htcmania and people from chinese forum mfunz. Hope it helps!!!

EDIT: Can someone translate for english users, please? It looks like you have to follow some steps...

Click to expand...

Click to collapse

TRANSLATION
The vid190 2012-4-11 14:43

Let me talk in front, there is no effective solution, but I have an idea,
theoretically feasible, but some adventure and have to put a machine into The BL7 special emphasis on Do not try.
Theoretically possible does not necessarily mean you can row. Not bad money, or want to cure except Brush Syndrome. If you must dare to try to act early to report findings and is extracted mirror up for the benefit of Ha. Here Xianxie. One, first prepare a can BL6 at the end of the ROOT package, personal recommendations Asia-Pacific BL6. Wipe after brushing about two, and then the methods we might have seen, I ROOT BNM Bl6 the method is the so-called normally speak OTAROOT, scientific name of the SHELL ROOT restarts for the second brush into BL7 the ROOT The features are: If your current machine can be a key ROOT, but the new brush into the versions (including the OTA update or the end of the package) can not be a key ROOT. And brush into the in WIPE old version of the new version you can start, then the new version of the brush into the same ROOT , Sounds like a mathematical formula.
Brief the SHELL ROOT, known MOTO one of the SHELL ROOT parameter in order to develop their own convenience, as long as the prop file by adding this parameter can be directly mount partition to reading and writing skills. 2.3 parameters ro.sys.atvc_allow_all_adb = 1, 4.0, parameters ro.kernel.qemu = 1 three, but there is to say, even if your own new brush BL7ROOT of which how to make already BL7 students ROOT it depends on this step. First be prepared to busybox, complete extraction of the dd function that you have ROOT BL7. This extract is a key own BL7ROOT 50% success, which this step is an additional 50%. This extract has the integrity of the risk point is extracted. I had success on the 2.2 so in theory the same can be successful. Basic first is the busybox push to the data / local / tmp, and then change the permissions 755. Then the command adb shell the data / local / tmp, / the busybox dd if = / dev/block/mmcblk1p21 of = / sdcard/mmcblk1p21-system.img ensure that not a usb mass model to ensure that the sd card. Open usb debugging necessary. Then extracted img mirror packaged the sbf brush into those who have bl7 students inside the machine can. Later took this as the end of the package.


( It should be noted, the brush into the re-packaged sbf students of bl7 of the end of the package must be the same BL7 end of the package ) The following is a complete process. -------------------------------------------------- ------------- a brush into the the MB526 Asia-Pacific's BL6ROM. Is Blur_Version.45.0.1321.MB526.AsiaRetail.en.03, brushing do not forget to wipe about http://sbf.droid-developers.org/umt...RDNGIBRIRD15_P014_A026_HWp3_Service1FF.sbf.gz two and then download the reform OTAROOT tool, open the USB debugging. The run ROOT.bat. Note that if the adb remount steps to remount failed: or the following script is not read error please check the end of the package, the first not to brush BL7. The BL7 end of the package is the same as the Asia-Pacific BL7ROM: http://sbf.droid-developers.org/. the .. 0_Service1FF.sbf.gz OTAROOT script for the:










1- @echo off
2- cls
3- adb kill-server
4-adb wait-for-device
5- adb.exe shell mv / data/local/12m / data/local/12m.bak (12mGet rid of the front building soft connection12m.bak)
6- adb.exe shell ln-s / data / data/local/12m (Get rid of the front building soft connection date)
7- adb.exe reboot
8- adb.exe wait-for-device
9- adb shell rm -r /data/local/tmp
10 adb shell mkdir /data/local/tmp
11- adb push zergRush / data / local / tmp (the zergRush 一 ( ROOT tmp In this directory )
12- adb shell chmod 755 /data/local/tmp/zergRush (Permissions assigned to it 755)
13- adb shell / data / local / tmp / zergRush (执行 zergRush)
14- adb wait-for-device
15- the adb remount (executed zergRush do not have to restart the system can be mounted directly to, and then be free)
16- adb.exe shell rm / data/local/12m (Get rid of the front building soft connection12m)
17- adb.exe shell mv / data/local/12m.bak / data/local/12m (Restoring a normal directory 12m)
18- adb.exe shell mv / data / local.prop / data / local.prop.bak (把 local.prop A name change .)
19- adb.exe shell "echo 'ro.sys.atvc_allow_netmon_usb=0' >> /data/local.prop" (n this document below gives the values )
20 adb.exe shell "echo 'ro.sys.atvc_allow_netmon_ih=0' >> /data/local.prop" (It will generate a new file )
21- adb.exe shell "echo 'ro.sys.atvc_allow_res_core=0' >> /data/local.prop"
22- adb.exe shell "echo 'ro.sys.atvc_allow_res_panic=0' >> /data/local.prop"
23-adb.exe shell "echo 'ro.sys.atvc_allow_all_adb=1' >> /data/local.prop"
24 adb.exe shell "echo 'ro.sys.atvc_allow_all_core=0' >> /data/local.prop"
25 adb.exe shell "echo 'ro.sys.atvc_allow_efem=0' >> /data/local.prop"
26 adb.exe shell "echo 'ro.sys.atvc_allow_bp_log=0' >> /data/local.prop"
27 adb.exe shell "echo 'ro.sys.atvc_allow_ap_mot_log=0' >> /data/local.prop"
28 adb.exe shell "echo 'ro.sys.atvc_allow_gki_log=0' >> /data/local.prop"
29- adb.exe reboot recovery (And then restart it to Mount Note that it is. shellroot)
30- echo machine into Recovery Mode, see the exclamation point and the robot (after restart only one opportunity, and then restart no)
31- echo While pressing the volume up or down not only the Android system recovery (So we have to restart to the shellroot Seize the opportunity before switching off the system )
32- echo and then select the first restart, and then immediately press and hold the volume, the faster (but do not wipe out the data partition, because before all)
33- echo can enter the Bootloader after, if not please quickly remove the battery (operating on this partition, remember)
34- echo re-boot a battery pack to hold the volume
35- echo Purpose is to go to bootloader，
36- echo If you have to enter the whole process of the wave animation please start over
37- echo 进入BootloaderAfter the brush in the Asia-Pacific BL 7 bottom bag
38- echo the brushing automatically restart after waiting for ROOT to complete the word
39- adb wait-for-device
40- the adb remount (mount system here, restart and then root out BL7 system ha)
41- adb push su / system / bin
42 adb shell chmod 4755 /system/bin/su
43- ADB push Superuser.apk / system / app
44- adb push busybox / system / bin
45-adb shell chmod 666 /system/app/Superuser.apk
46- adb shell chmod 755 /system/bin/busybox
47- adb shell rm -r /data/local/tmp
48- adb shell mkdir /data/local/tmp
49- the echo ROOT, Congratulations, Congratulations! Now you can be evil!
50- PAUSE

Copy the code

Your current the BL7 already ROOT a brushing this script. And then check whether the root, to install a RE manager or something. The ROOT exhausted not to restart and maintain shellroot. This script, I finally start ddsystem.bat. To ensure that the SD card and only charge mode script:





1- @echo off
2- cls
3- adb kill-server
4- adb wait-for-device
5- adb remount
6- adb push busybox /data/local/tmp
7- adb shell chmod 755 /data/local/tmp/busybox
8- adb shell data/local/tmp/busybox dd if=/dev/block/mmcblk1p21 of=/sdcard/mmcblk1p21-system.img
9- echo extraction, about 3 minutes later, the finished check the SD card root directory of the extracted img image!
10 PAUSE

Copy the code

The last issued by the mirror, or they would be hands-on. Use MotoAndroidDepacker unpack the Asia-Pacific BL7, then mmcblk1p21-system.img renamed CG39.smg replace the original, then re-packaged to. To get the package to modify the end of bl7 students to brush under the original Asia-Pacific bl7 painted this replacement system bl7 SBF on the paste has been synchronized to vid190 microblogging http://sbf.droid-developers.org/umt...RDNGIBRIRD15_P014_A026_HWp3_Service1FF.sbf.gz

From last few days I was collecting almost all roms to Defy including extremely rare and I tried to mix it with DFP-231/DFP-188 and only roms that can be mixed with it is DFP-125, DFP-132 and DFP-146.
I working on Linux also trying to find the way to edit CG39 (from clean rom and my nandroid backup extracted from phone) without signature fail but even after mounting CG39 as ext3/ext4 without any modification signature was broke.
I tried also make something with update for DFP-188 but I was reading that to make update.zip working on stock recovery every bin and apk must be signed by motorola and there is no way to just repack update.zip and flash it on stock recovery.
I tried to make something with shadow DFP-112 witch as I understood is rooted or able to patch CG39 so it must be without CDT in CG31 (I'm not sure) but ofc it can't be mixed with DFP-231. I'm interesting how it's in some roms that they can be patched or something to make it work without bootloader error.
I'm afraid that I'm out of new ideas. Maybe someone have any clue.