[GUIDE-IMPORTANT!] "rescue-backdoor" - regarding bootloop, do it before change in sys

condi · Feb 21, 2012

[GUIDE-IMPORTANT!] "rescue-backdoor" - regarding bootloop, do it before change in sys

UPDATE: THIS IS OBSOLETE.
USE S.onyTablet.S [ALLinONE] tool
Below guide/tool use as 'description'
-------------------------------------------------------------------------

Hi guys,

We've got now ROOT. We can do a lot of things, which we couldn't do before.
But before you begin to make changes in system files, first you need to know few things.

Few users experienced "bootloop". Its brick state. There is no access to shell, no adb.
Damaged device.

How to avoid that?

Yes, there is a solution. We need to get proper update zip for our device.
We also need to fool device, that it is a newer file, than the firmware in device.

How to, step by step:

Of course, ROOT is required.
To get proper ota-update-zip for your device you have to edit /build.prop:
- easiest way is via "Root Explorer", or directly via "build.prop Editor" (in market, free),
- do not use "File Manager HD" or other filemanager, which doesn't support root operations (thx kryddan),
- always make backup of files, which you are modifying,
- change value of "ro.sony.build.incremental" to lower one to fake firmware version,
- for example on my device newest firmware has: "ro.sony.build.incremental=111201022" - decrease that value,
in my case to 111201021.
Reboot device.
OTA update notification will appear - click on "Download" button.
Wait until download finishes, but don't click "Update"!!!
I repeat - DON'T CLICK UPDATE! It will reflash firmware,
and you will have to make everything from the beginning (inc. root).
Update zip is located in /cache/ota/signed-nbx03_.......zip - make a copy to safe place - external sd and/or in pc.
Leave build.prop modified. IMPORTANT. Don't revert back changes.

To enter RECOVERY-MODE - power off device,
hold vol-down + power button.

When you want to flash your device, Sony Tablet is checking few things:

is update zip proper one - signed one,
is the update zip - for your region - SKU value,
is the update zip is newer one than firmware in device - equal and higher will not update,
only lower - thats what we're faking.

If you will revert back build.prop = update will fail,
if you will try to update with other region update zip = update fail.

So if we stay with modified build.prop = we can just enter recovery,
and update from external sd card, to our downloaded update zip

Remember, that after reflash in recovery, your build.prop will be updated back
to higher value, then to be safe you need to reapply modification!

I have tested that "rescue-backdoor" on my own device,
deleted some system framework file - of course bootloop, without adb access.
Flashed through recovery - voila, device fixed

Of course, everything what you do with your device, you are doing at your own
risk. I'm sure that in 99% cases with "rescue-backdoor" you will fix your device,
always could be that other 0,01% case.

One condition for sure = build.prop file has to be correct.

[OPTIONAL]
You can disable ota update notification - which appears on every reboot.
To do this use "Titanium Backup" app, look for "System Update" app on list,
and use "Freeze" option

Any questions, suggestions - just ask

PS. I'm thining about writing auto-script for that...

br
condi

kryddan · Feb 21, 2012

great guide, thank you

I think an automated-script would be much appreciated

Judah001 · Feb 21, 2012

condi said:
Hi guys,

We've got now ROOT. We can do a lot of things, which we couldn't do before.
But before you begin to make changes in system files, first you need to know few things.

Few users experienced "bootloop". Its brick state. There is no access to shell, no adb.
Damaged device.

How to avoid that?

Yes, there is a solution. We need to get proper update zip for our device.
We also need to fool device, that it is a newer file, than the firmware in device.

How to, step by step:

Of course, ROOT is required.

To get proper ota-update-zip for your device you have to edit /build.prop:
- easiest way is via "Root Explorer", or directly via "build.prop Editor" (in market, free),
- always make backup of files, which you are modifying,
- change value of "ro.sony.build.incremental" to lower one to fake firmware version,
- for example on my device newest firmware has: "ro.sony.build.incremental=111201022" - decrease that value,
in my case to 111201021.

Reboot device.

OTA update notification will appear - click on "Download" button.

Wait until download finishes, but don't click "Update"!!!
I repeat - DON'T CLICK UPDATE! It will reflash firmware,
and you will have to make everything from the beginning (inc. root).

Update zip is located in /cache/ota/signed-nbx03_.......zip - make a copy to safe place - external sd and/or in pc.

Leave build.prop modified. IMPORTANT. Don't revert back changes.

When you want to flash your device, Sony Tablet is checking few things:

is update zip proper one - signed one,

is the update zip - for your region - SKU value,

is the update zip is newer one than firmware in device - equal and higher will not update,
only lower - thats what we're faking.

If you will revert back build.prop = update will fail,
if you will try to update with other region update zip = update fail.

So if we stay with modified build.prop = we can just enter recovery,
and update from external sd card, to our downloaded update zip

I have tested that "rescue-backdoor" on my own device,
deleted some system framework file - of course bootloop, without adb access.
Flashed through recovery - voila, device fixed

Of course, everything what you do with your device, you are doing at your own
risk. I'm sure that in 99% cases with "rescue-backdoor" you will fix your device,
always could be that other 0,01% case.

One condition for sure = build.prop file has to be correct.

[OPTIONAL]
You can disable ota update notification - which appears on every reboot.
To do this use "Titanium Backup" app, look for "System Update" app on list,
and use "Freeze" option

Any questions, suggestions - just ask

PS. I'm thining about writing auto-script for that...

br
condi

Thanks Condi! Download worked great but under my cache there is nothing. Could the file be located elsewhere?

obicom · Feb 21, 2012

It should be under '/cache/ota' ... nowhere else ..

condi · Feb 21, 2012

Judah001 said:
Thanks Condi! Download worked great but under my cache there is nothing. Could the file be located elsewhere?

Be sure that ota has been download, check again /cache/ota.
If still no zip, then run 'adb shell' then:

Code:

su
find -name *signed*

or

Code:

find -name *.zip

If your ota update will be in different location, then please post it.

br
condi

Judah001 · Feb 21, 2012

condi said:
Be sure that ota has been download, check again /cache/ota.
If still no zip, then run 'adb shell' then:

Code:

su find -name *signed*

or

Code:

find -name *.zip

If your ota update will be in different location, then please post it.

br
condi

ok I will try once I am home through adb. So far there is nothing under my cache folder. I am using file manager HD but it should pick up a zip file.

javbmw · Feb 21, 2012

Thank you condi... The instructions worked perfectly!!

kryddan · Feb 21, 2012

Judah001 said:
ok I will try once I am home through adb. So far there is nothing under my cache folder. I am using file manager HD but it should pick up a zip file.

Just a little tip. I'd suggest you use Root Explorer instead of File Manager HD.
You see, File Manager HD does not show the files in /cache. (mine didn't)

I tried File Manager HD on my tablet and found nothing inside /cache
But with Root Explorer I found three different directories. There among OTA.

Judah001 · Feb 21, 2012

kryddan said:
Just a little tip. I'd suggest you use Root Explorer instead of File Manager HD.
You see, File Manager HD does not show the files in /cache. (mine didn't)

I tried File Manager HD on my tablet and found nothing inside /cache
But with Root Explorer I found three different directories. There among OTA.

That did the trick. I used the root browser in rom tool box and copied the zip to my sd card. Thank you for the help guys.

obicom · Feb 21, 2012

Good advice kyddan ... same on my tab with file manager HD.
I work normally with Root Explorer or File Expert.
Both show the folders and files in /cache .. File Manager HD do not.

sebarkh · Feb 21, 2012

my ro.sony.build.incremental is 111201038
Do I have to decrease it by 1 to 111201037 ?

EDIT: nevermind. I did so. Worked.

condi · Feb 21, 2012

sebarkh said:
my ro.sony.build.incremental is 111201038
Do I have to decrease it by 1 to 111201037 ?

Yep, exacty. And then you will get newest ota zip of 111201038

pozdro

condi · Feb 21, 2012

hahahahah I just had brick... I'm working on auto-install script for "rescue-backdoor", and accidentally I've pushed empty 0bytes build.prop - after reboot - sony logo, then black screen.... and guess what...

recovery reads incremental value (which doesnt exists..) as "0" zero

so i've got lower value, and reflash done.

after reboot my tab started correctly, but.. after reboot again brick - black screen.
fortunatelly - after few min with black screen i've got adb access.
but for first - i can't get root access.. 'su' not works.
but... '/system/xbin/su' works

root

lets check - build.prop still empty,
remounted system as rw, pushed correct build.prop - ahhh again working !!

that was good experience hahah.

-------------edit:
i've got auto-install tool ready... need to make one more full test with my device and will publish it.
full automatic !!!!!

ase3000 · Feb 22, 2012

This is driving me crazy. why everyone is getting update message when changing the incremental value while my dumass tablet keeps saying that my system is up to date

condi · Feb 22, 2012

ase3000 said:
This is driving me crazy. why everyone is getting update message when changing the incremental value while my dumass tablet keeps saying that my system is up to date

Just wait for automatic-tool. Its ready, but need to make final tests.

riccardo91 · Feb 22, 2012

condi said:
So if we stay with modified build.prop = we can just enter recovery,
and update from external sd card, to our downloaded update zip

In which way we can enter to recovery??

condi · Feb 22, 2012

riccardo91 said:
In which way we can enter to recovery??

power off, hold vol-down + power.

riccardo91 · Feb 22, 2012

All done! It works well! Thanks! Avoiding bootloop it's even a good thing!

condi · Feb 22, 2012

riccardo91 said:
All done! It works well! Thanks! Avoiding bootloop it's even a good thing!

Great

Just remember one thing - after reflash in recovery, your build.prop will be updated to higher value - then to be safe you need to reapply modification!

--- my 100th post !

Amiga4ever123 · Jul 21, 2013

condi said:
Great Just remember one thing - after reflash in recovery, your build.prop will be updated to higher value - then to be safe you need to reapply modification!

--- my 100th post !

I bricked my XTS playuing with build.prop. Shame I didn't see this post before. For future - how can I edit build.prop in a safe way? I changed file permission then I forgot to restore default. After restart brick. Do I need to change permission to edit build.prop then do i NEED to restore proper permission back? I'm still confused with it

[GUIDE-IMPORTANT!] "rescue-backdoor" - regarding bootloop, do it before change in sys

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts