To be continued
Sounds promising =D
Sorry I am unable to find working stock kernel source code, one from http://dl-developer.sonymobile.com/code/copylefts/6.2.A.1.100.tar.bz2 fail to compile at start, so I can not continue, no want to waste my time fixing it since I need excatly the same kernel source which will produce excatly the same binary - stock kernel, probably that will not be happen since sony public source is broken so I can not produce the same binary + later: new modules needed for kexec, sorry guys I stopping now. Our soc going to iritate me a lot
I can just compile it.
Using doomlords prebuilt toolchain
Sent from my C2 using xda app-developers app
nickholtus said:
I can just compile it.
Using doomlords prebuilt toolchain
Sent from my C2 using xda app-developers app
Click to expand...
Click to collapse
Did you tried latest Sony archive? I dont know why but when I "make defconfig" and than do "make" compilation asking me for a lot of defconfig related things - chooses, seems archive from Sony is corupted? Tried riogrande**defconfig, tried allso defconfig which I using, no one working. There asking me for x86 things which is ...no logic
If some one have locked bootloader and have "unlock allowed - no", please give me TA backup! To get TA backup simple install http://www.flashtool.net/download.php and do:
1. install it
2. run it
3. click file menu -> switch to pro
4. click to adwance menu -> trim area -> s1 -> backup
5. post your dump here
Thanks!
You can find many TA backups here.
Gesendet von meinem Xperia S mit Tapatalk
djolivier said:
You can find many TA backups here.
Gesendet von meinem Xperia S mit Tapatalk
Click to expand...
Click to collapse
Missin inposible with ta http://forum.xda-developers.com/showpost.php?p=49958520&postcount=687 only maybe kexec can do a job
Maybe hashcode could help for kexec on locked bootloader. He seems to make it work on several locked device(motorola,latest samsung).
munjeni said:
Sorry I am unable to find working stock kernel source code, one from http://dl-developer.sonymobile.com/code/copylefts/6.2.A.1.100.tar.bz2 fail to compile at start, so I can not continue, no want to waste my time fixing it since I need excatly the same kernel source which will produce excatly the same binary - stock kernel, probably that will not be happen since sony public source is broken so I can not produce the same binary + later: new modules needed for kexec, sorry guys I stopping now. Our soc going to iritate me a lot
Click to expand...
Click to collapse
Sir, I can confirm that its compiling. [TOOLCHAIN- arm-eabi-4.4.3 ] without any changes made in Makefile for now. Which toolchain are you using?
Cheers,
AJ
@munjeni as of now,Xperia U tree and P tree are using ARM-EABI-4.4.3
You can git clone it from here --> www.github.com/Abhinav1997/arm-eabi-4.4-3 and push it over to prebuilts/gcc/linux-x86/arm
So,if you still get errors,modify the toolchain line to : "arm-eabi-4.4.3/bin/arm-eabi-"
Hope it helps
Abhinav2 said:
Sir, I can confirm that its compiling. [TOOLCHAIN- arm-eabi-4.4.3 ] without any changes made in Makefile for now. Which toolchain are you using?
Cheers,
AJ
Click to expand...
Click to collapse
Sorry my wrong :laugh: I executed by this way:
make ARCH=arm CROSS_COMPILE=/root/gitstvari/android_prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi- riogrande_lotus_defconfig
make
instead of
make ARCH=arm CROSS_COMPILE=/root/gitstvari/android_prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi- riogrande_lotus_defconfig
make ARCH=arm CROSS_COMPILE=/root/gitstvari/android_prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
Ok will continue.
Here is git https://github.com/munjeni/stock_jb_kexec_kernel_for_locked_bootloader/commits/master
lsmod
kexec_load 28179 0 - Live 0x00000000
procfs_rw 2435 0 - Live 0x00000000
Click to expand...
Click to collapse
status
[email protected]:/data/local/tmp # grep kexec_driver /dev/devices
grep kexec_driver /dev/devices
grep: /dev/devices: No such file or directory
2|[email protected]:/data/local/tmp # kexec --load zImage --initrd=initrd.gz --mem-m
in=0x3000000 --command-line="$(cat /proc/cmdline)"
initrd=initrd.gz --mem-min=0x3000000 --command-line="$(cat /proc/cmdline)" <
kernel: 0x401c7008 kernel_size: 35f1f8
kexec_load: entry = 0x3008000 flags = 280000
nr_segments = 3
segment[0].buf = 0xe75090
segment[0].bufsz = 210
segment[0].mem = 0x3001000
segment[0].memsz = 1000
segment[1].buf = 0x401c7008
segment[1].bufsz = 35f1f8
segment[1].mem = 0x3008000
segment[1].memsz = 360000
segment[2].buf = 0x40529008
segment[2].bufsz = 47e538
segment[2].mem = 0x3d7d000
segment[2].memsz = 47f000
kexec_load failed: Function not implemented
entry = 0x3008000 flags = 280000
nr_segments = 3
segment[0].buf = 0xe75090
segment[0].bufsz = 210
segment[0].mem = 0x3001000
segment[0].memsz = 1000
segment[1].buf = 0x401c7008
segment[1].bufsz = 35f1f8
segment[1].mem = 0x3008000
segment[1].memsz = 360000
segment[2].buf = 0x40529008
segment[2].bufsz = 47e538
segment[2].mem = 0x3d7d000
segment[2].memsz = 47f000
255|[email protected]:/data/local/tmp # cat /dev/kexec_driver
Click to expand...
Click to collapse
Progress:
[72371.535949] Kexec: KDS_entry : '3008000'
[72371.535980] Kexec: KDS_nr_segments : '3'
[72371.535980] Kexec: KDS_segment : '1afe8a8'
[72371.535980] Kexec: KDS_kexec_flags : '280004'
[72371.536010] Kexec: - Starting kexec_load...
[72371.599609] Kexec: - ---- kexec_load - result : '0'
[72392.445739] Kexec:-----------------------------------------------------
[72392.445800] Kexec: REBOOT DEVICE !!!
[72392.445953] Starting new kernel
[72392.446044] Bye!
Click to expand...
Click to collapse
Remaining thing is - need to reserve memory for storing hardboot atags, hope I can store them in the same memory like used on my kernel, if not than will investigate something
I wouldn't want to disturb devs working, but I think it would be interesting to follow this.
And btw, if you are still wondering about RCK_H, it's encrypted with unsalted SHA-256 hash
wan5xp said:
Maybe hashcode could help for kexec on locked bootloader. He seems to make it work on several locked device(motorola,latest samsung).
Click to expand...
Click to collapse
Who? Where?
mirhl said:
I wouldn't want to disturb devs working, but I think it would be interesting to follow this.
And btw, if you are still wondering about RCK_H, it's encrypted with unsalted SHA-256 hash
Click to expand...
Click to collapse
Probably some one found something and posted them, but post is deleted http://forum.xda-developers.com/show....php?t=1196932 why?
munjeni said:
Probably some one found something and posted them, but post is deleted http://forum.xda-developers.com/show....php?t=1196932 why?
Click to expand...
Click to collapse
your link was bad
but what posts should have been deleted? Can't see anything wrong
mirhl said:
your link was bad
but what posts should have been deleted? Can't see anything wrong
Click to expand...
Click to collapse
These is copy paste link, so I can not open broken link, tried to append 1196932 to the http://forum.xda-developers.com/newreply.php?do=newreply&p= but thats not link which pointing to the post related to the "arcievied unlock thing"... some one say that there is thread where some guys found unlock procedure for "unlock allowed = no", so I can not see these thread
Related
Open cmd
go to adb folder
type adb shell
cd /system/bin/
kexec-tool
you willl see commands for loading Zimage to kernel or loading new kernel
Yes but it has been already told that we have to find root partition... without it we can't do anything... Bin4ry has already posted modded kexec tool too..
blagus said:
Yes but it has been already told that we have to find root partition... without it we can't do anything... Bin4ry has already posted modded kexec tool too..
Click to expand...
Click to collapse
Im looking for it
in init.delta.rc I found the text
sevice kexec-tool /system/bin/kexec-tool -p /system/xbin/capk --initrd=/system/xbin/capk_root
and the source code is config file
in /kernel/arch/arm/configs/semc_shakira_capk_defconfig
I did not compile it
there are errors during compilation
If, after compilation will file capk_root. can try to run it on the phone !?
sorry for my english
That kexec command is made to load new kernel in case of kernel panic. So maybe we can load new kernel with that -p option and produce kernel panic so new kernel would be loaded... Would that work?
blagus said:
That kexec command is made to load new kernel in case of kernel panic. So maybe we can load new kernel with that -p option and produce kernel panic so new kernel would be loaded... Would that work?
Click to expand...
Click to collapse
Dontpanic folder is located in data folder.
Maybe will work try some panic kernel andvif mobile will not turn on that mean you did it.
Sent from my E15i using XDA App
blagus said:
That kexec command is made to load new kernel in case of kernel panic. So maybe we can load new kernel with that -p option and produce kernel panic so new kernel would be loaded... Would that work?
Click to expand...
Click to collapse
try flashing x10s kernel.sin that will probably produce kernel panic
That wouldn't work because phone would be off - we need working turned on system, where we load new kernel and then produce kernel panic... unfortunately, when I have to, I don't know how, but when I "had" to crash Ubuntu installation, it was very easy
blagus said:
That wouldn't work because phone would be off - we need working turned on system, where we load new kernel and then produce kernel panic... unfortunately, when I have to, I don't know how, but when I "had" to crash Ubuntu installation, it was very easy
Click to expand...
Click to collapse
Change modules.
Sent from my E15i using XDA App
Tried this. Used capk_root and capk with kexec, triggered kernel panic.
Nothing special happens. Devices just hangs.
here what happen while trying kexec-tool -p
# kexec-tool -p /data/dontpanic/zImage
kexec-tool -p /data/dontpanic/zImage
200000- d8fffff : System RAM
22b000- 6e3fff : Kernel text
6e4000- 813733 : Kernel data
2900000- 2afffff : kgsl_phys_memory
d200000- d8fffff : Crash kernel
d9e0000- d9fffff : ram_console
a0000000-a001ffff : kgsl_reg_memory
a0000000-a001ffff : kgsl
a0200000-a0200fff : msm_serial_hs.0
a0400000-a0400fff : msm_sdcc.1
a0500000-a0500fff : TIWLAN_SDIO.2
a0800000-a08003ff : msm_hsusb
a0800000-a08003ff : msm_hsusb_periphera
a0800000-a08003ff : msm_hsusb_host.0
a0800000-a08003ff : msm_hsusb_otg
a0800000-a08003ff : msm_otg
a0a00000-a0a007ff : msm_nand_phys
a9900000-a9900fff : msm_i2c.0
a9900000-a9900fff : msm_i2c
a9c00000-a9c00fff : msm_serial.2
a9c00000-a9c00fff : msm_serial
aa200000-aa2effff : mdp
aa300000-aa300fff : tssc
aa600000-aa600fff : pmdh
CRASH MEMORY RANGES
200000- d1fffff
Created elf header segment at 0xd8fc000
Command line after adding elfcorehdr
elfcorehdr=222192K
---UP------
Good morning from Germany!
I would like to recompile my kernel on the gt-s 5300 device, so that i could install / setup some application and modules.
Basically i would like to enable the usb gadget on this android device, as far as i am informed, a kernel recompile is needed.
i have done a few kernel recompiles for linux systems, but never for a android smartphone.
maybe someone could point me to the right path ?
thanks all for your help!
kind regards
no help ?
no help ?
thanks a lot ...
Self-plug.
http://forum.xda-developers.com/showthread.php?t=1748297
thewadegeek said:
Self-plug.
http://forum.xda-developers.com/showthread.php?t=1748297
Click to expand...
Click to collapse
Hello,
Yes I have read your post - and everything worked fine.
My question now is how to get my own module to be compiled?
I have my sourcecode but not sure where to place the module and what references in which Makefile have to be done ..?
Thanks for your help.
Kind regards
Stock GT-5300 kernel built, but won't boot
I've been able to create a zImage from the GT-S5300 open source kernel code, using the bcm21553_cori_04_defconfig as indicated by the accompanying readme file.
However, when I use this kernel to create a boot.img and download using Odin, I get a quick S5300 startup screen, then nothing.
At this point, I'm just trying to build a stock kernel, no modifications. I'm looking for helpful hints on where to find any debug or error messages that will help indicate what is going wrong. I can use Odin to put the prebuilt stock kernel back, and it boots ok once again.
I've compared my boot.img with a stock boot.img (samfirmware sourced), and they are similar in terms of addresses and pagesizes. The ramfs file is also stock, taken from that same stock boot.img. The built kernel is a bit larger than the stock and I'm not sure if I should expect my built kernel to be exactly the same size, or if it's ok for it to be a few KBs different.
Any other parameters or configurations that I might be missing or should check? (And to samsungkid, were there any special steps that you took?)
Thank You!
ric105 said:
I've been able to create a zImage from the GT-S5300 open source kernel code, using the bcm21553_cori_04_defconfig as indicated by the accompanying readme file.
However, when I use this kernel to create a boot.img and download using Odin, I get a quick S5300 startup screen, then nothing.
At this point, I'm just trying to build a stock kernel, no modifications. I'm looking for helpful hints on where to find any debug or error messages that will help indicate what is going wrong. I can use Odin to put the prebuilt stock kernel back, and it boots ok once again.
I've compared my boot.img with a stock boot.img (samfirmware sourced), and they are similar in terms of addresses and pagesizes. The ramfs file is also stock, taken from that same stock boot.img. The built kernel is a bit larger than the stock and I'm not sure if I should expect my built kernel to be exactly the same size, or if it's ok for it to be a few KBs different.
Any other parameters or configurations that I might be missing or should check? (And to samsungkid, were there any special steps that you took?)
Thank You!
Click to expand...
Click to collapse
Thanks for bashing my thread...
Might be better to create your own ?
Will do.
samsungkid said:
Thanks for bashing my thread...
Might be better to create your own ?
Click to expand...
Click to collapse
Hadn't seen much traffic on S5300, saw you 'everything worked fine' comment, and thought I might find some tips here.
I will post a separate thread.
Regards
ric105 said:
Hadn't seen much traffic on S5300, saw you 'everything worked fine' comment, and thought I might find some tips here.
I will post a separate thread.
Regards
Click to expand...
Click to collapse
yes please - coz this thread is still open...
waiting for someone to reply for my last questions...
ric105 said:
I've been able to create a zImage from the GT-S5300 open source kernel code, using the bcm21553_cori_04_defconfig as indicated by the accompanying readme file.
However, when I use this kernel to create a boot.img and download using Odin, I get a quick S5300 startup screen, then nothing.
At this point, I'm just trying to build a stock kernel, no modifications. I'm looking for helpful hints on where to find any debug or error messages that will help indicate what is going wrong. I can use Odin to put the prebuilt stock kernel back, and it boots ok once again.
I've compared my boot.img with a stock boot.img (samfirmware sourced), and they are similar in terms of addresses and pagesizes. The ramfs file is also stock, taken from that same stock boot.img. The built kernel is a bit larger than the stock and I'm not sure if I should expect my built kernel to be exactly the same size, or if it's ok for it to be a few KBs different.
Any other parameters or configurations that I might be missing or should check? (And to samsungkid, were there any special steps that you took?)
Thank You!
Click to expand...
Click to collapse
have you checked command line?
Resolved by switching toolchains. OP query remains...
mr.harsh said:
have you checked command line?
Click to expand...
Click to collapse
No errors reported anywhere that I could find, but thanks for the response.
UPDATE: I resolved my original issue: toolchain was wrong. The readme from samsung tried to tell me, but I refused to listen... Once I changed to the Code Sourcery toolchain, the zImage loaded fine.
But back to samsungkid's issue....
I believe he is still trying to get his own custom module compiled into the kernel. I know that building a module separately as an LKM would work technically, but I don't know if that makes sense for the use case.
Regards
cleudde thetical
ric105 said:
No errors reported anywhere that I could find, but thanks for the response.
UPDATE: I resolved my original issue: toolchain was wrong. The readme from samsung tried to tell me, but I refused to listen... Once I changed to the Code Sourcery toolchain, the zImage loaded fine.
But back to samsungkid's issue....
I believe he is still trying to get his own custom module compiled into the kernel. I know that building a module separately as an LKM would work technically, but I don't know if that makes sense for the use case.
Regards
Click to expand...
Click to collapse
Yes, I would be glad if someone could help me with this...
still working on it
Thanks for every information you can give me !
Maybe I need to give you more details, so:
I downloaded the corresponding kernel for my samsung device.
Then I unpacked the file and opened the readme file, which states:
HOW TO BUILD KERNEL 2.6.35 FOR GT-S5300
1. How to Build
- get Toolchain
Visit http://www.codesourcery.com/, download and install Sourcery G++ Lite 2009q3-68 toolchain for ARM EABI.
Extract kernel source and move into the top directory.
$ cd common/
$ make bcm21553_cori_04_defconfig
$ make
2. Output files
- Kernel : kernel/common/arch/arm/boot/zImage
3. How to make .tar binary for downloading into target.
- change current directory to kernel/common/arch/arm/boot
- type following command
$ tar cvf GT-S5300_Kernel_Gingerbread.tar zImage
Click to expand...
Click to collapse
So I downloaded the appropriate toolchain and created my directories under /root/projects/android
[email protected]:~/projects/android# ls
infofiles kernel tarballs toolchain
Click to expand...
Click to collapse
In the directory infofiles are only the readme files from Samsung.
Kernel contains the extracted files from the archives, downloaded from Samsung.
tarballs contain all the tarballs meaning the kernel.tar.gz and the toolchain.tar.gz
toolchain contains the extracted files from toolchain
I then do all the thinks written in the readme file:
[email protected]:~/projects/android# cd kernel/common/
[email protected]:~/projects/android/kernel/common# make bcm21553_cori_04_defconfig
#
# configuration written to .config
#
Click to expand...
Click to collapse
and then I run into an error:
[email protected]:~/projects/android/kernel/common# make
scripts/kconfig/conf -s arch/arm/Kconfig
CHK include/linux/version.h
CHK include/generated/utsrelease.h
make[1]: `include/generated/mach-types.h' is up to date.
CC kernel/bounds.s
arm-eabi-gcc: error trying to exec 'cc1': execvp: No such file or directory
make[1]: *** [kernel/bounds.s] Error 1
make: *** [prepare0] Error 2
Click to expand...
Click to collapse
So could please, anybody help me with me issue?
Thank you !
no one ?
Have you EXPORTed variables to point to the compiler directory?
A guess, but is the error message saying it cannot find the cross compile toolchain? Generally, you need to either export a couple of variables, or add them to the make command line. Something like:
ARCH=arm SUBARCH=arm CROSS_COMPILE= /home/yourhome/toolchains/.../arm-none-eabi- make
Hope it helps.
ric105 said:
A guess, but is the error message saying it cannot find the cross compile toolchain? Generally, you need to either export a couple of variables, or add them to the make command line. Something like:
ARCH=arm SUBARCH=arm CROSS_COMPILE= /home/yourhome/toolchains/.../arm-none-eabi- make
Hope it helps.
Click to expand...
Click to collapse
Thanks.
I added the path to the toolchain directly into the $PATH variable...
Even tried your above statement - the same error again
Maybe need this...
You may need to edit the Makefile:
export KBUILD_BUILDHOST := $(SUBARCH)
ARCH ?=arm
#this is original ---> CROSS_COMPILE ?=/home/aniruddh/sgy/arm-eabi-4.4.3/bin/arm-eabi-
CROSS_COMPILE ?=/home/your_user_name_here/arm-2009q3/bin/arm-none-eabi-
CROSS_COMPILE ?= $(CONFIG_CROSS_COMPILE:"%"=%)
Then you will run 'make' without export any variables.
Regards
tokomotxo said:
You may need to edit the Makefile:
export KBUILD_BUILDHOST := $(SUBARCH)
ARCH ?=arm
#this is original ---> CROSS_COMPILE ?=/home/aniruddh/sgy/arm-eabi-4.4.3/bin/arm-eabi-
CROSS_COMPILE ?=/home/your_user_name_here/arm-2009q3/bin/arm-none-eabi-
CROSS_COMPILE ?= $(CONFIG_CROSS_COMPILE:"%"=%)
Then you will run 'make' without export any variables.
Regards
Click to expand...
Click to collapse
THAT, did the trick!
Thanks a lot for this awesome hint !
I own you
samsungkid said:
THAT, did the trick!
Thanks a lot for this awesome hint !
I own you
Click to expand...
Click to collapse
Thanks to you :good:
tokomotxo said:
Thanks to you :good:
Click to expand...
Click to collapse
Maybe you could answer me another question?
When I want to compile a normal .c program (like a Hello World Program) for my Samsung phone, how would I proceed?
Do I have to write a Makefile for this?
Thanks
http://theteamk.x10.mx/index.php?topic=153.0
The Team K Developers have started the work on fota to end the prolonged wait of android on wave 525.developers r requested to please post some codings so that the project can be completed soon.please keep dis thread development focussed and clean.
After a lot of research the forum users have found the brcm2133.elf and wave 525 fota which can be decoded using IDA PRO DISASSEMBLER.
Anyone who can help can come forward and help
Thanks
I HAVE FOUND BCM21331.elf IN SAMSUNG CORBY s3653w FIRMWARE FILE. THERE IS ALSO WEBKIT.elf. DOWNLOAD IT FROM HERE(it is contained in firmware):
Click to expand...
Click to collapse
Please.
Need BCM21331.elf for study...
Where to download?
You can write PM. :angel:
Thanx in advance.
Best Regards
adfree said:
Please.
Need BCM21331.elf for study...
Where to download?
You can write PM. :angel:
Thanx in advance.
Best Regards
Click to expand...
Click to collapse
http://mediafire.com/?uxhiu82ffwcrvue
u can download brcm21331 from the above link.it is present in the SAMSUNG CORBY s3653w FIRMWARE FILE
Thanks
It seems BCM21331.elf of S3653WDXJG2 is apps_compressed.bin... not Bootfiles...
http://forum.xda-developers.com/showthread.php?t=1325713
Code:
ELF_MAP
BCM21331.csi 9 MB
BCM21331.elf 327 MB
BCM21331.map 125 MB
BCM21331.sym 41 KB
WEBKIT.elf 167 MB
Seen from S3850... but no valid Downloadlink...
Best Regards
reply
adfree said:
It seems BCM21331.elf of S3653WDXJG2 is apps_compressed.bin... not Bootfiles...
http://forum.xda-developers.com/showthread.php?t=1325713
Code:
ELF_MAP
BCM21331.csi 9 MB
BCM21331.elf 327 MB
BCM21331.map 125 MB
BCM21331.sym 41 KB
WEBKIT.elf 167 MB
Seen from S3850... but no valid Downloadlink...
Best Regards
Click to expand...
Click to collapse
i didnt understand
did mediafire say that the download link was not valid
anyway i will upload the elf file today( i have downloaded it )
i dont think that the elf file is apps compressed.bin
u can check it out yourself after i upload the file
Thanks
request
i also request the moderators and administrators to make this thread sticky
Thanks
anyway i will upload the elf file today( i have downloaded it )
Click to expand...
Click to collapse
NO. Thank you.
I have this file. :angel:
But this is apps_compressed.bin... NOT Bootloader and it is only 1 file of 3 or 4 files...
Missing, because maybe helpfull...
Code:
BCM21331.csi
BCM21331.map
BCM21331.sym
So it is maybe less helpfull to find correct ""FOTA values"" to make such output + more...
http://forum.xda-developers.com/showthread.php?t=1496729
Best Regards
i am not really well versed with the coding
do u need BCM21331.csi
BCM21331.map
BCM21331.sym files ?
Thanks
anyway here is the brcm21331.elf for all other devs
http://d-h.st/VMs
Thanks
devs please help and contribute to this thread
i am using ida pro to decode the brcm21331.elf but need help on how to use this software
Thanks
Again...
Check this Thread...
http://forum.xda-developers.com/showthread.php?t=1496729
From S8500...
Code:
#include "BL3.h"
unsigned long c_[B]MemMMUCacheEnable[/B][] = { [COLOR="Red"]0xaab9f874,[/COLOR] 0 };
unsigned long c_[B]disp_FOTA_Init[/B][] = { [COLOR="Red"]0xbfab9174[/COLOR], 0 };
unsigned long c_[B]disp_FOTA_Printf[/B][] = { [COLOR="Red"]0xb69c410b[/COLOR], 0 };
unsigned long c_[B]OemSysGetSystemInfo[/B][] = { [COLOR="Red"]0xc3ac31a5[/COLOR], 0 };
unsigned long *fun_crc[i_endMarker] = {c_MemMMUCacheEnable,
c_disp_FOTA_Init,
c_disp_FOTA_Printf,
c_OemSysGetSystemInfo
};
This is what you need to find... MINIMUM.
This what we can find in BL3_univ.elf + BL3_univ.map
These files are from BOOTLOADER...
BCM21331.elf is ELF file of apps_compressed.bin...
You can NOT find this text in BCM21331.elf
Code:
MemMMUCacheEnable
disp_FOTA_Init
disp_FOTA_Printf
OemSysGetSystemInfo
So I am pretty sure... 51 % that BCM21331.elf is WRONG file to find correct values...
Anyway. With study of BCM21331.elf maybe someone can better understand how SHP/MOCHA Security etc. work...
Good luck.
Best Regards
adfree said:
Again...
Check this Thread...
http://forum.xda-developers.com/showthread.php?t=1496729
From S8500...
Code:
#include "BL3.h"
unsigned long c_[B]MemMMUCacheEnable[/B][] = { [COLOR="Red"]0xaab9f874,[/COLOR] 0 };
unsigned long c_[B]disp_FOTA_Init[/B][] = { [COLOR="Red"]0xbfab9174[/COLOR], 0 };
unsigned long c_[B]disp_FOTA_Printf[/B][] = { [COLOR="Red"]0xb69c410b[/COLOR], 0 };
unsigned long c_[B]OemSysGetSystemInfo[/B][] = { [COLOR="Red"]0xc3ac31a5[/COLOR], 0 };
unsigned long *fun_crc[i_endMarker] = {c_MemMMUCacheEnable,
c_disp_FOTA_Init,
c_disp_FOTA_Printf,
c_OemSysGetSystemInfo
};
This is what you need to find... MINIMUM.
This what we can find in BL3_univ.elf + BL3_univ.map
These files are from BOOTLOADER...
BCM21331.elf is ELF file of apps_compressed.bin...
You can NOT find this text in BCM21331.elf
Code:
MemMMUCacheEnable
disp_FOTA_Init
disp_FOTA_Printf
OemSysGetSystemInfo
So I am pretty sure... 51 % that BCM21331.elf is WRONG file to find correct values...
Anyway. With study of BCM21331.elf maybe someone can better understand how SHP/MOCHA Security etc. work...
Good luck.
Best Regards
Click to expand...
Click to collapse
Thanks for the clarification.
In the FOTA editing,are you guys using asm coding language ?
What minimum do i need to find?
Thanks
This whole thread and idea is wrong at this moment. FOTA exploit has been confirmed to work only for bootloaders of S8500 and S8530. There is no clue if there's such security flaw present in 525 - ergo, you should start with looking for security hole, and then writing exploit to utilise it instead of writing exploit without even knowing if there's anything to exploit literally.
FOTA exploit has been confirmed to work only for bootloaders of S8500 and S8530. There is no clue if there's such security flaw present in 525 - ergo, you should start with looking for security hole...
Click to expand...
Click to collapse
We all know it was looooooong way between first text output and later magic things with FOTA for S8500 and S8530... like zImage start for Android and so on...
http://forum.xda-developers.com/showthread.php?t=1020444
Short look into GT-S5250_Training_Manual_SW.ppt
1.
FOTA file used...
Code:
bplib_S5250OpenEuropeSlav.fota
Chance "high" to generate text ouput. :angel:
1.1
Broadcom Mobile Trace Terminal
Click to expand...
Click to collapse
Not found yet... maybe same like WinComm...
2.
Btw...
_uart_bootloader
Code:
boot1a.img
boot1b.img
boot2.img
onenandboot_4k.img
What is this? Found in
Code:
S5250XEJI4.rar
S5250XEJI6.rar
I have NO Broadcom devices for tests... also NOT in future...
Find your own solution, with your own way...
Best Regards
P.S.:
If way found for zImage start... you need your own/new Broadcom team...
Sorry.
Thank you everyone for any input you are giving
Rebellos thank u very much that fact was an eye opner
I will be really grateful to u guys if you can tell me on how u guys came to know the security loophole.Any kind of help is greatly acknowleged.Again I would like to thank adsfree and rebellos for their contributions to this thread and the facts
I've made a 20 minutes exercise - I downloaded bootfiles from S5250 (S5250XXJK2) and disassembled boot2.img using a guess that the bootloader is loaded at 83E00000. Easily found FOTA code similar to S8500. The binary is loaded from flash address 07E00000 to RAM 85200000 and executed there if the BPDZ marker is available (apps and fota file is checked as well), just as in S8500. The difference is switch arm32 and thumb mode.
In the attachment I've provide a sample fota file along with asm sources. That's all I can help. There's so much more things to be handled since this moment, but it's your job if you are to be capable of continuing any porting project. Please be aware that this is a hopeless task and you do it for fun and exploring. A finished port is not likely to be ever achieved unless you have a device with exactly same board (not only microcontroller, but display, radio, camera, wifi, sensors, etc) as another android device.
canu guys tell me how u decoded boot2.img
i mean using which software and how did u get the code
please help
Thanks
Maybe you could try what mijoma attached...
S5250_src.zip
Especially this file:
S5250_fota_base.fota
Feedback help if it work or not...
Best Regards
u did not understand what i said
i asked how u decoded boot2.img and using which software and how did you get the code
u did not understand what i said
Click to expand...
Click to collapse
Few answers are given...
Now mijoma offered FIRST solution for testing...
S5250_fota_base.fota
Now waiting for someones test feedback...
mijoma has NO broadcom device for testing...
Me too...
So you or other S5250 users...
I have also asked in German Thread...
http://www.handy-faq.de/forum/samsu...sion_download_freigegeben-11.html#post2541317
I can also not seen here in your Thread test result...
http://androbada525.hj.cx/index.php/topic,153.15.html
Best Regards
can some dev post the method to make roms like @hunfatal it will be easier to bring other roms to this device. im sure a lot of users would be interested in using variety of roms
https://www.google.pt/search?source...i19k1j0i22i30i19k1j0i22i10i30k1.0.f0TyAkeA2NU
google is your friend...
you have to learn by yourself if you have no one that teaches you... I learned myself too...
4 essential things:
1- rom source
2-device tree
3- device kernel
4-device vendor
Marado said:
https://www.google.pt/search?source...i19k1j0i22i30i19k1j0i22i10i30k1.0.f0TyAkeA2NU
google is your friend...
you have to learn by yourself if you have no one that teaches you... I learned myself too...
4 essential things:
1- rom source
2-device tree
3- device kernel
4-device vendor
Click to expand...
Click to collapse
how do u integrate security patches?
psychem said:
how do u integrate security patches?
Click to expand...
Click to collapse
Security patches are integrated when you update the source with "Repo sync"...
on older versions like lollipop or marshmallow don´t know never tried it..
maybe with git pull or git merge...
Marado said:
Security patches are integrated when you update the source with "Repo sync"...
on older versions like lollipop or marshmallow don´t know never tried it..
maybe with git pull or git merge...
Click to expand...
Click to collapse
what if the source hasnt been updated? like hunfatal was updating RR before LOS was updated by YM
psychem said:
what if the source hasnt been updated? like hunfatal was updating RR before LOS was updated by YM
Click to expand...
Click to collapse
You can send a pm to @hunfatal, he will certainly respond your questions....
but RR is based on lineage, so their source is synchronized.
:good: I left a msg on his thread. He wants to keep it a secret :angel:
psychem said:
:good: I left a msg on his thread. He wants to keep it a secret :angel:
Click to expand...
Click to collapse
Send pm to him...
I could build a rom, but Yumemichi is doing a great job, then i´m focusing my energy
on a great custom kernel for onyx...:silly:
Marado said:
Send pm to him...
I could build a rom, but Yumemichi is doing a great job, then i´m focusing my energy
on a great custom kernel for onyx...:silly:
Click to expand...
Click to collapse
looking forward to the kernel!
psychem said:
looking forward to the kernel!
Click to expand...
Click to collapse
It´s a kernel like many others...:crying:
but did you already build a rom or not? just ask if you have any questions...
Marado said:
It´s a kernel like many others...:crying:
but did you already build a rom or not? just ask if you have any questions...
Click to expand...
Click to collapse
will do it over the weekend when i have free time. will ask then
Marado said:
Send pm to him...
I could build a rom, but Yumemichi is doing a great job, then i´m focusing my energy
on a great custom kernel for onyx...:silly:
Click to expand...
Click to collapse
I have tried most of the custom ROMs available for onyx but I always had to switch back to stock because I faced one common issues in all ROMs : heavy app like snapchat, amazon, Instagram, etc stops working in some time and I have to reopen that app to continue might be because:
>> Its not allowing more CPU usage or might be I need to change Kernel
or
>> device get uncertified after installing custom ROM so version of apps from playstore are not stable or compatible with device
or
>> Some problem with patching WebView with G-Apps
I am just guessing the reasons but you can guide me with possible solution to help my experience with customized ROMs more smoother on OPX
cd247 said:
I have tried most of the custom ROMs available for onyx but I always had to switch back to stock because I faced one common issues in all ROMs : heavy app like snapchat, amazon, Instagram, etc stops working in some time and I have to reopen that app to continue might be because:
>> Its not allowing more CPU usage or might be I need to change Kernel
or
>> device get uncertified after installing custom ROM so version of apps from playstore are not stable or compatible with device
or
>> Some problem with patching WebView with G-Apps
I am just guessing the reasons but you can guide me with possible solution to help my experience with customized ROMs more smoother on OPX
Click to expand...
Click to collapse
Have no idea... But i know that Snapchat was app problem, i think with the last update is working...
other apps i dont know...
Marado said:
Have no idea... But i know that Snapchat was app problem, i think with the last update is working...
other apps i dont know...
Click to expand...
Click to collapse
@Marado
@YumeMichi
@hunfatal
i was trying to build but got into some problems
i overwrote this symlink file when i was trying to solve the errors below - manifest.xml from /root/android/lineage/.repo/ . how do i get it back?
errors were
Code:
[email protected]:~/android/lineage# repo init -u https://github.com/YumeMichi/kernel_oneplus_onyx.git -b lineage-16.0
From https://github.com/YumeMichi/kernel_oneplus_onyx
+ 0419ab9712e...975fdef3f0e cm-14.1 -> origin/cm-14.1 (forced update)
+ 954e6772a58...4e6c6a06b1e cm-14.1-sultan -> origin/cm-14.1-sultan (forced update)
+ 3e184d8da6c...c87e54b532b lineage-15.1-sultan -> origin/lineage-15.1-sultan (forced update)
+ 5b3dca0a275...674e2f500b0 lineage-16.0 -> origin/lineage-16.0 (forced update)
.repo/manifests/: discarding 23 commits
fatal: manifest 'default.xml' not available
fatal: manifest default.xml not found
Code:
[email protected]:~/android/lineage# breakfast onyx
including vendor/lineage/vendorsetup.sh
build/make/core/product_config.mk:234: error: Can not locate config makefile for product "lineage_onyx".
11:42:12 dumpvars failed with: exit status 1
Device onyx not found. Attempting to retrieve device repository from LineageOS Github (http://github.com/LineageOS).
Found repository: android_device_oneplus_onyx
Traceback (most recent call last):
File "vendor/lineage/build/tools/roomservice.py", line 258, in <module>
default_revision = get_default_revision()
File "vendor/lineage/build/tools/roomservice.py", line 114, in get_default_revision
m = ElementTree.parse(".repo/manifest.xml")
File "/usr/lib/python2.7/xml/etree/ElementTree.py", line 1182, in parse
tree.parse(source, parser)
File "/usr/lib/python2.7/xml/etree/ElementTree.py", line 647, in parse
source = open(source, "rb")
IOError: [Errno 2] No such file or directory: '.repo/manifest.xml'
build/make/core/product_config.mk:234: error: Can not locate config makefile for product "lineage_onyx".
11:42:14 dumpvars failed with: exit status 1
build/make/core/product_config.mk:234: error: Can not locate config makefile for product "lineage_onyx".
11:42:14 dumpvars failed with: exit status 1
** Don't have a product spec for: 'lineage_onyx'
** Do you have the right repo manifest?
Marado said:
Send pm to him...
I could build a rom, but Yumemichi is doing a great job, then i´m focusing my energy
on a great custom kernel for onyx...:silly:
Click to expand...
Click to collapse
Whoa !!
For Pie ?
Great news ! You can PM me for testing !
@psychem you are building Lineageos?
---------- Post added at 12:17 PM ---------- Previous post was at 12:15 PM ----------
Kéno40 said:
Whoa !!
For Pie ?
Great news ! You can PM me for testing !
Click to expand...
Click to collapse
I will release it for everybody testing....:silly:
Marado said:
you are building Lineageos?
---------- Post added at 12:17 PM ---------- Previous post was at 12:15 PM ----------
I will release it for everybody testing....:silly:
Click to expand...
Click to collapse
trying to.
psychem said:
trying to.
Click to expand...
Click to collapse
try repo sync again...
Marado said:
try repo sync again...
Click to expand...
Click to collapse
Code:
[email protected]:~/android/lineage# repo sync
Traceback (most recent call last):
File "/root/android/lineage/.repo/repo/main.py", line 531, in <module>
_Main(sys.argv[1:])
File "/root/android/lineage/.repo/repo/main.py", line 507, in _Main
result = repo._Run(argv) or 0
File "/root/android/lineage/.repo/repo/main.py", line 158, in _Run
copts, cargs = cmd.OptionParser.parse_args(argv)
File "/root/android/lineage/.repo/repo/command.py", line 67, in OptionParser
self._Options(self._optparse)
File "/root/android/lineage/.repo/repo/subcmds/sync.py", line 189, in _Options
self.jobs = self.manifest.default.sync_j
File "/root/android/lineage/.repo/repo/manifest_xml.py", line 360, in default
self._Load()
File "/root/android/lineage/.repo/repo/manifest_xml.py", line 407, in _Load
self.manifestProject.worktree))
File "/root/android/lineage/.repo/repo/manifest_xml.py", line 443, in _ParseManifestXml
root = xml.dom.minidom.parse(path)
File "/usr/lib/python2.7/xml/dom/minidom.py", line 1918, in parse
return expatbuilder.parse(file)
File "/usr/lib/python2.7/xml/dom/expatbuilder.py", line 922, in parse
fp = open(file, 'rb')
IOError: [Errno 2] No such file or directory: '/root/android/lineage/.repo/manifest.xml'
you have the repo bin folder inside Lineage source folder?
if yes delete it, and open terminal in desktop and place it there...
you´re using yumemichi´s sources right? the easiest way to build is download the sources direct from yume github, place in lineage source "device" "kernel" and "vendor", change the makefiles in device folder (in this case there is no need because yumemichi source is for lineage too) and brunch onyx....
In this way you don´t need to mess with manifest files (that is probably what you did) and if they´re wrong is a pain to sync back the source...
I'm going to show you how to build a custom kernel, and a custom boot.img.
Requirements
A linux OS
Kernel source code from Samsung
Android Image Kitchen (Required for the SEANDROID metadata it appends automatically)
GCC Cross Compilation Toolchain 4.8 (You may just clone the repo with git, or download a zip)
Hypothetical workspace directory on the filesystem: /workspace, now prepare it like this:
/workspace/kernel - this is where the kernel source code will be, this is what we will build. Extract the downloaded Kernel.tar.gz here
/workspace/build - this is the kernel compilation result, populated by the build
/workspace/toolchain - this is the required cross-compilation toolchain you download or check-out from the google link
/workspace/kitchen - Extract Android Image Kitchen here
Click to expand...
Click to collapse
Go to http://opensource.samsung.com/reception.do and search for SM-J415, download one of the results, extract Kernel.tar.gz to /workspace/kernel. I believe SWA stands for South West Asia, and MAE - Middle-east Africa, it doesn't matter which you pick, it is related to radio regulations.
Now overwrite the file /workspace/kernel/build_kernel.sh with:
Code:
#!/bin/bash
# The cross compilation toolchain path
export TOOLCHAIN=$(pwd)/../toolchain/arm-linux-androideabi-4.8
# This is the directory for the compiled kernel
export OUTDIR="O=$(pwd)/../build"
export PATH=$TOOLCHAIN/bin:$PATH
export ARCH=arm
export CROSS_COMPILE=arm-linux-androideabi-
export THREADS=$(nproc --all)
export COMMON_ARGS="-j$THREADS $OUTDIR arch=arm CFLAGS_MODULE=-fno-pic arch=arm"
if [ "$1" == "build" ]; then
make $COMMON_ARGS j4primelte_sea_open_defconfig
make $COMMON_ARGS
elif [ "$1" == "rebuild" ]; then
make $COMMON_ARGS
elif [ "$1" == "clean" ]; then
make $COMMON_ARGS distclean
make $COMMON_ARGS clean
else
echo "./build_kernel.sh build|rebuild|clean"
fi
Building kernel source code
Run the script:
$ cd /workspace/kernel/
edit: /workspace/kernel/arch/arm/configs/j4primelte_sea_open_defconfig
change CONFIG_SECURITY_DEFEX=y to CONFIG_SECURITY_DEFEX=n
$ bash build_kernel.sh build
It should build normally, if it fails there's something wrong with your OS setup. After a long time, you should see the compiled and compressed kernel with the DTP appended at:
/workspace/target/arch/arm/boot/zImage-dtb
The kernel configuration it created from the defconfig files in the kernel source tree is at
/workspace/target/.config
Build a new boot.img
$ cd /workspace/kitchen
$ bash unpackimg.sh /path/to/a/boot/or/recovery.img
Now you will have the unpacked kernel in: /workspace/kitchen/split_img/boot.img-zImage
Delete it
$ rm split_img/boot.img-zImage
Link the built custom kernel there instead
$ ln -s /workspace/target/arch/arm/boot/zImage-dtb /workspace/kitchen/split_img/boot.img-zImage
Now each time you create the boot.img, it will include your custom kernel instead.
Tweak the files and ramdisk as much as you want, and repackage the boot.img
$ bash repackimg.sh
Now you have a boot.img at /workspace/kitchen/image-new.img that is ready to flash to the device. You can unpack custom recoveries the same way as you unpacked boot.img to make them use your custom kernel.
Kernel configurations tried
CONFIG_SECURITY=n - boot loop
CONFIG_SECURITY_SELINUX=n - boot loop
CONFIG_SECURITY_DEFEX=n - works
CONFIG_DM_VERITY=n - works, does not prevent initramfs from using DM-VERITY, you still need some sort of ramdisk hack to disable verification of the next boot phase after initrd.
Often when editing the defconfig files, the same variables are declared in many different files so you might be better off using "sed' to change the variables, example:
$ grep -lr "CONFIG_SECURITY=y" | while read line; do sed -i 's/CONFIG_SECURITY=y/CONFIG_SECURITY=n/g' $line; done
When running "build_kernel.sh build", it will print "configuration written to .config" so verify that the variable was actually changed in the final config /workspace/build/.config
kapmino269 said:
and I think ,They aren't kernel see
Click to expand...
Click to collapse
No that is the latest kernel source code running on the latest firmware. You can use either of those 2 downloads from opensource.samsung.com
kapmino269 said:
it isn't working .
Click to expand...
Click to collapse
The kernel source code is on the Samsung opensource website.... there are two versions one that is MEA ( for Middle East and Africa roms) and the other one for SWA. It works if compiled properly
kapmino269 said:
ok
i have questions loop device depend on kernel and if it is .
How to add support?
Click to expand...
Click to collapse
It seems it depends on the kernel support but I haven't actually tried messing around that stuff
kapmino269 said:
it isn't working .
Click to expand...
Click to collapse
You need to install gcc, python and make before you run the command bash build_kernel.sh build
sudo apt install gcc make python
kapmino269 said:
I knew steps man I used Ubuntu for 2 years without windows .
thank you .
Click to expand...
Click to collapse
Do you tried make mrproper and make clean before you run build_kernel.sh?
kapmino269 said:
ok
i have questions loop device depend on kernel and if it is .
How to add support?
Click to expand...
Click to collapse
Type "make xconfig" in the kernel directory, and a window will open for configuring the .config file in that same directory.
Search for "Loopback device support" and add a checkmark (not a dot, so that the module is built into the kernel.)
kapmino269 said:
it isn't working .
Click to expand...
Click to collapse
Can you please provide a log or something? It sounds like you are missing dependencies in your operating system for building kernels.
how do you flash the new boot.img with a samsung device?
kapmino269 said:
By twrp
Click to expand...
Click to collapse
Thanks!!
I ended up using https://forum.xda-developers.com/showthread.php?t=2446269 which is pretty easy as well.
I am now stuck on how to enable wifi after flashing a different kernal.
Kernal = samsung opensource
Rom = nouget 7.1.1 (different to opensource kernal)
Any suggestions?
heavy load said:
Thanks!!
I ended up using https://forum.xda-developers.com/showthread.php?t=2446269 which is pretty easy as well.
I am now stuck on how to enable wifi after flashing a different kernal.
Kernal = samsung opensource
Rom = nouget 7.1.1 (different to opensource kernal)
Any suggestions?
Click to expand...
Click to collapse
Install the Magisk module LIBSECURE_STORAGE COMPANION
ashyx said:
Install the Magisk module LIBSECURE_STORAGE COMPANION
Click to expand...
Click to collapse
Thanks Ashyx, I had a play with your kernal on github, nice work there!
I ended up downloading a stock rom matching the samsung opensource kernal build number, worked out of the box.
kapmino269 said:
See that :
@ashyx any help
I NEED TO ADD SOME MODULES.
Click to expand...
Click to collapse
It's telling you the path to the defconfig doesn't exist.
Either the name is wrong or it doesn't exist in the config directory.
kapmino269 said:
This, I solved it yesterday, Thanks .
But I have 2 problems :
1- Device is arm and at bulid_kernel.sh tell me to use toolchain arch64 ,
Which I should Use arm or arm64 ,
I confused as cpu is arm64 .
https://www.qualcomm.com/products/snapdragon/processors/425
Or
Ndk
https://developer.android.com/ndk/downloads/index.html
2- Which command I should write after menuconfig
./build_kernel.sh
Or
make -jX .
Click to expand...
Click to collapse
Just use whichever is in the build script.
You will need to add menuconfig to build_kernel.sh before make or your changes will be lost.
Then run build_kernel.sh
kapmino269 said:
@ashyx ,all is ok .
The error from clang and there is 2 config files .
Fixed and I will test kernel but I have problem when compiling I choose lz4 type ,do U see I should choose another .
Also where is zimage now ,i compiled manually not with build_kernel.sh .
Click to expand...
Click to collapse
You don't need the export arguments which are contradictory anyway, as you have already defined your toolchain and architecture before hand.
Also the boot image does not need to be lz4. The compiler will tell you where the finished zImage is when completed. You should find it in the boot directory of the arm64 directory if you are not using OUT_DIR statements.
kapmino269 said:
Sorry ashyx this is last thing ,
-You told me later that device is arm not arm64 .
In Your twrp thread .
-Also defconfig of device in /arch/arm .
-Arch=arm in build_kernel.sh .
-Gsi system armaonly only work on the device .
-All apps told that device is arm .
I confused ,
Please tell that it is right to use arm64 tool chain .
Or How did U build it ?
By arm64 toolchain or arm toolchain ?
Very Thank U .
Click to expand...
Click to collapse
I was just going by the screen shot you posted. Like I said your commands are contradictory.
You have both arm and arm64 toolchains defined in the same script.
You also have an export statement for arm64 directly under a statement for an arm toolchain.
Not sure why you added both?
As far as I can see the architecture you're compiling for is arm, so you need an arm toolchain.
kapmino269 said:
It contains errors
Click to expand...
Click to collapse
This is the script I use.
You will need to modify the path to your toolchain.
can i use the source code to build kernel for android 10 one ui if the source built for mm