Related
stepw discovered a stack overflow vulnerability that affects ALL Trinity SPL versions up to now, I implemented an exploit for it, see details here.
The same bug is present in Hermes SPL versions >= 1.11, and all SPLs using HTC common base 1.51, so probably newer Breeze SPLs are vulnerable too.
Sadly for hermes users this bug can't be exploited the same way it's done on Trinity, this is the memory layout on Trinity:
Code:
0x80b00000 | xxxxxxxxxxx | \
.... | xxxxxxxxxxx | > wdata buffer
0x80b10000 | xxxxxxxxxxx | /
+-------------+
| . |
| . |
+-------------+
0x8c000000 | SPL-begins | \
.... | SPL SPL SPL | ME
.... | SPL SPL SPL | MO <--- how_far
.... | SPL SPL SPL | RY
.... | SPL SPL SPL | /
0x8c040000 | SPL-ends |
+-------------+
| . |
| . |
+-------------+
| . | \
0x8c08cb90 | . | s
.... | | t /\
.... | | a ||
.... | | c ||
.... | | k ||
0x8c08db90 | | /
| |
By doing recusrive 'ruustart' calls we can overflow the stack and set arbitrary bytes in 0x64 bytes buffer (size of command buffer in ruu mode).
We first try to detect how far the overflow should go, this varies on each SPL version. Then we put a known pattern on the stack and use the 'checksum' command to determine offsets of current stack top and size of stack frame of ruustart and normal command mode.
Then we load our unsigned code using wdata, of course we get an "invalid cert error" from bootloader, but the data we send is stored at 0x80b00000 (wdata buffer). We place here a modified IPL to skip loading SPL from NAND, and the custom SPL we want to load.
Then we calulate how many recursions we need to reach the spl end at 0x8c040000, the first recursions are padded with 0's as they are useless, only need them to overflow the stack, we put our shellcode here, the shellcode is a handler which executes the loader that resides in ram (0x80b00000) which copies patched IPL, SPL to RAM, disables ARM instruction caching and virtual addressing and branches to 0 offset to start IPL.
After placing the shellcode, we send the next ruustart calls with padding that contains branch instructions (relative jumps to the handler), we calculate how many calls we need based on target offset, initial stack offset and stack frame size.
Finally we need to jump to our patched code, to do this we call a function which has its entry point properly aligned with the overflown stack frame (we only control 0x64 bytes out of the frame size for ruustart which is tipically 0xe0), this also varies in each SPL version.
Now let's see the problem we're facing in hermes, this is the Hermes memory layout:
Code:
| . | \
| . | s /\
| | t ||
.... | | a ||
| | c ||
.... | | k
0x8c033b90 | | /
+-------------+
| . |
| . |
+-------------+
0x8c080000 | SPL-begins | \
.... | SPL SPL SPL | ME
.... | SPL SPL SPL | MO <--- how_far; we never reach here :(
.... | SPL SPL SPL | RY
.... | SPL SPL SPL | /
0x8c0c0000 | SPL-ends |
+-------------+
| . |
As you can see here, the stack grows up in the same direction as trinity, but the SPL code is placed below the stack so we can't overwrite it, thus we can't call a function that branches to our code.
So this is a call for developers & researchers, we need to find what else is between the stack and the ram top in hermes and see if there's something there that could be exploited, or if there's a pointer in ram that code branches to, we can exploit it by replacing the pointer.
You can use the Trinity exploit code with '-m hermes' hidden flag to test things on Hermes, feel free to modify / adapt the source for your tests on hermes.
Any ideas are welcome, have fun!
Damn pof your a real wacko and a genious, nice job man congrats!!
Re: spl overflow
Cool!
Congratz to stepw for this amazing research and exploit!
pof! GOOD work and nice code! Hope caffeine let you sleep some day!
Tonight we have to celebrate this with some beers!
heheh
thanks, keep up the good works, hope this software be develope as soon as posible so that our bricked phone be alive again.
I don't Understand
i'm using dopod 838 pro....where the memory layout mus edit?
HOWTO: Setup a working environment to build CM7, with SVN
0. Overview
In this thread: http://forum.xda-developers.com/showthread.php?t=1565517, HPA has shown a custom ROM based on CM7, and his development files. I think there's a need to create a guideline of how to create such artifacts yourself by setting up your own development environment, download the source code and build ones for yourself. This post address that need. Hope this helps!
1. Install a version tracking system
1.1 Install SVN, please refer to "Setup a Subversion Server in 4 Minutes" (http://www.tonyspencer.com/2007/03/02/setup-a-subversion-server-in-4-minutes/)
1.1 Install RapidSVN by running "sudo apt-get install rapidsvn" (Ubuntu users may need to use sudo, or by installing it from Synaptic, for more details please refer to http://www.rapidsvn.org/index.php/OnlineHelp:Contents)
What's just happened: you installed Subversion (a software versioning and revision control system) and a GUI tool to track changes to the scripts you are going to create/update. Having a revision control system up and running is recommended since you're going to change many things from the original files, or create ones yourself. When your change is irrelevant, Subversion will save the day by allow you to revert back to a last-known-good version in the past - that's all we need, I think.
2. Get CM7 source code
Assume that we're going to use a folder named "gingerbread" in your home folder for this task:
Code:
$ cd ~/android/gingerbread
$ repo init -u git://github.com/CyanogenMod/android.git -b gingerbread
$ repo sync
3. Initialize the build script folder structure
Ensure that, the folder containing development files will have the same structure as the CM7 source tree, like this:
Code:
$ tree -d ~/android/cm7dev/gingerbread
gingerbread
|-- device
| `-- dell
| `-- venue
| |-- files
| |-- libaudio-qsd8k
| `-- overlay
| |-- frameworks
| | `-- base
| | |-- core
| | | `-- res
| | | `-- res
| | | `-- values
| | `-- packages
| | `-- SettingsProvider
| | `-- res
| | `-- values
| `-- packages
| `-- apps
| |-- CMParts
| | `-- res
| | `-- values
| |-- Mms
| | `-- res
| | `-- values
| |-- Phone
| | `-- res
| | `-- values
| |-- Settings
| | `-- res
| | `-- values
| `-- Torch
| `-- res
| `-- values
|-- frameworks
| `-- base
| |-- include
| | |-- camera
| | `-- media
| |-- libs
| | `-- camera
| |-- media
| | |-- java
| | | `-- android
| | | `-- media
| | |-- jni
| | `-- libstagefright
| | `-- omx
| |-- policy
| | `-- src
| | `-- com
| | `-- android
| | `-- internal
| | `-- policy
| | `-- impl
| |-- services
| | |-- camera
| | | `-- libcameraservice
| | `-- java
| | `-- com
| | `-- android
| | `-- server
| `-- telephony
| `-- java
| |-- android
| | `-- telephony
| `-- com
| `-- android
| `-- internal
| `-- telephony
| `-- gsm
|-- packages
| `-- providers
| `-- MediaProvider
| `-- src
| `-- com
| `-- android
| `-- providers
| `-- media
`-- vendor
`-- cyanogen
`-- products
Here, we have 4 sub-folders called "device", "frameworks", "packages" and "vendor". Later we will merge this folder with the CM7 source tree.
4. Import cm7dev files (the above tree folder structure) to SVN repo
Code:
$ svn import ~/android/cm7dev/gingerbread file:///data/svnrepos/gingerbread
5. Create a new empty working directory
This will be the place we checkout our code, and actually do the development task
Code:
$ cd ~/android
$ mkdir dv-dev
$ mkdir dv-dev/gingerbread
Now, checkout code from URL file:///data/svnrepos/gingerbread to the above working folder. You can use RapidSVN, or if you're familiar with SVN command line interface, issue this:
Code:
$ svn co file:///data/svnrepos/gingerbread ~/android/dv-dev/gingerbread
6. Merge CM7 code folder with our working directory
Now, copy everything from CM7 code folder (~/android/gingerbread) to the your working directory ~/android/dv-dev/gingerbread. Since they have the same name, with the same sub-folders, a confirmation will be shown to ask you whether you want to merge the content. Say Yes, and besure to select to apply to all items found.
This step ensures that, you can now build CM7 right from the working folder, and any changes to build script can be tracked by SVN (checked in). Now you're ready to go with the build progress. You may want to copy files from ~/android/cm7dev/gingerbread to the working folder again to overwrite all conflicts if there are any.
7. Copy proprietary files
Be sure your phone is connected to your PC, and USB access are well-configured so that ADB can do its task to pull the proprietary needed files.
Code:
$ cd ~/android/dv-dev/gingerbread/device/dell/venue
$ ./extract-files.sh
In this step, several changes need to be made for this file (extract-files.sh). You will have to adjust one for yourself since I noticed that HPA - the author - wrote some script to pull files that do not exists (he might have based on a Streak instead).
8. Install new versions of gApps and Rom Manager (of course, if you want)
Code:
$ cd ~/android/dv-dev/gingerbread/vendor/cyanogen/
$ ./get-rommanager
9. Build (the setup-makefiles.sh below will also has to be modified)
Code:
$ cd ~/android/dv-dev/gingerbread/device/dell/venue
$ ./setup-makefiles.sh
$ cd ~/android/dv-dev/gingerbread
$ cp ./vendor/cyanogen/products/cyanogen_venue.mk ./buildspec.mk
# choose device
$ . build/envsetup.sh
$ lunch cyanogen_venue-eng
# actual build
$ mka (or make -j`grep 'processor' /proc/cpuinfo | wc -l`, like what shown in Cyanogen official guidelines)
Now, let's just wait adjust the build scripts base on what you get (errors) during the build progress. For example, here's what I met:
Code:
target Strip: InputChannel_test (out/target/product/venue/obj/EXECUTABLES/InputChannel_test_intermediates/InputChannel_test)
(unknown): error 4: Added public method android.telephony.PhoneNumberUtils.formatKoreanNumber
(unknown): error 5: Added public field android.media.MediaRecorder.AudioEncoder.EVRC
(unknown): error 5: Added public field android.media.MediaRecorder.AudioEncoder.QCELP
(unknown): error 5: Added public field android.telephony.PhoneNumberUtils.FORMAT_KOREA
******************************
You have tried to change the API from what has been previously approved.
To make these errors go away, you have two choices:
1) You can add "@hide" javadoc comments to the methods, etc. listed in the
errors above.
2) You can update current.xml by executing the following command:
make update-api
^^^^^^^^^^^^^^^^^^
NO. NO. STOP BEING LAZY. SERIOUSLY.
DO NOT DO THIS in CM. THIS IS A LIE. IF YOU DO THIS I WILL HATE YOU.
USE OPTION #1.
-Koush
To submit the revised current.xml to the main Android repository,
you will need approval.
******************************
I typed "make update-api" like the author said above, and things were fine.
10. Remove symbolic links in /system/xbin, /system/bin
All symbolic links in the above folders need to be removed, since they will be created during the flashing progress, via instructions in updater-script
Code:
$ cd ~/android/dv-dev/gingerbread/out/target/product/venue/system/bin
$ find . -maxdepth 1 -type l -exec rm -f {} \;
$ cd ~/android/dv-dev/gingerbread/out/target/product/venue/system/xbin
$ find . -maxdepth 1 -type l -exec rm -f {} \;
11. Deploy
Now, copy the following things from ~/android/dv-dev/gingerbread/out/target/product/venue
- ./system
- boot.img
to another directory to create an update.zip file.
12. Other tools you might need/consider
Meld: a visual diff and merge tool
Geany: a text editor using the GTK2 toolkit with basic features of an integrated development environment
RabbitVCS: a graphical front-end for version control systems available on Linux that can be integrated into file managers such as Nautilus, Thunar. You'll find it familiar if you use TortoiseSVN on Windows before.
P.S. My development files: http://www.mediafire.com/?2ozrmxotdsib9nn
Here is my working result:
http://www.mediafire.com/?8a8ntad2t7tv4mb
and its screenshot:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Still, there is not many differences with the original update-cm-7.2.0-RC1-DV-KANG-HPA-BETA2-signed yet, but at least we know how to build it! Right?
Update: ROM with my custom kernel (4.06)
hey, chacona .!! Can u add my yahoo ID!
Trainhque_dideple_dayemphe_7593
i have something to ask you ! ?
chacona said:
Here is my working result:
http://www.mediafire.com/?zqqkne7qb4bqplf
and its screenshot:
Still, there is not many differences with the original update-cm-7.2.0-RC1-DV-KANG-HPA-BETA2-signed yet, but at least we know how to build it! Right?
Update: ROM with my custom kernel (4.06)
Click to expand...
Click to collapse
Is there anyway to get more free RAM?
How did you get so much RAM?
As I have only 184 MB of free RAM.
prasad12ka4: sorry, I don't know how to get more RAM so far. What I've done is just establishing a development environment, and successfully built a working copy of CM7 myself, proving that what I did is correct. Surely, I have a lot of things to do after that.
Guys.!!! Dell venue n dell streak 5got same rom n environment hardware too just diffrence is venue is Hdpi n dell streak is Mdpi .so why do nt we join hands n make ics work for dell or on other hand u can take advantage of our dell streak 5 formus there r few good roms like longhorn 2.8 with Hdpi support for dell Venue and Dcs 1.1.which supports both hdpi n mdpi just need to edit build.prop n may be kernel....whish u all safe cooking ...n Friends in need friend indeed ..
Max
Sent from my Dell Streak using xda premium
djmax81 said:
Guys.!!! Dell venue n dell streak 5got same rom n environment hardware too just diffrence is venue is Hdpi n dell streak is Mdpi .so why do nt we join hands n make ics work for dell or on other hand u can take advantage of our dell streak 5 formus there r few good roms like longhorn 2.8 with Hdpi support for dell Venue and Dcs 1.1.which supports both hdpi n mdpi just need to edit build.prop n may be kernel....whish u all safe cooking ...n Friends in need friend indeed ..
Max
Sent from my Dell Streak using xda premium
Click to expand...
Click to collapse
this is indeed exciting
Sent from my Dell Venue using xda premium
yah if some dev help us then surely we will get ics on dell venue
I am still working on CM7, with some kernel related tasks such as overclocking, checking the memory (I wonder why with 2.3.3 the total memory is only about 383, and on 2.2.2 is about 400+). Maybe it's a ROM problem, but I will try to find the root cause in the kernel first.
Because of the reason above, I still have no chance to look at the ICS ROM yet. However, there might be a lot of things to be learnt (as stated in CM forum). But, for stability, I think we should wait until ICS becomes RTM to begin our development work since changes are still can be many.
E430
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
DESCRIPTION:
Code:
GENERAL 2G Network GSM 850 / 900 / 1800 / 1900
3G Network HSDPA 900 / 2100
SIM Mini-SIM
Announced 2013, February
Status Available. Released 2013, April
BODY Dimensions 102.6 x 61.1 x 11.9 mm (4.04 x 2.41 x 0.47 in)
Weight 107 g (3.77 oz)
DISPLAY Type IPS LCD capacitive touchscreen
Size 240 x 320 pixels, 3.2 inches (~125 ppi pixel density)
Multitouch Yes
SOUND Alert types Vibration, MP3 ringtones
Loudspeaker Yes
3.5mm jack Yes
MEMORY Card slot microSD, up to 32 GB
Internal 4 GB (1.6 GB user available), 512 MB RAM
DATA GPRS Class 12 (4+1/3+2/2+3/1+4 slots), 32 - 48 kbps
EDGE Class 12
Speed HSDPA, 7.2 Mbps; HSUPA, 5.76 Mbps
WLAN Wi-Fi 802.11 b/g/n, Wi-Fi hotspot
Bluetooth Yes, v3.0 with A2DP, HS
USB Yes, microUSB v2.0
CAMERA Primary 3.15 MP, 2048 x 1536 pixels
Features Geo-tagging
Video Yes, [email protected]
Secondary No
FEATURES OS Android OS, v4.1.2 (Jelly Bean)
Chipset Qualcomm MSM7225A Snapdragon
CPU 1 GHz
GPU Adreno 200
Sensors Accelerometer, proximity, compass
Messaging SMS (threaded view), MMS, Email, Push Email, IM
Browser HTML
Radio FM radio
GPS Yes, with A-GPS support
Java Yes, via Java MIDP emulator
Colors Indigo Black, Titanium silver, White
- SNS integration
- MP4/H.264/H.263/WMV player
- MP3/WAV/WMA/eAAC+ player
- Google Search, Maps, Gmail
- YouTube, Google Talk
- Document viewer
- Photo viewer
- Organizer
- Voice memo
- Predictive text input
BATTERY Type Li-Po
Capacity 1540 mAh
Stand-by Up to 608 h (2G) / Up to 700 h (3G)
Talk time Up to 11 h 30 min (2G) / Up to 10 h (3G)
MISC SAR US 1.02 W/kg (head) 1.23 W/kg (body)
SAR EU 1.00 W/kg (head) 0.52 W/kg (body)
Warning :
Code:
* Your warranty is now void.
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features of this Kernel
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
* But since i'm a nice dude i will try to guide you anyway:)
WINDOWS ROOTING GUIDE
*this guide will work on most android phones
Download THIS PROGRAM (VROOT)
Install Program
Enable USB Debugging in settings (TICK CHECK-BOX IN Settings>>>Developer options>>>USB debugging)
Plug your phone to PC using usb cable in "LG software" mode
If you are connecting your phone to your pc for the first time you need to install lg drivers from first autorun when phone plugged in ( If autorun disabled navigate to lg removable drive and run LGAutoRun.exe) follow on-screen instructions or download drivers from LG Official Website HERE
Ensure all drivers have installed correctly (no yellow triangles in "Device Manager")
Run VROOT As Administrator On PC
program will connect to your phone and tell you your phone model and if phone is rooted (obviously our's is not)
Click ROOT in right bottom corner
program will install Chinese sync/managment app (you can remove app later) on your phone and install Kinguser superuser app on your phone (you can replace this with your favourite superuser app <i kept Kinguser and i'm happy>)
Your phone will reboot when completed
BOOTLOADER = UNLOCKED AND CWM READY !!!
THANKS TO Cobmaster AND PlayfulGod WE HAVE UNLOCKED BOOTLOADER AND HAVE WORKING CWM v6.0.4.8
WINDOWS INSTALLER HERE *readme.txt
LINUX-UNIVERSAL INSTALLER HERE *THANKS TO Cobmaster
.APK FOR NON PC INSTALL HERE *THANKS TO PlayfulGod
*These will unlock bootloader install and CWM recovery
YOU CAN ENTER RECOVERY USING BUTTON COMBO !!! !!!
1. PRESS AND HOLD "HOME" BUTTON
2. PRESS "VOL-" AND "POWER" BUTTONS TOGETHER FOR ~2.5-3 SECONDS AND RELEASE
3. KEEP HOLD OF "HOME" BUTTON UNTIL RECOVERY BOOTED
Here you can find apk to try on other devices:
MAKE SURE YOU FULL BACKUP AND ARE READY FOR SOFT/HARD BRICK
IT MIGHT BREAK YOU PHONE !!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
OK ONLY IF YOU ARE 100% SURE
WE (NO ONE BUT YOURSELF) TAKE NO RESPONSIBILITY IF THIS WILL DO ANYTHING BAD TO YOUR DEVICE
PlayfulGod said:
Heres the link to the new app build that getprops ro.product.device = vee3e or vee3
Click to expand...
Click to collapse
*if your model is E425 L3II replace boot.img with THIS ONE (1.1ghz overclock E425 S=off )
*if your model is E435 L3II Dual Sim replace boot.img with THIS ONE (1.1ghz overclock E435 S=off )
1. DEVICETREE = CWM READY THANKS TO PlayfulGod LINK HERE
NEEDS FILLING TO BUILD KERNEL/ROM'S
*i'm trying at the moment but it doesn't seems to be going anywhere
ALL AVAILABLE DATA HERE:
Dump of all the partitions using dd if= of= command DROPBOX HERE
Original JB kernel / android source DROPBOX HERE Containing kernel.tar.gz 109 MB<<<Click for tree android.tar.gz 63.8 MB<<<Click for tree
Stock boot partition extracted DROPBOX HERE *zImage and ramdisk
Cwm builder extracted STOCK recovery partition DROPBOX HERE
2. KERNEL = (DRIVERS/OVERCLOCK/DPI{smoothing?})
Yess Thanks To @Cobmaster !!!
We have 1.2Ghz Overclock also its possible to change the DPI setting (I use 105 and "roboto enchanced" font)
1.2Ghz S=off latest build for e430 ONLY. included more governors and I/O shedulers boot.img * download and "dd" flash or replace boot.img in freedom tools above
Stock JB kernel source 3.4.0 DROPBOX HERE
Modded JB kernel by cobmaster GIT HERE
3. PORTING/MAKING CUSTOM ROM TWEAKS
SEE POST 2*Updating...
I have Ubuntu 13.10 x64 // Windows 7 x86 dual boot sdk/build environments set-up.
AND DEVICE FOR TESTING
I have managed to access few of the partitions, put a name to them Here is what i got till now: *If anyone can help resolve more partitions please do so
Code:
[B] *---------------------------- PartitionTable Info --------------------------*
Index| Partition Name | Logical Start Offset | Logical Size (KB) | File Offset | Physical Start Offset | Partition Size (KB) | Device Location
02 | QCSBL | 0xFFFFFFFF | 0x841CFBCD ( 949734KB) | 0x 100000 | 0x 0 | 0x 829 ( 1044KB) | /dev/block/mmcblk0p2
03 | OEMSBL | 0x3445474C | 0x 3033 ( 6169KB) | 0x 180000 | 0x 829 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p3
04 | EXT | 0x 0 | 0x 0 ( 0KB) | 0x 280000 | 0x 2829 | 0x 1D7D7 ( 60395KB) | /dev/block/mmcblk0p4
05 | APPSSBL | 0x 0 | 0xFFFFFFFF (4194303KB) | 0x 300000 | 0x 20000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p5
06 | WALLPAPER | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 22000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p6
07 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 24000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p7
08 | misc | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 26000 | 0x C000 ( 24576KB) | /dev/block/mmcblk0p8
09 | APPS | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 32000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p9
10 | MODEM_ST1 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 38000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p10
11 | MODEM_ST2 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p11
12 | MODEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3C000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p12
13 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 1D80000 | 0x 4A000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p13
14 | SYSTEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3100000 | 0x 58000 | 0x 1D0000 ( 950272KB) | /dev/block/mmcblk0p14
15 | PERSIST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3D100000 | 0x 228000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p15
16 | CACHE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 22E000 | 0x 140000 ( 655360KB) | /dev/block/mmcblk0p16
17 | RECOVERY | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 36E000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p17
18 | DRM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 374000 | 0x 4000 ( 8192KB) | /dev/block/mmcblk0p18
19 | FOTA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 378000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p19
20 | USERDATA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 37E000 | 0x 38C000 (1859584KB) | /dev/block/mmcblk0p20
21 | DLOAD | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p21
22 | BOOT_LOGO_IMAGE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70C000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p22
23 | MPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 70E000 | 0x 8000 ( 16384KB) | /dev/block/mmcblk0p23
24 | ENCRYPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 716000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p24
25 | CUST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 718000 | 0x 10000 ( 32768KB) | /dev/block/mmcblk0p25
26 | rct | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 40280000 | 0x 728000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p26
[/B]
Just a Tip
IF someone is pissed off like me when you plug your phone to usb and have to click 3 times before phone connects
1. DIAL 3845#*430# ]425/435[
2. UN-CHECK BOX IN: "Settings">>>"Auto run">>>"AutoRun Enable"
3. Reboot (not sure if necessary but i did)
NO MORE CHECKING FOR DRIVERS / SKIP EVERY-TIME YOU PLUG YOUR PHONE IN
EXTRA CREDITS TO :
Slipsystem
TEAM OPTIMA
x13n0114
linuxxxx
And others
*if you feel left out please pm/mention
Reserve [Updated]
1st ? MOD for E430 LG L3 II Beta State do not use unless you know what you are doing
slipsystem has managed to port he's SLIMSYSTEM MOD to our device.
for info on he's mod go here
I have tested it on my device and there is no errors as such.
some features of the mod might not work at the moment as its a alpha pre-view
please do adb pull /system (to securely fully backup) GUIDE ON ADB
before running this as we cannot confirm compatibility with every firmware yet
(we need people to test on their devices and post fw version (i.e. V10C_00) any errors logcat and screen much appreciated )
PLEASE DOWNLOAD AND RUN THIS
then zip the folder called slipsystem then upload it with a link to help us develop further
Please let us know if MOD works on your device.
Things that may not work (all to disappear)
Maybe left over apps/data from debloat
statusbar systemui
Features (more to come)
*Build.prop Tweaks
* Debloat
* Mod SystemUI
* LG Optimus G Lock
* Multi User
* App Replacements
* Init.d Support
* Ads Block
Q/A
Ota Updater is working!!.
Will we get updates?
Yes, if you guys keep in touch and send us the files that we need.
FIRST 2 ATTACHED IMAGES ARE SCREENS BEFORE
LAST 2 ATTACHED IMAGES ARE SCREENS AFTER
Also stay tuned to THIS thread
@slipsystem @AwesomeSMS
I asked lg if we are able to unlock The e430 bootloader but they said it is not Possible right now.
Sent from my Kindle Fire HD 7 using XDA Premium 4 mobile app
TESTERS
Testers for roms and such:
E430
http://forum.xda-developers.com/member.php?u=4782028 @Aimbot91
http://forum.xda-developers.com/member.php?u=5238274 @dadziokPL
http://forum.xda-developers.com/member.php?u=4302324 @Cobmaster
http://forum.xda-developers.com/member.php?u=4989941 @x13n0114
http://forum.xda-developers.com/member.php?u=3542146 @Daniolki
http://forum.xda-developers.com/member.php?u=5483119 @AwesomeSMS
E425
http://forum.xda-developers.com/member.php?u=5299788 @29y6145
if you want to be added or removed from list please quote or pm me
IGGYVIP said:
I want to unlock/bypass bootloader, probably update kernel and make/port custom rom (CM preferably)
For e430 e430
I know its a lot to do and that i will need a lot of help but it needs to be done
I know basics about the whole process
I have a lot of spare time
I have the phone for testing (not scared of bricking [i will push the life back to it])
I'm very good at research and spamming manufactures for datasheets/drivers etc.
I need some experienced dev to tell me exact what to look for
What would be EXACT steps trough the process of
1 BOOTLOADER = UNLOCKING / 2ND BOOT ?
2 KERNEL = ? (DRIVERS/OVERCLOCK/DPI{smoothing?})
3 PORTING/MAKING CUSTOM ROM (DRIVERS ETC.)
Please someone ( @-CALIBAN666- @linuxxxx @szymel0 ANYONE ) show me the right direction
@AwesomeSMS please help
Click to expand...
Click to collapse
sorry but i am at start of my android experience
i study technology in my country at high school however this is my first android smartphone
in this month i understood a lot of things maybe i can help you in somethings but i am not so big to port rom or rebuild bootloader
if you have informations tell me i would like to understand and learn
We are gonna need all the help we can get. Thank you!!
You can't have any rom
sorry
no one can develop on those, because mediatek is not developer friendly, they don't release any kind of driver for soc so ayone can compile a rom / kernel without them
my gf just bought the phone and want to see cm11 running on it like on my phone
so, how can we support your development?
we are both non it people, living a alternative live in the woods
linuxxxx said:
You can't have any rom
sorry
no one can develop on those, because mediatek is not developer friendly, they don't release any kind of driver for soc so ayone can compile a rom / kernel without them
Click to expand...
Click to collapse
LG L3 2 isn't MTK like the LG l5 2. This phone has no devs. That's Why
Sent from my LG-E430 using XDA Premium 4 mobile app
Hmmm
linuxxxx said:
You can't have any rom
sorry
no one can develop on those, because mediatek is not developer friendly, they don't release any kind of driver for soc so ayone can compile a rom / kernel without them
Click to expand...
Click to collapse
i have original JB kernel / system source
E430(Optimus L3II)_Android_JB_E43010b containing
kernel.tar.gz 109 MB
android.tar.gz 63.8 MB
aren't drivers included in this package ?
Can someone run this tool
https://dl.dropboxusercontent.com/u/51036208/Android/SlimSystem/L3 II/ForPort.zip
then zip the folder called slipsystem on your C drive
then upload it with a link
Okay! I just rooted my phone.
Sent from my LG-E430 using XDA Premium 4 mobile app
slipsystem said:
Can someone run this tool
https://dl.dropboxusercontent.com/u/51036208/Android/SlimSystem/L3 II/ForPort.zip
then zip the folder called slipsystem on your C drive
then upload it with a link
Click to expand...
Click to collapse
AwesomeSMS said:
Okay! I just rooted my phone.
Sent from my LG-E430 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
anyone interested ?
system patrtition tree list.txt
full framework.zip
e430
WOW
AwesomeSMS said:
Okay! I just rooted my phone.
Sent from my LG-E430 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
how come you didnt root b4 ?
AwesomeSMS said:
Okay! I just rooted my phone.
Sent from my LG-E430 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
nice you find a way to root the new firmware?
---------- Post added at 08:39 PM ---------- Previous post was at 08:36 PM ----------
IGGYVIP said:
anyone interested ?
system patrtition tree list.txt
full framework.zip
e430
Click to expand...
Click to collapse
nice thanks for this.
one thing I have noticed is that all the files are bigger than mine? strange I would have said it would be the other way around
---------- Post added at 08:52 PM ---------- Previous post was at 08:39 PM ----------
download taking its time. only 47 minutes left and I can start developing for your device
anyone want to be my tester?
slipsystem said:
nice thanks for this.
one thing I have noticed is that all the files are bigger than mine? strange I would have said it would be the other way around
---------- Post added at 08:52 PM ---------- Previous post was at 08:39 PM ----------
download taking its time. only 47 minutes left and I can start developing for your device
anyone want to be my tester?
Click to expand...
Click to collapse
lol it took less time to upload using my milestone 4 shared must be baaad
can you upload yours 4 compare ?
why you think yours should bigger ?
its zipped as store no compression
COUNT ME IN 4 TESTING
Ok if anyone is interested in trying. thanks to
@AwesomeSMS and @IGGYVIP for contributing there framework and apks
I managed to port my mod to your device.
for info on my mod go here
http://forum.xda-developers.com/showthread.php?t=2650588
I havent tested it yet this is a theoretical build so it might not work.
please do adb pull /system
before running this as I haven't tested it yet.
https://dl.dropboxusercontent.com/u/51036208/Android/SlimSystem/L3 II/slimsystemtest.zip
Please let me know if this works. Take some screenshots if you can.
Things that may not work
Calculator
Maybe left over apps from debloat
Features
Xperia Media Apps
Xperia Keyboard with swipe control
init.d support
Build.prop Tweaks
Quick Launch Status bar
Potato status bar gestures
Q/A
Ota Updater is not working?
I haven't added it to my ota account yet.
Will we get updates?
Yes, if you guys keep in touch and send me the files that I need.
Keyboard has switched to google voice?
you need to change the keyboard under settings.
why haven't the status bar icons changed
this mod was by gabi4175 i am still finding the icons he replaced.
slipsystem said:
Ok if anyone is interested in trying.
Click to expand...
Click to collapse
YES downloading as we speak
UPDATE:
Flashed no problem no errors
everything seems(i cannot check mobile network as my imei is damaged) to be working
ANYONE who wants to keep google chrome browser remove
Code:
rm /system/app/ChromeWithBrowser.apk
rm /system/app/ChromeWithBrowser.odex
rm /data/app/com.android.chrome-1.apk
out of slimsystem.sh
I want to keep mine
awesome work dude
after multiple reboots (by me) i have spotted it always opens browser on startup
screen included
ROOT
Rooted for a while (new software V**x_00 ?) here are screens
used superoneclick newest? and vroot superoneclick gave some errors and vroot finished proper
when i tried only with vroot it was rooted but not the shell i couldnt get su in terminal superoneclick must have done something because now i can
@AwesomeSMS
IGGYVIP said:
YES downloading as we speak
UPDATE:
Flashed no problem no errors
everything seems(i cannot check mobile network as my imei is damaged) to be working
ANYONE who wants to keep google chrome browser remove
Code:
rm /system/app/ChromeWithBrowser.apk
rm /system/app/ChromeWithBrowser.odex
rm /data/app/com.android.chrome-1.apk
out of slimsystem.sh
I want to keep mine
awesome work dude
after multiple reboots (by me) i have spotted it always opens browser on startup
screen included
Click to expand...
Click to collapse
Ok this is something to do with a init.d script. Just need to figure out which one. And to think I thought I was going crazy.
Hi, If this is a stupid noob question, then sorry.
I've got an xt1941-3 Motorola One. Figured out how to put LineageOS 17.1 on, and was looking at opengapps for the play store and google maps only. Since I literally only want the play store app and google play services for the location services, I wrote an exclude file for gapps that looks like this
Code:
# .gapps-config-deen
# Exclude all extras from pico package
# Pico+
CalSync # Install Google Calendar Sync (if Google Calendar is being installed)
DialerFramework # Install Dialer Framework (Android 6.0+)
GoogleTTS # Install Google Text-to-Speech Engine (Micro+ on 5.0-, Pico+ on 6.0+)
PackageInstallerGoogle # Install Package Installer (Android 6.0 only & Android 8.0+)
This results in all the packages except for the Google DialerFramework to be excluded. Looking at the gapps logs, I see That gapps is claiming that the AOSP DialerFramework "is not available on your ROM (anymore)"
The device was factory reset prior to having lineage flashed to ensure a clean install of gapps.
dalvik, system, data was all wiped before the lineage install, so not understanding how the aosp version is not there (anymore).
Code:
# Begin Open GApps Install Log
------------------------------------------------------------------
ROM Android version | 10
ROM Build ID | lineage_deen-eng 10 QQ3A.200605.001 eng.root.20200710.200251 test-keys
ROM Version increment | eng.root.20200710.200251
ROM SDK version | 29
ROM/Recovery modversion | 17.1-20200711-UNOFFICIAL-deen
Device Recovery | TWRP 3.2.3-0-08ee1e2f
Device Name | deen
Device Model | motorola one
Device Type | phone
Device CPU | arm64-v8a,armeabi-v7a,armeabi
Device A/B-partitions | true
Installer Platform | arm
ROM Platform | arm64
Display Density Used | unknown
Install Type | Clean[Data Wiped]
Google Camera already installed | Clean
VRMode Compatible | false
Google Camera Compatible | true
New Camera API Compatible | false
Google Pixel Features | false
Current GApps Version | No GApps Installed
Google Camera version | Legacy
Installing GApps Zipfile | /external_sd/Packages/open_gapps-arm64-10.0-pico-20201110.zip
Installing GApps Version | 20201110
Installing GApps Type | pico
Config Type | exclude
Using gapps-config | /external_sd/Packages/.gapps-config-deen
Remove Stock/AOSP Browser | false[NO_Chrome]
Remove Stock/AOSP Camera | false[NO_CameraGoogle]
[B] Remove Stock/AOSP Dialer | false[NO_DialerGoogle][/B]
Remove Stock/AOSP Email | false[NO_Gmail]
Remove Stock/AOSP Gallery | false[NO_Photos]
Remove Stock/AOSP Launcher | false[NO_GoogleNow/PixelLauncher]
Remove Stock/AOSP MMS App | false[NO_Messenger]
Remove Stock/AOSP Pico TTS | false[NO_GoogleTTS]
Ignore Google Contacts | false
[B] Ignore Google Dialer | true[NoRemove][/B]
Ignore Google Keyboard | false
Ignore Google Package Installer | false
Ignore Google NFC Tag | false
Ignore Google WebView | false
Total System Size (KB) | 2580272
Used System Space (KB) | 1338072
Current Free Space (KB) | 1225816
Post Install Free Space (KB) | 1064544 << See Calculations Below
------------------------------------------------------------------
# End Open GApps Install Log
[B]NOTE: The Stock/AOSP Dialer is not available on your
ROM (anymore), the Google equivalent will not be removed.[/B]
# Begin GApps Size Calculations
------------------------------------------------------------------
TYPE | DESCRIPTION | SIZE | TOTAL
| Current Free Space | 1225816 | 1225816
Remove | Existing GApps | + 0 | 1225816
Remove | Obsolete Files | + 0 | 1225816
Remove | cmsetupwizard | + 0 | 1225816
Remove | extservicesstock | + 96 | 1225912
Remove | extsharedstock | + 24 | 1225936
Remove | provision | + 0 | 1225936
Install | Core | - 152176 | 1073760
| Buffer Space | - 9216 | 1064544
------------------------------------------------------------------
Post Install Free Space | 1064544
------------------------------------------------------------------
# End GApps Size Calculations
# Begin User's gapps-config
CalSync
DialerFramework
GoogleTTS
PackageInstallerGoogle
# End User's gapps-config
What am I missing? Please help understand!
Edit: this may be related to this other problem encountered that I wrote about here: https://forum.xda-developers.com/motorola-one/how-to/problems-google-apps-infecting-fresh-t4191039
JFYI, I just received the Play-systemupdate of Dec 1, 2021.
See screenshot.
This is what got updated (for me): packages + version (after update):
Code:
com.google.android.modulemetadata | 2021-12-01S+
com.google.android.networkstack | aml_net_3112130
com.google.android.networkstack.tethering | 12-7798439
com.google.android.odad | S.8.playstore.p
com.google.android.permissioncontroller | aml_per_3112110
com.google.android.providers.media.module | 12-7964833
Not yet for me.
I'm still on November. Is it just me?