Root Auto-Key Factory Recovery Patcher--- Testers Wanted

[Bigcountry907]

Well this is a pretty exciting moment for me.
I have spent many hours writing some serious shell scripts.

First of all let me tell you a little bit about Auto-Key. What is it?

Auto-key is a program built using shell scripts with the original intention of patching a stock recovery to allow everyone to flash zip files through the stock recovery.

In the case of the One Touch Fierce 2 and many others I am sure there is no TWRP or CWM for the device yet.
And as well no way to flash a backup of the phone when things go wrong leaving us with an unusable device.
It's not bricked but we cant repair system files because we can only flash a update that is signed by the manufacturer.

Well my friends sadly enough for manufacturers those days are over.

Here is how it works.

First the program pulls the /system folder off the phone.
Next it grabs the OTACERTS.ZIP or RELEASEKEY.X509.PEM from the system folder.
This allows us to determine what public exponent was used by the manufacturer.

Then Auto-key will make you your own set of private and public keys. This is a complete set of keys that could be used to compile a custom rom like cyanogenmod or aosp.

Next after auto-key determines the stock offset value it creates the elusive /res/keys file.
The keys file is dumped using you private keyset.

Then we unpack the recovery image and replace the /res/keys file in the ramdisk with our new one.

Once that is done and any other modifications you want to make to the ramdisk are completed the ramdisk gets re-packed.

After all that its just a matter of copying the recovery.img to the sd card and then using DD to write it to the recovery partition.

Sign any zip you want to flash with the new recovery, and yes it will work in fastboot if your device supports fastboot,

Anyway itll flash the file.....You wont get signature failed.

Please note you must sign the zip with the -w option, Signapk.jar alone is not good enough.


Now i need a few more days to finish things up so im not including the flashing or repacking functions today.

This way there is zero risk of anyone doing any kind of damage. If you are a developer you could easily do the repack and dd and sign the zip with -w if you want.

Right now i need to know what all dependencies are going to be required to run my program. And make sure that everything functions well on other systems.

Currently it is designed for a linux system. I am running Ubuntu and I have a full development enviornment installed. I will try to get this going in cygwin for windows so some testing there could be helpful as well.

All the scripts are open and free to modify as you wish. Just share your ideas.

Im going to start testing this tommorow on a fres ubuntu install and then on windows.

The program will tell you what to do when you start running it. Pretty much follow the menus in order.
When you go to a sub menu complete all the options before you return to the previous menu. Then execute the next function on the menu.

Like i said there is currently no function included that could hurt any device. So take it for a spin. I want some feedback and ideas and see what we run into before i spend a week refining it all.

Thanks Have fun and enjoy.

PS you have to unzip the file in your home directory.

So the folder Auto-key will be in your home directory.

type ./autokey.sh to start it from the auto-key folder.

Minimum requirements are
ADB
JAVA
OPENSSL

This runs in the terminal only.

 

[Bigcountry907]

It is still ok to test with this version that is uploaded.
But i am still working on the program.

I have added project management to manage files for multiple products.

I am updating the boot image tools to handle really wacky images with very non-standard offsets and includes support for images that include DTB and the dt.img.

And I am writing a device backup function that will make a standard CWM TWRP style device backup.

I also added other image tools for managing images.
Mount ext4, yaffs, sparce, yaffs2 and other image types.
Re-pack create these img types from files.

Im doing all this because i work on so many different devices that i want a tool-set to do all the things you end up doing manually when developing for a new device. Quicker and easier.

Many good things to come. Its just a matter of how long it takes me to write all this code.

 

[Tyler Dean Osborne]

I'd be very interested in using this program. I'll have to use a vm due to using Windows 10. My biggest issue is that I'd love to learn all this stuff myself. I'm only a novice Computer Science major at my local community college. I've yet to write any of my own programs but I really want to. The reason I've looked into this because I have the sister phone to yours, the Pop Icon (clone of yours but with CDMA) and I need to root it to give more storage space. This would also be my first Android device that I've been unable to root. Thanks for your time.

 

[Bigcountry907]

In order for me to assist you i would need more information about your phone.

Also do you have ADB installed?
Its the android sdk program.

If so i would try using kingroot for pc.
Its in chineese but seems to work good on these phones.

http://www.kingroot.net/

I used the windows version. Had to run it a few times before i got the phone rooted but it did the trick.

You will need to search the adb drivers for your phone and install them. Then load up adb
and make sure it connects to phone.

I am not sure how experienced you are but if you google search root for your specific device you can probably find some info.

The autokey program is for patching the recovery.img to allow flashing of a cooked rom built from a backup. In the case where there is no recovery like TWRP or CYM available for the device this is the only way to flash a rom.

If you get the phone rooted and send me your recovery image I can patch it for you. There isn't a whole lot we can do without root first. I haven't gotten to deep intodeveloping new root methods so i cant help much there.

My program is built from a linux shell script. If you want to learn its not too hard. Start by studying the process of what you want to do. Like unpack recovery images or signing files. Search around and find the commands used in adb to do those things. Download other peoples script files and see how they do things.

Once you get the hang of it comes down to knowing what command you want to execute. What information you need from the device to build the command. And what output you want to see.

Then you give it some conditions. Like if you get the information you need to run the command then run the command. Else output an error.

Bash is like windows batch program. Only way more powerful. And all of the information you need is on google. If you search bash and what you want to do you will get some idea how yo do it.

Anyway see if you can pull the build.prop file from the phone and send it to me or post it.

Then i can point you in the right direction and provide the correct advice for your device.

 

[Ikonex]

Would it be possible to post screenshots of the program?

 

[Ikonex]

And I get the general process of things but I am more of a visual learner due to my brain having difficulties processing steps through text

 

[Bigcountry907]

Yes I will post some screen shots. I have made a lot of changes to the program recently and i haven't finished everything yet. So some of the formatting will be different. And some of the menus have changed. But ill show you where i am at.

Menu #1 ( Project Management )

This menu is for:

#1 Create a new project - For adding more than one device.

#2 Pick the device you want to work on.

The files created by the program will be saved in the project folder of the project you select. This way device files don't get mixed up.

#3 Delete Project

To remove no longer needed projects obviously.

#4 Work on current Project

Will take you to the next menu to start working on the project you selected.

I will post alot more but this first post was a test. Be right back so hold of on any replies please.

 

[Bigcountry907]

Menu #2 ( Main Menu)



This is the main menu. Some of the options open sub menus.

#1
Checks the phone for working adb connection.
Checks if root access is available. ADBD Insecure
Checks for SU access.

#2
Opens the sub menu for getting your device files into the project.
Includes:

Generating a CWM or TWRP style backup using the same process as Onandroid. Currently I am working on this part of the script.
The script i have written automatically detects the partition information of the device. There are a lot of variations so it has taken some time to come up with a routine that works efficiently. Im pretty sure I have it nailed down now. I've tested it on 7 different devices ranging from yaffs2 partitions to the current emmc we have now. It could take some more work to get the info from every device and thats the reason i need testers.
I want this program to be universal. I have a routine that finds the byname path and as long as i can find the by name path i can get all of the mountpoints.

Copy a current CWM or TWRP backup off of your SD Card.
I have developed a method of getting the path to the sd card. Thanks to the writer of onandriod. I use a similar method with some modifications. The onandroid script runs on the device. All of my routines run through ADB without pushing files to the device. It is much more difficult to do that.

Copy a rom to the project folder manually.
This also will work. This would be for the extracted files that you have from any method.
You place your extracted files in the project and the program will work with them..


Use a factory rom.
Will properly mount or extract different types of image file roms.
Including sparce images, yaffs images, ext4 images, dd dump images, If there is a image type out there I should be able to process it.

Again this is a work in progress. I have a plan and the binary to do all this I just need to finish writing the script. I want this program to handle all situations. A one stop shop.

#3
Opens the key making menu.
The key maker menu will allow you to generate your own set of private keys.
Basically the same as AOSP if you built from source. Many roms use testkeys which everyone has access to. For more security you create private keys that only you have access to.

Primarily I created this to defeat the signature verification of the factory recovery.
It also will dump the private keys to the /res/keys file so you can replace the res/keys in the recovery ramdisk.

Then if you sign your new zip file with your private keys you can flash anything you want through the modified stock recovery.

When you have a locked boot loader and you cant flash cwm or twrp you are able to use this patch.
The locked boot loader accepts and boots the modified stock recovery.img. And since you signed it. You have the private key. Just like the manufacturer. So you have the ability to update through the factory recovery.

#4
Opens the image file menu

This will unpack and repack boot.img and recovery img correctly.
I am updating the boot image tools so it is currently capable of handling all boot images standard or not.
It automatically detects all the offsets and type of image and ramdisk you are dealing with.
Automatically unpacks and correctly repacks the images with the right offsets and command line.

This menu is also going to have the options for unpacking / packing all types of images. Yaffs2, Sparce, Chunk whatever you got.

#5
Flashing Menu

This option opens a menu to flash files to the phone.
It works using adb push / dd commands and fastboot.
but it automatically finds the correct partition to flash depending on what you are flashing.

#6
Signing Menu
Automatically signs roms or zip files using the sign whole file method.
At some point in time it will include signing apps and other files correctly as autokey currently creates the 4 keys needed to sign anything. Each key is used to sign specific types of files within the rom.

#7
takes you back to project management.

Further more i plan to include complete rom building. Generating Meta-Inf and updater script.
And all of the fun things that go along with that. But before i go there i want to finish what i have already planned. Currently i have been working on this project for approximately 6 weeks. It takes a lot of time to write all this code and test it by myself. Especially since im making it universal. I anticipate a few more weeks before i have a fully functioning release for the public. The other thing is it will output detailed messages of what you need to do. Including when things go right and when things go wrong. I will post shots of the 1st option. DEVICE TESTING. It will give you an idea of what things are going to be like with this program.

Message / instructions



Success / messages





Error Messages





Other Menus / Still Working on them





There is alot more to go over and show you. But i have to budget my time. I have alot going on in the fierce 2 rom thread and i got to get back to writing my tutorial.

If you think you want to get involved in this project let me know. I am open to help. Testing or Writing Script. Also need someone to test for required dependencies in linux. I run a full dev system. And if this is gonna ever run on windows we need to get alot of stuff together for cygwin and edit the code for cygwin.

I do as much as i can. Unfortunately I had to get a job. So thats 8 hours a day I loose on this project now. I still put in at least 4 to 6 hours a day on android projects. Help would be appreciated.

 

[Ikonex]

Thanks... That helps a lot

 

[Ikonex]

THATS GREAT NEWS. Man you are providing a future for this phone.. Great Job.

 

[Tyler Dean Osborne]

In order for me to assist you i would need more information about your phone.

Also do you have ADB installed?
Its the android sdk program.

If so i would try using kingroot for pc.
Its in chineese but seems to work good on these phones.

http://www.kingroot.net/

I used the windows version. Had to run it a few times before i got the phone rooted but it did the trick.

You will need to search the adb drivers for your phone and install them. Then load up adb
and make sure it connects to phone.

I am not sure how experienced you are but if you google search root for your specific device you can probably find some info.

The autokey program is for patching the recovery.img to allow flashing of a cooked rom built from a backup. In the case where there is no recovery like TWRP or CYM available for the device this is the only way to flash a rom.

If you get the phone rooted and send me your recovery image I can patch it for you. There isn't a whole lot we can do without root first. I haven't gotten to deep intodeveloping new root methods so i cant help much there.

My program is built from a linux shell script. If you want to learn its not too hard. Start by studying the process of what you want to do. Like unpack recovery images or signing files. Search around and find the commands used in adb to do those things. Download other peoples script files and see how they do things.

Once you get the hang of it comes down to knowing what command you want to execute. What information you need from the device to build the command. And what output you want to see.

Then you give it some conditions. Like if you get the information you need to run the command then run the command. Else output an error.

Bash is like windows batch program. Only way more powerful. And all of the information you need is on google. If you search bash and what you want to do you will get some idea how yo do it.

Anyway see if you can pull the build.prop file from the phone and send it to me or post it.

Then i can point you in the right direction and provide the correct advice for your device.

I've used Linux a lot is just I always revert back to windows. The problem with my phone is that I know most methods I've owned twice Android devices since 2010. If I can get kingroot to work this time great I've tried it multiple times though. If and when I get it rooted I'll happily rest your software as it should in my phone considering us the sister to yours.

 

[Bigcountry907]

Yes actually I have written auto-key to work for all phones.
Try installing kingroot app and install kinguser app.
Then download kingroot for windows.
Run Kingroot for windows try 2 or 3 times.
Check your apps if the phone reboots and clear all cache of any king app.
You should also see a root helper app get loaded on your phone by kingroot windows.

If kingroot in windows dont work then try the kingroot app.

I kinda went through this same process with someone else and after kingroot windows failed a couple of times we ran the kingroot app and the phone rooted right away.

My only other suggestion is to do ADB Pull /system/build.prop
Send me the file.
If i know your device specifics I may be able to give you a more exact root method to try.

http://www.kingroot.net/
https://play.google.com/store/apps/details?id=com.kingouser.com&hl=en
https://play.google.com/store/apps/details?id=net.mydev.kingproroot&hl=en

 

[Tyler Dean Osborne]

Yes actually I have written auto-key to work for all phones.
Try installing kingroot app and install kinguser app.
Then download kingroot for windows.
Run Kingroot for windows try 2 or 3 times.
Check your apps if the phone reboots and clear all cache of any king app.
You should also see a root helper app get loaded on your phone by kingroot windows.

If kingroot in windows dont work then try the kingroot app.

I kinda went through this same process with someone else and after kingroot windows failed a couple of times we ran the kingroot app and the phone rooted right away.

My only other suggestion is to do ADB Pull /system/build.prop
Send me the file.
If i know your device specifics I may be able to give you a more exact root method to try.

http://www.kingroot.net/
https://play.google.com/store/apps/details?id=com.kingouser.com&hl=en
https://play.google.com/store/apps/details?id=net.mydev.kingproroot&hl=en

ok thank you sorry would've responded earlier have a baby due soon and wife is needing a lot of help lol

 

[cyclops93]

First of all,Thank you for your script and it is amazing to do that factory recovery signification but ı have a linux mint and i can't patch recovery 5. step i installed all openssl, java sdk and adb libraries.I really need to do that because my phone is bricked bootloader is locked ,stock recovery and phone is not turn on i can only push a zip file to phone if i flash my phone imei number will be deleting. so i need your help i cant' change recovery and phone is not open i dont want to do flash firmware (addinitonaly i can generate a key and signification zip files i thing there are openssl process and java process so there is a no library problem)

sorry for my bad english

 

[Bigcountry907]

Here is a link to a newer version of Auto-Key.
https://drive.google.com/file/d/0B8jitdIyh2NtMHo4Q1ZLbFk3aEE/view?usp=sharing

make a folder in the home dir called auto-key
unzip the file in there

Signing the zip will work with this.
Just use the keys i sent along in the package.

Only thing is if the recovery.img is alot newer you might have to use the new boot tools.
I havent written them in the software yet.

Under the folder boot in auto-key
Put your recovery.img in the boot folder

cd ~/auto-key/boot

type
./mkboot recovery.img new-ramdisk

that will unpack the recovery.

open the new-ramdisk folder

go to /res in the new-ramdisk

there is a file called keys

delete it

go to the the keys folder in auto-key

~./auto-key2/keys/factorykey/res/e-0x3
copy the keys file to the

new-ramdisk/res folder

cd

cd ~/auto-key/boot

type
./mkboot new-ramdisk patched-recovery.img
it will repack the recovery

Then you have to flash patched-recovery.img to the recovery mmcblk of your device.
You will have to use the dd command in adb if you can.
Not sure what type of access you have with the bootloop.

example command may work for you
just make sure that the patched-recovery.img is in the dir that shell is cd to.

then type
adb push patched-recovery.img /storage/sdcard0
or
adb push patched-recovery.img /storage/sdcard1

whichever one is your sd card.

then type
adb shell
su
dd if=/storage/sdcard0/patched-recovery.img of=/dev/block/mmcblk0p?? "make after the p your correct partition for recovery"

To sign files put them in the tosign folder in the auto-key folder
only 1 file ata a time can be in that folder
run akey.sh
select sign files
select option 1 in the sign files menu.

You will find the signed zip in /auto-key/output.

If you need more help let me know.

 

[Bigcountry907]

What phone do you have?
I'm not sure how you will flash the recovery.img.

I might have a recovery.img for your phone allready.
Or I could make you one if you need more help.

What is your plan to flash the recovery to the phone? How?

 

[cyclops93]

i have an access phone on DFU mode and i can copy update.zip file in to it(sdcard) , if update.zip signing is passed recovery will be boot. but on terminal i cant use "su" and "dd" because phone is not rooted only access is DFU...
The Phone is : ZTE Blade Vec 4G and rom is Belgium Rom(phone has different roms and different recovery files)
when i use stock rom phone is'nt open(stuck on logo) all i need is open bootloader or recovery.if i can change recovery i will do root easly or if i can unlock bootloader i can flash something easly...

 

[cyclops93]

https://drive.google.com/folderview?id=0BwC2WY3ebSIXTXdWbkcxelR2ejQ&usp=sharing
files of my original stock rom(belgium which is on my phone)

https://drive.google.com/folderview?id=0BwC2WY3ebSIXSlRCaElid2hiSGc&usp=sharing
files of custom(original rom but bootloader is unlocked)(Turkey rom)

My plan is unpacking turkey rom and re-signing whit belgium recovery key so recovery will pass my zip file and bootlader will be unlocked.
is it Dream because only way is this.

 

[Bigcountry907]

@cyclops93
It is a nice Idea but if it is the stock from the factory recovery that is currently flashed on your phone this will not work.
The custom rom is going to be signed most likely with standard test keys. If it was built from source.
IE: AOSP or Cyanogenmod.

The problem is in any rom that is flash-able the only key in the rom is the Releasekey.pem or Testkey.pem.

That is the public half of the key pair.

You also need the releasekey.x509.pk8 or testkey.x509.pk8 which is the private key in the keypair.

Only the factory has the pk8.

That is why i patch the recovery. Then i can use my own .pem and .pk8 for signing zip file.
The /res/keys in the recovery.img verifies that the zip was signed by the same .pem and pk8 keypair.

So you see you need both keys .pem and .pk8 + the /res/keys made from the .pem .pk8 pair or zip will fail signature.

Im not sure what DFU mode is. Is it fastboot? Can you get the phone into fastboot mode. If yes then we can load the recovery.img to the phone and flash the custom rom.

I can make the recovery.img and sign the zip for you. But without fastboot or shell access it wont help.

If you got fastboot were set.

 

[cyclops93]

Dfu mode is the mode which you can access files on your mobile (it is including system folder and sdcard,not ramdisk) yes i know i need a private key .pk8... i know fastboot mode but it is locked... is there any trick or way to defeat recovery like for exp. in build.prob we can change or delete phone checking text. I can't open phone if i do i can acess debug mode and i can easly root it with kingroot etc.

 

[Bigcountry907]

No there is no way to turn off signature verification in a stock recovery.
Have you checked to see if ZTE has a firmware update or factory firmware package?

That would fix it enough for us to get in.

 

[Bigcountry907]

here you go.
the recovery will allow you to run this.
Its spanish though.
But it might get you in.

http://www.ztedevice.com/support/14a8704e-de3c-400e-839c-3c35bd16f065.html

Should be a complete factory rom.
Install it first then we can do more.

 

[Bigcountry907]

I would try the factory rom above first. I goes on the sd caard. Previous post.

If that dont work try this maybe.
http://www.how-to-flash.com/2015/10/zte-blade-vec-4g-6645.html

 

[Bigcountry907]

yes this should fix your troubles.
It is the factory rom that the recovery will accept.
http://www.ztedevice.com/support/14a8704e-de3c-400e-839c-3c35bd16f065.html

Option 1 copy update.zip to sdcard boot into recovery and select install update from sd card.

Option 2 use adb sideload to send the update.zip to the phone if you can boot into recovery and have update from adb or sideload.

once your back up and running you should be able to flash the custom rom again.

 

[cyclops93]

Ok I'll try thank you for your answers i'll post back if it is success