Root Porting ClockWorkMod to the Kyocera Rise

[Alastor10009]

It does seem like a waste but even if we wipe the entire os will the power button plus the down- volume work as safe mode andhave a stock version available and then even as a paperwight it would still go back its stock rom? Right. Or someone with a bricked kyocera rise try to get safe mode working if it does go to its stock rom then maybe that's where we need to start looking in entering commands into the bootloader.? Ideas.?

 

[cooldudezach]

It does seem like a waste but even if we wipe the entire os will the power button plus the down- volume work as safe mode andhave a stock version available and then even as a paperwight it would still go back its stock rom? Right. Or someone with a bricked kyocera rise try to get safe mode working if it does go to its stock rom then maybe that's where we need to start looking in entering commands into the bootloader.? Ideas.?

Power + Volume Down = Recovery
Power + Volume Down + Volume Up = Safe Mode

Recovery would be wiped in the process, and is entirely useless to us anyway. Safe mode just boots into the normal OS, but does not load and used apps. Both would be useless if they are wiped. The only way to go back to a stock rom after wiping everything would be to flash a ROM from fastboot or recovery. We know that both our recovery and fastboot are locked down in one way or another, preventing us access into the phone.

Now, I have an idea that follows this thinking that might work?
We have 20 partitions, and some just seem to sit there. Do we have a full list of all of them yet? Maybe if we were to zero the correct one out might get us where we need? At one point in my mucking around I created a few half lists, but I don't know if I stumbled upon all of the names for the partitions.

 

[sneaky_1]

Power + Volume Down = Recovery
Power + Volume Down + Volume Up = Safe Mode

Recovery would be wiped in the process, and is entirely useless to us anyway. Safe mode just boots into the normal OS, but does not load and used apps. Both would be useless if they are wiped. The only way to go back to a stock rom after wiping everything would be to flash a ROM from fastboot or recovery. We know that both our recovery and fastboot are locked down in one way or another, preventing us access into the phone.

Now, I have an idea that follows this thinking that might work?
We have 20 partitions, and some just seem to sit there. Do we have a full list of all of them yet? Maybe if we were to zero the correct one out might get us where we need? At one point in my mucking around I created a few half lists, but I don't know if I stumbled upon all of the names for the partitions.

Is there a /cache/recovery/last_log on the rise? I don't have the phone on me ATM. It should give partittion info and more.

 

[db2]

Is there a /cache/recovery/last_log on the rise? I don't have the phone on me ATM. It should give partittion info and more.

I posted that partition information here already.

 

[Deleted User]

Thank you for contacting Kyocera Communications Inc. This email message is in response to your inquiry regarding the bootloader for your Kyocera Hydro.

We are sorry to hear about the difficulties you are experiencing and appreciate the opportunity to assist you.

The bootloader can only be used by the factory or an Authorized Distributor are allowed to flash the firmware through a desktop software. It is not available for End-users as it will void the warranty and breach the contract with the service providers.

If you have any further questions, or are interested in purchasing, or information on accessories for your Kyocera Communications Inc. phone, please contact us at any of the phone numbers listed below:

Well time to start looking into second init

 

[cooldudezach]

Well time to start looking into second init

Or bugging an Authorized Distibutor. -sigh-

How does 2nd init work, exactly? I tried looking at it a few weeks ago, but got sidetracked.

 

[ngtwolf]

PLEASE REMEMBER TO NOT FLASH ANYTHING TO EITHER OF THESE PHONES, IT WILL BRICK YOUR DEVICE

Actually, I was able to flash random recovery images through adb (via dd) without bricking the device. Of course, the recovery images didn't work and would no longer boot to recovery, but after booting back into system I was able to dd the stock recovery image back onto the device and get back into stock recovery again (for what little good that is). As long as we don't kill the system, we should be good.

This does lead me to my next question, if the system image is corrupted, how do we recover from that? As far as we can tell, there is no way to do that (no restore option in recovery). Thus, maybe if we approach it from that aspect, we can contact kyocera and tell them our os is corrupted (maybe state that it gets some android error after booting and that a full wipe from recovery didn't help). Maybe they have some tool like kies for samsung (or odin or whatever) that will repartition and reimage a phone. I can't imagine they'll expect everyone to mail their phones back for something relatively minor like that?

 

[db2]

This does lead me to my next question, if the system image is corrupted, how do we recover from that? As far as we can tell, there is no way to do that (no restore option in recovery). Thus, maybe if we approach it from that aspect, we can contact kyocera and tell them our os is corrupted (maybe state that it gets some android error after booting and that a full wipe from recovery didn't help). Maybe they have some tool like kies for samsung (or odin or whatever) that will repartition and reimage a phone. I can't imagine they'll expect everyone to mail their phones back for something relatively minor like that?

Tried that, they pass the buck down to the carrier.

 

[ngtwolf]

Tried that, they pass the buck down to the carrier.

Okay, I just tried as well, so we'll see. I do have an answer for the carrier issue, so i'll see how far I can go before I (or they) lose interest.

 

[Deleted User]

Well, I literally meant for any one with no experience to not flash anything.
A very talented developer by the name of hroark13 bricked his. Now I do not recall if it was recovery or a boot.img he flashed, I would have to ask, but that was the reasoning for my warning.

As far as second init, I have know clue. Shabbypenguin had recommended I looked at the bootstrap for the LG motion as a possibility. Keep in mind this could cause a brick also.

If I could find these for even cheaper I would throw anything at it. But for now its touch and go

 

[ngtwolf]

As far as second init, I have know clue. Shabbypenguin had recommended I looked at the bootstrap for the LG motion as a possibility. Keep in mind this could cause a brick also.

I looked up the LG motion briefly but I'm not sure if theres anything there; the specs look quite different as well as I don't really see how the recovery works on that. On the bootstrap items, I did try using the droid's bootstrap recovery apks, but they failed to install - probably does a check to keep people from screwing their devices up - not sure.

 

[ngtwolf]

On the bootstrap items, I did try using the droid's bootstrap recovery apks, but they failed to install - probably does a check to keep people from screwing their devices up - not sure.

Used a different installer and the installer worked, but did nothing. Tried both the Droid 2 and the Droid 3 bootstrapper. I didn't expect them to work, but I figured what the hell.

 

[cooldudezach]

Well, I kind of feel like an idiot. I was mucking about the init scripts for the recovery ramdisk, and saw mentions for debugging and adb. Looked up the config that was mentioned, and it was right there at the top of the default.prop file. -_-

#ro.secure=1
#ro.debuggable=0
ro.secure=0
ro.debuggable=1

The commented lines are from stock, the uncommented lines are what we need. This is why we can't get adb in recovery. If somebody could figure out how to build even the stock recovery with these flags set, we'd at least have adb in recovery, and could start mucking about with /system.

 

[cooldudezach]

Just got a reply back from Kyocera.

Thank you for contacting Kyocera Communications Inc. This email message is in response to your inquiry regarding your Kyocera C5155 Rise from Virgin Mobile and you want to be able to unlock the bootloader.

We are sorry to hear about the difficulties you are experiencing and appreciate the opportunity to assist you.

Bootloader is also known as Download Mode.

We escalated this case to our corporate office and here is their response:

"Download Mode is a state the phone can be in that allows the factory or an Authorized Distributor to flash firmware through a desktop software. It is not available for End-users as it will void the warranty."

Even though endusers are already aware that unlocking the bootloader will void the warranty, Kyocera will stiill restrict the endusers of unlocking the bootloader to prevent future problems.

Jerks.

 

[daygen4545]

Just got a reply back from Kyocera.
Jerks.

Although that is very helpful from kyocera, It would be nice if they wouldn't be completely dumb and restrict our use of the software.

 

[db2]

If somebody could figure out how to build even the stock recovery with these flags set, we'd at least have adb in recovery, and could start mucking about with /system.

The building (rebuilding) is actually easy, but it won't match what the bootloader is checking for anymore and it will reject it. Still worth a shot though, but if it works I'll eat my hat.

edit: I'm going to test something, if it works I'll make a new reply, if it fails I won't bother. edit 2: Nope, no go.

 

[db2]

Some more partition info, from "fdisk -lu /dev/block/mmcblkp0"

Disk /dev/block/mmcblk0: 2000 MB, 2000683008 bytes
1 heads, 16 sectors/track, 244224 cylinders, total 3907584 sectors
Units = sectors of 1 * 512 = 512 bytes

Device Boot Start End Blocks Id System
/dev/block/mmcblk0p1 1 65536 32768 c Win95 FAT32 (LBA)
Partition 1 does not end on cylinder boundary
/dev/block/mmcblk0p2 * 65537 66560 512 4d Unknown
Partition 2 does not end on cylinder boundary
/dev/block/mmcblk0p3 66561 69120 1280 46 Unknown
Partition 3 does not end on cylinder boundary
/dev/block/mmcblk0p4 69121 3907584 1919232 5 Extended
Partition 4 does not end on cylinder boundary
/dev/block/mmcblk0p5 73728 81919 4096 47 Unknown
/dev/block/mmcblk0p6 81920 90111 4096 5d Unknown
/dev/block/mmcblk0p7 90112 98303 4096 58 Unknown
/dev/block/mmcblk0p8 98304 114687 8192 48 Unknown
/dev/block/mmcblk0p9 114688 131071 8192 50 Unknown
/dev/block/mmcblk0p10 131072 139263 4096 4a Unknown
/dev/block/mmcblk0p11 139264 147455 4096 4b Unknown
/dev/block/mmcblk0p12 147456 770047 311296 83 Linux
/dev/block/mmcblk0p13 770048 1589247 409600 83 Linux
/dev/block/mmcblk0p14 1589248 1605631 8192 83 Linux
/dev/block/mmcblk0p15 1605632 1622015 8192 60 Unknown
/dev/block/mmcblk0p16 1622016 1736703 57344 61 Unknown
/dev/block/mmcblk0p17 1736704 1753087 8192 83 Linux
/dev/block/mmcblk0p18 1753088 1835007 40960 83 Linux
/dev/block/mmcblk0p19 1835008 1859583 12288 62 Unknown
/dev/block/mmcblk0p20 1859584 3907583 1024000 83 Linux

Apparently 2GB built-in, everything I'd seen on other sites either says nothing about it or says 1GB.

 

[db2]

The Rise is definitely checking everything, not just the kernel. Repacked the recovery image with a minor change to the ramdisk using the same kernel, rebooting to recovery it checks and then reboots again normally. So that simple way to get adb working in recovery is a no-go, sorry folks.

Can also confirm reflashing the recovery partition with stock works fine, for what little good that does anyone. We already knew that, but can't hurt to confirm it.

 

[Deleted User]

The Rise is definitely checking everything, not just the kernel. Repacked the recovery image with a minor change to the ramdisk using the same kernel, rebooting to recovery it checks and then reboots again normally. So that simple way to get adb working in recovery is a no-go, sorry folks.

Can also confirm reflashing the recovery partition with stock works fine, for what little good that does anyone. We already knew that, but can't hurt to confirm it.

I believe the recovery has to be signed with the release keys set by kyocera. And that's what the bootloader is checking. The security is in the bootloader, I don't think there is a locked down hardware bootloader, if I was reading that link I posted correctly.
Maybe the issue with unlocking it is, kyocera doesn't know how lol. They built it from source and chose the secure version.

 

[daygen4545]

I believe the recovery has to be signed with the release keys set by kyocera. And that's what the bootloader is checking. The security is in the bootloader, I don't think there is a locked down hardware bootloader, if I was reading that link I posted correctly.
Maybe the issue with unlocking it is, kyocera doesn't know how lol. They built it from source and chose the secure version.

There's probably a very good chance that's what they did actually. Now, assuming they did do that, there would be a very small chance that we could actually get this program, unless anyone here knows someone who works there

But anyways, on topic a little more, I'm just taking a guess at this point, that we either need to:
A) Exploit the current bootloader/Flash a new bootloader that will allow unsigned recovery/boot/any other images to be booted into

B) Somehow figure out how Kyocera signs these, and attempt to do it ourselves?

 

[Deleted User]

Well I've built cwm and kernels, the bootloader can't be that far off.
Anyways I will have to research it alot more before I attempt it.

 

[cooldudezach]

Well I've built cwm and kernels, the bootloader can't be that far off.
Anyways I will have to research it alot more before I attempt it.

I've got a challenge for you, or anybody who feels like helping. Can you figure out which partition is the bootloader? I'm busy with catching up on school, but I want to mess around with a hex editor and the bootloader

 

[Deleted User]

I've got a challenge for you, or anybody who feels like helping. Can you figure out which partition is the bootloader? I'm busy with catching up on school, but I want to mess around with a hex editor and the bootloader

I'll look at it tonight. I have to pull all the partitions still.

 

[Deleted User]

If I remember right it is sys_boot

 

[micku92]

I just want to say thanks to all the devs that dedicate their time into making this phone better for all the other users. You guys are great!

Also, I want to start Android development so I can hopefully help you guys in the future. Is there any webpage that has tutorials or lessons on Android development? What would you guys recommend?