1. Download our Official Android App: Forums for Android!

Root Backgrounder to rooting and Android errata

Discussion in 'Android Devices' started by handy5876, Jun 30, 2011.

  1. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    If you are the type who needs to get the bigger picture before following detailed instructions then you may need to go through this.

    Background before rooting and flashing ROMs.

    Just to state the obvious the HTC desire has got the linux operating system at its core and the android virtual machine called the Dalvik virtual machine sits on top of this core. These are some of the areas you may need to get a handle on.

    ROM
    The desire has 572 MB RAM and 512 MB ROM space. The ROM is called so but actually is not read only and resides on NAND Flash memory which can be both read and written to. The ROM is like the hard disk of a PC and the sdcard is like a removable disk. Just like a PC which divides the hard disk into C: , D: etc Android divides the ROM into partitions. Android calls these partitions by different names like boot, system, data etc.
    - The first partition 'misc' is a very sensitive area which contains carrier data among other and is normally never touched even when you root, go soff or flash ROMs.
    - The 'recovery' partition contains a linux kernel specially tailored for flashing updates. During rooting this is replaced by a custom recovery from clockworkmod etc. The original recovery does not permit flashing of unofficial ROMs, backups etc and is extremely limited.
    - The next partition is 'boot' which houses the actual linux kernel used by android.
    - The 'system' partition houses the system apps and data. The term flashing ROMs mostly means installing a different system and boot image.
    - The 'data' partition houses the user apps and their dependencies.
    - The 'cache' partition houses the system cache.

    SDCARD
    The sdcard can be also divided into partitions. The first partition is generally the FAT32 filesystem of Windows which can be accessed on the PC by connecting with USB cable. The second partition is generally the ext filesystem of linux. sdext is not available on original device and is basically a mod for shifting your apps to sdcard when you are running out of space which is a vexing issue for desire owners. This is because in Android all user apps are installed only on 'data' partition which is on ROM and is 147 MB only and soon you run out of space. Note that this sdext methodology is different from android supported method of shifting of apps to sdcard.

    Bootloader
    The bootloader or hboot is the first piece of code executed by the device. It is accessed by booting with vol dn + power pressed. The hboot is similar to the BIOS of PCs. It does some checks and hands control over to the linux kernel(boot partition) if normal booting is followed. If interactive booting is followed and recovery is selected then it hands over control to recovery kernel(recovery partition). The hboot being the first piece of code executed by the device is one of the most sensitive pieces of software and corruption bricks the device.

    Radio
    The radio software drives the radio of the device like 2g, 3g . The radio software is also upgradable but is equally sensitive like hboot. Problems during flashing like supply interruptions, problematic usb cables, PC problems can brick the device.

    Rooting
    The process of rooting is basically gaining root or priveleged access in the linux system and is the first step to any customization of the device. Typically during rooting the unofficial recovery from clockworkmod or amonra is flashed which is what unrevoked does. Once the unofficial recovery is flashed your device actually gets opened up. With this recovery you can flash custom ROMs. You can also take backups(nandroid). Nandroid takes a image of the recovery, boot, system, data, cache and sdext partitions. This can be used to restore the system exactly to that state if things do not go as planned when flashing a new ROM or some other system related operation. Note that nandroid will not touch the hboot, radio and misc and also will not restore recovery. Nandroid also gives capability to erase(wipe) partitions like /data(factory reset), /cache and dalvik cache and may be required prior to flashing a new ROM due to incompatibilities. Custom recovery can also be used to uninstall vexing system apps(bloatware) among many other things.

    SON/SOFF
    The hboot has a special safeguard for preventing unauthorised changes to /system partition (even with root access) called SON. This prevents you from touching the /system or system apps when android is booted up. What this means is that you cant get rid of bloatware when android is running. The process of unlocking this security feature is called soff and it is carried out with alpharev software. Alpharev flashes a modified hboot which bypasses the security feature and /system can thereafter be available for read write. Since hboot also contains partition information, the partition sizes can also be changed from original tables with alpharev hboot. The modified partition tables can give you increased space in /data partition from original 147 MB stock to more than 300 MB by rearranging space. The hboot also has a special mode called fastboot during which some extended commands for flashing hboots, radios, splash screens etc can be issued to bootloader.

    Unrooting (RUU/PB99IMG.zip)
    These terms which you will come across is basically for disaster recovery and you want to restore and unroot the phone back to original carrier/HTC version for all areas including radio, hboot, boot, system, data etc. RUU (ROM Upgrade utility) is a PC software and works through the USB cable. The PB99IMG.zip file can be extracted from the RUU is a special zip file which when you stick it on sdcard does the same job as RUU. One needs to know that RUU/PB99IMG software are region specific and only a few of them are available which have been leaked from OEM service centres. You also need to be aware that your phone carries region branding which is a special code inserted by manufacturer. This code called cidnum is checked by the RUU/PB99IMG before it restores the phone. So if the software is not available for your region then the only alternative is you need to make a goldcard as described in the guides hosted in the forum. The goldcard is nothing but a sdcard with a modified bootsector. With the goldcard in the phone the RUU/PB99IMG bypasses the region code checks.

    There is more detailed information in my subsequent posts if you want to know more.
     

    Advertisement

    Sak01, ernolander, alshop and 6 others like this.
  2. Rastaman-FB

    Rastaman-FB Android Expert
    Rank:
    None
    Points:
    313
    Posts:
    6,113
    Joined:
    Sep 11, 2009

    Sep 11, 2009
    6,113
    1,010
    313
    UK
    very good but its too long so i can imagine members will read that and be like WTF?

    out of interest did you read any of the guides/faq's that SUroot had written with all the various advise and problems weve come across over last 18months?

    it would have answered a lot of questions
     
  3. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    - Yeah maybe its slightly long. What can I leave out or reduce? Ill try.

    - I pieced this from those guides and interaction with the members and some searching on xda also.
     
  4. Rastaman-FB

    Rastaman-FB Android Expert
    Rank:
    None
    Points:
    313
    Posts:
    6,113
    Joined:
    Sep 11, 2009

    Sep 11, 2009
    6,113
    1,010
    313
    UK
    well its good as a learning piece, im just not sure who its targeted at as alot of that stuff is things that you can learn over time as its not needed for the early stuff

    never the less, a good write up
     
    SUroot likes this.
  5. GrenW

    GrenW Android Expert
    Rank:
    None
    Points:
    93
    Posts:
    799
    Joined:
    Apr 16, 2010

    Apr 16, 2010
    799
    130
    93
    UK
    I like it. It's different.

    It's not a guide on what you need to do, in fact its nothing you 'really' need to know. But it does tell you why things are done the way they are and gives you more of an understanding of what's going on.

    Most people just root and flash. Then perhaps S-Off to get more data partition space. How many actually know what's going on and how their phone operates behind all of the jargon.

    Nice one
     
  6. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    Thanks for the boosters. I figured out how to make it smaller by formatting. Maybe now it is more readable.
    My small writeup is hardly a patch on the guides here. It is just a rough map sketch.
     
  7. stevep94

    stevep94 Well-Known Member
    Rank:
    None
    Points:
    36
    Posts:
    180
    Joined:
    Jul 14, 2010

    Jul 14, 2010
    180
    5
    36
    Chesterfield
    I like it!!

    As great as the guides and faq's are (and they ARE!) my initial fear was not understanding what various things actually were when they were referred to in the guide - this helps a lot!!

    Even now with a good 4 days rooting experience under my belt, its been handy to have a read through and understand things a little better!

    I'd recommend any new rooters read this and then go on to the guides!!
     
  8. Flumme

    Flumme Android Enthusiast
    Rank:
    None
    Points:
    53
    Posts:
    335
    Joined:
    Jun 29, 2011

    Jun 29, 2011
    335
    88
    53
    Sweden
    Thank you!

    This is a great complement to the extremely well written guides and faq:s in the stickies! Well done!
     
  9. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    Some errata I gleaned on android. For the curious ones

    Android Partitions
    The ROM is divided into following partitions
    mtd0 - misc
    mtd1 - recovery
    mtd2 - boot
    mtd3 - system
    mtd4 - cache
    mtd5 - userdata

    mmcblk0 - sdcard
    mmcblk1 - sdext(Generally)
    How to change splash screen
    If you are soff then you can make your own splash screen.

    Download nbimg-1.1win32.zip from xda at [release] nbimg: HTC splash screen tool - xda-developers and extract it and follow the steps as shown in xda.

    My command prompt history is shown below:-

    Convert bmp to nb
    Check output
    Now rename splash1.bmp.nb to splash1.img. I used explorer for that.
    Check fastboot recognises the phone
    Give the flashing command
    Make Goldcard without Phone
    Need to make a goldcard which you didnt make earlier and phone is having a problem. I heard somewhere that phone is not at all required for making a goldcard. The tricky part is you need to read the cid.

    Didnt have any luck with Windows. Didnt find any utility to read the cid.

    Turned my attention to linux. Was too lazy to install linux. But I realized that I had the gparted live cd. I think most rooters have this. Just booted with that and read the cid just as given in the rooting sticky except you need to substitute mmc0 for mmc1. All other steps are the same.

    Course you need computer with cardreader and computer needs to be set to boot from cd.
    Nandroid
    Nandroid is the backup and restore facility offered by custom recovery. What is custom recovery now? It is the the recovery program which is used to replace the stock program in the phone. The custom recovery gives many more facilities than the stock one does like:-
    - Flashing custom ROMs
    - Backup and restore the phone
    - Formating partitions
    - Wipe partitions etc
    Now recovery is really a linux kernel which is situated on mtd1 (the second partition of Flash memory). Once the bootloader hboot completes its checks it hands over control to the actual linux kernel located at mtd2. If the interactive booting is followed and recovery option is chosen in hboot then control is handed over to recovery in mtd1.

    The nandroid backup facility of recovery creates .img files from the /recovery(mtd1), /boot(mtd2) , /system(mtd3), /cache(mtd4), /userdata(mtd5) and /sdext (mmcblk0p2) partitions. The idea is that on selecting restore these partitions are restored exactly as they were earlier. It is thus a great utility since if you try out a ROM and dont like it and want to go back all you need to do is reboot into recovery and restore the specific backup.

    Nandroid does not restore the recovery.img since I guess it does not make sense trying to restore itself. But all these image files can be flashed from fastboot mode if you are SOFF.
    Root Directory
    Have you wondered about the ROMs you install. What is in them? It turned out that they only contained verbatim the /system partition you find on the device. It also contains a boot.img.

    Now there is a mystery. Where did so many directories get populated on the root directory once android starts up. Where is the root mounted ? The answer to this lies in boot.img. The boot.img which is destined for the boot partition contains a kernel and gzipped ramdisk. If the ramdisk is extracted by searching for gzip signature then you find the ramdisk contents faithfully mirror some of the files & directories in the root directory like so:-
    /data
    /dev
    /proc
    /sbin
    /sys
    /system
    default.prop
    init
    init.bash.rc
    init.goldfish.rc
    init.rc
    ueventd.bravo.rc
    ueventd.goldfish.rc
    ueventd.rc

    All these directories are mostly empty and are mount points for the actual partitions like mtd3, 4 etc. Thus the ramdisk itself is the root partition. Unlike desktop linux the ramdisk is not unloaded and continues. So after kernel gets control from bootloader one of the tasks it does after many OS related stuff is start init located in ramdisk. init in turn executes init.rc also on ramdisk.

    init.rc is the one which actually brings the system up and it also mounts the partitions into the root. It also creates various other directories which you find in the root directory and not in the ramdisk.
    Unrooting
    RUU/PB99IMG
    Some thoughts on RUU/PB99IMG

    I have seen people finding the RUU business very trying. This is my attempt at understanding RUU issue. Not complete.

    RUU Rom Upgrade Utility is a leaked software from OEM service centres which are utilised to quickly repair or flash a phone back to stock. In the process the phone also gets unrooted. The RUU is a windows software and works through the USB cable. The PB99IMG.zip is a rom.zip file hidden inside the RUU and can be easily extracted in Windows. The zip file needs to be renamed to PB99IMG.zip and planted on your sdcard and thereafter the same function as RUU can be achieved by booting device with vol dn + power button.

    Each RUU is specific to a certain region and ordinarily you cannot flash the RUU not meant for you. The device supported by the RUU is captured in the rom.zip in the android-info.txt file. For example the android-info.txt file in the wwe RUU 2.29.405.5 RUU holds the following data:-

    modelid: PB9920000
    cidnum: HTC__001
    cidnum: HTC__E11
    cidnum: HTC__N34
    cidnum: HTC__203
    cidnum: HTC__102
    cidnum: HTC__K18
    cidnum: HTC__405
    cidnum: HTC__Y13
    cidnum: HTC__A07
    cidnum: HTC__304
    cidnum: HTC__016
    cidnum: HTC__032
    mainver: 2.29.405.5
    hbootpreupdate:12
    DelCache: 1

    If you issue 'fastboot getvar all' you will find whether your device tallies with this data.

    C:\AndroidSDK\tools>fastboot getvar all
    INFOversion: 0.5
    INFOversion-bootloader: 0.92.0001
    INFOversion-baseband: 5.09.00.20
    INFOversion-cpld: None
    INFOversion-microp: 031d
    INFOversion-main: 2.09.405.8
    INFOserialno: HT045PL12223
    INFOimei: 357841031833711
    INFOproduct: bravo
    INFOplatform: HBOOT-8
     
  10. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    Been flashing radios, hboots and ROMs? Want to know where they actually go ? I mean physically ? Have a look at the images below.

    [​IMG]


    [​IMG]

    The Qualcomm chips are confidential I think. No further information is available on them.
     
  11. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

    How to change hboot using thalamus patcher available at hboot patcher.

    Command Prompt History
    Command Prompt history hboot flashing for 100MB System and 5M Cache.

    1. First Do nandroid backup

    2. Directory listing of hboot_patcher directory

    3. Execute hboot_patcher

    4. OK check the checksum

    5. OK checksum is fine. Rerun hboot_patcher

    5. Move the generated hboot to hboot.img and copy to sdktools directory. Not really required.


    6. Now put the device in fastboot mode
    ***Sanity check for fastboot.
    7. Now give the command.
    Now boot recovery
    Wipe Data and Cache
    Restore your Nandroid Backup.
     
  12. handy5876

    handy5876 Guest
    Thread Starter
    Rank:
    None
    Posts:
    0
    Joined:

Tags:

Share This Page

Loading...