Building custom recovery

[Guest minipower]

I'm going to build a custom recovery for my unsupported ZTE n817 Quest phone. The phone is running Android 4.4.4 - kernel 3.4.0
The phone has been rooted and made a few system and partitions backups.

I would like to have my edited device files double checked. So I can be confident in building the custom recovery.

I have installed a linux mint VM.I believe I have correctly setup the build environment. I have successfully built a few kernels and roms for a different device.

I started by repo syncing CM11 and ran extract-files.sh. This gave me a device folder zte/n817..

I looked at Boardconfig.mk and their seemed to be some errors I marked in red

This is the original unedited Boardconfig.mk

[HIDE]

USE_CAMERA_STUB := true

# inherit from the proprietary version
-include vendor/zte/n817/BoardConfigVendor.mk

TARGET_ARCH := arm
TARGET_NO_BOOTLOADER := true
TARGET_BOARD_PLATFORM := unknown
TARGET_CPU_ABI := armeabi-v7a
TARGET_CPU_ABI2 := armeabi
TARGET_ARCH_VARIANT := armv7-a-neon
TARGET_CPU_VARIANT := cortex-a7
TARGET_CPU_SMP := true
ARCH_ARM_HAVE_TLS_REGISTER := true

TARGET_BOOTLOADER_BOARD_NAME := n817

BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37
BOARD_KERNEL_BASE := 0x00000000
BOARD_KERNEL_PAGESIZE := 2048

# fix this up by examining /proc/mtd on a running device
BOARD_BOOTIMAGE_PARTITION_SIZE := 0x105c0000
BOARD_RECOVERYIMAGE_PARTITION_SIZE := 0x105c0000
BOARD_SYSTEMIMAGE_PARTITION_SIZE := 0x105c0000
BOARD_USERDATAIMAGE_PARTITION_SIZE := 0x105c0000
BOARD_FLASH_BLOCK_SIZE := 131072

TARGET_PREBUILT_KERNEL := device/zte/n817/kernel

BOARD_HAS_NO_SELECT_BUTTON := true
[/HIDE]

This is my Boardconfig.mk I edited. Changes marked in red

[HIDE]

USE_CAMERA_STUB := true

# inherit from the proprietary version
-include vendor/zte/n817/BoardConfigVendor.mk

TARGET_ARCH := arm
TARGET_NO_BOOTLOADER := true
TARGET_BOARD_PLATFORM := msm8610
TARGET_CPU_ABI := armeabi-v7a
TARGET_CPU_ABI2 := armeabi
TARGET_ARCH_VARIANT := armv7-a-neon
TARGET_CPU_VARIANT := cortex-a7
TARGET_CPU_SMP := true
ARCH_ARM_HAVE_TLS_REGISTER := true

TARGET_BOOTLOADER_BOARD_NAME := n817

BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37

BOARD_KERNEL_BASE := 0x00000000 - Don't know what to put here

BOARD_KERNEL_PAGESIZE := 2048

# fix this up by examining /proc/mtd on a running device
BOARD_BOOTIMAGE_PARTITION_SIZE := 16777216
BOARD_RECOVERYIMAGE_PARTITION_SIZE := 16777216
BOARD_SYSTEMIMAGE_PARTITION_SIZE := 1291845632
BOARD_USERDATAIMAGE_PARTITION_SIZE := 1862270976
BOARD_FLASH_BLOCK_SIZE := 131072

TARGET_PREBUILT_KERNEL := device/zte/n817/kernel

BOARD_HAS_NO_SELECT_BUTTON := true

[/HIDE]

The ZTE n817 Quest does not have mtd. So I ran adb shell and cat /proc/partitions and ls -al /dev/block/platform/msm_sdcc.1/by-name also mount and df commands.
I then used  dd if=/dev/block/mmcblk0** of=/sd card/***.img  to dump the phones whole image and each partition separately.

Looking at all these outputs I put this together.

[HIDE]
#blocks ----  by-name      ----        partitions          ----               size
8192 ----     DDR ->    ----        /dev/block/mmcblk0p2
8192  ----    aboot ->    ----      /dev/block/mmcblk0p15
16384  ----   boot ->     ----      /dev/block/mmcblk0p17      ----  16384 x  1024     =     16777216
311296 ----   cache ->   ----       /dev/block/mmcblk0p22
40960  ----   carrier ->  ----      /dev/block/mmcblk0p23
8192  ----    dbi ->      ----      /dev/block/mmcblk0p5
8192   ----   fsc ->     ----       /dev/block/mmcblk0p11
8192   ----   fsg ->     ----       /dev/block/mmcblk0p12
8192   ----   misc ->    ----       /dev/block/mmcblk0p21
131072 ----   modem ->    ----      /dev/block/mmcblk0p16
8192   ----   modemst1 ->  ----     /dev/block/mmcblk0p13
8192  ----    modemst2 ->  ----     /dev/block/mmcblk0p14
8192   ----   pad ->    ----        /dev/block/mmcblk0p9
32768  ----   persist ->   ----     /dev/block/mmcblk0p8
16384  ----   recovery ->  ----     /dev/block/mmcblk0p18      ----     16384 x 1024   =  16777216
8192  ----    rpm ->    ----        /dev/block/mmcblk0p3
8192   ----   sbl1 ->    ----       /dev/block/mmcblk0p1
16384  ----   splash -> ----        /dev/block/mmcblk0p19
8192   ----   ssd ->   ----         /dev/block/mmcblk0p10
1261568 ----  system ->  ----       /dev/block/mmcblk0p24       ----  1261568 x 1024  =    1291845632
8192  ----    tombstones ->  ----   /dev/block/mmcblk0p20
8192  ----    tz ->   ----          /dev/block/mmcblk0p4
1818624 ----  userdata ->  ----     /dev/block/mmcblk0p25       ----    1818624 x 1024  = 1862270976
8192  ----    ztecfg ->  ----       /dev/block/mmcblk0p7
8192  ----    ztelk ->    ----      /dev/block/mmcblk0p6

=======================================================================
=======================================================================

Filesystem                              Size     Used     Free   Blksize
/dev                                   198.8M   132.0K   198.6M   4096
/sys/fs/cgroup                         198.8M    12.0K   198.7M   4096
/mnt/asec                              198.8M     0.0K   198.8M   4096
/mnt/obb                               198.8M     0.0K   198.8M   4096
/system                                  1.2G   780.7M   430.1M   4096
/data                                    1.7G   642.1M     1.1G   4096
/cache                                 299.0M     5.8M   293.2M   4096
/persist                                31.5M     4.1M    27.4M   4096
/carrier                                39.4M     4.0M    35.3M   4096
/firmware                               64.0M    41.0M    23.0M   16384
/mnt/shell/emulated                      1.7G   642.1M     1.1G   4096
/storage/emulated/legacy                 1.7G   642.1M     1.1G   4096
/storage/emulated                      198.8M     0.0K   198.8M   4096
/mnt/media_rw/sdcard1                   29.8G     9.7G    20.1G   8192
/storage/sdcard1                        29.8G     9.7G    20.1G   8192
/storage/emulated/0                      1.7G   642.1M     1.1G   4096
/storage/emulated/0/Android/obb          1.7G   642.1M     1.1G   4096
/storage/emulated/legacy                 1.7G   642.1M     1.1G   4096
/storage/emulated/legacy/Android/obb     1.7G   642.1M     1.1G   4096

[/HIDE]

This is the cm.mk

[HIDE]
## Specify phone tech before including full_phone
$(call inherit-product, vendor/cm/config/gsm.mk)

# Release name
PRODUCT_RELEASE_NAME := n817

# Inherit some common CM stuff.
$(call inherit-product, vendor/cm/config/common_full_phone.mk)

# Inherit device configuration
$(call inherit-product, device/zte/n817/device_n817.mk)

## Device identifier. This must come after all inclusions
PRODUCT_DEVICE := n817
PRODUCT_NAME := cm_n817
PRODUCT_BRAND := zte
PRODUCT_MODEL := n817
PRODUCT_MANUFACTURER := zte
[/HIDE]

 -- but I'm not sure it is right. Because the ZTE n817 Quest is identified as
[HIDE]
ro.product.model=N817
ro.product.brand=ZTE
ro.product.name=ZTE_WELLINGTON
ro.product.device=wellington
ro.product.board=wellington
ro.build.description=ZTE_WELLINGTON-user 4.4.4 KTU84P 20150821.163315.3491 release-keys
ro.build.fingerprint=ZTE/ZTE_WELLINGTON/wellington:4.4.4/KTU84P/20150821.163315.3491:user/release-keys
ro.build.characteristics=cdma
from device/zte/wellington/system.prop

[/HIDE]

This is the device_n817.mk

[HIDE]
$(call inherit-product, $(SRC_TARGET_DIR)/product/languages_full.mk)

# The gps config appropriate for this device
$(call inherit-product, device/common/gps/gps_us_supl.mk)

$(call inherit-product-if-exists, vendor/zte/n817/n817-vendor.mk)

DEVICE_PACKAGE_OVERLAYS += device/zte/n817/overlay

LOCAL_PATH := device/zte/n817
ifeq ($(TARGET_PREBUILT_KERNEL),)
    LOCAL_KERNEL := $(LOCAL_PATH)/kernel
else
    LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
endif

PRODUCT_COPY_FILES += \
    $(LOCAL_KERNEL):kernel

$(call inherit-product, build/target/product/full.mk)

PRODUCT_BUILD_PROP_OVERRIDES += BUILD_UTC_DATE=0
PRODUCT_NAME := full_n817
PRODUCT_DEVICE := n817
[/HIDE]

The AndroidProducts.mk

[HIDE]
PRODUCT_MAKEFILES := \
    $(LOCAL_DIR)/device_n817.mk
[/HIDE]

This is AndroidBoard.mk

[HIDE]
LOCAL_PATH := $(call my-dir)

include $(CLEAR_VARS)

ALL_PREBUILT += $(INSTALLED_KERNEL_TARGET)

# include the non-open-source counterpart to this file
-include vendor/zte/n817/AndroidBoardVendor.mk
[/HIDE]

This is the original unedited recovery.fstab I got using extract-files.sh

[HIDE]
# mount point    fstype    device        [device2]

/boot       mtd         boot
/cache      yaffs2      cache
/data       yaffs2      userdata
/misc       mtd         misc
/recovery   mtd         recovery
/sdcard     vfat        /dev/block/mmcblk0p1        /dev/block/mmcblk0
/system     yaffs2      system
/sd-ext     ext4        /dev/block/mmcblk0p2
[/HIDE]

Do I need to sync a clockworkmod recovery in the CM11 tree and replace android_bootable_recovery or android_bootable_recovery-cm ¿?

The phones vendor Proprietary Blobs have not been extracted yet. I didn't get the vendor files when I ran extract-files.sh.. I'm not finding the right way to extract the phones vendor files. I keep find different or conflicting instructions.

Is there any tips or advice you would give me in helping me build the custom recovery ¿¿

Thank you for helping me with this

[Guest minipower]

After some more digging. I figured I got the partitions and that the BOARD_KERNEL_BASE was correct. So I placed the ZTE kernel in CM11 tree and built a Flash Recovery.

Since the phone does not have Fastboot, would I be able to dd the recovery using adb shell¿

Also.. I extracted the phones boot.img and edited the default.prop. Would I be able to repack the boot.img and dd it to the phone ¿

[Guest jag9906]

If your on Linux mkboot or mkbootimg, few others. OK I see you have Linux. Type sudo apt-get install mkbootimg

Also on github

[Guest raging_chaos]

Any updates on being able to build this recovery?

[Guest minipower]

No.. I paused working on this because I need to figure out how to unlock the bootloader without Fastboot. I did do a strings search on the phones bootloader that I pulled after rooting and it still does have (unlock bootloader) in there. So it seems it's a regular bootloader and the security they used is too just not include fastboot.

 

jag9906:  I did do that. I pulled the boot partition and extracted everything out with those tools. That was how I figured out the BOARD_KERNEL_BASE was correct

Edited March 1, 2017 by minipower

[Guest PatchValid]

Hey minipower, any progress no the n817's bootloader? To be honest, I might be able to achive my goal it I just knew the right way of going about it.

Here's my situation.. I currently use the n817 on the Q-Link network life-link service.(free government funded service) and would like to transfer my service to a better phone that will work with the same service. Thing is, even though the phone is completely compatible (Samsung SCH-R530X) Q-Link does not allow transferring the free line to a different phone. Now, I can transfer the whole Life-link line to a different carrier, but I'm not eligible for that until Dec. So, I thought I'll just clone the N817 to the Samsung, place the N817 in the closet til Dec, and all is good. Problem is, I can not get any software (CMDA WS, QPTS, DFS CMDA Tool, and a few others) to pull any info off of the damn thing to be able to do the cloning. Now, of course, I can pull all the common info from within the ##33284# and/or the ##3282# menus but is that enough info to successfully do the clone? From what I've gathered, I'll need the MSL code? Any help would be greatly appreciated. Thanks

[Guest minipower]

  I'm also playing with the same thing. So far I have been able to connect and read with software. I first put the phone in FTM mode and was able to read the phone. Also if you can get the MSL, you can put the phone in dm by ##3424# same as ##DIAG# it will ask for the 6 digit MSL and then you can turn on the usb as data port, which allows you to read the phone in software.

 

  I think I got all the info from the N817 to transfer to the other phone, but I'm not able to read the AAA and HA keys. I'm not totally sure if the phone uses them or not, because when I read the phone in software the command output box says invalid parameter. Also when I go into the ##DATA# menu and click on data profile, it shows HA SPI as 1234 and AAA SPI as 1234, those numbers show up when I press them so I can modify them. But when I press on the HA and AAA passwords it shows blank.