91 replies to this topic

[qeifupa]

Hi Paul,
thank you very much for your amazing work. I'm waiting your complete procedure to root the Acer Duo. Do you have an idea of the time required to prepare it?
BR,
F.

[qeifupa]

Rooted following the information in the first page.... GREAT!

[GPulse]

PaulOBrien, on 17 September 2012 - 12:42 PM, said:

Hi Folks!

As you know I recently got my hands on an Acer Gallant Duo, which i've duly rooted... this post contains my root solution and the various tools i've accrued along the way.

First things first - as well as rooting using my method, the root exploit found by Bin4ryDigit also works at the time of writing.

With that said... here's my findings!

The MTK6765 chipset

The Gallant Duo (and Solo) use the MTK6575 chipset, which is also widely used in 'Chinese devices', meaning that a lot of hacking tools are already out there. The most useful one is the official MTK flashing tool. This is only available on Windows, but allows both the backing up and flashing of images directly from the device bootloader!

In order to facilitate this, a file called a 'scatter file' is used. This is basically a text file containing addresses for the various partitions on the flash, so that the tool knows where to write them. The Gallant devices don't use any of the existing MTK6575 scatter files out there, so i've created one for the device which is included in the download below. With this, we can flash custom ROMs, recoveries, boot images, logo binaries etc. with no problem. And create backups before we do. data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAjRQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c874d88If88kk89Im9Mwl9cMd9cQf9cch9sUe9sYf9scf9sgg9skh9swi9swk98kf98og988k99Mm+c0g+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/NUi/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrUVau3wAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0TlOw1AURuH/2i+2Y8d2UEgQYZAA0UHJBpBYAA0rgJaKAlHS0dCwIDaBqBASQkRCZojn2M/vXgpKOEv4DhH+piAAbFf5AxRV1xgApADACadxuM8P2fw9bwEQieWOx4cbnizqxdPjR9Iw2QRnunuyvjSNbQfRyLS1IZt6w53j5RUf6Pu2Jq8qW7Hgrh4FIxLDTNeRF2xMXCg48aAv58AtANdx/LAHBX/oxXILCANh1lNxP1XwtsRYwgD4hkVEubBAUl8YBjMLF5XuBLCweG5gmIVZTKNb3WlYqNP67NKwCHflV1nqeQULTZpUp1dFZ8r0vZ5nbaVhE7OO6ODufu87zz/T+m1WMJF4a5u7gWPDNGXWfr/MGlJAO9Pz7UBJp7vm9SvRAJEATjiJwojztEjyFiCiX+ReMEBR6l9k+m/HDz2krEn873c1AAAAAElFTkSuQmCC

Possible root attack vectors

Aside from Bin4ryDigit's root method and the one I am using (flashing a SuperRecovery using the MTK tool), there are a couple of other potential 'ways in', but they are best kept under wraps for the time being. Interestingly, the stock recovery on the Gallant devices has backup and restore options, which back up the data partition to a single file on the SD card. This is useful (not just for obvious reasons), but also because this allowed me to poke around the data partition of the device even before I had root. For reference, the backup files are gzipped tar images with a 512 byte signature on the front. If you cut the first 512 bytes off, you can extract it with no issues.

SuperRecovery

For the initial root for the Gallant, I wanted to create a solution which gave root without compromising the ability to provide over the air updates in the future. With this in mind I'm overwriting only the stock recovery, but i'm overwriting it with a version which is still fully compatible with the original. It is the stock recovery but with ADB access and a script that runs on startup to root the device. We will likely have a clockworkmod recovery very soon for users that want to play around with the device more (custom ROMs and the like).

To install, you need to use the MTK flasher and my scatter file to install the custom recovery. After installation, launching the recovery just once will root the device.

Using SuperRecovery - step by step

Follow this simple guide to using SuperRecovery and rooting your device (Windows PC required!)

• Download the tools pack linked below and extract to a directory on your PC.
  
• Take the back off your device and pull the battery. Run device manager on your PC. Plug the device into your PC via the USB cable and you will see an 'unknown device' briefly appear in Device Manager. Right click this device and select 'update driver', specifying the location where you just extracted the tools zip (specifically, the driver folder for your chosen OS).
  
• With the driver installed, you're ready to run the flashing tool. From the 'Flash Tool' directory run 'Flash_tool.exe'. Unplug your device at this point.
  
• The 'Download Agent' field is automatically populated. You need to click the 'Scatter-loading' button and select the 'MT6575_android_scatter_emmc.duo.modaco.txt' file from the 'Scatter directory'.
  
• Next you need to tell the application which part you want to flash. Click the 'RECOVERY' line and select the 'recovery.superboot.duo.img' file from the 'Images' directory.
  
• That's it! Don't click any other options. Note that flashing is DANGEROUS, and you do so entirely at your own risk. If you're ready to go, press 'Download'. Do NOT click any other buttons!
  
• Now, with your device off, plug it back in via USB. You will first see a red bar, then a yellow progress bar, then a green success box as shown below.
  
• When the flash is complete, turn your device on with 'volume up' held. This will launch recovery. When the recovery screen loads, press the volume up key to show the menu and select the reboot option. Your device is now rooted!

click the images to enlarge

"]http://content.modac.../duoflash1.png][/url]

"]http://content.modac.../duoflash2.png][/url]

"]http://content.modac.../duoflash3.png][/url]

"]http://content.modac.../duoflash4.png][/url]

"]http://content.modac.../duoflash5.png][/url]

Editing boot / recovery / logo images

The Gallant images are not a format we are used to, however scripts for unpacking and repacking have been created by bgcngm and are available to download on GitHub. I used these to create the SuperRecovery and they work great. data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAiJQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c88If88kk89Im9Mwl9cMd9cch9sUe9scf9sgg9skh9swi9swk98og988k99Mm+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrX/9jcQAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0b9Kw1AYhvH3OzlJ2qRpiiVCIxUUdXIRdFd0cfQOvA4HF3UWr0Fw83J0VEQpaLX/myY5Od/n0FGfS/g9RPibhgBwfB00MMuqwgIgDQBelMbRLj9NRp/TEgCRKD9Jjjq+FIvy9fm7XzA5BC/dPuu00tjx0EhsubCk4Mbd03Z6DVq5TcJ4J21qaPido6BNsACaeR50J1mm4cVhXQTCAPmeG0QuFIKWH4sFiwVHNa3jOjRqG2KV3FjgikVEtA8FkvzCMphZeLZ4rARQyF8KWGZhFlsYmMpAYTEuzi8ti3A1Hz4cmlEGh5x64u3fHSjJsp/7k1H+NTBEemVrL6o9AACOx9nH27Aiktra+nboKnA5n5TDt15BGih7ZrQZaqlMVbwP+gYgEsCLVptRk6fjWX9aAkS0RHbDBmZzs0Sm/3b8Apz1nhT0ICJTAAAAAElFTkSuQmCC

The download

All the files you need can be downloaded here!

• r1 - DOWNLOAD (ROMraid) - MD5: 9c604f9cb7f800ca1145635d92afd087

Any questions

Any questions or feedback on the above? Post below! data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAiJQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c88If88kk89Im9Mwl9cMd9cch9sUe9scf9sgg9skh9swi9swk98og988k99Mm+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrX/9jcQAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0b9Kw1AYhvH3OzlJ2qRpiiVCIxUUdXIRdFd0cfQOvA4HF3UWr0Fw83J0VEQpaLX/myY5Od/n0FGfS/g9RPibhgBwfB00MMuqwgIgDQBelMbRLj9NRp/TEgCRKD9Jjjq+FIvy9fm7XzA5BC/dPuu00tjx0EhsubCk4Mbd03Z6DVq5TcJ4J21qaPido6BNsACaeR50J1mm4cVhXQTCAPmeG0QuFIKWH4sFiwVHNa3jOjRqG2KV3FjgikVEtA8FkvzCMphZeLZ4rARQyF8KWGZhFlsYmMpAYTEuzi8ti3A1Hz4cmlEGh5x64u3fHSjJsp/7k1H+NTBEemVrL6o9AACOx9nH27Aiktra+nboKnA5n5TDt15BGih7ZrQZaqlMVbwP+gYgEsCLVptRk6fjWX9aAkS0RHbDBmZzs0Sm/3b8Apz1nhT0ICJTAAAAAElFTkSuQmCC

Have followed your instructions faithfully up to step 6 where I press the 'download' button but I get a warning that 'Not all images have been loaded properly etc, and whether I want to continue' and therefore I have been reluctant to proceed and plug in the E350. Is that a normal message that I shouldn't worry about or not? Thanks

[GPulse]

PaulOBrien, on 17 September 2012 - 12:42 PM, said:

Hi Folks!

As you know I recently got my hands on an Acer Gallant Duo, which i've duly rooted... this post contains my root solution and the various tools i've accrued along the way.

First things first - as well as rooting using my method, the root exploit found by Bin4ryDigit also works at the time of writing.

With that said... here's my findings!

The MTK6765 chipset

The Gallant Duo (and Solo) use the MTK6575 chipset, which is also widely used in 'Chinese devices', meaning that a lot of hacking tools are already out there. The most useful one is the official MTK flashing tool. This is only available on Windows, but allows both the backing up and flashing of images directly from the device bootloader!

In order to facilitate this, a file called a 'scatter file' is used. This is basically a text file containing addresses for the various partitions on the flash, so that the tool knows where to write them. The Gallant devices don't use any of the existing MTK6575 scatter files out there, so i've created one for the device which is included in the download below. With this, we can flash custom ROMs, recoveries, boot images, logo binaries etc. with no problem. And create backups before we do. data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAjRQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c874d88If88kk89Im9Mwl9cMd9cQf9cch9sUe9sYf9scf9sgg9skh9swi9swk98kf98og988k99Mm+c0g+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/NUi/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrUVau3wAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0TlOw1AURuH/2i+2Y8d2UEgQYZAA0UHJBpBYAA0rgJaKAlHS0dCwIDaBqBASQkRCZojn2M/vXgpKOEv4DhH+piAAbFf5AxRV1xgApADACadxuM8P2fw9bwEQieWOx4cbnizqxdPjR9Iw2QRnunuyvjSNbQfRyLS1IZt6w53j5RUf6Pu2Jq8qW7Hgrh4FIxLDTNeRF2xMXCg48aAv58AtANdx/LAHBX/oxXILCANh1lNxP1XwtsRYwgD4hkVEubBAUl8YBjMLF5XuBLCweG5gmIVZTKNb3WlYqNP67NKwCHflV1nqeQULTZpUp1dFZ8r0vZ5nbaVhE7OO6ODufu87zz/T+m1WMJF4a5u7gWPDNGXWfr/MGlJAO9Pz7UBJp7vm9SvRAJEATjiJwojztEjyFiCiX+ReMEBR6l9k+m/HDz2krEn873c1AAAAAElFTkSuQmCC

Possible root attack vectors

Aside from Bin4ryDigit's root method and the one I am using (flashing a SuperRecovery using the MTK tool), there are a couple of other potential 'ways in', but they are best kept under wraps for the time being. Interestingly, the stock recovery on the Gallant devices has backup and restore options, which back up the data partition to a single file on the SD card. This is useful (not just for obvious reasons), but also because this allowed me to poke around the data partition of the device even before I had root. For reference, the backup files are gzipped tar images with a 512 byte signature on the front. If you cut the first 512 bytes off, you can extract it with no issues.

SuperRecovery

For the initial root for the Gallant, I wanted to create a solution which gave root without compromising the ability to provide over the air updates in the future. With this in mind I'm overwriting only the stock recovery, but i'm overwriting it with a version which is still fully compatible with the original. It is the stock recovery but with ADB access and a script that runs on startup to root the device. We will likely have a clockworkmod recovery very soon for users that want to play around with the device more (custom ROMs and the like).

To install, you need to use the MTK flasher and my scatter file to install the custom recovery. After installation, launching the recovery just once will root the device.

Using SuperRecovery - step by step

Follow this simple guide to using SuperRecovery and rooting your device (Windows PC required!)

• Download the tools pack linked below and extract to a directory on your PC.
  
• Take the back off your device and pull the battery. Run device manager on your PC. Plug the device into your PC via the USB cable and you will see an 'unknown device' briefly appear in Device Manager. Right click this device and select 'update driver', specifying the location where you just extracted the tools zip (specifically, the driver folder for your chosen OS).
  
• With the driver installed, you're ready to run the flashing tool. From the 'Flash Tool' directory run 'Flash_tool.exe'. Unplug your device at this point.
  
• The 'Download Agent' field is automatically populated. You need to click the 'Scatter-loading' button and select the 'MT6575_android_scatter_emmc.duo.modaco.txt' file from the 'Scatter directory'.
  
• Next you need to tell the application which part you want to flash. Click the 'RECOVERY' line and select the 'recovery.superboot.duo.img' file from the 'Images' directory.
  
• That's it! Don't click any other options. Note that flashing is DANGEROUS, and you do so entirely at your own risk. If you're ready to go, press 'Download'. Do NOT click any other buttons!
  
• Now, with your device off, plug it back in via USB. You will first see a red bar, then a yellow progress bar, then a green success box as shown below.
  
• When the flash is complete, turn your device on with 'volume up' held. This will launch recovery. When the recovery screen loads, press the volume up key to show the menu and select the reboot option. Your device is now rooted!

click the images to enlarge

"]http://content.modac.../duoflash1.png][/url]

"]http://content.modac.../duoflash2.png][/url]

"]http://content.modac.../duoflash3.png][/url]

"]http://content.modac.../duoflash4.png][/url]

"]http://content.modac.../duoflash5.png][/url]

Editing boot / recovery / logo images

The Gallant images are not a format we are used to, however scripts for unpacking and repacking have been created by bgcngm and are available to download on GitHub. I used these to create the SuperRecovery and they work great. data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAiJQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c88If88kk89Im9Mwl9cMd9cch9sUe9scf9sgg9skh9swi9swk98og988k99Mm+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrX/9jcQAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0b9Kw1AYhvH3OzlJ2qRpiiVCIxUUdXIRdFd0cfQOvA4HF3UWr0Fw83J0VEQpaLX/myY5Od/n0FGfS/g9RPibhgBwfB00MMuqwgIgDQBelMbRLj9NRp/TEgCRKD9Jjjq+FIvy9fm7XzA5BC/dPuu00tjx0EhsubCk4Mbd03Z6DVq5TcJ4J21qaPido6BNsACaeR50J1mm4cVhXQTCAPmeG0QuFIKWH4sFiwVHNa3jOjRqG2KV3FjgikVEtA8FkvzCMphZeLZ4rARQyF8KWGZhFlsYmMpAYTEuzi8ti3A1Hz4cmlEGh5x64u3fHSjJsp/7k1H+NTBEemVrL6o9AACOx9nH27Aiktra+nboKnA5n5TDt15BGih7ZrQZaqlMVbwP+gYgEsCLVptRk6fjWX9aAkS0RHbDBmZzs0Sm/3b8Apz1nhT0ICJTAAAAAElFTkSuQmCC

The download

All the files you need can be downloaded here!

• r1 - DOWNLOAD (ROMraid) - MD5: 9c604f9cb7f800ca1145635d92afd087

Any questions

Any questions or feedback on the above? Post below! data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAMAAAC6V+0/AAAABGdBTUEAANbY1E9YMgAAAiJQTFRFV0AI////V0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIV0AIW0IIV0AIW0IIW0QJW0IIV0AIV0AIV0AIQzQQa0oJbEwJbVELbk4Kb0wJb1QMcVILc1cMlF8Ll2oNmXEQnn8Vo2gLpGgLpGoMpW8NpXEOp3YQq4MUrH0Rro0Xr4QUsI4XsZAYuXQNwIkSwI0VyIAOyocQyqcdy4QQzosS1Kod1rIf3ZMS3ZUT3a8c3o4Q3rcf4ZER5JUR5ZYS5ZgS5aIW55wT554U6KkZ6qQV6qUW6qYW6qcX66gW7Lsf7a0X7a0Y7a8Z7bEb7rAY7rEY7rMa7rMb77EY77Ma77QZ77cd77oc8bgb8bkb8bob8b4f8cUh8skh87wb870c88If88kk89Im9Mwl9cMd9cch9sUe9scf9sgg9skh9swi9swk98og988k99Mm+c8h+dMk+dYm+9Mh+9Mi+9Uj+9Yk+9cl+9gl+9kn+9on+9oo+9op+9so/Ncl/Ngl/Non/Nso/N0o/N0p/dkk/dok/d4o/eAp/eEp/tsk/twk/t0k/t4l/uAn/uAp/uIq/uMp/uMq/uQq/94l/94m/98l/98m/+Am/+An/+En/+Eo/+Io/+Ip/+Mo/+Mp/+Mq/+Qp/+Qq/+Qr/+Uq/+UrX/9jcQAAACd0Uk5TAAABCQoLHCYnMDY4OjuCg4WHiImKm56fx8jJys3P1Ofp6enq7/DyAdnyKAAAAUZJREFUGNNt0b9Kw1AYhvH3OzlJ2qRpiiVCIxUUdXIRdFd0cfQOvA4HF3UWr0Fw83J0VEQpaLX/myY5Od/n0FGfS/g9RPibhgBwfB00MMuqwgIgDQBelMbRLj9NRp/TEgCRKD9Jjjq+FIvy9fm7XzA5BC/dPuu00tjx0EhsubCk4Mbd03Z6DVq5TcJ4J21qaPido6BNsACaeR50J1mm4cVhXQTCAPmeG0QuFIKWH4sFiwVHNa3jOjRqG2KV3FjgikVEtA8FkvzCMphZeLZ4rARQyF8KWGZhFlsYmMpAYTEuzi8ti3A1Hz4cmlEGh5x64u3fHSjJsp/7k1H+NTBEemVrL6o9AACOx9nH27Aiktra+nboKnA5n5TDt15BGih7ZrQZaqlMVbwP+gYgEsCLVptRk6fjWX9aAkS0RHbDBmZzs0Sm/3b8Apz1nhT0ICJTAAAAAElFTkSuQmCC

Apologies! Didn't have sufficiently close look at your screenshots where it actually shows that message. Done it successfully. Thanks

[idcool]

sbavi, on 19 September 2012 - 04:14 PM, said:

Thanks!


i've removed these apps:
AcerDLNA2.apk
AcerNidus.apk
AcerRegistration2.apk
BarcodeScanner41.apk
BlackList.apk
Chrome.apk
ClockWidget.apk
Default_ICS.apk
DigitalClockWidget2.apk
Fashion.apk
FBAndroidpreload.apk
Gmail.apk
HoloSpiralWallpaper.apk
HoloSpiralWallpaper.odex
Lady.apk
Launcher2.apk
Launcher2.odex
LiveWallpapers.apk
LiveWallpapers.odex
MagicSmokeWallpapers.apk
MagicSmokeWallpapers.odex
Maps_alldpi.apk
MtkWeatherProvider.apk
MtkWeatherSetting.apk
MtkWeatherSetting.odex
MtkWeatherWidget.apk
MtkWorldClockWidget.apk
MtkWorldClockWidget.odex
Music2.apk
NoiseField.apk
NoiseField.odex
PhaseBeam.apk
PhaseBeam.odex
PlusOne.apk
PolarisViewer4.apk
Science.apk
Sport.apk
Swype.apk
TagGoogle.apk
talkback.apk
Videos.apk
WeatherWidget2.apk
WSBoxNet.apk
WSDropbox.apk
Youtube.apk

device work like a charm!

I have rooted my phone successfully and deleted some of the files listed above, now my phone wont load the home screen but I can get into settings and some system apps.

I think I deleted Launcher2.apk... woops.


I am fairly inexperienced with this but I think I can fix my phone by installing a Launcher2.apk from my pc to my phone using ADB. The only problem is I dont have drivers for USB debugging so I cant use ADB. Am I going down the right path to fix this? Thanks in advance.


EDIT: Got the ADB working now by installing the official drivers from the acer website, will post back about the Launcher problem.

Edited by idcool, 12 October 2012 - 02:34 PM.

[idcool]

idcool, on 12 October 2012 - 02:04 PM, said:

I have rooted my phone successfully and deleted some of the files listed above, now my phone wont load the home screen but I can get into settings and some system apps.

I think I deleted Launcher2.apk... woops.


I am fairly inexperienced with this but I think I can fix my phone by installing a Launcher2.apk from my pc to my phone using ADB. The only problem is I dont have drivers for USB debugging so I cant use ADB. Am I going down the right path to fix this? Thanks in advance.


EDIT: Got the ADB working now by installing the official drivers from the acer website, will post back about the Launcher problem.

I got it working now.

I tried ABD but couldnt get it to remount using "abd remount" , I would get remount failed: Operation not permitted.

Then I tried MobileGo software and even though it said the Launcher2.apk install failed I can now launch to the home screen. Thought I would leave this here for anyone else who accidently deletes the launcher.

[sbavi]

to remove stock launcher need an alternative in system apps

Go to settings-> Security and flag on unknown sources
From lockscreen (shutter) try to open directly browser, download and install:

http://dl.apktops.com/app/201209/Nova_Launcher_1_3_1.apk

[Hoevi]

Thank you very much Paul. It's a great piece of work.

Actually I just struggeling a liitle bit with software download from Google Play, Internet access and some other things that require Internet connection. I'm not sure if it's related to the root hack or a problem with the Gallnet duo itself, because i never tested it before rooting.

Here's my problem.
As long as I'm connected to the Internet via WLAN everything it's fine, but it's not working with my phone account. Neither SIM1 nor SIM2.
Same SIM cards (both Vodafone) are working fine for Internet access in another dual SIM phone.

I tried a lot of things like reboot, set back to APN standard values, switch between 2G / 3G, switch of SIM cards and so on but had no success up to now.
The only messages that may help are:

- from my E-mail program, that of course also don't work without WLAN Internet access. When i try to download my mails the message says "java.net.Socket.Timeout exception"

- when I shutdown the phone I can see a message for 1 second the says "Limited access changed"

Except of the "Dual sim" menue, is there any option to limit the Internet access I may hvae not found up to now?

Has anyone else similar trouble and maybe is there any solution?

Thanks a lot in advance
Hoevi from Germany

[cmachado0]

easy way to root just one click , check the link

http://forum.xda-dev...d.php?t=1899736

[cmachado0]

hello
by mistake i uninstall the google search apk now i cant find any to work with the phone do you have the apk ?

thks

sbavi, on 19 September 2012 - 04:14 PM, said:

Thanks!


i've removed these apps:


device work like a charm!

[newuser1234567]

Has anybody seen significant improvements to battery life after rooting it?
I'm only interested in improving that, and am wary of rooting.  Think it's worth it?

[jaapstreepjan]

newuser1234567, on 18 October 2012 - 07:13 PM, said:

Has anybody seen significant improvements to battery life after rooting it?
I'm only interested in improving that, and am wary of rooting.  Think it's worth it?

yes it's worth it, if you uninstall the hogging system apps

[jaapstreepjan]

could anybody help me creating a working recovery.fstab?
I need it for compiling Clockworkmod Recovery.
it should be something like this:


/boot     emmc /dev/block/mmcblk0p1
/cache     ext4 /dev/block/mmcblk0p2
/data     ext4 /dev/block/mmcblk0p3
/recovery     emmc /dev/block/mmcblk0p21
/sdcard     vfat /dev/block/mmcblk1p4 /dev/block/mmcblk4
/system     ext4 /dev/block/mmcblk0p26

maybe Paul could help ?

[hapx]

@jaapstreepjan

I am glad you are working on CWM for the Liquid Gallant. It is important to have this tool
for nandroid backup and it is the base for future custom ROM, if any.

Apparently the first thing is to get the partition mapping and mainly the /boot and /recovery
in the phone.

As a simple user, I gathered some information below.

There are some interesting script/applicatoins for online nandroid backup:

Online Nandroid backup script :
http://forum.xda-dev...d.php?t=1620255
Currently for the Liquid Gallant, the right command line script is:
onandroid --phone --old --storage /mnt/sdcard2
but of course it cannot find /boot and /recovery.


Online Nandroid backup Android application using the above script :
https://play.google....r3t1c.onnandbup

The Android app is interesting since it updates automatically the script,
and optionally installs utility like makeyaffs if missing on the running phone.
Currently it uses /mnt/sdcard per default as storage and hence fails since there is not
sufficient disk space. And since there is no patch file yet for the phone, it cannot
find /boot and /recovery for backup.

For nandroid backup for Liquid Gallant, there are particularities to be considered:
- /mnt/sdcard2 is the external SD card where nandroid backup should be stored.
- /mnt/sdcard  is to be backuped
- /mnt/sdcard/.android_secure is empty, maybe sec_ro to be backuped ?

From the scatter file (number of sectors for each partition), from the size of partitions dump using 'dd' command,
from the size of each file from Acer_AV041_E350_1.000.08_EMEA_FR.zip, one probably could
deduces a right mapping.

So if /boot  is mapped to  emmc /dev/block/mmcblk0p1, there is probably a problem
since this partition has only 1 KB (result of dd command), and boot.img size is 3660KB.

In Acer_AV041_E350_1.000.08_EMEA_FR.zip:
http://vache-android.com/?dir=Smartphones/Liquid%20Gallant
http://vache-android.com/Smartphones/Liquid%20Gallant/OS%20Images/Dual%20SIM/EMEA_FR/Acer_AV041_E350_1.000.08_EMEA_FR.zip

system.img 452MB 474 229 044 bytes
logo.bin 25.2KB 25 840 bytes
MT6575_Android_scatter_emmc.txt 448 448 bytes
preloader_simcom75_cu_ics.bin 102.1 KB 104 588 bytes
uboot_simcom75_cu_ics.bin 166.5KB 170 480 bytes
boot.img 3660KB 3 747 840 bytes
recovery.img 4178KB 4 278 272 bytes
secro.img 4252KB 4 354 232

adb shell
shell@android:/ # ls -l
ls -l
drwxr-xr-x root	 root			 2012-10-11 22:30 acct
-rw-r--r-- root	 root		 1203 1970-01-01 01:00 advanced_meta_init.project.rc
-rw-r--r-- root	 root	 31594 1970-01-01 01:00 advanced_meta_init.rc
drwxrwx--- system cache			 2012-10-12 17:02 cache
dr-x------ root	 root			 2012-10-11 22:30 config
lrwxrwxrwx root	 root			 2012-10-11 22:30 d -> /sys/kernel/debug
drwxrwx--x system system		 2012-10-11 22:31 data
-rw-r--r-- root	 root		 168 1970-01-01 01:00 default.prop
drwxr-xr-x root	 root			 2012-10-11 22:31 dev
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@android -> /dev/block/mmcblk0p6
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@cache -> /dev/block/mmcblk0p2
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@ebr1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@fat -> /dev/block/mmcblk0p4
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@sec_ro -> /dev/block/mmcblk0p5
lrwxrwxrwx root	 root			 1970-01-01 01:00 emmc@usrdata -> /dev/block/mmcblk0p3
lrwxrwxrwx root	 root			 2012-10-11 22:30 etc -> /system/etc
-rwxr-x--- root	 root	 106928 1970-01-01 01:00 init
-rwxr-x--- root	 root		 149 1970-01-01 01:00 init.aee.customer.rc
-rwxr-x--- root	 root	 12600 1970-01-01 01:00 init.factory.rc
-rwxr-x--- root	 root		 2344 1970-01-01 01:00 init.goldfish.rc
-rwxr-x--- root	 root		 3511 1970-01-01 01:00 init.project.rc
-rwxr-x--- root	 root	 26841 1970-01-01 01:00 init.rc
-rwxr-x--- root	 root	 12063 1970-01-01 01:00 init.usb.rc
-rw-r--r-- root	 root		 9609 1970-01-01 01:00 meta_init.rc
drwxrwxr-x root	 system		 2012-10-11 22:30 mnt
dr-xr-xr-x root	 root			 1970-01-01 01:00 proc
lrwxrwxrwx root	 root			 1970-01-01 01:00 res -> /system/res
drwx------ root	 root			 2012-07-30 11:58 root
drwxr-x--- root	 root			 1970-01-01 01:00 sbin
lrwxrwxrwx root	 root			 2012-10-11 22:30 sdcard -> /mnt/sdcard
lrwxrwxrwx root	 root			 2012-10-11 22:30 sdcard2 -> /mnt/sdcard2
drwxr-xr-x root	 root			 2012-10-11 22:30 sys
drwxr-xr-x root	 root			 2012-10-04 12:57 system
-rw-r--r-- root	 root		 272 1970-01-01 01:00 ueventd.goldfish.rc
-rw-r--r-- root	 root		 4388 1970-01-01 01:00 ueventd.rc
lrwxrwxrwx root	 root			 2012-10-11 22:30 vendor -> /system/vendor
shell@android:/ #


partno: start_sect nr_sects partition_name
emmc_p1: 00000020 00000002 "ebr1"
emmc_p2: 0010f720 00100000 "cache"
emmc_p3: 0020ff20 00200000 "usrdata"
emmc_p4: 00410720 003328e0 "fat"
emmc_p5: 00009f00 00002800 "sec_ro"
emmc_p6: 0000ef20 00100000 "android"

From the Liquid Gallant :
emmc@android -> /dev/block/mmcblk0p6
emmc@cache -> /dev/block/mmcblk0p2
emmc@ebr1 -> /dev/block/mmcblk0p1
emmc@fat -> /dev/block/mmcblk0p4
emmc@sec_ro -> /dev/block/mmcblk0p5
emmc@usrdata -> /dev/block/mmcblk0p3



ls -l /dev/block
brw------- root	 root	 254, 0 2012-10-11 22:32 dm-0
brw------- root	 root	 254, 1 2012-10-11 22:32 dm-1
brw------- root	 root	 254, 2 2012-10-11 22:32 dm-2
brw------- root	 root	 254, 3 2012-10-11 22:32 dm-3
brw------- root	 root	 254, 4 2012-10-11 22:32 dm-4
brw------- root	 root	 254, 5 2012-10-11 22:33 dm-5
brw------- root	 root	 254, 6 2012-10-11 22:33 dm-6
brw------- root	 root	 254, 7 2012-10-11 22:33 dm-7
brw------- root	 root	 254, 8 2012-10-11 22:33 dm-8
brw------- root	 root	 254, 9 2012-10-11 22:33 dm-9
brw------- root	 root	 7, 0 2012-10-11 22:30 loop0
brw------- root	 root	 7, 1 2012-10-11 22:30 loop1
brw------- root	 root	 7, 2 2012-10-11 22:30 loop2
brw------- root	 root	 7, 3 2012-10-11 22:30 loop3
brw------- root	 root	 7, 4 2012-10-11 22:30 loop4
brw------- root	 root	 7, 5 2012-10-11 22:30 loop5
brw------- root	 root	 7, 6 2012-10-11 22:30 loop6
brw------- root	 root	 7, 7 2012-10-11 22:30 loop7
brw-rw---- root	 root	 7, 8 2012-10-11 22:33 loop8
brw-rw---- root	 root	 7, 9 2012-10-11 22:33 loop9
brw------- root	 root	 179, 0 2012-10-11 22:30 mmcblk0
brw------- root	 root	 179, 8 2012-10-11 22:30 mmcblk0boot0
brw------- root	 root	 179, 16 2012-10-11 22:30 mmcblk0boot1
brw------- root	 root	 179, 1 2012-10-11 22:30 mmcblk0p1
brw------- root	 root	 179, 2 2012-10-11 22:31 mmcblk0p2
brw------- root	 root	 179, 3 2012-10-11 22:31 mmcblk0p3
brw------- root	 root	 179, 4 2012-10-11 22:30 mmcblk0p4
brw------- root	 root	 179, 5 2012-10-11 22:30 mmcblk0p5
brw------- root	 root	 179, 6 2012-10-11 22:30 mmcblk0p6
brw------- root	 root	 179, 24 2012-10-11 22:30 mmcblk1
brw------- root	 root	 179, 25 2012-10-11 22:30 mmcblk1p1
drwxr-xr-x root	 root			 2012-10-11 22:30 platform
drwxr-xr-x root	 root			 2012-10-11 22:31 vold


---
brw------- root	 root	 179, 8 2012-10-11 22:30 mmcblk0boot0 boot ?
brw------- root	 root	 179, 16 2012-10-11 22:30 mmcblk0boot1 ?
brw------- root	 root	 179, 1 2012-10-11 22:30 mmcblk0p1 ebr1
brw------- root	 root	 179, 2 2012-10-11 22:31 mmcblk0p2 cache
brw------- root	 root	 179, 3 2012-10-11 22:31 mmcblk0p3 usrdata = data ?
brw------- root	 root	 179, 4 2012-10-11 22:30 mmcblk0p4 fat
brw------- root	 root	 179, 5 2012-10-11 22:30 mmcblk0p5 sec_ro
brw------- root	 root	 179, 6 2012-10-11 22:30 mmcblk0p6 android = system ?
brw------- root	 root	 179, 24 2012-10-11 22:30 mmcblk1
brw------- root	 root	 179, 25 2012-10-11 22:30 mmcblk1p1 sdcard ?

# 'dd' execution time, size of file produced
# < 1s 1MB
dd if=/dev/block/mmcblk0boot0 of=/sdcard2/clockworkmod/backup/boot0.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# < 1s 1MB
dd if=/dev/block/mmcblk0boot1 of=/sdcard2/clockworkmod/backup/boot1.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# 115 s 512 MB
dd if=/dev/block/mmcblk0p6 of=/sdcard2/clockworkmod/backup/system.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# 37s 512 MB
dd if=/dev/block/mmcblk0p2 of=/sdcard2/clockworkmod/backup/cache.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# < 1s 1KB
dd if=/dev/block/mmcblk0p1 of=/sdcard2/clockworkmod/backup/ebr1.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# < 1s 5MB
dd if=/dev/block/mmcblk0p5 of=/sdcard2/clockworkmod/backup/sec_ro.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# 104s 1.5 GB
dd if=/dev/block/mmcblk0p4 of=/sdcard2/clockworkmod/backup/fat.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# 62s 1022.3 MB
dd if=/dev/block/mmcblk0p3 of=/sdcard2/clockworkmod/backup/data.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

# seems to be the /sdcard2, size > 3GB at least! operation interrupted
dd if=/dev/block/mmcblk1p1 of=/sdcard2/clockworkmod/backup/sdcard.dsk	 bs=8192
ls -l /sdcard2/clockworkmod/backup/

[Benoit31]

Hi, we had an upgrade yesterday on the acer gallant, and of course the superuser have been deleted. Do u think we can retry Paul's rooting method ?

[lucky76]

We have ClockWork Recovery or other recovery mod?

I have this devices and is very good.

Bye all.

[albe.minimal]

lucky76, on 23 October 2012 - 11:20 AM, said:

We have ClockWork Recovery or other recovery mod?

I have this devices and is very good.

Bye all.

no nothing yet

[lucky76]

Ok thanks albe......

[hapx]

Benoit31, on 23 October 2012 - 05:38 AM, said:

Hi, we had an upgrade yesterday on the acer gallant, and of course the superuser have been deleted. Do u think we can retry Paul's rooting method ?

I used bin4ry method, it works well. I did not try Paul's method this time.

[Benoit31]

Ok thanks.
Done with Paul's method, ... and it rocks twice,