Guest minipower Posted December 20, 2016 Report Posted December 20, 2016 I'm going to build a custom recovery for my unsupported ZTE n817 Quest phone. The phone is running Android 4.4.4 - kernel 3.4.0 The phone has been rooted and made a few system and partitions backups. I would like to have my edited device files double checked. So I can be confident in building the custom recovery. I have installed a linux mint VM.I believe I have correctly setup the build environment. I have successfully built a few kernels and roms for a different device. I started by repo syncing CM11 and ran extract-files.sh. This gave me a device folder zte/n817.. I looked at Boardconfig.mk and their seemed to be some errors I marked in red This is the original unedited Boardconfig.mk [HIDE] USE_CAMERA_STUB := true # inherit from the proprietary version -include vendor/zte/n817/BoardConfigVendor.mk TARGET_ARCH := arm TARGET_NO_BOOTLOADER := trueTARGET_BOARD_PLATFORM := unknown TARGET_CPU_ABI := armeabi-v7a TARGET_CPU_ABI2 := armeabi TARGET_ARCH_VARIANT := armv7-a-neon TARGET_CPU_VARIANT := cortex-a7 TARGET_CPU_SMP := true ARCH_ARM_HAVE_TLS_REGISTER := true TARGET_BOOTLOADER_BOARD_NAME := n817 BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37BOARD_KERNEL_BASE := 0x00000000 BOARD_KERNEL_PAGESIZE := 2048 # fix this up by examining /proc/mtd on a running deviceBOARD_BOOTIMAGE_PARTITION_SIZE := 0x105c0000 BOARD_RECOVERYIMAGE_PARTITION_SIZE := 0x105c0000 BOARD_SYSTEMIMAGE_PARTITION_SIZE := 0x105c0000 BOARD_USERDATAIMAGE_PARTITION_SIZE := 0x105c0000 BOARD_FLASH_BLOCK_SIZE := 131072 TARGET_PREBUILT_KERNEL := device/zte/n817/kernel BOARD_HAS_NO_SELECT_BUTTON := true [/HIDE] This is my Boardconfig.mk I edited. Changes marked in red [HIDE] USE_CAMERA_STUB := true # inherit from the proprietary version -include vendor/zte/n817/BoardConfigVendor.mk TARGET_ARCH := arm TARGET_NO_BOOTLOADER := trueTARGET_BOARD_PLATFORM := msm8610 TARGET_CPU_ABI := armeabi-v7a TARGET_CPU_ABI2 := armeabi TARGET_ARCH_VARIANT := armv7-a-neon TARGET_CPU_VARIANT := cortex-a7 TARGET_CPU_SMP := true ARCH_ARM_HAVE_TLS_REGISTER := true TARGET_BOOTLOADER_BOARD_NAME := n817 BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 BOARD_KERNEL_BASE := 0x00000000 - Don't know what to put here BOARD_KERNEL_PAGESIZE := 2048 # fix this up by examining /proc/mtd on a running deviceBOARD_BOOTIMAGE_PARTITION_SIZE := 16777216 BOARD_RECOVERYIMAGE_PARTITION_SIZE := 16777216 BOARD_SYSTEMIMAGE_PARTITION_SIZE := 1291845632 BOARD_USERDATAIMAGE_PARTITION_SIZE := 1862270976 BOARD_FLASH_BLOCK_SIZE := 131072 TARGET_PREBUILT_KERNEL := device/zte/n817/kernel BOARD_HAS_NO_SELECT_BUTTON := true [/HIDE] The ZTE n817 Quest does not have mtd. So I ran adb shell and cat /proc/partitions and ls -al /dev/block/platform/msm_sdcc.1/by-name also mount and df commands. I then used dd if=/dev/block/mmcblk0** of=/sd card/***.img to dump the phones whole image and each partition separately. Looking at all these outputs I put this together. [HIDE] #blocks ---- by-name ---- partitions ---- size 8192 ---- DDR -> ---- /dev/block/mmcblk0p2 8192 ---- aboot -> ---- /dev/block/mmcblk0p15 16384 ---- boot -> ---- /dev/block/mmcblk0p17 ---- 16384 x 1024 = 16777216 311296 ---- cache -> ---- /dev/block/mmcblk0p22 40960 ---- carrier -> ---- /dev/block/mmcblk0p23 8192 ---- dbi -> ---- /dev/block/mmcblk0p5 8192 ---- fsc -> ---- /dev/block/mmcblk0p11 8192 ---- fsg -> ---- /dev/block/mmcblk0p12 8192 ---- misc -> ---- /dev/block/mmcblk0p21 131072 ---- modem -> ---- /dev/block/mmcblk0p16 8192 ---- modemst1 -> ---- /dev/block/mmcblk0p13 8192 ---- modemst2 -> ---- /dev/block/mmcblk0p14 8192 ---- pad -> ---- /dev/block/mmcblk0p9 32768 ---- persist -> ---- /dev/block/mmcblk0p8 16384 ---- recovery -> ---- /dev/block/mmcblk0p18 ---- 16384 x 1024 = 16777216 8192 ---- rpm -> ---- /dev/block/mmcblk0p3 8192 ---- sbl1 -> ---- /dev/block/mmcblk0p1 16384 ---- splash -> ---- /dev/block/mmcblk0p19 8192 ---- ssd -> ---- /dev/block/mmcblk0p10 1261568 ---- system -> ---- /dev/block/mmcblk0p24 ---- 1261568 x 1024 = 1291845632 8192 ---- tombstones -> ---- /dev/block/mmcblk0p20 8192 ---- tz -> ---- /dev/block/mmcblk0p4 1818624 ---- userdata -> ---- /dev/block/mmcblk0p25 ---- 1818624 x 1024 = 1862270976 8192 ---- ztecfg -> ---- /dev/block/mmcblk0p7 8192 ---- ztelk -> ---- /dev/block/mmcblk0p6 ======================================================================= ======================================================================= Filesystem Size Used Free Blksize /dev 198.8M 132.0K 198.6M 4096 /sys/fs/cgroup 198.8M 12.0K 198.7M 4096 /mnt/asec 198.8M 0.0K 198.8M 4096 /mnt/obb 198.8M 0.0K 198.8M 4096 /system 1.2G 780.7M 430.1M 4096 /data 1.7G 642.1M 1.1G 4096 /cache 299.0M 5.8M 293.2M 4096 /persist 31.5M 4.1M 27.4M 4096 /carrier 39.4M 4.0M 35.3M 4096 /firmware 64.0M 41.0M 23.0M 16384 /mnt/shell/emulated 1.7G 642.1M 1.1G 4096 /storage/emulated/legacy 1.7G 642.1M 1.1G 4096 /storage/emulated 198.8M 0.0K 198.8M 4096 /mnt/media_rw/sdcard1 29.8G 9.7G 20.1G 8192 /storage/sdcard1 29.8G 9.7G 20.1G 8192 /storage/emulated/0 1.7G 642.1M 1.1G 4096 /storage/emulated/0/Android/obb 1.7G 642.1M 1.1G 4096 /storage/emulated/legacy 1.7G 642.1M 1.1G 4096 /storage/emulated/legacy/Android/obb 1.7G 642.1M 1.1G 4096 [/HIDE] This is the cm.mk [HIDE] ## Specify phone tech before including full_phone $(call inherit-product, vendor/cm/config/gsm.mk) # Release name PRODUCT_RELEASE_NAME := n817 # Inherit some common CM stuff. $(call inherit-product, vendor/cm/config/common_full_phone.mk) # Inherit device configuration $(call inherit-product, device/zte/n817/device_n817.mk) ## Device identifier. This must come after all inclusions PRODUCT_DEVICE := n817 PRODUCT_NAME := cm_n817 PRODUCT_BRAND := zte PRODUCT_MODEL := n817 PRODUCT_MANUFACTURER := zte [/HIDE] -- but I'm not sure it is right. Because the ZTE n817 Quest is identified as [HIDE] ro.product.model=N817 ro.product.brand=ZTE ro.product.name=ZTE_WELLINGTON ro.product.device=wellington ro.product.board=wellington ro.build.description=ZTE_WELLINGTON-user 4.4.4 KTU84P 20150821.163315.3491 release-keys ro.build.fingerprint=ZTE/ZTE_WELLINGTON/wellington:4.4.4/KTU84P/20150821.163315.3491:user/release-keys ro.build.characteristics=cdma from device/zte/wellington/system.prop [/HIDE] This is the device_n817.mk [HIDE] $(call inherit-product, $(SRC_TARGET_DIR)/product/languages_full.mk) # The gps config appropriate for this device $(call inherit-product, device/common/gps/gps_us_supl.mk) $(call inherit-product-if-exists, vendor/zte/n817/n817-vendor.mk) DEVICE_PACKAGE_OVERLAYS += device/zte/n817/overlay LOCAL_PATH := device/zte/n817 ifeq ($(TARGET_PREBUILT_KERNEL),) LOCAL_KERNEL := $(LOCAL_PATH)/kernel else LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL) endif PRODUCT_COPY_FILES += \ $(LOCAL_KERNEL):kernel $(call inherit-product, build/target/product/full.mk) PRODUCT_BUILD_PROP_OVERRIDES += BUILD_UTC_DATE=0 PRODUCT_NAME := full_n817 PRODUCT_DEVICE := n817 [/HIDE] The AndroidProducts.mk [HIDE] PRODUCT_MAKEFILES := \ $(LOCAL_DIR)/device_n817.mk [/HIDE] This is AndroidBoard.mk [HIDE] LOCAL_PATH := $(call my-dir) include $(CLEAR_VARS) ALL_PREBUILT += $(INSTALLED_KERNEL_TARGET) # include the non-open-source counterpart to this file -include vendor/zte/n817/AndroidBoardVendor.mk [/HIDE] This is the original unedited recovery.fstab I got using extract-files.sh [HIDE] # mount point fstype device [device2] /boot mtd boot /cache yaffs2 cache /data yaffs2 userdata /misc mtd misc /recovery mtd recovery /sdcard vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0 /system yaffs2 system /sd-ext ext4 /dev/block/mmcblk0p2 [/HIDE] Do I need to sync a clockworkmod recovery in the CM11 tree and replace android_bootable_recovery or android_bootable_recovery-cm ¿? The phones vendor Proprietary Blobs have not been extracted yet. I didn't get the vendor files when I ran extract-files.sh.. I'm not finding the right way to extract the phones vendor files. I keep find different or conflicting instructions. Is there any tips or advice you would give me in helping me build the custom recovery ¿¿ Thank you for helping me with this
Guest minipower Posted December 26, 2016 Report Posted December 26, 2016 After some more digging. I figured I got the partitions and that the BOARD_KERNEL_BASE was correct. So I placed the ZTE kernel in CM11 tree and built a Flash Recovery. Since the phone does not have Fastboot, would I be able to dd the recovery using adb shell¿ Also.. I extracted the phones boot.img and edited the default.prop. Would I be able to repack the boot.img and dd it to the phone ¿
Guest jag9906 Posted January 27, 2017 Report Posted January 27, 2017 If your on Linux mkboot or mkbootimg, few others. OK I see you have Linux. Type sudo apt-get install mkbootimg Also on github
Guest raging_chaos Posted February 1, 2017 Report Posted February 1, 2017 Any updates on being able to build this recovery?
Guest minipower Posted March 1, 2017 Report Posted March 1, 2017 (edited) No.. I paused working on this because I need to figure out how to unlock the bootloader without Fastboot. I did do a strings search on the phones bootloader that I pulled after rooting and it still does have (unlock bootloader) in there. So it seems it's a regular bootloader and the security they used is too just not include fastboot. jag9906: I did do that. I pulled the boot partition and extracted everything out with those tools. That was how I figured out the BOARD_KERNEL_BASE was correct Edited March 1, 2017 by minipower
Guest PatchValid Posted March 9, 2017 Report Posted March 9, 2017 Hey minipower, any progress no the n817's bootloader? To be honest, I might be able to achive my goal it I just knew the right way of going about it. Here's my situation.. I currently use the n817 on the Q-Link network life-link service.(free government funded service) and would like to transfer my service to a better phone that will work with the same service. Thing is, even though the phone is completely compatible (Samsung SCH-R530X) Q-Link does not allow transferring the free line to a different phone. Now, I can transfer the whole Life-link line to a different carrier, but I'm not eligible for that until Dec. So, I thought I'll just clone the N817 to the Samsung, place the N817 in the closet til Dec, and all is good. Problem is, I can not get any software (CMDA WS, QPTS, DFS CMDA Tool, and a few others) to pull any info off of the damn thing to be able to do the cloning. Now, of course, I can pull all the common info from within the ##33284# and/or the ##3282# menus but is that enough info to successfully do the clone? From what I've gathered, I'll need the MSL code? Any help would be greatly appreciated. Thanks
Guest minipower Posted March 9, 2017 Report Posted March 9, 2017 I'm also playing with the same thing. So far I have been able to connect and read with software. I first put the phone in FTM mode and was able to read the phone. Also if you can get the MSL, you can put the phone in dm by ##3424# same as ##DIAG# it will ask for the 6 digit MSL and then you can turn on the usb as data port, which allows you to read the phone in software. I think I got all the info from the N817 to transfer to the other phone, but I'm not able to read the AAA and HA keys. I'm not totally sure if the phone uses them or not, because when I read the phone in software the command output box says invalid parameter. Also when I go into the ##DATA# menu and click on data profile, it shows HA SPI as 1234 and AAA SPI as 1234, those numbers show up when I press them so I can modify them. But when I press on the HA and AAA passwords it shows blank.
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now