Root my M9

Originally Posted by evow04

first one should have a copy of the original uboot, then we could extract the binary to build a custom uboot, flash it over & run android/updates without the checksum.. but easier written then done:-)

so for now root is only for the ones with serial access to m9

With busybox in place, we would just have to locate the Uboot file, copy it off the nand and share it here. One week after that I'm sure we'll have root - for real this time! hehe

can you try to access proc/config.gz in root shell?

I'll try it tomorrow. And I'll try the uboot commands you list in another thread.

Originally Posted by Coninsan

With busybox in place, we would just have to locate the Uboot file, copy it off the nand and share it here. One week after that I'm sure we'll have root - for real this time! hehe

Actually we don't know where uboot is.
Does anyone know where m8 (android version) put its uboot ? I guess meizu will reuse many things of m8 to m9.

One more thing, seems nobody notice the recover.log I uploaded in another thread, so I upload it again.
From the recovery log, I have an idea:
Seems m9 will extract the firmware to /tmp/update.zip, and extract the key to /res/keys. Maybe we can get these files when m9 recovery runs.
I'll try ittomorrow. It may help us to extract the firmware.
Since I'm not familiar with android, who know what these lines mean, and could we modify this to get more information?

Code:

ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=0

Originally Posted by easwy

Does anyone know where m8 (android version) put its uboot ? I guess meizu will reuse many things of m8 to m9.

thing is android on m8 is fan made & without uboot, so nothing usefull there.

if you could run in uboot the following commands, it might pop up:-)

Code:

flpart - displays or modifies the partition table.
fsinfo - print information about filesystems

seems nobody notice the recover.log

I did,
but I´m currently working, so did a wordwrap in notepad to read it very quickly. But it was still a mess so i gave up :-)

Maybe we can get these files when m9 recovery runs

Not sure if that would work, but if it did, it would be fantastic.
But how would you pull it? using uboot or adb root shell ? Cause on reboot the content will be cleared I guess?

Code:

ro.secure=1

doesn´t really matter, if it shows as 0 instead of 1 you phone is rooted permanent (so even without serial access).
Can´t you pull it through serial root access, edit the default.prop file and push it back?

I've been trying to gain access to Uboot via both PuTTY and AcessPort, but no luck so far any tips?

did you check the wirings?
& do you get the output itself?

The wires are correct, I've already triple checked. And I am getting a clear output, I just can't interrupt Uboot.

Do you have any tips for that?

I've been tapping enter or holding it down while my M9 was booting, but no response in either PuTTY or AccessPort.

how long are the wires?
And do you measure any voltage on the tx pin when you broadcast data in putty?
& did you power VCC like easwy mentioned?

@xcmir; I like ;=)

The wires are 15cm or there about. VCC is powered by 3.3 Volts, just as easwy has done.
And my board says that data is transmitted every time I hit a key in PuTTY or AccessPort.

15 cm should be ok depending of the type of wiring
do you measure any spike using a multimeter when sending data?


edit interesting: ftp://ftp1.digi.com/support/patches/..._SD_U-Boot.pdf

It could have something to do with the internal pin in the Mini USB plug not staying in the plug haha, I guess I'll need to wire up a new one.

But it looks like xcmir has already made the Root stick

What does that picture mean evow?

can you try to access proc/config.gz in root shell?

There's no /proc/config.gz.
And i tried many uboot command, they don't work. See attachment.

Originally Posted by evow04

if you could run in uboot the following commands, it might pop up:-)

Code:

flpart - displays or modifies the partition table.
fsinfo - print information about filesystems

Won't work in uboot.

Originally Posted by evow04

Not sure if that would work, but if it did, it would be fantastic.
But how would you pull it? using uboot or adb root shell ? Cause on reboot the content will be cleared I guess?

There's no shell in recovery mode, so i cannot dump it

Originally Posted by Coninsan

The wires are correct, I've already triple checked. And I am getting a clear output, I just can't interrupt Uboot.
Do you have any tips for that?

Similar as my problem before. Please re-check the pin order. Pin 7 should be empty and pin 9 should be solider.
Also check the cable with multimeter to make sure they are connected well.

I can root M9 now without serial or adb, but wont realease details to public as its easily patchable bug. If coninsan or evow04 want the details, you guys can contact me, but I see you would already have root shell via serial anyways. Also nand is locked

sorry guys for such noob question but this is my first android phone so what is the point of rooting the phone. I know that you will laugh but how I will learn about it if will not ask

Once rooted, can we (normal M9 users) expect a custom M9 FW to update our devices to get root aswell? (without giving away how the root was possible)

i want root my m9, who can tell me how to do?

Here's something...

ROOT¹¤¾ß£¬ÇײâM9 ROOT ³É¹¦ - ×ÛºÏÌÖÂÛÇø - ÷È×åÉçÇø

Originally Posted by Coninsan

internal pin in the Mini USB plug not staying in the plug

lol, on such small wiring things can go wrong very fast :-)
You can , if everything is soldered well, put some glue on it to make it more solid?

xcmir has already made the Root stick

I can root M9 now without serial or adb

Indeed, Congrats 2 xcmir !
It´s nice to see that there are coming more options on rooting m9´s.

wont release details to public as its easily patchable bug

You are right, as long as it are minor bugs that can be patched fast by Meizu, I wouldn´t spread the information.
One can better make use of it by dumping as much information as one can.

In case any one wants root they can fall back on the 'hardware' hack.

evow04 want the details

thanks for the offer, but I´m not having an m9 so i wont be able to do something with it :-) (waiting on M9II )

expect a custom M9 FW to update our devices to get root aswell?

yup

what is the point of rooting the phone

10 reasons why to root

What does that picture mean

You can see a few things.
1: the "#" icon : this shows in a shell that you are root (normal user has "$").
2: command dd means you are going to copy files, in this case the content of mtd0
3: the raw content gets copied to the SD card in .img format
4: if I am right xcmir is trying to copy the NOR flash content & it looks successful.

no /proc/config.gz

damned, if you would have time, could you try one of the oldest firmware packages to see if that one contains this file? (its the kernel config).

Originally Posted by niq2001

Once rooted, can we (normal M9 users) expect a custom M9 FW to update our devices to get root aswell? (without giving away how the root was possible)

Possibly

We already know that the M9 has the extraction algorithme for Update.bin files, if we could extract that, then we could rig a program to unpack and compress update files - effectively pushing changes into place without the need for root access.

We would only need 1 full copy of the system, but it would be alot of work.
Yet since the only method of rooting is via a very fixable bug, firmware unpacking might be the only option for rom modification.