Cubot X12
model: Cubot X12
- cpu: MediaTek MT6735M 1 GHz, 64 bit Quad core
- RAM: 1 GB
- ROM: 8 GB
- GPU: Mali-T20
- Display: 5 inch, 540x960, IPS, 16M colors
- touch screen: multitouch
- camera - front: 5.0 Mpixel
- camera - rear: 8.0 Mpixel
- network: 802.11 b/g/n
- WLAN MAC address: 60:fe:1e:41:16:71
- mobile bands: GSM 850 / 900 / 1800 / 1900 MHz, WCDMA 900 / 2100 MHz, FDD-LTE Band 1 / Band 3 / Band 7 / Band 20
- SIM: 2 x microSIM slots (DualSIM with dual standby)
- storage: microSD card slot (up to 32 GB)
- battery: 2200 mAh
- operating system: Android 5.1
- usb: 2.0
- Bluetooth: 4.0
- GPS: GPS + A-GPS
- color: golden
- other: built-in IR transmitter
- Android: 5.1 build R19
keys: vol down + power boots into chinese menu (factory test?), vol up + power boots into recovery
Android recovery: Power the Vol UP takes you to menu.
back to mobiles page.
Links
Links: Cubot, How to root Cubot X12 in less than an hour, NeedROM - X12, HardReset - Cubot X12, MTKROMs, Github: mtkimg, xda-developers: mtkimg, Easy Magic TWRP Installer for all MediaTek Devices ONLY, github: MediaDeb, more links: adb / fastboot commands - ultimate list, How to Discover Hidden Fastboot Commands, local links: Google Chromecast,
History
2020-04-24: apps - install Vivaldi 3.0.1885.36,
2018-08-14: xda-developers - [ROOT] [GUIDE] Tips for rooting cheap Chinese MediaTek MTK MT67xx (100s of models). Tools: SP Flash Tool (windows),. Techora - How to Port TWRP for MediaTek 64 bit MT67XX Devices [MTK], Image Kitchen, SP Flash Tool. Hmm, there is a SP Flash Tool for Linux here. xda-developers: TUTORIAL How to setup SP_Flash_Tool_Linux (MTK/MediaTek Soc),
2018-01-16: apps - install Google Chrome 63.0.3239.111 - permissions: device and app history, identity, location, photos/media/files, camera, microphone,
2018-01-16: apps - upgrade to Google Home 1.26.30.8,
2017-09-30: github: MediaDeb looks nice. Perhaps I can use it on this device some day.
2017-09-13: cast - unfortunately, upgrading to latest Google Home, restarting the phone and restarting the Chromecast didn't help. I still can't cast from this phone. Works nicely from another phone.
2017-09-13: apps - upgrade to Google Home 1.24.37.7, (YouTube 12.34.55 - need to much access; not installed),
2017-07-08: cast - after upgrading Google Home, I can cast to my Chromecast again.
2017-07-08: apps - upgrade to Google Home 1.24.33.6,
2017-06-27: apps - installed Ghost Commander 1.54 - access required: photos / media / files, Wi-Fi connection information, SMB plugin (for Ghost Commander) 1.32 - access: Wi-Fi conn. info., SFTP plugn (for Ghost Commander) 1.14.4,
2017-06-04: I couldn't connect to my Chromecast, so I rebooted the X12, but that didn't help.
2017-06-04: apps - upgraded to Google Home 1.23.35.2, Google 7.2.26.21.arm, Gmail 7.5.7.156101332.release, Kodi 17.3, Maps 9.53.1, Root Checker 6.0.8, SuperSU 2.82, YouTube 12.19.56 - new access: Contacts, Location, SMS, Microphone, Device ID + call info so I decided not to update,
2017-03-03: try to flash recovery (TWRP):
[tingo@localhost recovery_final]$ sudo fastboot devices [sudo] password for tingo: 0123456789ABCDEF fastboot [tingo@localhost recovery_final]$ sudo fastboot flash recovery recovery.img target reported max download size of 134217728 bytes sending 'recovery' (10630 KB)... OKAY [ 0.973s] writing 'recovery'... FAILED (remote: download for partition 'recovery' is not allowed ) finished. total time: 0.975s [tingo@localhost recovery_final]$
Hmm, do I need to unlock first?
[tingo@localhost recovery_final]$ sudo fastboot oem unlock ... (bootloader) Start unlock flow FAILED (remote: Unlock operation is not allowed ) finished. total time: 13.760s
(I answered volume up = yes)
[tingo@localhost recovery_final]$ sudo fastboot oem unlock ... OKAY [ 12.336s] finished. total time: 12.336s
(I answered volume down = no)
for some reason, the transfer process hung. so I restart from beginning
tingo@localhost recovery_final]$ adb reboot bootloader [tingo@localhost recovery_final]$ sudo fastboot devices 0123456789ABCDEF fastboot
retry the flashing
[tingo@localhost recovery_final]$ sudo fastboot flash recovery recovery.img target reported max download size of 134217728 bytes sending 'recovery' (10630 KB)... OKAY [ 0.992s] writing 'recovery'... FAILED (remote: download for partition 'recovery' is not allowed ) finished. total time: 0.994s
ok, unlock
[tingo@localhost recovery_final]$ sudo fastboot oem unlock ... OKAY [ 7.858s] finished. total time: 7.858s
retry flashing - didn't work
retry unlock
[tingo@localhost recovery_final]$ sudo fastboot oem unlock (bootloader) Start unlock flow FAILED (remote: Unlock operation is not allowed ) finished. total time: 6.163s
re-try flashing again
[tingo@localhost recovery_final]$ sudo fastboot flash recovery recovery.img target reported max download size of 134217728 bytes sending 'recovery' (10630 KB)... OKAY [ 0.987s] writing 'recovery'... FAILED (remote: download for partition 'recovery' is not allowed ) finished. total time: 0.989s
nope.
2017-03-03: root - trying KingRoot (kingroot.net) for rooting this phone. Does a few reboots, then "failed to root phone".
2017-03-03: factory test menu - a menu with chinese signs. Pressing volume down walks the menu, the lowest menu choice is "reboot".
2017-03-03: recovery - booting into recovery gives me an Android figure on its back with open front panel and a red warning triangle and the text "No command." under. Cannot seem to get out of it, have to take out the battery. Press: Power, then Vol UP, and you get to the recovery menu.
2016-12-11: apps - upgraded to YouTube 11.45.59,
2016-12-02: apps - upgraded to Google Home (formerly Google Cast) 1.19.29, at first the app wouldn't detect my Chromecast, but a few tries later it was working.
2016-06-26: apps - upgraded to Google Cast 1.16.7, YouTube 11.23.56,
2016-05-17: apps - upgraded to ES File Explorer 4.0.5.2, Gmail 6.4.120760496.release, Google 5.12.35.21.arm, Google Cast 1.15.7, Maps 9.25.1, YouTube 11.16.62,
2016-04-25: apps - upgraded to ES File Explorer 4.0.4.9, Gmail 6.3.117716127.release, Google 5.11.35.19.arm, Maps 9.23.1, Root Checker 5.8.1, Speedtest.net 3.2.18, YouTube 11.13.56,
2016-03-24: apps - upgraded to Chromecast 1.14.11, Google Text-to-speech 3.8.16, Maps 9.22.1, Root Checker 5.7.7,
2016-02-25: adb - shell - check out package manager (pm):
shell@hct6735m_35gu_l:/ $ pm list features feature:reqGlEsVersion=0x30000 feature:android.hardware.audio.output feature:android.hardware.bluetooth feature:android.hardware.bluetooth_le feature:android.hardware.camera feature:android.hardware.camera.any feature:android.hardware.camera.autofocus feature:android.hardware.camera.flash feature:android.hardware.camera.front feature:android.hardware.consumerir feature:android.hardware.faketouch feature:android.hardware.location feature:android.hardware.location.gps feature:android.hardware.location.network feature:android.hardware.microphone feature:android.hardware.screen.landscape feature:android.hardware.screen.portrait feature:android.hardware.sensor.accelerometer feature:android.hardware.sensor.compass feature:android.hardware.sensor.light feature:android.hardware.sensor.proximity feature:android.hardware.telephony feature:android.hardware.telephony.gsm feature:android.hardware.touchscreen feature:android.hardware.touchscreen.multitouch feature:android.hardware.touchscreen.multitouch.distinct feature:android.hardware.touchscreen.multitouch.jazzhand feature:android.hardware.usb.accessory feature:android.hardware.usb.host feature:android.hardware.wifi feature:android.hardware.wifi.direct feature:android.software.app_widgets feature:android.software.backup feature:android.software.connectionservice feature:android.software.device_admin feature:android.software.home_screen feature:android.software.input_methods feature:android.software.live_wallpaper feature:android.software.print feature:android.software.webview
libraries
shell@hct6735m_35gu_l:/ $ pm list libraries library:android.test.runner library:com.android.future.usb.accessory library:com.android.location.provider library:com.android.media.remotedisplay library:com.android.mediadrm.signer library:com.google.android.gms library:com.google.android.maps library:com.google.android.media.effects library:com.google.widevine.software.drm library:com.mediatek.effect library:javax.obex library:org.simalliance.openmobileapi
users
shell@hct6735m_35gu_l:/ $ pm list users Users: UserInfo{0:Owner:13} running
max supported users
shell@hct6735m_35gu_l:/ $ pm get-max-users Maximum supported users: 1
permission groups
shell@hct6735m_35gu_l:/ $ pm list permission-groups permission group:android.permission-group.PHONE_CALLS permission group:android.permission-group.WALLPAPER permission group:com.google.android.gms.permission.CAR_INFORMATION permission group:android.permission-group.MESSAGES permission group:android.permission-group.USER_DICTIONARY permission group:android.permission-group.CALENDAR permission group:android.permission-group.BLUETOOTH_NETWORK permission group:android.permission-group.BOOKMARKS permission group:android.permission-group.CAMERA permission group:android.permission-group.DEVELOPMENT_TOOLS permission group:android.permission-group.SCREENLOCK permission group:android.permission-group.WRITE_USER_DICTIONARY permission group:android.permission-group.AUDIO_SETTINGS permission group:android.permission-group.HARDWARE_CONTROLS permission group:android.permission-group.VOICEMAIL permission group:android.permission-group.DISPLAY permission group:android.permission-group.APP_INFO permission group:android.permission-group.SOCIAL_INFO permission group:android.permission-group.AFFECTS_BATTERY permission group:android.permission-group.NETWORK permission group:android.permission-group.ACCESSIBILITY_FEATURES permission group:android.permission-group.STATUS_BAR permission group:android.permission-group.SYNC_SETTINGS permission group:android.permission-group.PERSONAL_INFO permission group:android.permission-group.LOCATION permission group:android.permission-group.SYSTEM_CLOCK permission group:android.permission-group.STORAGE permission group:android.permission-group.SYSTEM_TOOLS permission group:android.permission-group.ACCOUNTS permission group:android.permission-group.COST_MONEY permission group:android.permission-group.DEVICE_ALARMS permission group:android.permission-group.MICROPHONE
install location
shell@hct6735m_35gu_l:/ $ pm get-install-location 0[auto]
packages
shell@hct6735m_35gu_l:/ $ pm list packages package:com.android.providers.telephony package:com.adups.fota.sysoper package:com.google.android.googlequicksearchbox package:com.android.providers.calendar package:com.android.providers.media package:com.mediatek.fwk.plugin package:com.android.wallpapercropper package:com.mediatek.schpwronoff package:org.simalliance.openmobileapi.service package:com.android.documentsui package:com.android.galaxy4 package:com.android.externalstorage package:com.mediatek.ygps package:com.android.htmlviewer package:com.android.mms.service package:com.android.providers.downloads package:com.fw.upgrade package:com.adups.fota package:com.mediatek.engineermode package:com.mediatek.omacp package:com.android.browser package:com.android.providers.applications package:com.mediatek.fmradio package:com.google.android.configupdater package:com.android.soundrecorder package:com.mobitrendz.phoneinfo package:com.android.defcontainer package:org.zwanoo.android.speedtest package:com.android.providers.downloads.ui package:com.android.vending package:com.android.pacprocessor package:com.joeykrim.rootcheck package:com.android.certinstaller package:android package:com.mediatek.connectivity package:com.android.contacts package:com.android.mms package:com.android.stk package:com.android.launcher3 package:com.android.backupconfirm package:com.google.android.gm package:com.android.wallpaper.holospiral package:com.android.calendar package:com.android.phasebeam package:com.mediatek.providers.drm package:com.google.android.setupwizard package:com.android.providers.settings package:com.android.sharedstoragebackup package:com.mediatek.batterywarning package:com.android.printspooler package:com.mediatek.datatransfer package:com.android.dreams.basic package:com.android.webview package:com.android.inputdevices package:com.estrongs.android.pop package:com.mediatek package:com.example package:com.android.musicfx package:com.google.android.apps.maps package:com.google.android.apps.plus package:com.android.onetimeinitializer package:com.mediatek.nlpservice package:com.android.server.telecom package:com.google.android.syncadapters.contacts package:com.android.keychain package:com.android.dialer package:com.android.gallery3d package:com.google.android.gms package:com.google.android.gsf package:com.google.android.tts package:com.google.android.partnersetup package:com.android.packageinstaller package:com.android.proxyhandler package:com.android.inputmethod.latin package:cn.sh.hct.themeNormal package:com.android.musicvis package:com.google.android.syncadapters.calendar package:com.android.managedprovisioning package:com.mediatek.calendarimporter package:com.mediatek.atci.service package:com.android.dreams.phototable package:com.mediatek.thermalmanager package:com.android.noisefield package:com.google.android.gsf.login package:com.geohot.towelroot package:com.mediatek.factorymode package:com.mtk.telephony package:com.android.wallpaper.livepicker package:com.dama.hardwareinfo package:com.google.android.backuptransport package:com.android.settings package:com.estrongs.chromecast package:com.fw.upgrade.sysoper package:com.android.calculator2 package:com.mediatek.lbs.em2.ui package:com.google.android.apps.chromecast.app package:se.iis.bbk package:com.android.wallpaper package:com.android.vpndialogs package:com.android.email package:eu.chainfire.supersu package:com.android.music package:com.android.phone package:com.android.shell package:com.android.providers.userdictionary package:com.android.location.fused package:com.android.deskclock package:com.android.systemui package:com.android.exchange package:com.mediatek.filemanager package:com.mediatek.mtklogger package:com.mediatek.apst.target package:com.android.bluetooth package:com.android.providers.contacts package:com.android.captiveportallogin package:com.mediatek.dataprotection
a few interesting ones.
2016-02-25: adb - run adb shell and see what you can figure out.
[tingo@localhost backups]$ adb shell shell@hct6735m_35gu_l:/ $
nice.
shell@hct6735m_35gu_l:/ $ date Thu Feb 25 22:03:53 CET 2016
correct.
list files ```sh shell@hct6735m_35gu_l:/ $ ls -l drwxr-xr-x root root 2016-02-25 21:49 acct drwxrwx--- system cache 2016-02-25 00:07 cache lrwxrwxrwx root root 1970-01-01 01:00 charger -> /sbin/healthd dr-x------ root root 2016-02-25 21:49 config drwxr-xr-x root root 2016-02-25 21:49 custom lrwxrwxrwx root root 2016-02-25 21:49 d -> /sys/kernel/debug drwxrwx--x system system 2016-02-25 21:49 data -rw-r--r-- root root 531 1970-01-01 01:00 default.prop drwxr-xr-x root root 2016-02-25 21:49 dev -rw-r--r-- root root 500 1970-01-01 01:00 enableswap.sh lrwxrwxrwx root root 2016-02-25 21:49 etc -> /system/etc -rw-r--r-- root root 1851 1970-01-01 01:00 factory_init.project.rc -rw-r--r-- root root 18948 1970-01-01 01:00 factory_init.rc -rw-r--r-- root root 31476 1970-01-01 01:00 file_contexts -rw-r----- root root 1837 1970-01-01 01:00 fstab.mt6735 -rwxr-x--- root root 235880 1970-01-01 01:00 init -rwxr-x--- root root 605 1970-01-01 01:00 init.aee.rc -rwxr-x--- root root 1071 1970-01-01 01:00 init.environ.rc -rwxr-x--- root root 3548 1970-01-01 01:00 init.modem.rc -rwxr-x--- root root 48066 1970-01-01 01:00 init.mt6735.rc -rwxr-x--- root root 31495 1970-01-01 01:00 init.mt6735.usb.rc -rwxr-x--- root root 4492 1970-01-01 01:00 init.project.rc -rwxr-x--- root root 22366 1970-01-01 01:00 init.rc -rwxr-x--- root root 1270 1970-01-01 01:00 init.ssd_nomuser.rc -rwxr-x--- root root 2288 1970-01-01 01:00 init.trace.rc -rwxr-x--- root root 3885 1970-01-01 01:00 init.usb.rc -rwxr-x--- root root 583 1970-01-01 01:00 init.xlog.rc -rwxr-x--- root root 301 1970-01-01 01:00 init.zygote32.rc -rw-r--r-- root root 1062 1970-01-01 01:00 meta_init.modem.rc -rw-r--r-- root root 1630 1970-01-01 01:00 meta_init.project.rc -rw-r--r-- root root 14551 1970-01-01 01:00 meta_init.rc drwxrwxr-x root system 2016-02-25 21:49 mnt lstat './nvdata' failed: Permission denied drwxrwx--x system system 2016-02-25 21:49 persist dr-xr-xr-x root root 1970-01-01 01:00 proc -rw-r--r-- root root 9169 1970-01-01 01:00 property_contexts lstat './protect_f' failed: Permission denied lstat './protect_s' failed: Permission denied drwx------ root root 2015-09-22 09:45 root drwxr-x--- root root 1970-01-01 01:00 sbin lrwxrwxrwx root root 2016-02-25 21:49 sdcard -> /storage/sdcard0 -rw-r--r-- root root 471 1970-01-01 01:00 seapp_contexts -rw-r--r-- root root 79 1970-01-01 01:00 selinux_version -rw-r--r-- root root 257203 1970-01-01 01:00 sepolicy -rw-r--r-- root root 11479 1970-01-01 01:00 service_contexts drwxr-x--x root sdcard_r 2016-02-25 21:49 storage dr-xr-xr-x root root 2016-02-25 21:49 sys drwxr-xr-x root root 2016-01-03 23:52 system -rw-r--r-- root root 8520 1970-01-01 01:00 ueventd.rc lrwxrwxrwx root root 2016-02-25 21:49 vendor -> /system/vendor shell@hct6735m_35gu_l:/ $
good. check out some .rc files
shell@hct6735m_35gu_l:/ $ more factory_init.project.rc mkdir /data/misc/sensors 0664 system system service msensord /system/bin/msensord user system group system oneshot service akmd8963 /system/bin/akmd8963 disabled user system group system on post-fs # # Connectivity related modules and character device nodes (Begin) # #for 662x_launcher chmod 0660 /dev/ttyMT2 chown system system /dev/ttyMT2 # STP, SDIO, WMT, GPS, FM and BT Driver # insmod /system/lib/modules/mtk_hif_sdio.ko # insmod /system/lib/modules/mtk_stp_wmt.ko # insmod /system/lib/modules/mtk_stp_uart.ko # insmod /system/lib/modules/mtk_stp_gps.ko # insmod /system/lib/modules/mtk_stp_bt.ko # insmod /system/lib/modules/mtk_fm_drv.ko # insmod /system/lib/modules/mtk_fm_priv.ko # insmod /system/lib/modules/mtk_wmt_wifi.ko insmod /system/lib/modules/mtk_wmt_detect.ko # Create char device file for WMT, GPS, BT, FM, WIFI mknod /dev/stpwmt c 190 0; mknod /dev/stpgps c 191 0; mknod /dev/stpbt c 192 0; mknod /dev/fm c 193 0; chmod 0660 /dev/stpwmt chown system system /dev/stpwmt chmod 0660 /dev/wmtdetect chown system system /dev/wmtdetect # FM Radio device, FIXME: this is not a proper way to set permissions chmod 0666 /dev/fm mknod /dev/wmtWifi c 153 0 chmod 0666 /dev/wmtWifi chmod 0660 /dev/stpgps chmod 0660 /dev/stpbt chown bluetooth radio /dev/stpbt # Load WiFi Driver #insmod /system/lib/modules/wlan.ko # # Connectivity related modules and character device nodes (Ends) # on boot # # Connectivity related services (Begin) # service wmtLoader /system/bin/wmt_loader user root group root oneshot service conn_launcher /system/bin/6620_launcher -p /system/etc/firmware/ user system group system # # Connectivity related services (End) # next is factory_init.rc: 127|shell@hct6735m_35gu_l:/ $ more factory_init.rc import /init.environ.rc import init.ssd.rc import init.no_ssd.rc import init.ssd_nomuser.rc import init.fon.rc import init.trustonic.rc on early-init # Set init and its forked children's oom_adj. write /proc/1/oom_score_adj -1000 # Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls. write /sys/fs/selinux/checkreqprot 0 # Set the security context for the init process. # This should occur before anything else (e.g. ueventd) is started. setcon u:r:init:s0 # Set the security context of /adb_keys if present. restorecon /adb_keys start ueventd write /proc/bootprof "INIT: usr/eng build setting" # create mountpoints mkdir /mnt 0775 root system on init sysclktz 0 loglevel 5 # Backward compatibility symlink /system/etc /etc symlink /sys/kernel/debug /d # Temp Backward compatibility symlink /dev/block/platform/mtk-msdc.0/by-name/boot /dev/bootimg symlink /dev/block/platform/mtk-msdc.0/by-name/recovery /dev/recovery symlink /dev/block/platform/mtk-msdc.0/by-name/secro /dev/sec_ro symlink /dev/block/platform/mtk-msdc.0/by-name/kb /dev/kb symlink /dev/block/platform/mtk-msdc.0/by-name/dkb /dev/dkb symlink /dev/block/platform/mtk-msdc.0/by-name/seccfg /dev/seccfg symlink /dev/block/platform/mtk-msdc.0/by-name/proinfo /dev/pro_info symlink /dev/block/platform/mtk-msdc.0/by-name/nvram /dev/nvram symlink /dev/block/platform/mtk-msdc.0/by-name/para /dev/misc symlink /dev/block/platform/mtk-msdc.0/by-name/logo /dev/logo # Right now vendor lives on the same filesystem as system, # but someday that may change. symlink /system/vendor /vendor # Create cgroup mount point for cpu accounting mkdir /acct mount cgroup none /acct cpuacct mkdir /acct/uid # Backwards Compat - XXX: Going away in G* symlink /mnt/sdcard /sdcard mkdir /system mkdir /data 0771 system system mkdir /cache 0770 system cache mkdir /config 0500 root root mkdir /protect_f 0771 system system mkdir /protect_s 0771 system system #create mountpoint for persist partition mkdir /persist 0771 system system #Create nvdata mount point mkdir /nvdata 0771 system system # See storage config details at http://source.android.com/tech/storage/ mkdir /mnt/shell 0700 shell shell mkdir /mnt/media_rw 0700 media_rw media_rw mkdir /storage 0751 root sdcard_r # Filesystem image public mount points. mkdir /mnt/obb 0700 root system mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000 write /proc/sys/kernel/panic_on_oops 1 write /proc/sys/kernel/hung_task_timeout_secs 0 write /proc/cpu/alignment 4 write /proc/sys/kernel/sched_latency_ns 10000000 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000 write /proc/sys/kernel/sched_compat_yield 1 write /proc/sys/kernel/sched_child_runs_first 0 # Healthd can trigger a full boot from charger mode by signaling this # property when the power button is held. on property:sys.boot_from_charger_mode=1 class_stop charger trigger late-init # Load properties from /system/ + /factory after fs mount. on load_all_props_action load_all_props # Mount filesystems and start core system services. on late-init trigger early-fs trigger fs trigger post-fs trigger post-fs-data # Load properties from /system/ + /factory after fs mount. Place # this in another action so that the load will be scheduled after the prior # issued fs triggers have completed. trigger load_all_props_action trigger early-boot trigger boot on fs write /proc/bootprof "INIT:Mount_START" mount_all /fstab.mt6735 #change partition permissions exec /system/bin/chmod 0640 /dev/block/platform/mtk-msdc.0/by-name/boot exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/boot exec /system/bin/chmod 0640 /dev/block/platform/mtk-msdc.0/by-name/recovery exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/recovery exec /system/bin/chmod 0640 /dev/block/platform/mtk-msdc.0/by-name/secro exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/secro exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/seccfg exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/seccfg exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/proinfo exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/proinfo exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/otp exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/otp exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/nvram exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/nvram exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/para exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/para exec /system/bin/chmod 0660 /dev/block/platform/mtk-msdc.0/by-name/logo exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/logo exec /system/bin/chown root:system /dev/block/platform/mtk-msdc.0/by-name/para write /proc/bootprof "INIT:Mount_END" on post-fs # once everything is setup, no need to modify / mount rootfs rootfs / ro remount chown system system /system/data mkdir /system/cache 0770 system cache # We restorecon /cache in case the cache partition has been reset. restorecon_recursive /cache # We chown/chmod /data again so because mount is run as root + defaults chown system system /system/data chmod 0777 /system/data # We chown/chmod /data again so because mount is run as root + defaults chown system system /data chmod 0771 /data # We restorecon /data in case the userdata partition has been reset. restorecon /data # Same reason as /data above chown system cache /cache chmod 0770 /cache mkdir /cache/recovery 0770 system system chown system system /protect_f chmod 0770 /protect_f chown system system /protect_s chmod 0770 /protect_s # This may have been created by the recovery system with odd permissions chown system cache /cache/recovery chmod 0770 /cache/recovery #change permissions on vmallocinfo so we can grab it from bugreports chown root log /proc/vmallocinfo chmod 0440 /proc/vmallocinfo #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks chown root system /proc/kmsg chmod 0440 /proc/kmsg # make the selinux kernel policy world-readable chmod 0444 /sys/fs/selinux/policy # create the lost+found directories, so as to enforce our permissions mkdir /cache/lost+found 0770 root root on post-fs-data #SeLinux mkdir /data/ccci_cfg 0770 system radio restorecon /data/ccci_cfg restorecon_recursive /protect_f restorecon_recursive /protect_s # We chown/chmod /data again so because mount is run as root + defaults chown root system /proc/sysrq-trigger chmod 0220 /proc/sysrq-trigger chown system system /persist chmod 0771 /persist # create basic filesystem structure #mkdir /data/nvram 2770 root system # We chown/chmod /nvdata again so because mount is run as root + defaults chown root system /nvdata chmod 2770 /nvdata symlink /nvdata /data/nvram # Set SELinux security contexts on upgrade or policy update. restorecon_recursive /nvdata mkdir /data/misc 01771 system misc mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth mkdir /data/misc/bluetooth 0770 system system mkdir /data/misc/keystore 0700 keystore keystore mkdir /data/misc/keychain 0771 system system mkdir /data/misc/vpn 0770 system vpn mkdir /data/misc/systemkeys 0700 system system # give system access to wpa_supplicant.conf for backup and restore mkdir /data/misc/wifi 0770 wifi wifi chmod 0660 /data/misc/wifi/wpa_supplicant.conf mkdir /data/local 0771 shell shell mkdir /data/local/tmp 0771 shell shell mkdir /data/data 0771 system system mkdir /data/app-private 0771 system system mkdir /data/app 0771 system system mkdir /data/property 0700 root root # create the lost+found directories, so as to enforce our permissions mkdir /data/lost+found 0770 mkdir /cache/lost+found 0770 # double check the perms, in case lost+found already exists, and set owner chown root root /data/lost+found chmod 0770 /data/lost+found chown root root /cache/lost+found chmod 0770 /cache/lost+found # VIA flashlessd service mkdir /data/flashless 0770 radio nvram mkdir /data/nvram/md_via 0770 root nvram chmod 0660 /dev/ttyMT4 chown radio radio /dev/ttyMT4 chmod 0660 /dev/vmodem chown radio radio /dev/vmodem #VIA pppd service mkdir /data/pppd_via 0770 radio system # md32 boot chown root system /dev/md32 chmod 0440 /dev/md32 chown root system /sys/class/misc/md32/md32_mobile_log chmod 0660 /sys/class/misc/md32/md32_mobile_log write /sys/class/misc/md32/md32_boot 1 # dhcp server mkdir /data/misc/dhcp 0770 dhcp dhcp chown dhcp dhcp /data/misc/dhcp # device info interface chmod 0440 /dev/devmap chown root system /dev/devmap #change partition permission exec /system/etc/partition_permission.sh ## Custom pos-fs area (START) # Please add custom fs operation below # Touch Panel chown root diag /sys/module/tpd_setting/parameters/tpd_calmat chown root diag /sys/module/tpd_setting/parameters/tpd_em_debounce_time chown root diag /sys/module/tpd_debug/parameters/tpd_em_log chown root diag /sys/module/tpd_debug/parameters/tpd_em_log_to_fs chmod 0777 /dev/pmem_multimedia chmod 0777 /dev/mt6516-isp chmod 0777 /dev/mt6516-IDP chmod 0777 /dev/mt9p012 chmod 0777 /dev/mt6516_jpeg chmod 0777 /dev/FM50AF chmod 0777 /dev/BU6424AF chmod 0777 /dev/IMX164AF chmod 0777 /dev/BU6429AF # RTC mkdir /data/misc/rtc 0770 system system # Modem related device nodes mkdir /data/nvram/md 0770 root system mkdir /data/nvram/md2 0770 root system # Build-in Modified - S # insmod /system/lib/modules/ccci_plat.ko # insmod /system/lib/modules/ccci.ko # Build-in Modified - E # chown ccci ccci /sys/class/BOOT/BOOT/boot/md chown radio radio /sys/kernel/ccci/boot # M4U #insmod /system/lib/modules/m4u.ko #mknod /dev/M4U_device c 188 0 chmod 0444 /dev/M4U_device #set mlock limit to infinate (for m4u operation) setrlimit 8 -1 -1 # Sensor chmod 0666 /dev/hwmsensor chmod 0666 /dev/gyroscope chmod 0666 /dev/msensor chmod 0666 /dev/gsensor chmod 0666 /dev/alsps #VideoCodec chmod 0666 /dev/Vcodec mkdir /data/amit/ # GPIO chmod 0666 /dev/mtgpio chmod 0666 /dev/exm0 # TTY # For ATCID chmod 0660 /dev/ttyGS0 chown system radio /dev/ttyGS0 chmod 0660 /dev/ttyGS1 chown system /dev/ttyGS1 # For BT relayer chown bluetooth radio /dev/ttyGS2 chmod 0660 /dev/ttyGS2 # For MD Logger chown system radio /dev/ttyGS3 chmod 0660 /dev/ttyGS3 #NFC rm /data/mtknfc_server ## Custom pos_fs area (END) # Separate location for storing security policy files on data mkdir /data/security 0711 system system # Reload policy from /data/security if present. setprop selinux.reload_policy 1 # Set SELinux security contexts on upgrade or policy update. restorecon_recursive /data # If there is no fs-post-data action in the init.<device>.rc file, you # must uncomment this line, otherwise encrypted filesystems # won't work. # Set indication (checked by vold) that we have finished this action setprop vold.post_fs_data_done 1 on boot #VIA device property setprop viatel.device.asci uart.4.ttyMT setprop viatel.device.fls sdio.3.ttySDIO setprop viatel.device.at sdio.4.ttySDIO setprop viatel.device.data sdio.1.ttySDIO # basic network init ifup lo hostname localhost domainname localdomain # Start default class, this line is very important!! class_start default class_start core on nonencrypted class_start main class_start late_start on property:vold.decrypt=trigger_default_encryption start defaultcrypto on property:vold.decrypt=trigger_encryption start surfaceflinger start encrypt on property:vold.decrypt=trigger_reset_main class_reset main on property:vold.decrypt=trigger_load_persist_props load_persist_props on property:vold.decrypt=trigger_post_fs_data trigger post-fs-data on property:vold.decrypt=trigger_restart_min_framework class_start main on property:vold.decrypt=trigger_restart_framework start nvram_daemon class_start main class_start late_start start permission_check on property:vold.decrypt=trigger_shutdown_framework class_reset late_start class_reset main ## Daemon processes to be run by init. ## # Update the second boot logo # service bootlogoupdater /system/bin/boot_logo_updater # oneshot service ueventd /sbin/ueventd class core critical seclabel u:r:ueventd:s0 service logd /system/bin/logd class core socket logd stream 0666 logd logd socket logdr seqpacket 0666 logd logd socket logdw dgram 0222 logd logd seclabel u:r:logd:s0 service console /system/bin/sh class core console disabled user shell group shell log seclabel u:r:shell:s0 on property:sys.powerctl=* powerctl ${sys.powerctl} on property:ro.debuggable=1 start console # adbd is controlled via property triggers in init.<platform>.usb.rc service adbd /sbin/adbd --root_seclabel=u:r:su:s0 class core socket adbd stream 660 system system disabled seclabel u:r:adbd:s0 service vold /system/bin/vold class core socket vold stream 0660 root mount ioprio be 2 # One shot invocation to deal with encrypted volume. service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted disabled oneshot # vold will set vold.decrypt to trigger_restart_framework (default # encryption) or trigger_restart_min_framework (other encryption) # One shot invocation to encrypt unencrypted volumes service encrypt /system/bin/vdc --wait cryptfs enablecrypto inplace default disabled oneshot # vold will set vold.decrypt to trigger_restart_framework (default # encryption) ## Custom service area (START) # Please add custom service below service thermal_manager /system/bin/thermal_manager user root oneshot service permission_check /system/bin/permission_check user root group system radio oneshot service ccci_fsd /system/bin/ccci_fsd 0 user radio group radio system oneshot service ccci_mdinit /system/bin/ccci_mdinit 0 user system group radio system oneshot service ccci_rpcd /system/bin/ccci_rpcd 0 user radio group radio system oneshot service nvram_daemon /system/bin/nvram_daemon class main user root group system oneshot service mdlogger /system/bin/mdlogger class main user shell group shell system radio sdcard_rw inet disabled oneshot service dualmdlogger /system/bin/dualmdlogger class main user shell group shell system radio sdcard_rw inet disabled oneshot service installd /system/bin/installd class main socket installd stream 600 system system service factory_no_image /system/bin/logwrapper /system/bin/factory disabled oneshot service factory_with_image /system/bin/logwrapper /sbin/factory disabled oneshot service mobile_log_d /system/bin/mobile_log_d class main #service hald /system/bin/hald # class main # socket hald stream 0660 root system #service wpa_supplicant /system/bin/logwrapper /system/bin/wpa_supplicant # group wifi # disabled # oneshot # # Connectivity related services (End) # # ## Custom service area (END) #statusd service service statusd /system/bin/statusd -f [/system/bin/flashlessd -l -m 0] socket statusd stream 660 radio radio user radio group radio cache inet misc system on property:sys.mtk.no.factoryimage=1 start factory_no_image on property:sys.mtk.no.factoryimage=0 start factory_with_image #mass_storage,adb,acm on property:ro.boot.usbconfig=0 write /sys/class/android_usb/android0/iSerial $ro.serialno write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor 0e8d write /sys/class/android_usb/android0/idProduct 2006 write /sys/class/android_usb/android0/f_acm/instances 1 write /sys/class/android_usb/android0/functions mass_storage,adb,acm write /sys/class/android_usb/android0/enable 1 start adbd setprop sys.usb.acm_idx 1 #acm on property:ro.boot.usbconfig=1 write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/iSerial " " write /sys/class/android_usb/android0/idVendor 0e8d write /sys/class/android_usb/android0/idProduct 2007 write /sys/class/android_usb/android0/f_acm/instances 1 write /sys/class/android_usb/android0/functions acm write /sys/class/android_usb/android0/bDeviceClass 02 write /sys/class/android_usb/android0/enable 1 #singloe modem comport for factory mode on property:sys.usb.config=gs3,dual_acm write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor $sys.usb.vid write /sys/class/android_usb/android0/idProduct 202E write /sys/class/android_usb/android0/f_acm/port_index 1,4 write /sys/devices/platform/mt_usb/saving 1 write /sys/class/android_usb/android0/functions mass_storage,adb,acm write /sys/class/android_usb/android0/enable 1 chown system radio /dev/ttyGS3 chmod 0660 /dev/ttyGS3 start adbd setprop sys.usb.state $sys.usb.config setprop sys.usb.acm_idx 1,4 #dual modem comport for factory mode on property:sys.usb.config=gs1gs3,dual_acm write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor $sys.usb.vid write /sys/class/android_usb/android0/idProduct 202F write /sys/class/android_usb/android0/f_acm/port_index 1,2,4 write /sys/devices/platform/mt_usb/saving 1 write /sys/class/android_usb/android0/functions adb,acm write /sys/class/android_usb/android0/enable 1 chown system radio /dev/ttyGS3 chmod 0660 /dev/ttyGS3 chown system radio /dev/ttyGS1 chmod 0660 /dev/ttyGS1 start adbd setprop sys.usb.state $sys.usb.config setprop sys.usb.acm_idx 1,2,4
contents of system/xbin
shell@hct6735m_35gu_l:/ $ ls -l system/xbin lstat 'system/xbin/BGW' failed: Permission denied -rwxr-xr-x root shell 59756 2015-08-24 07:03 dexdump lstat 'system/xbin/mnld' failed: Permission denied -rwxr-xr-x root shell 9444 2015-08-24 07:03 showmap -rwxr-xr-x root root 813252 2015-08-24 07:03 tcpdump
contents of system/bin
shell@hct6735m_35gu_l:/ $ ls -l system/bin -rwxr-xr-x root shell 22780 2015-08-24 07:03 6620_launcher -rwxr-xr-x root shell 9472 2015-08-24 07:03 6620_wmt_concurrency -rwxr-xr-x root shell 9500 2015-08-24 07:03 6620_wmt_lpbk -rwxr-xr-x root shell 66944 2015-08-24 07:03 AcdApiDaemon -rwxr-xr-x root shell 5296 2015-08-24 07:03 MtkCodecService -rwxr-xr-x root shell 117224 2015-08-24 07:03 adb -rwxr-xr-x root shell 21772 2015-08-24 07:03 aee -rwxr-xr-x root shell 17676 2015-08-24 07:03 aee_archive -rwxr-xr-x root shell 21908 2015-08-24 07:03 aee_core_forwarder -rwxr-xr-x root shell 34136 2015-08-24 07:03 aee_dumpstate lstat 'system/bin/akmd09911' failed: Permission denied -rwxr-xr-x root shell 34308 2015-08-24 07:03 akmd8963 -rwxr-xr-x root shell 30220 2015-08-24 07:03 akmd8975 -rwxr-xr-x root shell 210 2015-08-24 07:03 am -rwxr-xr-x root shell 30080 2015-08-24 07:03 ami304d lrwxr-xr-x root shell 2015-08-24 07:03 app_process -> app_process32 -rwxr-xr-x root shell 13596 2015-08-24 07:03 app_process32 -rwxr-xr-x root shell 53596 2015-08-24 07:03 applypatch -rwxr-xr-x root shell 13596 2015-08-24 07:03 applysig -rwxr-xr-x root shell 213 2015-08-24 07:03 appops -rwxr-xr-x root shell 215 2015-08-24 07:03 appwidget -rwxr-xr-x root shell 44640 2015-08-24 07:03 atci_service -rwxr-xr-x root shell 37896 2015-08-24 07:03 atcid -rwxr-xr-x root shell 22004 2015-08-24 07:03 atrace -rwxr-xr-x root shell 71116 2015-08-24 07:03 audiocmdservice_atci -rwxr-xr-x root shell 21732 2015-08-24 07:03 autokd -rwxr-xr-x root shell 17688 2015-08-24 07:03 badblocks -rwxr-xr-x root shell 9392 2015-08-24 07:03 batterywarning -rwxr-xr-x root shell 13620 2016-01-03 23:50 bcc -rwxr-xr-x root shell 9512 2015-08-24 07:03 blkid -rwxr-xr-x root shell 51344 2015-08-24 07:03 bmc156d -rwxr-xr-x root shell 199 2015-08-24 07:03 bmgr -rwxr-xr-x root shell 63816 2015-08-24 07:03 bmm050d -rwxr-xr-x root shell 81512 2015-08-24 07:03 bmx056d -rwxr-xr-x root shell 5348 2015-08-24 07:03 boot_logo_updater -rwxr-xr-x root shell 38372 2015-08-24 07:03 bootanimation -rwxr-xr-x root shell 22372 2015-08-24 07:03 btconfig -rwxr-xr-x root shell 5416 2015-08-24 07:03 btlogmask -rwxr-xr-x root shell 156 2015-08-24 07:03 bu -rwxr-xr-x root shell 5348 2015-08-24 07:03 bugreport lrwxr-xr-x root shell 2015-08-24 07:03 cat -> toolbox -rwxr-xr-x root shell 95360 2015-08-24 07:03 ccci_fsd -rwxr-xr-x root shell 62764 2015-08-24 07:03 ccci_mdinit lrwxr-xr-x root shell 2015-08-24 07:03 chcon -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 chmod -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 chown -> toolbox -rwxr-xr-x root shell 34284 2015-08-24 07:03 clatd lrwxr-xr-x root shell 2015-08-24 07:03 clear -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 cmp -> toolbox -rwxr-xr-x root shell 207 2015-08-24 07:03 content lrwxr-xr-x root shell 2015-08-24 07:03 cp -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 dalvikvm -> dalvikvm32 -rwxr-xr-x root shell 9444 2015-08-24 07:03 dalvikvm32 lrwxr-xr-x root shell 2015-08-24 07:03 date -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 dd -> toolbox -rwxr-xr-x root shell 158796 2015-08-24 07:03 debuggerd -rwxr-xr-x root shell 79180 2015-08-24 07:03 dex2oat lrwxr-xr-x root shell 2015-08-24 07:03 df -> toolbox -rwxr-xr-x root shell 116280 2015-08-24 07:03 dhcp6c -rwxr-xr-x root shell 13540 2015-08-24 07:03 dhcp6ctl -rwxr-xr-x root shell 107904 2015-08-24 07:03 dhcp6s -rwxr-xr-x root shell 71072 2015-08-24 07:03 dhcpcd lstat 'system/bin/dm_agent_binder' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 dmesg -> toolbox -rwxr-xr-x root shell 5296 2015-08-24 07:03 dmlog -rwxr-xr-x root shell 109904 2015-08-24 07:03 dnsmasq -rwxr-xr-x root shell 112220 2015-08-24 07:03 downloader -rwxr-xr-x root shell 156 2015-08-24 07:03 dpm -rwxr-xr-x root shell 91420 2015-08-24 07:03 drmserver lrwxr-xr-x root shell 2015-08-24 07:03 du -> toolbox -rwxr-xr-x root shell 127972 2015-08-24 07:03 dualmdlogger -rwxr-xr-x root shell 42276 2015-08-24 07:03 dumpstate -rwxr-xr-x root shell 9444 2015-08-24 07:03 dumpsys -rwxr-xr-x root shell 150432 2015-08-24 07:03 e2fsck -rwxr-xr-x root shell 50992 2015-08-24 07:03 em_svr -rwxr-xr-x root shell 148364 2015-08-24 07:03 emdlogger1 lstat 'system/bin/epdg_wod' failed: Permission denied -rwxr-xr-x root shell 1139560 2016-01-03 23:50 factory -rwxr-xr-x root shell 21912 2015-08-24 07:03 fotabinder -rwxr-xr-x root shell 38172 2015-08-24 07:03 fsck_msdos -rwxr-xr-x root shell 46504 2015-08-24 07:03 fsck_msdos_mtk -rwxr-xr-x root shell 22260 2015-08-24 07:03 geomagneticd lrwxr-xr-x root shell 2015-08-24 07:03 getenforce -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 getevent -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 getprop -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 getsebool -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 grep -> toolbox -rwxr-xr-x root shell 70392 2015-08-24 07:03 gsm0710muxd -rwxr-xr-x root shell 70392 2015-08-24 07:03 gsm0710muxdmd2 lstat 'system/bin/guiext-server' failed: Permission denied -rwxr-xr-x root shell 9444 2015-08-24 07:03 gzip -rwxr-xr-x root shell 128572 2015-08-24 07:03 gzip_static -rwxr-xr-x root shell 58872 2015-08-24 07:03 halutil lrwxr-xr-x root shell 2015-08-24 07:03 hd -> toolbox -rwxr-xr-x root shell 371596 2015-08-24 07:03 hostapd -rwxr-xr-x root shell 30252 2015-08-24 07:03 hostapd_cli lrwxr-xr-x root shell 2015-08-24 07:03 id -> toolbox -rwxr-xr-x root shell 21788 2015-08-24 07:03 idmap lrwxr-xr-x root shell 2015-08-24 07:03 ifconfig -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 iftop -> toolbox -rwxr-xr-x root shell 194 2015-08-24 07:03 ime -rwxr-xr-x root shell 201 2015-08-24 07:03 input lrwxr-xr-x root shell 2015-08-24 07:03 insmod -> toolbox lstat 'system/bin/install-recovery.sh' failed: Permission denied -rwxr-xr-x root shell 42532 2015-08-24 07:03 installd lrwxr-xr-x root shell 2015-08-24 07:03 ioctl -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 ionice -> toolbox -rwxr-xr-x root shell 165488 2015-08-24 07:03 ip -rwxr-xr-x root shell 228908 2015-08-24 07:03 ip6tables -rwxr-xr-x root shell 224648 2015-08-24 07:03 iptables -rwxr-xr-x root shell 42448 2016-01-03 23:15 keystore lrwxr-xr-x root shell 2015-08-24 07:03 kill -> toolbox -rwxr-xr-x root shell 17712 2015-08-24 07:03 kpoc_charger -rwxr-xr-x root shell 9444 2015-08-24 07:03 lcdc_screen_cap -rwxr-xr-x root shell 93891 2015-08-24 07:03 linker -rwxr-xr-x root shell 13592 2015-08-24 07:03 lmkd lrwxr-xr-x root shell 2015-08-24 07:03 ln -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 load_policy -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 log -> toolbox -rwxr-xr-x root shell 17688 2015-08-24 07:03 logcat -rwxr-xr-x root shell 34120 2015-08-24 07:03 logd -rwxr-xr-x root shell 13620 2015-08-24 07:03 logwrapper lrwxr-xr-x root shell 2015-08-24 07:03 ls -> toolbox -rwxr-xr-x root shell 30096 2015-08-24 07:03 lsm303md lrwxr-xr-x root shell 2015-08-24 07:03 lsmod -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 lsof -> toolbox -rwxr-xr-x root shell 26000 2015-08-24 07:03 magd -rwxr-xr-x root shell 13652 2015-08-24 07:03 make_ext4fs -rwxr-xr-x root shell 5356 2015-08-24 07:03 matv -rwxr-xr-x root shell 30540 2015-08-24 07:03 mc6420d lrwxr-xr-x root shell 2015-08-24 07:03 md5 -> toolbox lstat 'system/bin/md_ctrl' failed: Permission denied -rwxr-xr-x root shell 115628 2015-08-24 07:03 mdlogger -rwxr-xr-x root shell 399068 2016-01-03 23:50 mdnsd -rwxr-xr-x root shell 210 2015-08-24 07:03 media -rwxr-xr-x root shell 13548 2015-08-24 07:03 mediaserver -rwxr-xr-x root shell 5296 2015-08-24 07:03 memorydumper -rwxr-xr-x root shell 17952 2015-08-24 07:03 memsicd -rwxr-xr-x root shell 22056 2015-08-24 07:03 memsicd3416x lstat 'system/bin/meta_tst' failed: Permission denied -rwxr-xr-x root shell 116272 2015-08-24 07:03 mfv_ut lrwxr-xr-x root shell 2015-08-24 07:03 mkdir -> toolbox -rwxr-xr-x root shell 46400 2015-08-24 07:03 mke2fs lrwxr-xr-x root shell 2015-08-24 07:03 mknod -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 mkswap -> toolbox -rwxr-xr-x root shell 47468 2015-08-24 07:03 mobile_log_d -rwxr-xr-x root shell 217 2015-08-24 07:03 monkey lrwxr-xr-x root shell 2015-08-24 07:03 mount -> toolbox -rwxr-xr-x root shell 5368 2015-08-24 07:03 msensord -rwxr-xr-x root shell 1378888 2015-08-24 07:03 mtk_agpsd -rwxr-xr-x root shell 5348 2015-08-24 07:03 mtk_setprop -rwxr-xr-x root shell 1099964 2016-01-03 23:50 mtkbt -rwxr-xr-x root shell 9536 2015-08-24 07:03 mtkrild -rwxr-xr-x root shell 9536 2015-08-24 07:03 mtkrildmd2 -rwxr-xr-x root shell 17852 2015-08-24 07:03 mtpd -rwxr-xr-x root shell 17032 2015-08-24 07:03 muxreport lrwxr-xr-x root shell 2015-08-24 07:03 mv -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 nandread -> toolbox -rwxr-xr-x root shell 9472 2016-01-03 23:50 ndc -rwxr-s--- root inet 5464 2015-08-24 07:03 netcfg lstat 'system/bin/netd' failed: Permission denied -rwxr-xr-x root shell 38316 2015-08-24 07:03 netdiag lrwxr-xr-x root shell 2015-08-24 07:03 netstat -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 newfs_msdos -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 nohup -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 notify -> toolbox -rwxr-xr-x root shell 21812 2015-08-24 07:03 nvram_agent_binder -rwxr-xr-x root shell 17688 2015-08-24 07:03 nvram_backup_binder -rwxr-xr-x root shell 13768 2015-08-24 07:03 nvram_daemon -rwxr-xr-x root shell 83308 2015-08-24 07:03 oatdump -rwxr-xr-x root shell 14724 2015-08-24 07:03 orientationd -rwxr-xr-x root shell 50456 2015-08-24 07:03 patchoat -rwxr-xr-x root shell 9392 2015-08-24 07:03 perf_native_test lstat 'system/bin/permission_check' failed: Permission denied -rwxr-xr-x root root 26068 2015-08-24 07:03 ping -rwxr-xr-x root shell 30428 2015-08-24 07:03 ping6 -rwxr-xr-x root shell 191 2015-08-24 07:03 pm -rwxr-xr-x root shell 17696 2015-08-24 07:03 ppl_agent -rwxr-xr-x root shell 141864 2015-08-24 07:03 pppd -rwxr-xr-x root shell 146128 2015-08-24 07:03 pppd_btdun lstat 'system/bin/pppd_dt' failed: Permission denied -rwxr-xr-x root shell 5404 2015-08-24 07:03 pq lrwxr-xr-x root shell 2015-08-24 07:03 printenv -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 prlimit -> toolbox lstat 'system/bin/program_binary_service' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 ps -> toolbox -rwxr-xr-x root shell 162708 2015-08-24 07:03 racoon -rwxr-xr-x root shell 55500 2015-08-24 07:03 radvd lrwxr-xr-x root shell 2015-08-24 07:03 readlink -> toolbox -rwxr-xr-x root shell 5296 2015-08-24 07:03 reboot -rwxr-xr-x root shell 597856 2015-08-24 07:03 recovery lrwxr-xr-x root shell 2015-08-24 07:03 renice -> toolbox -rwxr-xr-x root shell 188 2015-08-24 07:03 requestsync -rwxr-xr-x root shell 34020 2015-08-24 07:03 resize2fs -rwxr-xr-x root shell 5348 2015-08-24 07:03 resize_ext4 lrwxr-xr-x root shell 2015-08-24 07:03 restorecon -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 rm -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 rmdir -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 rmmod -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 route -> toolbox -rwxr-xr-x root shell 13580 2015-08-24 07:03 rtt -rwxr-x--- root shell 9444 2015-08-24 07:03 run-as lrwxr-xr-x root shell 2015-08-24 07:03 runcon -> toolbox -rwxr-xr-x root shell 26024 2015-08-24 07:03 s62xd lstat 'system/bin/sbchk' failed: Permission denied -rwxr-xr-x root shell 5296 2015-08-24 07:03 schedtest lrwxr-xr-x root shell 2015-08-24 07:03 schedtop -> toolbox -rwxr-xr-x root shell 9392 2015-08-24 07:03 screencap -rwxr-xr-x root shell 95664 2015-08-24 07:03 screenrecord -rwxr-xr-x root shell 25828 2015-08-24 07:03 sdcard lrwxr-xr-x root shell 2015-08-24 07:03 sendevent -> toolbox -rwxr-xr-x root shell 5296 2015-08-24 07:03 sensorservice -rwxr-xr-x root shell 9444 2015-08-24 07:03 service lstat 'system/bin/servicemanager' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 setenforce -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 setprop -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 setsebool -> toolbox -rwxr-xr-x root shell 178 2015-08-24 07:03 settings -rwxr-xr-x root shell 157412 2015-08-24 07:03 sh lrwxr-xr-x root shell 2015-08-24 07:03 sleep -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 smd -> toolbox -rwxr-xr-x root shell 5356 2015-08-24 07:03 sn lrwxr-xr-x root shell 2015-08-24 07:03 start -> toolbox -rwxr-xr-x root shell 18632 2015-08-24 07:03 stkgesd lrwxr-xr-x root shell 2015-08-24 07:03 stop -> toolbox -rwxr-xr-x root shell 34076 2015-08-24 07:03 superumount lstat 'system/bin/surfaceflinger' failed: Permission denied -rwxr-xr-x root shell 192 2015-08-24 07:03 svc lrwxr-xr-x root shell 2015-08-24 07:03 swapoff -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 swapon -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 sync -> toolbox -rwxr-xr-x root shell 62992 2015-08-24 07:03 tc lstat 'system/bin/terservice' failed: Permission denied -rwxr-xr-x root shell 5372 2015-08-24 07:03 tertestclient -rwxr-xr-x root shell 14040 2015-08-24 07:03 thermal -rwxr-xr-x root shell 9684 2015-08-24 07:03 thermal_manager -rwxr-xr-x root shell 9452 2015-08-24 07:03 thermald -rwxr-xr-x root shell 5348 2015-08-24 07:03 tiny_fallocate -rwxr-xr-x root shell 5348 2015-08-24 07:03 tiny_mkswap -rwxr-xr-x root shell 5348 2015-08-24 07:03 tiny_swapoff -rwxr-xr-x root shell 5348 2015-08-24 07:03 tiny_swapon -rwxr-xr-x root shell 150776 2015-08-24 07:03 toolbox lrwxr-xr-x root shell 2015-08-24 07:03 top -> toolbox lrwxr-xr-x root shell 2015-08-24 07:03 touch -> toolbox -rwxr-xr-x root shell 34096 2015-08-24 07:03 tune2fs -rwxr-xr-x root shell 3814 2015-08-24 07:03 uiautomator lrwxr-xr-x root shell 2015-08-24 07:03 umount -> toolbox lstat 'system/bin/uncrypt' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 uptime -> toolbox lstat 'system/bin/vdc' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 vmstat -> toolbox lstat 'system/bin/vold' failed: Permission denied lrwxr-xr-x root shell 2015-08-24 07:03 watchprops -> toolbox -rwxr-xr-x root shell 13540 2015-08-24 07:03 wifi2agps lrwxr-xr-x root shell 2015-08-24 07:03 wipe -> toolbox -rwxr-xr-x root shell 190 2015-08-24 07:03 wm -rwxr-xr-x root shell 9440 2015-08-24 07:03 wmt_loader -rwxr-xr-x root shell 66240 2015-08-24 07:03 wpa_cli -rwxr-xr-x root shell 1031408 2015-08-24 07:03 wpa_supplicant -rwxr-xr-x root shell 9508 2015-08-24 07:03 xlog
what is PATH
shell@hct6735m_35gu_l:/ $ echo $PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
check it
shell@hct6735m_35gu_l:/ $ ls -l /sbin opendir failed, Permission denied 1|shell@hct6735m_35gu_l:/ $ ls -l /vendor/bin /vendor/bin: No such file or directory 1|shell@hct6735m_35gu_l:/ $ ls -l /system/sbin /system/sbin: No such file or directory
aliases
127|shell@hct6735m_35gu_l:/ $ alias autoload='typeset -fu' functions='typeset -f' hash='alias -t' history='fc -l' integer='typeset -i' l=ls la='l -a' ll='l -l' lo='l -a -l' local=typeset login='exec login' nameref='typeset -n' nohup='nohup ' r='fc -e -' source='PATH=$PATH:. command .' type='whence -v' environment- shell@hct6735m_35gu_l:/ $ printenv _=/system/bin/printenv ANDROID_DATA=/data MKSH=/system/bin/sh LOOP_MOUNTPOINT=/mnt/obb USBOTG_STORAGE=/storage/usbotg HOME=/data USER=shell ANDROID_ROOT=/system TERM=vt100 SHELL=/system/bin/sh ANDROID_BOOTLOGO=1 ANDROID_ASSETS=/system/app BOOTCLASSPATH=/system/framework/core-libart.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/apache-xml.jar:/system/framework/mediatek-common.jar:/system/framework/mediatek-framework.jar:/system/framework/mediatek-telephony-common.jar ASEC_MOUNTPOINT=/mnt/asec ANDROID_SOCKET_adbd=10 HOSTNAME=hct6735m_35gu_l EXTERNAL_STORAGE=/storage/sdcard0 ANDROID_STORAGE=/storage PATH=/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin SYSTEMSERVERCLASSPATH=/system/framework/services.jar:/system/framework/ethernet-service.jar:/system/framework/wifi-service.jar ANDROID_PROPERTY_WORKSPACE=8,0
disk size
shell@hct6735m_35gu_l:/ $ df Filesystem Size Used Free Blksize /dev 464.9M 68.0K 464.8M 4096 /sys/fs/cgroup 464.9M 12.0K 464.9M 4096 /mnt/asec 464.9M 0.0K 464.9M 4096 /mnt/obb 464.9M 0.0K 464.9M 4096 /mnt/media_rw 464.9M 0.0K 464.9M 4096 /storage/usbotg 464.9M 0.0K 464.9M 4096 /system 1.5G 916.2M 571.6M 4096 /data 5.0G 1.2G 3.8G 4096 /cache 387.4M 1.6M 385.9M 4096 /protect_f 5.8M 60.0K 5.8M 4096 /protect_s 5.8M 56.0K 5.8M 4096 /nvdata 27.5M 2.2M 25.3M 4096 /mnt/cd-rom 1.2M 1.2M 0.0K 2048 /storage/sdcard0 5.0G 1.2G 3.8G 4096
next XXX
2016-02-25: usb debugging - what can I find out? I connect the X12 to my laptop (z30b), allow usb debugging and see this device:
[tingo@localhost ~]$ adb devices List of devices attached 0123456789ABCDEF device
reboot into bootloader
[tingo@localhost ~]$ adb reboot-bootloader
(on X12 screen --2=> FASTBOOT mode...")
[tingo@localhost ~]$ sudo fastboot devices 0123456789ABCDEF fastboot
unlock the bootloader
[tingo@localhost ~]$ sudo fastboot oem unlock OKAY [ 4.863s] finished. total time: 4.863s
on the X12 I pressed volume down.
get all variables:
[tingo@localhost ~]$ sudo fastboot getvar all (bootloader) max-download-size: 0x8000000 (bootloader) partition-size:flashinfo: 1000000 (bootloader) partition-type:flashinfo: raw data (bootloader) partition-size:userdata: 32000000 (bootloader) partition-type:userdata: ext4 (bootloader) partition-size:cache: 19000000 (bootloader) partition-type:cache: ext4 (bootloader) partition-size:system: 60000000 (bootloader) partition-type:system: ext4 (bootloader) partition-size:metadata: 2500000 (bootloader) partition-type:metadata: raw data (bootloader) partition-size:nvdata: 2000000 (bootloader) partition-type:nvdata: ext4 (bootloader) partition-size:frp: 100000 (bootloader) partition-type:frp: raw data (bootloader) partition-size:tee2: 500000 (bootloader) partition-type:tee2: raw data (bootloader) partition-size:tee1: 500000 (bootloader) partition-type:tee1: raw data (bootloader) partition-size:keystore: 800000 (bootloader) partition-type:keystore: raw data (bootloader) partition-size:secro: 600000 (bootloader) partition-type:secro: raw data (bootloader) partition-size:oemkeystore: 200000 (bootloader) partition-type:oemkeystore: raw data (bootloader) partition-size:seccfg: 80000 (bootloader) partition-type:seccfg: raw data (bootloader) partition-size:expdb: a00000 (bootloader) partition-type:expdb: raw data (bootloader) partition-size:logo: 800000 (bootloader) partition-type:logo: raw data (bootloader) partition-size:recovery: 1000000 (bootloader) partition-type:recovery: raw data (bootloader) partition-size:boot: 1000000 (bootloader) partition-type:boot: raw data (bootloader) partition-size:para: 80000 (bootloader) partition-type:para: raw data (bootloader) partition-size:lk: 80000 (bootloader) partition-type:lk: raw data (bootloader) partition-size:protect2: a00000 (bootloader) partition-type:protect2: ext4 (bootloader) partition-size:protect1: a00000 (bootloader) partition-type:protect1: ext4 (bootloader) partition-size:nvram: 500000 (bootloader) partition-type:nvram: raw data (bootloader) partition-size:proinfo: 300000 (bootloader) partition-type:proinfo: raw data (bootloader) partition-size:preloader: 40000 (bootloader) partition-type:preloader: raw data (bootloader) off-mode-charge: 1 (bootloader) warranty: yes (bootloader) unlocked: no (bootloader) secure: yes (bootloader) kernel: lk (bootloader) product: HCT6735M_35GU_L (bootloader) version: 0.5 all: Done!! finished. total time: 0.005s
that worked.
backup
[tingo@localhost backups]$ adb backup -all Now unlock your device and confirm the backup operation.
created a file "backup.ab"
[tingo@localhost backups]$ ll -h total 26M drwxrwxr-x. 2 tingo tingo 4.0K Feb 25 21:53 ./ drwxrwxr-x. 3 tingo tingo 4.0K Feb 25 21:52 ../ -rw-r-----. 1 tingo tingo 26M Feb 25 21:55 backup.ab [tingo@localhost backups]$ file b* backup.ab: data
ok, not much help there.
2016-02-24: try to root the X12. Download Towelroot with the browser on the phone, Start install from Downloads (enable unknown sources). after install disable unknown sources again. When I try Towelroot, it just says "This phone isn't currently supported". Next, try Kingo Root - it only gave me an error message, not root. Uninstalled via ES File Explorer. Then iRoot, which says "Root failed!". Uninstalled from Settings, Apps.
2016-01-03: Wireless update (on the Settings, About phone screen) - I start it it is "FOTA", Current is R16, I press "Check for updates", it checks and says that R17, 27.66 MB, release date 2015-09-09 is available. Description is:
1.Optimize some functions of system 2.Fix some bugs"
I press "Download" it downloads, I press "Update now", it warns that the update will monopolize the phone (it won't do anything else during update), I press "OK", it unzips package, reboots into recovery and installs ("installing system update") which takes a while, reboots, and I get "Android is upgrading" (85 apps) message. Back in Android I get "Update hint" "Installation Successful". Settings - about phone. still Android 5.1, Baseband version is now MOLY.LR9.W1444.MD.LWTG.MP.V8.P30, Kernel version is now 3.10.65+, release05@ubuntu #1, Tue Sep 8 22:12:48 CST 2015. Build number R17. I do Wireless update, Check for updates again - now R18, 13.25 MB, release date 2015-09-16 is available. So I download and install that too. Build R18 has Baseband version MOLY.LR9.W1444.MD.LWTG.MP.V8.P30, 2015/09/16 16:19 Kernel version 3.10.65+, release05@ubuntu #1, Wed Sep 16 16:38:12 CST 2015. another Wireless update - now R19, 19.11 MB, I install that too. Build R19 has Baseband version MOLY.LR9.W1444.MD.LWTG.MP.V8.P31, 2015/09/12 15:30, Kernel version 3.10.65+, release05@ubuntu #1, Wed Sep 22 15:47:54 CST 2015. I check Wireless update again - now my phone is up to date.
2016-01-03: Settings - about phone. Model X12, Android 5.1, Baseband version MOLY.LR9.W1444.MD.LWTG.MP.V8.P26.T1, 2015/08/24 12:59. Kernel version 3.10.65+, release05@ubuntu #1, Mon aug 24 13:17:42 CST 2015. Build number R16.
2016-01-03: Settings - this phone comes with Developer options activated (is that standard for Android 5.1?)
2016-01-03: first start. I power on the phone with the power button on the right side. Battery level is above 50%. English (United States) is already selected, Next is "Insert SIM cards" I skip that for now. Next "Select Wi-Fi network", I connect to kg4 for now. It the goes checking for updates. Next is "Add your account" - I create a new Google account, set password, add my phone number and agree to terms. Next it wants me to add a credit card - sorry, I won't do that, so I select "remind me later". Next "Protect your phone" - it is "set screen lock now", but I skip that, it warns me that device protection features will not be activated, I select "skip anyway". Next "Google services", back up: on, Google location: off, Help improve location: off, Help improve your Android experience: off, Keep me up to date: off (all of then was "on". That was it, I get the "Welcome" screen and is in Android 5.1.
2016-01-03: setting up. Getting the back cover off the phone is a bit scary at first; there is a small gap at the lower right corner (lower left corner if the back is facing you) just behind the screen. Use that for leverage - the whole back case (including buttons and IR LED) comes off. At the top of the battery compartment is (from left to right) microSD, SIM1, SIM2 slots. I just insert the battery (snug fit) now and put the back cover on.
2016-01-03: unpacking. The box is a "standard" light brown cardboard box with a slide-off cover. Sliding off the cover and removing the top part (lid) reveals the phone in a top drawer. Taking out the phone reveals a sheet with stickers; one large with "CUBOT" "X12" and the IMEI written on it and three smaller ones labeled "A", "B" and "C", also with IMEI on them. Taking out the top drawer from the box reveals a quick start guide, a screen protector, a battery (serial: CUBASP00000258022), a charger (AC power adapter, output 5 VDC 1A) and a usb A to micro-USB cable. The quick start guide is just an introduction to using Android. When I unwrap the phone from the plastic, I realize that it comes with a transparent, soft back case as well. Nice!
2015-12-07: I got a pick note in my (physical) mailbox, and picked up the package at my local PIB (Rimi Trondheimsveien) in the evening.
2015-12-01: tracking showed that the phone was shipped from the Netherlands.
2015-11-15: I got a "shipped" notice with a tracking number. It also mentioned that flat rate shipping "should normally take 10-25 business days to arrive (approximately)".
2015-11-12: I ordered a Cubot X12 (SKU 132074303) mobile phone from GearBest, with standard (flat rate) shipping for USD 60.82.