Difference between revisions of "Android"

From HyperSecurity Wiki
Jump to: navigation, search
(Back up of a single partition (tar = only files and folders))
(Back up of a single partition (tar = only files and folders))
Line 43: Line 43:
  
  
== Back up of a single partition (tar = only files and folders) ==
 
  
In this case, you need the partition mounted. To see the list of mounted partitions type on Terminal
+
== Back up of the whole memory block (via adb) ==
Code:
 
  
adb shell mount
+
Connect the phone in ADB mode and unlock the screen.
 
+
Open one Cygwin Terminal and enter (replace mmcblk0 if needed):
Now you need to know where is mounted the partition you want to backup, for example the firmware is mounted on /system, which is the ROM.
 
In this case you will have to open three terminals, because of android limitations:
 
 
 
Open one terminal and create a fifo, in /cache, for example, and redirect the tar there
 
 
Code:
 
Code:
  
Line 59: Line 53:
 
  adb shell
 
  adb shell
 
  su
 
  su
  /system/xbin/busybox mkfifo /cache/myfifo
+
  /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
/system/xbin/busybox tar -cvf /cache/myfifo /system
 
  
We have to do it this way because redirecting the tar to stdout (with - ) is broken on android and will corrupt the tar file.
+
You will see the cursor blinking at the left. Now the phone is waiting to send the block over the network.
 
 
Open a second terminal and type:
 
Code:
 
 
 
adb forward tcp:5555 tcp:5555
 
adb shell
 
su
 
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox cat /cache/myfifo
 
  
Open a third terminal and type:
+
Open another Cygwin terminal and type:
 
Code:
 
Code:
  
 
  adb forward tcp:5555 tcp:5555
 
  adb forward tcp:5555 tcp:5555
 
  cd /path/to/store/the/backup
 
  cd /path/to/store/the/backup
  nc 127.0.0.1 5555 | pv -i 0.5 > system.tar
+
  nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw
  
You can browse the tar file with Winrar, Total Commander, PeaZip and almost any compression tool. Note that you shouldn't extract files or edit it since the tar format saves the permission and owner data for each file, that is lost when extracted to FAT / NTFS partitions and you will mess things when restoring.
+
You will see how the image size is growing until it finishes. Now you have the whole phone backed up in raw format. You can see the contents of the GPT partition with gptfdisk tool, available for windows, linux and such. See official website and sourceforge to get it. You can do it the same from ClockWorkMod Recovery but you have to mount first the /system partition since the busybox included with clockworkmod does not come with netcat and you have to use the one from the system partition.
 +
With further linux tools you could edit or extract single partitions from the whole block.

Revision as of 20:37, 3 June 2015

SDK Setup

http://xmodulo.com/how-to-run-android-emulator-on-ubuntu-or-debian.html

CID

CID would appear to stand for 'Country ID' - but LTE users have found flashing a different number CID firmware (than their original) broke network support. More here.
CID6 = XT1031 - CDMA (Republic Wireless US)
CID7 = XT1032 - European Global GSM (Single-SIM) or XT1033 - Retail Asia (Dual-SIM) 
CID9 = XT1031 - CDMA (Boost US) or XT1032 - Retail US Global GSM or XT1034 - Retail US AWS
CID12 = XT1032 - Latin America / Brazil Global GSM (Single-SIM) or XT1033 - Latin America / Brazil Global GSM (Dual-SIM) 
CID14 = XT1034 - Retail Canada AWS or XT1034 - Bell Canada AWS

IMEI

IMEI=$(cat /proc/config/imei/ascii)
echo 'AT+EGMR=1,14,'"$IMEI" > /dev/pttycmd1

Commands

List all files:

ls -lRa

Remount file system as read/write:

mount -o remount,rw /system

Symbolic Link:

ln -sf /system/efs

Change modes:

chmod 0555 filename

Busybox:

/system/xbin/busybox

Diag Mode:

setprop sys.usb.config diag,adb


Find all mount points:

cd /dev/block/platform/msm_sdcc.1/by-name/
ls -las



Back up of the whole memory block (via adb)

Connect the phone in ADB mode and unlock the screen. Open one Cygwin Terminal and enter (replace mmcblk0 if needed): Code:

adb forward tcp:5555 tcp:5555
adb shell
su
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0

You will see the cursor blinking at the left. Now the phone is waiting to send the block over the network.

Open another Cygwin terminal and type: Code:

adb forward tcp:5555 tcp:5555
cd /path/to/store/the/backup
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.raw

You will see how the image size is growing until it finishes. Now you have the whole phone backed up in raw format. You can see the contents of the GPT partition with gptfdisk tool, available for windows, linux and such. See official website and sourceforge to get it. You can do it the same from ClockWorkMod Recovery but you have to mount first the /system partition since the busybox included with clockworkmod does not come with netcat and you have to use the one from the system partition. With further linux tools you could edit or extract single partitions from the whole block.