25 Dec 2015

Rooting Intel Based Tablets on Linux Slash Mac Os X

In this article I will explain how to root Intel-CPU based android Devices on Linux/Mac OS X. The instructions are based on this forum post. I used this code to root a Medion LIFETAB P8912. However this should also apply to all devices mentioned in this forum post.

The first thing to do, is install fastboot and adb on your PC/Mac. Make sure that you have enabled the development option on your android device and are able to connect to it via adb.

Then place the update, you want to install on the sdcard on your device. In case you want to install the root patch, you can download the latest SuperSU. Note that you will be not able to install custom roms, if your bootloader is locked. If the signature mismatch it will refuse to boot.

The next thing to do is to download and extract IntelAndroid-FBRL-07-24-2015.7z mentioned in the post. It contains a recovery images for CWM or TWRP and some custom trigger code to start a temporary CWM Recovery Session on the device. After reboot this session will be gone. But you can apply updates during the session such as SuperSU. You will not be able to follow the exact instructions from this forum post, because it contains a windows specific batch file and windows executables. However these are just fancy wrappers around adb and fastboot, so you can still use the contained images/launch code.

To reboot your device into the bootloader, connect it to your computer and run, while it is turned on:

$ adb reboot-bootloader

Within the boot loader, we will first put the alternate rescue image on the device along with some custom launcher code. I first tried TWRP on my device, but my touchscreen didn’t work with it, so I sticked to CWM:

# assuming you have changed to the directory of extracted archive:
$ fastboot flash /tmp/recovery.zip FB_RecoveryLauncher/cwm.zip
$ fastboot flash /tmp/recovery.launcher FB_RecoveryLauncher/recovery.launcher

The next thing to do is to trigger the device via fastboot to start our recovery. The forum post contained 4 alternatives approaches based on the android device. The following (T4) was working for me:

$ fastboot oem start_partitioning; fastboot flash /system/bin/logcat FB_RecoveryLauncher/fbrl.trigger; fastboot oem stop_partitioning

This temporary replace logcat with a launcher. It is important to execute all commands in one shot. Otherwise fastboot will fail to flash logcat.

If the command will not work for you, you could one of these commands:

# T1
$ fastboot flash /sbin/adbd FB_RecoveryLauncher/fbrl.trigger; fastboot oem startftm
# T2
$ fastboot flash /system/bin/cp FB_RecoveryLauncher/fbrl.trigger; fastboot oem backup_factory
# T3
$ fastboot flash /sbin/partlink FB_RecoveryLauncher/fbrl.trigger; fastboot oem stop_partitioning

If everything works it should start the recovery image.

Walter pinto 14 Oct 2016

hi, i have a little problem, fastboot said the partion is smaller than the file, even when i try to flash the smaller ones, so i think that /tmp partition doesn't exist, what could i do?

Mic92 14 Oct 2016

I have never seen an android system, where it does not exists actually. You could double check using:

$ cat /proc/mounts

Otherwise fbrl.trigger would be need to rewritten to accept recovery from a different writeable place

Walter pinto 15 Oct 2016

thanks for your answer, i don't have clear where i have to put these line of code, i mean the process is at fastboot mode, i didn't see an shell option from there.

sorry my english

Mic92 15 Oct 2016

it could be done via adb when booting up as usual.

Walter pinto 16 Oct 2016

Does This /tmp partition is unique? I mean, I couldn't flash those file from fastboot, but I could push it from adb, could it work?

Mic92 16 Oct 2016

it purely exists in-memory, which means it will be recreated once you reboot into fastboot.

Walter pinto 22 Oct 2016

$ cat /proc/mounts | grep tmp
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0

-------------------------------------------------------------------------------------------------
and this when i try to flash
------------------------------------------------------------------------------------------------

~/recovery android intel $ fastboot flash /tmp/recovery.zip cwm.zip

(bootloader) /tmp/recovery.zip partition type: raw
target reported max download size of 59768576 bytes
sending '/tmp/recovery.zip' (3623 KB)...
(bootloader) Ready to receive: 0x00389e8f size of data
OKAY [ 0.099s]
writing '/tmp/recovery.zip'...
(bootloader) Flashing partition: /tmp/recovery.zip
FAILED (remote: Download image size is large than partition size)
finished. total time: 0.109s

~/git/blog

Rooting Intel Based Tablets on Linux Slash Mac Os X

Archived comments