Get into fastboot mode without root or hardware buttons

Question

I own a relatively unknown Chinaphone, the CUBOT GT72+ (MTK6572 SoC) - on which I was attempting to gain root access. No known exploit-based root methods exist for this device (which runs on Android 4.4.2), so I found myself having to dissect boot.img using the MTK-Tools Perl-scripts.

After unpacking the boot image, I made some modifications in the initramfs, they are as follows:

• Modify default.prop, setting ro.secure to 0, ro.debuggable to 1, and ro.adb.secure to 0.

• Add the rootsh binary to /sbin.

• Modify init.rc to mount /system as a rw filesystem, since (re)mounting /system is somehow not allowed by the kernel, even when root.

• Replace adbd in /sbin with a version provided by a package called adbd insecure, which was supposed to automatically grant root access to adb-connections.

(Please note: Before replacing adbd I had also installed the su binary in /system/bin and the Superuser.apk package)

Now this is where the problem comes in: the hacked adbd no longer allows me to connect using adb. It shows the device - with an id of 0123456789ABCDEF as offline in the devices listing of adb.

Now, using an adb shell, I could simply get root by typing 'adb shell' followed by a simple 'su', and ta dah: root shell! Yet, somehow, the permissions on the su binary are all messed up - since when I use a terminal emulator on the device itself: I get presented with a 'Permission denied' error. Applications are not getting root, either. (I suppose the permissions are messed up somewhere, chmodding went fine, but chowning did not. Also, busybox is still missing.)

And here's the final problem: the phone does not have a way to get into fastboot mode using hardware buttons, so I found myself having to type 'adb reboot bootloader' to get it into fastboot mode... which, well, obviously doesn't work anymore. And to reflash boot.img I need to get into fastboot mode.

My device does work just fine when turned on (although not rooted), but I really want to reflash boot.img to get the proper adbd back. There is a button combination to get into recovery mode, but that doesn't provide me with a connection in adb. Sideload mode does seem to come up in adb, yet flashing any Update.zip has so far not been succesful (maybe due to a crippled adbd?), even though I have tried various methods of crafting (signed) Update.zip files with the only purpose to reboot the device into fastboot mode.

The device does come with a proprietary flashing tool, but that only works under Windows XP. I do not own any computers running Windows. And especially not XP. (The adb version I run on my computer is the latest provided by Debian (sid), so it should be quite recent.)

Now the question remains: How do I get my device into fastboot mode?

Answer 1

If you've had problems flashing your phone through adb, you should really consider the Windows XP installation route. I've had to look around for some compatible drivers,as I've been experimenting using Windows XP and even Windows 8.1 with success using SP Flash tool. As one of the the answer given before in this thread, you don't need ADB to flash files to your phone SP Flash tools; just the required drivers and connect the phone to the computer with the battery removed.

You could try VMWARElinux to install Windows XP on with with required drivers/ files, etc. I can confirm VMWARE windows allows USB devices to connect to it, including this phone. I've flashed through it with success. Don't know if the Linux version does, though.

After lots of research and headaches I've finally managed to fully root my phone. I've posted my files so you can try it out here:

http://www.needrom.com/download/cubot-gt72-rooted-rom-twrp-recivery/

Best and luck and regards.

Answer 2

Did you properly change adbd permissions?

Look for other files in the same directory with adbd for permissions value. Most probably it will be 644 but be sure.

Note: adb is a service and need to be properly run at start so reboot after changing permissions