1

I had been ignoring low memory on my android phone (Nexus 6P running copperhead OS) for some time.

OS suddenly crashed out of no where and started booting up infinitely. After forcing it to restart and entering the password for decryption, phone never finishes the boot procedure. Seems that due to zero or very less space, some error must be occurring, which doesn't let the OS finish the boot procedure.

It's my assumption that low memory could have been the issue, so trying to find a way to delete files and let OS have some space to boot up.

(1) Bootloader is locked. I can see "Device is LOCKED." at bootloader screen. So, unable to boot latest TWRP via fastboot boot twrp.img. Receiving error FAILED (remote: unlock device to use this command)

(2) ADB sideload option available in copperhead OS recovery doesn't allow any random update.zip. Tried to run an updater script but it fails. It seems that recovery is validating the package. Errors are E: footer is wrong, E: Signature verification failed, E:error: 21 Installation aborted

(3) Tried to find some vulnerabilities which let bypass security features, but didn't find any except this which has been fixed in bootloader angler-03.79 being used.

(4) Phone is running an old android OS : 8.1.0 June 2018 AOSP build, and since then there could be security vulnerabilities being introduced. So are there any vulnerabilities or exploits which can be helpful here?

  • ask copperhead support if they can provide update.zip for wiping app cache – alecxs Jan 26 at 10:08
  • How did you install the Copperhead custom rom without unlocking the bootloader? – Robert Jan 26 at 11:33
  • @alecxs I have asked. Let's see what reply I receive. – Amit Jan 27 at 1:43
  • @Robert Earlier I had the ability for OEM unlocking as stock android was working. I used the official docs to first unlock bootloader and then lock it post installation of copperhead OS. – Amit Jan 27 at 1:44
  • it seems there already exist OEM solution. ask for update recovery mode with new option "Lacking storage booting" forum.xda-developers.com/showthread.php?t=3885938 – alecxs Feb 15 at 10:30
0

You can ask the OEM developers if they can help with an official solution. Problem is the 1st Level Support will always deny such requests. You can request the source code instead (in compliance with the GPL) and if you are lucky you will get direct contact (email address) to any developer this way instead.

OEM could easily provide (signed) emergency-update.zip containing following files

META-INF/com/google/android/updater-script

ifelse(is_mounted("/data"), ui_print("deleting cache files..."), abort("ERROR: Data not mounted"));
package_extract_dir("tmp", "/tmp");
set_perm_recursive(0, 2000, 0755, 0755, "/tmp");
run_program("/tmp/rmcache.sh");
ui_print("done");

tmp/rmcache.sh

#!/bin/sh
/tmp/busybox find /data/data -type d -iname cache -exec /tmp/busybox find {} -type f -print -delete +

tmp/busybox

use the busybox binary (toybox segmentation fault):
www.busybox.net/downloads/binaries/1.31.0-defconfig-multiarch-musl

this would free up storage space by deleting some unimportant cache files only. this way it will neither harm the device nor create vulnerability for exploits

this emergency-update.zip can be applied via the recovery menu's "Apply update from SD card"

after this you should be able to boot at least once and get the availability to immediately enable airplane mode (prevents data usage), usb-debugging (for adb uninstall in case system_server crashes) and backup/clear your Internal Storage via MTP USB (or adb)

| improve this answer | |
  • 1
    Appreciate for providing the updater-script. I have a question here. How updater-script will be able to decrypt the /data. Shouldn't there be a command as well which uses the decryption password to first mount /data and then delete some files? – Amit Feb 1 at 14:40
  • Fortunately, I have received reply from the copperhead, but it suggests towards adb backup which I am unable to figure out. I have tried adb backup -all in recovery mode, but that spits out adb: unable to connect for backup: closed. It should mean, backup is not available. I see only adb sideload <update.zip> to be enabled and a message in recovery mode : Supported API: 3. Among 3 APIs, sideload is one, what could be other two? – Amit Feb 1 at 14:41
  • I have asked for either signed zip or key for signing the zip, as copperhead says Nexus 6P is out of support. Don't know about key unless it is being used somewhere else, but hope to receive at least the signed zip. – Amit Feb 1 at 14:41
  • that's a stupid reply, they should know that adb backup is disabled by default (it requires usb-debugging and authorized RSA-Key). Unfortunately, i don't know how things work for stock recovery. for TWRP, decryption rely on recovery (it will ask you for credentials only if needed). i was assuming recovery does mount /data automatically – alecxs Feb 1 at 15:18
  • for sure they won't leak signing key, that would vulnerable all devices – alecxs Feb 1 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.