Google Pixel - protocol fault - enable_device_writing

[TheArkive]

I'm on Ubuntu 16.04. All dependencies loaded (according to the script). I had to go out and get 7za, no biggie.

It seemed to almost make it through, but I know the internal structure of the Pixel series is a bit different, so I'm not totally surprised it failed. Any other info you need?

 *** OS: Linux 4.8.0-53-generic (linux)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-j7p3w0_s
 *** Selected device: FA6C30304014
 *** Pulling framework from device...
      DEBUG: 3273 KB/s (16502976 bytes in 4.923s)
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
 *** Disassembling classes...
      DEBUG: Disassembling framework/classes.dex
 *** Patching...
 *** Detected: Android 7.x / Android 6.0.x / CyanogenMod 13-14
 *** Patching succeeded.
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
 *** Recompressing framework...
      DEBUG: Compressing framework.jar
 *** Copying the patched file to the output folder...
 *** Rooting adbd...
      DEBUG: restarting adbd as root
 *** Unlocked ADB: True
 *** Remounting /system...
error: protocol fault (no status)
Traceback (most recent call last):
  File "main.py", line 536, in <module>
    enable_device_writing(SELECTED_DEVICE)
  File "main.py", line 219, in enable_device_writing
    remount_check = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_device, "remount", "/system"]).decode("utf-8")
  File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.5/subprocess.py", line 708, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'FA6C30304014', 'remount', '/system']' returned non-zero exit status 1

Can you add instructions for manual pushing? And perhaps what permissions to set if necessary?

EDIT: Almost forgot this. When I push apps to /system, I have to go here:

/system/system/priv-app

So I think the path needed to push this file back to the Pixel device is:

/system/system/framework/framework.jar

Ironically, when viewing the file system within the OS, you don't see that, but in TWRP it's as clear as day.

Trying it manually in TWRP now.

EDIT (final): It worked!!

I used TWRP to copy the patched framework.jar on my pc (in the "output" folder of this script) into:

/system/system/framework[/framework.jar]

Did chmod 644, pushed gsm_core.apk to /system/system/priv_app and did chmod 644 for the apk. Rebooted and GSM Core reports signature spoofing enabled! Still further testing needed, but we're at the 95% mark on Pixel :-D

Hopefully the script can be updated to fully automate the process as intended!

EDIT: I just got haystack working... only issue was the script didn't wait long enough for remount (device appeared to be unplugged I guess?). Maybe that's the issue in this script a well. On a separate note, within the OS, /system/framework does exist, but under TWRP or bootloader, it's actually /system/system/framework.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/45824226-google-pixel-protocol-fault-enable_device_writing?utm_campaign=plugin&utm_content=tracker%2F43052892&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F43052892&utm_medium=issues&utm_source=github).

[ale5000-git]

@TheArkive: Hi, the problem of /system/system/framework should be easily fixable (when I get some free time).

The strange thing is the problem with adb remount.

Could you please run manually adb root and adb remount when the phone is in TWRP and post the output?

PS: To install microG there is also microG unofficial installer that should already be compatible with Pixel (although not tested).

[TheArkive]

Sure, but the terminal doesn't show much. It just says "successful", even though system is still read only. Was there some other log you are looking for?

On June 12, 2017 2:53:43 PM GMT+02:00, ale5000 notifications@github.com wrote:

@TheArkive: The problem of /system/system/framework should be easily fixable (when I get some free time).

The strange thing is the problem with adb remount.

Could you please run adb remount when the phone is in TWRP and post the output?

-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: https://github.com/ale5000-git/tingle/issues/32#issuecomment-307780473

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

[ale5000-git]

The problem is error: protocol fault (no status) that appear near adb remount, doesn't it appear to you when you run it manually?

[TheArkive]

Sorry man I'm still trying to understand how/where you are seeing that. Here's what I see...

jeb6@MCP6L:~$ adb root restarting adbd as root jeb6@MCP6L:~$ adb remount remount succeeded jeb6@MCP6L:~$

The issue is that for whatever reason it didn't succeed. Do you mean a logcat log entry? Is that where you see an error?

I'm checking logcat now to see if I can find anything like that. Please let me know how/where you see that error so I can attempt a better confirmation of what you are asking for. I wanna help!!

On Tue, Jun 13, 2017 at 12:24 PM, ale5000 notifications@github.com wrote:

The problem is "error: protocol fault (no status)" that appear near "adb remount", doesn't it appear to you when you run it manually?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ale5000-git/tingle/issues/32#issuecomment-308073610, or mute the thread https://github.com/notifications/unsubscribe-auth/ABLBpJd5HlJqQN86bywHmrhU7WlEOb_eks5sDmNCgaJpZM4NuCB3 .

[TheArkive]

The odd thing of course is that despite the favorable looking outcome, it still doesn't work.

Here's what I do know: within the ADB shell, the pixel /system can be mounted like so:

mount -o remount,rw /system

Actually, this might be the "fix" to get this done without needing to change anything in your script, as long as the user has a Terminal emulator on their system.

I'll try this out shortly and let you know what I come up with.

On Tue, Jun 13, 2017 at 6:01 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Sorry man I'm still trying to understand how/where you are seeing that. Here's what I see...

jeb6@MCP6L:~$ adb root restarting adbd as root jeb6@MCP6L:~$ adb remount remount succeeded jeb6@MCP6L:~$

The issue is that for whatever reason it didn't succeed. Do you mean a logcat log entry? Is that where you see an error?

I'm checking logcat now to see if I can find anything like that. Please let me know how/where you see that error so I can attempt a better confirmation of what you are asking for. I wanna help!!

On Tue, Jun 13, 2017 at 12:24 PM, ale5000 notifications@github.com wrote:

The problem is "error: protocol fault (no status)" that appear near "adb remount", doesn't it appear to you when you run it manually?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ale5000-git/tingle/issues/32#issuecomment-308073610, or mute the thread https://github.com/notifications/unsubscribe-auth/ABLBpJd5HlJqQN86bywHmrhU7WlEOb_eks5sDmNCgaJpZM4NuCB3 .

[TheArkive]

Ok man I'm feelin like a bit of a doof. At least on the device, with a terminal emulator, or other app that allows /system to be mounted as RW then your script works fine. It's just an issue with "adb remount" not doing the trick.

Let me know what else you want to test and how. Maybe just update your instructions? This command in a terminal emulator makes your scripts universal:

mount -o remount,rw /system

On Tue, Jun 13, 2017 at 6:09 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

The odd thing of course is that despite the favorable looking outcome, it still doesn't work.

Here's what I do know: within the ADB shell, the pixel /system can be mounted like so:

mount -o remount,rw /system

Actually, this might be the "fix" to get this done without needing to change anything in your script, as long as the user has a Terminal emulator on their system.

I'll try this out shortly and let you know what I come up with.

On Tue, Jun 13, 2017 at 6:01 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Sorry man I'm still trying to understand how/where you are seeing that. Here's what I see...

jeb6@MCP6L:~$ adb root restarting adbd as root jeb6@MCP6L:~$ adb remount remount succeeded jeb6@MCP6L:~$

The issue is that for whatever reason it didn't succeed. Do you mean a logcat log entry? Is that where you see an error?

I'm checking logcat now to see if I can find anything like that. Please let me know how/where you see that error so I can attempt a better confirmation of what you are asking for. I wanna help!!

On Tue, Jun 13, 2017 at 12:24 PM, ale5000 notifications@github.com wrote:

The problem is "error: protocol fault (no status)" that appear near "adb remount", doesn't it appear to you when you run it manually?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ale5000-git/tingle/issues/32#issuecomment-308073610, or mute the thread https://github.com/notifications/unsubscribe-auth/ABLBpJd5HlJqQN86bywHmrhU7WlEOb_eks5sDmNCgaJpZM4NuCB3 .

[TheArkive]

Sorry for the flurry of email...

Just double confirmed in another app (termux - terminal emulator). Last time I used an app that i knew successfully mounted my /system partition as RW, this time i did it in a terminal emulator and it still worked.

I made sure to reboot the phone first and get the usual error when running your script, which is:

adb root restarting adbd as root adb remount remount succeeded adb push sailfishsigspoof-hook-7.0sigspoof-coresigspoof-ui-global-7.0/framework.jar /system/framework/ adb: error: failed to copy 'sailfishsigspoof-hook-7.0sigspoof-coresigspoof-ui-global-7.0/framework.jar' to '/system/framework/framework.jar': remote couldn't create file: Read-only file system sailfishsigspoof-hook-7.0sigspoof-core__sigspoof-ui-global-7.0/framework.jar: 0 files pushed. 211.2 MB/s (2621440 bytes in 0.012s)

Then typed the command:

mount -o remount,rw /system

into Termux, and all is well with your script, no changes necessary.

I'm thinking a tip in the instructions would actually suffice, rather than a rewrite. Apologies once again...

Unless you want to attack this from another angle then I'm up for whatever troubleshooting!

On Tue, Jun 13, 2017 at 6:14 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Ok man I'm feelin like a bit of a doof. At least on the device, with a terminal emulator, or other app that allows /system to be mounted as RW then your script works fine. It's just an issue with "adb remount" not doing the trick.

Let me know what else you want to test and how. Maybe just update your instructions? This command in a terminal emulator makes your scripts universal:

mount -o remount,rw /system

On Tue, Jun 13, 2017 at 6:09 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

The odd thing of course is that despite the favorable looking outcome, it still doesn't work.

Here's what I do know: within the ADB shell, the pixel /system can be mounted like so:

mount -o remount,rw /system

Actually, this might be the "fix" to get this done without needing to change anything in your script, as long as the user has a Terminal emulator on their system.

I'll try this out shortly and let you know what I come up with.

On Tue, Jun 13, 2017 at 6:01 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Sorry man I'm still trying to understand how/where you are seeing that. Here's what I see...

jeb6@MCP6L:~$ adb root restarting adbd as root jeb6@MCP6L:~$ adb remount remount succeeded jeb6@MCP6L:~$

The issue is that for whatever reason it didn't succeed. Do you mean a logcat log entry? Is that where you see an error?

I'm checking logcat now to see if I can find anything like that. Please let me know how/where you see that error so I can attempt a better confirmation of what you are asking for. I wanna help!!

On Tue, Jun 13, 2017 at 12:24 PM, ale5000 notifications@github.com wrote:

The problem is "error: protocol fault (no status)" that appear near "adb remount", doesn't it appear to you when you run it manually?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ale5000-git/tingle/issues/32#issuecomment-308073610, or mute the thread https://github.com/notifications/unsubscribe-auth/ABLBpJd5HlJqQN86bywHmrhU7WlEOb_eks5sDmNCgaJpZM4NuCB3 .

[TheArkive]

Caveat,

Here's my reference:

https://stackoverflow.com/questions/5467881/a-terminal-command-for-a-rooted-android-to-remount-system-as-read-write

Looks like there may be some variations on that command for some systems:

ie.

mount -o rw,remount /system

... and maybe a few others as well. It may be device specific in some cases. oy.

On Tue, Jun 13, 2017 at 6:26 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Sorry for the flurry of email...

Just double confirmed in another app (termux - terminal emulator). Last time I used an app that i knew successfully mounted my /system partition as RW, this time i did it in a terminal emulator and it still worked.

I made sure to reboot the phone first and get the usual error when running your script, which is:

adb root restarting adbd as root adb remount remount succeeded adb push sailfishsigspoof-hook-7.0sigspoof-coresigspoof-ui-global-7.0/framework.jar /system/framework/ adb: error: failed to copy 'sailfishsigspoof-hook-7.0 sigspoof-coresigspoof-ui-global-7.0/framework.jar' to '/system/framework/framework.jar': remote couldn't create file: Read-only file system sailfishsigspoof-hook-7.0sigspoof-core__sigspoof-ui-global-7.0/framework.jar: 0 files pushed. 211.2 MB/s (2621440 bytes in 0.012s)

Then typed the command:

mount -o remount,rw /system

into Termux, and all is well with your script, no changes necessary.

I'm thinking a tip in the instructions would actually suffice, rather than a rewrite. Apologies once again...

Unless you want to attack this from another angle then I'm up for whatever troubleshooting!

On Tue, Jun 13, 2017 at 6:14 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Ok man I'm feelin like a bit of a doof. At least on the device, with a terminal emulator, or other app that allows /system to be mounted as RW then your script works fine. It's just an issue with "adb remount" not doing the trick.

Let me know what else you want to test and how. Maybe just update your instructions? This command in a terminal emulator makes your scripts universal:

mount -o remount,rw /system

On Tue, Jun 13, 2017 at 6:09 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

The odd thing of course is that despite the favorable looking outcome, it still doesn't work.

Here's what I do know: within the ADB shell, the pixel /system can be mounted like so:

mount -o remount,rw /system

Actually, this might be the "fix" to get this done without needing to change anything in your script, as long as the user has a Terminal emulator on their system.

I'll try this out shortly and let you know what I come up with.

On Tue, Jun 13, 2017 at 6:01 PM, Jeb Dude jeremiah.sharier@gmail.com wrote:

Sorry man I'm still trying to understand how/where you are seeing that. Here's what I see...

jeb6@MCP6L:~$ adb root restarting adbd as root jeb6@MCP6L:~$ adb remount remount succeeded jeb6@MCP6L:~$

The issue is that for whatever reason it didn't succeed. Do you mean a logcat log entry? Is that where you see an error?

I'm checking logcat now to see if I can find anything like that. Please let me know how/where you see that error so I can attempt a better confirmation of what you are asking for. I wanna help!!

On Tue, Jun 13, 2017 at 12:24 PM, ale5000 notifications@github.com wrote:

The problem is "error: protocol fault (no status)" that appear near "adb remount", doesn't it appear to you when you run it manually?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ale5000-git/tingle/issues/32#issuecomment-308073610, or mute the thread https://github.com/notifications/unsubscribe-auth/ABLBpJd5HlJqQN86bywHmrhU7WlEOb_eks5sDmNCgaJpZM4NuCB3 .

[ale5000-git]

I already know the problem of remounting on some devices, what I'm looking now is the error: protocol fault (no status); it is in you first log after *** Remounting /system....

I hope to discover what is the cause of the error. Can you please do this and post the result?

• run adb devices and note the device name
• run adb -s [device name] root
• run adb -s [device name] remount /system

[TheArkive]

Sorry it took me so long to get back to you.

Here's the output. I'm afraid it's the same as before.

C:\Windows\System32>adb devices
List of devices attached
* daemon not running. starting it now at tcp:5037 *
* daemon started successfully *
XXXX device

C:\Windows\System32>adb -s XXXX root

C:\Windows\System32>adb -s XXXX remount /system
remount succeeded

C:\Windows\System32>

Any other ideas? If I try the same in Ubuntu, I get the same output. No error of any kind on the command line (for Pixel).

[ale5000-git]

@TheArkive Could you please run this adb shell getprop ro.build.system_root_image and post the result?