I got a Samsung Intercept for use with Virgin Mobile USA (on their ridiculous $25/mo plan). It is the "DI06" version. It was sold at Best Buy on November 4, 2010 for about $250.
I'm surprised how useful the web browser is. I'm surprised how fun it is to write Android software. I'm disappointed that the phone app keeps getting slower the longer I own it. I'm disappointed that pressing the "call end button" has no immediate effect during a phonecall. I'm disappointed that there are numerous stupid bugs. I'm delighted to learn that Sprint is providing Virgin Mobile customers with second rate data ("EVDO") service, meaning they have no incentive to cancel my outrageously good deal.
I rooted it with rageagainstthecage. I made the root permanent by replacing /system/bin/playlogos1 with a script that makes a tmpfs and puts a setuid "su" in it. For some reason unknown to me the SuperUser.apk file is also needed.
I compiled and installed busybox. I rebuilt ConnectBot to provide pipe (|) and backtick (`) characters. I ported some of my own apps to it. I compiled and installed dropbear sshd, because my apps happen to use it to sync.
I did not overwrite the recovery image or the kernel because I do not want to brick my device. I did not fix any of the numerous bugs because I did not want to do the "deodex dance" to make it possible to change /system/apps or /system/frameworks.
However, the symptoms of the numerous bugs are becoming more painful to live with. Especially because the phone keeps getting slower. Especially the phone app itself. Probably because google makes it accumulate way too much historical information that it is then inefficient at using? Anyways, in the interests of improving performance and making it possible for me to fix bugs and make improvements at will, I am going to replace the Android parts with something that is not all odexed and proprietary, so I can replace individual components on my own timeline.
This means installing a recovery image so that I can have reasonably good odds of unbricking my device. Also because that appears to be the best way to install a new distribution.
So it looks like I can select a few components: a boot image installer (to flash recovery image/kernel), a recovery image, an android "ROM", and perhaps a kernel.
Users are advised to use some shitty "SWUpdate" utility, but I don't run Windows or really want to deal with the shittiness of it all so I opt for a Linux flashing tool.
There is a flash_image floating around which came from "eclair moment" that is purported to work on the Intercept. It uses BML, while the publicly-available flash_image source code uses MTD. MTD is the standard Linux way of accessing flash. Samsung says they have some new kind of OneNAND flash memory for which MTD is inappropriate, and for that they provide BML. BML is a low-level interface. On top of BML they provide STL which is slightly less low-level but doesn't seem to give any information about the boot partitions, only the filesystem ones. RFS is the filesystem (an optimized journaling VFAT) that runs on top of STL. Anyways, I read a rumor it doesn't work for the recovery image unless you use it to flash the kernel first, which seems assinine and there is enough mud in the water that I simply do not trust it. Anyways, the real stake in its heart is that it doesn't provide a way to make a backup of the old image.
inxane's recovery - Seems to be the only option. Indicates that it has numerous infelicities but apparently it is sufficient to install a hacked update.zip-like file. Appears to be abandonware.
SlapStick Rom v1.4 - Says not to flash from 2.1 so disqualified. It appears to be just a theme, really (it does not seem to provide de-odexed system files, for example).
UbuntDroid 3.0 - I want to dwell for a moment on how stupid UbuntDroid is. And not because it is the worst "ROM" for the Samsung, but rather because it is relatively good. First, the name is simply stupid, because it has nothing at all to do with Ubuntu (it is not a Linux distribution). Second, it is nearly impossible to tell what it is. It is, in fact, a set of Android 2.1 (Eclair) .apk files that have been de-odexed (or never odexed to begin with), combined with a dalvikvm with substantially ?improved? JIT from Android 2.2 (Frozen Yogurt). The combination is commonly known as "Frozen Eclair." You would not be able to find this information in a clear form on their shitty website, even if you happened to stumble upon my post asking for clarification.
On the bright side, UbuntDroid appears to be relatively popular and well-tested, and in fact a de-odexed 2.1 with a faster dalvikvm is nearly exactly what I might ask for. Though in actuality, a mini dpkg-based distribution running parallel to Android 2.2 was what I actually did ask for. But I might still use UbuntDroid.
It is just unfortunate that the Android hacking community is nearly obscured by the mass of noobs who just want to change all of the colors and "make it fast."
p.s., if you think that UbuntDroid is about "the south american philosophy of humanity towards others," keep in mind that really it is in fact about shameless self-promotion.
Frozen Eclair - This is a distribution that appears to be just the new dalvikvm, so it needs your phone to be already de-odexed.
squealjoy v1.5 - audio works, but old?
squealjoy v2.2 - audio delays? but new... tethering
CherryKernel v1.2 - based on KuroOCedKernel, supposedly fixes audio bugs, adds tethering.
SlapKernel v1.1 - built from the Android 2.2 (froyo) repository, has tethering etc.
I'm getting the impression that the various "ROMs" (binary distributions) are crap of the crappiest variety and the only advantage to them is that they're slightly less likely to brick your phone than rolling your own.
So I propose this task list:
Here is what I can tell about the partitions on my phone:
The BML partitions can be read using dd, can they be written with dd too???
Endless research! The "secondary boot loader" supposedly talks Odin ("download mode"). There are utilities that talk Odin, but I'm not sure if they apply to the Intercept. I don't even know if the Intercept's sbl talks Odin.
I'm not sure if I care about Odin, since it is really only a "last ditch" kind of recovery option. However, if I use Odin today to make a dump of the flash then in theory I should always be able to go back to that state!
So I need to odin-dump the existing data before writing anything.
Okay, looking inside the bml4/bml8 images, I see that there is a mystery 2kB header then a zImage. It seems that inxane's recovery.rfs file doesn't contain the header, so it must be automatically generated by flash_image or something.
I'm getting the impression that if you use the built-in recovery image to install an update.zip then it will ultimately run flash_image to perform the work. Or something. So I should be able to get an authoritative flash_image by extracting it from the recovery image.
Someone wrote a script to extract an initramfs from a zImage. It doesn't work. It searches for a gzip header and unzips it to find the kernel, then within that image it searches for another gzip header and assumes the second gzip header is the initramfs. However, the way it is actually encoded appears to be that there are two gzip headers within the bml, rather than a second header within the kernel. There is an initramfs within the kernel image that the script finds, but it contains just /dev/console and /root, nothing of any interest. *shrug*
Here is the braindead script I wrote that successfully extracts both
gzips (the first is the kernel image, the second is the initramfs):
#!/bin/sh pos=`grep -a -b --only-matching $'\x1F\x8B\x08' $1 | cut -f 1 -d :` x=1 for i in $pos do dd if=$1 bs=$i skip=1 | gzip -d -c > part$x x=$((x+1)) done
Then, to unpack the cpio:
cpio -v -i --no-absolute-filenames < part2
The surprising thing I have just learned is that bml4 and bml8 are identical, and contain a recovery.rc. I wonder if this means that the difference between them is in the form of, i.e., a "init=/recovery.rc" on the kernel command line, provided by the sbl?
Oh, and I found that the phone has a /sbin/redbend_ua, which must be the authoritative BML flasher for this phone. Unfortunately redbend_ua uses raw device names instead of symbolic "recovery" and "boot" names, so in order to replace the recovery image I need to be certain I truly know which bml is the recovery partition.
Also note that this phone doesn't seem to have a "PIT" partition (on other Samsung phones, this partition specifies names for the other partitions), which may throw Heimdall for a loop.
I took the flash_image that I have from "eclair moment", and I
disassembled it a little. I found the assembly for
mtd_find_partition_by_name() which is exactly as it is for the mtd-based
flash_image. It uses a table filled in by mtd_scan_partitions(), which
is also similar to mtd-based flash_image. However, it also contains
this code:
sscanf(...); switch(x) { case 0: y="boot1"; case 1: y="boot2"; case 2: y="boot3"; case 3: y="boot"; case 4: y="system"; case 5: y="data"; case 6: y="cache"; case 7: y="recovery"; case 8: y="modem"; case 9: y="efs"; default: ...? }
I think x is the "id" field in /proc/rfs/bmlinfo, and y is probably mtdname. Anyways, it strongly suggests that bml4 is "boot" and bml8 is "recovery", as suspected.
And a promising first start at thorough reverse-engineering, proving I'm oriented.
I still love my LG and I want to tell you why Android is so awesome.
In 2001 I wrote a personal information managament (PIM) suite consisting of a note manager and a checkbook register. It was actually two suites, one for the HP95LX (a DOS-based palmtop), using HP's custom uh "GUI". The other was a set of scripts for my unix machine to allow it to edit the same database. Plus another set of scripts to sync the two.
In 2003 I wrote a GTK version of the suite for my iPAQ h3765, on which I ran Familiar (a debian-like palmtop distro).
From 2003 to 2008 I didn't see the point in buying another palmtop, because the iPAQ was so useless (it never left the house). But in 2009 I bought a Nokia n810 (which sucks, by the way). Even though my suite worked with GTK (which is the basis for Maemo), it took considerable hacking (almost a rewrite) to get it to play nice with the shitty undocumented quirky window manager on the n810.
So now I've written 3 specialized clients for portable devices I no longer use. Bummer.
Along came Android. In 2010 I got a Samsung (which sucks, by the way), and I wrote yet the fourth set of portable clients for my PIM suite. And I carried it around in my pocket for a year -- I used this fourth edition more in that year than I had used all the previous editions put together.
And now I got an LG. And shazam, with no real work, I have my PIM on there. This is the first time a single client has survived two pieces of hardware.
So thanks to Android, I now use my software because it is on my phone which I actually do carry everywhere. And thanks to Android, I don't have to rewrite it every time I buy a new PDA.
Booya