Accidentally flashed both rootfs1 and rootfs2 in LX05

[Moha-Master]

AI Translated

Current Problem

Now I'm stuck in uboot because of integrity checks, and neither boot_first or boot_second could work 😭
How can I flash the backup original rootfs in uboot with TTL?
In advance, thank you for any possible answers that may appear❤️

---

Detailed Explanation

To be precise, I'm not using this project directly, but inspired by it, I started exploring ROM customization and flashing on an LX05 device on my own, working together with AI.

This LX05 has partition integrity checks and an unknown root password.
Normally, I keep rootfs1 as the original system and flash my customized system to rootfs2.

The specific workflow:

1. Enter uboot.
2. While ensuring setenv bootcmd 'run setargs_first boot_first' is set, use setenv setargs_first 'setenv bootargs earlyprintk=${earlyprintk} console=${console} root=${first_root} rootwait init=/bin/sh rdinit=/bin/sh loglevel=${loglevel} partitions=${partitions} gpt=${gpt} rotpk_status=${rotpk_status}' to bypass /sbin/init and login, dropping directly into /bin/sh on rootfs1.
3. Mount the internal storage with mount -t ext4 /dev/nand0p9 /data.
4. Write a file /data/ssh_en with content 1 to enable SSH on system boot.
5. Using a script written with the help of an AI, create a directory /tmp/etc_modified and:
   • Modify /tmp/etc_modified/pam.d/common-auth to disable DSA signature verification.
   • Modify /tmp/etc_modified/shadow to set the root password to empty.
   • Modify /tmp/etc_modified/inittab to enable login-free serial console.
   • mount --bind /tmp/etc_modified /etc to replace /etc.
   • exec /sbin/init to proceed with the full boot, giving full functionality including networking, SSH, etc., with the above changes already applied.
6. Save the script to /data/start.sh so it can be re-run as needed, then run source /data/start.sh.
7. Run cat <rootfs_patched>.img | ssh root@192.168.1.5 "dd of=/dev/nand0p5 bs=1024" to flash the customized system image to rootfs2.
8. Run fw_setenv setargs_first 'setenv bootargs earlyprintk=${earlyprintk} console=${console} root=${second_root} rootwait init=${init} rdinit=${rdinit} loglevel=${loglevel} partitions=${partitions} gpt=${gpt} rotpk_status=${rotpk_status}' and fw_setenv bootcmd 'run setargs_first boot_first' to use kernel1 and the modified rootfs2.
   • As the project author mentioned, the integrity check during boot_first only validates kernel1 and rootfs1. rootfs2 is not checked regardless of any modifications.
   • So if you're also tinkering with this, make absolutely sure to keep at least one rootfs as the stock image, otherwise you may run into trouble.

As for the script content if anyone wants:

cat > /data/start.sh << 'EOF'
#!/bin/sh

# 0. Mount basic filesystems
mount -t proc proc /proc 2>/dev/null
mount -t sysfs sys /sys 2>/dev/null
mount -t tmpfs tmpfs /tmp 2>/dev/null

# 1. Copy /etc to tmpfs
cp -a /etc /tmp/etc_modified

# 2. Modify PAM config — bypass DSA signature verification
cat > /tmp/etc_modified/pam.d/common-auth << 'PAMEOF'
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
account [success=1 default=ignore]      pam_unix.so nullok_secure
PAMEOF

# 3. Set root password to empty
cat > /tmp/etc_modified/shadow << 'SHADOWEOF'
root::18128:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
SHADOWEOF

# 4. Modify inittab — give serial console a direct shell, no login required
cat > /tmp/etc_modified/inittab << 'INITEOF'
::sysinit:/etc/init.d/rcS S boot
::shutdown:/etc/init.d/rcS K shutdown
::askconsole:/bin/ash
INITEOF

# 5. bind mount to replace /etc
mount --bind /tmp/etc_modified /etc

# 6. Boot the full system
exec /sbin/init
EOF

chmod +x /data/start.sh

It seems no need to post the terminal output for this problem?

[duhow]

Check if you have loadx or loady commands in U-boot, from there you can send the previous/original rootfs image via serial to RAM, and flash it back to the flash memory position (you need to print and calculate it). Be careful with this process.

[Moha-Master]

Check if you have loadx or loady commands in U-boot, from there you can send the previous/original rootfs image via serial to RAM, and flash it back to the flash memory position (you need to print and calculate it). Be careful with this process.

Thanks for the tip! I do have loadx and loady available in U-Boot. However, I'm not sure how to write the received data back to flash, my sunxi_flash command seems to only support read:

=> help sunxi_flash
sunxi_flash - sunxi_flash sub-system

Usage:
sunxi_flash sunxi_flash read mem_addr part_name [size]

And I found some exposed pads on the board labeled/probed as 5V/GND/DP/DM, which I assume are the USB OTG lines. Would fastboot flash works? And is there any other recovery path you'd recommend?