Blog on Jhuan Reategui Solis

Blog on Jhuan Reategui Solishttps://chijure.github.io/en/blog/Recent content in Blog on Jhuan Reategui SolisHugoenxray v1: an X-ray of an Android phone before portinghttps://chijure.github.io/en/blog/xray-v1/Thu, 05 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/xray-v1/<p>I buy old phones to port CyanogenMod to them, and each one starts the same way: find out the SoC, the RAM, the kernel, how the partitions are laid out, what the <code>fstab</code> mounts, and whether the flash is eMMC or NAND. I used to do it by hand with <code>adb shell</code>, and every device answered differently. <strong>xray</strong> does that first pass with one command. It is a Go tool, a single binary for Linux, Windows and macOS, under the MIT license. I tried it on 13 devices running Android 2.2 to 4.2.2.</p>Persistent TWRP on the LG Optimus F3 P659H: a new Loki targethttps://chijure.github.io/en/blog/loki-lg-f3-p659h/Wed, 04 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/loki-lg-f3-p659h/<p>The <strong>LG Optimus F3 P659H</strong> (<code>fx3sca</code>, firmware <code>P659h10a</code>) could boot a custom recovery temporarily, but would not accept one in its recovery partition. After writing TWRP directly and running <code>adb reboot recovery</code>, the result was always <strong>“boot certification verify”</strong>. LG’s <a class="gloss" href="https://chijure.github.io/en/glossary/#bootloader" title="The first program that runs when the phone is switched on: it sets up the basics, loads the kernel and hands over to it.">bootloader</a> rejected the installed image before executing its <a class="gloss" href="https://chijure.github.io/en/glossary/#kernel" title="The core of the operating system (Linux on Android): it manages hardware, memory and processes.">kernel</a>.</p>Kernel 3.4 for the LG L3 (E400): from a phone that rebooted itself to CM10.1 with GPS, sensors and camerahttps://chijure.github.io/en/blog/kernel-34-lg-l3/Tue, 03 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/kernel-34-lg-l3/<p>The <strong>LG Optimus L3 (E400)</strong> is a 2012 phone: a Qualcomm <strong>MSM7225A</strong>, a 320x240 screen, 384 MB of RAM (about 299 MB for Android) and a 2.6.38 kernel from the factory. It already ran <a class="gloss" href="https://chijure.github.io/en/glossary/#cm" title="Community ROM built from Android’s open source code, now discontinued (LineageOS continues it). CM7 is Android 2.3 and CM10 is Android 4.1/4.2.">CyanogenMod</a> 7 and 9. I wanted to move it to <strong>CM10.1 (Android 4.2.2)</strong> on a <strong>3.4</strong> <a class="gloss" href="https://chijure.github.io/en/glossary/#kernel" title="The core of the operating system (Linux on Android): it manages hardware, memory and processes.">kernel</a>, like its siblings the L5 and L7. This post tells the path and the failures I had to take apart. It continues the <a href="https://chijure.github.io/en/blog/reboot-at-612-seconds/">612-second reboot</a>, which now has a different ending.</p>The LG G2 Mini doesn't use LK: unlocking a Tegra 4i with nvflashhttps://chijure.github.io/en/blog/nvflash-lg-d625/Tue, 03 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/nvflash-lg-d625/<p>The <a href="https://chijure.github.io/en/blog/mediatek-lk-patch/">L5 II, L4 II and L50</a> share MediaTek’s <a class="gloss" href="https://chijure.github.io/en/glossary/#lk" title="Bootloader used by MediaTek and Qualcomm on Android. It runs after the first-stage loader (on MediaTek, the preloader), brings up the display, draws the logo and loads the kernel.">LK</a> bootloader, so one piece of analysis worked, with adjustments, for all three. The <strong>LG G2 Mini (D625)</strong> is a different family inside: an <strong>NVIDIA Tegra 4i</strong>, with its own low-level recovery mode and its own flashing tool. Nothing learned from the LK carried over as-is.</p>adb over Wi-Fi, and why it drops right when you need it mosthttps://chijure.github.io/en/blog/adb-over-wifi/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/adb-over-wifi/<p>When I test <a class="gloss" href="https://chijure.github.io/en/glossary/#otg" title="On-The-Go: lets a phone act as a USB host to connect flash drives, mice and keyboards, using a special adapter.">USB OTG</a> in <a class="gloss" href="https://chijure.github.io/en/glossary/#host-mode" title="The phone acts as the “PC”: it drives and powers whatever is connected (flash drive, mouse). The opposite is peripheral mode, the usual one when plugged into a PC.">USB host mode</a>, the phone’s USB port stops being useful for <a class="gloss" href="https://chijure.github.io/en/glossary/#adb" title="Android Debug Bridge: a command-line tool to talk to a phone over USB or the network. It copies files, opens a shell and installs apps.">ADB</a>: it’s busy talking to the flash drive or mouse plugged into it. The fix is <code>adb</code> over Wi-Fi:</p>QApp: testing a ROM without guessinghttps://chijure.github.io/en/blog/qapp-testing-without-guessing/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/qapp-testing-without-guessing/<p>Porting a ROM to an old phone comes with a problem that isn’t about software: when something fails, it isn’t always clear whether the ROM is at fault or the hardware itself, worn down by years of use. <strong>QApp</strong> was born to take that doubt out of the equation.</p> <h2 id="the-origin-a-battery-that-couldnt-keep-up">The origin: a battery that couldn’t keep up</h2> <p>The first version was written for the LG D625, while investigating a reboot that looked like a ROM bug. The battery test measures the idle voltage, puts the CPU and GPU under load for thirty seconds, and measures how far it drops. A healthy battery drops little and recovers fast; a worn one drops a lot and takes a while to come back. That measurement let me rule out the kernel as the cause and confirm the battery was the culprit, without opening the phone or buying a replacement to test.</p>Screenshotting Android 2.3 without screencaphttps://chijure.github.io/en/blog/gingerbread-screen-capture/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/gingerbread-screen-capture/<p><code>adb shell screencap</code> arrived in Android 4.0. On <a class="gloss" href="https://chijure.github.io/en/glossary/#gingerbread" title="Android version 2.3, from 2010–2011. Its kernels and tools are old, which is why many modern solutions do not apply.">Gingerbread (Android 2.3)</a> (2.3) it doesn’t exist, so taking a screenshot of an old phone means reading the <a class="gloss" href="https://chijure.github.io/en/glossary/#framebuffer" title="Region of video memory whose contents are shown on screen. The kernel exposes it as /dev/graphics/fb0.">Framebuffer</a> directly: <code>/dev/graphics/fb0</code>.</p> <p>The part that almost always trips you up isn’t the permission or the format, it’s the <strong><a class="gloss" href="https://chijure.github.io/en/glossary/#bpp" title="Colour depth of an image. 16 bpp uses 2 bytes per pixel (RGB565); 32 bpp uses 4 (8 bits per channel plus alpha).">bpp (bits per pixel)</a> (stride)</strong>: the real width, in pixels, of each row in memory, which almost never equals the screen’s visible width. On the LG C660, the screen is 240×320, but the real stride is <strong>256 pixels</strong>, not 240. If you read the image assuming 240, every row comes out shifted, and the result looks like diagonal tearing, as if the video were out of sync.</p>The C660's battery: what you can measure without a fuel gaugehttps://chijure.github.io/en/blog/battery-without-fuel-gauge/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/battery-without-fuel-gauge/<p>When you suspect a worn battery, the right tool is a multimeter. What I had on hand was the LG C660 and <a href="https://chijure.github.io/en/blog/qapp-testing-without-guessing/">QApp</a>, so this is how far software alone can take you, and where it has to stop.</p> <h2 id="the-phone-has-no-hahahugoshortcode15s1hbhb-with-a-cell-meter">The phone has no <a class="gloss" href="https://chijure.github.io/en/glossary/#pmic" title="Power management chip: regulators, battery charging, the power button.">PMIC</a> with a cell meter</h2> <p>The C660 ships with no dedicated battery-metering chip (neither <code>bq27x00</code> nor <code>max17040</code>; both are off in the kernel). Everything Android sees — voltage, capacity, temperature — arrives through a remote call to the modem (<code>msm_battery</code> over RPC), which itself filters the ADC signal. The practical consequence: voltage moves in <strong>steps of about 17 mV</strong>, not a continuous curve, and that has to be accounted for when reading any number.</p>USB OTG on the LG C660: what I measured and why it does not workhttps://chijure.github.io/en/blog/usb-otg-c660/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/usb-otg-c660/<p>On the LG L3 (E400), <a class="gloss" href="https://chijure.github.io/en/glossary/#host-mode" title="The phone acts as the “PC”: it drives and powers whatever is connected (flash drive, mouse). The opposite is peripheral mode, the usual one when plugged into a PC.">USB host</a> mode worked with a powered <a class="gloss" href="https://chijure.github.io/en/glossary/#otg" title="On-The-Go: lets a phone act as a USB host to connect flash drives, mice and keyboards, using a special adapter.">OTG</a> adapter, so I tried the same on the <strong>LG Optimus Pro C660</strong>. It does not work, and this is what I measured to be sure.</p>What doesn't exist in the Android 2.3 shell (and what does, against what I believed)https://chijure.github.io/en/blog/what-gingerbread-lacks/Mon, 02 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/what-gingerbread-lacks/<p>Debugging a <a class="gloss" href="https://chijure.github.io/en/glossary/#gingerbread" title="Android version 2.3, from 2010–2011. Its kernels and tools are old, which is why many modern solutions do not apply.">Gingerbread (Android 2.3)</a> (Android 2.3) phone over <code>adb shell</code> has traps that don’t exist on newer versions, and it’s worth knowing them before writing a script that hangs halfway through a test.</p> <h2 id="what-really-doesnt-exist">What really doesn’t exist</h2> <p>Confirmed on an LG C660 running CM7:</p> <pre tabindex="0"><code>$ input tap 10 10 Error: Unknown command: tap $ input swipe 10 10 20 20 Error: Unknown command: swipe $ am force-stop com.example Error: Unknown command: force-stop </code></pre><p><code>input</code> on this version only accepts <code>text</code> and <code>keyevent</code>; to simulate a touch you have to use <code>sendevent</code> directly on the input device, or a <code>keyevent</code> if the element already has focus. To force-close an app without <code>force-stop</code>, the alternative is killing the process by <code>pid</code> (<code>ps</code> + <code>kill</code>), or <code>am kill</code>, which is gentler and doesn’t always free the memory.</p>USB OTG on the LG L3 (E400): host mode with a software switchhttps://chijure.github.io/en/blog/usb-otg-e400/Sun, 01 Nov 2026 00:00:00 -0500https://chijure.github.io/en/blog/usb-otg-e400/<p>On the <strong>LG Optimus L3 (E400)</strong> running <a class="gloss" href="https://chijure.github.io/en/glossary/#cm" title="Community ROM built from Android’s open source code, now discontinued (LineageOS continues it). CM7 is Android 2.3 and CM10 is Android 4.1/4.2.">CyanogenMod</a> 7, a flash drive plugged in through <a class="gloss" href="https://chijure.github.io/en/glossary/#otg" title="On-The-Go: lets a phone act as a USB host to connect flash drives, mice and keyboards, using a special adapter.">USB OTG</a> works: it mounts by itself and can be read from the phone. This is what it took, compared with the <a href="https://chijure.github.io/en/blog/usb-otg-c660/">C660</a>, where there was no way.</p>A reboot at exactly 612 secondshttps://chijure.github.io/en/blog/reboot-at-612-seconds/Sat, 31 Oct 2026 00:00:00 -0500https://chijure.github.io/en/blog/reboot-at-612-seconds/<blockquote> <p><strong>Update, 3 November 2026:</strong> this reboot stopped happening after restoring the phone’s full factory firmware (modem and NV included), with the same 3.4 kernel. So the conclusion below, “it is not the modem”, was too strong. I tell the story in <a href="https://chijure.github.io/en/blog/kernel-34-lg-l3/">Kernel 3.4 for the LG L3</a>.</p> </blockquote> <p>Porting <a class="gloss" href="https://chijure.github.io/en/glossary/#cm" title="Community ROM built from Android’s open source code, now discontinued (LineageOS continues it). CM7 is Android 2.3 and CM10 is Android 4.1/4.2.">CyanogenMod (CM)</a> 10.1 to the <strong>LG Optimus L3 (E400)</strong> with a 3.4 <a class="gloss" href="https://chijure.github.io/en/glossary/#kernel" title="The core of the operating system (Linux on Android): it manages hardware, memory and processes.">Kernel</a> (instead of the 2.6.38 that already worked) brought a failure I had not seen before: the phone reboots on its own, with no <a class="gloss" href="https://chijure.github.io/en/glossary/#panic" title="Unrecoverable kernel error: the kernel stops and the device reboots. Its message is kept in last_kmsg.">Kernel panic</a> and no oops in the log, almost always between <strong>609 and 616 seconds</strong> of uptime. It happens even at full idle, with the screen off. After the reboot, the bootloader comes up in charging mode.</p>A 3.4.5 kernel for the Huawei Y220-U05: 26 commits from a donor tree to a stable Gingerbreadhttps://chijure.github.io/en/blog/y220-kernel/Fri, 23 Oct 2026 00:00:00 -0500https://chijure.github.io/en/blog/y220-kernel/<p>This is the second of two articles about the <a class="gloss" href="https://chijure.github.io/en/glossary/#kernel" title="The core of the operating system (Linux on Android): it manages hardware, memory and processes.">kernel</a> of the <strong>Huawei Ascend Y220-U05</strong> (MediaTek <strong><a class="gloss" href="https://chijure.github.io/en/glossary/#mt6572" title="Dual-core Cortex-A7 MediaTek processor used in low-end phones such as the Huawei Y220.">MT6572</a></strong>, Android 2.3.6 <a class="gloss" href="https://chijure.github.io/en/glossary/#stock" title="The factory firmware: the one the phone ships with. It is the reference for comparing the behaviour of your own ROM.">stock</a>). In the <a href="https://chijure.github.io/en/blog/y220-twrp-first/">first</a> I tell how I tested it in <a class="gloss" href="https://chijure.github.io/en/glossary/#twrp" title="Team Win Recovery Project: a touch-driven recovery that installs zips, makes backups and restores partitions.">TWRP</a> so as not to risk the system. Here are the fixes.</p>Platform patches or device tree: why I choose HALs and shimshttps://chijure.github.io/en/blog/hals-and-shims/Thu, 22 Oct 2026 00:00:00 -0500https://chijure.github.io/en/blog/hals-and-shims/<p>If you look at the device trees I have published, you will find the same sentence repeated: <em>“all through a <a class="gloss" href="https://chijure.github.io/en/glossary/#device-tree" title="In the ROM world, the folder holding one model’s configuration: partitions, init.rc, boot files. It is not the kernel’s binary device tree (DTB).">Device tree</a> HAL, like on the Y220”</em>. It is not an abstract rule, it is a decision I make on every port, and one I have paid to undo when I did not follow it. This is what it means and why I prefer it.</p>One patch, three phones: MediaTek's LK bootloaderhttps://chijure.github.io/en/blog/mediatek-lk-patch/Sat, 17 Oct 2026 00:00:00 -0500https://chijure.github.io/en/blog/mediatek-lk-patch/<p>The <a href="https://github.com/chijure-android-system-development/lg-d625-tegra-bootloader-patch">LG D625</a> (Tegra 4i) needed its own unlock path, with <code>nvflash</code>. A different group of older LG phones — the <strong>L5 II (E450g)</strong>, the <strong>L4 II (E440g)</strong> and the <strong>L50 (D213)</strong> — share something that sets them apart: the same MediaTek <strong>LK</strong> bootloader, on the same chip family (MT6575 and MT6572). That coincidence is what let one piece of analysis work, with adjustments, for all three.</p> <h2 id="the-problem-it-solves">The problem it solves</h2> <p>A custom recovery like TWRP or CWM isn’t signed by LG. The LK, before booting any image from the <code>boot</code> or <code>recovery</code> partition, checks that signature, and if it doesn’t match, it halts with a “Security Error” and boots nothing. Without disabling that check, there’s no way to install your own recovery, short of paying for an unlock tool every time it’s needed.</p>Testing the Huawei Y220-U05 kernel without risking the ROM: TWRP firsthttps://chijure.github.io/en/blog/y220-twrp-first/Mon, 12 Oct 2026 00:00:00 -0500https://chijure.github.io/en/blog/y220-twrp-first/<p>The <strong>Huawei Ascend Y220-U05</strong> uses a MediaTek <strong><a class="gloss" href="https://chijure.github.io/en/glossary/#mt6572" title="Dual-core Cortex-A7 MediaTek processor used in low-end phones such as the Huawei Y220.">MT6572</a></strong> and ships with Android 2.3.6 (build <code>C482B206SP05</code>). For the <a class="gloss" href="https://chijure.github.io/en/glossary/#cm" title="Community ROM built from Android’s open source code, now discontinued (LineageOS continues it). CM7 is Android 2.3 and CM10 is Android 4.1/4.2.">CyanogenMod</a> port I needed my own <a class="gloss" href="https://chijure.github.io/en/glossary/#kernel" title="The core of the operating system (Linux on Android): it manages hardware, memory and processes.">kernel</a>, and the starting point was a <strong>donor</strong> tree from Longcheer for Jelly Bean (<code>lcsh72_we_jb3</code>): a Linux 3.4.5 with MediaTek support (its history shows it imported from a Lenovo project in 2014).</p>