Rooting the HTC Sensation XE

I found loads of guides online with even more text. The problem with these guides is that they explain which button to push but not what it does.

I am fairly tech-savvy which means I try to figure out what is going on and these guides fail to explain that.

So here goes, the TL;DR version to root your HTC Sensation XE and replace the bootloader to make backups or replace the OS.

We start by replacing the bootloader so we can install custom things, including the root access.

  • Step 1: Unlock your phone; this is called switching S-ON to S-OFF. I speculate this allows write access to parts of the phone. Follow the HTC instructions here:
  • Step 2: Use ‘juopunutbear’ to unlock and replace the stock bootloader with a version that can be replaced. Yes, the ‘trick’ with the wire is required: it probably triggers a reset of one of the security mechanisms to cheat your way into the bootloader.
  • Step 3: At this point the bootloader can be replaced. Write your preferred bootloader image from your computer to your phone in the ‘fastboot’ mode using fastboot flash recovery myrecovery.img; see and search for the ‘Flash the Recovery’ section which has a link to an image and the exact command for it.

Your HTC Sensation XE now can install custom firmware including the root access. How this can be done is future work.

Linux / Gentoo Linux

Ubuntu Kernel 3.8 and NVidia Drivers

While playing around with various mainline kernels I found out that the vanilla NVidia driver (310.xx and 313.xx) do not compile on the linux 3.8.0-rc3 kernel. Testing the xorg-edgers and ubuntu-x-swat versions of the NVidia driver package did not help either.

Until the NVidia driver officially supports the 3.8.0 kernel, this workaround will allow you to fix the NVidia driver using the DKMS source installation. This might also still apply for kernel 3.7.x. Begin by adding the ubuntu-x-swat repository to get at least version 304.60 of the NVidia driver:

sudo apt-add-repository ppa:ubuntu-x-swat/x-updates
sudo apt-get update
sudo apt-get install nvidia-current

Patch (by hand if you have to) the following 2 files: /usr/src/nvidia-current-304.64/ and /usr/src/nvidia-current-304.64/nv-mmap.c. These patches are based on 310.xx but can be used for manual modification:

---    2012-10-11 19:18:22.704848496 -0400
+++ 2012-10-12 20:35:55.707213868 -0400
@@ -20,6 +20,7 @@
 ISYSTEM=`$CC -print-file-name=include 2> /dev/null`
@@ -118,7 +119,7 @@
@@ -146,10 +147,10 @@
     if [ "$ARCH" = "i386" -o "$ARCH" = "x86_64" ]; then
-        CFLAGS="$CFLAGS -I$SOURCES/arch/x86/include -I$OUTPUT/arch/x86/include/generated"
+        CFLAGS="$CFLAGS -I$SOURCES/arch/x86/include -I$SOURCES/arch/x86/include/uapi -I$OUTPUT/arch/x86/include/generated -I$OUTPUT/arch/x86/include/generated/uapi"
     elif [ "$ARCH" = "arm" ]; then
         CFLAGS="$CFLAGS -I$SOURCES/arch/arm/include -I$OUTPUT/arch/arm/include/generated"
--- nv-mmap.c.dist 2012-08-08 22:52:53.000000000 -0400
+++ nv-mmap.c 2012-08-14 23:52:41.257235863 -0400
@@ -450,7 +450,7 @@
nv_vm_list_page_count(&at->page_table[i], pages);

- vma->vm_flags |= (VM_IO | VM_LOCKED | VM_RESERVED);
+ vma->vm_flags |= (VM_IO | VM_LOCKED | (VM_DONTEXPAND | VM_DONTDUMP));

Patches are taken from here After patching, the NVidia kernel module will not be built unless you install a new kernel or force an update using DKMS. To rebuild the kernel module for your currently running kernel, run this:

sudo dkms autoinstall -k $(uname -r)


Building OpenElec with Lirc audio_alsa

Since OpenElec 2/3 does not ship with ‘audio_alsa’, here are the instructions to build OpenElec with the ‘audio_alsa’ lirc driver. This module is used with home-brew IR receivers using the soundcard audio input.

Use the standard build guide from the OpenElec wiki. After cloning the GIT repository, modify the lirc build script to build the correct module.

Open packages/sysutils/remote/lirc/build and replace the following line for the userspace driver: ... --with-driver=userspace \ ... to ... --with-driver=audio_alsa \ ...

Update: I tried various things but for some reason I could not get the alsa support to be simply added to the standard build (this seems to be a bug in LIRC which should have been fixed upstream). You can try adding the line instead of replacing it (note the trailing slash!)

All done: now start the system build as you normally should: PROJECT=Generic make release
Sit back and wait; on a Core2Duo system the build takes several hours and close to 9GB of space. Follow the guides to modify the lirc config in userspace, or modify the ‘install’ script to install the correct configuration into the read-only system build.

Updates Break LIRC!

Your custom built OpenELEC will attempt to update itself with standard releases. You can disable automatic updates or place the LIRC binaries on the /storage mount where they will survive updates; just make sure you call the correct binaries.

Note that this will only allow you to have updates as long as the binary compatibility of OpenELEC does not change. It seems plausible that this will remain as such at least between large updates but if you want to be really sure you should switch to manual updates to prevent sudden breakage…

Audio Setup

Some notes to set up the audio capture correctly as these seem to be scattered over the internet.

First off, mute the capture for all inputs but the jack you connected the receiver to so only the correct input is enabled. On OpenELEC it seems like all inputs are muted by default so you only need to unmute the correct input from within /storage/.config/

# Select the correct input channel
amixer set "Capture",0 cap
# Set the volume of the capture
amixer set "Capture",0 20

In case you wonder which channel is the correct one or how loud it should be, use arecord. You most likely will not have this program on OpenELEC but it is in fact identical to ‘aplay’: create a symlink to ‘aplay’ called ‘arecord’ and you are good to go.

Use ‘arecord’ to display the volume of the incoming signal (using the builtin VU), tweak to whatever your system needs:

arecord -vv -D hw:0 -c2 -r48000,l -f S16 > /dev/null

I experimented with the recording amplification until I had a near zero output when idle (2 to 3% on the VU) and 30% to 35% peak volume when holding a button down. At first I had the volume tweaked so input would trigger 10% on the VU. At this point irrecord seemed to work but it failed on the ‘Toggle Bit’ detection where you have to push a button as often as possible. Increasing the volume solved this (and simply opening the volume up to the max will break it again – calibrate it properly or ‘irrecord’ will fail!).

And for reference, this is how I start lircd from in OpenELEC:

/storage/.bin/lircd --driver=audio_alsa --output=/var/run/lirc/lircd \
 --pidfile=/var/run/lirc/ -d hw@48000,l /storage/.config/lircd.conf

You could add --uinput to generate Linux input events besides standard lirc events. This effectively means the XBMC would not use LIRC events but something like keyboard strokes. It depends on personal preference but I still use the old fashioned LIRC events.


Sharing Sound From Ubuntu to XBMC

Summary: in this article I explain how you can stream music (audio) from your Ubuntu computer to XBMC using UPnP. While this recipe also allows you to play every MP3 file on your computer, it is targeted to getting the audio from your speakers to your home cinema set.

While test-driving XBMC 12 during the pre-beta phase I noticed how I could use AirPlay with iTunes under Windows to get sound from my crappy laptop speakers to the home cinema setup powered by XBMC.

Thinking this should also be possible from within Ubuntu Linux sent me on a goose chase that seemed to end up nowhere.

From the ‘paprefs’ utility, you can actually connect with the AirPlay capabilities of XBMC. But instead of sharing sound, you in-sta crash or hang XBMC. Even better, since this functionality is managed by PulseAudio, merely logging in on Ubuntu will hang XBMC as PulseAudio keeps connecting.

I read multiple stories how this is a RAOP (I assume this is the Linuxy name for AirPlay) issue where UDP should be used but TCP is preferred or something. Looking at the libshairplay website (which seems to be used by PA), it says UDP is supposed to be working for quite some time now. I gave up on this.

Next up is sharing local audio using UPnP: paprefs => ‘Network Server’ => ‘Make local sound devices available as DNLA/UPnP Media Server’. Fire up XBMC, search for audio using UPnP aaaaaand…. nothing.

It turns out that enabling this option only loads a module which creates an HTTP audio sink. Put another way: the audio from your sound card is shared on the network, it is just not advertised so nothing can find it.

This is the point where you need Rygel. While the description tells you about transcoding media for Xboxes and PlayStations, the core of Rygel is a UPnP media server. You need this functionality to advertise the audio sources to the local network.

If you now start Rygel (3) by typing ‘rygel’ you will get a listing for any found media, Rythmbox music collection (if its running) and the internal sound cards (1).

But all is not well yet: when you point XBMC to the internal sound card (or the special DNLA device if you enabled it in ‘paprefs’) XBMC will crash:

Hopefully this bug will get fixed soon but in the meantime it leaves us without streaming audio. Luckily there is another solution in the form of the GstLaunch (2) plugin for Rygel. Do note that this is another package seperate from Rygel itself (it took me 10 minutes to figure out why the plugin was seemingly awol when it was in fact not installed).

The GstLauncher plugin allows you to connect a GStreamer pipeline to the network as a UPnP source. While this in theory opens up loads of fun stuff to play with, it can also be used to generate audio streams from the internal sound card for XBMC.

Open up your rygel.conf (I removed the one in ~/.config/rygel.conf and put everything in /etc/rygel.conf) and put the following in there (comment the existing GstLaunch section):


pulseaudioflac-title=FLAC on @HOSTNAME@
device=upnp.monitor ! flacenc

pulseaudiomp3-title=MP3 on @HOSTNAME@
device=upnp.monitor ! lamemp3enc

pulseaudiopcm-title=PCM on @HOSTNAME@
device=upnp.monitor ! wavenc

Feel free to cut this list down to just the formats you want (do not forget to modify launch-items accordingly). MP3 is lossy and as such lowers audio quality and has a high latency. FLAC is losless and should have low latency but XBMC refuses to play the FLAC stream. It complains about the -lack of- metadata and similar issues have been solved in GStreamer 0.11 while I am using 0.10. I assume a newer Ubuntu will fix this. Finally PCM is uncompressed wave but requires the most bandwidth – I am using this option.

You will end up with something like this:

         +--> (1) PulseAudio => HTTP stream from internal audio --+ 
Ubuntu --+--> (2) Rygel => HTTP audio stream from GstLaunch ------+--> network -> XBMC
         +--> (3) Rygel UPnP server ------------------------------+

Note that (1) would be the preferred option as its built into Ubuntu but currently does not work in XBMC. Start Rygel and find the GstLaunch entry in the UPnP listing. Pick one of the streams to start listening, enjoy!

Linux / Gentoo Linux

Backing up/cloning a linux system over a network

I had to perform this emergency procedure every now and then and I seem to reinvent the wheel every time so I reckoned it was time to document it.

This time, its a failing master drive in a simple home server – without a RAID. The SMART monitoring has not yet caught on but the self-tests fail and some files are read-only as writes to the drive fail. Also the logs are full with SATA errors like: Apr 29 10:23:57 rivenscryr smartd[3621]: Device: /dev/sda, 18 Currently unreadable (pending) sectors

To save the installation and all the files, I want to clone or backup the entire root filesystem (which is ext3, but that is not relevant) to a new drive (formatted ext4) in another machine. The reason to do this between machines can be numerous: perhaps you are migrating a live machine or (in this case) perhaps you worry that the current drive may fail when you power-cycle the system when the replacement drive is installed.

Backup/Clone Over Network Recipe

  1. Mount the root filesystem of the original machine on another location in order to have a clean copy:
      mkdir /mnt/rootfs && mount / /mnt/rootfs -o bind

    Check if it worked by listing the /mnt/rootfs/ folder. Note that /mnt/rootfs/proc will be empty and dev will be empty or very sparse.

  2. Use netcat and tar on the receiving machine (my case: random system with Ubuntu on USB stick and new HDD plugged in) to receive and write the data.
      nc -l 7777 | tar -xz -C /mnt/targetdir
  3. Use tar and netcat on the original machine to stream-copy the root filesystem over the network.
    Big fat warning: My cloning is done on an internal, trusted network. You will be cloning using an unsecured stream over this network.

      tar -czp --atime-preserve --numeric-owner \
        --xattrs --recursion /mnt/rootfs | nc remotehost 7777

Here is what all these options do:

  • -c: Create a new archive
  • -z: Use GZip compression to speed up the transfer
  • -p: Preserve file permissions
  • –atime-preserve: Do not update the accessed timestamp
  • –numeric-owner: Copy using numeric ids only – useful when cloning into a foreign system
  • –xattrs: Include ACL attributes and SElinux attributes
  • –recursion: Recurse down into sub-folders
  • –ignore-failed-read: Useful when a drive is heavily damaged and you only care to extract as much data as possible. Note: do not enable this by default as you might end up with an unusable clone if some files are missing. (Aka, this is a last resort option for non-functional clones)

Thomson TG787v and PXE boot

If you have a Thomson TG787v modem, like we have from KPN Business in the Netherlands, you might want to add an PXE server to your network to quickly install computers without the hassle of running around with CDs or thumb drives.

I will not explain how to set up the PXE environment itself (which is in fact a TFTP service) but I will stick to the modification of the modem/router. This modification can NOT be done using the webbased configuration panel.

We will log in using telnet, create option templates for the DHCP server, install those option templates and finally add them to the active pool so they will actually be in use.

If you think that’s rather a lot of work to install option 66 (TFTP server address) and option 67 (Bootfile name) into your modem, please complain to Thomson and insist they make it a) more intuitive; b) improve their documentation; c) implement these things in their web-based configuration; d) all of the above.

  • Log in on the CLI using telnet at your router, port 23 and enter your credentials
    Note: with the unlocked versions, your login will be the username from the web-based configuration and no password. Try “Administrator”.
  • Install the new template for the PXE server address:
    dhcp server option tmpladd name=tftp_server_name optionid=66
  • Install the new template for the PXE bootfile name:
    dhcp server option tmpladd name=bootfile optionid=67
  • Instantiate the templates:
    dhcp server option instadd name=tftp_server_name tmplname=tftp_server_name value=(addr)
    dhcp server option instadd name=bootfile tmplname=bootfile value=(ascii)pxelinux.0

    Note: The file name can be configured to whatever you need.

  • List all DHCP server pools: dhcp server pool list
  • Optionally, add the option to the desired pool:

    dhcp server pool optadd name=LAN_private instname=tftp_server_name
    dhcp server pool optadd name=LAN_private instname=bootfile

It seems that the template instantiation is added by default to the “LAN_private” pool.

Linux / Gentoo Linux

Clearing GPT from harddisk without destroying MBR

For some reason, my attempts to use GPT with Windows 7 ran aground and I ended up with a working Master Boot Record (MBR) and an empty GPT. While Windows 7 was quite happy with this, the Ubuntu installer detected the GPT and attempts to use it – which effectively prevents me from installing it unless I wipe the entire hard drive for Ubuntu.

In this little article I will clear the GPT from the disk so only the MBR remains. This is an advanced technique which WILL destroy your partition layout and thus your data when it fails. Make very very sure you understand each step and have backups.

Start by making a backup of your MBR, which is 512 bytes long at the start of the disk:
sudo dd if=/dev/sda of=disk_mbr.raw bs=512 count=1
I made a backup of the MBR and the GPT as well, just in case (GPT is 512 bytes for the header followed by 16kB of content, total with MBR is 17kB):
sudo dd if=/dev/sda of=disk_mbr_gpt.raw bs=1024 count=17
The GPT is present at the start and end of the disk. Lets start by erasing the GPT from the start:
sudo dd if=/dev/zero of=/dev/sda bs=512 seek=1 count=33
Now find the end of your disk, use fdisk /dev/sda and note the number of bytes on the disk. In my case it is: 240,057,409,536 bytes, since I want to use kilobytes with dd, lets convert it to kB: 234,431,064 kB. We need to erase the last 16.5 kB, but 16kB will suffice (as the header is in the last 512 bytes).

So subtracts 16 from the drive size to generate the GPT offset for the end of the disk and zero-fill it to the end: sudo dd if=/dev/zero of=/dev/sda seek=234431048 bs=1024 count=17

All done! Now fdisk will no longer complain the drive has a GPT table and the Ubuntu installer will only find the MBR and happily install using that.


Force HTC Hero 1.5 to update

Since it took me hours to find this answer, I decided to put it up clear and simple: this is how you ‘force’ your stock HTC Hero to check for updates.

First off, this is for the original HTC Hero. So not the Sprint or CDMA version, but the GSM version (with the chin). Most sites tell you to use the “Check for updates” option. The original HTC Hero firmware does not have this option.

Instead, you need to install the first (of three) updates to get the updater. The original update mechanism checks every two weeks for an update. If you need it to check right away, you can move the clock 2 weeks forward or use enter this number: *#*#682#*#*. If it worked, the number will disappear from the dialer and almost instantly a popup will tell you that an update is available.

After this update, force the phone to check for future updates by doing:

  1. From the Home screen, press MENU, and then tap Settings.
  2. Scroll down the screen, and then tap About phone > System software updates.
  3. On the System software updates screen, tap Check now.

Gentoo KVM virtual machine support plus networking

The Gentoo Wiki article about KVM uses the less flexible networking setup with dedicated TAP devices like ‘tap0’. While this setup works fine, other distributions use the bridge device in a different way. By creating a virtual bridge and forcing the host system to connect through this bridge, virtual machines can simply connect to the bridge device and ‘plug in’. No need to manually create TAP devices. In this guide we will set up host and guest networking using the virtual bridge device and DHCP for wired ethernet.


Upgrading LIRC to ir-core and imon

While the title may sound a tad cryptic, that matched my first impression about the new infrared remote subsystem used in Ubuntu 10.10 and kernel 2.6.36+ based distributions. In Linux 2.6.36, a new sub-system is introduced for remote controls. This subsystem is a partial replacement for lirc as it features complete IR drivers for numerous devices.

In reality, the glass is only half full as some IR receivers (and transmitters) deal with raw data. Writing universal drivers for such devices can be bothersome or even impossible, for example when dealing with universal receivers. As such, LIRC is not completely written off as it can be used to do userspace IR processing as it used to. The exact details are unknown to me as I have an SoundGraph iMon receiver (device ID 0038 – LCD), which does not deliver raw sensory input but rather complete scancodes.

When I upgraded from Ubuntu 10.04 running lirc 0.8.6 to Ubuntu 10.10 and lirc 0.8.7, the entire IR subsystem died on me. To my surprise, while the remote was dead, the LCD screen was working fine. Further inspection showed that the ‘lirc_imon’ driver was not loaded at all.

With the move to the new input layer driver for supported IR devices in the kernel, the new ‘imon’ driver (version 0.8 at the time of writing) no longer provides a ‘lirc0’ device. As such, lircd will fail when attempting to claim it and loading ‘lirc_imon’ (provided you still have it) will not work as the device is already claimed by the ‘imon’ driver.

The fastest way to get up and running again is as follows. The ‘imon’ receiver will now be a HID input device. I got the impression it would send keystrokes to a graphical application but I didn’t get that working. Instead, we will use ‘lircd’ again using a special driver called ‘devinput’. This driver reads the key strokes from the input layer device and converts them into LIRC events. All your LIRC capable programs will then use LIRC like they used to – we only need to use the new button names.

To find the iMon receiver in the list of input devices, lets create a udev rule to symlink to the device. This way we will not have to rely on obscure device names like ‘input1’. Make sure the device name matches whatever hardware you have. I inserted this rule in a file called /etc/udev/rules.d/99-imon.rules:

KERNEL=="event*", SYSFS{name}=="iMON Remote (15c2:0038)", NAME="input/%k", SYMLINK="input/imon_remote", MODE="0666"

Lets begin by stopping lirc if you still have it running. Next, reconfigure LIRC to use the devinput driver – when it asks which device you have, DOT NOT SELECT THE SOUNDGRAPH IMON but ‘Linux input layer (/dev/input/eventX)’. In the next screen select ‘None’ as you probably do not use a transmitter.

/etc/init.d/lirc stop
sudo dpkg-reconfigure lirc
> Linux input layer (/dev/input/eventX)
> None
/etc/init.d/lirc start

In case you are not using Ubuntu Linux, I will explain the key parts of the LIRC configuration. The /etc/lirc/lircd.conf file now has this part in it:

#Configuration for the Linux input layer (/dev/input/eventX) remote:
include "/usr/share/lirc/remotes/devinput/lircd.conf.devinput"

The lirc.conf.devinput file is a standard (generated) file with key codes as provided with LIRC. There is no need to manually set up a file with button scan codes as the new ir-core kernel subsystem will generate standard codes.

The file called /etc/lirc/hardware.conf has something like this in it:

REMOTE="Linux input layer (/dev/input/eventX)"

All that remains is to use the new buttons in your LIRC capable program. For example, this is a part of my configuration of XBMC (Lircmap.xml) for use with the SoundGraph iMon receiver:

  <remote device="devinput">