#Get and compile Heimdell with line change #BridgeManager.cpp contains: #success = ReceivePacket(receiveFilePartPacket, receiveEmptyTransferFlags); #but it makes wrong timeout and lost flags. #I use this one: #success = ReceivePacket(receiveFilePartPacket, kDefaultTimeoutReceive, #receiveEmptyTransferFlags); #see notes: http://pastebin.com/eB8Dhgke #Get recovery img from here: #http://forum.xda-developers.com/tab-4/orig-development/clockworkmod-6-0-5-0-galaxy-tab-4-10-1-t2830683 #http://forum.xda-developers.com/attachment.php?attachmentid=2873786&d=1406554277 #reboot into bootloader and flash recovery #!!!!!!upon reboot hold down Vol Down + Menu + Power sudo adb reboot bootloader sudo heimdall flash --RECOVERY recovery.img sudo adb reboot recovery #once in recovery adb shell sudo adb shell ###############note############# # USE PARTED TO LEARN WHICH PARTITION IS WHAT #parted /dev/block/mmcblk0 #(parted) print ###############note############# #mount system, cache and data because clockworkmod can’t #mount sdcard - you might need to rm /sdcard folder #rm -fr /sdcard && mkdir /sdcard mount /dev/block/mmcblk1p1 /sdcard mount /dev/block/mmcblk0p23 /system mount /dev/block/mmcblk0p24 /cache mount /dev/block/mmcblk0p26 /data ###############keeping CWM############ #backup parition #rm -fr /sdcard && mkdir /sdcard mount /dev/block/mmcblk1p1 /sdcard mkdir /sdcard/tab4 dd if=/dev/block/mmcblk0p15 of=/sdcard/tab4/stock-recovery.img dd if=/sdcard/recovery.img of=/dev/block/mmcblk0p15 #to make it last through reboots mount /dev/block/mmcblk0p23 /system mv /system/recovery-from-boot.p /system/recovery-from-boot.p ###################root device################## #in clock work mod mount /dev/block/mmcblk0p23 /system cd /system/bin cp sh su #setuid to su will always run as root chown root:root su chmod 4755 su ################busybox############ #on desktop wget http://benno.id.au/android/busybox sudo adb push busybox /system/bin/ sudo adb shell #link to busybox on device cd /system/bin for i in $(busybox --list);do echo "linking $i...";ln -s busybox $i;done ################editing startup scripts################### #as root (in recovery maybe) mount /dev/block/mmcblk0p23 /system echo “/etc/myboot.sh” >> /system/etc/init.sec.boot.sh /system/bin/busybox vi /system/etc/myboot.sh