diff --git a/dump_image/Android.mk b/dump_image/Android.mk
new file mode 100644
index 0000000..ab8ac38
--- /dev/null
+++ b/dump_image/Android.mk
@@ -0,0 +1,15 @@
+ifneq ($(TARGET_SIMULATOR),true)
+ifeq ($(TARGET_ARCH),arm)
+
+LOCAL_PATH := $(call my-dir)
+include $(CLEAR_VARS)
+LOCAL_SRC_FILES := dump_image.c mtdutils.c ../mtdutils/mounts.c
+LOCAL_MODULE := recovery_dump_image
+LOCAL_MODULE_TAGS := eng
+LOCAL_STATIC_LIBRARIES := libcutils libc
+LOCAL_MODULE_STEM := dump_image
+LOCAL_FORCE_STATIC_EXECUTABLE := true
+include $(BUILD_EXECUTABLE)
+
+endif	# TARGET_ARCH == arm
+endif	# !TARGET_SIMULATOR
diff --git a/dump_image/dump_image.c b/dump_image/dump_image.c
new file mode 100644
index 0000000..bc96abc
--- /dev/null
+++ b/dump_image/dump_image.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+
+#include "cutils/log.h"
+#include "mtdutils.h"
+
+#ifdef LOG_TAG
+#undef LOG_TAG
+#endif
+
+#define LOG_TAG "dump_image"
+
+#define BLOCK_SIZE	2048
+#define SPARE_SIZE	(BLOCK_SIZE >> 5)
+
+void die(const char *msg, ...) {
+    int err = errno;
+    va_list args;
+    va_start(args, msg);
+    char buf[1024];
+    vsnprintf(buf, sizeof(buf), msg, args);
+    va_end(args);
+
+    if (err != 0) {
+        strlcat(buf, ": ", sizeof(buf));
+        strlcat(buf, strerror(err), sizeof(buf));
+    }
+
+    fprintf(stderr, "%s\n", buf);
+    exit(1);
+}
+
+/* Read a flash partition and write it to an image file. */
+
+int main(int argc, char **argv)
+{
+    ssize_t (*read_func) (MtdReadContext *, char *, size_t);
+    MtdReadContext *in;
+    const MtdPartition *partition;
+    char buf[BLOCK_SIZE + SPARE_SIZE];
+    size_t partition_size;
+    size_t read_size;
+    size_t total;
+    int fd;
+    int wrote;
+    int len;
+
+    if (argc != 3) {
+        fprintf(stderr, "usage: %s partition file.img\n", argv[0]);
+        return 2;
+    }
+
+    if (mtd_scan_partitions() <= 0)
+    	die("error scanning partitions");
+
+    partition = mtd_find_partition_by_name(argv[1]);
+    if (partition == NULL)
+   	 die("can't find %s partition", argv[1]);
+
+    if (mtd_partition_info(partition, &partition_size, NULL, NULL)) {
+   	 die("can't get info of partition %s", argv[1]);
+    }
+
+    if (!strcmp(argv[2], "-")) {
+	fd = fileno(stdout);
+    } else {
+	fd = open(argv[2], O_WRONLY|O_CREAT|O_TRUNC, 0666);
+    }
+
+    if (fd < 0)
+    	die("error opening %s", argv[2]);
+
+    in = mtd_read_partition(partition);
+    if (in == NULL) {
+    	close(fd);
+	unlink(argv[2]);
+        die("error opening %s: %s\n", argv[1], strerror(errno));
+    }
+
+    if (!strcmp(argv[1], "system") ||
+        !strcmp(argv[1], "cache") ||
+	!strcmp(argv[1], "userdata")) {
+	read_size = BLOCK_SIZE + SPARE_SIZE;
+	read_func = mtd_read_raw;
+    } else {
+	read_size = BLOCK_SIZE;
+	read_func = mtd_read_data;
+    }
+
+    total = 0;
+    while ((len = read_func(in, buf, read_size)) > 0) {
+        wrote = write(fd, buf, len);
+        if (wrote != len) {
+    		close(fd);
+		unlink(argv[2]);
+		die("error writing %s", argv[2]);
+	}
+	total += BLOCK_SIZE;
+    }
+
+    if (total != partition_size) {
+    	close(fd);
+	unlink(argv[2]);
+    	die("error reading %s", argv[1]);
+    }
+
+    mtd_read_close(in);
+
+    if (close(fd)) {
+	unlink(argv[2]);
+    	die("error closing %s", argv[2]);
+    }
+
+    return 0;
+}
diff --git a/dump_image/mtdutils.c b/dump_image/mtdutils.c
new file mode 100644
index 0000000..9ee7246
--- /dev/null
+++ b/dump_image/mtdutils.c
@@ -0,0 +1,600 @@
+/*
+ * Copyright (C) 2007 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/mount.h>  // for _IOW, _IOR, mount()
+#include <sys/stat.h>
+#include <mtd/mtd-user.h>
+#undef NDEBUG
+#include <assert.h>
+
+#include "mtdutils.h"
+
+struct MtdPartition {
+    int device_index;
+    unsigned int size;
+    unsigned int erase_size;
+    char *name;
+};
+
+struct MtdReadContext {
+    const MtdPartition *partition;
+    char *buffer;
+    size_t read_size;
+    size_t consumed;
+    int fd;
+};
+
+struct MtdWriteContext {
+    const MtdPartition *partition;
+    char *buffer;
+    size_t stored;
+    int fd;
+};
+
+typedef struct {
+    MtdPartition *partitions;
+    int partitions_allocd;
+    int partition_count;
+} MtdState;
+
+static MtdState g_mtd_state = {
+    NULL,   // partitions
+    0,      // partitions_allocd
+    -1      // partition_count
+};
+
+#define MTD_PROC_FILENAME   "/proc/mtd"
+
+int
+mtd_scan_partitions()
+{
+    char buf[2048];
+    const char *bufp;
+    int fd;
+    int i;
+    ssize_t nbytes;
+
+    if (g_mtd_state.partitions == NULL) {
+        const int nump = 32;
+        MtdPartition *partitions = malloc(nump * sizeof(*partitions));
+        if (partitions == NULL) {
+            errno = ENOMEM;
+            return -1;
+        }
+        g_mtd_state.partitions = partitions;
+        g_mtd_state.partitions_allocd = nump;
+        memset(partitions, 0, nump * sizeof(*partitions));
+    }
+    g_mtd_state.partition_count = 0;
+
+    /* Initialize all of the entries to make things easier later.
+     * (Lets us handle sparsely-numbered partitions, which
+     * may not even be possible.)
+     */
+    for (i = 0; i < g_mtd_state.partitions_allocd; i++) {
+        MtdPartition *p = &g_mtd_state.partitions[i];
+        if (p->name != NULL) {
+            free(p->name);
+            p->name = NULL;
+        }
+        p->device_index = -1;
+    }
+
+    /* Open and read the file contents.
+     */
+    fd = open(MTD_PROC_FILENAME, O_RDONLY);
+    if (fd < 0) {
+        goto bail;
+    }
+    nbytes = read(fd, buf, sizeof(buf) - 1);
+    close(fd);
+    if (nbytes < 0) {
+        goto bail;
+    }
+    buf[nbytes] = '\0';
+
+    /* Parse the contents of the file, which looks like:
+     *
+     *     # cat /proc/mtd
+     *     dev:    size   erasesize  name
+     *     mtd0: 00080000 00020000 "bootloader"
+     *     mtd1: 00400000 00020000 "mfg_and_gsm"
+     *     mtd2: 00400000 00020000 "0000000c"
+     *     mtd3: 00200000 00020000 "0000000d"
+     *     mtd4: 04000000 00020000 "system"
+     *     mtd5: 03280000 00020000 "userdata"
+     */
+    bufp = buf;
+    while (nbytes > 0) {
+        int mtdnum, mtdsize, mtderasesize;
+        int matches;
+        char mtdname[64];
+        mtdname[0] = '\0';
+        mtdnum = -1;
+
+        matches = sscanf(bufp, "mtd%d: %x %x \"%63[^\"]",
+                &mtdnum, &mtdsize, &mtderasesize, mtdname);
+        /* This will fail on the first line, which just contains
+         * column headers.
+         */
+        if (matches == 4) {
+            MtdPartition *p = &g_mtd_state.partitions[mtdnum];
+            p->device_index = mtdnum;
+            p->size = mtdsize;
+            p->erase_size = mtderasesize;
+            p->name = strdup(mtdname);
+            if (p->name == NULL) {
+                errno = ENOMEM;
+                goto bail;
+            }
+            g_mtd_state.partition_count++;
+        }
+
+        /* Eat the line.
+         */
+        while (nbytes > 0 && *bufp != '\n') {
+            bufp++;
+            nbytes--;
+        }
+        if (nbytes > 0) {
+            bufp++;
+            nbytes--;
+        }
+    }
+
+    return g_mtd_state.partition_count;
+
+bail:
+    // keep "partitions" around so we can free the names on a rescan.
+    g_mtd_state.partition_count = -1;
+    return -1;
+}
+
+const MtdPartition *
+mtd_find_partition_by_name(const char *name)
+{
+    if (g_mtd_state.partitions != NULL) {
+        int i;
+        for (i = 0; i < g_mtd_state.partitions_allocd; i++) {
+            MtdPartition *p = &g_mtd_state.partitions[i];
+            if (p->device_index >= 0 && p->name != NULL) {
+                if (strcmp(p->name, name) == 0) {
+                    return p;
+                }
+            }
+        }
+    }
+    return NULL;
+}
+
+int
+mtd_mount_partition(const MtdPartition *partition, const char *mount_point,
+        const char *filesystem, int read_only)
+{
+    const unsigned long flags = MS_NOATIME | MS_NODEV | MS_NODIRATIME;
+    char devname[64];
+    int rv = -1;
+
+    sprintf(devname, "/dev/block/mtdblock%d", partition->device_index);
+    if (!read_only) {
+        rv = mount(devname, mount_point, filesystem, flags, NULL);
+    }
+    if (read_only || rv < 0) {
+        rv = mount(devname, mount_point, filesystem, flags | MS_RDONLY, 0);
+        if (rv < 0) {
+            printf("Failed to mount %s on %s: %s\n",
+                    devname, mount_point, strerror(errno));
+        } else {
+            printf("Mount %s on %s read-only\n", devname, mount_point);
+        }
+    }
+#if 1   //TODO: figure out why this is happening; remove include of stat.h
+    if (rv >= 0) {
+        /* For some reason, the x bits sometimes aren't set on the root
+         * of mounted volumes.
+         */
+        struct stat st;
+        rv = stat(mount_point, &st);
+        if (rv < 0) {
+            return rv;
+        }
+        mode_t new_mode = st.st_mode | S_IXUSR | S_IXGRP | S_IXOTH;
+        if (new_mode != st.st_mode) {
+printf("Fixing execute permissions for %s\n", mount_point);
+            rv = chmod(mount_point, new_mode);
+            if (rv < 0) {
+                printf("Couldn't fix permissions for %s: %s\n",
+                        mount_point, strerror(errno));
+            }
+        }
+    }
+#endif
+    return rv;
+}
+
+int
+mtd_partition_info(const MtdPartition *partition,
+        size_t *total_size, size_t *erase_size, size_t *write_size)
+{
+    char mtddevname[32];
+    sprintf(mtddevname, "/dev/mtd/mtd%d", partition->device_index);
+    int fd = open(mtddevname, O_RDONLY);
+    if (fd < 0) return -1;
+
+    struct mtd_info_user mtd_info;
+    int ret = ioctl(fd, MEMGETINFO, &mtd_info);
+    close(fd);
+    if (ret < 0) return -1;
+
+    if (total_size != NULL) *total_size = mtd_info.size;
+    if (erase_size != NULL) *erase_size = mtd_info.erasesize;
+    if (write_size != NULL) *write_size = mtd_info.writesize;
+    return 0;
+}
+
+MtdReadContext *mtd_read_partition(const MtdPartition *partition)
+{
+    MtdReadContext *ctx = (MtdReadContext*) malloc(sizeof(MtdReadContext));
+    if (ctx == NULL) return NULL;
+
+    ctx->buffer = malloc(partition->erase_size);
+    if (ctx->buffer == NULL) {
+        free(ctx);
+        return NULL;
+    }
+
+    char mtddevname[32];
+    sprintf(mtddevname, "/dev/mtd/mtd%d", partition->device_index);
+    ctx->fd = open(mtddevname, O_RDONLY);
+    if (ctx->fd < 0) {
+        free(ctx);
+        free(ctx->buffer);
+        return NULL;
+    }
+
+    ctx->partition = partition;
+    ctx->read_size = partition->erase_size;
+    ctx->consumed = ctx->read_size;
+    return ctx;
+}
+
+static int read_block(const MtdReadContext *ctx, char *data)
+{
+    struct mtd_ecc_stats before, after;
+    off_t pos;
+    ssize_t size;
+
+    if (ioctl(ctx->fd, ECCGETSTATS, &before)) {
+        fprintf(stderr, "mtd: ECCGETSTATS error (%s)\n", strerror(errno));
+        return -1;
+    }
+
+    pos = lseek(ctx->fd, 0, SEEK_CUR);
+    size = ctx->read_size;
+
+    while (pos + size <= (int) ctx->partition->size) {
+        if (lseek(ctx->fd, pos, SEEK_SET) != pos || read(ctx->fd, data, size) != size) {
+            fprintf(stderr, "mtd: read error at 0x%08lx (%s)\n",
+                    pos, strerror(errno));
+        } else if (ioctl(ctx->fd, ECCGETSTATS, &after)) {
+            fprintf(stderr, "mtd: ECCGETSTATS error (%s)\n", strerror(errno));
+            return -1;
+        } else if (after.failed != before.failed) {
+            fprintf(stderr, "mtd: ECC errors (%d soft, %d hard) at 0x%08lx\n",
+                    after.corrected - before.corrected,
+                    after.failed - before.failed, pos);
+	    /*
+	     * Reset error counts, so next read may succeed.
+	     */
+	    before = after;
+        } else {
+            return 0;  // Success!
+        }
+
+        pos += ctx->read_size;
+    }
+
+    errno = ENOSPC;
+    return -1;
+}
+
+ssize_t mtd_read_data(MtdReadContext *ctx, char *data, size_t len)
+{
+    ssize_t read = 0;
+    while (read < (int) len) {
+        if (ctx->consumed < ctx->read_size) {
+            size_t avail = ctx->read_size - ctx->consumed;
+            size_t copy = len - read < avail ? len - read : avail;
+            memcpy(data + read, ctx->buffer + ctx->consumed, copy);
+            ctx->consumed += copy;
+            read += copy;
+        }
+
+        // Read complete blocks directly into the user's buffer
+        while (ctx->consumed == ctx->read_size &&
+               len - read >= ctx->read_size) {
+            if (read_block(ctx, data + read)) return -1;
+            read += ctx->read_size;
+        }
+
+        // Read the next block into the buffer
+        if (ctx->consumed == ctx->read_size && read < (int) len) {
+            if (read_block(ctx, ctx->buffer)) return -1;
+            ctx->consumed = 0;
+        }
+    }
+
+    return read;
+}
+
+ssize_t mtd_read_raw(MtdReadContext *ctx, char *data, size_t len)
+{
+    static const int SPARE_SIZE = (2048 >> 5);
+    struct mtd_info_user mtd_info;
+    struct mtd_oob_buf oob_buf;
+    struct nand_ecclayout ecc_layout;
+    struct nand_oobfree *fp;
+    unsigned char ecc[SPARE_SIZE];
+    char *src, *dst;
+    int i, n, ret;
+
+/*
+ * FIXME: These two ioctls should be cached in MtdReadContext.
+ */
+    ret = ioctl(ctx->fd, MEMGETINFO, &mtd_info);
+    if (ret < 0)
+        return -1;
+
+    ret = ioctl(ctx->fd, ECCGETLAYOUT, &ecc_layout);
+    if (ret < 0)
+        return -1;
+
+    ctx->read_size = mtd_info.writesize;
+    ctx->consumed = ctx->read_size;
+
+/*
+ * Read next good data block.
+ */
+    ret = read_block(ctx, data);
+    if (ret < 0)
+    	return -1;
+
+    dst = src = data + ctx->read_size;
+
+/*
+ * Read OOB data for last block read in read_block().
+ */
+    oob_buf.start = lseek(ctx->fd, 0, SEEK_CUR) - ctx->read_size;
+    oob_buf.length = mtd_info.oobsize;
+    oob_buf.ptr = (unsigned char *) src;
+
+    ret = ioctl(ctx->fd, MEMREADOOB, &oob_buf);
+    if (ret < 0)
+    	return -1;
+
+/*
+ * As yaffs and yaffs2 use mode MEM_OOB_AUTO, but mtdchar uses
+ * MEM_OOB_PLACE, copy the spare data down the hard way.
+ *
+ * Safe away ECC data:
+ */
+    for (i = 0; i < ecc_layout.eccbytes; i++) {
+    	ecc[i] = src[ecc_layout.eccpos[i]];
+    }
+    for ( ; i < SPARE_SIZE; i++) {
+    	ecc[i] = 0;
+    }
+
+/*
+ * Copy yaffs2 spare data down.
+ */
+    n = ecc_layout.oobavail;
+    fp = &ecc_layout.oobfree[0];
+    while (n) {
+    	if (fp->offset) {
+		memmove(dst, src + fp->offset, fp->length); 
+	}
+	dst += fp->length;
+	n -= fp->length;
+	++fp;
+    }
+
+/*
+ * Restore ECC data behind spare data.
+ */
+    memcpy(dst, ecc, (ctx->read_size >> 5) - ecc_layout.oobavail);
+
+    return ctx->read_size + (ctx->read_size >> 5);
+}
+
+void mtd_read_close(MtdReadContext *ctx)
+{
+    close(ctx->fd);
+    free(ctx->buffer);
+    free(ctx);
+}
+
+MtdWriteContext *mtd_write_partition(const MtdPartition *partition)
+{
+    MtdWriteContext *ctx = (MtdWriteContext*) malloc(sizeof(MtdWriteContext));
+    if (ctx == NULL) return NULL;
+
+    ctx->buffer = malloc(partition->erase_size);
+    if (ctx->buffer == NULL) {
+        free(ctx);
+        return NULL;
+    }
+
+    char mtddevname[32];
+    sprintf(mtddevname, "/dev/mtd/mtd%d", partition->device_index);
+    ctx->fd = open(mtddevname, O_RDWR);
+    if (ctx->fd < 0) {
+        free(ctx->buffer);
+        free(ctx);
+        return NULL;
+    }
+
+    ctx->partition = partition;
+    ctx->stored = 0;
+    return ctx;
+}
+
+static int write_block(const MtdPartition *partition, int fd, const char *data)
+{
+    off_t pos = lseek(fd, 0, SEEK_CUR);
+    if (pos == (off_t) -1) return 1;
+
+    ssize_t size = partition->erase_size;
+    while (pos + size <= (int) partition->size) {
+        loff_t bpos = pos;
+        if (ioctl(fd, MEMGETBADBLOCK, &bpos) > 0) {
+            fprintf(stderr, "mtd: not writing bad block at 0x%08lx\n", pos);
+            pos += partition->erase_size;
+            continue;  // Don't try to erase known factory-bad blocks.
+        }
+
+        struct erase_info_user erase_info;
+        erase_info.start = pos;
+        erase_info.length = size;
+        int retry;
+        for (retry = 0; retry < 2; ++retry) {
+            if (ioctl(fd, MEMERASE, &erase_info) < 0) {
+                fprintf(stderr, "mtd: erase failure at 0x%08lx (%s)\n",
+                        pos, strerror(errno));
+                continue;
+            }
+            if (lseek(fd, pos, SEEK_SET) != pos ||
+                write(fd, data, size) != size) {
+                fprintf(stderr, "mtd: write error at 0x%08lx (%s)\n",
+                        pos, strerror(errno));
+            }
+
+            char verify[size];
+            if (lseek(fd, pos, SEEK_SET) != pos ||
+                read(fd, verify, size) != size) {
+                fprintf(stderr, "mtd: re-read error at 0x%08lx (%s)\n",
+                        pos, strerror(errno));
+                continue;
+            }
+            if (memcmp(data, verify, size) != 0) {
+                fprintf(stderr, "mtd: verification error at 0x%08lx (%s)\n",
+                        pos, strerror(errno));
+                continue;
+            }
+
+            if (retry > 0) {
+                fprintf(stderr, "mtd: wrote block after %d retries\n", retry);
+            }
+            return 0;  // Success!
+        }
+
+        // Try to erase it once more as we give up on this block
+        fprintf(stderr, "mtd: skipping write block at 0x%08lx\n", pos);
+        ioctl(fd, MEMERASE, &erase_info);
+        pos += partition->erase_size;
+    }
+
+    // Ran out of space on the device
+    errno = ENOSPC;
+    return -1;
+}
+
+ssize_t mtd_write_data(MtdWriteContext *ctx, const char *data, size_t len)
+{
+    size_t wrote = 0;
+    while (wrote < len) {
+        // Coalesce partial writes into complete blocks
+        if (ctx->stored > 0 || len - wrote < ctx->partition->erase_size) {
+            size_t avail = ctx->partition->erase_size - ctx->stored;
+            size_t copy = len - wrote < avail ? len - wrote : avail;
+            memcpy(ctx->buffer + ctx->stored, data + wrote, copy);
+            ctx->stored += copy;
+            wrote += copy;
+        }
+
+        // If a complete block was accumulated, write it
+        if (ctx->stored == ctx->partition->erase_size) {
+            if (write_block(ctx->partition, ctx->fd, ctx->buffer)) return -1;
+            ctx->stored = 0;
+        }
+
+        // Write complete blocks directly from the user's buffer
+        while (ctx->stored == 0 && len - wrote >= ctx->partition->erase_size) {
+            if (write_block(ctx->partition, ctx->fd, data + wrote)) return -1;
+            wrote += ctx->partition->erase_size;
+        }
+    }
+
+    return wrote;
+}
+
+off_t mtd_erase_blocks(MtdWriteContext *ctx, int blocks)
+{
+    // Zero-pad and write any pending data to get us to a block boundary
+    if (ctx->stored > 0) {
+        size_t zero = ctx->partition->erase_size - ctx->stored;
+        memset(ctx->buffer + ctx->stored, 0, zero);
+        if (write_block(ctx->partition, ctx->fd, ctx->buffer)) return -1;
+        ctx->stored = 0;
+    }
+
+    off_t pos = lseek(ctx->fd, 0, SEEK_CUR);
+    if ((off_t) pos == (off_t) -1) return pos;
+
+    const int total = (ctx->partition->size - pos) / ctx->partition->erase_size;
+    if (blocks < 0) blocks = total;
+    if (blocks > total) {
+        errno = ENOSPC;
+        return -1;
+    }
+
+    // Erase the specified number of blocks
+    while (blocks-- > 0) {
+        loff_t bpos = pos;
+        if (ioctl(ctx->fd, MEMGETBADBLOCK, &bpos) > 0) {
+            fprintf(stderr, "mtd: not erasing bad block at 0x%08lx\n", pos);
+            pos += ctx->partition->erase_size;
+            continue;  // Don't try to erase known factory-bad blocks.
+        }
+
+        struct erase_info_user erase_info;
+        erase_info.start = pos;
+        erase_info.length = ctx->partition->erase_size;
+        if (ioctl(ctx->fd, MEMERASE, &erase_info) < 0) {
+            fprintf(stderr, "mtd: erase failure at 0x%08lx\n", pos);
+        }
+        pos += ctx->partition->erase_size;
+    }
+
+    return pos;
+}
+
+int mtd_write_close(MtdWriteContext *ctx)
+{
+    int r = 0;
+    // Make sure any pending data gets written
+    if (mtd_erase_blocks(ctx, 0) == (off_t) -1) r = -1;
+    if (close(ctx->fd)) r = -1;
+    free(ctx->buffer);
+    free(ctx);
+    return r;
+}
diff --git a/dump_image/mtdutils.h b/dump_image/mtdutils.h
new file mode 100644
index 0000000..4a35543
--- /dev/null
+++ b/dump_image/mtdutils.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MTDUTILS_H_
+#define MTDUTILS_H_
+
+#include <sys/types.h>  // for size_t, etc.
+
+typedef struct MtdPartition MtdPartition;
+
+int mtd_scan_partitions(void);
+
+const MtdPartition *mtd_find_partition_by_name(const char *name);
+
+/* mount_point is like "/system"
+ * filesystem is like "yaffs2"
+ */
+int mtd_mount_partition(const MtdPartition *partition, const char *mount_point,
+        const char *filesystem, int read_only);
+
+/* get the partition and the minimum erase/write block size.  NULL is ok.
+ */
+int mtd_partition_info(const MtdPartition *partition,
+        size_t *total_size, size_t *erase_size, size_t *write_size);
+
+/* read or write raw data from a partition, starting at the beginning.
+ * skips bad blocks as best we can.
+ */
+typedef struct MtdReadContext MtdReadContext;
+typedef struct MtdWriteContext MtdWriteContext;
+
+MtdReadContext *mtd_read_partition(const MtdPartition *);
+ssize_t mtd_read_data(MtdReadContext *, char *data, size_t data_len);
+ssize_t mtd_read_raw(MtdReadContext *, char *data, size_t data_len);
+void mtd_read_close(MtdReadContext *);
+
+MtdWriteContext *mtd_write_partition(const MtdPartition *);
+ssize_t mtd_write_data(MtdWriteContext *, const char *data, size_t data_len);
+off_t mtd_erase_blocks(MtdWriteContext *, int blocks);  /* 0 ok, -1 for all */
+int mtd_write_close(MtdWriteContext *);
+
+#endif  // MTDUTILS_H_
diff --git a/res/nandroid-mobile.sh b/res/nandroid-mobile.sh
new file mode 100755
index 0000000..9a9a824
--- /dev/null
+++ b/res/nandroid-mobile.sh
@@ -0,0 +1,293 @@
+#!/sbin/sh
+
+# nandroid v2.1 - an Android backup tool for the G1 by infernix and brainaid
+
+# Requirements:
+
+# - a modded android in recovery mode (JF 1.3 will work by default)
+# - adb shell as root in recovery mode if not using a pre-made recovery image
+# - busybox in recovery mode
+# - dump_image-arm-uclibc compiled and in path on phone
+# - mkyaffs2image-arm-uclibc compiled and installed in path on phone
+
+# Reference data:
+
+# dev:    size   erasesize  name
+#mtd0: 00040000 00020000 "misc"
+#mtd1: 00500000 00020000 "recovery"
+#mtd2: 00280000 00020000 "boot"
+#mtd3: 04380000 00020000 "system"
+#mtd4: 04380000 00020000 "cache"
+#mtd5: 04ac0000 00020000 "userdata"
+#mtd6 is everything, dump splash1 with: dd if=/dev/mtd/mtd6ro of=/sdcard/splash1.img skip=19072 bs=2048 count=150
+
+# We don't dump misc or cache because they do not contain any useful data that we are aware of at this time.
+
+# Logical steps (v2.1):
+#
+# 0.  test for a target dir and the various tools needed, if not found then exit with error.
+# 1.  check "adb devices" for a device in recovery mode. set DEVICEID variable to the device ID. abort when not found.
+# 2.  mount system and data partitions read-only, set up adb portforward and create destdir
+# 3.  check free space on /cache, exit if less blocks than 20MB free
+# 4.  push required tools to device in /cache
+# 5   for partitions boot recovery misc:
+# 5a  get md5sum for content of current partition *on the device* (no data transfered)
+# 5b  while MD5sum comparison is incorrect (always is the first time):
+# 5b1 dump current partition to a netcat session
+# 5b2 start local netcat to dump image to current dir
+# 5b3 compare md5sums of dumped data with dump in current dir. if correct, contine, else restart the loop (6b1)
+# 6   for partitions system data:
+# 6a  get md5sum for tar of content of current partition *on the device* (no data transfered)
+# 6b  while MD5sum comparison is incorrect (always is the first time):
+# 6b1 tar current partition to a netcat session
+# 6b2 start local netcat to dump tar to current dir
+# 6b3 compare md5sums of dumped data with dump in current dir. if correct, contine, else restart the loop (6b1)
+# 6c  if i'm running as root:
+# 6c1 create a temp dir using either tempdir command or the deviceid in /tmp
+# 6c2 extract tar to tempdir
+# 6c3 invoke mkyaffs2image to create the img
+# 6c4 clean up
+# 7.  remove tools from device /cache
+# 8.  umount system and data on device
+# 9.  print success.
+
+
+DEVICEID=foo
+RECOVERY=foo
+
+echo "nandroid-mobile v2.1"
+
+
+if [ "$1" == "" ]; then
+	echo "Usage: $0 {backup|restore} [/path/to/nandroid/backup/]"
+	echo "- backup will store a full system backup on /sdcard/nandroid/$DEVICEID"
+	echo "- restore path will restore the last made backup for boot, system, recovery and data"
+	exit 0
+fi
+
+case $1 in
+	backup)
+		mkyaffs2image=`which mkyaffs2image`
+		if [ "$mkyaffs2image" == "" ]; then
+			mkyaffs2image=`which mkyaffs2image-arm-uclibc`
+			if [ "$mkyaffs2image" == "" ]; then
+				echo "error: mkyaffs2image or mkyaffs2image-arm-uclibc not found in path"
+				exit 1
+			fi
+		fi
+		dump_image=`which dump_image`
+		if [ "$dump_image" == "" ]; then
+			dump_image=`which dump_image-arm-uclibc`
+			if [ "$dump_image" == "" ]; then
+				echo "error: dump_image or dump_image-arm-uclibc not found in path"
+				exit 1
+			fi
+		fi
+		break
+		;;
+	restore)
+		flash_image=`which flash_image`
+		if [ "$flash_image" == "" ]; then
+			flash_image=`which flash_image-arm-uclibc`
+			if [ "$flash_image" == "" ]; then
+				echo "error: flash_image or flash_image-arm-uclibc not found in path"
+				exit 1
+			fi
+		fi
+		break
+		;;
+esac
+
+# 1
+DEVICEID=`cat /proc/cmdline | sed "s/.*serialno=//" | cut -d" " -f1`
+RECOVERY=`cat /proc/cmdline | grep "androidboot.mode=recovery"`
+if [ "$RECOVERY" == "foo" ]; then
+	echo "error: not running in recovery mode, aborting"
+	exit 1
+fi
+if [ "$DEVICEID" == "foo" ]; then
+	echo "error: device id not found in /proc/cmdline, aborting"
+	exit 1
+fi
+if [ ! "`id -u 2>/dev/null`" == "0" ]; then
+	if [ "`whoami 2>&1 | grep 'uid 0'`" == "" ]; then
+		echo "error: must run as root, aborting"
+		exit 1
+	fi
+fi
+
+
+case $1 in
+	restore)
+		ENERGY=`cat /sys/class/power_supply/battery/capacity`
+		if [ "`cat /sys/class/power_supply/battery/status`" == "Charging" ]; then
+			ENERGY=100
+		fi
+		if [ ! $ENERGY -ge 30 ]; then
+			echo "Error: not enough battery power"
+			echo "Connect charger or USB power and try again"
+			exit 1
+		fi
+		RESTOREPATH=$2
+		if [ ! -f $RESTOREPATH/nandroid.md5 ]; then
+			echo "error: $RESTOREPATH/nandroid.md5 not found, cannot verify backup data"
+			exit 1
+		fi
+		umount /system 2>/dev/null
+		umount /data 2>/dev/null
+		if [ ! "`mount | grep data`" == "" ]; then
+			echo "error: unable to umount /data, aborting"	
+			exit 1
+		fi
+		if [ ! "`mount | grep system`" == "" ]; then
+			echo "error: unable to umount /system, aborting"	
+			exit 1
+		fi
+		
+		echo "Verifying backup images..."
+		CWD=$PWD
+		cd $RESTOREPATH
+		md5sum -c nandroid.md5
+		if [ $? -eq 1 ]; then
+			echo "error: md5sum mismatch, aborting"
+			exit 1
+		fi
+		for image in boot recovery; do
+			echo "Flashing $image..."
+			$flash_image $image $image.img
+		done
+		echo "Flashing system and data not currently supported"
+		echo "Restore done"
+		exit 0
+		;;
+	backup)
+		break
+		;;
+	*)
+		echo "Usage: $0 {backup|restore} [/path/to/nandroid/backup/]"
+		echo "- backup will store a full system backup on /sdcard/nandroid/$DEVICEID"
+		echo "- restore path will restore the last made backup for boot, system, recovery and data"
+		exit 1
+		;;
+esac
+
+# 2.
+echo "mounting system and data read-only, sdcard read-write"
+umount /system 2>/dev/null
+umount /data 2>/dev/null
+umount /sdcard 2>/dev/null
+mount -o ro /system || FAIL=1
+mount -o ro /data || FAIL=2
+mount /sdcard || mount /dev/block/mmcblk0 /sdcard || FAIL=3
+case $FAIL in
+	1) echo "Error mounting system read-only"; umount /system /data /sdcard; exit 1;;
+	2) echo "Error mounting data read-only"; umount /system /data /sdcard; exit 1;;
+	3) echo "Error mounting sdcard read-write"; umount /system /data /sdcard; exit 1;;
+esac
+
+TIMESTAMP="`date +%Y%m%d-%H%M`"
+DESTDIR="/sdcard/nandroid/$DEVICEID/$TIMESTAMP"
+if [ ! -d $DESTDIR ]; then 
+	mkdir -p $DESTDIR
+	if [ ! -d $DESTDIR ]; then 
+		echo "error: cannot create $DESTDIR"
+		umount /system 2>/dev/null
+		umount /data 2>/dev/null
+		umount /sdcard 2>/dev/null
+		exit 1
+	fi
+else
+	touch $DESTDIR/.nandroidwritable
+	if [ ! -e $DESTDIR/.nandroidwritable ]; then
+		echo "error: cannot write to $DESTDIR"
+		umount /system 2>/dev/null
+		umount /data 2>/dev/null
+		umount /sdcard 2>/dev/null
+		exit 1
+	fi
+	rm $DESTDIR/.nandroidwritable
+fi
+
+# 3.
+echo "checking free space on sdcard"
+FREEBLOCKS="`df -k /sdcard| grep sdcard | awk '{ print $4 }'`"
+# we need about 130MB for the dump
+if [ $FREEBLOCKS -le 130000 ]; then
+	echo "error: not enough free space available on sdcard (need 130mb), aborting."
+	umount /system 2>/dev/null
+	umount /data 2>/dev/null
+	umount /sdcard 2>/dev/null
+	exit 1
+fi
+
+
+
+if [ -e /dev/mtd/mtd6ro ]; then
+	echo -n "Dumping splash1 from device over tcp to $DESTDIR/splash1.img..."
+	dd if=/dev/mtd/mtd6ro of=$DESTDIR/splash1.img skip=19072 bs=2048 count=150 2>/dev/null
+	echo "done"
+	sleep 1s
+	echo -n "Dumping splash2 from device over tcp to $DESTDIR/splash2.img..."
+	dd if=/dev/mtd/mtd6ro of=$DESTDIR/splash2.img skip=19456 bs=2048 count=150 2>/dev/null
+	echo "done"
+fi
+
+
+# 5.
+for image in boot recovery misc; do
+	# 5a
+	DEVICEMD5=`$dump_image $image - | md5sum | awk '{ print $1 }'`
+	sleep 1s
+	MD5RESULT=1
+	# 5b
+	echo -n "Dumping $image to $DESTDIR/$image.img..."
+	ATTEMPT=0
+	while [ $MD5RESULT -eq 1 ]; do
+		let ATTEMPT=$ATTEMPT+1
+		# 5b1
+		$dump_image $image $DESTDIR/$image.img 
+		sync
+		# 5b3
+		echo "${DEVICEMD5}  $DESTDIR/$image.img" | md5sum -c -s -
+		if [ $? -eq 1 ]; then
+			true
+		else
+			MD5RESULT=0
+		fi
+		if [ "$ATTEMPT" == "5" ]; then
+			echo "fatal error while trying to dump $image, aborting"
+			umount /system
+			umount /data
+			umount /sdcard
+			exit 1
+		fi
+	done
+	echo "done"
+done
+
+# 6
+for image in system data cache; do
+	# 6a
+	echo -n "Dumping $image to $DESTDIR/$image.img..."
+	$mkyaffs2image /$image $DESTDIR/$image.img
+	sync
+	echo "done"
+done
+
+
+# 7.
+echo -n "generating md5sum file..."
+CWD=$PWD
+cd $DESTDIR
+md5sum *img > nandroid.md5
+cd $CWD
+echo "done"
+
+# 8.
+echo "unmounting system, data and sdcard"
+umount /system
+umount /data
+umount /sdcard
+
+# 9.
+echo "Backup successful."