Related
I can't seem to get the boot.img file to unpack, regardless of what tool I use or what os. I typically get the results below. the long term goal is to edit the boot.img to allow the next7p to use ext3 /system as opposed to cramfs, and give full read/write. It has been done by Wendal Chen on a different but similar tablet. (Both are rk29xx tablets.)
Any help would be appreciated.
I have been able to create a "custom" rom, which has root and SU, but you cannot write to the /system.
the boot.img from my custom rom is 598k The boot.img pulled from the tablet
is 4096K i get the same issues from both.
Code:
Welcome to the ZTE Racer kitchen by TigTex!
If you aren't using Windows XP, you might need to run this as admin
Make sure you have boot.img on the same folder as this file
Press 1 to decompress the ramdisk and kernel from boot.img
Press 2 to build the boot.img from the ramdisk folder and boot.img-kerne
Press q to exit
Type 1,2 or q and press ENTER: 1
Android Magic not found in boot.img. Giving up.
******kernel and ramdisk extracted!******
* Kernel is the "boot.img-kernel" file *
* Ramdisk is on gzip + cpio *
* YOU CAN ONLY EDIT RAMDISK ON LINUX *
* original img backed up as oldboot.img *
*****************************************
Press 1 to decompress the ramdisk and kernel from boot.img
Press 2 to build the boot.img from the ramdisk folder and boot.img-kerne
Press q to exit
Type 1,2 or q and press ENTER:
Ok so let's try the android kitchen
Here is the show boot.img information
Code:
Working folder's boot.img information
-------------------------------------
Kernel Size : 559903 bytes
Kernel Base Address : 0x00000000
Ramdisk Size : 2090599168 bytes
Ramdisk Load Address : 0x65545c0b
Second Stage Size : 779876570 bytes
Second Stage Load Address : 0xe1906573
Page Size : 84348953 bytes
ASCIIZ Product Name : (None)
Command Line: (None)
Press Enter to continue
And now the attempt to extract first using w option...
Code:
Working folder found
Android header not found at start of boot.img
Warning: Android header not located anywhere in boot.img
Kernel found at offset 84348953 in boot.img
Making folder BOOT-EXTRACTED ...
Extracting kernel ...
Extracting ramdisk ...
Error: No ramdisk folder found!
Press Enter to continue
Ok so lets try the other option in the menu.
Code:
Press Enter to continue
Android header not found at start of boot.img
Warning: Android header not located anywhere in boot.img
Kernel found at offset 84348953 in boot.img
Extracting kernel ...
Extracting ramdisk ...
Error: No ramdisk folder found!
Contents of bootimg_010612_234100:
total 0
-rw-r--r-- 1 0 2012-01-06 23:41 zImage
Press Enter to continue
The zImage file it writes is 0k in size.
Here is the first line from the boot.img looking at it in the hexeditor.
Code:
00000000 4b 52 4e 4c 3a 93 08 00 1f 8b 08 00 00 00 00 00 KRNL:"...<......
From what I have read the kernel is supposedly starting at 1f 8b.....
getting the error that the Ramdisk is not there, it is almost like it is not a complete boot.img file. More so if I look at boot.img in a hexeditor and lookup that address. (Sigh) I keep plugging away.
any help is appreciated.
Dochoppy said:
I can't seem to get the boot.img file to unpack, regardless of what tool I use or what os. I typically get the results below. the long term goal is to edit the boot.img to allow the next7p to use ext3 /system as opposed to cramfs, and give full read/write. It has been done by Wendal Chen on a different but similar tablet. (Both are rk29xx tablets.)
Any help would be appreciated.
I have been able to create a "custom" rom, which has root and SU, but you cannot write to the /system.
the boot.img from my custom rom is 598k The boot.img pulled from the tablet
is 4096K i get the same issues from both.
Code:
Welcome to the ZTE Racer kitchen by TigTex!
If you aren't using Windows XP, you might need to run this as admin
Make sure you have boot.img on the same folder as this file
Press 1 to decompress the ramdisk and kernel from boot.img
Press 2 to build the boot.img from the ramdisk folder and boot.img-kerne
Press q to exit
Type 1,2 or q and press ENTER: 1
Android Magic not found in boot.img. Giving up.
******kernel and ramdisk extracted!******
* Kernel is the "boot.img-kernel" file *
* Ramdisk is on gzip + cpio *
* YOU CAN ONLY EDIT RAMDISK ON LINUX *
* original img backed up as oldboot.img *
*****************************************
Press 1 to decompress the ramdisk and kernel from boot.img
Press 2 to build the boot.img from the ramdisk folder and boot.img-kerne
Press q to exit
Type 1,2 or q and press ENTER:
Ok so let's try the android kitchen
Here is the show boot.img information
Code:
Working folder's boot.img information
-------------------------------------
Kernel Size : 559903 bytes
Kernel Base Address : 0x00000000
Ramdisk Size : 2090599168 bytes
Ramdisk Load Address : 0x65545c0b
Second Stage Size : 779876570 bytes
Second Stage Load Address : 0xe1906573
Page Size : 84348953 bytes
ASCIIZ Product Name : (None)
Command Line: (None)
Press Enter to continue
And now the attempt to extract first using w option...
Code:
Working folder found
Android header not found at start of boot.img
Warning: Android header not located anywhere in boot.img
Kernel found at offset 84348953 in boot.img
Making folder BOOT-EXTRACTED ...
Extracting kernel ...
Extracting ramdisk ...
Error: No ramdisk folder found!
Press Enter to continue
Ok so lets try the other option in the menu.
Code:
Press Enter to continue
Android header not found at start of boot.img
Warning: Android header not located anywhere in boot.img
Kernel found at offset 84348953 in boot.img
Extracting kernel ...
Extracting ramdisk ...
Error: No ramdisk folder found!
Contents of bootimg_010612_234100:
total 0
-rw-r--r-- 1 0 2012-01-06 23:41 zImage
Press Enter to continue
The zImage file it writes is 0k in size.
Here is the first line from the boot.img looking at it in the hexeditor.
Code:
00000000 4b 52 4e 4c 3a 93 08 00 1f 8b 08 00 00 00 00 00 KRNL:"...<......
From what I have read the kernel is supposedly starting at 1f 8b.....
getting the error that the Ramdisk is not there, it is almost like it is not a complete boot.img file. More so if I look at boot.img in a hexeditor and lookup that address. (Sigh) I keep plugging away.
any help is appreciated.
Click to expand...
Click to collapse
Dsixda's kitchen has this feature, (un/re-pack) boot.img built in. Makes for very easy editing. Also helps for making your ROM.
Sent from my PC36100 using xda premium
jamieg71 said:
Dsixda's kitchen has this feature, (un/re-pack) boot.img built in. Makes for very easy editing. Also helps for making your ROM.
Sent from my PC36100 using xda premium
Click to expand...
Click to collapse
That's what he said he used, but the kitchen does not support boot.img of his device's format. A lot of the cheaper tablets use a special format but I have seen Wiki guides on how they are built and extracted.
Any chance you know a link to one of the guides? I will also start searching on like tablets.
Dochoppy said:
Any chance you know a link to one of the guides? I will also start searching on like tablets.
Click to expand...
Click to collapse
Google for the "cmp738a" by Craig. It's a really ****ty tablet that I owned for one day. It uses cramfs like yours, and there are some links on how to unpack and create a ROM. Use terms like "cmp738a unpack ROM"
Dsixda: First thanks for your kitchen tool really it is a great piece of work, I am sure you are under appreciated for it.
After you told me to do some searches I did, then I looked back over everything I had been reading.
I can say I feel like an idiot. I was letting the big picture blot out the details so to speak.
Almost literally all I had to do was remove 3-4 bytes from the header, and ungzip the file...cpio etc etc.
I was stuck in the train of thought that I had to "unpack the boot.img" file first, then ungzip it...
Dochoppy said:
Dsixda: First thanks for your kitchen tool really it is a great piece of work, I am sure you are under appreciated for it.
After you told me to do some searches I did, then I looked back over everything I had been reading.
I can say I feel like an idiot. I was letting the big picture blot out the details so to speak.
Almost literally all I had to do was remove 3-4 bytes from the header, and ungzip the file...cpio etc etc.
I was stuck in the train of thought that I had to "unpack the boot.img" file first, then ungzip it...
Click to expand...
Click to collapse
You mean it's like any other boot.img except for the extra bytes at the beginning and a different header (instead of "ANDROID!" - the actual header the kitchen looks for)?
Well yes and no. The kitchen still does not extract the boot.img correctly, zImage is created as a 0k file, and the ramdisk is still not extracted.
Ok I am still missing something here.
Ok I am still missing something here.
dsixda-
Could you take a look at the boot.img file and tell me what I may be missing?
http://www.mediafire.com/?n9an9o5vmjida1c
I would appreciate it very much.
Dochoppy said:
Ok I am still missing something here.
dsixda-
Could you take a look at the boot.img file and tell me what I may be missing?
http://www.mediafire.com/?n9an9o5vmjida1c
I would appreciate it very much.
Click to expand...
Click to collapse
It's not going to work in the kitchen, what are you trying to do? It is missing the "ANDROID!" magic header and the rest of the file is in a garbled format. You'll need to Google for the solution for your device. I can't offer much help, sorry.
I understand that much. When you do a file boot.img command in linux it just comes back as DATA.
I'm not so much concerned with being able to use the kitchen on it as just being able to unpack and pack the file correctly, and completely.
Thanks for taking a peak at it.
Can you upload to dropbox and let me know. I was working on an experimental tool to do this, so an unknown device would be good to check.. I might be some time in getting back to you though
Sent from my HTC Desire using Tapatalk
Droidzone-
Drop box link
http://dl.dropbox.com/u/56600275/boot.img
Media fire link if that doesn't work.
http://www.mediafire.com/?n9an9o5vmjida1c
Thanks for taking a peak.
Could you also provide the full name of the tablet, manufacturer, and possibly a link to the device?
The tablet in question is the nextbook 7 premium
marketed in the US by E-fun. Website is www.nextbookusa.com
on the front of the page there is a link to the latest firmware which the current version of DocHoppy Rom is based on.
Thanks again for taking a peak at it.
I know this much, the boot.img file it's self once unpacked from the update.img file
is a gziped cpio file, with odd header and footer bits. I have been able to unpack the file (removing header info to make it gzip recognizable), and then using 7zip of all things to unpack the cpio portion. That is where I get hung up at. I need to unpack it correctly so it can be rebuilt correctly. By doing it the way I have, you can't rebuild the file properly.
Update:
After alot of research, and trial and error, I was able to correctly unpack and repack the boot.img. I flashed the repack to my tablet, and successfully booted.
Next step is to modify init.rc and convert /system to ext3.
I will keep you posted.
Do document what you did so that it helps someone else later
Sent from my HTC Desire using Tapatalk
I'm having a similar problem, posted about here. I don't understand why the Android magic number isn't making it into my kernel. I thought the kernel compile would be straightforward, but sheesh...
Dochoppy said:
Update:
After alot of research, and trial and error, I was able to correctly unpack and repack the boot.img. I flashed the repack to my tablet, and successfully booted.
Next step is to modify init.rc and convert /system to ext3.
I will keep you posted.
Click to expand...
Click to collapse
Hi, i am trying to extract a boot.img without the Android header too. What have you done to extract it?
Regards.
Hi there!
Currently I am trying to extract and modify a boot.img from my car stereo (to set ro.secure=0 in default.prop - its a AV7) from MIC. ( http://www.shop.mic-deutschland.de/shop/article_W005/AV7.html?shop_param=cid=6&aid=W005& )
I did my exercises by studying the specs of a normal boot.img and learned that there should be a 2k header, followed by the gzipped kernel. I should be able to identify the kernel starting after those 2k of header and ending with some zeros finished with 1F 8B. The rest should be the ramdisk, gzipped and cpioed.
So far the theory - but apparently, I am not able to extract the kernel. I also tried some different scripts floating around - none of them ended up with an extractable kernel.
Example:
/unpackbootimg -i ../boot.img -o .
BOARD_KERNEL_CMDLINE
BOARD_KERNEL_BASE e3e0ff00
BOARD_PAGE_SIZE 1768697202
-> Kernel size 0, pretty everything ends up in the ramdisk which is NOT a gzip file.
This is the boot.img: http://ul.to/ivggomon
So you see me pretty clueless at the moment - any suggestion is highly appreciated!
Noone any idea?
unmkbootimg output:
Code:
unmkbootimg version 1.2 - Mikael Q Kuisma <[email protected]>
File ../boot.img not a plain boot image, seeking for embedded image ... not found.
boot_info (from bootimg_Toolset):
.
Code:
/boot_info ../boot.img
Android Magic not found in ../boot.img. Giving up.
The hread may be deleted. It was a uImage multi file with a gzipped cpio in it...
Recently purchased an iplay 7t after reading the xda review. This is replacing an LG v400 tablet that I had rooted. I updated the iplay to build T701_V1.20_20191112, enabled developer options, enabled oem unlock bootloader, found the corresponding firmware pac, installed magisk and used it to patch boot.img. So far so good.
I entered fastboot, then I attempted to flash the modified boot.img and was told:
Code:
target didn't report max-download-size
sending 'boot' (18584 KB)...
OKAY [ 0.593s]
writing 'boot'...
FAILED (remote: Flashing Lock Flag is locked. Please unlock it first!)
finished. total time: 0.608s
I tried various options to unlock the bootloader:
Code:
> fastboot getvar unlocked
unlocked:
finished. total time: -0.000s
> fastboot oem unlock
...
FAILED (remote: unknown cmd.)
finished. total time: -0.000s
> fastboot oem unlock-go
...
FAILED (remote: unknown cmd.)
finished. total time: 0.002s
> fastboot flashing get_unlock_ability
...
FAILED (remote: Not implement.)
finished. total time: -0.000s
> fastboot flashing unlock
...
FAILED (remote: Not implemet.)
finished. total time: -0.000s
> fastboot flashing unlock_critical
...
FAILED (remote: Not implement.)
finished. total time: 0.016s
> fastboot flashing unlock_bootloader
fastboot: usage: unknown 'flashing' command unlock_bootloader
> fastboot flashing unlock_bootloader_nonce
fastboot: usage: unknown 'flashing' command unlock_bootloader_nonce
Okay ... fine. I fired up SPD Research tool and attempted to use it to flash the modified boot.img. It transfers the image and then times out.
As a sanity check I used SPD Research tool to flash the original boot.img and that worked fine.
I'll note the modified image is smaller than the original, however padding the modified image with zeros to the same size didn't seem to help. Using SPD Research tool to flash the padded image still timed out.
I am looking to open a request up on the Alldocube support site (currently their registration form is giving me an error), in the meantime ... suggestions? Has anyone successfully flashed a modified boot.img on this device / rooted this device?
in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.
DR.Doyle said:
in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.
Click to expand...
Click to collapse
Yes ... I have that enabled.
Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.
jwehle said:
Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.
Click to expand...
Click to collapse
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.
wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery.
Click to expand...
Click to collapse
Thanks for supplying the modified PAC and for explaining the changes.
Your PAC seemed to work fine and now that I have a better understanding
of things I should be able build my own PAC when I have a chance.
Your time and effort in explaining things is appreciated.
What's the significance of removing the encryption for the vendor partitions?
jwehle said:
What's the significance of removing the encryption for the vendor partitions?
Click to expand...
Click to collapse
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
fstab.sp9832e_1h10：
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="DarkOrange"]fileencryption[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]fileencryption[/COLOR]=aes-256-xts
---------->
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts
wangyiling said:
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
Click to expand...
Click to collapse
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.
jwehle said:
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.
Click to expand...
Click to collapse
Just for twrp to read the data partition, convenient for personal use。
It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Code:
vbmeta
boot
recovery
What was happening is when the system started normally it saw that recovery image had been modified so it checked if the boot image was the factory standard image. Since I hadn't touched the boot image the OS went ahead and attempted to replace the recovery image I flashed with a standard recovery image generated on the fly from the factory standard boot image. This caused a soft-brick when I rebooted into recovery since that recovery image wasn't signed using the public key specified by my replacement vbmeta.
By also flashing a newly signed boot image because the signature is different from what's it knows about the system no longer attempts to use it to refresh the recovery image.
Here's an outline of what I did to successfully root the device:
Use the Qin 2 Pro instructions / tools to unlock the boot loader.
Flash the appropriate factory standard firmware to establish a know starting point. I used iplay7t(T701)-Android9.0-ALLDOCUBE-191112 from the Alldocube web site.
Use SPD Rsearch Tool to extract vbmeta-sign.img, boot.img, and recovery.img.
Use avbtool (with the below patch) to extract the public keys from vbmeta-sign.img like so:
Code:
avbtool info_image --image vbmeta-sign.img.
Use make (with the below makefile) to sign vbmeta, boot, and recovery using a new key.
Flashed vbmeta, boot, and recovery.
Booted into recovery, saw that it worked, and did a factory reset.
Used magisk to patch recovery.img in the normal fashion, signed the patched recovery using the new key, and flashed the patched recovery.
Proceed to finish installing magisk in the normal fashion.
Notes:
rsa4096_vbmeta.pem is the private key mentioned in the Qin 2 Pro article.
The dhtbsign-vbmeta command is basically the dhtb signing python script from Qin 2 Pro article.
Here's the trival patch for avbtool to dump the public keys.
Code:
--- avbtool 2020-02-22 22:11:55.107787032 -0500
+++ avbtool.dumpkeys 2020-02-22 22:15:36.046283077 -0500
@@ -1657,6 +1657,10 @@ class AvbChainPartitionDescriptor(AvbDes
Arguments:
o: The object to write the output to.
"""
+ kfd = open(self.partition_name, "w");
+ kfd.write(self.public_key);
+ kfd.close();
+
o.write(' Chain Partition descriptor:\n')
o.write(' Partition Name: {}\n'.format(self.partition_name))
o.write(' Rollback Index Location: {}\n'.format(
Here's the makefile I used for signing the images.
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: Makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
dhtbsign-vbmeta vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
avbtool add_hash_footer --image recovery-sign.img \
--partition_name recovery --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
@ jwehle，Very grateful for your detailed sharing
Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.
MissAyako said:
Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.
Click to expand...
Click to collapse
Seems the issue was with Windows. I thought I would be able to get the unlock token with Windows and then use WSL to do the rest of the signing, but apparently not.
Luckily I had an old laptop lying around. I threw Linux Mint on it and it worked just fine.
It didn't seem to work just using a live USB; I had to install Linux to the hard disk, but YMMV.
jwehle said:
It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Click to expand...
Click to collapse
This was wonderful, thank you! I've added some of my own notes below as an experience of what I encountered when attempting this process myself (spoiler'd because it is a lot).
I do not have enough post count to add links, but titles to the relevant articles has been added.
Follow steps in Article "Guide: How to Unlock Xiaomi Qin 2 (Pro) and Install Custom ROMs" from step 1 to (and including) step 10 (Unlocking section).
Notes:
- A Linux PC is necessary.
- You'll have to mark the "fastboot" file from the "Android_device_unlock.rar" archive as executable (chmod +x).
- Run the "fastboot" file as root.
- Getting the "SPD Research Tool" to pick up the tablet and not let the tablet try to move to either the charging
screen or the bootlogo is difficult, but do-able. Press and hold Power+Vol_Up and release when Windows does its
USB device detected chime.
- Flashing takes a few minutes (I think around 300 seconds).
- The SPD Research Tool extracts the PAC file contents into a folder. Grab the system images from there.
- The "avbtool" is available to be cloned via git from Google's repo
- The avbtool is a python script that is patched with three lines of code at line 1776:
Code:
kfd = open(self.partition_name, "w");
kfd.write(self.public_key);
kfd.close();
- When you use the patched avbtool on the vbmeta-sign.img file you copied (avbtool info_image --image vbmeta-sign.img)
it will produce several partitions with relative public keys that need to be stored in separate files for the next step.
The contents of the files are simply the public key and the partition name as the file name. Store the files in a folder named "keys".
- When creating the makefile, ensure that proper indentation is used. The code segment below is properly formatted (hopefully). If you get make errors, remove and re-indent the lines.
- If your "rsa4096_vbmeta.pem" keyfile is not placed alongside the makefile, ensure the --key flag points to this file.
- The makefile exists in the same directory as the system images.
- I had to insert local paths to the avbtool, as it was not installed to the system PATH.
- The dhtbsign-vbmeta.py command is located below. Make sure to mark this as executable as well.
Everything else is rather straightforward.
# makefile
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
./dhtbsign-vbmeta.py vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
# dhtbsign-vbmeta.py file (from "How I Unlocked Xiaomi Qin 2 Pro and Installed Phh GSI")
Code:
#!/usr/bin/env python
import hashlib
import sys
f = open(sys.argv[1], "rb")
b = f.read()
sha = hashlib.sha256(b).digest()
f.close()
f = open("vbmeta_signed.img", "wb")
f.write(b)
f.seek(1048576 - 512)
f.write(b'\x44\x48\x54\x42\x01\x00\x00\x00')
f.write(sha)
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')
f.seek(1048576 - 1)
f.write(b'\x00')
f.close()
wuxianlin has build a twrp device for T701.
i think this will be a help .
Help me
Sir help pliz same problem my device ,same chipset , Symphony i95 ,pliz sir modify my pac file pliz....
wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.
Click to expand...
Click to collapse
can i just flash the pac without unlocking the bootloader.
thanks in advances
hidroela said:
can i just flash the pac without unlocking the bootloader.
thanks in advances
Click to expand...
Click to collapse
yes,just falsh pac
wangyiling said:
yes,just falsh pac
Click to expand...
Click to collapse
i did unlocked the bootloader and flash the pac and follow the instructions for magisk to work, but after a third reboot Root was gone.
i don't know what I am missing.
Hi
I try to modding the official ROM of Armon 11T and modify the super.img partition.
I use this guide:
Editing system.img inside super.img and flashing our modifications
I'm trying to modify my system.img (/system/build.prop) to include support for multi users. After struggling a lot, I've succeeded following your guide (that's an awesome work btw) to unpack, mount, modify, umount and repack super.img. Then...
forum.xda-developers.com
I unpack super.img and the the super.ext4.img contaings 6 partitions:
- system_a.img
- system_b.img
- vendor_a.img
- vendor_b.img (0 byte)
- product_a.img
- product_b.img (0 byte)
If i resize a single image, for example system_a.img :
- fallocate -l 2G system_a.img
- resize2fs system_a.img 2G
Only doing
- resize2fs system_a.img 2G
The original size of system_a.img change.
Then i repack the super.img using lpmake command.
If i reflash the ROM on device this starting but during boot i have the error "device is corrupt".
Where i wrong?
Can you help me please?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Disclaimer:
The user takes sole responsibility for any damage that might arise due to use of this tool.
This includes physical damage (to device), injury, data loss, and also legal matters.
This project was made as a learning initiative and the developer or organization cannot be held liable in any way for the use of it.
Click to expand...
Click to collapse
Kitchen for working with Amlogic firmwareUsed for unpacking/packing amlogic images
Supported features
Unpack/repack Amlogic images
Unpack/repack partitions (system,product,system_ext,oem and odm)
Create flashable zip from amlogic image
Unpack/repack recovery,boot,logo and dtb
Create aml image from supported flashable zips
Support for super image unpack/repack
Dump os from device through /mask mode
Note:
Ignore some errors with dtb (some conditions are missing), decompiling/compiling dtb should work fine.
This tool is tested only in some firmwares and devices.
Theres no guarantee that packed flashable zips or amlogic images will flash successfully.
TODO:
....
Download : https://github.com/althafvly/AmlogicKitchen
Report issues: https://github.com/althafvly/AmlogicKitchen/issues
Flash-tool : https://github.com/althafvly/aml-flash-tool (Use Amlogic USB Burning Tool on windows)
Credits:
Base kitchen (vtx_kitchen) - Vortex
gnuwin32 and cygwin for linux binary ports
aml update tool - osmc
7-Zip - Igor Pavlov
ImgExtractor - unix3dgforce, blackeange and xiaoxindada
AIK - osm0sis
SuperImage tools - LonelyFool
Aml dtb, unpack tools - LineageOS
simg2img - anestisb
img2sdat, sdat2img - xpirt
simg2img - A.S._id
let me know if i missed anyone
Contribution:
If you want to contribute or fix something i broke, just fork and give a pull request with your changes
Support:
XDA is preferred for main discussion. But if you need any other support, check support group.
Reserved
How can I download it? It seems very similar to Vortex's kitchen.
kalehrl said:
How can I download it? It seems very similar to Vortex's kitchen.
Click to expand...
Click to collapse
You can clone the repo or download as zip from github. Yes this was done on top of vtx_kitchen
I just tried it. I unpacked level1 fine. When I tried level2, the terminal window didn't open. I realised I needed python for Windows so I installed it and level2 unpacked fine. Maybe add a notification to install Python. Level3 unpacked boot, logo and recovery but no dtb:
Spoiler: level3
1 file(s) copied.
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers
Supplied image: recovery.img
Setting up work folders . . .
Image type: AOSP
Splitting image to "split_img/" . . .
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=userdebug
BOARD_KERNEL_BASE 0x01078000
BOARD_NAME
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0xfff88000
BOARD_SECOND_OFFSET 0xffe88000
BOARD_TAGS_OFFSET 0xfef88100
BOARD_OS_VERSION 9.0.0
BOARD_OS_PATCH_LEVEL 2018-08
BOARD_HEADER_VERSION 1
BOARD_RECOVERY_DTBO_SIZE 438
BOARD_RECOVERY_DTBO_OFFSET 15835136
BOARD_HEADER_SIZE 1648
Unpacking ramdisk to "ramdisk/" . . .
Compression used: gzip
20266 blocks
Done!
Failed
1 dir(s) moved.
1 dir(s) moved.
1 file(s) copied.
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers
Supplied image: boot.img
Setting up work folders . . .
Image type: AOSP
Splitting image to "split_img/" . . .
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=userdebug
BOARD_KERNEL_BASE 0x01078000
BOARD_NAME
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0xfff88000
BOARD_SECOND_OFFSET 0xffe88000
BOARD_TAGS_OFFSET 0xfef88100
BOARD_OS_VERSION 9.0.0
BOARD_OS_PATCH_LEVEL 2018-08
BOARD_HEADER_VERSION 1
BOARD_HEADER_SIZE 1648
Warning: No ramdisk found to be unpacked!
Done!
Failed
1 dir(s) moved.
1 dir(s) moved.
dbg:res-img ver is 0x2
dbg:item level3\logo/bootup
dbg:item level3\logo/bootup_X3
dbg:item level3\logo/upgrade_bar
dbg:item level3\logo/upgrade_error
dbg:item level3\logo/upgrade_fail
dbg:item level3\logo/upgrade_logo
dbg:item level3\logo/upgrade_success
dbg:item level3\logo/upgrade_unfocus
dbg:item level3\logo/upgrade_upgrading
FATAL ERROR: Blob has incorrect magic number
Done.
Press any key to continue . . .
I tried _pack_zip_to_aml.bat but it says to install python from Microsoft store. I uninstalled the existing python, installed python 3.10 from MS store but it still doesn't work.
kalehrl said:
I just tried it. I unpacked level1 fine. When I tried level2, the terminal window didn't open. I realised I needed python for Windows so I installed it and level2 unpacked fine. Maybe add a notification to install Python. Level3 unpacked boot, logo and recovery but no dtb:
Spoiler: level3
1 file(s) copied.
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers
Supplied image: recovery.img
Setting up work folders . . .
Image type: AOSP
Splitting image to "split_img/" . . .
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=userdebug
BOARD_KERNEL_BASE 0x01078000
BOARD_NAME
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0xfff88000
BOARD_SECOND_OFFSET 0xffe88000
BOARD_TAGS_OFFSET 0xfef88100
BOARD_OS_VERSION 9.0.0
BOARD_OS_PATCH_LEVEL 2018-08
BOARD_HEADER_VERSION 1
BOARD_RECOVERY_DTBO_SIZE 438
BOARD_RECOVERY_DTBO_OFFSET 15835136
BOARD_HEADER_SIZE 1648
Unpacking ramdisk to "ramdisk/" . . .
Compression used: gzip
20266 blocks
Done!
Failed
1 dir(s) moved.
1 dir(s) moved.
1 file(s) copied.
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers
Supplied image: boot.img
Setting up work folders . . .
Image type: AOSP
Splitting image to "split_img/" . . .
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=userdebug
BOARD_KERNEL_BASE 0x01078000
BOARD_NAME
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0xfff88000
BOARD_SECOND_OFFSET 0xffe88000
BOARD_TAGS_OFFSET 0xfef88100
BOARD_OS_VERSION 9.0.0
BOARD_OS_PATCH_LEVEL 2018-08
BOARD_HEADER_VERSION 1
BOARD_HEADER_SIZE 1648
Warning: No ramdisk found to be unpacked!
Done!
Failed
1 dir(s) moved.
1 dir(s) moved.
dbg:res-img ver is 0x2
dbg:item level3\logo/bootup
dbg:item level3\logo/bootup_X3
dbg:item level3\logo/upgrade_bar
dbg:item level3\logo/upgrade_error
dbg:item level3\logo/upgrade_fail
dbg:item level3\logo/upgrade_logo
dbg:item level3\logo/upgrade_success
dbg:item level3\logo/upgrade_unfocus
dbg:item level3\logo/upgrade_upgrading
FATAL ERROR: Blob has incorrect magic number
Done.
Press any key to continue . . .
I tried _pack_zip_to_aml.bat but it says to install python from Microsoft store. I uninstalled the existing python, installed python 3.10 from MS store but it still doesn't work.
Click to expand...
Click to collapse
i have made some changes now. download or pull from git and check. fixed python missing error not showing in windows. if its still not extracting your dtb then, link me you firmware or _aml_dtb.PARTITION
I reinstalled Python but this time I selected 'add to path' option which is not selected by default. _pack_zip_to_aml.bat now works but I didn't try the resulting image. DTB still isn't extracted with the updated version of the tool. Vortex's kitchen extracts it fine.
I tried to test the image I made from ota.zip and when I try to unpack level2, I get this error while extracting odm partition while other partitions extract fine. Maybe because my ota.zip is encrypted so maybe you can add some type of detection.Vortex''s edition also errors out when unpacking odm with the same error.
Spoiler: log
.....................
Amlogic Kitchen
.....................
Select level 1,2 or 3: 2
Python 3.10.2
imgextractor: Vortex Edition
Traceback (most recent call last):
File "imgextractor.py", line 374, in <module>
File "imgextractor.py", line 360, in main
File "imgextractor.py", line 346, in __getTypeTarget
File "imgextractor.py", line 338, in checkSignOffset
OSError: [WinError 8] Not enough memory resources are available to process this command
[2700] Failed to execute script imgextractor
imgextractor: Vortex Edition
Convert product.PARTITION to product.raw.img
Extraction from product.PARTITION to product
imgextractor: Vortex Edition
Convert vendor.PARTITION to vendor.raw.img
Extraction from vendor.PARTITION to vendor
kalehrl said:
I reinstalled Python but this time I selected 'add to path' option which is not selected by default. _pack_zip_to_aml.bat now works but I didn't try the resulting image. DTB still isn't extracted with the updated version of the tool. Vortex's kitchen extracts it fine.
I tried to test the image I made from ota.zip and when I try to unpack level2, I get this error while extracting odm partition while other partitions extract fine. Maybe because my ota.zip is encrypted so maybe you can add some type of detection.Vortex''s edition also errors out when unpacking odm with the same error.
Spoiler: log
.....................
Amlogic Kitchen
.....................
Select level 1,2 or 3: 2
Python 3.10.2
imgextractor: Vortex Edition
Traceback (most recent call last):
File "imgextractor.py", line 374, in <module>
File "imgextractor.py", line 360, in main
File "imgextractor.py", line 346, in __getTypeTarget
File "imgextractor.py", line 338, in checkSignOffset
OSError: [WinError 8] Not enough memory resources are available to process this command
[2700] Failed to execute script imgextractor
imgextractor: Vortex Edition
Convert product.PARTITION to product.raw.img
Extraction from product.PARTITION to product
imgextractor: Vortex Edition
Convert vendor.PARTITION to vendor.raw.img
Extraction from vendor.PARTITION to vendor
Click to expand...
Click to collapse
i have pushed a fix for dtb now. odm error is mostly because its an empty partition
2 other kitchens extract the odm partition just fine. The one from CRB: https://forum.xda-developers.com/t/tool-windows-kitchen-crb-v3-0-0-beta14.3947779/ and another one from a Russian developer from 4pda. The partition isn't empty. How does this kitchen handle encrypted partitions? I think in the ota.zip I mentioned, boot and dt.img are encrypted. Vortex's kitchen recognises encrypted partitions and they have .enc suffix at the end. I tested with encrypted factory img for X99 Max + box.
kalehrl said:
2 other kitchens extract the odm partition just fine. The one from CRB: https://forum.xda-developers.com/t/tool-windows-kitchen-crb-v3-0-0-beta14.3947779/ and another one from a Russian developer from 4pda. The partition isn't empty. How does this kitchen handle encrypted partitions? I think in the ota.zip I mentioned, boot and dt.img are encrypted. Vortex's kitchen recognises encrypted partitions and they have .enc suffix at the end. I tested with encrypted factory img for X99 Max + box.
Click to expand...
Click to collapse
i havent tried any firmware with encrypted partitions yet. i will check soon
I can send you my ota.zip if you need it. Here you can find X99 max plus firmware: http://geekbuying.mediafire.com/fil...3_d4_sp6330_100m_20200917_r1(x99max+).7z/file
kalehrl said:
I can send you my ota.zip if you need it. Here you can find X99 max plus firmware: http://geekbuying.mediafire.com/fil...3_d4_sp6330_100m_20200917_r1(x99max+).7z/file
Click to expand...
Click to collapse
Now you can extract odm. i was using an old binary from Vortex. now using python script, same as linux one. and
i think your dtb is encrypted, not sure. im not able extract yours. i can extract meson1 (also dtb). added support for that.
The dtb I attached is not encrypted. It is from a SlimBox custom rom. I will send you the link to my ota.zip in which some files are encrypted, probably boot.img and dt.img. Other files should be fine.
EDIT: With the new version, dtb is decompiled successfully
althafvly said:
Dump os from device through adb/flash/mask mode
Click to expand...
Click to collapse
I've stumbled upon an interesting script for dumping fw via adb from [email protected] I think. Maybe I can send it to you to have a look and improve on it and make it available on github.
It seems that it doesn't extract Android 7.1 images correctly.
system/usr folder isn't extracted and the terminal window closes prematurely.
I tried this image which extracts fine with another tool:
0 byte folder on MEGA
mega.nz
New changes
- Allow user to select vortex/python for extracing firmware in windows
- Added support to dump firmware from mask mode
- Added support for firmwares with super.img
Note: i have only test this in some firmware/device. report if theres any issues.
Create flashable zip from amlogic image
i created a zip can I flash this with or without wiping anything in twrp ?
failed with error 6
cali.s said:
Create flashable zip from amlogic image
i created a zip can I flash this with or without wiping anything in twrp ?
failed with error 6
Click to expand...
Click to collapse
Not sure which device and firmware your are talking about. Its better if you wipe before flashing and its best to flash amlogic image if you have one.
I tried to dump_to_aml.sh Android 6 image but it failed:
[email protected]:/home/kalehrl/Templates/android/AmlogicKitchen# ./dump_to_aml.sh
Code:
.....................
Amlogic Dumper
.....................
Unpacking system
Repacking system
Repacking boot
Repacking recovery
Repacking logo
Enter a name for aml package:
ott
[ERR]f(AmlImagePack.cpp)L1312:Open pack image out/ott.img failed
Image pack FAILED
.....................
Done.
I can send you my TWRP backup of the original iamge to try if you have time.
kalehrl said:
I tried to dump_to_aml.sh Android 6 image but it failed:
[email protected]:/home/kalehrl/Templates/android/AmlogicKitchen# ./dump_to_aml.sh
Code:
.....................
Amlogic Dumper
.....................
Unpacking system
Repacking system
Repacking boot
Repacking recovery
Repacking logo
Enter a name for aml package:
ott
[ERR]f(AmlImagePack.cpp)L1312:Open pack image out/ott.img failed
Image pack FAILED
.....................
Done.
I can send you my TWRP backup of the original iamge to try if you have time.
Click to expand...
Click to collapse
dump to aml script isn't ready yet. Im still testing it. I will check on free time. This error is because script isn't able to create ott.img. Try different name or close any apps which using that ott.img file.