Hi everyone, I didn't find a full guide for unpacking & repacking new kernel.elf, they were somehow out-dated.
so I'm here to share with you my knowledge.
First Post : Unpack kernel
Second Post : Unpack ramdisk
Third Post : Repack ramdisk
Fourth Post : Repack kernel
1st : Requirements
1) the kernel you want to unpack
2) 7z -->
Code:
sudo apt-get install p7zip
2nd : procedure
lets assume our working directory is "~/kernel" and the kernels name is "kernel.elf".
now open terminal and write down the following code.
Code:
mkdir ~/kernel
cp /path/to/file ~/kernel/kernel.elf
cd ~/kernel
7z e kernel.elf
now you will get 0, 1, 2, 3.
0 --> zImage
1 --> ramdisk
2 --> cmdline
3 --> cert
Code:
mv 0 kernel.elf-zImage
mv 1 kernel.elf-ramdisk.gz
mv 2 kernel.elf-cmdline
mv 3 kernel.elf-cert
now you have successfully unpacked the kernel.
[B]Second Post : Unpack ramdisk[/B]
1st : Requirements
1) the ramdisk we got from the first post.
2) file -->
Code:
sudo apt-get install file
3) most probably gzip -->
Code:
sudo apt-get install gzip
2nd : procedure
Code:
file -b kernel.elf-ramdisk.gz
most probably you will get "gzip compressed data".
if not read the notes at the end of this post then resume reading.
Code:
gzip -dk kernel.elf-ramdisk.gz
now you will get cpio archive "kernel.elf-ramdisk".
Code:
mkdir ramdisk
mv kernel.elf-ramdisk ramdisk
cd ramdisk
cpio -i < kernel.elf-ramdisk
rm kernel.elf-ramdisk
cd ..
now you successfully extracted the ramdisk.
3rd : notes
it seems your ramdisk isn't gzip compressed.
if you got "LZMA compressed data" from file command
then it is "lzma" compressed
lzma -->
Code:
sudo apt-get install xz-utils
to uncompress use
Code:
mv kernel.elf-ramdisk.gz kernel.elf-ramdisk.lzma
xz -dk kernel.elf-ramdisk.lzma
now you chould resume unpacking process.
Third Post : repack ramdisk
1st : Requirements
1) the ramdisk folder we extracted from second post.
2) cpio
3) the tool we used for unpacking ramdisk (gzip) (check notes for other compression types)
2nd : procedure
Code:
cd ramdisk
find|cpio -o -H newc|gzip >../kernel.elf-new_ramdisk.gz
cd ..
now you successfully repacked the ramdisk.
3rd : notes
well it is recommended to repack the ramdisk with the original ramdisk format
because other formats maybe not supported
but no problem trying other formats as long as they are supported
for lzma :
Code:
cd ramdisk
find|cpio -o -H newc|xz --format=lzma >../kernel.elf-new_ramdisk.lzma
cd ..
Fourth Post : repack kernel
1st : Requirements
1) the files we unpacked from the kernel from first post (zImage, cmdline, we won't be needing the extracted cert).
2) the ramdisk folder we repacked from third post.
3) the original kernel.elf for injecting cert.
4) mkelf.py Sony's or Doomlord's
github.com/sonyxperiadev/device-sony-lt26/blob/master/tools/mkelf.py
github.com/DooMLoRD/build_tools/blob/master/bin/mkelf.py
2nd : procedure
now we gonna repack kernel.elf (without cert yet).
Code:
mkelf.py -o kernel.elf-new [email protected] [email protected],ramdisk [email protected]
now comes the tricky part.
Code:
printf "\x04"|dd of=kernel.elf-new bs=1 seek=44 count=1 conv=notrunc 2>/dev/null
dd if=kernel.elf of=kernel.elf-dumped_cert bs=1 skip=148 count=1106 2>/dev/null
cat kernel.elf-dumped_cert|dd of=kernel.elf-new bs=1 seek=148 count=1106 conv=notrunc 2>/dev/null
rm kernel.elf-dumped_cert
now you successfully repacked the kernel .
Hi, would this method work on the Xperia GO? Would I have to change the command line arguments in order for it to work for my Xperia GO?
Hukanawa said:
Hi, would this method work on the Xperia GO? Would I have to change the command line arguments in order for it to work for my Xperia GO?
Click to expand...
Click to collapse
It would be great if you linked me to the kernel you want to unpack/repack.
Should work for Xperia GO
I grabbed the kernel "in CM11 weekly 20 for Xperia GO by XperiaSTE Team", and found the kernel structure is similar to Xperia P/U.
So yeah this guide should work for Xperia GO.
I hope this was helpful.
Very nice and helpful guide.
Worked for ARM64 kernel.elf also.
Related
Anyone know how to do that and bundle it back up into a zImage we can flash on the Vibrant/Galaxy S? HTC's boot.img was reasonably simple to mod, but I haven't found any good data on re-assembling the zImage Samsung uses. I have been able to extract the initrd, but nothing on putting it back together.
I'd prefer not to completely build the kernel, as I'd like to keep using JACs and he hasn't posted the source. And I'd have to build the cross-compiler as well, time consuming.
Irritating, the Samsung kernel source build works but doesn't do this bit either. No initrd... grrrr...
No doubt there is a way to reverse-engineer the way the kernel and ramdisk is put together, but it's way beyond my capability at the moment. With that said, if we can take it apart, we can probably put it back together.
i too am looking for instructions how to repack and/or split this
Jr33 said:
i too am looking for instructions how to repack and/or split this
Click to expand...
Click to collapse
Here's how you pull the initrd out from a Vibrant image, well, JAC OCv4 anyway.. Based on a thread and script in the international Galaxy S forum. I still don't know how to re-assemble it, but Wes put some stuff in git that might help, I'm still building after a repo sync. After you run the script with the zImage as the only parameter, you should get an initrd directory with the extracted contents of the ramdisk.
Code:
#!/bin/sh
zImage=$1
#=======================================================
# find start of gziped kernel object in the zImage file:
#=======================================================
pos=`grep -a -b --only-matching $'\x1F\x8B\x08' $zImage | cut -f 1 -d :`
echo "-I- Extracting kernel image from $zImage (start = $pos)"
# dd if=$zImage bs=1 skip=$pos | gunzip > kernel.img
#===========================================================================
# find start and end of the "cpio" initramfs image inside the kernel object:
# ASCII cpio header starts with '070701'
# The end of the cpio archive is marked with an empty file named TRAILER!!!
#===========================================================================
search=`perl -e'print "\x1F\x8B\x08"'`
start=`grep -a -b --only-matching $search kernel.img | head -1 | cut -f 1 -d :`
echo "-I- Extracting initramfs image from kernel.img (start = $start, end = $end)"
dd if=kernel.img bs=1 skip=$start | gzip -d -c > initramfs.img
mkdir initrd
cd initrd
cpio -i --no-absolute-filenames < ../initramfs.img
This guide should hopefully allow you to unpack and re-pack the 2012 Xperia kernels, which use a new .elf format.
[ Requirements: ]
Sony's mkelf.py
Python (For mkelf.py)
7-zip
[ Unpack elf: ]
1. Unpack the .elf using 7-zip, either via the GUI or command line:
Code:
7z e kernel.elf
2. This will give you 3 files:
Code:
0 - Kernel
1 - RAMDisk
2 - Resource Power Manager (RPM, Xperia S only):
2. You will need to unpack the '1' file to get the RAMDisk (It will be named 1~):
Code:
7z e 1
3. Unpack the RAMDisk:
Code:
mkdir ramdisk
7z x "1~" -o"ramdisk"
Now make your changes to the RAMDisk
[ Pack elf: ]
1. Pack the new RAMDisk (The new RAMDisk will be named '1' in the ramdisk folder):
Code:
cd ramdisk
find . | cpio -o -H newc | gzip > 1
2. Copy the kernel '0', new RAMDisk '1' (in the ramdisk folder) and RPM '2' (Xpera S only) into a new folder, along with the mkelf.py file
3. Run the Python mkelf.py (note the different instructions for Xperia P and Xperia S):
Xperia P:
Kernel should be named 0
RAMDisk should be named 1
Code:
python mkelf.py -o new_kernel.elf [email protected] [email protected],ramdisk
Xperia S:
Kernel should be named 0
RAMDisk should be named 1
Resource Power Manager (RPM) should be named 2
Code:
python mkelf.py -o new_kernel.elf [email protected] [email protected],ramdisk [email protected],rpm
This should create a new packed file called newkernel.elf
[ Boot: ]
1. Flash the new kernel
Code:
fastboot -i 0x0fce flash boot new_kernel.elf
2. Reboot the phone
Code:
fastboot -i 0x0fce reboot
Hopefully should boot into your new kernel
Open to comments and suggestions for this tutorial
Disclaimer: I accept no responsibility if this destroys your device/house/life
Source: http://developer.sonymobile.com/wp/...-archive-released-with-building-instructions/
Source: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
Thanks: nickholtus, DooMLoRD
Guide looks really good
Just for the record: did anyone test this?
K900 said:
Just for the record: did anyone test this?
Click to expand...
Click to collapse
Yes Nickholtus did (On his Xperia P)
And on the S? Because from what I know the P doesn't have that bug.
Will this also work for the sola?
shreyasdilip said:
Will this also work for the sola?
Click to expand...
Click to collapse
It will need different addresses for the mkelf.py. If you link me to a Sola kernel, I can update the post with it
will this work for sola
What about sola
ffaaiissaall said:
What about sola
Click to expand...
Click to collapse
Don't mean to sound an arse but did you even read the thread? Check the question two posts up from you and the response to it just one below.
K900 said:
Just for the record: did anyone test this?
Click to expand...
Click to collapse
yes i have already done lots of testing on nick's Xperia P last week
And what if i have 4 files after unpacking the kernel.elf??
i have 0,1,2,3
How to deal with this case?
norberto_ said:
And what if i have 4 files after unpacking the kernel.elf??
i have 0,1,2,3
How to deal with this case?
Click to expand...
Click to collapse
what phone and what kernel ??
Regarding testing of things, I now have a spare Xperia S if anyone wants me to try things out without the risk of messing up my main phone.
check this out
http://forum.xda-developers.com/showthread.php?p=27859098#post27859098
championswimmer said:
check this out
http://forum.xda-developers.com/showthread.php?p=27859098#post27859098
Click to expand...
Click to collapse
makes sense
Atarii said:
This guide should hopefully allow you to unpack and re-pack the 2012 Xperia kernels, which use a new .elf format.
[ Requirements: ]
Sony's mkelf.py
Python (For mkelf.py)
7-zip
[ Unpack elf: ]
1. Unpack the .elf using 7-zip, either via the GUI or command line:
Code:
7z e kernel.elf
2. This will give you 3 files:
Code:
0 - Kernel
1 - RAMDisk
2 - Resource Power Manager (RPM, Xperia S only):
2. You will need to unpack the '1' file to get the RAMDisk (It will be named 1~):
Code:
7z e 1
3. Unpack the RAMDisk:
Code:
mkdir ramdisk
7z x "1~" -o"ramdisk"
Now make your changes to the RAMDisk
[ Pack elf: ]
1. Pack the new RAMDisk (The new RAMDisk will be named '1' in the ramdisk folder):
Code:
cd ramdisk
find . | cpio -o -H newc | gzip > 1
2. Copy the kernel '0', new RAMDisk '1' (in the ramdisk folder) and RPM '2' (Xpera S only) into a new folder, along with the mkelf.py file
3. Run the Python mkelf.py (note the different instructions for Xperia P and Xperia S):
Xperia P:
Kernel should be named 0
RAMDisk should be named 1
Code:
python mkelf.py -o new_kernel.elf [email protected] [email protected],ramdisk
Xperia S:
Kernel should be named 0
RAMDisk should be named 1
Resource Power Manager (RPM) should be named 2
Code:
python mkelf.py -o new_kernel.elf [email protected] [email protected],ramdisk [email protected],rpm
This should create a new packed file called newkernel.elf
[ Boot: ]
1. Flash the new kernel
Code:
fastboot -i 0x0fce flash boot new_kernel.elf
2. Reboot the phone
Code:
fastboot -i 0x0fce reboot
Hopefully should boot into your new kernel
Open to comments and suggestions for this tutorial
Disclaimer: I accept no responsibility if this destroys your device/house/life
Source: http://developer.sonymobile.com/wp/...-archive-released-with-building-instructions/
Source: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
Thanks: nickholtus, DooMLoRD
Click to expand...
Click to collapse
I just unpack & repack the kernel, but it isn't work
the screen just all black
nothing displays
wzhy said:
I just unpack & repack the kernel, but it isn't work
the screen just all black
nothing displays
Click to expand...
Click to collapse
I am using Xperia acro S. I had the same problem.
@wzhy, why don't you use the following command instead.
Code:
python mkelf.py -o new_kernel.elf [email protected] [email protected],ramdisk [email protected],rpm
for unpacking the ramdisk use the method on this page (few posts above)
otherwise you will get a black screen
Hi.
whats the correct setting for Xperia U for mkelf.py ?
Thx
Nice guide but ...
I have Xperia sola
4.0.4 rom build 6.1.1.B.1.54
kernel.sin has 3 files {
kernel.elf
kernel.patinfo
kernel.header
}
kernel.elf has 4 files! {
kernel.elf.3
kernel.elf.cert
kernel.elf.Image
kernel.elf.ramdisk.gz
}
In the ram disk there is a file name kernel.elf.ramdisk
and kernel.elf.ramdisk has the ramdisk files
So how can I repack THIS?!
thanks in advance for your answer
Maybe a noob question, but how do you guys split and repack SGS3 boot.img ?
The usual perl scripts don't seem to work with any S3 boot.img I came across (neither for the Galaxy Tab 7.7 boot.img's btw).
I keep getting this error :
Android Magic not found in boot.img. Giving Up.
Click to expand...
Click to collapse
Thanks for answering.
To unpack, you can do this:
Code:
abootimg -x boot.img && mkdir newramdisk && cd newramdisk && zcat ../initrd.img | cpio -i --no-absolute-filenames
Of course, that assumes you have abootimg installed. The above will split the zImage and the ramdisk from the boot.img and then proceed to extract the files from the ramdisk. Some ramdisks are not Gzip compressed so in that case use cat instead of zcat. Also: run that as root to make sure you don't mangle the files' permissions. I haven't tried repacking, though. ("find . -print | cpio -o -H newc | gzip > ../initrd.img" followed by "cd .. ; abootimg -u boot.img -r initrd.img" worked for my U8800pro, but I've had no need to try it with GS3 images.) I'd start by looking at the tools that come with the official Samsung source distribution and guides that tell you how to build a Samsung kernel.
Thanks a lot for this thorough answer
Trying this right now.
Couldn't find a specific Samsung kernel-related tutorial, though good idea to go take a look at Samsung's official kernel documentation.
qwerty12 said:
To unpack, you can do this:
Code:
abootimg -x boot.img && mkdir newramdisk && cd newramdisk && zcat ../initrd.img | cpio -i --no-absolute-filenames
Of course, that assumes you have abootimg installed. The above will split the zImage and the ramdisk from the boot.img and then proceed to extract the files from the ramdisk. Some ramdisks are not Gzip compressed so in that case use cat instead of zcat. Also: run that as root to make sure you don't mangle the files' permissions. I haven't tried repacking, though. ("find . -print | cpio -o -H newc | gzip > ../initrd.img" followed by "cd .. ; abootimg -u boot.img -r initrd.img" worked for my U8800pro, but I've had no need to try it with GS3 images.) I'd start by looking at the tools that come with the official Samsung source distribution and guides that tell you how to build a Samsung kernel.
Click to expand...
Click to collapse
Great!! Thanks for your information.
Here is what I use. Inside there are three binaries and two perl scripts,, copy the binaries into /usr/bin/ or you can add them in their own place and add that to the path. Then use this to help you use the files
Thanks for that too, ima try those scripts
Getting this error :
~$ perl unpack-bootimg.pl boot.img
could not find any embeded ramdisk images. Are you sure this is a full boot image?
Click to expand...
Click to collapse
Apparently, from what I have been reading, Samsung uses a different type of kernels than other manufacturers.
Although there's a huge number of custom samsung kernels out there. There might be a way^^
Here is the kernel i'm trying to edit if anyone wanna give a try at unpacking it for me.
That is true up until the S3 boot.img/kernel They have always used a zImage. Now Google has forced them to move over to EXT4 system and change the kernel format.
That file is only 2.88 mb's that is way too small to be a full kernel. Even for stock with no tweaks. That's why you are having an error.
This is the original boot.img from the CM9 for Galaxy Tab 7.7 update.zip
However i get the same error when trying to unpack S3 stock boot.img or even CM10 boot.img, although when i try the same scripts on my Xperia Play's kernels they unpack properly.
Good thing if Google made Samsung do kernels like others
Hi,
Did you manage to unpack/repack the SGS3 boot image? I'm trying to modify init.rc in an international SGS3 (i9300).
I've managed to unpack the boot image (from /dev/block/mmcblk0p5) as per qwerty12's command but how do I repack it?
Thanks!
I recently got my hands on a WeTek Hub. All round quite a nice little box, but the default lowmemorykiller settings are a little annoying, and sometimes result in the boot failing because the kernel decided to kill one of the startup processes. I'm trying to modify the settings in the init.rc, but I'm having a spot of trouble with a boot loop after repacking the boot image.
I copied the image off the device by using dd to extract the partition to a file, and then used the built-in FTP server to copy it off the device, and extracted it using unmkbootimg. after unzipping, extracting, modifying, and re-packing, I used mkbootimg to recreate the image, and dd'd it back onto the box (commands below).
Code:
dd if=/dev/block/boot of=/sdcard/boot.img
Code:
./unmkbootimg boot.img
mv initrd.img{,.gz}
gunzip initrd.img.gz
mkdir initrd
cp initrd.img initrd
cd initrd
cpio -i < initrd.img
rm initrd.img
# change stuff here
find . | cpio -o -H newc > ../initrd.cpio
cd ..
gzip initrd.cpio
./mkbootimg --kernel kernel.gz --ramdisk initrd.img.gz -o new_boot.img
Code:
dd if=/sdcard/new_boot.img of=/dev/block/boot
Unfortunately, that left me with a flashing WeTek logo as the it continuously rebooted. examining the logs from u-boot didn't give anything useful, but luckily I was able to get it into recovery and flash Ricardo's Android TV ROM back on there. Unfortunately, I'm still stuck with the original boot failure issue. Any clues as to what I've missed?
I do so
Code:
cd boot
../mkboot boot.img unpaсk
cd unpack/ramdisk
find . | cpio -o -H newc | gzip > ../ramdisk.packed
[I][B]# (edit size ramdisk in /boot/unpack/img_info file)[/B][/I]
cd ../..
../mkboot unpack boot.img
all is working
Hey all,
I am learning how Android works and am trying to figure out how I can update the Android filesystem by extracting a ramdisk from normal boot.img, adding some files, then flashing it back. So far, I have been unsuccessful in doing this and am hoping to figure out why. Here's the steps below I have taken:
Using a Google Pixel 4a, Android 11, kernel v 4.14 (i.e. not GKI)
High level:
Extract ramdisk.cpio from boot.img using magiskboot via adb on device, modify extract contents, sent back up to magiskboot, repackaged, then flashed via fastboot.
Detailed steps:
Grab ramdisk.cpio
Code:
$ # obtain the ramdisk.cpio from magiskboot
$ adb -d shell "cd ${BOOT_IMG_PATH}; ./magiskboot unpack boot.img"
$ adb -d pull /${BOOT_IMG_PATH}/ramdisk.cpio /tmp/
$ # attempt to modify the filesystem
$ mkdir /tmp/rd && cd rd
$ cpio -i < /tmp/ramdisk.cpio
$ touch yolo
$ echo "why doest this work" > system/wtf.txt
$ echo "why doest this work" > sys/wtf.txt
$ echo "why doest this work" > vendor/wtf.txt
#patch this directory back up and send to magiskboot
$ find . | cpio -oH new > /tmp/new.ramdisk.cpio
$ adb -d push /tmp/new.ramdisk.cpio ${BOOT_IMG_PATH}/ramdisk.cpio
$ adb -d shell "cd ${BOOT_IMG_PATH}; ./magiskboot repack boot.img
$ adb -d pull /${BOOT_IMG_PATH}/new-boot.img /tmp/
# apply this modifyied boot.img
$ adb reboot bootloader
fastboot flash boot /tmp/new-boot.img
fastboot reboot
After doing this, I'll adb back in to verify:
Code:
adb -d shell "find / -name "wtf.txt" 2>/dev/null
# silence.... always silence... no file change
* I am aware that Wu modifies the extracted dtb file from boot.img with a "magiskboot dtb dtb patch" command but that doesn't seem to apply to my particular boot.img as the fstab doesn't seem to be around
* I am aware that vbmeta and codesigning, I have disabled vbmeta via fastboot
* I am aware that there's A/B slots for flashing. I have tried flashing both slots to make sure the updated ramdisk is seen
* I am aware of magiskboot's kernel patch from skip_initramfs -> want_initramfs. I could use some clarification on this if it pertains to my problem
* My Android device uses "mount method C" from Wu's great writeup https://github.com/topjohnwu/Magisk/blob/master/docs/boot.md. That is, it's init's job to mount everything on my device. I guess I feel confused as to why init wouldn't mount the additional files that I've added to the ramdisk
Extremely grateful for help or guidance on what I've overlooked. Thanks y'all
You should probably examine your modified boot file to see if the new stuff is in there.
I don't use your tools or even deal with cpio as a file type.
Code:
C:\>echo Hello > sbin\bogus
C:\>imgutil /i boot.img sbin/bogus
C:\>imgutil /l boot.img
...
sbin/bogus
...