Extracting stock Boot, Recovery and Persist images - Redmi K20 / Xiaomi Mi 9T Guides, News, & Discussio

Talking here about how to extract the stock Boot, Recovery and Persist images, needed in case of e.g. bootloop upon flashing Magisk or TWRP, to reflash the stock image(s).
Also, boot image is needed for patching from Magisk Manager (and flashing by Fastboot), as a preferable way to install Magisk.
Stock Recovery is needed if you want to revert from the custom one, and stock Persist is important because it contains certificate for Widevine L1 (needed for Full HD in eg Netflix)
From Recovery (zip) firmware
Download the Recovery (zip) image from:
https://c.mi.com/oc/miuidownload/detail?device=1700361
Extract the archive and find the boot.img inside.
However, it does not contain recovery.img
From Fastboot (tgz) firmware
Similarly, download the Fastboot (tgz) image from:
https://c.mi.com/oc/miuidownload/detail?guide=2
(check Desktop site if opening from the mobile browser)
Extract the archive, find the images folder with boot.img and recovery.img inside
From TWRP or OrangeBox
Boot and Persist images can be disk-dumped from TWRP or OrangeFox, from its Terminal, with the command:
Code:
dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img
Dumped images will be saved to Internal memory - both the official TWRP and OrangeFox support internal storage encryption (use your Android lock-screen password/pin), hence no need to format Data for TWRP to dump to Internal memory
Note:
Observe that if Magisk was installed, dumped Boot image won't be the stock one but the one already patched by Magisk
We could similarly dump the Recovery image, but since we must dump from TWRP or OorangeFox,
the dumped image won't be the stock one but the image of the installed custom Recovery
From Terminal Emulator app
Similarly, Recovery and Persist mages can be disk-dumped from Terminal emulator app:
Code:
su
dd if=/dev/block/bootdevice/by-name/recovery of=/sdcard/recovery.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img
By ADB
Finally, Recovery and Persist images can be also disk-dumped from ADB:
Code:
adb shell
su
dd if=/dev/block/bootdevice/by-name/recovery of=/sdcard/recovery.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img
Of course, ADB with drivers must be properly installed to the PC, and ADB debugging must be enabled in Settings, Developer options menu on the phone.
PC must be authorized from the phone once they get connected by USB cable
Finally, after the su command, root privilege must be granted to the Terminal emulator app before proceeding with dd command
Take care not to miss the authorization and root granting pop-ups on the phone if screen was switched of
Notes:
Observe that in both cases of Terminal emulator app and ADB, if custom Recovery was already installed, then you will be dumping the image of that custom Recovery
We can similarly dump the Bot image from Terminal emulator app or by ADB - but the root (Magisk) was prerequisite, hence the dumped image will be the Boot image already patched by Magisk

---

(Extracted stock) image files can be flashed by various ways
From Fastboot
Image files must be on the PC:
Code:
fastboot flash boot boot.img
fastboot flash recovery recovery.img
(I didn't test for persist.img, but found a note somewhere that it doesn't work)
You can also temporarily boot with the given boot.img (it won't be flashed and next time you reboot, it will reboot with the boot image that was flashed/installed previously):
Code:
fastboot boot boot.img
(As far as I tested, it's not possible similarly to temporarily boot with the given recovery image, without really flashing it)
By ADB
Image files must be on Internal memory at /
At the same place wherre you disk-dumped them
Adb must be enabled, phone must be rooted and adb must be granted root privilege
Code:
dd if=/sdcard/boot.img of=/dev/block/bootdevice/by-name/boot
dd if=/sdcard/recovery.img of=/dev/block/bootdevice/by-name/recovery
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist
From Terminal Emulator app
Similarly like by adb, but here just use "su dd" instead of "adb shell su dd"
Of course, phone must be rooted and Terminal Emulator app must be granted root privilege
From TWRP
From Advanced, Terminal.
Similarly like by adb, but use just "dd" instead of "adb shell su dd"
However, boot.img and recovery.img can be also flashed from Install menu in TWRP.
Select Image (by default is ZIP File), navigate to your boot.img (recovery.img) and select to flash to Boot (Recovery).
Persist.img cannot be flashed that way because e.g., official TWRP does not offer to patch to Persist
From OrangeFox
Image files can be flashed by "dd" command, just like from TWRP (OrangeFox is developed on top of TWRP)
However, image files can be also flashed directly from the main menu in OrangeFox.
Not only boot.img and recovery.img but also persist.img - see attached screenshot

---

Reserved

---

Same applies also for disk-dumping/flashing persistbak.img
It's a good idea to backup both Persist and PersistBack, if something goes wrong you can also restore persisback.img to Persist
Btw, backup (dd) also sdf.img and keep;
dd if=/dev/block/sdf of=/sdcard/sdf.img
restore if you loose IMEIs:
dd if=/sdcard/sdf.bin of=/dev/block/sdf

---

The fastboot rom comes with the stock persist image?
Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.
---------- Post added at 02:31 PM ---------- Previous post was at 02:31 PM ----------
The fastboot rom comes with the stock persist image?
Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.

---

Cni said:
The fastboot rom comes with the stock persist image?
Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.
---------- Post added at 02:31 PM ---------- Previous post was at 02:31 PM ----------
The fastboot rom comes with the stock persist image?
Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.
Click to expand...
Click to collapse
I doubt you could find persist.img in tgz but download, extract and check
However, you can disk-dump persist.img and persistbak.img, save, rename persistbak.img to persist.img and flash it back, maybe it still contains your L1 certificate
If anything goes wrong, just flash your persist.img back

---

Has anyone got the L1 certificate using this method?

---

tylerberk said:
Has anyone got the L1 certificate using this method?
Click to expand...
Click to collapse
No, you can't get back Widevine L1...

---

Super useful guide, especially if you already have a ROM installed and don't want to download the whole ROM again. Tahnk you for the tips, OP!

---

boot, recovery, Huawei Lua-u22​