Unpacking android emmc image - Android Q&A, Help & Troubleshooting

Hello everyone!
I'm starting a new research on an embedded device, I'm pretty new in iot hacking, so I'm lacking a lot of basic knowledge.
The device I'm working on runs on an ARM soc and uses an Android based operating system, booting with an U-boot bootloader.
I was able to get an adb root shell, which gave me access to everything on the device, and proceeded to dumping the whole emmc raw image (the one in /dev/block/mmc...).
I'm now trying to boot that same image on a tinkerboard, so I can get a better view at the internals of the device and to be able to debug it properly, which I can't do on the original device without damaging it beyond repair.
For this I want to grab one of the tinkerboard's android images offered on the website, which is basically a raw image which you can flash onto an ssd card an use it to boot the tinkerboard, and modify the partitions I need (system, boot, userdata, etc).
However, I don't know how to extract each one of the partitions from this raw image. I was thinking about doing something manual with binwalk and dd, but there must be a better way.
So my question is: Is there a tool I can use to extract and then rebuild each android partition from a raw emmc image dump?
Thanks a lot!
apok

Related

[Q] Android recovery system

HI!
I have few queries regarding the Android recovery system, and the class RecoverySystem.
1. As per my understanding the recovery system which is supposed to work from the recovery partition, does not necessarily be a android OS, but can be even plain embedded linux with bassic RFS and a workhorse application like the bootable/Recovery in the source. Even the recovery application can be different from the one in the bootable/recovery folder in SDK source.
Please let me know if this understanding of mine is correct?
I need to implement such recovery mechanism for a MMC based non mobile device. Any poiters on that?
2. Why is that the boot-loader (Hboot in phones) is doing the actual job of installing the system update , bootimage update and the hboot update? Cant the recovery system itself untar and install the "SYSTEM" update in it's respective partition and the "BOOTIMAGE" update in its respective partition from the user space application "recovery".
2. The class RecoverySystem is used to interact with the recovery system running in RECOVERY partition. Can somebody point me to some example uses the RecoverySystem class?
regards
-Nitin

[Q] The boot sequence, SDE, and dual boot

I have a few questions about Archos' devices, in particular those belonging to the Generation 8 family. Here they are:
How is the partition table setup on the device and is the partition table signature checked? How are the partitions logically laid out?
When the SDE is installed and run, boot1 locks up boot0, itself and the recovery partition to prevent them from being modified. I would imagine that this type of setup would require keeping the partition table from being modified, thereby preventing dual boot. Can dual boot be achieved using the SDE without any extra modifications?
Are some of the partitions on Archos devices contained in compressed images and then loaded into the RAM in a manner similar to the way Damn Small Linux boots?
Is the recovery partition a minimal OS setup that exists to perform recovery operations or is it in fact copied in it entirety to the primary partition when recovery mode is entered?
I have realized/learned some things Linux that I hadn't noticed before such as the fact that folders like /home and /boot have their own partitions and that /boot may contain more than one kernel and that bootloaders like GRUB are actually represented in the filesystem. I don't if these are real partitions or logical partitions so I might have to do some relearning.
I'm bumping this thread.
Master Melab said:
I have a few questions about Archos' devices, in particular those belonging to the Generation 8 family. Here they are:
How is the partition table setup on the device and is the partition table signature checked? How are the partitions logically laid out?
When the SDE is installed and run, boot1 locks up boot0, itself and the recovery partition to prevent them from being modified. I would imagine that this type of setup would require keeping the partition table from being modified, thereby preventing dual boot. Can dual boot be achieved using the SDE without any extra modifications?
Are some of the partitions on Archos devices contained in compressed images and then loaded into the RAM in a manner similar to the way Damn Small Linux boots?
Is the recovery partition a minimal OS setup that exists to perform recovery operations or is it in fact copied in it entirety to the primary partition when recovery mode is entered?
I have realized/learned some things Linux that I hadn't noticed before such as the fact that folders like /home and /boot have their own partitions and that /boot may contain more than one kernel and that bootloaders like GRUB are actually represented in the filesystem. I don't if these are real partitions or logical partitions so I might have to do some relearning.
Click to expand...
Click to collapse
Partition tables are not locked. Devices are populated as normal in kernel. Partitions can be edited and the device repopulated with partprobe as normal.
The bootloader/recovery is held on a partition on mmcblk0, they are signed using a public/device encryption key, that has been broken. When the system is booted it mounts the recovery image and performs requested functions. The AOS firmware format is also encrypted, but has not been broken. The stock firmware is held on mmcblk0 as well, in an 256bit device key encrypted SquashFS(which has also been broken). It is mounted with a chroot as R/O at stock boot.
Dual boot can be achieved in multiple ways, easiest of which is installing the openAOS multiboot menu. A current limitation is that all OSes must use the same kernel, until we can get kexec working correctly(or other more dangerous solutions).
P.S. Folder's like /boot and /home can be many different things. Folders, partitions, images, symlinks, etc. The advantage of linux/debian is that everything is represented in the file system. Even sending commands to devices or modifying driver settings is done by "modifying files". For example, to flip the touchscreen's input on my A101, you write the letter "N" to a "file" called /sys/module/hid_hanvon/parameters/rotate180.
This is actually an interface to the driver for the touchscreen, not an actual file, so sending the letter N to "rotate180" tells the driver to flip the input coming from that device(hid_hanvon = the touchscreen).
If you tell me what you're trying to achieve, I can give you more details. If you are just trying to learn, you should come to the openaos IRC channel. Lot's of years of experience in there.
I didn't think bootloaders were stored on partitions. On PCs, the first stage bootloader is stored outside of any partition on the MBR.
Master Melab said:
I didn't think bootloaders were stored on partitions. On PCs, the first stage bootloader is stored outside of any partition on the MBR.
Click to expand...
Click to collapse
That's flashed on eMMC2. I was talking about the recovery bootloader. Basically, the bios is off limits, and the recovery bootloader allows updates, SDE flashing, etc. without risking bricking, as I'm sure you know.
So boot0, the root of all control on the device, is not stored in a partition, like the first stage bootloader on a PC while boot1 (or whatever special bootloader that exists for recovery purposes) is stored on its respective partition like a second stage bootloader on a PC?
I'm bumping this thread. Please explain further. What do you mean when you say "BIOS" and is boot1 the recovery bootloadr?
Master Melab said:
I'm bumping this thread. Please explain further. What do you mean when you say "BIOS" and is boot1 the recovery bootloadr?
Click to expand...
Click to collapse
Another bump.
I also want to know the partition layout of gen8 devices after installing SDE and UrukDroid.
I already installed SDE and when I plug the device to my computer I see 3 partitions:
/dev/sdb1 76295 469632 12586808+ 83 Linux
/dev/sdb2 1 30518 976563 83 Linux
/dev/sdb3 30518 76295 1464844+ 83 Linux
sdb1 - 13GB, doesn't contain a /system, but here's the menu.lst
sdb2 - 1GB, contains a /system (but i think it's not the stock android installation) ...maybe UrukDroid?
sdb3 - 1.5GB, contains a /system, but has only a few files, etc is missing for example
So is the stock android partition invisible?
I am bumping this thread.
Maybe this thread could be usefull for you : http://forum.xda-developers.com/showthread.php?t=1199450

[Q] Best way to backup and restore on a number of devices

Hi
I've done a bit of searching but can't find anything too specific to what I'm trying to do. Basically we have 10 Android tablets, and I want to make them all standardised e.g. have the same Apps on, configured in the same way (e.g. enterprise wireless network added).
Now the thing is if anyone messes around with them I want a really easy way to restore them to the original config which I've done.
One way I thought was to configure one fully, install Titanium Backup on it, do a full backup of apps/system data etc, and put the backup onto an SD card. Then I already have the base ROM on an SD card so if theres any problems, I can just flash the ROM over it again, install TB, and restore all the data. Would this be suitable to do to duplicate the data onto 10 tablets, and also restore the data if required?
The other thing I looked into was customising a ROM myself, don't want to do anything too tricky it'll just be a case of removing all the preinstalled crap I don't want, preloading the Apps we do want, and if possible preloading the wireless key and getting rid of the first boot initial set up wizard.
PS I've looked at installing CWM and doing whole image backups, but supposedly the tablet isnt supported (its an Ainol Novo 7 Elf 2)
Any advice would be great, hopefully theres some fairly straight forward way of managing this
Thanks
One of the reasons I integrated a full blown GNU/Linux on my devices, was the need to run full and automated backups. If you are looking into the possibility making a custom ROM, this might be a solution for you as well. I'm using BackuPC to run backups nightly, backing them up as any other GNU/Linux machine (using tar over ssh).
See the link in my signature for more information about this.
kuisma said:
One of the reasons I integrated a full blown GNU/Linux on my devices, was the need to run full and automated backups. If you are looking into the possibility making a custom ROM, this might be a solution for you as well. I'm using BackuPC to run backups nightly, backing them up as any other GNU/Linux machine (using tar over ssh).
See the link in my signature for more information about this.
Click to expand...
Click to collapse
Hi
Thanks for the reply, not too sure this would be the right option for us. I don't really need to take nightly backups, I just need to make a backup of a preconfigured image, and then put that image onto 10 other devices. Then I want to keep the original backup and have an easy way to restore it onto any devices which have been messed up. Sort of like image cloning for PCs, I want to prepare a base image, and then flash it over all the devices.
fro5tie said:
Hi
Thanks for the reply, not too sure this would be the right option for us. I don't really need to take nightly backups, I just need to make a backup of a preconfigured image, and then put that image onto 10 other devices. Then I want to keep the original backup and have an easy way to restore it onto any devices which have been messed up. Sort of like image cloning for PCs, I want to prepare a base image, and then flash it over all the devices.
Click to expand...
Click to collapse
Ok, I see. Compile the image to you likings (boot image and system partition), and then flash it using fastboot onto you devices.
Hi
Does anyone have any more thoughts on this?
I have experimented with Titanium Backup and this seems to work quite well. I have installed a ROM, and customised it e.g. installed the apps I need and configured the apps, wireless settings and home screens etc. Then I do a full apps + system backup in TB to my SD card.
Then the plan is, I can reflash the ROM onto the other device, install TB and then restore this backup. This saves my user state and wireless settings etc.
Only problems is when I flash the ROM, I have to go through all the initial set up again and also remove some preinstalled apps which I dont want. Any ways around this?
There must be something I'm missing. Why don't you install the device, walk through the setup, remove the bloatware you don't want and then dumps the disk partitions into images you flash the other devices with using fastboot? This way you'll get'em cloned, isn't it this you want..?
Of course there's still some tinkering needed once restored/cloned, such as giving them individual Google accounts etc, but you can easily fix this without re-running the setup wizard.
kuisma said:
There must be something I'm missing. Why don't you install the device, walk through the setup, remove the bloatware you don't want and then dumps the disk partitions into images you flash the other devices with using fastboot? This way you'll get'em cloned, isn't it this you want..?
Of course there's still some tinkering needed once restored/cloned, such as giving them individual Google accounts etc, but you can easily fix this without re-running the setup wizard.
Click to expand...
Click to collapse
Hi
Yes that's what I want to do! How would I go about dumping the disk into an image and then flashing?
fro5tie said:
Hi
Yes that's what I want to do! How would I go about dumping the disk into an image and then flashing?
Click to expand...
Click to collapse
There are several methods. Some boot loaders (such as nvflash for tegra based devices) can actually read back the disk partitions to a computer via the USB port. You can also on the tablet read the raw mtd device with busybox/dd. I assume you've unlocked the bootloader and gain root access to the device, since this is a requirement for flashing them as well. A third alternative is using busybox/tar, and then recreate the filesystem image using mkyaffs (or if ext3/ext4 even easier, just loopback mount an image on you linux maching to unpack the tar archive to). Once you got the images (system and userdata partitions), you flash the devices with "fastboot flash system system.img" and "fastboot flash userdata data.img". I don't believe you'll need to tamper with the other partitions.
kuisma said:
There are several methods. Some boot loaders (such as nvflash for tegra based devices) can actually read back the disk partitions to a computer via the USB port. You can also on the tablet read the raw mtd device with busybox/dd. I assume you've unlocked the bootloader and gain root access to the device, since this is a requirement for flashing them as well. A third alternative is using busybox/tar, and then recreate the filesystem image using mkyaffs (or if ext3/ext4 even easier, just loopback mount an image on you linux maching to unpack the tar archive to). Once you got the images (system and userdata partitions), you flash the devices with "fastboot flash system system.img" and "fastboot flash userdata data.img". I don't believe you'll need to tamper with the other partitions.
Click to expand...
Click to collapse
Hi
Thanks for the quick reply, much appreciated.
Unfortunately you've lost me a bit here!
Yes the device is rooted, I dont have a linux machine though.
Any chance you'd be able to provide some more specific instructions? The device is a chinese tablet from manufacturer Ainol, the model is a Novo 7 Elf 2. Unfortunately there isn't much discussion on these online so specific help is hard to find!
fro5tie said:
Any chance you'd be able to provide some more specific instructions? The device is a chinese tablet from manufacturer Ainol, the model is a Novo 7 Elf 2. Unfortunately there isn't much discussion on these online so specific help is hard to find!
Click to expand...
Click to collapse
I can provide you specific answers to specific questions, but I have no experience of the tablet in question, so you'll have to do some digging yourself first. Make sure it supports fastboot, investigate what the proprietary bootloader is capable of, see how/if you can obtain an original image etc.
One maybe easier solution, especially if you plan to restore the tablets on a regular basis, is to only make a new boot image to reflash the devices with. The only modification done is that you change the /init.rc script to mount /data and /system from the SDcard instead of from the internal nand disk device.
Once this is done, you'll power up and run the installation wizard and everything on your master tablet. Then power it down, and clone the SDcard. This SDcard now contains everything, so you'll simply restore a device by replacing its SDcard with a copy of this master card. I guess it's easier to clone a SDcard than reflashing several internal partitions. Easier to make the master as well - you don't need to dd or tar them, they are already in "image" format. If you can get hold of the original firmware, this should be quite easy without the need to preserving data from the device itself.
fro5tie said:
Any chance you'd be able to provide some more specific instructions?
Click to expand...
Click to collapse
Issue the commands "cat /proc/mtd" and "mount" on your device at command prompt (e.g. via "adb shell" or the "ConnectBot" terminal app). This shows you if the device allows you to copy the boot image from it. Paste in the output into this thread. If you believe the "clone the tablet via the SDcard" is a good solution for you, the process is in short terms something as below;
Copy the boot image to the sdcard:
# dd if=/dev/mtd/mtd2ro of=/mnt/sdcard/boot.img bs=2048 (device dependent of contents of /proc/mtd)
Remove the sdcard, insert into a computer, split the boot image info kernel + initramfs. Read http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images for instructions about how to work with the boot.img file. I really recommend a GNU/Linux environment for this.
Then edit /init.rc replacing the "mount yaffs2 [email protected] /system" with "mount ext3 /dev/block/mmcblk0p2 /system" for system and data (use p3 for data partition, the device name may be different on your tablet, see mount output).
Create an SDcard with three partitions: #1 vfat (standard), #2 and #3 ext3. Insert into you device and boot it up again.
# mount -t ext3 /dev/block/mmcblk0p2 /root
# cd /system
# tar cf - . | (cd /root ; tar xf - )
# umount /root
# mount -t ext3 /dev/block/mmcblk0p3 /root
# cd /data
# tar cf - . | (cd /root ; tar xf - )
# umount /root
This copies your partitions to the SDcard. Shutdown the tablet again.
Make a new boot.img using the instructions in the link above, using the edited init.rc script.
Now you can non-destrutive give this a try.
Place you tablet in fastboot mode (often vol-up (or vol-down) during power on).
$ fastboot devices
This vill verify the tablet is in fastboot mode. It should be listed. Then:
$ fastboot boot boot.img
Note here, only BOOT the tablet, do NOT use the "flash" keyword. This in case of the image isn't working, you'll just have to restart you tablet, and no harm's done.
Look around. Do a "mount" command. Everything works? Mount shows /data and /system from sdcard? Perfect. Now you can reflash it. Shutdown and flash:
$ fastboot flash boot boot.img
Now the device will use /data and /system from the SDcard every time. Customize your device, and then clone your SDcard and try it in tablet #2 you'll booting with your new boot.img and the cloned SDcard. Verify that #tablet #2 is a perfect clone of tablet #1. It is? Now you can flash the boot,img into all your tablets.
--------------------
But don't forget, there may be other solutions as well, maybe more suitable. This you'll have to investigate yourself.
And the usual disclaimer - you can probably not follow above by the letter. There sure is some obstacle you'll have to overcome, something non-standard, etc.
Also keep the original boot.img file for safekeeping in the case you want to restore the device's boot image some day.
Wow! Thanks for the info! This is really helpful, I need to set aside a bit of time to work through this and have a look. Thanks again its really appreciated, I'll be back with info once I've had chance to give it a go!
I certainly can't offer more detailed info than the fellow from Sweden who seems to really know his stuff...but what about making a nandroid backup of your fully configured reference tablet (I'm assuming all tablets are rooted). Ensure all your tabs have CWM recovery and copy your nandroid file to each one.
If any of your fleet get 'corrupted' you can simply restore the original, fully configured ROM.
In fact that sounds too obvious..likely I missed something about your scenario which precludes this option from consideration!
Good luck mate.
tweeny80 said:
I certainly can't offer more detailed info than the fellow from Sweden who seems to really know his stuff...but what about making a nandroid backup of your fully configured reference tablet (I'm assuming all tablets are rooted). Ensure all your tabs have CWM recovery and copy your nandroid file to each one.
If any of your fleet get 'corrupted' you can simply restore the original, fully configured ROM.
In fact that sounds too obvious..likely I missed something about your scenario which precludes this option from consideration!
Good luck mate.
Click to expand...
Click to collapse
Hi
Yes that was my first thought as well, tablets are rooted yes but there is no CWM for the tablet. Its an obscure Chinese branded tablet.
Unless there is another way to do nandroid backups?
hmm tricky situation. Catch 22 ! From what I know, your best bet is to backup all possible things through Titanium Backup given that you don't have the use of Nandroid backups. You can include wifi settings, messages etc but it's modular & not systemic.
I did a quick google search with no luck - time to upgrade your fleet dude :-0
Best of luck.

Recovery as a another operating system?

Hey everybody!!! I was just wondering to myself, is it possible that someone out there will make an android recovery which will work just like the actual operating system?
I mean that when you would boot into recovery - you will see a homescreen with apps you can tap on and open - just like android.
Soooooo is it possible? And if it is - is there anyone out ther willing to do it? Because it will be awesome!!!!!!!!!!! ( i know it's like dual boot, but it's cooler!!!!)
because the partition of recovery is too small, we can't put full features os like android into recovery partition
Sent from my Redmi 2 using Tapatalk
Maybe with root rights you can change that partition? I'm nearly 100% sure it's possible
The recovery is already a separate operating system. However it's not Android - as other users have pointed out, there is no space for a second Android system on a normal device.
Most devices have two boot images that each contain a Linux kernel and a ramdisk image - one boot image for Android, one for the recovery. The bulk of the Android OS is on a separate /system partition. Recovery runs fully from the ramdisk.
If you have a storage device (like a microSD card) with additional free space, then it is possible to create separate /system and /data partitions there for a second independent OS. You could use the recovery boot image to boot that OS, but you may still need a recovery, so you'd need to add some code in your secondary boot image to switch between recovery and your secondary OS.
So... is it possible? Yes. Will I do it? No.
Thanks for the answer and clarification!!!
And if you could help me a bit more: do you know of some kind of dual - boot development project which has already been started for the gs5? I have a micro sd card and am flabberghasted by the idea of two OSs on one device. Thanks!!!
You can try this http://forum.xda-developers.com/showthread.php?t=2447534
Thanks!

Meraki MC74 Android Project [HW/SW] [Experience Required][Help][Android System Noob]

Hi all, I am new to the forums and I think that I need some help with a custom android project.
[Background]
I have bought a Meraki MC74, This phone is a VOIP office desk phone that has a nice 7 inch LCD screen that make for a ballin' custom intercom phone/general android device.
Cisco Meraki has dropped support for this phone, so even if I wanted to pay for a subscription, I couldn't. So custom android it is
[So what I know]
I know that the OEM OS is android 4.X.X with a custom Cisco Meraki dialer to do Meraki's cloud mumbojumbo. I was able to use ADB and Fastboot to flash ClockworkMod, and a custom version of Android 4.1.2 to get the device somewhat working. (it had lots of bugs and problems; but it was running android free of the Cisco Dialer!)
I was able to do this with the help of fellow xdadevelopers forum user "andrewmospak" (If you're reading this; I'm the dude from Ebay. And of course, thanks bro for the help so far!)
The storage is on a 4 GB Kingston EMMC.
[What I wanted for an end goal]
I wanted to have an interesting discontinued Meraki Desk phone that runs android and get all the functions of the phone working within android.
I also wanted to expand the storage from 4GB to 32GB. ( involving de-soldering existing EMMC and solder in the bigger EMMC.)
[What caused me to write this]
I would be fine if I wanted to stop there, but I wanted to try to install a GSI of android 9 in place of 4.1.2.
Again, this wouldn't be a big deal but I had to go and screw this up. I tried to resize some of the partitions (namely system to accommodate the bigger image of the android 9 GSI)but I accidentally completely killed the system,cache, and recovery partitions.
So, as one of the first steps of trouble shooting, I went to the hardest solution. The de-soldering of the EMMC.
I reached out to Andrewmospak again and asked for a full system emmc dump to try to flash his working file system to a spare 4GB EMMC to see an example of the file system of a working android EMMC. I received the image and flashed it to a spare Toshiba chip and soldered that to the phone, but I was unable to get the phone to boot into android right away, only able to load up fastboot.
Interestingly, I know that the EMMC is working because fastboot reports the S/N as the S/N of Andrewmospak's device and not the one written on my device.
[What I don't know]
Should some of the partitions on the EMMC not be recognized by Gparted in Debian? Like the User/System and others are partitioned ext4 while others are just not recognized.
Why when trying to flash partitions using Fastboot, wont fastboot recognise a recovery partition. It would just say that the partition just doesn't exist. same story with boot.
[What needs help]
I would like to know why fastboot wont see flashable volumes when using the EMMC dump flashed to another spare Toshiba EMMC, it is clearly there.
I would like to know how to reconstruct a volume to fix missing ones, and the number of partitions android needs to run.
Would I be able to flash an image of my working device to a 32gb emmc and just expand the system and user partitions into that extra space?
I will appreciate all help given to assist me and others that want a working device instead of a paperweight. ogChamp::fingers-crossed:
MOD ACTION:
Thread closed as duplicate. Follow the original HERE

Categories

Resources