HI there
I am having a problem to re-pack my boot image to boot in my new Pantech A880S....
It is working fine if I just fastboot boot <original image>
but once I extract the ZImage and Ramdisk and then re-pack it (eventhough I didn't change anything)
and when I re-try fastboot boot <re-packed image> it comes up with error: dtb not found
I tried this same issue either on linux abootimg to re-pack image or using Win32 port exe to re-pack it
e.g. http://forum.xda-developers.com/showpost.php?p=45157543&postcount=144
Is there anyone know why? I never seen this before on other devices with such error..
anyone know about kernel and dtb , how to extract them and pack them correctly?
Splitting image to "/split_img/" . . .
BOARD_KERNEL_CMDLINE console=ttyHSL0,115200,n8 androidboot.hardware=qcom user_debug=31 maxcpus=2 msm_rtb.filter=0x3F ehci-hcd.park=3 loglevel=0
BOARD_KERNEL_BASE 00000000
BOARD_PAGE_SIZE 2048
BOARD_RAMDISK_ADDR 02000000
Unpacking ramdisk to "/ramdisk/" . . .
Compression used: gzip
4704 blocks
Done!
Everything looks ok, but when I using fastboot to boot it (my device has been unloacked bootloader)
>fastboot boot image-new.img
downloading 'boot.img'...
OKAY [ 0.301s]
booting...
FAILED (remote: dtb not found)
finished. total time: 0.316s
Edit:
I tried to looking other similar kernel source from LG G2 (MSM8974)
/arch/arm/mach-msm/akefile.boot
I seems LG also using DTB in its kernel... so I am wondering current abootimg can handle it or not?
# MSM8974
zreladdr-$(CONFIG_ARCH_MSM8974) := 0x00008000
ifeq ($(CONFIG_MACH_LGE),n)
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-cdp.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-fluid.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-liquid.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-mtp.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-rumi.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v1-sim.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v2-cdp.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v2-fluid.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v2-liquid.dtb
dtb-$(CONFIG_ARCH_MSM8974) += msm8974-v2-mtp.dtb
dtb-$(CONFIG_ARCH_MSM8974) += apq8074-v2-liquid.dtb
dtb-$(CONFIG_ARCH_MSM8974) += apq8074-v2-dragonboard.dtb
else
dtb-$(CONFIG_ARCH_MSM8974_G2_KR) += msm8974-g2-kr.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_KR) += msm8974-v2-g2-kr.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_ATT) += msm8974-g2-att.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_ATT) += msm8974-v2-g2-att.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_VZW) += msm8974-g2-vzw.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_VZW) += msm8974-v2-g2-vzw.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_SPR) += msm8974-g2-spr.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_SPR) += msm8974-v2-g2-spr.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_TMO_US)+= msm8974-g2-tmo_us.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_TMO_US)+= msm8974-v2-g2-tmo_us.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_DCM) += msm8974-g2-dcm.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_DCM) += msm8974-v2-g2-dcm.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_KDDI) += msm8974-g2-kddi.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_KDDI) += msm8974-v2-g2-kddi.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPEN_COM) += msm8974-g2-open_com.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPEN_COM) += msm8974-v2-g2-open_com.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPEN_AME) += msm8974-g2-open_ame.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPEN_AME) += msm8974-v2-g2-open_ame.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPT_AU) += msm8974-g2-opt_au.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_OPT_AU) += msm8974-v2-g2-opt_au.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_CA) += msm8974-g2-ca.dtb
dtb-$(CONFIG_ARCH_MSM8974_G2_CA) += msm8974-v2-g2-ca.dtb
endif
I modified the split tool to support dtb, please test it……
Modify permissions before you use it
chmod a+x split_bootimg_dtb.pl
View attachment split_bootimg_dtb.zip
thank benjaminwan
https://github.com/xiaolu/mkbootimg_tools
benjaminwan said:
I modified the split tool to support dtb, please test it……
Modify permissions before you use it
chmod a+x split_bootimg_dtb.pl
View attachment 2229037
Click to expand...
Click to collapse
I'm testing, hoping to succeed @benjaminwan :fingers-crossed:
benjaminwan said:
I modified the split tool to support dtb, please test it……
Modify permissions before you use it
chmod a+x split_bootimg_dtb.pl
View attachment 2229037
Click to expand...
Click to collapse
Great work! I'm going to see if I can adapt this back into unpackbootimg. :good:
https://github.com/CyanogenMod/android_system_core/tree/cm-10.2/mkbootimg
Edit: Easier than I thought just using what was already in unpackbootimg.c and bootimg.h
Soon to be added to my Android Image Kitchen: http://v.ht/AIK-
reachedxyz said:
thanks you pro
Click to expand...
Click to collapse
help me. phone my brick
Chenglu said:
https://github.com/xiaolu/mkbootimg_tools
Click to expand...
Click to collapse
Thanks, thats work for me :angel:
Hello Guys,
I'm trying to boot the HTD Desire 510 recovery CWM on my new Wiko Ridge 4G.
I also got the DTB issue, but I'm not sure on how to fix it.
Can anyone throw me some tips on this?
I've chosen the Desire CWM because it have the same chipset.
Cheers
help me
please give me some tutorial to modif the split tool.
Hi Benjamin,
I am using Lenovo a6000 plus and getting the same error while I try to fastboot using command <fastboot boot "c:\Users\rakesh\lenovo-recovery-file\recovery.img">
What should I do?
I am not even able to enter recovery mode. My mobile got switched off during android upgradation. I think I lost some system file.
My phone lenovo a6000 plus error remote dtb not found how to fix the problem
Booting problem
Please tell Step by Step. Need help does not boot into any recovery.
hi iam also having same problem for my lenovo a6000 when itry to boot into recovery iam getting this error failed {remote:dtb not found} please help m any one.
How to apply da zip file to fix dtb not found during flashboot boot recovery.img command@benjaminwan
It seems that the boot.img images for Redmi Note 2 are being built/assembled using a custom (i.e., non-standard) version of mkbootimg, using non-standard offsets for the kernel and the ramdisk. I have tested this theory with boot.img from different ROMs, and all seem to suffer from the same fate. I have tried several tools and versions of mkbootimg (including abootimg, mktimg, and umkbootimg). Most can decompress the boot images, but none can assemble a boot image that will not brick the phone.
Does anyone have a copy of the mkbootimg (binary or source) that is being used to build these boot images?
Thanks.
PS: my goal is to build in support for running stuff from /etc/init.d/ during bootup (involves editing init.rc).
No worries, I've sorted it out. Can you please close this thread? Thanks.
use carliv image kitchen search in the forum or google it but use decompile or repack for normal android not mtk in the CMD menu as mt6795 uses different compressing method
type thanks please!
DarthJabba9 said:
No worries, I've sorted it out. Can you please close this thread? Thanks.
Click to expand...
Click to collapse
It would be nice and useful for other people if you explain how you've sorted it out.
gnazio said:
It would be nice and useful for other people if you explain how you've sorted it out.
Click to expand...
Click to collapse
I'm not sure anyone wants to hear about my trials and tribulations - but it involved downloading and testing all sorts of versions of mkbootimg (binaries, and sources) and other tools, patching mkbootimg sources, downloading Xiaomi Android sources from SudaMod and nofearnohappy github repositories, and studying all the arguments given to mkbootimg in the make files, bricking the phone about 30 times, etc. Eventually, I ended up with a combination of tools (from different sources) and mkbootimg arguments that did the job. I now have init.d support built into my boot image.
I have kept all the relevant tools in a folder for future reference. I'm not sure I'm allowed to distribute them here, or even that I would encourage anyone to try them, because the risk of bricking the phone is very high if something goes wrong (and it is very easy for something to go wrong with what you change in the decompressed ramdisk). For the curious, these were the right arguments (at least, for the boot image that I used - from Deer Stable 7.0.12.0) :
Code:
mkbootimg --kernel boot.img-kernel.img --ramdisk ramdisk.gz \
--base 0x40078000 \
--pagesize 2048 \
--kernel_offset 0x00008000 \
--ramdisk_offset 0x03f88000 \
--second_offset 0x00e88000 \
--tags_offset 0x0df88000 \
--board V7.0.12.0.LHMMI \
--cmdline bootopt=64S3,32N2,64N2 \
--output new_boot.img
I used Superr's kitchen v1.0.0.4 and it worked.
Recently purchased an iplay 7t after reading the xda review. This is replacing an LG v400 tablet that I had rooted. I updated the iplay to build T701_V1.20_20191112, enabled developer options, enabled oem unlock bootloader, found the corresponding firmware pac, installed magisk and used it to patch boot.img. So far so good.
I entered fastboot, then I attempted to flash the modified boot.img and was told:
Code:
target didn't report max-download-size
sending 'boot' (18584 KB)...
OKAY [ 0.593s]
writing 'boot'...
FAILED (remote: Flashing Lock Flag is locked. Please unlock it first!)
finished. total time: 0.608s
I tried various options to unlock the bootloader:
Code:
> fastboot getvar unlocked
unlocked:
finished. total time: -0.000s
> fastboot oem unlock
...
FAILED (remote: unknown cmd.)
finished. total time: -0.000s
> fastboot oem unlock-go
...
FAILED (remote: unknown cmd.)
finished. total time: 0.002s
> fastboot flashing get_unlock_ability
...
FAILED (remote: Not implement.)
finished. total time: -0.000s
> fastboot flashing unlock
...
FAILED (remote: Not implemet.)
finished. total time: -0.000s
> fastboot flashing unlock_critical
...
FAILED (remote: Not implement.)
finished. total time: 0.016s
> fastboot flashing unlock_bootloader
fastboot: usage: unknown 'flashing' command unlock_bootloader
> fastboot flashing unlock_bootloader_nonce
fastboot: usage: unknown 'flashing' command unlock_bootloader_nonce
Okay ... fine. I fired up SPD Research tool and attempted to use it to flash the modified boot.img. It transfers the image and then times out.
As a sanity check I used SPD Research tool to flash the original boot.img and that worked fine.
I'll note the modified image is smaller than the original, however padding the modified image with zeros to the same size didn't seem to help. Using SPD Research tool to flash the padded image still timed out.
I am looking to open a request up on the Alldocube support site (currently their registration form is giving me an error), in the meantime ... suggestions? Has anyone successfully flashed a modified boot.img on this device / rooted this device?
in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.
DR.Doyle said:
in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.
Click to expand...
Click to collapse
Yes ... I have that enabled.
Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.
jwehle said:
Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.
Click to expand...
Click to collapse
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.
wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery.
Click to expand...
Click to collapse
Thanks for supplying the modified PAC and for explaining the changes.
Your PAC seemed to work fine and now that I have a better understanding
of things I should be able build my own PAC when I have a chance.
Your time and effort in explaining things is appreciated.
What's the significance of removing the encryption for the vendor partitions?
jwehle said:
What's the significance of removing the encryption for the vendor partitions?
Click to expand...
Click to collapse
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
fstab.sp9832e_1h10：
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="DarkOrange"]fileencryption[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]fileencryption[/COLOR]=aes-256-xts
---------->
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts
wangyiling said:
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
Click to expand...
Click to collapse
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.
jwehle said:
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.
Click to expand...
Click to collapse
Just for twrp to read the data partition, convenient for personal use。
It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Code:
vbmeta
boot
recovery
What was happening is when the system started normally it saw that recovery image had been modified so it checked if the boot image was the factory standard image. Since I hadn't touched the boot image the OS went ahead and attempted to replace the recovery image I flashed with a standard recovery image generated on the fly from the factory standard boot image. This caused a soft-brick when I rebooted into recovery since that recovery image wasn't signed using the public key specified by my replacement vbmeta.
By also flashing a newly signed boot image because the signature is different from what's it knows about the system no longer attempts to use it to refresh the recovery image.
Here's an outline of what I did to successfully root the device:
Use the Qin 2 Pro instructions / tools to unlock the boot loader.
Flash the appropriate factory standard firmware to establish a know starting point. I used iplay7t(T701)-Android9.0-ALLDOCUBE-191112 from the Alldocube web site.
Use SPD Rsearch Tool to extract vbmeta-sign.img, boot.img, and recovery.img.
Use avbtool (with the below patch) to extract the public keys from vbmeta-sign.img like so:
Code:
avbtool info_image --image vbmeta-sign.img.
Use make (with the below makefile) to sign vbmeta, boot, and recovery using a new key.
Flashed vbmeta, boot, and recovery.
Booted into recovery, saw that it worked, and did a factory reset.
Used magisk to patch recovery.img in the normal fashion, signed the patched recovery using the new key, and flashed the patched recovery.
Proceed to finish installing magisk in the normal fashion.
Notes:
rsa4096_vbmeta.pem is the private key mentioned in the Qin 2 Pro article.
The dhtbsign-vbmeta command is basically the dhtb signing python script from Qin 2 Pro article.
Here's the trival patch for avbtool to dump the public keys.
Code:
--- avbtool 2020-02-22 22:11:55.107787032 -0500
+++ avbtool.dumpkeys 2020-02-22 22:15:36.046283077 -0500
@@ -1657,6 +1657,10 @@ class AvbChainPartitionDescriptor(AvbDes
Arguments:
o: The object to write the output to.
"""
+ kfd = open(self.partition_name, "w");
+ kfd.write(self.public_key);
+ kfd.close();
+
o.write(' Chain Partition descriptor:\n')
o.write(' Partition Name: {}\n'.format(self.partition_name))
o.write(' Rollback Index Location: {}\n'.format(
Here's the makefile I used for signing the images.
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: Makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
dhtbsign-vbmeta vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
avbtool add_hash_footer --image recovery-sign.img \
--partition_name recovery --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
@ jwehle，Very grateful for your detailed sharing
Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.
MissAyako said:
Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.
Click to expand...
Click to collapse
Seems the issue was with Windows. I thought I would be able to get the unlock token with Windows and then use WSL to do the rest of the signing, but apparently not.
Luckily I had an old laptop lying around. I threw Linux Mint on it and it worked just fine.
It didn't seem to work just using a live USB; I had to install Linux to the hard disk, but YMMV.
jwehle said:
It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Click to expand...
Click to collapse
This was wonderful, thank you! I've added some of my own notes below as an experience of what I encountered when attempting this process myself (spoiler'd because it is a lot).
I do not have enough post count to add links, but titles to the relevant articles has been added.
Follow steps in Article "Guide: How to Unlock Xiaomi Qin 2 (Pro) and Install Custom ROMs" from step 1 to (and including) step 10 (Unlocking section).
Notes:
- A Linux PC is necessary.
- You'll have to mark the "fastboot" file from the "Android_device_unlock.rar" archive as executable (chmod +x).
- Run the "fastboot" file as root.
- Getting the "SPD Research Tool" to pick up the tablet and not let the tablet try to move to either the charging
screen or the bootlogo is difficult, but do-able. Press and hold Power+Vol_Up and release when Windows does its
USB device detected chime.
- Flashing takes a few minutes (I think around 300 seconds).
- The SPD Research Tool extracts the PAC file contents into a folder. Grab the system images from there.
- The "avbtool" is available to be cloned via git from Google's repo
- The avbtool is a python script that is patched with three lines of code at line 1776:
Code:
kfd = open(self.partition_name, "w");
kfd.write(self.public_key);
kfd.close();
- When you use the patched avbtool on the vbmeta-sign.img file you copied (avbtool info_image --image vbmeta-sign.img)
it will produce several partitions with relative public keys that need to be stored in separate files for the next step.
The contents of the files are simply the public key and the partition name as the file name. Store the files in a folder named "keys".
- When creating the makefile, ensure that proper indentation is used. The code segment below is properly formatted (hopefully). If you get make errors, remove and re-indent the lines.
- If your "rsa4096_vbmeta.pem" keyfile is not placed alongside the makefile, ensure the --key flag points to this file.
- The makefile exists in the same directory as the system images.
- I had to insert local paths to the avbtool, as it was not installed to the system PATH.
- The dhtbsign-vbmeta.py command is located below. Make sure to mark this as executable as well.
Everything else is rather straightforward.
# makefile
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
./dhtbsign-vbmeta.py vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
# dhtbsign-vbmeta.py file (from "How I Unlocked Xiaomi Qin 2 Pro and Installed Phh GSI")
Code:
#!/usr/bin/env python
import hashlib
import sys
f = open(sys.argv[1], "rb")
b = f.read()
sha = hashlib.sha256(b).digest()
f.close()
f = open("vbmeta_signed.img", "wb")
f.write(b)
f.seek(1048576 - 512)
f.write(b'\x44\x48\x54\x42\x01\x00\x00\x00')
f.write(sha)
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')
f.seek(1048576 - 1)
f.write(b'\x00')
f.close()
wuxianlin has build a twrp device for T701.
i think this will be a help .
Help me
Sir help pliz same problem my device ,same chipset , Symphony i95 ,pliz sir modify my pac file pliz....
wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.
Click to expand...
Click to collapse
can i just flash the pac without unlocking the bootloader.
thanks in advances
hidroela said:
can i just flash the pac without unlocking the bootloader.
thanks in advances
Click to expand...
Click to collapse
yes,just falsh pac
wangyiling said:
yes,just falsh pac
Click to expand...
Click to collapse
i did unlocked the bootloader and flash the pac and follow the instructions for magisk to work, but after a third reboot Root was gone.
i don't know what I am missing.