Related
I'm starting this thread to document the work on creating a custom recovery image for the Tattoo.
The main goal is to provide a recovery image that will serve as the launchpad for flashing custom roms.
The Tattoo Custom Recovery Image will provide:
1) A way to use an update.zip signed with test-keys (already accomplished);
2) A way to perform a full backup of mtd2,mtd3,mtd4 and mtd5 (boot,system,cache and data).
3) A way to perform a full restore of the backup achieved by 2);
4) Adb support (already accomplished);
4.1) Adb shell support.
I'm open to input about using nandroid. Right now, without a S-OFF/ENG SPL this looks useless.
Also, if you have any other special need for recovery, please feel free to express it
Alpha release
Tattoo's Custom Recovery Image, Alpha Release
This first release includes:
- ADB enabled recovery
- ADB enabled root shell
- Accept update.zip signed with test keys
- All partitions mounted
- Custom recovery program (the last two options are stubs, not really working yet)
- Included in /sbin: busybox, flash_image and BART
- I've not used BART and, at the moment, cannot attest if it works or not.
- Backup script in /sbin/backup.sh
- Restore script in /sbin/restore.sh
With this custom recovery you can now do a full backup of your unit, by dumping the mtd block devices to your sdcard. Afterwards, you can use flash_image to recover your Tattoo to it's previous state.
I'm releasing this image as is. This is not a point-and-click recovery tool. If you don't know what you're doing, you can seriously damage your unit. The only reason I'm releasing this is in an effort to provide other devs with a way to easily recover their units, back to day-to-day configuration, while experimenting with them.
To flash:
Copy TCRI.alpha.img to /sdcard.
Run "flash_image recovery /sdcard/TCRI.alpha.img"
To reboot into recovery (quickest way)
adb reboot recovery
Please comment
thanks for you work
i try to flahs and get permission denied, do you know why?
flash_image: permission denied
chusen said:
i try to flahs and get permission denied, do you know why?
Click to expand...
Click to collapse
Partition remounted writeable from a fresh rebooted system with the tattoo-hack.ko module inserted??
But I'm sure you did that before because of:
I'm releasing this image as is. This is not a point-and-click recovery tool. If you don't know what you're doing...
Click to expand...
Click to collapse
;-)
-bm-
Thank you very much for your excellent job
Someone could install custom alpha recovery?
thx
@-bm-:yes I will try that way since the beginning. i mount with rw permissions /system and /data. i know is not a point-and-click recovery tool but i think i need more permissions but where?
Where did you guys get your flash_image binary from ?
The error you're getting is from flash_image, not from my recovery image.
I'll attach the flash_image I've been using to this post.
Please tell me if this solves your problem. You need tattoo-hack.ko module inserted, if you're using a release kernel.
Edit: You have the correct permissions in your flash_image binary, right ? After pushing it to the device, don't forget to chmod 755
It works I like drawing, jejeje.
Backup and Restore functionality appears to have no further
The adb root shell is perfect
Very good Work
for when the beta version? and the final version? lol
I try to dump the system userdata and boot.img and when i try to extract with unyasffs and i get this when i try to extract system.img
Code:
4 [main] unyaffs 3940 handle_exceptions: Exception: STATUS_ACCESS_VIOLATION
644 [main] unyaffs 3940 open_stackdumpfile: Dumping stack trace to unyaffs.exe.stackdump
and this with others
Code:
broken image file
Code:
[email protected]:~/Tattoo/images/boot/1$ ../../unpack.pl ./boot.1.img
Page size: 2048 (0x00000800)
Kernel size: 1899580 (0x001cfc3c)
Ramdisk size: 160952 (0x000274b8)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1 console=null
Writing boot.1.img-kernel ... complete.
Writing boot.1.img-ramdisk.gz ... complete.
528 blocks
[ boot.1.img-ramdisk.gz decompressed to boot.img-ramdisk ]
My image dumping script is OK
Take a look here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
The boot.img is not a yaffs2 image. It's a special format, comprised by a 2k header, a kernel image and a ramdisk.
The system.img is a yaffs2 image. From unyaffs's homepage: "Unyaffs is a program to extract files from a yaffs file system image. Now it can only extract images created by mkyaffs2image."
Chusen, I think it would be better to create a new thread for this, since it doesn't concern the custom recovery image directly.
Thank god for custom recovery!
Now we can really start cooking ROMs... gonna break out the tools tonight and get Android 1.6/2.1 sources ready to compile.
leon1984 said:
for when the beta version? and the final version? lol
Click to expand...
Click to collapse
You tell me
Next in line is to tie the backup/restore scripts to the UI, which won't be too hard.
Later, I may mess around with nandroid and bart, to see if they provide something more than my scripts.
Afterwards, when we have some custom roms available, I may create a downloader/updater option, to make it easier to install those.
Also, I'm taking requests for new features
suggestions about scripts
Excellent work, mainfram3. Thank you.
I have extracted the img file, and check backup.sh and restore.sh scripts. The code for checking sdcard remaining space is done. Here it is:
Code:
## TEST: Check free space in sdcard
NEED_KB="200000"
REM_KB=`du /sdcard | awk '{print $6}'`
if [ ${REM_KB%K} -lt $NEED_KB ]; then echo "Not enough space in /sdcard, exiting"; exit; fi
backup space min set to 200MB.
There is another suggestion about restore.sh. Because of backing up img to /sdcard/Backup, $1 might not be needed, right?
mainfram3 said:
Code:
[email protected]:~/Tattoo/images/boot/1$ ../../unpack.pl ./boot.1.img
Page size: 2048 (0x00000800)
Kernel size: 1899580 (0x001cfc3c)
Ramdisk size: 160952 (0x000274b8)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1 console=null
Writing boot.1.img-kernel ... complete.
Writing boot.1.img-ramdisk.gz ... complete.
528 blocks
[ boot.1.img-ramdisk.gz decompressed to boot.img-ramdisk ]
My image dumping script is OK
Take a look here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
The boot.img is not a yaffs2 image. It's a special format, comprised by a 2k header, a kernel image and a ramdisk.
The system.img is a yaffs2 image. From unyaffs's homepage: "Unyaffs is a program to extract files from a yaffs file system image. Now it can only extract images created by mkyaffs2image."
Chusen, I think it would be better to create a new thread for this, since it doesn't concern the custom recovery image directly.
Click to expand...
Click to collapse
and if you want to extract the boot.img here are the two scripts you need to fully extract the kernel(zImage) and ramdisk
split_bootimg.pl
and
extract-ramdisk.sh
they are attached below
jamezelle:
extract-ramdisk.sh missed #!, and the ramdisk zip file should be passed to $1 of this script.
mainfram3 said:
1) A way to use an update.zip signed with test-keys (already accomplished);
Click to expand...
Click to collapse
Hi mainfram3,
I don't want to jack your thread - could you add a little elaboration on this point, or provide a URL so I can learn a little more? The SPL on the phone (oem-78 or fastboot mode) accepts updates signed with the test key from the SDK? (Or some other key?) (On the Eris, the "rom.zip" files unpacked by the RUU are prepended with a mystery blob of 256 bytes - s'pose it could be a mic/sig, but if that's what it is, it don't appear to be in a standard DSA/RSA format, and those .zip files are not signed using the .apk/.jar manifest-signing method)
FYI here's an entertaining story of an epic fail in a related area. After reviewing the fastboot sources from the android tree, I decided that I wanted to spy on the (Windows) RUU update program by sniffing the USB bus - in particular to see if it was explicitly passing signatures in .sig files. (That's an undocumented command-line behavior in fastboot.)
Turns out that recent versions of libpcap and Wireshark allow for USB bus capture on Linux - and using the "usbmon" kernel module in Ubuntu 8.04 LTS, sniffing the USB (5k packet size) seems to work without hitch, even at USB 2.0 speeds. So I took it one step further, and installed WIn Xp SP3 in a QEMU VM on the Ubuntu machine, with the intention of running the RUU updater inside the Xp VM and sniffing the USB bus in the host OS (Linux) machine.
The result? QEMU/Win Xp VM can talk to the phone in either fastboot or adb mode, but bluescreens as soon as you start to move data at any appreciable rate. Doesn't seem to be dependent on whether monitoring is taking place. I might try putting the phone behind a cheapo USB 1.1 hub, and see if that helps, but for the moment I am stopped out on this hack.
bftb0
cn.fyodor said:
jamezelle:
extract-ramdisk.sh missed #!, and the ramdisk zip file should be passed to $1 of this script.
Click to expand...
Click to collapse
it works yea sorry about the
#/bin/sh
i didnt write the scripts btw
After releasing my custom recovery and boot images several people have messaged me about how to create these images.
First, you need to read this article, carefully: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images. It explains the format of these images. I suggest you try to extract the kernel and the ramdisk with a hex editor, as it will help you understand how the format works.
Afterwards, for convenience, you can use the two scripts provided in that page: unpack-bootimg.pl and repack-bootimg.pl.
You should now have two files, the kernel and the ramdisk.
Extract the contents of the ramdisk with:
Code:
gunzip -c ramdisk.cpio.gz | cpio -i
You can now proceed to alter what you wish, in the ramdisk.
For repacking, I use the tools provided in the Android 1.6 SDK. You need to download it from http://developer.htc.com/. After compiling the SDK, you should have (among others) these two tools: mkbootfs and mkbootimg.
To recreate the ramdisk, use the following command (assumes ramdisk in ramdisk folder):
Code:
mkbootfs ramdisk | gzip > ramdisk.gz
And now, to recreate the image:
Code:
mkbootfs [b]--base 0x2e00000[/b] --cmdline 'cmdline: no_console_suspend=1 console=null' --kernel kernel.gz --ramdisk ramdisk.gz -o my_new_boot_image.img
The only tricky part, and where I guess everyone is having problems, is with the --base 0x2e00000 option. This is the base address for the kernel and, without this, your Tattoo will hang at boot.
Do not try to create custom images unless you are fully aware of what you're doing. YOU CAN BRICK YOUR DEVICE
Best of luck
Thanks a lot mainfram3!
I'll base CoburnROM's boot.img off yours, and then we'll go from there.
All we need now is a how to on make your own system.img (either taking a RUU system and gutting the crap out of it or using one that a member has precompiled as a base) and we'll be set for cookin' ROMs with gas. Want fries with dat?
Thanks a million!
Cool! You have dispeled the clouds.
mf3: How did you know that base address of the kernel? I repacked the boot.img file without the option '--base xxx', that's why this one bricked my tattoo i think.
Thanks, you did the great job.
BTW, I break through this cloud by using HEX editor to comparing your image and mime and found that the kernel address, ramdisk address are different. But I don't know why... Would you mind to tell us why and how you find it??
huchengtw said:
Thanks, you did the great job.
BTW, I break through this cloud by using HEX editor to comparing your image and mime and found that the kernel address, ramdisk address are different. But I don't know why... Would you mind to tell us why and how you find it??
Click to expand...
Click to collapse
See at kernel sources at the file:
arch\arm\mach-msm\include\mach\memory.h
.....
/* physical offset of RAM */
#if defined(CONFIG_ARCH_MSM7225) || defined(CONFIG_ARCH_MSM7625)
#define PHYS_OFFSET UL(0x02E00000)
.....
I think there it is ......
cya
Well, actually I got the base address from looking at bootimg.h, to understand the structure of the header in the image files.
I then figured out the the kernel base address in the boot.img and recovery.img from the rom.zip (from the RUU) and compared it against the kernel address in the images I was creating. After that, I adjusted the arguments to mkbootimg so that it would generate a file with the same address as the originals.
i am trying to put together a recovery for the Sholes XT701. obviously i am missing this base offset because it hangs at boot. i was looking in the memory.h file and see the following but this is for the ram. where can i find the base offset for the kernel? that is what i need right?
Code:
#elif defined(CONFIG_MACH_SHOLES_UMTS) || defined(CONFIG_MACH_MAPPHONE)
#define PHYS_OFFSET UL(0x80C00000)
do you have a bootimg.h ? mainfram3 got his information from there...
Did you tried to put all in a rom.zip and replace the one that comes with Ruu WWE? IF the addresses are the same maybe it will flash your custom rom.
mainfram3 said:
Well, actually I got the base address from looking at bootimg.h, to understand the structure of the header in the image files.
I then figured out the the kernel base address in the boot.img and recovery.img from the rom.zip (from the RUU) and compared it against the kernel address in the images I was creating. After that, I adjusted the arguments to mkbootimg so that it would generate a file with the same address as the originals.
Click to expand...
Click to collapse
sorry,but how to create recovery.img?
is boot.img==recovery.img?
mainfram3 said:
And now, to recreate the image:
Code:
mkbootfs [b]--base 0x2e00000[/b] --cmdline 'cmdline: no_console_suspend=1 console=null' --kernel kernel.gz --ramdisk ramdisk.gz -o my_new_boot_image.img
Click to expand...
Click to collapse
Hi,
isn't it mkbootimg instead of mkbootfs to create an image?
Moreover, the script repack-bootimg.pl doesn't work for me. But your method using mkbootfs works well.
Thanks.
can an expert help me out? I have 2 recoveries, both of which can be flashed to my phone without any problem, except I have troubles using them.
Recovery X can be used without any problem, all the options work and I can perform nandroid backup and restore perfectly fine. However, it's missing the option to flash a custom rom from the memory card.
Recovery Y supports all the options, including the option to flash a custom rom from the memory card. However, it's not made specifically for my phone, which means that none of the buttons on my phone work. Therefore, I can only navigate through the options up or down, but I can't select it or go back.
My phone is a chinese clone btw, the brand is STAR A1000. That's why there aren't many properly made recoveries available for it. Anyway, since Recovery X works, I was wondering if someone could just compare the 2 recoveries and just change the button mappings on Recovery Y, as you can simply take the button mapping from Recovery X and that's it?
I dunno how to do it and don't wanna risk bricking my phone or anything, so if someone can kindly help me out that would be great.
I don't have this phone, but isn't there a keychars.pl file under /usr/"don't know the name anymore"/? there are files assigning an action to a pressed key - you just have to compare the keychars file from X and Y and change the Y keychars accordingly. Hope that helps, since I also never did this before.
Oh well I didn't know that
I dunno anything about creating a recovery or boot image. All I know is how to flash it and root the phone, i.e just the basic stuff.......
would you be able to help me compare the files and make the changes?
Here's the link to the files:
http://forum.xda-developers.com/attachment.php?attachmentid=740516&d=1317801095
http://forum.xda-developers.com/attachment.php?attachmentid=737495&d=1317534773
the first link is the recovery that is currently working for me, but doesn't have the option to flash a firmware from the memory card. It's a modified version of the ClockworkMod Recovery v4.0.0.5.
as for the 2nd link, please extract just the "a1000.img" recovery. My phone is the STAR A1000 and that's the recovery that contains all the options, except the buttons don't work on it. It's also in chinese but I can read it. So ya, I just need someone to remap the buttons that work in the "cw.img" recovery and copy that to the "a1000.img" recovery....
Hello!
This is -at least I hope it is- an easy to follow guide on how to unpack boot.img files (aka custom kernels) and modify the ramdisk.
Now, why would you want to do that?
First and simplest thing that comes to mind is for editing the kernel boot logo (the one that appears before the boot animation).
There are also a lot of other things you can edit in the ramdisk, but they require a bit more advanced knowledge, so we won't talk about them here.
Requirements:
1. Linux (any form will do, for example virtual box etc)
2. Perl (already included in Ubuntu, me thinks)
3. The Xperia Boot Tools package attached in this post
4. The mkbootimg binary (I already compiled it for Linux x86 and included it in the attachment)
5. Reading this post VERY VERY VERY carefully
Step 1: The mkbootimg binary
Let's install mkbootimg (we need it in order to repack the boot.img).
In a terminal window, cd to the directory where you extracted the mkbootimg file and type:
Code:
[B][I]sudo cp mkbootimg /bin/[/I][/B]
And then
Code:
[B][I]sudo chmod 755 /bin/mkbootimg[/I][/B]
Done!
* After first command, terminal will ask for your user password, type it, press enter and the command will be executed immediately.
Step 2: Splitting the boot.img
At this point, we need a boot.img file to play with.
Pick your favorite custom kernel and get the .img.
Place it in a folder along with the 2 perl scripts from the attached package.
In a terminal window, cd to the above-mentioned folder.
Next, type this command:
Code:
[B][I]perl split_bootimg.pl boot.img[/I][/B]
The command will return something like this:
Page size: 2048 (0x00000800)
Kernel size: 3132176 (0x002fcb10)
Ramdisk size: 3484496 (0x00352b50)
Second size: 0 (0x00000000)
Board name:
Command line:
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
Now the kernel is successfully extracted to your current directory.
It consists of 2 files: boot.img-kernel and boot.img-ramdisk.gz.
Step 3: Unpacking ramdisk
So we unvealed the ramdisk in our previous step but it is still of no use to us, so we need to un-gzip and then un-cpio it.
In the same terminal window as before, type:
Code:
[I][B]mkdir ramdisk[/B]
Code:
[B]cd ramdisk[/B]
Code:
[B]gzip -dc ../boot.img-ramdisk.gz | cpio -i[/B][/I]
Last command will return something like:
10503 blocks
Our ramdisk is unpacked now in the newly created /ramdisk folder.
Step 4: Editing ramdisk files
Now you can edit the contents of the ramdisk.
BE EXTREMELY CAREFUL AND NEVER EVER DO ANYTHING "JUST 'CAUSE"...
You need to be fully aware of what you're doing.
Good news is, changing the logo.rle (the static boot logo image) is fairly easy.
You just need to replace it with your .rle file.
I am not going to explain how to make your own .rle files right now.
Feel free to have a look at this thread for more info.
However, I attach the stock SE boot logo in case anyone misses it when he's on custom kernel.
IMPORTANT: Don't accidentally add irrelevant files to the ramdisk directory as cpio will include them too and your new boot.img will be useless.
Also, bear in mind:
DooMLoRD said:
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot
Click to expand...
Click to collapse
Step 5: Repack the ramdisk
Now that's all done, we need to pack the kernel back up into a flashable img file.
First, we will pack the ramdisk back to it's original state.
In the same terminal window as before, type:
Code:
[B][I]find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz[/I][/B]
Step 6: Repack the boot.img
In our last step, back into the terminal we go to use the "repack-bootimg" perl script that will give us our brand new boot.img.
Make sure to cd to the directory that the perl scripts are, much like in Step 1.
Type this command:
Code:
[B][I]perl repack-bootimg.pl '/.../.../.../boot.img-kernel' '/.../.../.../ramdisk' newboot.img[/I][/B]
Of course, replace /.../.../ with the path to the boot.img-kernel file and the ramdisk directory respectively.
All done! Your new img is newboot.img and is ready to be flashed!
ADVICE: Use fastboot boot and not fastboot flash boot the first time, to test that the new kernel boots. If all is well, proceed with the actual flashing!
FAQ:
- Can I do this on Windows?
- Not that I know of, no. You can use Vmware or VirtualBox to install a raw Ubuntu image (pure command line) on your Windows PC though.
- Great! How can I do this then?
- Wish I knew! I have a Linux partition on my PC, it has been like that forever. Google is your friend!
- This is so complicated, is there an easier way? Can you make a zip for me to use in recovery?
-
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
- OK, don't get upset. Can you do it for me?
- I will have to say no, because I know that the minute word gets out that I take requests, I will be overwhelmed.
Took me several hours to figure all this out but it will take you less than 10 minutes to do it yourself if you carefully follow the instructions.
- I think this or that is wrong and it should be like this or that.
- Thank you very much for correcting me! I am still learning! Please post your corrections here or PM me and I will update the thread ASAP!
References:
- HOWTO: Unpack, Edit, and Re-Pack Boot Images
- How to Port Android to Another Device
- [How-To] Make custom bootscreen/bootlogo (image to rle)/(rle to image)
Thanks to:
- Riyal for giving me the idea to get into this.
- pvyParts because without him I'd only be "pulling Irises"...
Cheers!
Thank you very much. I've been looking for something like this.
Anyways, use VirtualBox instead of VMware. It's a thousand times better.
or try pendrivelinux,boot linux from windows..great tutorial,gonna try it
so everyone can be doomlord
question,if i manage to change boot image and repack the it back,is there any chance for me to "brick" the kernel?
Sent from my LT18i
Locked Bootloader
Hello Iridaki,
many thanks for your apports (this and the init.d script). I'm actually user from a Spanish forum called www.htcmania.com (you may have heard about thedr0idboy, which is a Neo developer) and we were trying to pack kernels in order to flash it in locked bootloader devices or at least try to create an Overclock module for stock kernel that can be flashed in locked devices.
Do you think we can use this to achieve this goal? I just hate Arc S with it's damn 1.4 GHz processor :S. It was released only a month after I got my Arc.
Many thanks for your time and your efforts!!
P.D: a girl developer!!!
rashid.fairus said:
so everyone can be doomlord
question,if i manage to change boot image and repack the it back,is there any chance for me to "brick" the kernel?
Click to expand...
Click to collapse
Nah, it takes a lot more to be DoomLord..!!!
If there are no errors in the cmd, boot.img should be OK.
By using flashboot boot command, the kernel is sent to the phone and it tries to boot it. It's not flashing it, so if it fails, it immediately goes back to previous kernel.
So don't worry! Imagine that until I found the correct script, I had tried more or less 10 crapernels (crappy kernels)!!!
iR¡[email protected]!* via Tapatalk
iridaki said:
Nah, it takes a lot more to be DoomLord..!!!
If there are no errors in the cmd, boot.img should be OK.
By using flashboot boot command, the kernel is sent to the phone and it tries to boot it. It's not flashing it, so if it fails, it immediately goes back to previous kernel.
So don't worry! Imagine that until I found the correct script, I had tried more or less 10 crapernels (crappy kernels)!!!
iR¡[email protected]!* via Tapatalk
Click to expand...
Click to collapse
looks like our themes and apps forum have a new section,kernel theming,,(iridaki,you have purple theme for apps and roms,how about kernel?)
Sent from my LT18i
A big thanks, iridaki!
I was looking forward to such thread.
I did also a lot of search on google too, but somehow I couldn't find any match.
I am an experienced Linux user, so that shouldn't be a problem for me.
I'll try everything this weekend.
Afaik, CWM is also stored in the kernel, so is it possible to modify it with the tool?
I don't want to have a step by step guide, just a reference would be great (of course if you know one).
Anyway, thanks for your great contributions in XDA.
Sent from my LT18i using xda premium
OMG... :-o Iris you are a genius.
Sent from my Arc S LT18i using Xda Premium App
glaudrem said:
Hello Iridaki,
many thanks for your apports (this and the init.d script). I'm actually user from a Spanish forum called www.htcmania.com (you may have heard about thedr0idboy, which is a Neo developer) and we were trying to pack kernels in order to flash it in locked bootloader devices or at least try to create an Overclock module for stock kernel that can be flashed in locked devices.
Do you think we can use this to achieve this goal? I just hate Arc S with it's damn 1.4 GHz processor :S. It was released only a month after I got my Arc.
Many thanks for your time and your efforts!!
P.D: a girl developer!!!
Click to expand...
Click to collapse
currently we cant use custom kernels on locked bootloader...
there is a way to make overclock module for stock kernel... i am looking into that possibility & i have contacted a few devs... i will work on it when i get time...
@Iris
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot
DooMLoRD said:
@Iris
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot
Click to expand...
Click to collapse
Great tip indeed!!! Added to the OP!
I haven't come across the issue yet because I am only editing some tweaks and the logo.rle but say someone uses a much smaller logo and deletes some scripts, would he need to use a filler file, even if it is for 20-30 KB?
THANKS!
iridaki said:
Great tip indeed!!! Added to the OP!
I haven't come across the issue yet because I am only editing some tweaks and the logo.rle but say someone uses a much smaller logo and deletes some scripts, would he need to use a filler file, even if it is for 20-30 KB?
THANKS!
Click to expand...
Click to collapse
size of logo doesnt really matter... just the final size of the boot.img matters...
btw the logo.rle must have correct permissions (644)
DooMLoRD said:
size of logo doesnt really matter... just the final size of the boot.img matters...
btw the logo.rle must have correct permissions (644)
Click to expand...
Click to collapse
Yes, but if the logo.rle is replaced with a smaller one in size, ramdisk size is reduced accordingly, isn't it?
Permissions are taken care of while unpacking/repacking.
Overall, this guide works, since I've sorted everything out, hasn't failed me yet!
dp94 said:
Afaik, CWM is also stored in the kernel, so is it possible to modify it with the tool?
I don't want to have a step by step guide, just a reference would be great (of course if you know one).
Anyway, thanks for your great contributions in XDA.
Click to expand...
Click to collapse
My initial response would have to be: I have no idea!
However, tell me what exactly do you want to edit. Images, colors, features?
I'll look into it, currently I have never been in involved with recovery.
theduke89 said:
OMG... :-o Iris you are a genius.
Click to expand...
Click to collapse
I have my moments.
Presumably, kernel.sin can be renamed to boot.img for splitting without problems, or am I missing something pertinent to SE?
LenAsh said:
Presumably, kernel.sin can be renamed to boot.img for splitting without problems, or am I missing something pertinent to SE?
Click to expand...
Click to collapse
NOOOOOOO!!
DoomLord has released a .sin unpacker. Unpack the kernel.sin with it, then repack it with my script.
iR¡[email protected]!* via Tapatalk
Found that previously, but the repacker doesn't work. I think the script he published is a hack of something else and may have errors.
LenAsh said:
Found that previously, but the repacker doesn't work. I think the script he published is a hack of something else and may have errors.
Click to expand...
Click to collapse
Well, no, the script is OK, it's just made to work with the particular unpacker I included in the package. You need to edit it a wee bit to work with the sin unpacker. If I get some time in the weekend, I'll look into it too.
iR¡[email protected]!* via Tapatalk
Magic, thanks Iris. I recall the unpacking is fine, it is just repacking that doesn't yield either a boot.img OR kernel.sin due to the mixed file names/folders etc. It's been a few months since I tried... forgive me. All I was doing at the time was taking a stock Neo kernel and making it insecure. Which is dead easy normally. done it plenty with other phones, but SE .sin files threw me.
iridaki said:
My initial response would have to be: I have no idea!
However, tell me what exactly do you want to edit. Images, colors, features?
I'll look into it, currently I have never been in involved with recovery.
Click to expand...
Click to collapse
Just to change the colors, rename options, maybe integrate some features into one option.
I have really tried to search a lot, here in XDA & Google, but I have no idea.
dp94 said:
Just to change the colors, rename options, maybe integrate some features into one option.
I have really tried to search a lot, here in XDA & Google, but I have no idea.
Click to expand...
Click to collapse
You would have to rebuild CWM from sources or so i believe. dont ask me how either as i've not a clue
LenAsh said:
Magic, thanks Iris. I recall the unpacking is fine, it is just repacking that doesn't yield either a boot.img OR kernel.sin due to the mixed file names/folders etc. It's been a few months since I tried... forgive me. All I was doing at the time was taking a stock Neo kernel and making it insecure. Which is dead easy normally. done it plenty with other phones, but SE .sin files threw me.
Click to expand...
Click to collapse
use this tool
http://forum.xda-developers.com/showthread.php?t=1262656
and then you will have a kernel and ramdisk and then it is just like any other boot img i had to edit it to make it unpack the ramdisk aswell. ( had to remove the ../ right after the gzip command )
basicaly use the file in that post instead of iridakis "split_bootimg.pl"
Pvy
I can change the boot logo now. Thanks very much.. I'm using doomlord kernel, but I love SE original boot logo. Finally I managed to change it. Thanks again. I just follow the instruction and it works. The reduce in size of boot.img didn't cause any problem at all... ;-)
Sent from my LT15i using xda premium
Hi all,
I am a developer in GT-I9100G sub-section. I made a tutorial over there for I9100G on building a kernel. Since the method is very similar, I thought of posting a tutotial here for N7000 too so that it will help many new and aspiring developers to build their own kernel for GT-N7000.
Okay. Let's learn how to build kernel for Galaxy Note N7000. There are many ways to build. I am just presenting here the way I build and make kernel.
NOTE 1: Follow the instructions exactly.
NOTE 2: Kernel is opensource. If you make any changes to it, you're expected to share your source. (Usually people share it over github )
NOTE 3: FLASHING KERNEL IS RISKY AND DANGEROUS. BE CAREFUL. BUILD AND FLASH ON YOUR OWN RISK.
What you need to have:
Ubuntu 10.04 and above (I use 10.04 )
ARM tool chain (Download HERE. Click on IA32 GNU/Linux TAR under Advanced Packages)
Samsung's opensource kernel for N7000 (Download HERE. Go to Mobile->Mobile Phone-> Select GT-N7000 and download the zip)
Setting up toolchain:
Extract the tar you downloaded(Suggestion: Extract to one folder where you can have everything. In my case /home/superatmos/build_kernel).
After extracting, you'll see a folder named arm-2010q1. Inside there will be many folders (ex. bin, lib and so on.)
Folder structure will be: /home/<your_name>/build_kernel/arm-2010q1
Setting up kernel:
Extract the zip you've downloaded from samsung's opensource.
You'll find two zips.
Extract GT-N7000_Kernel.tar.gz to /home/<your_name>/build_kernel/
Folder structure: /home/<your_name>/build_kernel/GT-N7000_Kernel
Setting up initramfs:
Samsung's zImage is divided into two parts: Opensource kernel (which you downloaded from samsung's website) and initramfs (which is root file system to boot up the device).
Since I don't have the device, I don't have initramfs either. :-( (If some kernel developer for GT-N7000 can provide a sample initramfs for reference, I can attach it here and give credits to him )
The initramfs(let the folder name too be initramfs) folder need to be copied to /home/<your_name>/build_kernel/
Folder structure: /home/<your_name>/build_kernel/initramfs
Now the entire setup is ready. Let's start modifying kernel configuration.
Setting up kernel config:
Go to /home/<your_name>/build_kernel/GT-N7000_Kernel/arch/arm/configs folder.
Copy c1_rev02_q1_defconfig file and paste it in kernel root folder (/home/<your_name>/build_kernel/GT-N7000_Kernel/).
Rename c1_rev02_q1_defconfig to .config in kernel root folder.
Now open Makefile which is in your kernel root folder(/home/<your_name>/build_kernel/GT-N7000_Kernel/).
Modify the below lines (I guess line 195 and 196).
Code:
ARCH ?= arm
CROSS_COMPILE ?= /home/<your_name>/build_kernel/arm-2010q1/bin/arm-none-linux-gnueabi-
Save and close.
Modifying kernel configuration:
Now open .config file(which you renamed). If its not seen, it might be hidden. Go to View->Show hidden files and there you go.
Do the below things:
Adding local version:
Change CONFIG_LOCALVERSION=" " to anything you like. I add this way:
CONFIG_LOCALVERSION="-N7000-superatmos"
Adding initramfs path:
You need to let kernel know the path from which it needs to take initramfs.
Change CONFIG_INITRAMFS_SOURCE=" " to ../initramfs (In this tutorial it's the path. If you had copied anywhere else, give the path properly).
Enough for now. Once you get experience, you can modify many configurations as per your liking and save. This configuration can be changed by GUI too with the command make menuconfig.
The Important part: Building the kernel:
Open terminal.
Go to path /home/<your_name>/build_kernel/GT-N7000_Kernel/
Type make.
THAT'S ALL. YOUR zImage is ready and is available in /home/<your_name>/build_kernel/GT-N7000_Kernel/arch/arm/boot/zImage.
Install the zImage on the device:
Go to the path where zImage is present and type the below line in command line.
Code:
tar cvf N7000_kernel.tar zImage
Flash the tar using odin.
DONE. CONGRATULATIONS. NOW YOU'VE YOUR OWN KERNEL.
Give me your feedback so that I can improve this tutorial and make modifications to the tutorial if necessary. And of course do post here about how your build went. All the best.
Reserved
Reserved
Last one
Superatmos good too see you in N7000 forum.Wil you launch Superatmos Rom for N7000
Sent from my LG-P500 using xda premium
Been using windows all the time. Seems its good time to learn linux and ubuntu
muhamet said:
Superatmos good too see you in N7000 forum.Wil you launch Superatmos Rom for N7000
Sent from my LG-P500 using xda premium
Click to expand...
Click to collapse
Not as of now. I don't have the device. But I have plans to extend this tutorial to deodexing, modifying initramfs, building custom rom and more.
looks interesting.
i just want to make sure.. if for some reason i used odin to flash the tarred zImage and it's a broken zImage. or corrupted file or false configuration that will break the booting process. will i see be able to go to download move or cwm mode ?
what are the risks here besides the regular odin risks ?
ufk said:
i just want to make sure.. if for some reason i used odin to flash the tarred zImage and it's a broken zImage. or corrupted file or false configuration that will break the booting process. will i see be able to go to download move or cwm mode ?
what are the risks here besides the regular odin risks ?
Click to expand...
Click to collapse
The risks are considerable, to say the least. Read what happened with one b0rked kernel here:
http://forum.xda-developers.com/showthread.php?t=1526852
The end result: about 40-50 hard bricked devices.
ufk said:
i just want to make sure.. if for some reason i used odin to flash the tarred zImage and it's a broken zImage. or corrupted file or false configuration that will break the booting process. will i see be able to go to download move or cwm mode ?
what are the risks here besides the regular odin risks ?
Click to expand...
Click to collapse
Yes. Flashing kernels is always risky. But as per my experience, its very hard to brick the device unless you do something unusual.
so it depends on you. BUILD AND FLASH AT YOUR OWN RISK.
thanks and ok for this part ^^
but i have a question....
do you know the way for mod a stock kernel to add root / cwr when source code not avalable??
for exemple the lp6 kernel... do you know a way for extract the zimage for look on it and include root / crw on the Zimage directly...
if you have some idea please help comunauty for found a way for this ^^ (i have send pm to chainfire to take information for this mod but no response..)
ReDroiD™ said:
thanks and ok for this part ^^
but i have a question....
do you know the way for mod a stock kernel to add root / cwr when source code not avalable??
for exemple the lp6 kernel... do you know a way for extract the zimage for look on it and include root / crw on the Zimage directly...
if you have some idea please help comunauty for found a way for this ^^ (i have send pm to chainfire to take information for this mod but no response..)
Click to expand...
Click to collapse
you need to have crosscompiler, kernel repacker, busybox and su
1.Copy the original zImage to de directory where you extracted the kernel repacker
Rename it to zImage.org
create a temp directory in the kernel repacker directory
Open a linux shell and go to kernel repacker directory
./extracter.sh -s zImage.org -d temp (hit enter)
2.Go to the temp directory and edit init.rc with your favourite editor and put this on a new line at the end off the file.
service install_su /sbin/install_su.sh
user root
oneshot
Save the file and exit
3.copy busybox and su to the tmp folder in your extracted kernel folder
make sure they are markt als executable.
4.copy install_su.sh to the sbin folder in your extracted kernel folder
5.Open a linux shell and go to kernel repacker directory
./repacker.sh -s zImage.org -d zImage -r temp -c gzip
congratulations you must cooked your first modified kernel
6.tar the kernel using this command tar -H ustar -c zImage >code.tar
code need to be enterd in initd_support.sh
#!/tmp/busybox sh
if cd /system/etc/init.d >/dev/null 2>&1 ; then
for file in S* ; do
if ! ls "$file" >/dev/null 2>&1 ; then continue ; fi
/system/bin/sh "$file"
done
fi
code need to be enterd in init.rc
service initd_support /sbin/initd_support.sh
user root
oneshot
tools needed for cross compiler and kernel repacker
cross compiler
https://sourcery.mentor.com/public/...eabi/arm-2009q3-67-arm-none-linux-gnueabi.bin
Kernel repacker tool
https://github.com/project-voodoo/kernel_repack_utils
This will add busybox and SU (that means u will get root)...i dont know how to add recovery though...may be somewhere in intrafms we need to install the script...
perfect...i test this
Good!
Inviato dal mio GT-N7000 con Tapatalk 2
Could someone post ZCLP6's zimage i wanted to try in the beginning of the week but i have a very very slow connection, i'm not enough motivated to download the whole zip.
Thanks
One confirmation superatmos : bootloader and kernel are two different things, i mean bootloader is not included in zimage ?
mohamed454 said:
Could someone post ZCLP6's zimage i wanted to try in the beginning of the week but i have a very very slow connection, i'm not enough motivated to download the whole zip.
Thanks
One confirmation superatmos : bootloader and kernel are two different things, i mean bootloader is not included in zimage ?
Click to expand...
Click to collapse
Here you go.
no problem for extract
but when i whant extract old lp5 with recovery or other one i canot extract without error... the rebuild kernel have security form is creator?
ReDroiD™ said:
no problem for extract
but when i whant extract old lp5 with recovery or other one i canot extract without error... the rebuild kernel have security form is creator?
Click to expand...
Click to collapse
Try dsixda kitchen to extract and then follow the other procedures
Thanks for the zimage. It's telling me 2 hours for the cross compiler (i told you very slow connection :-/ )
Where is install_su.sh, i found a similar one for i9000 i think so :
#!/tmp/busybox sh
source='/tmp/su-2.3.6.1-ef'
dest='/system/xbin/su'
if /tmp/busybox [ ! -f /system/xbin/su ];
then
/tmp/busybox mount -o remount,rw /system
/tmp/busybox mkdir -p /system/xbin
/tmp/busybox cp $source $dest
# make sure it's owned by root
/tmp/busybox chown 0.0 $dest
# sets the suid permission
/tmp/busybox chmod 06755 $dest
/tmp/busybox mount -o remount,ro /system
fi;
Click to expand...
Click to collapse
Grgsiocl, what about bootloader ?
mohamed454 said:
Thanks for the zimage. It's telling me 2 hours for the cross compiler (i told you very slow connection :-/ )
Where is install_su.sh, i found a similar one for i9000 i think so :
Grgsiocl, what about bootloader ?
Click to expand...
Click to collapse
That's the superuser script...tomorrow I will update with new procedures and in detail..I think now I know how to add the recovery as well after doing some reverse engineering on cf kernels...will update tomorrow
Hey guys Lets get the ball rolling and get some development out into the light.
First you will have to download the OTA from Google.
Google’s OTA(13300): http://cache.pack.google.com/edgedl....1f63ef63d1f43c6222116806e5bea38a47e9f124.zip
Next download “SquashFS Exracter”, this tool is used to extract the System.img.
SquashFS Exracter: https://mega.co.nz/#!oEMFQCrC!JbD_9XeS28xu7vZBDipBzDWqdnF1i9cKMRzq2i_vEDU
When you are ready to go, simply drag system.img onto unsquashfs.exe, and the extraction will do its thing.
A new folder named “squashfs-root” will be where the system.img were located. This folder contains the extracted System.
Have a look around, and please report findings! :fingers-crossed:
Findings
/res/ - Contains some of the images used for the system. The boot animation is placed here.
/netflix/ - Self-explanatory. The Netflix app for the Chromecast.
/chrome/content_shell.pak – Contains a lot of useful information for the right eyes.
/chrome/osd_images/**** - Contains images used for the on-screen-display atm. volume slider.
/chrome/locals/ - Contains language files for the Chromecast.
Thx to ddggttff3 and tchebb for the links etc. :good:
Just FYI guys, here is link for newest OTA, build 19084, so you can check, what's new is inside.
http://cache.pack.google.com/edgedl/googletv-eureka/stable-channel/ota.19084.stable-channel.eureka-b3.0149464816d26917f37cb4a263171183cc00957a.zip
For extract system.img download and use SquashFS Exracter tool from previous post.
bormeth said:
Hey guys Lets get the ball rolling and get some development out into the light.
First you will have to download the OTA from Google.
Google’s OTA(13300): http://cache.pack.google.com/edgedl....1f63ef63d1f43c6222116806e5bea38a47e9f124.zip
Next download “SquashFS Exracter”, this tool is used to extract the System.img.
SquashFS Exracter: https://mega.co.nz/#!oEMFQCrC!JbD_9XeS28xu7vZBDipBzDWqdnF1i9cKMRzq2i_vEDU
When you are ready to go, simply drag system.img onto unsquashfs.exe, and the extraction will do its thing.
A new folder named “squashfs-root” will be where the system.img were located. This folder contains the extracted System.
Have a look around, and please report findings! :fingers-crossed:
Findings
/res/ - Contains some of the images used for the system. The boot animation is placed here.
/netflix/ - Self-explanatory. The Netflix app for the Chromecast.
/chrome/content_shell.pak – Contains a lot of useful information for the right eyes.
/chrome/osd_images/**** - Contains images used for the on-screen-display atm. volume slider.
/chrome/locals/ - Contains language files for the Chromecast.
Thx to ddggttff3 and tchebb for the links etc. :good:
Click to expand...
Click to collapse
I've been playing with unsquash in linux to add stuff to /etc. I realised linux can have a symlinks to a symlincs. So we can rederect /system/etc to /data/etc if we want to. It's probebly not so secure to have several symlincs in a chain, but I wanted ta add stuff like motd and profile to etc without reflasing it evertime I make a change.
First on then Cromecast
-----------------------------
cp -pr /system/ /data
On Debian 7
---------------
su root
apt-get install squashfs-tools
mkdir flash
cd flash
wget http://pdl.team-eureka.com/ota/19084.001.zip
unzip 19084.00.1.zip
unsquashfs system.img
cd squashfs-root
mv etc etc.bk
ln /data/system/etc -s etc
cd ..
rm system.img
mksquashfs squashfs-root system.img
rm -r squashfs-root
zip test1.zip *
And then you flash it with flashcast. Now we got a writable etc catalog. I haven't tryed symlinkc all catalogs in the system dir, but bin and etc are working fine as symlincs to /data/system dir.
Just FYI guys, there is again new build, and here is link for that OTA, build 46278.
http://cache.pack.google.com/edgedl/googletv-eureka/stable-channel/ota.46278.stable-channel.eureka-b3.ef7fdf1f7153dacecc77b7d1a3bb22a97e27ec7e.zip
For extract system.img download and use SquashFS Exracter tool from first post.
Mape0661 said:
I've been playing with unsquash in linux to add stuff to /etc. I realised linux can have a symlinks to a symlincs. So we can rederect /system/etc to /data/etc if we want to. It's probebly not so secure to have several symlincs in a chain, but I wanted ta add stuff like motd and profile to etc without reflasing it evertime I make a change.
First on then Cromecast
-----------------------------
cp -pr /system/ /data
On Debian 7
---------------
su root
apt-get install squashfs-tools
mkdir flash
cd flash
wget (i cant post links... -_-)
unzip 19084.00.1.zip
unsquashfs system.img
cd squashfs-root
mv etc etc.bk
ln /data/system/etc -s etc
cd ..
rm system.img
mksquashfs squashfs-root system.img
rm -r squashfs-root
zip test1.zip *
And then you flash it with flashcast. Now we got a writable etc catalog. I haven't tryed symlinkc all catalogs in the system dir, but bin and etc are working fine as symlincs to /data/system dir.
Click to expand...
Click to collapse
when i try this my CC just hangs at the black screen after the Eureka logo. instead of modifying etc, i just added a text file to etc so i could see if it got flashed. my file is there, and i can use SSH/Telnet and the web controls, it just wont boot past the black screen. Any advise?
casper33 said:
when i try this my CC just hangs at the black screen after the Eureka logo. instead of modifying etc, i just added a text file to etc so i could see if it got flashed. my file is there, and i can use SSH/Telnet and the web controls, it just wont boot past the black screen. Any advise?
Click to expand...
Click to collapse
Were you modifying the image as root? If not, you can have permission issues when rebuilding the squashfs file.
ddggttff3 said:
Were you modifying the image as root? If not, you can have permission issues when rebuilding the squashfs file.
Click to expand...
Click to collapse
well now i feel stupid, indeed i wasn't root, thank you!
Hi I need specific help with the mksquashfs.exe command in Windows to repack system.img to system.sfs
Specifically, if I have the system.img on c:\ temp folder, what is the syntax to end up with system.sfs in same directory.
Can anybody help?