Database Develop

[DEV][TOOLS] Unpack Repack boot.img (Kernel) Files And Modify Ramdisk

Hello!
This is -at least I hope it is- an easy to follow guide on how to unpack boot.img files (aka custom kernels) and modify the ramdisk.
Now, why would you want to do that?
First and simplest thing that comes to mind is for editing the kernel boot logo (the one that appears before the boot animation).
There are also a lot of other things you can edit in the ramdisk, but they require a bit more advanced knowledge, so we won't talk about them here.
Requirements:
1. Linux (any form will do, for example virtual box etc)
2. Perl (already included in Ubuntu, me thinks)
3. The Xperia Boot Tools package attached in this post
4. The mkbootimg binary (I already compiled it for Linux x86 and included it in the attachment)
5. Reading this post VERY VERY VERY carefully
Step 1: The mkbootimg binary
Let's install mkbootimg (we need it in order to repack the boot.img).
In a terminal window, cd to the directory where you extracted the mkbootimg file and type:
Code:
[B][I]sudo cp mkbootimg /bin/[/I][/B]
And then
Code:
[B][I]sudo chmod 755 /bin/mkbootimg[/I][/B]
Done!
* After first command, terminal will ask for your user password, type it, press enter and the command will be executed immediately.
Step 2: Splitting the boot.img
At this point, we need a boot.img file to play with.
Pick your favorite custom kernel and get the .img.
Place it in a folder along with the 2 perl scripts from the attached package.
In a terminal window, cd to the above-mentioned folder.
Next, type this command:
Code:
[B][I]perl split_bootimg.pl boot.img[/I][/B]
The command will return something like this:
Page size: 2048 (0x00000800)
Kernel size: 3132176 (0x002fcb10)
Ramdisk size: 3484496 (0x00352b50)
Second size: 0 (0x00000000)
Board name:
Command line:
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
Now the kernel is successfully extracted to your current directory.
It consists of 2 files: boot.img-kernel and boot.img-ramdisk.gz.
Step 3: Unpacking ramdisk
So we unvealed the ramdisk in our previous step but it is still of no use to us, so we need to un-gzip and then un-cpio it.
In the same terminal window as before, type:
Code:
[I][B]mkdir ramdisk[/B]
Code:
[B]cd ramdisk[/B]
Code:
[B]gzip -dc ../boot.img-ramdisk.gz | cpio -i[/B][/I]
Last command will return something like:
10503 blocks
Our ramdisk is unpacked now in the newly created /ramdisk folder.
Step 4: Editing ramdisk files
Now you can edit the contents of the ramdisk.
BE EXTREMELY CAREFUL AND NEVER EVER DO ANYTHING "JUST 'CAUSE"...
You need to be fully aware of what you're doing.
Good news is, changing the logo.rle (the static boot logo image) is fairly easy.
You just need to replace it with your .rle file.
I am not going to explain how to make your own .rle files right now.
Feel free to have a look at this thread for more info.
However, I attach the stock SE boot logo in case anyone misses it when he's on custom kernel.
IMPORTANT: Don't accidentally add irrelevant files to the ramdisk directory as cpio will include them too and your new boot.img will be useless.
Also, bear in mind:
DooMLoRD said:
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot
Click to expand...
Click to collapse
Step 5: Repack the ramdisk
Now that's all done, we need to pack the kernel back up into a flashable img file.
First, we will pack the ramdisk back to it's original state.
In the same terminal window as before, type:
Code:
[B][I]find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz[/I][/B]
Step 6: Repack the boot.img
In our last step, back into the terminal we go to use the "repack-bootimg" perl script that will give us our brand new boot.img.
Make sure to cd to the directory that the perl scripts are, much like in Step 1.
Type this command:
Code:
[B][I]perl repack-bootimg.pl '/.../.../.../boot.img-kernel' '/.../.../.../ramdisk' newboot.img[/I][/B]
Of course, replace /.../.../ with the path to the boot.img-kernel file and the ramdisk directory respectively.
All done! Your new img is newboot.img and is ready to be flashed!
ADVICE: Use fastboot boot and not fastboot flash boot the first time, to test that the new kernel boots. If all is well, proceed with the actual flashing!
FAQ:
- Can I do this on Windows?
- Not that I know of, no. You can use Vmware or VirtualBox to install a raw Ubuntu image (pure command line) on your Windows PC though.
- Great! How can I do this then?
- Wish I knew! I have a Linux partition on my PC, it has been like that forever. Google is your friend!
- This is so complicated, is there an easier way? Can you make a zip for me to use in recovery?
-
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
- OK, don't get upset. Can you do it for me?
- I will have to say no, because I know that the minute word gets out that I take requests, I will be overwhelmed.
Took me several hours to figure all this out but it will take you less than 10 minutes to do it yourself if you carefully follow the instructions.
- I think this or that is wrong and it should be like this or that.
- Thank you very much for correcting me! I am still learning! Please post your corrections here or PM me and I will update the thread ASAP!
References:
- HOWTO: Unpack, Edit, and Re-Pack Boot Images
- How to Port Android to Another Device
- [How-To] Make custom bootscreen/bootlogo (image to rle)/(rle to image)
Thanks to:
- Riyal for giving me the idea to get into this.
- pvyParts because without him I'd only be "pulling Irises"...
Cheers!

Thank you very much. I've been looking for something like this.
Anyways, use VirtualBox instead of VMware. It's a thousand times better.

or try pendrivelinux,boot linux from windows..great tutorial,gonna try it
so everyone can be doomlord
question,if i manage to change boot image and repack the it back,is there any chance for me to "brick" the kernel?
Sent from my LT18i

Locked Bootloader
Hello Iridaki,
many thanks for your apports (this and the init.d script). I'm actually user from a Spanish forum called www.htcmania.com (you may have heard about thedr0idboy, which is a Neo developer) and we were trying to pack kernels in order to flash it in locked bootloader devices or at least try to create an Overclock module for stock kernel that can be flashed in locked devices.
Do you think we can use this to achieve this goal? I just hate Arc S with it's damn 1.4 GHz processor :S. It was released only a month after I got my Arc.
Many thanks for your time and your efforts!!
P.D: a girl developer!!!

rashid.fairus said:
so everyone can be doomlord
question,if i manage to change boot image and repack the it back,is there any chance for me to "brick" the kernel?
Click to expand...
Click to collapse
Nah, it takes a lot more to be DoomLord..!!!
If there are no errors in the cmd, boot.img should be OK.
By using flashboot boot command, the kernel is sent to the phone and it tries to boot it. It's not flashing it, so if it fails, it immediately goes back to previous kernel.
So don't worry! Imagine that until I found the correct script, I had tried more or less 10 crapernels (crappy kernels)!!!
iR¡[email protected]!* via Tapatalk

iridaki said:
Nah, it takes a lot more to be DoomLord..!!!
If there are no errors in the cmd, boot.img should be OK.
By using flashboot boot command, the kernel is sent to the phone and it tries to boot it. It's not flashing it, so if it fails, it immediately goes back to previous kernel.
So don't worry! Imagine that until I found the correct script, I had tried more or less 10 crapernels (crappy kernels)!!!
iR¡[email protected]!* via Tapatalk
Click to expand...
Click to collapse
looks like our themes and apps forum have a new section,kernel theming,,(iridaki,you have purple theme for apps and roms,how about kernel?)
Sent from my LT18i

A big thanks, iridaki!
I was looking forward to such thread.
I did also a lot of search on google too, but somehow I couldn't find any match.
I am an experienced Linux user, so that shouldn't be a problem for me.
I'll try everything this weekend.
Afaik, CWM is also stored in the kernel, so is it possible to modify it with the tool?
I don't want to have a step by step guide, just a reference would be great (of course if you know one).
Anyway, thanks for your great contributions in XDA.
Sent from my LT18i using xda premium

OMG... :-o Iris you are a genius.
Sent from my Arc S LT18i using Xda Premium App

glaudrem said:
Hello Iridaki,
many thanks for your apports (this and the init.d script). I'm actually user from a Spanish forum called www.htcmania.com (you may have heard about thedr0idboy, which is a Neo developer) and we were trying to pack kernels in order to flash it in locked bootloader devices or at least try to create an Overclock module for stock kernel that can be flashed in locked devices.
Do you think we can use this to achieve this goal? I just hate Arc S with it's damn 1.4 GHz processor :S. It was released only a month after I got my Arc.
Many thanks for your time and your efforts!!
P.D: a girl developer!!!
Click to expand...
Click to collapse
currently we cant use custom kernels on locked bootloader...
there is a way to make overclock module for stock kernel... i am looking into that possibility & i have contacted a few devs... i will work on it when i get time...
@Iris
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot

DooMLoRD said:
@Iris
there is a bug in the semc S1 bootloader... sometimes if the boot.img isnt of a correct size then the device will not boot... the workaround is to add a "filler" file (which is say 512KB file with junk data) to the ramdisk so as to increase the size of the final boot.img file...
thanks to jerpelea for this incredible tip... i must have wasted atleast 10-15 hrs trying to figure out why my kernel failed to boot
Click to expand...
Click to collapse
Great tip indeed!!! Added to the OP!
I haven't come across the issue yet because I am only editing some tweaks and the logo.rle but say someone uses a much smaller logo and deletes some scripts, would he need to use a filler file, even if it is for 20-30 KB?
THANKS!

iridaki said:
Great tip indeed!!! Added to the OP!
I haven't come across the issue yet because I am only editing some tweaks and the logo.rle but say someone uses a much smaller logo and deletes some scripts, would he need to use a filler file, even if it is for 20-30 KB?
THANKS!
Click to expand...
Click to collapse
size of logo doesnt really matter... just the final size of the boot.img matters...
btw the logo.rle must have correct permissions (644)

DooMLoRD said:
size of logo doesnt really matter... just the final size of the boot.img matters...
btw the logo.rle must have correct permissions (644)
Click to expand...
Click to collapse
Yes, but if the logo.rle is replaced with a smaller one in size, ramdisk size is reduced accordingly, isn't it?
Permissions are taken care of while unpacking/repacking.
Overall, this guide works, since I've sorted everything out, hasn't failed me yet!
dp94 said:
Afaik, CWM is also stored in the kernel, so is it possible to modify it with the tool?
I don't want to have a step by step guide, just a reference would be great (of course if you know one).
Anyway, thanks for your great contributions in XDA.
Click to expand...
Click to collapse
My initial response would have to be: I have no idea!
However, tell me what exactly do you want to edit. Images, colors, features?
I'll look into it, currently I have never been in involved with recovery.
theduke89 said:
OMG... :-o Iris you are a genius.
Click to expand...
Click to collapse
I have my moments.

Presumably, kernel.sin can be renamed to boot.img for splitting without problems, or am I missing something pertinent to SE?

LenAsh said:
Presumably, kernel.sin can be renamed to boot.img for splitting without problems, or am I missing something pertinent to SE?
Click to expand...
Click to collapse
NOOOOOOO!!
DoomLord has released a .sin unpacker. Unpack the kernel.sin with it, then repack it with my script.
iR¡[email protected]!* via Tapatalk

Found that previously, but the repacker doesn't work. I think the script he published is a hack of something else and may have errors.

LenAsh said:
Found that previously, but the repacker doesn't work. I think the script he published is a hack of something else and may have errors.
Click to expand...
Click to collapse
Well, no, the script is OK, it's just made to work with the particular unpacker I included in the package. You need to edit it a wee bit to work with the sin unpacker. If I get some time in the weekend, I'll look into it too.
iR¡[email protected]!* via Tapatalk

Magic, thanks Iris. I recall the unpacking is fine, it is just repacking that doesn't yield either a boot.img OR kernel.sin due to the mixed file names/folders etc. It's been a few months since I tried... forgive me. All I was doing at the time was taking a stock Neo kernel and making it insecure. Which is dead easy normally. done it plenty with other phones, but SE .sin files threw me.

iridaki said:
My initial response would have to be: I have no idea!
However, tell me what exactly do you want to edit. Images, colors, features?
I'll look into it, currently I have never been in involved with recovery.
Click to expand...
Click to collapse
Just to change the colors, rename options, maybe integrate some features into one option.
I have really tried to search a lot, here in XDA & Google, but I have no idea.

dp94 said:
Just to change the colors, rename options, maybe integrate some features into one option.
I have really tried to search a lot, here in XDA & Google, but I have no idea.
Click to expand...
Click to collapse
You would have to rebuild CWM from sources or so i believe. dont ask me how either as i've not a clue
LenAsh said:
Magic, thanks Iris. I recall the unpacking is fine, it is just repacking that doesn't yield either a boot.img OR kernel.sin due to the mixed file names/folders etc. It's been a few months since I tried... forgive me. All I was doing at the time was taking a stock Neo kernel and making it insecure. Which is dead easy normally. done it plenty with other phones, but SE .sin files threw me.
Click to expand...
Click to collapse
use this tool
http://forum.xda-developers.com/showthread.php?t=1262656
and then you will have a kernel and ramdisk and then it is just like any other boot img i had to edit it to make it unpack the ramdisk aswell. ( had to remove the ../ right after the gzip command )
basicaly use the file in that post instead of iridakis "split_bootimg.pl"
Pvy

I can change the boot logo now. Thanks very much.. I'm using doomlord kernel, but I love SE original boot logo. Finally I managed to change it. Thanks again. I just follow the instruction and it works. The reduce in size of boot.img didn't cause any problem at all... ;-)
Sent from my LT15i using xda premium

[HOW-TO] Extract System.img

Hey guys Lets get the ball rolling and get some development out into the light.
First you will have to download the OTA from Google.
Google’s OTA(13300): http://cache.pack.google.com/edgedl....1f63ef63d1f43c6222116806e5bea38a47e9f124.zip
Next download “SquashFS Exracter”, this tool is used to extract the System.img.
SquashFS Exracter: https://mega.co.nz/#!oEMFQCrC!JbD_9XeS28xu7vZBDipBzDWqdnF1i9cKMRzq2i_vEDU
When you are ready to go, simply drag system.img onto unsquashfs.exe, and the extraction will do its thing.
A new folder named “squashfs-root” will be where the system.img were located. This folder contains the extracted System.
Have a look around, and please report findings! :fingers-crossed:
Findings
/res/ - Contains some of the images used for the system. The boot animation is placed here.
/netflix/ - Self-explanatory. The Netflix app for the Chromecast.
/chrome/content_shell.pak – Contains a lot of useful information for the right eyes.
/chrome/osd_images/**** - Contains images used for the on-screen-display atm. volume slider.
/chrome/locals/ - Contains language files for the Chromecast.
Thx to ddggttff3 and tchebb for the links etc. :good:

Just FYI guys, here is link for newest OTA, build 19084, so you can check, what's new is inside.
http://cache.pack.google.com/edgedl/googletv-eureka/stable-channel/ota.19084.stable-channel.eureka-b3.0149464816d26917f37cb4a263171183cc00957a.zip
For extract system.img download and use SquashFS Exracter tool from previous post.

bormeth said:
Hey guys Lets get the ball rolling and get some development out into the light.
First you will have to download the OTA from Google.
Google’s OTA(13300): http://cache.pack.google.com/edgedl....1f63ef63d1f43c6222116806e5bea38a47e9f124.zip
Next download “SquashFS Exracter”, this tool is used to extract the System.img.
SquashFS Exracter: https://mega.co.nz/#!oEMFQCrC!JbD_9XeS28xu7vZBDipBzDWqdnF1i9cKMRzq2i_vEDU
When you are ready to go, simply drag system.img onto unsquashfs.exe, and the extraction will do its thing.
A new folder named “squashfs-root” will be where the system.img were located. This folder contains the extracted System.
Have a look around, and please report findings! :fingers-crossed:
Findings
/res/ - Contains some of the images used for the system. The boot animation is placed here.
/netflix/ - Self-explanatory. The Netflix app for the Chromecast.
/chrome/content_shell.pak – Contains a lot of useful information for the right eyes.
/chrome/osd_images/**** - Contains images used for the on-screen-display atm. volume slider.
/chrome/locals/ - Contains language files for the Chromecast.
Thx to ddggttff3 and tchebb for the links etc. :good:
Click to expand...
Click to collapse
I've been playing with unsquash in linux to add stuff to /etc. I realised linux can have a symlinks to a symlincs. So we can rederect /system/etc to /data/etc if we want to. It's probebly not so secure to have several symlincs in a chain, but I wanted ta add stuff like motd and profile to etc without reflasing it evertime I make a change.
First on then Cromecast
-----------------------------
cp -pr /system/ /data
On Debian 7
---------------
su root
apt-get install squashfs-tools
mkdir flash
cd flash
wget http://pdl.team-eureka.com/ota/19084.001.zip
unzip 19084.00.1.zip
unsquashfs system.img
cd squashfs-root
mv etc etc.bk
ln /data/system/etc -s etc
cd ..
rm system.img
mksquashfs squashfs-root system.img
rm -r squashfs-root
zip test1.zip *
And then you flash it with flashcast. Now we got a writable etc catalog. I haven't tryed symlinkc all catalogs in the system dir, but bin and etc are working fine as symlincs to /data/system dir.

Just FYI guys, there is again new build, and here is link for that OTA, build 46278.
http://cache.pack.google.com/edgedl/googletv-eureka/stable-channel/ota.46278.stable-channel.eureka-b3.ef7fdf1f7153dacecc77b7d1a3bb22a97e27ec7e.zip
For extract system.img download and use SquashFS Exracter tool from first post.

Mape0661 said:
I've been playing with unsquash in linux to add stuff to /etc. I realised linux can have a symlinks to a symlincs. So we can rederect /system/etc to /data/etc if we want to. It's probebly not so secure to have several symlincs in a chain, but I wanted ta add stuff like motd and profile to etc without reflasing it evertime I make a change.
First on then Cromecast
-----------------------------
cp -pr /system/ /data
On Debian 7
---------------
su root
apt-get install squashfs-tools
mkdir flash
cd flash
wget (i cant post links... -_-)
unzip 19084.00.1.zip
unsquashfs system.img
cd squashfs-root
mv etc etc.bk
ln /data/system/etc -s etc
cd ..
rm system.img
mksquashfs squashfs-root system.img
rm -r squashfs-root
zip test1.zip *
And then you flash it with flashcast. Now we got a writable etc catalog. I haven't tryed symlinkc all catalogs in the system dir, but bin and etc are working fine as symlincs to /data/system dir.
Click to expand...
Click to collapse
when i try this my CC just hangs at the black screen after the Eureka logo. instead of modifying etc, i just added a text file to etc so i could see if it got flashed. my file is there, and i can use SSH/Telnet and the web controls, it just wont boot past the black screen. Any advise?

casper33 said:
when i try this my CC just hangs at the black screen after the Eureka logo. instead of modifying etc, i just added a text file to etc so i could see if it got flashed. my file is there, and i can use SSH/Telnet and the web controls, it just wont boot past the black screen. Any advise?
Click to expand...
Click to collapse
Were you modifying the image as root? If not, you can have permission issues when rebuilding the squashfs file.

ddggttff3 said:
Were you modifying the image as root? If not, you can have permission issues when rebuilding the squashfs file.
Click to expand...
Click to collapse
well now i feel stupid, indeed i wasn't root, thank you!

Hi I need specific help with the mksquashfs.exe command in Windows to repack system.img to system.sfs
Specifically, if I have the system.img on c:\ temp folder, what is the syntax to end up with system.sfs in same directory.
Can anybody help?

Unpacking, Editing, Packing ROMS [.IMG, .DAT] in Windows.

Unpacking, Editing, Packing ROMS GUIDE - Host Zero
First download the tools from the link below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
1. system.img
2. system.new.dat
1.Unpacking Repacking system.img
1. Paste your system.img in tools folder
2. Open cmd.exe
3. Type:
Code:
mkdir <your_folder_name>
ImgExtactor <raw_sparse.img> system -i
ex: ImgExtactor system.img system -i
4. Now open your folder you have created, you can find your <raw_image> has been extracted.
5. Now edit the files in system folder as your convenience.
6. Now open properties of folder you have created see the size of folder.
7. Now lets pack the image back, open the minimized command window.
Code:
make_ext4fs -s -l <size_of_your_folder+100>M -a system <name_of_packing_image>.img <your_folder_name>/
ex: make_ext4fs -s -l 512M -a system my_new_system.img system/
8. Done, enjoy!
2.Unpacking Repacking system.new.dat
1. Paste your system.new.dat, system.transfer.list and file_contexts in tools folder.
2. Open cmd.exe
3. Type:
Code:
sprs2ext system.transfer.list <name_of_system>.new.dat
ex: sprs2ext system.transfer.list system.new.dat
4. Now again type:
Code:
mkdir <your_folder_name>
ImgExtactor <raw_sparse.new.img> system -i
ex: ImgExtactor system.img system -i
5. Now open folder you have created and you will find the system.new.dat has been extracted.
6. Edit the extracted files.
7. Open properties of the extracted folder and check the size of folder
7. Now open minimized command window.
Code:
make_ext4fs -T 0 -S file_contexts -l <size_of_folder+100>M -a system <name_of_packing_image>.img <your_folder_name>/
ex: make_ext4fs -T 0 -S file_contexts -I 512M -a system my_new_system.img system/
8. Now again type:
Code:
rimg2sdat <your_raw_image>.img
ex: rimg2img my_new_system.img
9. Done! enjoy.
CLICK HERE TO DOWNLOAD TOOLS

Thank you very much.
You refresh the xda University.
I hope the University becomes more active.
We really need more guides to master android OS.
Sent from my SM-N910P using Tapatalk

I tried as rules mention on this thread. unpack was succeed. when I repack, here is the problem:
1. repack was succeed, but when I flash into my phone by spf tools, my phone was stuck at mi.com logo.
2. when I mount new system.img was created into DiskInternals Linux Reader, the file knowing as uknown file.
repack was succeed, but unable to use.
how to fix it?

A useful guide! Thanks!
Sent from my Sony Xperia Z3 Compact using XDA Labs

kevin mitnick said:
I tried as rules mention on this thread. unpack was succeed. when I repack, here is the problem:
1. repack was succeed, but when I flash into my phone by spf tools, my phone was stuck at mi.com logo.
2. when I mount new system.img was created into DiskInternals Linux Reader, the file knowing as uknown file.
repack was succeed, but unable to use.
how to fix it?
Click to expand...
Click to collapse
hey a bit late but i may help you.
Causes for this:
1. May be your rom is odex.
2. May be you are using OTA Update or Patch instead of full rom.
3. Applying more size while building .img
4. make_ext4fs dosent support all kind of roms. it only supports roms based on ICS, JB, KK... but i dont know how google builds factory images then.
Anyways a alternative.
Flash a full stock or custom rom into your device (with root access and adb support)
connect your device
type in cmd:
adb shell
su
(grant permissions on your device)
ls -al /dev/block/platform/*/by-name
now you will get your PMT table (Partition Management Table.)
ex: system ---> /dev/block/mmcblk07
and other partition information also.
now make system.img using adb.
dd if=/partitionnumber of=/sdcard/system.img
ex: dd if=/dev/block/mmcblk07
now you can find fastboot flashable system.img in your sdcard.
do rest with other partitions also. (boot partition manadatory).
enjoy.

Ticklefish said:
A useful guide! Thanks!
Sent from my Sony Xperia Z3 Compact using XDA Labs
Click to expand...
Click to collapse
Thankyou sir for encouraging.

Ticklefish said:
A useful guide! Thanks!
Sent from my Sony Xperia Z3 Compact using XDA Labs
Click to expand...
Click to collapse
Your Welcome sir.

HostZero said:
hey a bit late but i may help you.
Causes for this:
1. May be your rom is odex.
2. May be you are using OTA Update or Patch instead of full rom.
3. Applying more size while building .img
4. make_ext4fs dosent support all kind of roms. it only supports roms based on ICS, JB, KK... but i dont know how google builds factory images then.
Anyways a alternative.
Flash a full stock or custom rom into your device (with root access and adb support)
connect your device
type in cmd:
adb shell
su
(grant permissions on your device)
ls -al /dev/block/platform/*/by-name
now you will get your PMT table (Partition Management Table.)
ex: system ---> /dev/block/mmcblk07
and other partition information also.
now make system.img using adb.
dd if=/partitionnumber of=/sdcard/system.img
ex: dd if=/dev/block/mmcblk07
now you can find fastboot flashable system.img in your sdcard.
do rest with other partitions also. (boot partition manadatory).
enjoy.
Click to expand...
Click to collapse
thanks for respon @HostZero so much lessons and knowledge about this.
I'll try..report asap

kevin mitnick said:
thanks for respon @HostZero so much lessons and knowledge about this.
I'll try..report asap
Click to expand...
Click to collapse
This method is know as dumping method thanks to dd and su in android devices.

Cmd.exe not work on windows 7 32bit
?
sent from Xperia™ SP | Android 6.0.1

It seems to me that the permissions would be lost when they are dumped from system.img via this method. Are you seeing the selinux contexts preserved?

hamed24 said:
Cmd.exe not work on windows 7 32bit
sent from Xperia™ SP | Android 6.0.1
Click to expand...
Click to collapse
No problem. Open your tools folder in full screen. now below empty white space click (Shift + RightClick) then select Open Command Window Here.
Done!

HostZero said:
No problem. Open your tools folder in full screen. now below empty white space click (Shift + RightClick) then select Open Command Window Here.
Done!
Click to expand...
Click to collapse
Thanks for your help,that's work
Can you take screenshot from your cmd and typed codes, I'm beginner and confused some codes ?
sent from Xperia™ SP | Android 6.0.1

hamed24 said:
Thanks for your help,that's work
Can you take screenshot from your cmd and typed codes, I'm beginner and confused some codes
sent from Xperia™ SP | Android 6.0.1
Click to expand...
Click to collapse
Sorry bro I have recently shifted to Ubuntu14.04 for learning building. Read guide properly you will understand more. I have even provided examples as well as commands. and commands depends in each system folder.

hamed24 said:
Cmd.exe not work on windows 7 32bit
?
sent from Xperia™ SP | Android 6.0.1
Click to expand...
Click to collapse
Hi hamed24
Start-->run--> cmd.exe didn´t work? but using the right Mousebutton is okay?
Seems that Windows has lost the C:\Windows\system32 entry in the PATH Variable... easy to fix...
1. Press "Windows-Sign" Key and Break at the same time (it´s the same as rightclick on the Computer-Icon on the Desktop), click on Advanced System Settings.
2. Inside the new Window, click on Environment Variables, a new window opens. Now the lower part is the important one... look for PATH and doubleclick it.
3. At the end of the line, check if there is a ";" (without quotes). That seperates the different entries.... if there´s one there ... ok, place cursor at the end and enter C:\WINDOWS\SYSTEM32;
4. Hit ENTER, close all Windows, log off and on again.... and try again, should work now. If not, go to Start-->Run--> and type C:\WINDOWS\SYSTEM32\CMD.EXE and there you are
regards...
daywalker386

Thanks :3 Many thanks!!!!!! Very helpful thread!!!!!!

On <size_of_your_folder+100>M
For ex,
The folder size is 924MB, + 100MB=1024MB.
Is it right?

Unexpected argument: system

Hi, is that thread still active?
the tool download link is not working.

Fail could not create Tustarfilesystem

[GUIDE] Samsung Galaxy TAB A 7.0 SM-T(280/285) Debloat/Stock customization

UPDATE 09/20/2016 - Root is now available for the SM-T285 (custom ROM and SM-T280 to follow) see post for details (http://forum.xda-developers.com/showpost.php?p=68777842&postcount=27)
After some work I've managed to debloat my Galaxy Tab A(6) 7.0 LTE (SM-T285/T280). We all know that with a locked bootloader we
can at least do customizations with the system partition:
Here is a simple guide with hopes that more people with the device can continue to allow for more ROM customizations:
Tools/Requirements:
================
- Ubuntu as my OS
- make sure you have adb installed and running (See the android developers guide on how to do this)
- Heimdall 1.4.1
- A copy of the stock firmware zip from samsung for your device
- 7zip to be able to unzip the firmware from above
- Android AOSP fsutils simg2img and make_ext4fs (Attached) (note that your make_ext4fs needs to be patched to be able to generate samsung patches easily see gist) for some reason samsung chose to use a slightly different sparse file layout for this device. Using the stock make_ext4fs to generate an image will cause heimdall ( ad Odin) to stop data uploads after the first packet stream.
Or if you still want to use stock make_ext4fs you can try using Chainfire's sgs4ext4fs and run this after you generate your system.img, I haven't tried this route personally myself.
Step By Step (Part 1 - Mount stock system.img for modification)
==========
1. Create a folder to do your work like samsing_kitchen for example. Place your
stock firmware package there
Code:
mkdir samsung_kitchen
cd samsung_kitchen
2. Extract your stock firmware's system.img using 7zip
Code:
7z x XTC-T285XXU0APCN-20160421170750.zip
7z x T285XXU0APCN_T285OLB0APC6_T285XXU0APCN_HOME.tar.md5
Should see a couple of image files, one of them is system.img.
3. Create mount point and convert from sparse image to mountable image and then mount it
Code:
mkdir system
simg2img system.img system.img.raw
sudo mount -t ext4 -o loop system.img.raw ./system
The contents of the system image should now be visible inside the system folder you
just created. You can now proceed to modifiying it (e.g. remove apps)
(Part 2 - Repackage image for flashing to device)
=================================================
DISCLAIMER: As always make sure you backup your important files in case
something goes wrong! I will not be responsible for any losses resulting from this
activity. Also this activity may void your warranty.
Prequisites:
- Make sure you have heimdall properly working.
- Make sure you have oem unlock. This should be visible in developer settings
To know if it is enabled/disable FRP protection should be disabled when you go
in Odin mode.
1. pull the file_contexts file from .your device ( or download the attached in this post).
Code:
adb pull file_contexts
on a connected device in developer mode. You will need this file so that the permissions are properly set when building the image
2. Exit from system back to your working folder (e.g. samsing_kitchen ) and run
the following:
Code:
sudo make_ext4fs -s -l 2147483648 -S file_contexts -a system new_system.img ./system
This should create a flashable image called new_system.img
3. Restart your SM-T285 into Odin Mode (Power-off, then hold home vol-down + power until Odin Mode shows up)
4. Flash using Heimdall
Code:
heimdall flash --SYSTEM new_system.img
Your device should automatically restart after this. If something goes wrong you can always flash the original system image back.
Making an ODIN flashable image
----------------------------------------
To create an image compatible with ODIN (tar.md5) make sure you have a copy of the stock image zip from samsung and extract (using 7zip) its contents to a folder:
An extracted file should look like this:
Code:
boot.img
cache.img
hidden.img
nvitem.bin
recovery.img
SPRDCP.img
SPRDGDSP.img
SPRDLTEDSP.img
SPRDWDSP.img
system.img
replace the stock system.img with the one you created from above:
Code:
cp ../new_system.img system.img
tar and md5 it:
Code:
tar -H ustar -c boot.img cache.img hidden.img recovery.img SPRDCP.img SPRDGDSP.img SPRDLTEDSP.img SPRDWDSP.img system.img >T285_CUSTOM.tar
md5sum -t T285_CUSTOM.tar > T285_CUSTOM.tar
mv T285_CUSTOM.tar T285_CUSTOM.tar.md5
as per ashyx this should also work as well:
Code:
tar -H ustar -c system.img > system.tar
md5sum -t system.tar > sytem.tar
mv system.tar system.tar.md5
Optionally Zip it if you want:
Code:
7z a T285_CUSTOM.zip T285_CUSTOM.tar.md5
This guide should work for the T280 as well, though I can't confirm it since I don't have access to that model.
Petition for samsung to unlock the device:
https://www.change.org/p/samsung-unlock-the-bootloader-for-the-samsung-galaxy-tab-a-7-0-2016?recruiter=286570213&utm_source=petitions_share&utm_medium=copylink
Custom ROM to enable move apps to sd (apps2sd like support):
http://forum.xda-developers.com/android/development/rom-samsung-galaxy-tab-7-0-lte-2016-sm-t3455788

@jedld
Nice guide, just a few things though.
I don't think it's really necessary to use the file contexts as we're building a system image and all permissions should remain intact.
Regarding the chunk size, Chainfire created sgs4ext4fs to deal with this, it just needs to be run afterwards on the sparse image to patch the headers.
What is the source for the make_ext4fs patch or did you create this patch?
Lastly some people may prefer to use ODIN to flash.
So maybe you could add to the guide that the image can be repacked into a ODIN flashable tar using 7-zip.
By the way the guide will work for the T280 too, so you may want to add that.
Thanks.

ashyx said:
@jedld
Nice guide, just a few things though.
I don't think it's really necessary to use the file contexts as we're building a system image and all permissions should remain intact.
Regarding the chunk size, Chainfire created sgs4ext4fs to deal with this, it just needs to be run afterwards on the sparse image to patch the headers.
What is the source for the make_ext4fs patch or did you create this patch?
Lastly some people may prefer to use ODIN to flash.
So maybe you could add to the guide that the image can be repacked into a ODIN flashable tar using 7-zip.
By the way the guide will work for the T280 too, so you may want to add that.
Thanks.
Click to expand...
Click to collapse
I don't think it's really necessary to use the file contexts as we're building a system image and all permissions should remain intact.
Click to expand...
Click to collapse
I remember encountering a boot loop without that, let me check again and I'll update the guide.
What is the source for the make_ext4fs patch or did you create this patch?
Click to expand...
Click to collapse
Just applied the following patch on latest aosp sources:
https://gist.github.com/jedld/4f388496bda03b349f5744f367749a67
There is a magic number used which I can't figure out, the value is different between SM-T285 ROMS coming from different regions.
Nice to hear about sgs4ext4fs though, probably wouldn't be able to know based on the problem I encountered that the tool also applies unless someone pointed it out.

https://www.change.org/p/samsung-unl...edium=copyLink
Petition for unlocked bootloader for samsung, please sign

http://samsung4android.ru/?ipub=422
any thoguth on this?

klemen241 said:
http://samsung4android.ru/?ipub=422
any thoguth on this?
Click to expand...
Click to collapse
ashyx already tried everything. CF-auto root requires an unlocked recovery, the tablet won't even accept a repacked recovery image. Besides the guy in the video wasn't even using a SM-T285, if you look closely the files he used were for the SM-T550.

klemen241 said:
https://www.change.org/p/samsung-unl...edium=copyLink
Petition for unlocked bootloader for samsung, please sign
Click to expand...
Click to collapse
link is broken though, you must have used the auto truncated link, use this instead:
https://www.change.org/p/samsung-un...edium=copylink&recuruit_context=copylink_long

What about those custom roms? As far as i can see we can use modified stock rom. Can we go anywhere with that? And can someone explain how to make external storage bigger with SD?

SM-T285M with locked bootloader - research ...
First, I have a SM-T285M which is a Galaxy Tab A6 7.0 LTE with a COO CSC. and is factory unlocked (UB as Samsung notates it these days. It's got North and South America LTE bands, and unfortunately it also has a locked bootloader just like the T285 and the T280.
Hear me out on this theory I have come up with ....
I recently stumbled across mention of Samsung pushing out an OTA at some point that broke root at the kernel level forever. I read Chainfire has created a patch that fixes this on some models. Unfortunately not the T28x's due to the locked BL.
While looking for stock ROMS, I discovered differences in the pit files and the size of hidden.img that occurred between 3/2016 and 4/2016 releases leading me to believe that's when they locked the bootloader and pushed the root killing kernel ota to the T285M. The hidden.img was shrunk to a little more than the boot.img and the PIT was modified beginning with the 4/26 release
My T285M was built on 4/7/2016 and now having the new pit and hidden.img, any attempts at ODIN flashing of the 3/23 factory rom (3/10 build) crashes out at hidden.img. I figure I will be unable to go back to the 3/10 build unless I use the pit for that 3/10 build - I'm not ready to play that deep on this .... yet, I don't even know if I am on to anything at this point. but maybe someone else wants to ....
Take a peek at the contents of the three released roms for the T285M in the capture below and if anyone thinks theres hope in getting to root by going back to 3/10 build and PIT I can point you to the three files for experimentation, or even better to get to chainfire if this is doable.
BTW jedid GREAT debloat for the T285. I'm using the system.img on my T285M , I hated Touchwiz so much, now all we need is root. see if these tell you anything.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

klemen241 said:
What about those custom roms? As far as i can see we can use modified stock rom. Can we go anywhere with that? And can someone explain how to make external storage bigger with SD?
Click to expand...
Click to collapse
There are a number of things we can already do with a custom system.img like debloat, enable universal sd r/w, customizing apps, probably theming and fonts are also possible. Hopefully more people can come up with mods.
Unfortunately we need root/unlocked boot.img to do important things to fix the weakness of this device like changing partition sizes, enable apps2sd support, xposed framework, having customizable cpu performance governors/overclocking etc.

TopTongueBarry said:
First, I have a SM-T285M which is a Galaxy Tab A6 7.0 LTE with a COO CSC. and is factory unlocked (UB as Samsung notates it these days. It's got North and South America LTE bands, and unfortunately it also has a locked bootloader just like the T285 and the T280.
Hear me out on this theory I have come up with ....
I recently stumbled across mention of Samsung pushing out an OTA at some point that broke root at the kernel level forever. I read Chainfire has created a patch that fixes this on some models. Unfortunately not the T28x's due to the locked BL.
While looking for stock ROMS, I discovered differences in the pit files and the size of hidden.img that occurred between 3/2016 and 4/2016 releases leading me to believe that's when they locked the bootloader and pushed the root killing kernel ota to the T285M. The hidden.img was shrunk to a little more than the boot.img and the PIT was modified beginning with the 4/26 release
My T285M was built on 4/7/2016 and now having the new pit and hidden.img, any attempts at ODIN flashing of the 3/23 factory rom (3/10 build) crashes out at hidden.img. I figure I will be unable to go back to the 3/10 build unless I use the pit for that 3/10 build - I'm not ready to play that deep on this .... yet, I don't even know if I am on to anything at this point. but maybe someone else wants to ....
Take a peek at the contents of the three released roms for the T285M in the capture below and if anyone thinks theres hope in getting to root by going back to 3/10 build and PIT I can point you to the three files for experimentation, or even better to get to chainfire if this is doable.
BTW jedid GREAT debloat for the T285. I'm using the system.img on my T285M , I hated Touchwiz so much, now all we need is root. see if these tell you anything.
Click to expand...
Click to collapse
i was wondering the same thing, if ther is any chance of unlocking it on earlier versions.
Also i sent email to samsung support again, maybe they will be sick of us begging and release the lock

klemen241 said:
i was wondering the same thing, if ther is any chance of unlocking it on earlier versions.
Also i sent email to samsung support again, maybe they will be sick of us begging and release the lock
Click to expand...
Click to collapse
http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=t285m
---------- Post added at 02:46 AM ---------- Previous post was at 02:36 AM ----------
TopTongueBarry said:
First, I have a SM-T285M which is a Galaxy Tab A6 7.0 LTE with a COO CSC. and is factory unlocked (UB as Samsung notates it these days. It's got North and South America LTE bands, and unfortunately it also has a locked bootloader just like the T285 and the T280.
Hear me out on this theory I have come up with ....
I recently stumbled across mention of Samsung pushing out an OTA at some point that broke root at the kernel level forever. I read Chainfire has created a patch that fixes this on some models. Unfortunately not the T28x's due to the locked BL.
While looking for stock ROMS, I discovered differences in the pit files and the size of hidden.img that occurred between 3/2016 and 4/2016 releases leading me to believe that's when they locked the bootloader and pushed the root killing kernel ota to the T285M. The hidden.img was shrunk to a little more than the boot.img and the PIT was modified beginning with the 4/26 release
My T285M was built on 4/7/2016 and now having the new pit and hidden.img, any attempts at ODIN flashing of the 3/23 factory rom (3/10 build) crashes out at hidden.img. I figure I will be unable to go back to the 3/10 build unless I use the pit for that 3/10 build - I'm not ready to play that deep on this .... yet, I don't even know if I am on to anything at this point. but maybe someone else wants to ....
Take a peek at the contents of the three released roms for the T285M in the capture below and if anyone thinks theres hope in getting to root by going back to 3/10 build and PIT I can point you to the three files for experimentation, or even better to get to chainfire if this is doable.
BTW jedid GREAT debloat for the T285. I'm using the system.img on my T285M , I hated Touchwiz so much, now all we need is root. see if these tell you anything.
Click to expand...
Click to collapse
UPDATE: I was able to get the 3/10 stock factory rom flashed without changing the pit. Replaced the hidden.img file in this rom with a renamed copy of the boot.img from the same rom. Flashing does fail in the very end, but it completes before failing so I simply rebooted immediately into Odin mode again to flash jedid's debloated system.img for the T285. Done this a couple times now and the device comes up just fine. About device and Phone Info Samsung confirm it is running the 3/10 build.
Bad news is the bootloader is locked in this build too. No hope unless someone can do something with the source. See prior post.

is open source same for t280? i have 280 not 285

klemen241 said:
is open source same for t280? i have 280 not 285
Click to expand...
Click to collapse
not sure how having the kernel source would help since we can't even change the kernel on the device which is kinda awkward for samsung. Besides I remember ashyx having compilation issues with spreadtrum kernel sources by samsung and not just for this device.

TopTongueBarry said:
http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=t285m
---------- Post added at 02:46 AM ---------- Previous post was at 02:36 AM ----------
UPDATE: I was able to get the 3/10 stock factory rom flashed without changing the pit. Replaced the hidden.img file in this rom with a renamed copy of the boot.img from the same rom. Flashing does fail in the very end, but it completes before failing so I simply rebooted immediately into Odin mode again to flash jedid's debloated system.img for the T285. Done this a couple times now and the device comes up just fine. About device and Phone Info Samsung confirm it is running the 3/10 build.
Bad news is the bootloader is locked in this build too. No hope unless someone can do something with the source. See prior post.
Click to expand...
Click to collapse
I remember flashing an earlier build thinking the same thing and yep the bootloader is still locked. Aside from that I ran kingroot to see if there was anything exploitable... did'nt work. What I haven't tried is to see if superuser is disabled in this kernel though.

jedld said:
After some work I've managed to debloat my Galaxy Tab A(6) 7.0 LTE (SM-T285/T280). We all know that with a locked bootloader we
can at least do customizations with the system partition:
Here is a simple guide with hopes that more people with the device can continue to allow for more ROM customizations:
Tools/Requirements:
================
- Ubuntu as my OS
- make sure you have adb installed and running (See the android developers guide on how to do this)
- Heimdall 1.4.1
- A copy of the stock firmware zip from samsung for your device
- 7zip to be able to unzip the firmware from above
- Android AOSP fsutils simg2img and make_ext4fs (Attached) (note that your make_ext4fs needs to be patched to be able to generate samsung patches easily see gist) for some reason samsung chose to use a slightly different sparse file layout for this device. Using the stock make_ext4fs to generate an image will cause heimdall ( ad Odin) to stop data uploads after the first packet stream.
Or if you still want to use stock make_ext4fs you can try using Chainfire's sgs4ext4fs and run this after you generate your system.img, I haven't tried this route personally myself.
Step By Step (Part 1 - Mount stock system.img for modification)
==========
1. Create a folder to do your work like samsing_kitchen for example. Place your
stock firmware package there
Code:
mkdir samsung_kitchen
cd samsung_kitchen
2. Extract your stock firmware's system.img using 7zip
Code:
7z x XTC-T285XXU0APCN-20160421170750.zip
7z x T285XXU0APCN_T285OLB0APC6_T285XXU0APCN_HOME.tar.md5
Should see a couple of image files, one of them is system.img.
3. Create mount point and convert from sparse image to mountable image and then mount it
Code:
mkdir system
simg2img system.img system.img.raw
sudo mount -t ext4 -o loop system.img.raw ./system
The contents of the system image should now be visible inside the system folder you
just created. You can now proceed to modifiying it (e.g. remove apps)
(Part 2 - Repackage image for flashing to device)
=================================================
DISCLAIMER: As always make sure you backup your important files in case
something goes wrong! I will not be responsible for any losses resulting from this
activity. Also this activity may void your warranty.
Prequisites:
- Make sure you have heimdall properly working.
- Make sure you have oem unlock. This should be visible in developer settings
To know if it is enabled/disable FRP protection should be disabled when you go
in Odin mode.
1. pull the file_contexts file from .your device.
Code:
adb pull file_contexts
on a connected device in developer mode. You will need this file so that the permissions are properly set when building the image
2. Exit from system back to your working folder (e.g. samsing_kitchen ) and run
the following:
Code:
sudo make_ext4fs -s -l 2147483648 -S file_contexts -a system new_system.img ./system
This should create a flashable image called new_system.img
3. Restart your SM-T285 into Odin Mode (Power-off, then hold home vol-down + power until Odin Mode shows up)
4. Flash using Heimdall
Code:
heimdall flash --SYSTEM new_system.img
Your device should automatically restart after this. If something goes wrong you can always flash the original system image back.
Making an ODIN flashable image
----------------------------------------
To create an image compatible with ODIN (tar.md5) make sure you have a copy of the stock image zip from samsung and extract (using 7zip) its contents to a folder:
An extracted file should look like this:
Code:
boot.img
cache.img
hidden.img
nvitem.bin
recovery.img
SPRDCP.img
SPRDGDSP.img
SPRDLTEDSP.img
SPRDWDSP.img
system.img
replace the stock system.img with the one you created from above:
Code:
cp ../new_system.img system.img
tar and md5 it:
Code:
tar -H ustar -c boot.img cache.img hidden.img recovery.img SPRDCP.img SPRDGDSP.img SPRDLTEDSP.img SPRDWDSP.img system.img >T285_CUSTOM.tar
md5sum -t T285_CUSTOM.tar > T285_CUSTOM.tar
mv T285_CUSTOM.tar T285_CUSTOM.tar.md5
Optionally Zip it if you want:
Code:
7z a T285_CUSTOM.zip T285_CUSTOM.tar.md5
This guide should work for the T280 as well, though I can't confirm it since I don't have access to that model.
Click to expand...
Click to collapse
Anyway to do this on a windows machine?????

lohtse said:
Anyway to do this on a windows machine?????
Click to expand...
Click to collapse
Not sure though since you need to be able to mount an ext4 image, make modifications to it and then write it back. Plus the tools required to write the image back properly are only available in linux so I doubt there will be one for windows unless someone puts in effort to make something for it. The best I can do is to make a docker image where you can run it under windows with those tools if anyone is interested.

Just a note regarding the guide, it's not really necessary to add all the other partition images when creating the ODIN flashable tar.
All that is required is:
tar cvf system.tar system.img

jedld said:
Not sure though since you need to be able to mount an ext4 image, make modifications to it and then write it back. Plus the tools required to write the image back properly are only available in linux so I doubt there will be one for windows unless someone puts in effort to make something for it. The best I can do is to make a docker image where you can run it under windows with those tools if anyone is interested.
Click to expand...
Click to collapse
is there no way to create a set of files(zip etc) we windows users could flash using odin? would be a huge help if that could be done! also anyone have a link to a stock rom??
and finally I noticed that the US samsung site has a pdf manual for this tablet that refers to marshmallow!!!!!
http://www.samsung.com/us/business/support/owners/product/SM-T280NZWAXAR

lohtse said:
is there no way to create a set of files(zip etc) we windows users could flash using odin? would be a huge help if that could be done! also anyone have a link to a stock rom??
and finally I noticed that the US samsung site has a pdf manual for this tablet that refers to marshmallow!!!!!
http://www.samsung.com/us/business/support/owners/product/SM-T280NZWAXAR
Click to expand...
Click to collapse
I highly doubt this thing will get mm. [emoji52]

[Guide]Extracting Stock firmware files using Huawei Update Extractor/splitupdate

There seems to be a little confusion on how to do this and I've written down how to in many posts now so I figure I'd just write it down in a little guide.
What you need:
Firmware update.zip from http://pro-teammt.ru/firmware-database/
Windows only: Huawei Update Extractor
Linux/Mac(?)/(Windows too): splitupdate perl script (requires perl)
Direct link: https://mega.nz/#!4PBknJrK!iZQDI4ti6ERmQJC6afgUGTSvHHKcm9KFz9okmwwez3I
Source: https://github.com/marcominetti/split_updata.pl/tree/f5f415262be3487de28321b49dcb69d947897bf1
(Or my 'special' version https://mega.nz/#!NS4VnL7Q!5GMn-soCf_WMW6fZANd-TDzxjQkZW2LynEQtJ_TlUdU which extracts
to the same folder as 'splitupdate' instead of 'output/', and includes a mount script (Linux only, maybe Mac?) for extraction of files of the different images)
Archive extractor of your choice (7zip, winrar, winzip and so on.)
Firmware build
First you need to determine what your current firmware is, this can be done by going to 'Settings -> System -> About Phone' on your phone. Check 'Build Number'.
Mine says:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
BLA-L29 8.0.0.132(C636) (Replace 8.0.0. with C636 and add a B infront of 132 )
This can be translated into BLA-L29C636B132.
Now we have our current firmware!
Info on Nougat -> Oreo
As of Oreo the partitions changed a little.
'Boot' partition was split into 'ramdisk' and 'kernel'.
'Recovery' partition was split into 'recovery_ramdisk', 'recovery_vendor' and 'recovery_vbmeta', and shares the 'kernel' partition with 'ramdisk'.
The one's you probably want to flash are 'ramdisk' and 'recovery_ramdisk'. (Ramdisk is where Magisk/SuperSU goes, recovery_ramdisk is where TWRP goes)
Firmware update.zip
In this example I will be using my firmware, BLA-L29C636B132.
First start by going to http://pro-teammt.ru/firmware-database/ and enter your full firmware in the 'Enter model', click on Find Model.
This is what it will look like after you have searched. Locate the row that says FullOTA-MF and click on the 'update' link in that row.
When it's downloaded, open update.zip in your choice of archive manager and extract UPDATE.app to your desktop or somewhere easy to find.
Huawei Update Extractor:
Download Huawei Update Extractor from the link above, it's attached to first post in that thread I linked to (v0.9.9.5).
Extract the zip to your desktop (Or Downloads folder).
Enter the newly created folder that should be named 'HuaweiUpdateExtractor_0.9.9.5', and run HuaweiUpdateExtractor.exe.
Start by going to the 'Settings' tab and uncheck 'Verify header checksum'.
(Something is wrong with the header of erecovery_ramdisk, also it's mispelled to erecovery_ramdis, or maybe character limit? The partition on phone is named correctly. This does not need to be unchecked on Nougat firmware)
Then go back to the 'Extract' tab and click on the button that says '...' and open your UPDATE.APP
Rightclick on the file you want to extract and click on 'Extract Selected', this will bring up a dialog where you choose where to extract to.
After this you can flash the file using fastboot. Take 'ramdisk' for example.
Make sure you have adb & fastboot installed (https://forum.xda-developers.com/showthread.php?t=2317790)
Open up a command prompt and connect phone, reboot to fastboot mode using: usb plugged in, power + vol down, release power when phone vibrates.
Or you can use the command 'adb reboot bootloader'.
Make sure phone is recognized in fastboot mode with the command: 'fastboot devices', it should show up as a fastboot device.
Next we can flash RAMDISK.img using: 'fastboot flash ramdisk RAMDISK.img'.
On Nougat you would extract 'BOOT' from UPDATE.APP and flash using:
'fastboot flash boot BOOT.img'
Linux/Mac(?)(and Windows with perl installed, I use Strawberry Perl)
First download the splitupdate zip from above.
Extract it and enter the extracted 'split' folder, open a terminal and:
'chmod +x splitupdate'
'chmod +x crc'
Now put your UPDATE.APP in the 'split' folder and open a terminal and use the following command:
'./splitupdate UPDATE.APP file_to_extract'. If you write 'file_to_extract' or anything that is or is not in the UPDATE.APP it will list all images in it.
Typing './splitupdate UPDATE.APP' will extract all files in UPDATE.APP
It will output files to the newly created 'output' folder. The filtering is not perfect. If you use './splitupdate UPDATE.APP RAMDISK', it will extract all images with RAMDISK in its name, so you will get RAMDISK.img and RECOVERY_RAMDISK.img. This is fine for me as the original script extracted everything, which takes long for the larger images.
And if you use the 'special' version:
'chmod +x simg2img'
'chmod +x mount.sh'
I edited the splitupdate script for the 'special' version just to make it easier for me as I like to check SYSTEM, VENDOR, PROCDUCT and those images for changes.
So it made it easier if it extracted directly to the root of 'split' folder instead of 'output', then I could run the mount.sh script directly.
To use mount.sh, first edit the script and replace YOUR_SUDO_PASSWORD_HERE with your password or remove 'echo YOUR_SUDO_PASSWORD_HERE | ' and input password manually when it asks.
Then simply extract SYSTEM.img (or Product, vendor, odm whichever you like) and './mount.sh SYSTEM' (yes, no extension).
This will convert SYSTEM.img to SYSTEM.raw and mount it to 'split_folder/SYSTEM/' as a loop device, it will also chmod 777 everything in SYSTEM/.
Linux ADB and Fastboot
Use google for this one. ADB usually works fine right away, Fastboot might get 'no permissions' and need to be run as sudo if it's missing udev permissions/entries.
You can make fastboot work without sudo but it's easier to google it as it might get lengthy and there are a lot of different distros of linux (I use Ubuntu)

Hi ante0, i have downloaded the bla a09 8.0.0.109 c567 which is the recent update for my US mate 10 pro version, i was using hisuite to update my phone which is failing but i was able to grab the update which it down loaded and it has the following files in it, bla-a09_hw_usa( which contains update_full_BLA-A09_hw_usa, public( which contains update_data_full_public), update.zip which contains update.app and other xml files, i have already bl unlocked and rooted with supersu but i wanted to install magisk and i installed twrp and tried sideloading magisk but it fails stating boot image already modified and advised flask stock boot, so which files do i need to flash and what are the fastboot commands to do so and i was also thinking about complete bl lock just to make it look like new phone and how do i do that, please direct me, thank you.

I think to update you'll need to:
A) Unroot your supersu.
B) Restore stock boot and restore your stock recovery with guide in OP and with the firmware files actually installed on your phone.
Then you could root oreo with magisk.

oslo83 said:
I think to update you'll need to:
A) Unroot your supersu.
B) Restore stock boot and restore your stock recovery with guide in OP and with the firmware files actually installed on your phone.
Then you could root oreo with magisk.
Click to expand...
Click to collapse
there lies my problem, i am trying to flash an updated stock firmware than the one that came with my phone, i have unrooted supersu and deleted supersu app and dont have root anymore confirmed by rootcheck apps, since my boot is already patched once magisk wont flash and advising me to flash stock boot image but i dont know which to flash as with oreo there seems to be different partitions and i dont know commands other than basic fastbbot commands to flash stuff.

ok so i was able to flash ramdisk, recovery and system and boot back to OS ( i have earlier erased system by mistake) and i have flashed system.img from updated firmware but version still shows old one, and i am trying to use funkyhuawei erecovery method to flash the updated firmware and when i boot to erecovery to update but the update button is missing and i just have rebbot, wipe date/fr and wipe cache, so what do i need to flash and commands for it in order to make erecovery work and i have update button enabled, thank you.

lingarajug said:
ok so i was able to flash ramdisk, recovery and system and boot back to OS ( i have earlier erased system by mistake) and i have flashed system.img from updated firmware but version still shows old one, and i am trying to use funkyhuawei erecovery method to flash the updated firmware and when i boot to erecovery to update but the update button is missing and i just have rebbot, wipe date/fr and wipe cache, so what do i need to flash and commands for it in order to make erecovery work and i have update button enabled, thank you.
Click to expand...
Click to collapse
If you can, use the HWOTA method instead. It's free and found: https://forum.xda-developers.com/mate-10/how-to/guide-mate-10-flash-oreo-update-package-t3716814
If you can't use HWOTA and have to use Funky:
You seem to be in normal Recovery. You should see a button that says 'Download latest firmware', the one you're describing is showing buttons that are in normal Recovery.
Are you booting using Usb plugged in + vol up + power?

For some reason my phone would only boot to revovery and not erecocery, anyway i used hisuite method and was able to flash new firmware. Thank you.

I've just unbricked my Mate 10 pro via this method. Thank you Sir.

Not sure if this is the right place but where can I find the original Huawei OS it was shipped with? I installed Lineage and want to go back to Factory.
I just want to .img file. I have only unlocked the bootloader not rooted the phone.
Lack of camera and other features means I need to get back.
Any ideas?

elviss0812345 said:
I've just unbricked my Mate 10 pro via this method. Thank you Sir.
Click to expand...
Click to collapse
You bricked your device because you don't know what you are doing,not because of this guide.Oh,and i thought KangRom was responsible for bricking you device....anyone else to blame ?

My phone was bricked because of Lineage OS, and i unbricked with this guide. Read my post first.
Pretoriano80 said:
You bricked your device because you don't know what you are doing,not because of this guide.Oh,and i thought KangRom was responsible for bricking you device....anyone else to blame ?
Click to expand...
Click to collapse

elviss0812345 said:
My phone was bricked because of Lineage OS, and i unbricked with this guide. Read my post first.
Click to expand...
Click to collapse
lol,i've read "bricked"... .I apologize for that!:good:

There is no way at least for the US version to find firmwares shipped with phone until now, i figured it out by connecting phone to hisuite on PC and it showed update available and i clicked update and waited until download part of update process completed and then i went to documents folder and hisuite and the app stores the download there and it will have 3 zip files, u can copy them to a different place because once the update completes those files are deleted. Might be the same for other models if supported by hisuite.

Here https://playstoreappinstall.com/play-store-for-huawei/ more info

@lingaraguj not already listed there :
http://pro-teammt.ru/firmware-database/?firmware_model=ALP
?

oslo83 said:
@lingaraguj not already listed there :
http://pro-teammt.ru/firmware-database/?firmware_model=ALP
?
Click to expand...
Click to collapse
US version firmware not listed, lots of international versions though.

can i flash everything in UPDATE.APP to go back to fully stock.
if i can what is the fastboot command for every one of them files like "fastboot flash ramdisk RAMDISK.img'?
ive mate 10 pro.

lex71 said:
Not sure if this is the right place but where can I find the original Huawei OS it was shipped with? I installed Lineage and want to go back to Factory.
I just want to .img file. I have only unlocked the bootloader not rooted the phone.
Lack of camera and other features means I need to get back.
Any ideas?
Click to expand...
Click to collapse
It should say your current firmware (besides Lineage) in Settings -> (System?) -> About.
dark3bod said:
can i flash everything in UPDATE.APP to go back to fully stock.
if i can what is the fastboot command for every one of them files like "fastboot flash ramdisk RAMDISK.img'?
ive mate 10 pro.
Click to expand...
Click to collapse
It's better to use:
https://forum.xda-developers.com/mate-10/how-to/guide-mate-10-flash-oreo-update-package-t3716814
I'm not sure if symlinks will be set up correctly if you flash images directly. And some partitions can't be flashed from fastboot (like the erecovery ones)

ante0 said:
It should say your current firmware (besides Lineage) in Settings -> (System?) -> About.
It's better to use:
https://forum.xda-developers.com/mate-10/how-to/guide-mate-10-flash-oreo-update-package-t3716814
I'm not sure if symlinks will be set up correctly if you flash images directly. And some partitions can't be flashed from fastboot (like the erecovery ones)
Click to expand...
Click to collapse
@ante0
This man is a legend.........
I would like to express my gratitude in you answering my pms and assisting to get the device up and running.
If ever am in Sweden:silly: ill definitely buy you beeeeeeeeeeeeeeeeeeeeeeers
Thanks for the patience and the help you bring to us noobs bricking these bloody Mate 9's

Im now on lineage os. I didnt flash twrp and magisk. Can i only flash stock system.img to get fully stock. Or i have to flash ramdisk and boot first before system.img