[Q] inquiry on aboot signature process - Galaxy Note 3 Developer Discussion [Developers Onl

The aboot binary has a section of 0x100 bytes which contains a signature. This section is clearly identified in the header. Unless I'm mistaken, this is the pcks 1.5 padded sha 256 signature of the aboot binary file itself (thanks ryanbg). But I'm assuming the signature is generated prior to adding it into the binary, so what is the signature of exactly? Is it the entire aboot file with 0's in place of the signature? I noticed that one of the first things aboot does while executing is write 0's over of its own signature, but it writes 0's over the cert chain and beyond as well.
So I have these specific questions above. I'll answer them myself if enough time passes before someone else chimes in. If you have the answers already or any other information on the signing process that you feel might be helpful or interesting, feel free to reply.

Related

[DEV TOOLS] - Pack & Repack Boot.img Files - for Windows USERS

Plagiarism will not be tolerated on XDA-Developers:
http://forum.xda-developers.com/showpost.php?p=35640046&postcount=36
Reserved - Possible Updates Using Cygwin
I'm gonna take this one just in case as well
Thx for the app but i have an empty ramdisk folder...and all of the ramdisk files can't created or newer or same age version exists...cydwin won't let me copy the log...im using huawei not SE phone..if it has something to do!! But i can see the contents at boot.img-ramdisk.gz
Thanks but please mirror to other filehoster because mf is buggy on my phone
Sent from my WT19i using xda premium
$ ./extractboot boot.img
./extractboot: ./split_bootimg.pl: /usr/bin/perl: bad interpreter: Permission denied
./extractboot: line 17: cpio: command not found
gzip: ../../boot.img-ramdisk.gz: No such file or directory
what i missed here?
edit: opps. missed the REQUIRED packages. testing again.
$ ./extractboot boot.img
Android Magice not found in ./boot.img/ Giving up.
gzip: ../../boot.img-ramdisk.gz: unexpected end of file
cpio: premature end of archive
Any help with this error? I am trying to split and edit a custom CM9/ICS boot.img
very useful tool, thanks
This isn't working for me on my htc evo 4g lte. I am unpacking the stock boot.img and then repacking it with NO changes and get bootloops.
your image png should not exceed 20KB and your logo.rle should not exceed 60kb Otherwise you will almost always bootloop
stef67000 said:
your image png should not exceed 20KB and your logo.rle should not exceed 60kb Otherwise you will almost always bootloop
Click to expand...
Click to collapse
I didn't change any pngs, logos, or anything. I simply unpacked, repacked, and flashed.
maxdamage2122 said:
I didn't change any pngs, logos, or anything. I simply unpacked, repacked, and flashed.
Click to expand...
Click to collapse
Check on the way your kernel should be build.. Ours use as base 0x20 but yours may change..
Sent from my LT18i using Tapatalk
jimbo77 said:
Check on the way your kernel should be build.. Ours use as base 0x20 but yours may change..
Sent from my LT18i using Tapatalk
Click to expand...
Click to collapse
Is there a way to check without the source? Source for our kernel isn't released yet.
I've tried to unpack the last boot.img from cm9 RC2 to get the new cwm 6.x but I have an issue
Code:
$ ./extractboot boot.img
Page size: 2048 (0x00000800)
Kernel size: 3229308 (0x0031467c)
Ramdisk size: 1789254 (0x001b4d46)
Second size: 0 (0x00000000)
Board name:
Command line:
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
./extractboot: line 17: cpio: command not found
I use this way http://forum.xda-developers.com/showthread.php?t=1477845
how to change spash screen http://forum.xda-developers.com/showthread.php?t=1140406
You need to download the cpio package through cygic in order to have it fixed..
Sent from my SGS3... Yes I have it!!!!
jimbo77 said:
You need to download the cpio package through cygic in order to have it fixed..
Sent from my SGS3... Yes I have it!!!!
Click to expand...
Click to collapse
thanks
thomas.raines said:
$ ./extractboot boot.img
Android Magice not found in ./boot.img/ Giving up.
gzip: ../../boot.img-ramdisk.gz: unexpected end of file
cpio: premature end of archive
Any help with this error? I am trying to split and edit a custom CM9/ICS boot.img
Click to expand...
Click to collapse
Hello,I'm having the same error with CM9/10 ICS/JellyBean kernel boot.img,there are chances it comes from the kernel itself as it appears to be or should we better look into our configuration?
helo, i repacket doomlord kernel v22 and when im trying to flash it i got this error :
FAILED (remote: Wrong range:0x10008000-0x103202d7. Ok:0x00200000 - 0x03dfff)
It's somethink about size of kernel and "fake size maker" file, but i dont know how to fix it.
So I pulled a working one apart and replaced the kernel with the compiled one.
Code:
[email protected] ~
$ cd /boot
[email protected] /boot
$ ./extractboot boot.img
Page size: 2048 (0x00000800)
Kernel size: 4463500 (0x00441b8c)
Ramdisk size: 372027 (0x0005ad3b)
Second size: 0 (0x00000000)
Board name:
Command line: console=ttyHSL0,115200,n8 androidboot.hardware=qcom loglevel=0
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
2881 blocks
[email protected] /boot
$ ./packboot
Using base address 0x40200000
Using command line 'console=ttyHSL0,115200,n8 androidboot.hardware=qcom loglevel=0'
No errors
I then put it back together and I'm getting the boot.img is like half the original size (even tho the kernel files were pretty close to almost deadon the same size) and when I try to send to boot I get this
Code:
>fastboot boot boot_new.img
downloading 'boot.img'...
OKAY [ 1.168s]
booting...
FAILED (remote: incomplete bootimage)
finished. total time: 1.168s
This is for a Pantech Burst (p9070) if that helps at all
Original boot.img
New repacked boot.img

[HW][OT] E:V:A's Discussion Thread

This is my own completely Off Topic Discussion thread.
A place where I will bring HW related discussions, that do not fit into
specific threads or discussions.
Please, do not post here with general questions or other junk that I have not initiated myself.
Also do not ask where to find files/programs mentioned in this thread, because if I have not linked to them, I don't know!
They will be removed. (Thanks for understanding.)
See you.
<< Better reserve for more dragons >>
Didn't see that anyone mentioned it and I'm not sure if the S4 modems are as well, but the initial container that the modems are in on the HTC used S3 chips is a fat16 format. I saw that with a simple hex editor showed it and I was able to see the modem file structure as well. I'll snag a few S4 modems later today and take a look. Couldn't unpack and repackaged though, which is probably the EFS formatting with it.
Off topic goes in off topic
Sorry it took so long
I had intended to do this at least a week ago, but had not the chance. Both the S3 HTC Radios and the S4 HTC Radios are fat 16 imgs.
As you see in the Rezound screenshot, in the first few lines of the HEX table in the bottom left mentions no volume label and a fat 16 label on the type. in addition when I use IMG viewers it shows the same with both the MDM9K image and the main IMG. This should theoretically enable us to possibly use amss imgs or other parts of the radios with other devices or even cross the modem over to other Samsung devices with the same modem chips.
In addition as per the Ville screenshot, this is the One S modem for one of the European basebands. Again the HEX shows Fat 16 as the file type, but the file structure and amount of files are much more plentiful. If this can become of any use, great. If not, oh well... but it is good food for thought either way.
On other notes, I did try to copy files from the LTE baseband (MDM9k) from the Vivid and move them to the MDM9k IMG for the rezound, but the IMG bloated. I haven't had enough time to try and mount the images in my Ubuntu environment, but doing it in Winblows caused the IMG to bloat up too much and caused radio issues and IMEI unknown blanks.
Happy perusing and happy hunting!
Very nice, but I doubt you'll be able to mix modem files (between different devices) unless you're absolutely sure that the device modem and AP HW is the same. Apparently from another recent conversation, it seem that HTC and Qualcomm are both moving to unified source code for their devices. So it can still be true that many of those files are the same across devices.
Could you write a few lines on how you go about this extraction and do it for the HTC One X (LTE)?
Also don't forget that US HTC One X (or S, or whatever) is not the same hardware and the European one!
On second thought, I think this is what you got..right?
Pretty much. Seems like another situation where I should have spoke up when I first saw it with Qualcomm S3 modems in May. On moving files though, I was planning to stay in family. S3 w/ S3 ect.
^^ BTW. Could you tell if there are any structural differences (content wise) between files of same prefix, but sequential postfix? What is strange is that they are all very different sizes, which indicate they probably have very different content...
If it was just one solid piece of firmware, it would just have been chopped up into equal sized pieces...
I'll look closer on that. I do remember that most of the sequential pieces were the same size minus either the first or the last, holding with your theory.
Maybe not the right place, but have you looked at the pit files?
COM_TAR2MSM8960
MODEM non-tlos.bin
sbl1.mbm
sbl2.mbm
sbl3.mbm
aboot.mbm
rpm.mbm
BOOT boot.img
TZ
PAD
PARAM
EFS efs.img (ext4)
MODEMST1 nvrebuild1.bin
MODEMST2 nvrebuild2.bin
system.img (ext4)
userdata.img (ext4)
persist.img (ext4)
cache.img (ext4)
recovery.img (ext4)
FOTA
BACKUP
FSG
SSD
GROW
PGPT pgpt.img
PIT MSM8960.pit
MD5 md5.img
SGPT sgpt.img
I know it is not really new, but I hadn't seen the img names.
The ones I took screenshots of were for 3rd and 4th Gen Snapdragon processors, radio.imgs for HTC devices. The Samsung pit files may give good cross references though. I'll re-unbox my Amaze this evening and check the mounts to see any information on the single file broken into pieces theory.
"eMMC Partition tools usage for msm7x30/msm8x60"
(A repost from Anyclub...)
In the eMMC boot, there are some changes in eMMC partitioning.
Code:
[SIZE=2]partition.xml - Everything begins with this file, which describes the number of
partitions desired, and how many sectors each one should be.
PartitioningTool.py - translates partition.xml into binary partitions
msp.exe - writes binary partitions to SD/eMMC cards using card reader
mjsdload.cmm - writes binary partitions to SD/eMMC cards using Trace32
msp.py - writes binary partitions to a single image file
QPST - writes binary partitions to SD/eMMC cards on Target
[/SIZE]
Helper /Debug Tools:
Code:
[SIZE=2]parseBinaryPartitionFile.pl - Decodes MBR partition tables. Run:
"Perl parseBinaryPartitionFile.pl partition.bin"
to generate the partition information
parseGPT.pl - Decodes GPT partition tables
[/SIZE]
partition.xml
These are the property entries that can be added in new partiton.xml to specify the configuration.
Code:
[SIZE=2]<parser_instructions>
WRITE_PROTECT_BOUNDARY_IN_KB = 0
GROW_LAST_PARTITION_TO_FILL_DISK = false
ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY = false
</parser_instructions>[/SIZE]
WRITE_PROTECT_BOUNDARY_IN_KB: Typical boundaries are 64MB, i.e. 65536 KB. This
means that a 256MB eMMC card has 4 write protect boundaries. Any or all of
them can be marked as read-only. Different vendors allow for different sized
boundaries.
GROW_LAST_PARTITION_TO_FILL_DISK: In partition.xml the size of each partition
is specified. If this field is TRUE, then the last partition size is ignored
and set to 0. Then during patching this size is updated such that the last
partition extends to use all remaining space.
ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY: To allow total flexibility, it
could be that a partition that is currently writeable might need to be marked
as read-only. This can only happen *if* that partition begins on a write
protect boundary (i.e. 64MB). Thus if this field is TRUE, then all logical
partitions are positioned such that they begin on a write protect boundary.
PartitioningTool.py
Is a new tool used to generate the the partition.xml
When run, it will output following 5 files:
1. emmc_lock_regions.xml
This hold the sector ranges that need to be marked as read-only by the
operating system (this is from readonly="true" in partition.xml) i.e. modem
code and boot images are typically on read-only partitions Typical
Write-Protect boundary is 64MB = 131072 sectors = 0x20000 sectors. The file
below is protecting the very first 64MB region of the card,
Boundary #0
Starting at sector 0
Ending at sector 131071 (for a total of 131072 sectors)
Code:
[SIZE=2]<?xml version="1.0" ?>
<protect>
<!-- NOTE: This is an ** Autogenerated file ** -->
<!-- NOTE: Sector size is 512bytes, WRITE_PROTECT_BOUNDARY_IN_KB=0, WRITE_PROTECT_BOUNDARY_IN_SECTORS=0 -->
<!-- NOTE: "num_sectors" in HEX "start_sector" in HEX, i.e. 10 really equals 16 !! -->
<program boundary_num="0" num_boundaries_covered="1"
num_sectors="20000" num_sectors_dec="131072" physical_partition_number="0"
start_sector="0" start_sector_dec="0"/>
<information WRITE_PROTECT_BOUNDARY_IN_KB="0"/>
</protect>
[/SIZE]
2. partition0.bin
This holds the partition tables, i.e. MBR followed by all EBRs. This is the
partition table in binary format. It is copied over to the storage device in a
1 to 1 manner. I.e. how it looks in partition0.bin is exactly how the
partition table will look on the storage device. partition0.bin is a "generic"
file meant to fit on *any* size SD/eMMC card, as a result, there are 0's that
need to be patched,such as EXT partition and last partition size.
3. patch0.xml
Contain the patching instructions to tailor each partition table
"partition0.bin" to a specific SD/eMMC card. I.e. the partition0.bin
partition tables can be applied to any size storage device As a result,
there are empty values (zeros) in the partition tables that must be filled
in with a specific cards sector size
There are two ways to apply this patch:
a) (patch before) When you patch the "zeros" in the partition tables held in the file partition0.bin, and then write it to the card
b) (patch after) When you write partition0.bin to the card (which still has "zeros" in it), and then patch the cards partition tables directly
4. rawprogram0.xml
precise sector details of all partitions and what files (if any) need to
be placed there. In addition to writing partition tables onto a device,
often times it is desired to write one or more files into the partition
area as well, The File has partition name (i.e. label), where it begins
(start_sector) and how big it is (num_partition_sectors). It also
describes what file(s) to write to this partition, as well as any
offsets.
Example:
Code:
[SIZE=2]<program file_sector_offset="0" filename="partition0.bin" label="MBR"
num_partition_sectors="1" physical_partition_number="0"
size_in_KB="0.5" start_sector="0"/>
<program file_sector_offset="1" filename="partition0.bin " label="EXT"
num_partition_sectors="2" physical_partition_number="0"
size_in_KB="1.0" start_sector="779"/>
[/SIZE]
The 1st line describes taking the 1st sector from partition0.bin, and writing it to sector 0 of the card.
The 2nd line describes taking the 2nd and 3rd sector from partition0.bin and writing it to sector 779 of the card.
I.e. file_sector_offset = 2 and num_partition_sectors=2
5. loadpt.cmm
This is used by the mjsdload.cmm to flash the image.
msp.exe
This is used to apply the patches
This program will program a memory card (SD/eMMC) attached to the PC as USB mass storage device
Use -d to detect the path of the memory card if you are unsure what to do first
Commands list:
Code:
[SIZE=2]-h (Print this help message) Ex. msp -h
-d (Detect which storage device ID is active) Ex. msp -d
-p (Print partition information) Ex. msp -p /dev/sdb
-pp (Print partition information - DETAILED) Ex. msp -pp /dev/sdb
-x (Write files as outlined in rawprogram.xml) Ex. msp -x rawprogram.xml /dev/sdb
-xx (Write files as outlined in rawprogram.xml - DETAILED) Ex. msp -xx rawprogram.xml /dev/sdb
-s (Write SINGLE IMAGE "singleimage.bin" as outlined in rawprogram.xml) Ex. msp -s rawprogram.xml 8192
-v (Verify file written correctly as outlined in rawprogram.xml) Ex. msp -v rawprogram.xml boot.img /dev/sdb
-f (Program single file as outlined in rawprogram.xml) Ex. msp -f rawprogram.xml boot.img /dev/sdb
[/SIZE]
To program the SD/eMMC with msp.exe in mass storage mode:
Code:
[SIZE=2]STEPS Complete example (patch after)
-------------------------------------------------------------
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Program your device msp -x rawprogram0.xml /dev/sdb
Patch your device msp -xx patch0.xml /dev/sdb
STEPS Complete example (patch before)
-------------------------------------------------------------
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Patch your files msp xx patch0.xml 15758336 (patch the 8GB card offline,this will change the partition0.bin)
Program your device msp x rawprogram0.xml /dev/sdb
[/SIZE]
The msp.py program can also used to patch the files.
For example:
python msp.py patch0.xml 15758336
This will patch the 8GB card offline, and change the partition0.bin.
Qualcomm DBL format (source Anyclub)
DBL is combined by three images.
dbl.bin - the raw DBL image
dbl.hd - the dbl header image
dbl_preamble.mbn - the preamble image with following format:
Code:
[SIZE=2]+------------+
|Dbl-preamble|
+------------+
|Dbl-header |
+------------+
|Dbl.bin |
+------------+
[/SIZE]
PBL is using the dbl_preamble to detect the NAND page size. The NAND controller
can detect 512 byte and 2 Kbyte page size automatically, but for NAND page size
more than 2K, PBL needs preamble to determine the page size, so for 512/2K
NAND,eMMC,eSD,oneNAND , the preamble is optional.
For the dbl_preamable, the first two words are same as dbl header, they are
codeword and magic,
ref image_header.c
Code:
data_ptr = autodetectpage;
*data_ptr = sbl_header.codeword;
data_ptr++;
*data_ptr = sbl_header.magic;
data_ptr++;
*data_ptr = AUTODETECT_PAGE_SIZE_MAGIC_NUM;
the third one is auto page size detection magic number.
The usage of the auto detection magic number is as below description To
understand this more clearly, for example ,if the dbl_preamble is 8KB. When we
detect the NAND page size > 2KB, we will set the default page size as 2K, then
try to read the preamble image from NAND flash, in case the page size is 4KB,
when read, can get 2 magic number in 8K size because page size will increase
with 4K byte steps, so page size is detected and that is 8K/2 = 4. For the 8K
page NAND, 1 magic number is read from the 8K size preamble image, so the page
size will be 8K/1 = 8K.
Dbl_preamble layout:
Code:
[SIZE=2]+-------------------------------------------------+
| codeword|magic|autodetection_ magic|............|
2K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
4K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
6K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
8K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
+-------------------------------------------------+
[/SIZE]
E:V:A said:
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Program your device msp -x rawprogram0.xml /dev/sdb
Patch your device msp -xx patch0.xml /dev/sdb
Click to expand...
Click to collapse
Hello, where i can find these files, i have qpst but there are no such files.
So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)
dviguha said:
Hello, where i can find these files, i have qpst but there are no such files.
Click to expand...
Click to collapse
I think it could be part of the Qualcomm Development Acceleration Resource Toolkit (QDART), as it supersedes QPST. But I'm not sure...
joederp said:
So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)
Click to expand...
Click to collapse
Where do you find these references?
I don't know, so if you find out let us know.
http://forum.xda-developers.com/showthread.php?t=1848267
If you dump the pit file you can see the references if you open in hex editor. Since it defines partition locations it appears they are either after last partition.. I haven't looked into technical pit stuff.
Sent from my SGH-T999 using xda app-developers app
Photo Place Holder Post
All images that I have not yet posted goes here...
Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?
vache said:
Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?
Click to expand...
Click to collapse
You tell me!

OP3 Partitions

I looked on the partition layout of the OP3 and noticed that
1. the free space in the system partition is only about 200 MB (with OOS 3.5.1) so at some point there may be not enough space, is it possible to change the partition layout?
2. sde23 (/bt_firmware) is 1 GB large but uses only a few KiB i.e. its a waist of 1 GB :/
3. The flash seams to be divided into 6 devices and each of those partitioned, the last block device sdf has apparently 1.5 GB of unpartitioned space :/ what a waist!
What are you thoughts on the matter?
Code:
sda 57.940.115.456 55.256,00
sda1 8.192 ssd 0,01
sda2 33.554.432 persist 32,00 /persist
sda3 268.435.456 cache 256,00 /cache
sda4 1.048.576 misc 1,00
sda5 524.288 keystore 0,50
sda6 131.072 devcfg 0,13 /devcfg.mb
sda7 131.072 devcfgbak 0,13 /devcfg.mb
sda8 524.288 frp 0,50
sda9 10.485.760 oem_dycnvbk 10,00
sda10 10.485.760 oem_stanvbk 10,00 /static_nvbk.bin
sda11 1.048.576 param 1,00
sda12 8.290.304 reserve1 7,91
sda13 16.580.608 reserve2 15,81
sda14 524.288 config 0,50
sda15 57.588.297.728 userdata 54.920,48 /data
0
sdb 4.194.304 4,00
sdb1 4.149.248 xbl 3,96 /xbl.elf
0,04
sdc 4.194.304 4,00
sdc1 4.149.248 xblbak 3,96 /xbl.elf
0,04
sdd 134.217.728 128,00
sdd1 32.768 reserve 0,03
sdd2 4.096 cdt 0,00
sdd3 1.048.576 ddr 1,00
126,96
sde 4.294.967.296 4.096,00
sde1 524.288 rpm 0,50 /rpm.mbn
sde2 524.288 rpmbak 0,50 /rpm.mbn
sde3 2.097.152 tz 2,00 /tz.mbn
sde4 2.097.152 tzbak 2,00 /tz.mbn
sde5 524.288 hyp 0,50 /hyp.mbn
sde6 524.288 hypbak 0,50 /hyp.mbn
sde7 2.097.152 fsg 2,00
sde8 16.384 sec 0,02
sde9 524.288 pmic 0,50 /pmic.elf
sde10 524.288 pmicbak 0,50 /pmic.elf
sde11 99.614.720 modem 95,00 /firmware /NON-HLOS.bin
sde12 16.777.216 dsp 16,00 /dsp /adspso.bin
sde13 1.048.576 dip 1,00
sde14 33.554.432 mdtp 32,00
sde15 8.388.608 abootbak 8,00 /emmc_appsboot.mbn
sde16 8.388.608 aboot 8,00 /emmc_appsboot.mbn
sde17 16.777.216 LOGO 16,00
sde18 67.108.864 boot 64,00 /boot.img
sde19 67.108.864 boot_aging 64,00
sde20 3.154.116.608 system 3.008,00 /system
sde21 67.108.864 recovery 64,00 /recovery.img
sde22 4.096 devinfo 0,00
sde23 1.048.576 bluetooth 1,00 /bt_firmware /BTFM.bin
sde24 524.288 keymaster 0,50 /keymaster.mbn
sde25 524.288 keymasterbak 0,50 /keymaster.mbn
sde26 262.144 cmnlib 0,25 /cmnlib.mbn
sde27 262.144 cmnlibbak 0,25 /cmnlib.mbn
sde28 262.144 cmnlib64 0,25 /cmnlib64.mbn
sde29 262.144 cmnlib64bak 0,25 /cmnlib64.mbn
sde30 262.144 apdp 0,25
sde31 262.144 msadp 0,25
sde32 4.096 dpo 0,00
sde33 34.226.176 splash 32,64
sde34 2.097.152 sti 2,00
673
sdf 1.610.612.736 1.536,00
sdf1 2.097.152 modemst1 2,00
sdf2 2.097.152 modemst2 2,00
sdf3 4.096 fsc 0,00
sdf4 524.288 md5 0,50
1.531,50
63.988.301.824
the nexus 5 has marshmallow on a 1gb /system, I think 3gb in OP3 will be fine especially since there's still empty space in it now.
My thoughts are that this is in the wrong section
Best Regards,
Taker
Taker18 said:
My thoughts are that this is in the wrong section
Click to expand...
Click to collapse
And which one would be the right one?
Also does anyone here know what what all this different small partitions do?
for example what is boot_aging apparently its some sort of boot image but its needier a backup of boot.img nor of the recovery.
I also wonder why xbl is so important to have the backup xblbak located with an own partition table in a separated flash section?
Q and A section evidently this has nothing to do with dev
And frankly don't begin to mess with partitions, nothing good can come up from this.
Well, isn't understanding the partitions not part of development? IMHO one could learn something useful out of that.
Development is programming. Building Rom and kernels.
This isn't dev add you don't propose anything related to a script, a program. You're just asking.
You can not program without understanding how the underlying system works. Respectively the better you understand the system the more you can get out of the hardware, for example here: http://forum.xda-developers.com/optimus-4x-hd/development/rom-mahdi-rom-2-7-unofficial-beta-t2867590 this ROM apparently exploits a existing but unused partition of the p880 to add a new encryption feature which was not present in the stock OS.
Given how many partitions and unused space the OP3 has I'm sure someone can come up with a nice feature to exploit them. Possibly for a different approach on multi boot or may be some virtualization 1 Gig of space is more than enough for a hyper-visor.
> You're just asking.
Nope I'm finding out stuff and trying to find out more stuff....
I looked into the binaries and found something worrisome in XBL partitions contained in the 2nd and 3rd block device:
Code:
##This flag enables booting to UEFI Shell on LA devices.
##This UEFI in the current form should not be used for
##retail purpose. Fuse check will be added to avoid any
##possible security implications.
Also I'm wondering what the boot_aging partition does, apparently its some sort of boot image. But its needier a backup of the kernel (boot.img) nor of the recovery, I wonder what it is...
I'm not discussing that. It belongs to Q&A until a practical thing comes up, then it can be in dev section.
So a sub forum called: OnePlus 3 ROMs, Kernels, Recoveries, & Other Development
is not intended to talk about development, that's so odd.
What sub forum than is intended to talk about source and hardware and boot loaders on a nun user level?
@DavidXanatos
No offense, Sir... but I guess OnePlus 3 ROMs, Kernels, Recoveries, & Other Development is more for like releases and stuff made by devs.
Maybe your thread belongs in OnePlus 3 Guides, News, & Discussion where you can discuss hat topic and find out stuff, as there are other threads a bit like yours.
Maybe ask a mod to move your thread? Just a suggestion.
Striatum_bdr said:
I'm not discussing that. It belongs to Q&A until a practical thing comes up, then it can be in dev section.
Click to expand...
Click to collapse
This thread does not belong in Q&A either. General maybe, but development could be right if it's about adding more space to /system.
I think debating on whether this thread should be in QA section or Dev section why not keep this decision on moderator.
why not just provide proper answer ( of course, if you know ).
I agree this question is more suited in QA section but i think this question can be asked in Dev section because it's very closely related to development.
Hello,
I've moved it to Guides, New, Discussion, please discuss away.
This where it will reside unless someone comes up with a compelling argument as to why it belongs in "Other Development". I don't really believe it does.
Also please be civil to each other.
Cheers Sloth
I think a practical case has come up with OOS 9.0.3 with no space left in partition. Adblock and Ifont are not able to write files. Please suggest
-Amateur Dev
Delete play music and play movies from system partition. Should free up enough space for our mods.

OnePlus3T custom ROM install failed, but OOS forks just fine.

I tried to install /e/ on my OnePlus3T after I used LinageOS 16.
Because after I upgraded LinageOS to 16, I cant update LineageOs over the Air and some other Reasons i wanted to switch to /e/.
So I tried installing /e/ or a other Version of LinageOs using TWRP, but sadly this doesnt worked, i got Error 7 or rather Error 1001.
I flashed my OnePlus Firmware to 5.0.8 and Still got the same error.
I tried wiping my Partitions.
Also I flashed the stock Recovery from OnePlus.
And installed OOS with Stockrecovery, which absolutly worked.
I locked my phone
With OOs I made a Update over the Air.
Unlocked the Phone and tried to install a Custom ROM.
But still got the same Error.
After unpacking the installion zip of /e/ i removed all lines in the updater-script except
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
which stands for the corresponding error. Then i took the updater-binary file und copyied it to my phone. Then I took the files I unpacked and rezipped them into mytest.zip,
which I moved over to my phone.
I run following commands:
chmod 777 /data/media/update-binary
/data/media/update-binary 3 0 /data/media/mytest.zip
And got following Error:
Decompression failed with BLOCK_LENGTH_1 missing 4095265 bytes of new data failed to execute command [new 2,23006,24030] ui_print script succeeded: result was []
In TWRP i can access files in the /system Partition and the /system partition is mountable, but still there is something wrong with it.
What could I try next?
Post the recovery log from when you get the original error 7 (1001) message. That might be more specific as to what is wrong.
EvilChickens said:
What could I try next?
Click to expand...
Click to collapse
Save all your data and go this way:
1. install latest TWRP (3.3.1.0) and firmware 9.0.4
2. in TWRP delete all partitions (Dalvik, Cache, System, Data,...)
3. reboot into TWRP
4. format Data in Wipe - Format Data - type "yes"
5. reboot into TWRP
6. connect your phone with your computer and copy the custom rom into your phone
7. install your rom and if needed gapps + magisk
8. enjoy your rom
this one?
Installing zip file '/sdcard/e-0.7-p-20190710-UNOFFICIAL-oneplus3.zip'
Checking for Digest file...
I:Update binary zip
Verifying package compatibility...
Package doesn't contain compatibility.zip entry
I:Extracting updater binary 'META-INF/com/google/android/update-binary'
I:Zip does not contain SELinux file_contexts file in its root.
I:Legacy property environment not used in updater.
SELinux: Loaded file_contexts
__bionic_open_tzdata: couldn't find any tzdata when looking for CST6CDT,M3.2.0,M11.1.0!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
Target: OnePlus/OnePlus3/OnePlus3:9/PKQ1.181203.001/1905251415:user/release-keysTarget: OnePlus/OnePlus3/OnePlus3:9/PKQ1.181203.001/1905251415:user/release-keys
Extracted file "/tmp/install/bin/backuptool.sh"
Extracted file "/tmp/install/bin/backuptool.functions"
Extracted 2 file(s)
detected filesystem ext4 for /dev/block/bootdevice/by-name/systemdetected filesystem ext4 for /dev/block/bootdevice/by-name/system
about to run program [/tmp/install/bin/backuptool.sh] with 3 args
run_program: child exited with status 127
Patching system image unconditionally...
performing update
Patching system image unconditionally...blockimg version is 4
maximum stash entries 0
creating stash /cache/recovery/2bdde8504898ccfcd2c59f20bb8c9c25f73bb524/
234885120 bytes free on /cache (0 needed)
/cache/recovery/last_command doesn't exist.
erasing 333337 blocks
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
writing 1024 blocks of new data
Decompression failed with TRANSFORM
missing 3648635 bytes of new data
failed to execute command [new 2,72343,73367]
script aborted: E1001: Failed to update system image.
E1001: Failed to update system image.error: 1001
Updater process ended with ERROR: 7
I:Install took 8 second(s).
Error installing zip file '/sdcard/e-0.7-p-20190710-UNOFFICIAL-oneplus3.zip'
Master_TC said:
Save all your data and go this way:
1. install latest TWRP (3.3.1.0) and firmware 9.0.4
2. in TWRP delete all partitions (Dalvik, Cache, System, Data,...)
3. reboot into TWRP
4. format Data in Wipe - Format Data - type "yes"
5. reboot into TWRP
6. connect your phone with your computer and copy the custom rom into your phone
7. install your rom and if needed gapps + magisk
8. enjoy your rom
Click to expand...
Click to collapse
I'll tried this, but didnt work for me, still got the same Error
EvilChickens said:
I'll tried this, but didnt work for me, still got the same Error
Click to expand...
Click to collapse
OK, can you install successfull any other custom rom?
Master_TC said:
OK, can you install successfull any other custom rom?
Click to expand...
Click to collapse
I'll tried different versions of LineageOS and /e/ and all didnt work
EvilChickens said:
I'll tried different versions of LineageOS and /e/ and all didnt work
Click to expand...
Click to collapse
That's strange. You have the right firmware and TWRP installed on your phone? Which versions do you use and where have you downloaded them?
OP 3 or 3T?
Master_TC said:
That's strange. You have the right firmware and TWRP installed on your phone? Which versions do you use and where have you downloaded them?
OP 3 or 3T?
Click to expand...
Click to collapse
I'll use TWRP 3.3.1-0 :
https://eu.dl.twrp.me/oneplus3/
and firmware 9.0.4:
https://androidfilehost.com/?fid=6006931924117907812
EvilChickens said:
I'll use TWRP 3.3.1-0 :
https://eu.dl.twrp.me/oneplus3/
and firmware 9.0.4:
https://androidfilehost.com/?fid=6006931924117907812
Click to expand...
Click to collapse
You have a OP 3T, so the files are right..
I have a 3T too withe the same files and i can install successfull all roms....
Please install the firmware again - reboot into twrp - install the rom below (dirty unicorns)
https://download.dirtyunicorns.com/.../du_oneplus3-v13.4-20190707-1336-OFFICIAL.zip
Don't forget to wipe all partitons and format the data partition!
Do you get the failer?
Master_TC said:
You have a OP 3T ?
Click to expand...
Click to collapse
Yes
EvilChickens said:
Yes
Click to expand...
Click to collapse
You have a OP 3T, so the files are right..
I have a 3T too withe the same files and i can install successfull all roms....
Please install the firmware again - reboot into twrp - install the rom below (dirty unicorns)
https://download.dirtyunicorns.com/.../du_oneplus3-v13.4-20190707-1336-OFFICIAL.zip
Don't forget to wipe all partitons and format the data partition!
Do you get the same failer?
Master_TC said:
You have a OP 3T, so the files are right..
I have a 3T too withe the same files and i can install successfull all roms....
Please install the firmware again - reboot into twrp - install the rom below (dirty unicorns)
https://download.dirtyunicorns.com/.../du_oneplus3-v13.4-20190707-1336-OFFICIAL.zip
Don't forget to wipe all partitons and format the data partition!
Do you get the same failer?
Click to expand...
Click to collapse
Yes I still got the same error
Hi,
coud you try this recovery version? https://androidfilehost.com/?fid=1395089523397907195
With last version of TWRP (3.3.1?) I was unable to flash files in /system partition, with this version I resolved.
syntesys said:
Hi,
coud you try this recovery version? https://androidfilehost.com/?fid=1395089523397907195
With last version of TWRP (3.3.1?) I was unable to flash files in /system partition, with this version I resolved.
Click to expand...
Click to collapse
Sadly still got the same Error, Error 7.
Use code tags or upload the file. Your posting of the twrp log is a mess.
EvilChickens said:
Code:
[...]
Decompression failed with TRANSFORM
missing 3648635 bytes of new data
failed to execute command [new 2,72343,73367]
script aborted: E1001: Failed to update system image.
E1001: Failed to update system image.error: 1001
Updater process ended with ERROR: 7
[...]
Click to expand...
Click to collapse
As you can see the decompression of some content of the flashable zip is failing. This means your zip file is broken. Check the checksum of the flashable zip after transfering it to the device.
I think this could happen sometimes, but I tried a lot of installings. Also i tried installing the zip directly. Overall I tried installing the zip around 65 Times.
But in the next install I will check the checksume on the device, but for now i am unable to test it. But why then I can install the Stock OS with Stock Recovery without any Problems? (But this takes a long time like 2 Hours)
Thank you very much for your advice, i didnt thought about that
EvilChickens said:
I think this could happen sometimes, but I tried a lot of installings. Also i tried installing the zip directly. Overall I tried installing the zip around 65 Times.
But in the next install I will check the checksume on the device, but for now i am unable to test it. But why then I can install the Stock OS with Stock Recovery without any Problems? (But this takes a long time like 2 Hours)
Thank you very much for your advice, i didnt thought about that
Click to expand...
Click to collapse
The log's lines I've quoted are biunique: there's data in the zip missing or broken. I don't know why it's missing or broken, but as a matter of fact it IS actually broken. Possible reasons are wide spread through the complete chain of transmission from the machine the rom wss build on to the final installation device. That's why one should always check the integrety of a flashable zip on the target device prior to flashing - twrp can do this automatically for you (at least for md5sum - never tried with los sha256sum).
EvilChickens said:
But why then I can install the Stock OS with Stock Recovery without any Problems? (But this takes a long time like 2 Hours)
Click to expand...
Click to collapse
2 hours? If i install the latest OS 9.04 on my 3T it takes 15-20 Minutes. Do you have a SDcard in your phone, which is casing the problems? If yes, then put it out...
No, i went over ADB

Unpacking contents in fastboot.img - possible?

I've downloaded a few different firmwares for VOG-L29 and used HuaweiUpdateExtractor to unpack images from the udpate.app files. I wanted to see if I can look at the content of fastboot.img, but it seems like this is packed and/or encrypted, so just wondering if anyone has taken a look into this before and have some suggestions? Since the file has quite high entropy I'm positive it's either packed in some way or worst case encrypted.
Code:
--/dload_VOG-L29.153/extracted$ file FASTBOOT.img
FASTBOOT.img: data
../dload_VOG-L29.153/extracted$ binwalk FASTBOOT.img -E
DECIMAL HEXADECIMAL ENTROPY
--------------------------------------------------------------------------------
2048 0x800 Falling entropy edge (0.084814)
4096 0x1000 Rising entropy edge (0.988633)
militiaOfDeath said:
I've downloaded a few different firmwares for VOG-L29 and used HuaweiUpdateExtractor to unpack images from the udpate.app files. I wanted to see if I can look at the content of fastboot.img, but it seems like this is packed and/or encrypted, so just wondering if anyone has taken a look into this before and have some suggestions? Since the file has quite high entropy I'm positive it's either packed in some way or worst case encrypted.
Code:
--/dload_VOG-L29.153/extracted$ file FASTBOOT.img
FASTBOOT.img: data
../dload_VOG-L29.153/extracted$ binwalk FASTBOOT.img -E
DECIMAL HEXADECIMAL ENTROPY
--------------------------------------------------------------------------------
2048 0x800 Falling entropy edge (0.084814)
4096 0x1000 Rising entropy edge (0.988633)
Click to expand...
Click to collapse
Did you try to mount it in Linux?
tibcsi0407 said:
Did you try to mount it in Linux?
Click to expand...
Click to collapse
No, but as far as I can see there is no signature data in the file that suggests that it can be mounted. As mentioned it seems to be mostly random data, so either it's some sort of archive or scrambled/encrypted/etc.
I've uploaded the file to mega: https://mega.nz/#!4VwRhCSA!mJ55LuxzdIOQMOXTFVEuLZ5E9LVGgYy4aZl7gjohNe0

Categories

Resources