Hi all,
I am trying to get an insecure kernel for Nexus 6, marshmallow 6.0, and I stuck at a bootloop.
The AOSP tag android-6.0.0_r1 builds without any errors. Then I flash the produced insecure boot image on a nexus 6, which had the latest 6.0 factory images.
Has anyone managed to do this procedure?
Btw, I am compiling the AOSP sources, and not the kernel sources.
In AOSP, I think, the kernel/zImage is precompiled, and the aosp build system bundles it into a boot image.
So, if someone has managed to build a working insecure boot.img from any marshmallow branch please let me know.
Or has done the same thing from kernels sources, also let me know.
EDIT:
How to compile an insecure kernel:
0. This will use the precompiled kernel found in aosp sources.
So we are not actually compiling. But this title might help some folks googling the topic.
2. modify device/<maker>/<codename>/fstab.<codename>/, and remove verify tag from system
3. make -jN bootimage
Alternatively, you can follow the procedure by ziddey, and removing the verify tag from fstab.shamu, allows the kernel to be booted!
NOTE: insecure kernel is not permissive.
How to compile a permissive kernel:
0. Now we will actually compile the kernel.
1. Download the kernel sources, and checkout the branch you want. Do these modifications.
Finally compile the kernel. (There are many tutorials for kernel compilation online)
2. copy the kernel (arch/arm/boot/zImage-dtb) to your aosp_dir/device/<maker>/<codename>-kernel/
3. Disable verification (as w/ insecure kernel)
4. make -j8 bootimage
How to compile an insecure and permissive kernel:
Not sure about this. I 'd play with configurations in aosp_dir/device/<maker>/<codename>,
or maybe try an eng build. If anyone knows just post it!
I have tried these with the kernel branch "android-msm-shamu-3.10-marshmallow-mr1",
and the aosp tag "android-6.0.1_r21".
I have also tried to unpack and repack the boot.img using unpackbootimg and mkbootimg from https://github.com/osm0sis/mkbootimg.
I have extracted ramdisk, edited the default prob, repacked ramdisk, and packed using:
Code:
mkbootimg --kernel su_boot.img-zImage --ramdisk su_boot.img-ramdisk.gz --cmdline 'console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=shamu msm_rtb.filter=0x37 ehci-hcd.park=3 utags.blkdev=/dev/block/platform/msm_sdcc.1/by-name/utags utags.backup=/dev/block/platform/msm_sdcc.1/by-name/utagsBackup coherent_pool=8M' --base 00000000 --pagesize 2048 --kernel_offset 00008000 --ramdisk_offset 02000000 --tags_offset 01e00000 --board "" -o ins_su_boot.img
Have I missed anything?
*EDIT* also tried w/ 'abootimg'. Still no luck.
Screwing around with random files found on the internet is not going to solve your problem. Use the program from *AOSP*. And make sure your parameters match (I'm not going to verify them for you). Bootloops are always cute, what did you change? Typically running make bootimg should make you a good bootimg from AOSP sources.
Well, turns out that in this case, that assumption is not correct.
The first issue is that the verity keys are not present in a custom built boot.img. At least not ones without also involving an entire system build (not that they would match the system partition that you already have).
So to solve that, edit the fstab file in the shamu device tree to remove the verify parameter from the system partition. Once that is done, it should no longer randomly reboot.
UNFORTUNATELY, that may not be enough to make the whole thing work properly still, since there appears to be some other differences between the AOSP userdebug's boot.img and the google user build. You will be able to adb in, but the android subsystem won't run.
These utilities I have used were the ones that have been successfully used to pack/unpack boot images by others. I have also done this successfully in the past, for another device running earlier versions.
Yeap. That's the problem. A kernel build from AOSP sources does not work out of the box with the rest of the system, if it is a production build. This used to work for Lollipop, but I guess they tighten security up.
Building zImage from kernel sources is still not a solution for me, as I can't properly pack/unpack a Marshmallow boot.img
The problem might be something very stupid, OS specific, and I don't want to waste any more time on this.
For now I will live with SuperSu and adbd insecure.
Maybe at some point I might try to remove the verification to see whether the rest of the stuff play nicely.
Thanks for your time!
[edit]
Answer is root. http://forum.xda-developers.com/showpost.php?p=64110288&postcount=1283
[/edit]
I spent a while tonight trying to figure this out as well. Simply dumping boot.img and recreating it works fine. But something goes wrong when unpacking/repacking the ramdisk. Stripping bootsize from bootimg.cfg so abootimg recalculates it doesn't help.
1. I did find that mkboot "works": https://github.com/ModdingMyMind/mkbootimg_tools
Simply run `mkboot boot.img boot` to dump to dir boot. Make changes to ramdisk, and then run `mkboot boot newboot.img` to create a new image. However, for whatever reason, this causes at least one issue for me. The sbin dir, despite being 755 in the ramdisk is 750 again in Android. Not sure what's going on here since I can redump newboot.img and confirm that sbin is 755.
2. I looked at seSuperuser/super-bootimg and found https://github.com/seSuperuser/super-bootimg/blob/master/scripts/bootimg.sh
The relevant part is in doneBootImgEdit(). Looking at the comments, Husson found that appending the changes to the inflated ramdisk cpio and then deflating it works. I just tested this and indeed it does work.
Husson only appends new/changed files; as a test, I tried appending the entire new ramdisk onto the old one, and sure enough, it bugs out again. Will have to investigate why this happening later, but for now, this is good enough.
As well, abootimg also comes with the tools abootimg-pack-initrd and aboot-unpack-initrd, which takes care of gzip/cpio. Of course, since the packing part doesn't work, we can't use it.
So, here's an example. Say you want to change fstab.shamu (to remove /system verification and/or /data forced encryption):
Code:
# extract boot.img
abootimg -x boot.img
# unpack the extracted initrd.img to ramdisk dir
abootimg-unpack-initrd
cd ramdisk
# make your changes to ramdisk/fstab.shamu here....
echo fstab.shamu | cpio -o -H newc > ../initrd2
cd ..
# inflate initrd.img
cp initrd.img initrd.gz
gunzip initrd.gz
# append and create new initrd.img
cat initrd initrd2 |gzip -9 -c > newinitrd.img
# strip bootsize from bootimg.cfg
sed 1d bootimg.cfg > newbootimg.cfg
# create new boot.img
abootimg --create newboot.img -f newbootimg.cfg -k zImage -r newinitrd.img
newboot.img should be a working boot image. If modifying multiple files, it may be easiest to create a different dir with those files and use find . |cpio -o -H newc > ../initrd2
Hope this helps. And if anyone can explain why this is necessary / how to recreate initrd from scratch, I can continue being lazy.
Thanks @phhusson
[edit]
Damn. I tried applying a different init file and it ate ****.
[/edit]
ziddey said:
I spent a while tonight trying to figure this out as well. Simply dumping boot.img and recreating it works fine. But something goes wrong when unpacking/repacking the ramdisk. Stripping bootsize from bootimg.cfg so abootimg recalculates it doesn't help.
1. I did find that mkboot "works": https://github.com/ModdingMyMind/mkbootimg_tools
Simply run `mkboot boot.img boot` to dump to dir boot. Make changes to ramdisk, and then run `mkboot boot newboot.img` to create a new image. However, for whatever reason, this causes at least one issue for me. The sbin dir, despite being 755 in the ramdisk is 750 again in Android. Not sure what's going on here since I can redump newboot.img and confirm that sbin is 755.
2. I looked at seSuperuser/super-bootimg and found https://github.com/seSuperuser/super-bootimg/blob/master/scripts/bootimg.sh
The relevant part is in doneBootImgEdit(). Looking at the comments, Husson found that appending the changes to the inflated ramdisk cpio and then deflating it works. I just tested this and indeed it does work.
Husson only appends new/changed files; as a test, I tried appending the entire new ramdisk onto the old one, and sure enough, it bugs out again. Will have to investigate why this happening later, but for now, this is good enough.
As well, abootimg also comes with the tools abootimg-pack-initrd and aboot-unpack-initrd, which takes care of gzip/cpio. Of course, since the packing part doesn't work, we can't use it.
So, here's an example. Say you want to change fstab.shamu (to remove /system verification and/or /data forced encryption):
Code:
# extract boot.img
abootimg -x boot.img
# unpack the extracted initrd.img to ramdisk dir
abootimg-unpack-initrd
cd ramdisk
# make your changes to ramdisk/fstab.shamu here....
echo fstab.shamu | cpio -o -H newc > ../initrd2
cd ..
# inflate initrd.img
cp initrd.img initrd.gz
gunzip initrd.gz
# append and create new initrd.img
cat initrd initrd2 |gzip -9 -c > newinitrd.img
# strip bootsize from bootimg.cfg
sed 1d bootimg.cfg > newbootimg.cfg
# create new boot.img
abootimg --create newboot.img -f newbootimg.cfg -k zImage -r newinitrd.img
newboot.img should be a working boot image. If modifying multiple files, it may be easiest to create a different dir with those files and use find . |cpio -o -H newc > ../initrd2
Hope this helps. And if anyone can explain why this is necessary / how to recreate initrd from scratch, I can continue being lazy.
Thanks @phhusson
[edit]
Damn. I tried applying a different init file and it ate ****.
[/edit]
Click to expand...
Click to collapse
My guess, and the reason why I tried appending without further thinking, is that the new initramfs files contains SELinux labels, which standard GNU/Linux cpio tool doesn't support.
One would have to investigate the changes in mkbootfs done recently.
Also, I guess mkboot is using Android's mkbootfs, which forces the permissions by itself I think.
Though the fact that extracting back give the result you expected is weird.
In super-bootimg I chose to change init.rc to chmod /sbin
Wow. http://forum.xda-developers.com/showpost.php?p=64110288&postcount=1283
Just tested and sure enough, everything is working.
Thanks @shoey63
Hopefully a final update:
The difference is in ownership. Unpacking (cpio -i) as a regular user will not preserve the ownership. However, repacking (cpio -o) does.
To repack, add -R 0.0 to cpio (i.e. --owner root.root).
e.g.
Code:
find . |cpio -o -H newc -R 0.0 | gzip -9 > ../newinitrd.img
I just tested and this works just fine without being root.
ziddey said:
Hopefully a final update:
The difference is in ownership. Unpacking (cpio -i) as a regular user will not preserve the ownership. However, repacking (cpio -o) does.
To repack, add -R 0.0 to cpio (i.e. --owner root.root).
e.g.
Code:
find . |cpio -o -H newc -R 0.0 | gzip -9 > ../newinitrd.img
I just tested and this works just fine without being root.
Click to expand...
Click to collapse
Erf that's weird, I'm pretty sure I always ran the script as root...
Anyway, thanks for the info! I'll probably update my scripts with it
I just wanted to post that using root to extract the cpio file fixed the boot failure for me on my Nexus 9 with 6.0.1. You also need to use root to find the files and create the cpio file because some files are only accessible by root of course. I guess that should have been obvious (usually needed for /dev nodes) as @phhusson said, but this time I didn't do that until reading here.
To unpack the boot.img file I used: https://github.com/osm0sis/mkbootimg.git
To pack the boot.img file I used: https://android.googlesource.com/platform/system/core/+/master/mkbootimg
I'm not sure you need the official google packer, but I just happened to use when it worked.
EDIT: I needed to update boot.img and I tried it using the osm0sis packer and it worked.
Hey guys. Thanks for the replies!
I needed a permissive kernel this time, and I have played around with the sources and your recommendations and got it working. :good:
The post by ziddey might be the easiest way to make any kernel bootable, by disabling the verification from fstab.
(and uses just one packing/unpacking tool)
You can do the same thing from sources, again by modifying the fstab on aosp.
You can build an insecure kernel by using the pre-built kernel (is aosp),
or compile and then pack a permissive one.
This procedure wasn't working for me back then when I tried it (hence this thread). I am not sure if it was my fault or the initial marshmallow release had differences from the sources. More info on the first post.
Related
Being a linux noob, i am trying to repack a boot image i have created for my Sapphire. I extracted Cyanogen's boot.img, extracted that and added a couple of things in, deleted a couple of things and now i want to repack it and am unable to. I am following the instructions from:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images
i have downloaded the mkbootimg.zip froma thread here but am unsure what to do with it- i have extracted it to the working directory but when i type
Code:
[email protected]:~/Desktop/boot$ mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img
i get the error:
Code:
bash: mkbootimg: command not found
i have the kernel and ramdisk-new.gz in the working folder (boot) along with mkbootimg.
What am i doing wrong? I am sure it's a nice simple thing about what i have to do with the mkbootimg program...
thanks
Scott
Put ./mkbootimg etc etc
This is a linux related question. And could have been posted in DREAM Q&A. I know you wanted an answer but help keep the forum clean.
sorry but i thought this was related to android development- i am trying to develop a bit of android for myself.
anyway tried the
Code:
./mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img
and got
Code:
bash: ./mkbootimg: Permission denied
so i tried it with sudo infront of it all and got:
Code:
sudo: ./mkbootimg: command not found
I guess there's some gray area. Your trying to develop and are having a problem along the way.. lol
Maybe my syntax is off, still learning linux myself. Try a space between . And / eg: ". /mkbootimg". What distro are you using. (I don't need super user permissions to execute it on my ubuntu box). The only thing I run as su is make when using jf build environment.
You could also put it in a tools folder and include it in path. Or just drop it in bin.
Custom Boot Image
MontAlbert said:
sorry but i thought this was related to android development- i am trying to develop a bit of android for myself.
anyway tried the
Code:
./mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img
and got
Code:
bash: ./mkbootimg: Permission denied
so i tried it with sudo infront of it all and got:
Code:
sudo: ./mkbootimg: command not found
Click to expand...
Click to collapse
did you post your question here?
http://forum.xda-developers.com/showthread.php?t=443994
LucidREM said:
did you post your question here?
http://forum.xda-developers.com/showthread.php?t=443994
Click to expand...
Click to collapse
no i thought that thread hasnt seen action in ages. Bit late now either way hey?
just tried a different tact...
Code:
./repack-bootimg.pl boot.img-kernel /home/scott/Desktop/boot/new boot-new.zip
4293 blocks
sh: mkbootimg: not found
damnit!
maybe i will try and drop everything in bin and try it from there....
mkbootimg is not in your path, that is why you are getting the error when doing sudo. Do the following
1) cp ~/mydroid/out/host/linux-x86/bin/mkbootimg ~/android-sdk-linux_x86-1.5_r2/tools
2) export PATH=$PATH:~/android-sdk-linux_x86-1.5_r2/tools
3) chmod 755 ~/android-sdk-linux_x86-1.5_r2/tools/mkbootimg
Now you can run your command WITHOUT using sudo. There's no reason to put mkbootimg in /usr/local/bin or /bin as it doesn't have anything to do with your system. It is a development binary and should be contained with the rest of your dev binaries. If you want to make that path permanent put step #2 in your ~/.profile or ~/.bash_profile depending which one your system uses
**EDIT**
If you get any errors of file not found well then that's b/c I have no idea how your system is structured so I can't guess where your original mkbootimg is located or where its going. You need to change the directory paths that I used above to match your own. Also, you won't need to do ./mkbootimg as that only works if that binary is in the exact same directory that you're in
thanks- will try that now....
When I repack boot.img's I just cp mkbootimg to my working directory and invoke it using ". /mkbootimg command" works without issue for me. Eventually ill setup my tools directory to be included in path as its more practical.
Hi all,
Here is my concern I have de-compiled without a problem then I modified the boot.img images cwm but impossible to re-compile.
I get an error every time. I'm running Ubuntu.
If someone could help me it would be nice.
Thank you in advance.
MontAlbert said:
sorry but i thought this was related to android development- i am trying to develop a bit of android for myself.
anyway tried the
Code:
./mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img
and got
Code:
bash: ./mkbootimg: Permission denied
so i tried it with sudo infront of it all and got:
Code:
sudo: ./mkbootimg: command not found
Click to expand...
Click to collapse
This is old, but if someone else has a similar issue this might help.
The 'command not found' thing when the executable is in fact there and has the right permissions can happen when the 32bit binaries aren't installed on the system. They are part of the ia32-libs package, which you can install with
Code:
sudo apt-get install ia32-libs
want to edit your boot.img?
included files in zip: mkbootimg (i compiled this file from android source), unpack-bootimg.pl, repack-bootimg.pl
i edited the repack script to compile the nexus s img correctly.
Code:
--base 0x30000000 --pagesize 4096
first dump original boot.img:
Code:
cat /dev/mtd/mtd2 > /sdcard/boot.img
then drag/drop to your linux box to edit file.
use unpack script:
Code:
./unpack-bootimg.pl boot.img
you will end up with 2 compressed files and 1 folder.
finished editing and want to repack boot.img, for example:
Code:
./repack-bootimg.pl <kernel> <ramdisk-directory> <outfile>
most info and scripts pulled from here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images, thanks to the original author.
test your new boot.img:
Code:
fastboot boot boot.img
Two things:
1. if you have any bad blocks in your boot partition, this method will fail to extract the boot.img (you need to skip bad blocks, but cat will just get an error)
2. you can replace just the kernel (leaving the ramdisk and parameters intact) using:
Code:
% fastboot flash zimage zImage
The bootloader will read-modify-write the boot partition, replacing the kernel only.
how would you skip bad blocks? i never thought of a phone as having bad blocks.
k0mpresd said:
i never thought of a phone as having bad blocks.
Click to expand...
Click to collapse
All flash devices can have bad blocks. But it usually isn't something the end user would notice, unless there are so many and something is wrong that you're losing drive space.
edit: more info here if your curious http://en.wikipedia.org/wiki/Flash_memory
hmm, very strange thing happening to me. I've only gotten my boot.img to compile and boot successfully once with this method, but now I can't seem to get it to compile? I keep getting errors of the file name or file type. I'm using the correct usage.. If I compile manually with mkbootimg on the cmd line it'll compile but it won't boot. Just bootloops at the Google splash..
Jroid try my Matr1x kernel and see what happens
Sent from my Nexus S using XDA App
The problem seems to be compiling the boot with the perl scripts, not the kernel itself.
Try manually:
Once unpacked do the boot.img-ramdisk.cpio.gz with the following command (moved to the ramdisk folder):
Code:
#sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
Then cd ../
And repack:
Code:
#./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
you can replace just the kernel (leaving the ramdisk and parameters intact) using:
Code:
% fastboot flash zimage zImage
The bootloader will read-modify-write the boot partition, replacing the kernel only.
Click to expand...
Click to collapse
It won't work on the Nexus S.
python08 said:
It won't work on the Nexus S.
Click to expand...
Click to collapse
exactly, i'd love to be able to do this for some testing but it doesn't allow me.
EDIT: yes it does. Swetland is right
Chamb' said:
Try manually:
Once unpacked do the boot.img-ramdisk.cpio.gz with the following command (moved to the ramdisk folder):
Code:
#sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
Then cd ../
And repack:
Code:
#./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
Click to expand...
Click to collapse
I've tied compiling a boot both manually (with cmdline) and with the perl scripts and have used a simple kernel.gz and ramdisk.cpio.gz for my file names.. doesn't really matter what I name it as long as it has the correct file format in this .gz and .cpio.gz right? the manual compile goes fine with base 0x30000000 and pagesize 4096
however, it does not boot and will bootloop at the Google splash
Used boot.img extracted from (what ROM ?) cat /dev/mtd/mtd2 ?
Is the phone start with this boot.img (unchanged) if you flash it by typing "fastboot flash..." ?
After that, just try to unpack and repack the boot.img without changes on ramdisk or kernel, if it works that means your changes suck (^^).
These commands (or perl scripts) work perfectly for me.
Lol I will try doing that. The boot.img I used is from stock 2.3.4, edited the ramdisk (specifically init.rc & init.herring.rc)
Like I said, first time I used the perl scripts I edited my ramdisk, threw in a netarchy kernel, it compiled fine and booted. Now if I use the perl script to repack with an aosp kernel, it gives me an error about file name and/or extension being wrong. Or complains it can't find mkbootimg when its there and executable. I'll re run it again and post errors
Sent from my Nexus S
he guys where is the boot image located? not the animation, the google logo at the start of the booting!
Sent from my Nexus S using XDA Premium App
ok so when I used the repack-bootimg.pl script, it kept giving me this error:
Code:
boot.img-kernel.gz Not a directory at ./repack-bootimg.pl line 13.
So I ran mkbootimg manually, without a cmdline comment as stated above. It compiled
and booted beautifully all stock with no init.rc or init.herring.rc edits.
however when I compile a boot.img coupled with a stock kernel and a modified ramdisk, I get a non-booting boot.img. One came out at 2.9 mb and the other at 5.6 mb neither boots using the same cmd that compiled the working boot. Must be my edits.. I literally only changed about 1 line in init.rc and another line in init.herring.rc that causing it not to boot.
By the way, I got some info on a stock boot.img using the unpackbootimg binary (not the perl script) and here's what it outputs:
Code:
#BOARD_KERNEL_CMDLINE console=ttyFIQ0 no_console_suspend
BOARD_KERNEL_BASE 30000000
BOARD_PAGE_SIZE 00001000
I enter that pagesize and it says it's not a valid value when I compile boot.img's
Borky_16 said:
he guys where is the boot image located? not the animation, the google logo at the start of the booting!
Sent from my Nexus S using XDA Premium App
Click to expand...
Click to collapse
part of the kernel
to change-https://github.com/morfic/Samsung-logo
ogdobber said:
part of the kernel
to change-https://github.com/morfic/Samsung-logo
Click to expand...
Click to collapse
yeah i know thanks for the link a helping source though!
Sent from my Nexus S using XDA Premium App
Sorry for the Control C Control V of it, but I just found this topic now..
I`m facing this problem when I try to unpack boot.img..
I have done it 2 days ago but dunno why, now I can`t..
Follows what is happening..
Code:
[email protected]:~/NS-bootwork$ ./unpack-bootimg.pl boot.img
Found a secondary file after the ramdisk image.
According to the spec (mkbootimg.h) this file can exist,
but this script is not designed to deal with this scenario.
The Kernel is built, as a zImage and the WLAN as a bmc3429.ko..
Just repeating, I have built this Kernel 2 days ago in the same way, without any problems, but now I`m struggling on the message after inputting ./unpack-bootimg.pl boot.img..
Dunno what else to try, I re-downloaded the unpack-bootimg.pl from 2 different sources, and still the same error..
Any ideas?
Many thanks..
P.S.: Ubuntu 11.04 x64..
EDIT
Well, I already solve it!
That is what I did..
As unpack-bootimg.pl was not working (don`t know why) I used split_bootimg.pl script, splitting the boot.img and created new ramdisk img..
Code:
./split_bootimg.pl boot.img
mkdir ramdisk
cd ramdisk
gzip -dc ../boot.img-ramdisk.gz | cpio -i
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
Then after just compiled the Kernel with
Code:
./mkbootimg --kernel zImage --ramdisk newramdisk.cpio.gz --base 0x30000000 --pagesize 4096 --cmdline _console_suspend=1 console=bull's -o newtestboot.img'no
Witches includes " --cmdline _console_suspend=1 console=bull's" to not break BT functionality, in the case of Nexus S..
I found the tools here work well: http://glandium.org/blog/?p=2214
...if you then use the code originally posted above:
Code:
sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
Hi,
There seems to me to be the general idea that swapping kernels is just flashing a different boot.img, however, what seems to never be mentioned is that each boot.img has a unique ram disk or included set of files/folder structure. This ram disk was designed to work with a specific version of android and within that, a specific build of that version. The init.rc file could be totally different, there could be a different init compiled in, ro.secure could be 0 in default.prop, and so on.
When looking through some of the scripts out there, it is always flash boot.img, not extract the ramdisk and rebuilt boot.img first. This introduces a tad bit of randomness to the whole kernel swapping scenario.
This is an pseudo example of what I would do, if I had to swap kernels manually on the phone. I have attached the referenced phone compatible binaries. (I would normally do it from within linux on a PC)
With CWM running on your phone, start adb.
$ adb shell
# ~ cd /tmp
# /tmp dump_image /dev/block/mmcblk0p11 boot.img
# /tmp unpack boot.img
# /tmp ls
boot.img boot.img-zImage boot.img-ramdisk
# /tmp cp /sdcard/mynewkernel-zImage .
# /tmp ls
boot.img boot.img-zImage boot.img-ramdisk mynewkernel-zImage
# /tmp cat /proc/cmdline >cmdline.txt
# /tmp cat ./cmdline.txt
[email protected] [email protected] vmalloc=320M video=tegrafb console=null usbcore.old_scheme_first=1 tegraboot=sdmmc tegrapart=mbr:1100:100:800,kpanic:2500:400:800 security=tomoyo mot_prod=1 androidboot.serialno=TA2xxxxxxx
# /tmp busybox vi cmdline.txt
# /tmp cat ./cmdline.txt
[email protected] [email protected] [email protected] vmalloc=320M video=tegrafb console=null usbcore.old_scheme_first=1 tegraboot=sdmmc tegrapart=mbr:1100:100:800,kpanic:2500:400:800 security=tomoyo mot_prod=1 androidboot.serialno=TA2xxxxxxx
# /tmp mkbootimg --cmdline cmdline.txt --kernel mynewkernel-zImage --ramdisk boot.img-ramdisk.gz -o boot.img
# /tmp flash_image /dev/block/mmcblk0p11 boot.img
the bits in green if you wanted to fix the missing [email protected] in your cmdline if applicable.
Replace the general sequence in your CWM install scripts when all you want is to swap the kernel, not potentially change the boot sequence/flags as well.
Cheers!
hi
thanks for tutorial
but regarding this command :
Code:
/tmp cp /sdcard/mynewkernel-zImage
what is mynewkernel-zImage ?
Hazem62 said:
hi
thanks for tutorial
but regarding this command :
Code:
/tmp cp /sdcard/mynewkernel-zImage
what is mynewkernel-zImage ?
Click to expand...
Click to collapse
That would be whatever kernel image you wanted to replace your existing kernel with. As the ones around are in zip files with prepackaged boot.img files you would have to unzip and extract to get just the kernel part. Also, you would need any dependent libs copied over to /system/lib/[modules].
This is nothing really new, just not being done with the Atrix thus far.
Cheers!
How do I get boot.img-ramdisk from this step
NFHimself said:
# /tmp ls
boot.img boot.img-zImage boot.img-ramdisk
Click to expand...
Click to collapse
into boot.img-ramdisk.gz for mkbootimg? do I use the regular gzip?
NFHimself said:
# /tmp mkbootimg --cmdline cmdline.txt --kernel mynewkernel-zImage --ramdisk boot.img-ramdisk.gz -o boot.img
Click to expand...
Click to collapse
If I wanted to edit and change the partition table, could I use the same method to pull and edit the partition file since it also exists in the same directory as cmdline?
toyota86 said:
do I use the regular gzip?
Click to expand...
Click to collapse
Yes.
(deleted)
NFHimself said:
Hi,
There seems to me to be the general idea that swapping kernels is just flashing a different boot.img, however, what seems to never be mentioned is that each boot.img has a unique ram disk or included set of files/folder structure. This ram disk was designed to work with a specific version of android and within that, a specific build of that version. The init.rc file could be totally different, there could be a different init compiled in, ro.secure could be 0 in default.prop, and so on.
When looking through some of the scripts out there, it is always flash boot.img, not extract the ramdisk and rebuilt boot.img first. This introduces a tad bit of randomness to the whole kernel swapping scenario.
This is an pseudo example of what I would do, if I had to swap kernels manually on the phone. I have attached the referenced phone compatible binaries. (I would normally do it from within linux on a PC)
With CWM running on your phone, start adb.
$ adb shell
# ~ cd /tmp
# /tmp dump_image /dev/block/mmcblk0p11 boot.img
# /tmp unpack boot.img
# /tmp ls
boot.img boot.img-zImage boot.img-ramdisk
# /tmp cp /sdcard/mynewkernel-zImage .
# /tmp ls
boot.img boot.img-zImage boot.img-ramdisk mynewkernel-zImage
# /tmp cat /proc/cmdline >cmdline.txt
# /tmp cat ./cmdline.txt
[email protected] [email protected] vmalloc=320M video=tegrafb console=null usbcore.old_scheme_first=1 tegraboot=sdmmc tegrapart=mbr:1100:100:800,kpanic:2500:400:800 security=tomoyo mot_prod=1 androidboot.serialno=TA2xxxxxxx
# /tmp busybox vi cmdline.txt
# /tmp cat ./cmdline.txt
[email protected] [email protected] [email protected] vmalloc=320M video=tegrafb console=null usbcore.old_scheme_first=1 tegraboot=sdmmc tegrapart=mbr:1100:100:800,kpanic:2500:400:800 security=tomoyo mot_prod=1 androidboot.serialno=TA2xxxxxxx
# /tmp mkbootimg --cmdline cmdline.txt --kernel mynewkernel-zImage --ramdisk boot.img-ramdisk.gz -o boot.img
# /tmp flash_image /dev/block/mmcblk0p11 boot.img
the bits in green if you wanted to fix the missing [email protected] in your cmdline if applicable.
Replace the general sequence in your CWM install scripts when all you want is to swap the kernel, not potentially change the boot sequence/flags as well.
Cheers!
Click to expand...
Click to collapse
can any1 tell me how to extract boot.img-zimage for adding more drivers
Ni5hant said:
can any1 tell me how to extract boot.img-zimage for adding more drivers
Click to expand...
Click to collapse
Basically, you can't.
New drivers are either built into the kernel when it is compiled. Or built as kernel modules using the same kernel source and same compiler as the main kernel. In both cases, you need to know all about compiling a kernel.
runekock said:
Basically, you can't.
New drivers are either built into the kernel when it is compiled. Or built as kernel modules using the same kernel source and same compiler as the main kernel. In both cases, you need to know all about compiling a kernel.
Click to expand...
Click to collapse
anyway ..i have an ARM kali 2.0 on my galaxy j7.. and i want to connect my TP-Link Tw722n wifi adapter to it....
"Dmesg | grep usb" shows the usb...bt i cant anything else with it..........any help would be appreciated
Ni5hant said:
anyway ..i have an ARM kali 2.0 on my galaxy j7.. and i want to connect my TP-Link Tw722n wifi adapter to it....
"Dmesg | grep usb" shows the usb...bt i cant anything else with it..........any help would be appreciated
Click to expand...
Click to collapse
If you are running Kali Linux on a Galaxy J7, then you are in entirely the wrong thread. This is about Android on Motorola Atrix. Try asking in a Kali Linux thread. Though I suspect the answer will be more or less the same -- that you need to learn how to compile a kernel to do anything.
runekock said:
If you are running Kali Linux on a Galaxy J7, then you are in entirely the wrong thread. This is about Android on Motorola Atrix. Try asking in a Kali Linux thread. Though I suspect the answer will be more or less the same -- that you need to learn how to compile a kernel to do anything.
Click to expand...
Click to collapse
Thnx for the answer buddy i have downloaded my kernel source and goind to recompile it...just looking for the right toolchain to download...anyways thnx for the replies
Ni5hant said:
Thnx for the answer buddy i have downloaded my kernel source and goind to recompile it...just looking for the right toolchain to download...anyways thnx for the replies
Click to expand...
Click to collapse
BTW, this may not only be a question of drivers. The userspace networking code also needs to setup the new network port.
runekock said:
BTW, this may not only be a question of drivers. The userspace networking code also needs to setup the new network port.
Click to expand...
Click to collapse
Nopp..i have to just enable aethros driver support with cfg80211 module..and after flash dat kernel next time i can use my usb wifi adapter...although at this kernel i cant use my inbuilt wifi adapter...anyways i have. Build my kernel have to just compile it...if it will be a success i will upload it...
Hi All,
I am working on MotoX kernel(3.4.42) , after compilation of kernel source code i am able to generate zImage. I have written zImage to original boot.img using following command
$ abootimg -u boot.img -k zImage
with this boot.img(with custom zImage) I flashed using following command
$fastboot flash boot boot.img
After booting my MotoX phone , my touch screen is not responding. I observed touch screen I2c driver is not initilized because device tree image(dt.img) is not loading by zImage during booting .
Can any one please help how to create dt.img with compiled dtb files and flash in to device???????
Thanks
Ram
516
Any one any help???????
ram1443 said:
Any one any help???????
Click to expand...
Click to collapse
im really surprised you expected most people to know the answer to your question. anyways you can rip t he prebuilt dtb from you stock boot.img using these tools right here : https://github.com/xiaolu/mkbootimg_tools and then use them to repack your zimage. abootimg isnt useful in its current form it seems.
if you wish to compile the dts files into dtb ones youll need to run a script on them, here is teh guide that taught me how to http://www.wiki.xilinx.com/Build+Device+Tree+Blob
shabbypenguin said:
im really surprised you expected most people to know the answer to your question. anyways you can rip t he prebuilt dtb from you stock boot.img using these tools right here : https://github.com/xiaolu/mkbootimg_tools and then use them to repack your zimage. abootimg isnt useful in its current form it seems.
if you wish to compile the dts files into dtb ones youll need to run a script on them, here is teh guide that taught me how to http://www.wiki.xilinx.com/Build+Device+Tree+Blob
Click to expand...
Click to collapse
Hi shabbypenguin,
Thanks for your help,
Now i am able to boot with my custom zImage and default dt.img afeter following above links. but i am unable to generate custom dt.img from my compiled dtb files.
To generate dt.img i am doing below steps:
COMMAND:
-------------
$ ./dtbTool -s 2048 -o ./dt.img -p ../../source/kernel_kitkat/out/target/product/generic/obj/kernel/scripts/dtc/ ../../source/kernel_kitkat/out/target/product/generic/obj/kernel/arch/arm/boot/
OUTPUT :
-----------
Input directory: '../../source/kernel_kitkat/out/target/product/generic/obj/kernel/arch/arm/boot/'
Output file: 'dt.img'
Found file: msm8960ab-ultra-maxx-p1.dtb ... skip, failed to scan for 'qcom,msm-id = <' tag
Found file: msm8960ab-ultram-p3.dtb ... skip, failed to scan for 'qcom,msm-id = <' tag
=> Found 0 unique DTB(s)
Can you please guide me how to generate dt.img from compiled dtb files??
Thanks
Ram
A beginners guide to building and modifying a nexus 4 lollipop* kernel from source.
*currently 5.0.1Disclaimer
I am not a developer, nor am I an expert. All the information in here I have gleaned from other sources, credited where possible, so it may not be correct and almost certainly isn't the 'best' way to do things. But it works for me. I hope it works for you but there's no guarantee. Use at your own risk
Assumptions
You have access to a computer running Ubuntu - other distros will probably work but this is the one I'm using. You'll need a basic understanding of the Linux command line including, but not limited to, ls, cp, cd, mkdir, make, ~, sudo, nano and so on.
You'll need to know how to use adb & fastboot to copy stuff into and out of your Nexus 4
A basic undersanding of Git is REALLY helpful if you want to modify your kernel. You'll be able to get by using the comands listed but you really need to have a basic understanding of what Git does if you're going to proceed.
CONTENTS
Initialise your build environment
Downloading the sources
Toolchain
Building
Creating a boot.img
A bit more about Git
Modifying kernels (how I got DT2W working)
Making a flashable zip
Initialise your build envronment
The information for this stage came from: here
I installed Ubuntu 14.04.1 LTS from a scratch. I used VM ware on a Windows laptop but any Linux environment can probably be made to work. So, to start, do an update just to be sure, then install the packages you'll need.
Code:
# sudo apt-get update
# sudo apt-get install bison g++-multilib git gperf libxml2-utils
# sudo apt-get install libncurses5-dev:i386
# sudo apt-get install lib32ncurses5-dev
# sudo apt-get install build-essential kernel-package
Downloads
Most of the really helpful information I've used came from here
I've updated the information slightly and changed the device from Flo to Mako but Pete's page is well worth reading for more background information than I've included here.
To download the source into a 'kernel' folder
Code:
# mkdir ~/android
# cd ~/android/
# git clone https://android.googlesource.com/kernel/msm.git kernel
# cd kernel/
# git branch -a
will show you all the current branches of Mako kernels, choose the one you want and checkout that one.
Code:
# git checkout android-msm-mako-3.4-lollipop-release
Now you need to find out exactly which kernel to build. The 'official' method is here
but that involves a significant download for just a few bytes so I suggest you use the following trick. Go to the pre-built kernel you want to copy here
and you wll see the first line after the header is:-
"16e203d lowmemorykiller: enhance debug information"
You need to make a note of the first seven characters, in this case 16e203d.
Next you need to use Git to create a new branch for our specific kernel. I've called it 'android-lollipop-release'.
Code:
# git checkout -b android-lollipop-release 16e203d
This will extract the source for the kernel we're going to build.
Toolchain
I'm using the stock toolchain (thanks @zaclimon) but will add an alternative suggested by @aviz1911 as time allows.
I'm going to install the toolchain in /usr/local/share but there are other places you could sensibly put it.
Code:
# cd /usr/local/share
sudo git clone [url]https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.7[/url]
Export the path to the toolchain and check it works. Note these exports only work for the current session, if you want to add permanently put it in your .bashrc or .profile
Code:
# export PATH=$PATH:/usr/local/share/arm-eabi-4.7/bin
# cd ~
Test it works with
Code:
# arm-eabi-gcc --version
Now you need to tell the system we want to cross compile.
Code:
# export ARCH=arm
# export SUBARCH=arm
# export CROSS_COMPILE=arm-eabi-
Building
Now you're ready to start.
Code:
#cd ~/android/kernel
# make mako_defconfig
You'll get some warnings like this which you can ignore
warning: (ARCH_MSM_KRAITMP && ARCH_MSM_CORTEX_A5) selects HAVE_HW_BRKPT_RESERVED_RW_ACCESS which has unmet direct dependencies (HAVE_HW_BREAKPOINT)
Code:
# make menuconfig
this is where you can make some changes if you like, we're going to change just the name. Choose General Setup ---> then select
(-perf) Local version - append to kernel release
and change perf to anything you like, I'll use dt2w
Save and exit
Code:
# make -j2
where 2 is twice the number of cores on your machine - there's just one processor on my VM but could be many more on yours. It takes more than half an hour on my machine. Then you should see
Code:
Kernel: arch/arm/boot/zImage is ready
Ta Daaaaa - you have built a kernel - now you need to pack it for testing on your phone.
Creating a boot.img
Again I'm going to use Pete's blog post as my guide but omit some details and just get the job done. I'm not going to explain all the steps, you'll have to investigate yourself if you want to understand more.
Code:
# cd ~/android
# git clone https://github.com/pbatard/bootimg-tools.git bootimg-tools
# cd bootimg-tools/libmincrypt/
# gcc -c *.c -I../include
# # cd ../mkbootimg
# gcc mkbootimg.c -o mkbootimg -I../include ../libmincrypt/libmincrypt.a
# sudo cp mkbootimg /usr/local/bin/
# gcc -o unmkbootimg unmkbootimg.c
# sudo cp unmkbootimg /usr/local/bin/
You need an original boot img to copy so you can insert your new kernel into it. Download the factory image.
Code:
# mkdir ~/android/boot
# cd ~/android/boot
# wget https://dl.google.com/dl/android/aosp/occam-lrx22c-factory-86c04af6.tgz
# tar -xvf occam-lrx22c-factory-86c04af6.tgz
# cd occam-lrx22c/
# unzip occam-lrx22c-factory-86c04af6.zip
# cp boot.img ../
# cd ~/android/boot
Now it's time to unpack the original boot image. unmkbooting will tell you all the parameters you need to repack the boot image with your new kernel inside.
Code:
# unmkbootimg -i boot.img
kernel written to 'kernel' (6009416 bytes)
ramdisk written to 'ramdisk.cpio.gz' (490557 bytes)
To rebuild this boot image, you can use the command:
mkbootimg --base 0 --pagesize 2048 --kernel_offset 0x80208000 --ramdisk_offset 0x81800000 --second_offset 0x81100000 --tags_offset 0x80200100 --cmdline 'console=ttyHSL0,115200,n8 androidboot.hardware=mako lpj=67677 user_debug=31' --kernel kernel --ramdisk ramdisk.cpio.gz -o boot.img
Code:
# cp ~/android/kernel/arch/arm/boot/zImage ~/android/boot/
Repack your new boot image with your new kernel using the information from unmkbootimg
Code:
mkbootimg --base 0 --pagesize 2048 --kernel_offset 0x80208000 --ramdisk_offset 0x81800000 --second_offset 0x81100000 --tags_offset 0x80200100 --cmdline 'console=ttyHSL0,115200,n8 androidboot.hardware=mako lpj=67677 user_debug=31' --kernel zImage --ramdisk ramdisk.cpio.gz -o new_boot.img
Nore that kernel has been changed to zImage and output file has been changed new_boot.img Now it's time to test your new_boot.img by rebooting your phone into bootloader and reboot with the new img.
DO NOT FLASH THE NEW IMAGE.
fastboot boot new_boot.img NOT fastboot flash boot new_boot.img
If all has gone well your phone will now boot with your new kernel. If something has gone wrong just reboot the phone and you'll be back to where you started. If it has all worked then you can flash the new boot image and use that.
A bit more about Git
If like me, you know nothing about Git, then this bit of the guide is for you. If you have basic understanding this will be too simple for you and you'll have to skip this bit and look elsewhere. If you have a basic understanding of any version control software you won't need this either as the necessary commands to complete the next step will be self explanatory.
Jump to the next stage here
Git is a version control system. To understand what it does at a most basic level follow these steps
Code:
# mkdir git_test
# cd git_test
# git init
Tell git who you are. You don't need the inverted commas, just an email address and a name. Keep this information for when/if you open a Github account.
Code:
# git config --global user.email "[email protected]"
# git config --global user.name "Your Name"
create a text file called 'text' with a single line of text that says "This is the first line"
add this file to your git
Code:
# git add text
commit the change with a message
Code:
git commit -m "first line"
create a new branch (checkout -b both creates and makes the new branch current)
Code:
git checkout -b newbranch
edit the 'text' file by adding another line "this is the second line"
add and commit the change to git
Code:
# git add text
# git commit -m "second line"
Then examine the text file, as you might expect it looks like this
Code:
# cat text
this the first line
this is the second line
but if we now go back to the master branch and checkout THE SAME file, we get a different result
Code:
# git checkout master
cat text
this the first line
The second line is not present because it was only added to the 'newbranch' branch. This, it appears to me is the essence of git, it changes files depending on which branch you're viewing them from.
Now we're going to look at how we can use git to extract files from someone else's repository in order to get the files we want for our needs.
There are loads of guides that help you to learn more, I found this video particularly helpful.
https://www.youtube.com/watch?v=1ffBJ4sVUb4
Still to come
Modifying kernels (how I got DT2W working)
Edit:- It's going to be a while before I complete this section as although I managed to build a working kernel I'm pretty sure I didn't do it the 'right' way so I'm reading the Git Pro book.
Will be back later. .. . .
Awesome guide dude. This will surely help a lot of people
Nice
Nice guide, wish you'd have written it a week earlier
Anyways, what i'd really like to know, is how to patch the Linux version properly, because my attempts lead to break the kernel in the process. Didn't get beyond 3.4.11 :/
Hope you can help me out there, buddy.
How to create a zip ?
I have been looking into this and created a kernel a few days ago. But i want to share it.
For that ill have to create a zip. I have searched for it. I think its done using anykernel template.
The issuse is can i use the certificates in the meta-inf folder and the update-binary that is 4 years old ?
Or should i just unzip a kernel , modify the script and place my boot.img.
@aviz1911
Unzipping and re zipping is pretty easy, I'd do that.
@Nicknoxx How's the reading up on git going? Any tips on enabling dt2w would be much appreciated. I've been trying but can't seem to get it to work
I'm really new at the Kernel stuff and just wanted to build stock with dt2w as my first project.
Thanks for the first part of the guide
Wow nice guide sir, i'll try it later
Great Guide!
Thanks Mate!!
what all lines or links should i have to modify if i am building kernel for my device oneplus one lollipop ?
@Nicknoxx
Also @Nicknoxx one can use the -b argument with git while cloning so git just downloads a single branch of the kernel source, this'll save bandwidth and time to some extent
Like
git clone https://android.googlesource.com/kernel/msm.git -bx kernel
Replace x with desired branch name
Click to expand...
Click to collapse
̿ ̿̿’̿’\̵͇̿̿\з==(*͡° ͜ʖ ͡°)==ε/̵͇̿̿/’̿’̿ ̿ ̿̿*
---------- Post added at 08:26 PM ---------- Previous post was at 08:21 PM ----------
Droid.Riz said:
what all lines or links should i have to modify if i am building kernel for my device oneplus one lollipop ?
@Nicknoxx
Click to expand...
Click to collapse
Use the cm kernel source from github.com/CyanogenMod in git clone
Just type
git clone https://github.com/CyanogenMod/android_kernel_oneplus_msm8974 kernel
Click to expand...
Click to collapse
And for compiling
make bacon_defconfig
Click to expand...
Click to collapse
̿ ̿̿’̿’\̵͇̿̿\з==(*͡° ͜ʖ ͡°)==ε/̵͇̿̿/’̿’̿ ̿ ̿̿*
KNIGHT97 said:
Also @Nicknoxx one can use the -b argument with git while cloning so git just downloads a single branch of the kernel source, this'll save bandwidth and time to some extent
Like
̿ ̿̿’̿’\̵͇̿̿\з==(*͡° ͜ʖ ͡°)==ε/̵͇̿̿/’̿’̿ ̿ ̿̿*
---------- Post added at 08:26 PM ---------- Previous post was at 08:21 PM ----------
Use the cm kernel source from github.com/CyanogenMod in git clone
Just type
And for compiling
̿ ̿̿’̿’\̵͇̿̿\з==(*͡° ͜ʖ ͡°)==ε/̵͇̿̿/’̿’̿ ̿ ̿̿*
Click to expand...
Click to collapse
thanks a lot for quick reply i will start it today itself @ night.
after successfully compiling i will reply here
Nice guide. I ad it to my collection. I mis the part about building the modules. For wifi and so on. I think the command is "make modules"
Maby ad some info about updating a kernel. ICS to JB. KK to LP and sow on.
How about the command to clean after building?
[email protected] said:
Nice guide. I ad it to my collection. I mis the part about building the modules. For wifi and so on. I think the command is "make modules"
Maby ad some info about updating a kernel. ICS to JB. KK to LP and sow on.
How about the command to clean after building?
Click to expand...
Click to collapse
Executing the make -j# command automatically builds your modules along with the Zimage, you'll just need to read last few lines in terminal to know the modules and where they reside
̿ ̿̿’̿’\̵͇̿̿\з==(*͡° ͜ʖ ͡°)==ε/̵͇̿̿/’̿’̿ ̿ ̿̿*
Hi guys,
How i can implement this mod/patch in my kernel??
http://forum.xda-developers.com/android/software-hacking/kernel-tap2unlock-tap2wake-feature-t2965344