Related
want to edit your boot.img?
included files in zip: mkbootimg (i compiled this file from android source), unpack-bootimg.pl, repack-bootimg.pl
i edited the repack script to compile the nexus s img correctly.
Code:
--base 0x30000000 --pagesize 4096
first dump original boot.img:
Code:
cat /dev/mtd/mtd2 > /sdcard/boot.img
then drag/drop to your linux box to edit file.
use unpack script:
Code:
./unpack-bootimg.pl boot.img
you will end up with 2 compressed files and 1 folder.
finished editing and want to repack boot.img, for example:
Code:
./repack-bootimg.pl <kernel> <ramdisk-directory> <outfile>
most info and scripts pulled from here: http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images, thanks to the original author.
test your new boot.img:
Code:
fastboot boot boot.img
Two things:
1. if you have any bad blocks in your boot partition, this method will fail to extract the boot.img (you need to skip bad blocks, but cat will just get an error)
2. you can replace just the kernel (leaving the ramdisk and parameters intact) using:
Code:
% fastboot flash zimage zImage
The bootloader will read-modify-write the boot partition, replacing the kernel only.
how would you skip bad blocks? i never thought of a phone as having bad blocks.
k0mpresd said:
i never thought of a phone as having bad blocks.
Click to expand...
Click to collapse
All flash devices can have bad blocks. But it usually isn't something the end user would notice, unless there are so many and something is wrong that you're losing drive space.
edit: more info here if your curious http://en.wikipedia.org/wiki/Flash_memory
hmm, very strange thing happening to me. I've only gotten my boot.img to compile and boot successfully once with this method, but now I can't seem to get it to compile? I keep getting errors of the file name or file type. I'm using the correct usage.. If I compile manually with mkbootimg on the cmd line it'll compile but it won't boot. Just bootloops at the Google splash..
Jroid try my Matr1x kernel and see what happens
Sent from my Nexus S using XDA App
The problem seems to be compiling the boot with the perl scripts, not the kernel itself.
Try manually:
Once unpacked do the boot.img-ramdisk.cpio.gz with the following command (moved to the ramdisk folder):
Code:
#sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
Then cd ../
And repack:
Code:
#./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
you can replace just the kernel (leaving the ramdisk and parameters intact) using:
Code:
% fastboot flash zimage zImage
The bootloader will read-modify-write the boot partition, replacing the kernel only.
Click to expand...
Click to collapse
It won't work on the Nexus S.
python08 said:
It won't work on the Nexus S.
Click to expand...
Click to collapse
exactly, i'd love to be able to do this for some testing but it doesn't allow me.
EDIT: yes it does. Swetland is right
Chamb' said:
Try manually:
Once unpacked do the boot.img-ramdisk.cpio.gz with the following command (moved to the ramdisk folder):
Code:
#sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
Then cd ../
And repack:
Code:
#./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
Click to expand...
Click to collapse
I've tied compiling a boot both manually (with cmdline) and with the perl scripts and have used a simple kernel.gz and ramdisk.cpio.gz for my file names.. doesn't really matter what I name it as long as it has the correct file format in this .gz and .cpio.gz right? the manual compile goes fine with base 0x30000000 and pagesize 4096
however, it does not boot and will bootloop at the Google splash
Used boot.img extracted from (what ROM ?) cat /dev/mtd/mtd2 ?
Is the phone start with this boot.img (unchanged) if you flash it by typing "fastboot flash..." ?
After that, just try to unpack and repack the boot.img without changes on ramdisk or kernel, if it works that means your changes suck (^^).
These commands (or perl scripts) work perfectly for me.
Lol I will try doing that. The boot.img I used is from stock 2.3.4, edited the ramdisk (specifically init.rc & init.herring.rc)
Like I said, first time I used the perl scripts I edited my ramdisk, threw in a netarchy kernel, it compiled fine and booted. Now if I use the perl script to repack with an aosp kernel, it gives me an error about file name and/or extension being wrong. Or complains it can't find mkbootimg when its there and executable. I'll re run it again and post errors
Sent from my Nexus S
he guys where is the boot image located? not the animation, the google logo at the start of the booting!
Sent from my Nexus S using XDA Premium App
ok so when I used the repack-bootimg.pl script, it kept giving me this error:
Code:
boot.img-kernel.gz Not a directory at ./repack-bootimg.pl line 13.
So I ran mkbootimg manually, without a cmdline comment as stated above. It compiled
and booted beautifully all stock with no init.rc or init.herring.rc edits.
however when I compile a boot.img coupled with a stock kernel and a modified ramdisk, I get a non-booting boot.img. One came out at 2.9 mb and the other at 5.6 mb neither boots using the same cmd that compiled the working boot. Must be my edits.. I literally only changed about 1 line in init.rc and another line in init.herring.rc that causing it not to boot.
By the way, I got some info on a stock boot.img using the unpackbootimg binary (not the perl script) and here's what it outputs:
Code:
#BOARD_KERNEL_CMDLINE console=ttyFIQ0 no_console_suspend
BOARD_KERNEL_BASE 30000000
BOARD_PAGE_SIZE 00001000
I enter that pagesize and it says it's not a valid value when I compile boot.img's
Borky_16 said:
he guys where is the boot image located? not the animation, the google logo at the start of the booting!
Sent from my Nexus S using XDA Premium App
Click to expand...
Click to collapse
part of the kernel
to change-https://github.com/morfic/Samsung-logo
ogdobber said:
part of the kernel
to change-https://github.com/morfic/Samsung-logo
Click to expand...
Click to collapse
yeah i know thanks for the link a helping source though!
Sent from my Nexus S using XDA Premium App
Sorry for the Control C Control V of it, but I just found this topic now..
I`m facing this problem when I try to unpack boot.img..
I have done it 2 days ago but dunno why, now I can`t..
Follows what is happening..
Code:
[email protected]:~/NS-bootwork$ ./unpack-bootimg.pl boot.img
Found a secondary file after the ramdisk image.
According to the spec (mkbootimg.h) this file can exist,
but this script is not designed to deal with this scenario.
The Kernel is built, as a zImage and the WLAN as a bmc3429.ko..
Just repeating, I have built this Kernel 2 days ago in the same way, without any problems, but now I`m struggling on the message after inputting ./unpack-bootimg.pl boot.img..
Dunno what else to try, I re-downloaded the unpack-bootimg.pl from 2 different sources, and still the same error..
Any ideas?
Many thanks..
P.S.: Ubuntu 11.04 x64..
EDIT
Well, I already solve it!
That is what I did..
As unpack-bootimg.pl was not working (don`t know why) I used split_bootimg.pl script, splitting the boot.img and created new ramdisk img..
Code:
./split_bootimg.pl boot.img
mkdir ramdisk
cd ramdisk
gzip -dc ../boot.img-ramdisk.gz | cpio -i
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
Then after just compiled the Kernel with
Code:
./mkbootimg --kernel zImage --ramdisk newramdisk.cpio.gz --base 0x30000000 --pagesize 4096 --cmdline _console_suspend=1 console=bull's -o newtestboot.img'no
Witches includes " --cmdline _console_suspend=1 console=bull's" to not break BT functionality, in the case of Nexus S..
I found the tools here work well: http://glandium.org/blog/?p=2214
...if you then use the code originally posted above:
Code:
sudo find . | cpio -o -H newc | gzip > ../<your boot name>.img-ramdisk.cpio.gz
./mkbootimg --kernel <your boot name>.img-kernel.gz --ramdisk <your boot name>.img-ramdisk.cpio.gz --base 0x30000000 --pagesize 4096 -o boot.img
After installing stock versions of 4.0.4, 4.1.1, or 4.1.2, the kernel will mount the recovery partition as read only so that ClockWorkMod (or any other recovery) will not install properly. Here are the commands to fix the kernel so that it mounts the recovery partition as writable and turns off secure mode:
The following commands below assume that you have already downloaded your desired firmware from sammobile.com and have extracted the boot.img (kernel) file from it using the tar utility. This tutorial is for Linux only and tested on Ubuntu 12.04.
Code:
unmkbootimg boot.img
mkdir ramdisk
cd ramdisk
gunzip -c ../initramfs.cpio.gz | cpio -i
patch -p1 < ../ro.secure.diff
find . | cpio -o -H newc | gzip > ../initramfs-new.cpio.gz
cd ..
mkbootimg --kernel kernel.gz --ramdisk initramfs-new.cpio.gz --base 0x80000000 --cmdline 'console=ttyO2,115200n8 mem=1024M androidboot.console=ttyO2 vram=20M omapfb.vram=0:16M androidboot.carrier=wifi' -o new_boot.img
Contents of patch (ro.secure.diff):
Code:
--- ramdisk/default.prop.org 2013-02-18 03:40:22.442572189 +0100
+++ ramdisk/default.prop 2013-02-18 03:40:56.158572156 +0100
@@ -1,7 +1,7 @@
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
-ro.secure=1
+ro.secure=0
ro.allow.mock.location=0
ro.debuggable=0
persist.sys.usb.config=mtp
I have attached also below an example of the flash-able zip file used for installing the new boot.img through ClockworkMod. Just replace the boot.img inside the kernel.zip file with the new boot.img that you just created from the directions above and sign the zip (signing is optional).
If you interested in extracting the kernel image from the Samsung Galaxy S5 ROM, you should follow the following steps.
This is was tested with the G900VVRU1ANCG_G900VVZW1ANCG_VZW stock ROM firmware.
The first is extracting the files from the ROM firmware file, this is explained in many places and won't be covered here.
Extract the boot.img to some directory, using the Android unpackbootimg utility:
Code:
unpackbootimg -i boot.img -o boot/
After extracting the boot.img file you will usually end up with the following file list:
Code:
boot.img-base
boot.img-cmdline
boot.img-pagesize
boot.img-ramdisk.gz <- this includes the root (/) files, like init*.rc and SELinux policy files
boot.img-zImage <- compressed image of the Android Linux kernel
Next step will be extracting the compressed kernel image from the zImage file. The Android kernel is a self-extracting compressed file, while different devices use different compression methods. While looking at the file contents using hex editor, you can see the decompression code at the beginning, and then at some point the compressed data begins. The compressed image begins where you find the LZO magic header.
Code:
static const unsigned char lzop_magic[9] = {
0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
};
Save the data from the LZO magic header to the end of the file with the zImage.kernel file name.
This firmware and kernel are using LZO compression, and there is an easy to use utility called lzop that is used for the decompression of the file. Just run the following command to decompress the kernel from the zImage.kernel file:
Code:
lzop -d -c zImage.kernel > zImage.kernel.decompressed
And now you have the decompressed kernel for the device ready for exploration, which is also attached to this post.
Note:
I've tried using different scripts that do the job, including galaxys2_kernel_repack and http://forum.xda-developers.com/showthread.php?t=901152 but both failed while extracting the kernel image, although were able to extract the begin position for the LZO compression header.
But it does trip KNOX after flashing, doesn't it?
roman.blachman said:
If you interested in extracting the kernel image from the Samsung Galaxy S5 ROM, you should follow the following steps.
This is was tested with the G900VVRU1ANCG_G900VVZW1ANCG_VZW stock ROM firmware.
The first is extracting the files from the ROM firmware file, this is explained in many places and won't be covered here.
Extract the boot.img to some directory, using the Android unpackbootimg utility:
Code:
unpackbootimg -i boot.img -o boot/
After extracting the boot.img file you will usually end up with the following file list:
Code:
boot.img-base
boot.img-cmdline
boot.img-pagesize
boot.img-ramdisk.gz <- this includes the root (/) files, like init*.rc and SELinux policy files
boot.img-zImage <- compressed image of the Android Linux kernel
Next step will be extracting the compressed kernel image from the zImage file. The Android kernel is a self-extracting compressed file, while different devices use different compression methods. While looking at the file contents using hex editor, you can see the decompression code at the beginning, and then at some point the compressed data begins. The compressed image begins where you find the LZO magic header.
Code:
static const unsigned char lzop_magic[9] = {
0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
};
Save the data from the LZO magic header to the end of the file with the zImage.kernel file name.
This firmware and kernel are using LZO compression, and there is an easy to use utility called lzop that is used for the decompression of the file. Just run the following command to decompress the kernel from the zImage.kernel file:
Code:
lzop -d -c zImage.kernel > zImage.kernel.decompressed
And now you have the decompressed kernel for the device ready for exploration, which is also attached to this post.
Note:
I've tried using different scripts that do the job, including galaxys2_kernel_repack and http://forum.xda-developers.com/showthread.php?t=901152 but both failed while extracting the kernel image, although were able to extract the begin position for the LZO compression header.
Click to expand...
Click to collapse
I tried that and was given a warning of trailing bytes by `lzop`. Later when i do a `file` command on the resulting uncompressed file, it is not a vmlinux ELF image, rather it is a data file. How are we able to repack this image back into zImage? Any advise is appreciated thanks.
What i do if i have boot.img-kernel and boot.img-kernel_offset?
DGKG said:
What i do if i have boot.img-kernel and boot.img-kernel_offset?
Click to expand...
Click to collapse
The boot.img-kernel is your zimage file
What Source you used for Unpack?
Can you share link for you Scripts? or can you provide link to scripts for unpacking and repacking Note 9 Exynos Kernel?
Thanks
Greetings
I followed these procedures, and pushed the boot.img with Odin, but the phone goes into download mode stating: "Could not do normal boot." Can anyone see what I am doing wrong? How can I troubleshoot the issue? Is there some way I can look at some logs somewhere? I did save my recovery.log file from twrp to the sdcard before I loaded the backedup files and rebooted the phone. I put them here is there anything else I can do?
I tried the same thing with boot.img and I got the following:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ ./mkboot boot.img ksumag
Unpack & decompress boot.img to ksumag
kernel : zImage
ramdisk : ramdisk
page size : 2048
kernel size : 8262680
ramdisk size : 1064985
dtb size : 1300480
base : 0x00000000
kernel offset : 0x00008000
ramdisk offset : 0x02000000
second_offset : 0x00f00000
tags offset : 0x01e00000
dtb img : dt.img
cmd line : console=null androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3
ramdisk is gzip format.
Unpack completed.
[email protected]:~/xiaolu/mkbootimg_tools$ cd ksumag/
[email protected]:~/xiaolu/mkbootimg_tools/ksumag$ ls
dt.img img_info ramdisk ramdisk.gz zImage
[email protected]:~/xiaolu/mkbootimg_tools/ksumag$
I put the scsi_wait.ko ( name? ) file in ramdisk /dev folder, and replaced the zImage and dt.img file with the ones I made, and packed them into my own boot.img file.
Here is the output:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ ./mkboot ksumag/ boot.img
mkbootimg from ksumag//img_info.
kernel : zImage
ramdisk : new_ramdisk.gz
page size : 2048
kernel size : 8262680
ramdisk size : 1082259
dtb size : 1300480
base : 0x00000000
kernel offset : 0x00008000
ramdisk offset : 0x02000000
tags offset : 0x01e00000
dtb img : dt.img
cmd line : console=null androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3
Kernel size: 8262680, new ramdisk size: 1082259, boot.img: 10893312.
boot.img has been created.
...
Then I put all files in a tar file. I did make a couple of mistakes with files names, which I hope did not damage the boot.img file.
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img >> boot.img
tar: boot.img: file is the archive; not dumped
[email protected]:~/xiaolu/mkbootimg_tools$ ls
ARM dtbToolCM ksumag mkbootimg recovery.img
boot.img dtbtool.txt lz4 MyKernel.tar.md5 recovery.tar.md5
commands dtc mkboot oldfiles shahin
dtbTool ksuamg mkbootfs README.md sm-n900p-test1
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img > boot.img
tar: boot.img: file is the archive; not dumped
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img > boot.tar
[email protected]:~/xiaolu/mkbootimg_tools$
Then I took the hash of the entire thing:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ md5sum -t boot.tar >> boot.tar
[email protected]:~/xiaolu/mkbootimg_tools$ mv boot.tar boot.tar.md5
[email protected]:~/xiaolu/mkbootimg_tools$
What are you trying to get
kenny1991 said:
What are you trying to get
Click to expand...
Click to collapse
I am trying to get a flashable image. The file I get from the above procedure goes on my phone, but the kernel does not seem to be loaded. I am still learning about the boot process, and I do not know if my phone just has a bootloader or a bootstrap also; regardless it seems to not load the kernel since it goes into download mode. The recovery.log does not show anything either. I posted in pastebin. I can put link to it here if you think it would help. My goal is to flash my phone with a copy of the kernel which I built myself.
Oh you need a developer to respond for that.
kenny1991 said:
Oh you need a developer to respond for that.
Click to expand...
Click to collapse
Do you know if I can move this thread myself or perhaps request it from one of the admins? I do not know how effective it would be if I put a link to this discussion in the developer forum.
You may ask as you can't move it. You should move it to developers discussion forum
How to process Android boot image files on a PC running the Linux OS
To unpack and repack the boot image for phones running the Android OS the Magisk binary magiskboot is necessary (well, there might be other tools for this task but magiskboot seems to be one of the best tools for this task). Therefor these kind of tasks will usually be done on a phone running the Android OS.
But there is also a magiskboot binary for x86 CPUs in the Magisk apk file and that executable can be used to work with boot images for Android phones on a PC running the Linux OS on a machine with x86 CPU. To retrieve the x86 version of magiskboot from the Magisk apk file do:
Bash:
# to use the 32 bit version
unzip Magisk-v25.2.apk lib/x86/libmagiskboot.so
mv lib/x86/libmagiskboot.so ./magiskboot
chmod 755 ./magiskboot
or
Bash:
# to use the 64 bit version
unzip Magisk-v25.2.apk lib/x86_64/libmagiskboot.so
mv lib/x86_64/libmagiskboot.so ./magiskboot
chmod 755 ./magiskboot
Example:
Code:
[[email protected] /data/develop/android/magisk]$ unzip Magisk-v25.2.apk lib/x86_64/libmagiskboot.so
Archive: Magisk-v25.2.apk
version=25.2
versionCode=25200
inflating: lib/x86_64/libmagiskboot.so
[[email protected] /data/develop/android/magisk]$
[[email protected] /data/develop/android/magisk]$ mv lib/x86_64/libmagiskboot.so ./magiskboot
[[email protected] /data/develop/android/magisk]$
[[email protected] /data/develop/android/magisk]$ chmod 755 magiskboot
[[email protected] /data/develop/android/magisk]$
[[email protected] /data/develop/android/magisk]$ file ./magiskboot
./magiskboot: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=b2d42d7bab2f70a0d66fc606a1fb2726a0559fed, stripped
[[email protected] /data/develop/android/magisk]$
[[email protected] /data/develop/android/magisk]$ ldd ./magiskboot
not a dynamic executable
[[email protected] /data/develop/android/magisk]$
[[email protected] /data/develop/android/magisk]$ ./magiskboot
MagiskBoot - Boot Image Modification Tool
Usage: ./magiskboot <action> [args...]
...
[[email protected] /data/develop/android/magisk]$
The binary magiskboot from the Magisk apk file is a statically linked executable either for 32 Bit or 64 Bit. Therefor it should run on any Linux distribution that supports executing executables for x86. I tested the binary from the apk file with Magisk v25.2 on these distributions:
Fedora 36 (64 Bit, kernel 6.x)
Redhat 8.6 (64 Bit, kernel 4.x)
Redhat 6.10 (64 Bit, kernel 2.x)
GRML LiveCD (32 Bit, kernel 5.x, the 32 bit version only)
RockyLinux 9.0 (64 Bit, kernel 5.x)
openSUSE LEAP 15.2 (64 Bit, kernel 5.x)
Unpacking a boot image file using magiskboot on a PC running the Linux OS can be done using this command;
Bash:
./magiskboot unpack boot_a.img
To change files in the ramdisk from the boot image use the magiskboot parameter cpio:
Code:
[[email protected] /data/develop/android/test2]$ ./magiskboot
MagiskBoot - Boot Image Modification Tool
Usage: ./magiskboot <action> [args...]
Supported actions:
...
cpio <incpio> [commands...]
Do cpio commands to <incpio> (modifications are done in-place)
Each command is a single argument, add quotes for each command
Supported commands:
exists ENTRY
Return 0 if ENTRY exists, else return 1
rm [-r] ENTRY
Remove ENTRY, specify [-r] to remove recursively
mkdir MODE ENTRY
Create directory ENTRY in permissions MODE
ln TARGET ENTRY
Create a symlink to TARGET with the name ENTRY
mv SOURCE DEST
Move SOURCE to DEST
add MODE ENTRY INFILE
Add INFILE as ENTRY in permissions MODE; replaces ENTRY if exists
extract [ENTRY OUT]
Extract ENTRY to OUT, or extract all entries to current directory
test
Test the current cpio's status
Return value is 0 or bitwise or-ed of following values:
0x1:Magisk 0x2:unsupported 0x4:Sony
patch
Apply ramdisk patches
Configure with env variables: KEEPVERITY KEEPFORCEENCRYPT
backup ORIG
Create ramdisk backups from ORIG
restore
Restore ramdisk from ramdisk backup stored within incpio
sha1
Print stock boot SHA1 if previously backed up in ramdisk
...
[[email protected] /data/develop/android/test2]$
E.g. to change the file system/etc/ramdisk/build.prop in the ramdisk, extract the file from the ramdisk
Bash:
./magiskboot cpio ramdisk.cpio "extract system/etc/ramdisk/build.prop build.prop"
edit the file, and add the file back to the ramdisk using this command:
Bash:
./magiskboot cpio ramdisk.cpio "add 0644 system/etc/ramdisk/build.prop build.prop"
Notes
Note that I did not yet manage to create a working boot image with magiskboot running in the Linux OS after extracting, changing, and recreating the ramdisk via the Linux cpio command (as Linux user root, of course) :
Creating a new boot image this way with magiskboot running in the LInux OS works without error but booting the new created boot image always ends with a ramdump error on the phone. So extracting the ramdisk via Linux cpio command can only be used to view the files in a boot image file for an Android Phone from wthin the Linux OS.
Trouble Shooting
To test the new boot image without installing it use this approach:
Bash:
# boot the phone into the bootloader
#
adb reboot bootloader
# boot the phone from the patched image file
#
sudo fastboot boot ./new-boot.img
If booting the phone works and everything is fine flash the image to the active boot partition
In case you get a ramdump error after booting the phone from the new boot partition just restart the phone into the bootloader mode and flash the old image back to the boot partition.