Database Info

Strange SD card problem in Bootloader (SOLVED)

This is wat I have done:
With romupdate I made a backup on 512MB SD Card
Put SD card away
Installed TMob rom, all ok.
Tmobile is too pink for me so I wanted to install my old rom
Put in SD card and immediatedly bootloader says SD card, update blabla and it worked.
----
Now I want to have that bigstorage. I ntrw'd the SDcard to a file, opened it with hexeditor, changed the 2 020008000 thingies, saved it and ntrw'd it back onto the SDcard.
Sow, when inserted in bootloader, it just sais
SERIAL
V1.02
When I remove the card very sometimes it THEN IMMEDIATELDY askes to install, but than sections=1 and read card is fail. Somtimes when removing and reinserting it sais ROM size not enough.
What should I do? I tried everything. Should I keep my old rom and forget the big storage?

I tried leaving the phone for 1 night in the bootloader, hoping next morning it would say SD update.
It left me with a drained battery (0%!) it wouldn't reset anymore until I plugged the device in te loader, I had it fully recharged. Strange.

Ok. I think this could be a problem.
My SD image looks like this (first somewhat 500 bytes
Code:
4d 41 47 49 43 49 41 4e 20 20 20 20 20 20 20 20 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 2e 30 32 20 20 20 20 20 20 20 20 20 20 20 20 25 8e f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 8a c5 37 53 41 30 30 d8 00 45 07 00 06 7d 77 57 00 3c 27 bf 22 e7 00 07 b4 2e 0b 19 96 d8 bb 88 ef c3 dd 49 c6 26 3a 50 e6 00 1c b8 2f 59 e0 27 ec 45 f2 af 00 00 f9 ab 7a ca 4e 5a 9d 0f b3 cc 00 00 00 00 9d a8 a3 51 99 3f 82 07 ba 4d 40 51 00 ff e9 5c 9a 8b 67 bb 3a b9 f5 09 a9 a3 d6 69 74 71 4f 17 46 a3 2e 4e ee 8e 61 e8 f3 b0 a5 cc cb d6 1c b5 59 d0 47 1a ea 9f 29 4f 84 2e cc b3 d0 b1 a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 f0 48 cd 47 ab 32 f5 57 1e 36 1a 99 8c 93 4c 67 35 9d 60 d3 34 10 f3 99 a8 a4 ab 53 12 e1 c0 ec fe 35 bb 57 e6 44 7e 81 53 7f 85 84 45 f8 6b 1d d5 74 b0 60 19 c2 b9 aa 48 4c 18 d8 1e ec 0e b6 82 01 4e ba 67 c1 04 f3 f0 d1 16 3c d7 13 aa b5 0f bf e8 74 a8 b5 01 77 f4 11 70 dd e8 00 80 56 c4 d3 0e d9 f7 52 90 95 3c 53 56 29 0a 8b 10 48 54 43 53 41 30 30 34 30 30 30 30 30 33 46 43 30 30 30 30 30 43 46 34 38 45 32 35 fe 03 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 43 45 43 34 ec 0d 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 4f 44 41 50 30 30
cant get the text copied, but when I encode it to a /nbf file, with good romdumps it shows the operator and things, now it shows garbage:
Code:
Good one:
deviceId=PM10A
cellOpName=T-MOB005
language=WWE
firmwareVersion=1.13.00
deviceModelName=Magician
address0=0
address1=0
address2=0
crc32=6448ae5b
File crc32: dd221a2f
Code:
My own:
deviceId=MAGICIAN
cellOpName=0000000000000000
language=1.02
firmwareVersion= %Ķ♀
deviceModelName=
address0=
address1=
address2=
crc32=
File crc32: 148cd320
Where dit it go wrong???
ntrw, romupdate.exe? It's a bit scrambled.

It wás the problem.
What I did:
FOrmat SD card
Get rom on SD card with romupdate
ntrw it to disk
used hexedit to remove the 400meg of zero's (512mb sdcard)
ran mksBigStoragerENG.exe from ftp site for patch it bigstorage and so,
format SD card again
ntrw new patched file to SD
put it in Magician, start bootloader, and in 10 sec SD UPDATE and off it goes, now 51%...
Wish me luck!

Yes, done it.
Now have Dutch Vodafone 1.12 ROM with 1.12 Radio, extended rom is on my harddisk and bigstorage.
If someone wants this ROM please let me know, have no fast connection but then I will upload it at night.

Thanks for your thoughtfulness but I believe ROM 1.12 with Radio 1.12 is already in the ftp. In fact, the latest ROM version is 1.13 with Radio 1.12, but there's a stand alone Radio 1.13.

Well I'm happy it worked this way. There were some people struggling to get the SD card to update, this should do the trick then. I tried everything else
And I had some problems with pushmanager + bluesoleil in 1.13 (no vodafone?) which I dont have now. Maybe it was not the 1.13 fault, but ey, what's the difference?

Goldcard Example for G1

Hi,
I'm an Australian user of the Optus Dream / G1.
I've searched on here as well as Google in general to try and find an example of a goldcard. Whenever I make mine, windows *****es that it cannot read the device to load the dreaming file on. I just want to find out if i'm on the right track.
Ok, so here's the CID straight from terminal emulator:
Code:
0353445355303147801060c16d009198
and now, reversed with 00 at the start:
Code:
0091006dc16010804731305553445303
I load this into qmat and generate this goldcard:
Code:
6F E9 DB F4 62 CF 43 51 09 60 42 63 C6 5E 17 A8
39 68 F0 67 A8 40 85 41 4D BE 7D 74 2E 28 81 02
FB 98 90 61 C8 DD 02 A0 46 12 FF AB 02 F6 E9 0A
C3 37 09 00 7D 62 10 4C 3F 66 F2 F2 D5 D2 F8 0E
67 FD DC 18 4E D8 B3 49 74 AA 58 B9 06 9E 57 E8
79 A8 30 A7 E8 80 C5 81 8D FE BD B4 6E 68 C1 42
3B D8 D0 A1 08 0D 2B 96 97 30 4F 19 52 54 F9 4A
03 77 49 40 BD A2 50 8C 7F A6 32 32 92 ED AB F4
53 41 30 30 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 5F 00 9E 00 00 00 00 00 00
75 00 00 00 00 A5 7E 00 00 00 00 00 00 00 00 00
00 D8 2D 00 00 00 00 00 00 00 00 00 00 8F CD 07
42 00 00 00 00 00 00 00 00 00 00 00 00 82 00 00
00 00 00 00 00 00 00 00 00 00 00 00 52 28 7D 3C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(the goldcard is x180 long)
This is what the first x180 of my SD card looks like when it is freshly formatted to FAT32 and opened in hxD:
Code:
EB 58 90 4D 53 44 4F 53 35 2E 30 00 02 08 0C 11
02 00 00 00 00 F8 00 00 3F 00 FF 00 00 20 00 00
BB 06 1E 00 7A 07 00 00 00 00 00 00 02 00 00 00
01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00
80 00 29 C6 28 D5 F6 4E 4F 20 4E 41 4D 45 20 20
20 20 46 41 54 33 32 20 20 20 33 C9 8E D1 BC F4
7B 8E C1 8E D9 BD 00 7C 88 4E 02 8A 56 40 B4 41
BB AA 55 CD 13 72 10 81 FB 55 AA 75 0A F6 C1 01
74 05 FE 46 02 EB 2D 8A 56 40 B4 08 CD 13 73 05
B9 FF FF 8A F1 66 0F B6 C6 40 66 0F B6 D1 80 E2
3F F7 E2 86 CD C0 ED 06 41 66 0F B7 C9 66 F7 E1
66 89 46 F8 83 7E 16 00 75 38 83 7E 2A 00 77 32
66 8B 46 1C 66 83 C0 0C BB 00 80 B9 01 00 E8 2B
00 E9 2C 03 A0 FA 7D B4 7D 8B F0 AC 84 C0 74 17
3C FF 74 09 B4 0E BB 07 00 CD 10 EB EE A0 FB 7D
EB E5 A0 F9 7D EB E0 98 CD 16 CD 19 66 60 80 7E
02 00 0F 84 20 00 66 6A 00 66 50 06 53 66 68 10
00 01 00 B4 42 8A 56 40 8B F4 CD 13 66 58 66 58
66 58 66 58 EB 33 66 3B 46 F8 72 03 F9 EB 2A 66
33 D2 66 0F B7 4E 18 66 F7 F1 FE C2 8A CA 66 8B
D0 66 C1 EA 10 F7 76 1A 86 D6 8A 56 40 8A E8 C0
E4 06 0A CC B8 01 02 CD 13 66 61 0F 82 75 FF 81
C3 00 02 66 40 49 75 94 C3 42 4F 4F 54 4D 47 52
20 20 20 20 00 00 00 00 00 00 00 00 00 00 00 00
Now, various instructions (that I cannot link to being a new user) I have seen say to copy the first x170 of the goldcard to the sdcard. But the goldcard is x180 long???
Anyway, I've tried both (copying x180 and x170), and that doesn't work. I've tried adding replacing the first byte of the reversed CID with "00", and not replacing it, and neither work.
TL;DR: Does the above goldcard and unmodified SD card look like yours?

can't you just flash that nbh img from bootloader?
not sure how much different australian g1s from US. but I didn't use gold card in rooting my g1.

Did you try this?

xtenpeben said:
can't you just flash that nbh img from bootloader?
not sure how much different australian g1s from US. but I didn't use gold card in rooting my g1.
Click to expand...
Click to collapse
I tried that, but when I reboot and hold the camera button it comes up and says "Not allowed"
nk111 said:
Did you try this?
Click to expand...
Click to collapse
Yes I tried the online goldcard generator, same results on all fronts.
I have also tried different SD Cards, a 2gb Kingston and a 1gb sandisk

The best this is to use qmat to do the reverse string thingie.
I had done it a lot of times manually, but failed every time.
After using qmat I got it to work.

Hello,
I can not check your goldcard right now because I am on my phone, but I think this is not your problem. If windows complains about beeing not able to read the drive, you most likely copied your goldcard to the wrong part of the disk.
You have to overwrite the first 170 Byte of your sd Card. It is important that you do not choose the logical drive (say drive letter e: for example) but the actual physical drive with your sdcard (should not have a drive letter)
I just assume this is your problem. Maybe you could pos the first bytes of your selected drive and tell us what you did.
edit: ah you did post that. The first bytes should be a bunch of 0s. Check what I stated above and tell us if you still have problems.

Please try my software: http://www.mediafire.com/download.php?mzqdyrtmimj

I bet its wether a mistake in the transcription of the CID or you havent used the physical drive. If the sd card has to be formated, it wont work.

I just got mine to work. My problem was same as yours, my mistake was using "logical disk" instead of physical in HxD. I also switched my sd card to older 1gb that I formatted first in a camera (fat16) then formatted in vista to fat32 right before writing the 170 bytes (length: 180). Save after you copy paste the hex but dont close. put the DREAIMG.nhb on it first then close HxD, then "safely remove"
This worked for me but I struggled until I got here, made so many mistakes. Good Luck.

goldcard is really x180 long just
copy all 00 00 00 00 ... from x170 to x180 and save
thanks man you are the best

you have an extra 3 at the end in the reversed code.. lol

[Q] String in PIT

I was looking at the PIT image for the device and was curious about this string:
Code:
00000070 3b 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 |;.C.:.\.P.r.o.g.|
00000080 00 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 |..a.m. .F.i.l.e.|
00000090 73 00 5c 00 45 00 53 00 54 00 73 00 6f 00 66 00 |s.\.E.S.T.s.o.f.|
Anyone know what that is from? there is no t on the next line by the way.
On an unrelated note, does anyone know of any tools to work with rfs natively in linux? I can open the image as vfat but It's missing some obvious stuff (SUID).

xaocon said:
I was looking at the PIT image for the device and was curious about this string:
Code:
00000070 3b 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 |;.C.:.\.P.r.o.g.|
00000080 00 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 |..a.m. .F.i.l.e.|
00000090 73 00 5c 00 45 00 53 00 54 00 73 00 6f 00 66 00 |s.\.E.S.T.s.o.f.|
Anyone know what that is from? there is no t on the next line by the way.
On an unrelated note, does anyone know of any tools to work with rfs natively in linux? I can open the image as vfat but It's missing some obvious stuff (SUID).
Click to expand...
Click to collapse
What pit is this? Is this one of the old ones (813) ? Or is this one that was pulled for whitehawks?

Bl4ckpheniX said:
What pit is this? Is this one of the old ones (813) ? Or is this one that was pulled for whitehawks?
Click to expand...
Click to collapse
This was pulled for whitehawks. I've never flashed a new pit though.

xaocon said:
This was pulled for whitehawks. I've never flashed a new pit though.
Click to expand...
Click to collapse
Hmm, I will look at it some more.
Sent from my SGH-T959V using XDA Premium App

[Q] General HEX Editing question

I'm changing proxy addresses on a Casio C731 Rock... in mass quantities. DLL wont read on CHMC Lab edition so resorting to HEX editing.. yeay.
When I change the proxies in the HEX it takes fine but the phone only reads 13 characters (size of the oem proxy) so I know its only a simple digit telling the phone how many characters to allow in this field... I thought it was the 3rd byte but in this HEX the 3rd byte is the start of the actual proxy address..
What I'm working with:
Stock:
[NV Items]
[Complete items - 2]
7541 (0x1D75) - OK
0D 67 77 2E 76 7A 77 77 61 70 2E 63 6F 6D 00 31
00 2E 76 74 65 78 74 2E 63 6F 6D 2F 70 63 64 2F
63 37 33 31 2F 63 37 33 31 2E 78 6D 6C 00 44 4D
02 34 35 00 44 32 00 09 43 44 4D 41 02 34 35 00
31 00 08 43 44 4D 41 5F 02 34 35 00 00 09 43 44
4D 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00
7542 (0x1D76) - OK
0E 67 77 31 2E 76 7A 77 77 61 70 2E 63 6F 6D 00
00 2E 76 74 65 78 74 2E 63 6F 6D 2F 70 63 64 2F
63 37 33 31 2F 63 37 33 31 2E 78 6D 6C 00 44 4D
02 34 35 00 44 32 00 09 43 44 4D 41 02 34 35 00
31 00 08 43 44 4D 41 5F 02 34 35 00 00 09 43 44
4D 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00
Modified with desired proxy:
[NV Items]
[Complete items - 2]
7541 (0x1D75) - OK
0d 70 70 63 67 77 31 2e 76 7a 77 72 65 73 65 6c
6c 65 72 2e 63 6f 6d 00 31 00 00 00 00 00 00 00
00 2E 76 74 65 78 74 2E 63 6F 6D 2F 70 63 64 2F
63 37 33 31 2F 63 37 33 31 2E 78 6D 6C 00 44 4D
02 34 35 00 44 32 00 09 43 44 4D 41 02 34 35 00
31 00 08 43 44 4D 41 5F 02 34 35 00 00 09 43 44
4D 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
7542 (0x1D76) - OK
0e 70 70 63 67 77 32 2e 76 7a 77 72 65 73 65 6c
6c 65 72 2e 63 6f 6d 00 00 00 00 00 00 00 00 00
00 2E 76 74 65 78 74 2E 63 6F 6D 2F 70 63 64 2F
63 37 33 31 2F 63 37 33 31 2E 78 6D 6C 00 44 4D
02 34 35 00 44 32 00 09 43 44 4D 41 02 34 35 00
31 00 08 43 44 4D 41 5F 02 34 35 00 00 09 43 44
4D 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Any help would be greatly appreciated - thanks for looking

[GUIDE] How to eliminate the slot of an A/B device (pre-Android 10) into Aonly device

This guide should be generic for all of Qualcomm A/B devices came with Android 9 or older out of box - in other words, devices with "super" partition are not applicable.
For some reason, if you prefer custom ROM rather than stock, or you want to get more storage space especially for 32GB or fewer devices, this should be a good start point.
I have never tested MediaTek or Unisoc devices, but for Qualcomm devices, this should work properly.
The point is, simply rename, eliminate and resize partitions so it will behave like A-only devices.
Devices with AVB1 need to repurpose these partitions:
Code:
boot_a -> boot
boot_b -> recovery
modem_a -> modem
modem_b -> (whatever you want)
bluetooth_a -> bluetooth
bluetooth_b -> (whatever you want)
dsp_a -> dsp
dsp_b -> dsp
mdtp_a -> mdtp
mdtp_b -> (whatever you want)
system_a -> system
vendor_a -> vendor
system_b -> (eliminated)
vendor_b -> (eliminated)
userdata -> enlarged
Devices with AVB2 need to repurpose these partitions additionally:
Code:
dtbo_a -> dtbo
dtbo_b -> (whatever you want)
vbmeta_a -> vbmeta
vbmeta_b -> (whatever you want)
MediaTek and Unisoc devices may have few more different partitions, may need to take care of them individually.
Few OEMs may have minor differences on few partitions - for example, HTC renamed modem to radio.
I know there's one device with such paranoid partition layout, that is Blackberry Key 2 (BBF100). I was wondering if using such paranoid partition layout on other A/B devices will make it behave like A-only devices, and the answer is yes.
To readers who want to check partition table of Blackberry Key 2, please unhide following content.
Code:
Sector size (logical): 512 bytes
Disk identifier (GUID): 85AF7333-4C28-063E-1A0A-A25F7F0A55C7
Partition table holds up to 80 entries
Main partition table begins at sector 2 and ends at sector 21
First usable sector is 34, last usable sector is 122142686
Partitions will be aligned on 8-sector boundaries
Total free space is 27642 sectors (13.5 MiB)
Number Start (sector) End (sector) Size Code Name
1 40 16383 8.0 MiB FFFF padding0
2 16384 18431 1024.0 KiB FFFF traceability
3 18432 32767 7.0 MiB FFFF padding1
4 32768 40959 4.0 MiB A02A fsg
5 40960 43007 1024.0 KiB FFFF dip
6 43008 43015 4.0 KiB A021 devinfo
7 43016 43527 256.0 KiB A022 apdp
8 43528 44039 256.0 KiB A023 msadp
9 44040 44041 1024 bytes A024 dpo
10 44048 110895 32.6 MiB FFFF splash
11 110896 110903 4.0 KiB A040 limits
12 110904 112951 1024.0 KiB FFFF toolsfv
13 112952 114999 1024.0 KiB A01A ddr
14 115000 115031 16.0 KiB A01D sec
15 115032 115287 128.0 KiB FFFF storsec
16 115288 123479 4.0 MiB FFFF tunning
17 123480 123983 252.0 KiB FFFF prdid
18 123984 124487 252.0 KiB FFFF boardid
19 124488 124615 64.0 KiB FFFF vbmeta
20 124616 126663 1024.0 KiB FFFF bluetooth
21 126664 159431 16.0 MiB FFFF dsp
22 159432 224967 32.0 MiB FFFF mdtp
23 224968 356039 64.0 MiB A036 boot
24 356040 581319 110.0 MiB 0700 modem
25 581320 581327 4.0 KiB FFFF bootsig
26 581328 589823 4.1 MiB FFFF padding2
27 589824 596991 3.5 MiB A012 xbl_a
28 596992 605183 4.0 MiB A016 tz_a
29 605184 606207 512.0 KiB A018 rpm_a
30 606208 607231 512.0 KiB A017 hyp_a
31 607232 608255 512.0 KiB A01E pmic_a
32 608256 610303 1024.0 KiB FFFF keymaster_a
33 610304 612351 1024.0 KiB FFFF cmnlib_a
34 612352 614399 1024.0 KiB FFFF cmnlib64_a
35 614400 622591 4.0 MiB FFFF mdtpsecapp_a
36 622592 624639 1024.0 KiB FFFF devcfg_a
37 624640 626687 1024.0 KiB FFFF abl_a
38 626688 638975 6.0 MiB FFFF padding3
39 638976 646143 3.5 MiB FFFF xbl_b
40 646144 654335 4.0 MiB FFFF tz_b
41 654336 655359 512.0 KiB FFFF rpm_b
42 655360 656383 512.0 KiB FFFF hyp_b
43 656384 657407 512.0 KiB FFFF pmic_b
44 657408 659455 1024.0 KiB FFFF keymaster_b
45 659456 661503 1024.0 KiB FFFF cmnlib_b
46 661504 663551 1024.0 KiB FFFF cmnlib64_b
47 663552 671743 4.0 MiB FFFF mdtpsecapp_b
48 671744 673791 1024.0 KiB FFFF devcfg_b
49 673792 675839 1024.0 KiB FFFF abl_b
50 688128 704511 8.0 MiB FFFF logfs
51 704512 704513 1024 bytes A029 fsc
52 704520 704535 8.0 KiB A02C ssd
53 704536 770071 32.0 MiB A026 persist
54 770072 772119 1024.0 KiB A01F misc
55 772120 773143 512.0 KiB A02D keystore
56 773144 774167 512.0 KiB FFFF frp
57 774168 905231 64.0 MiB A025 recovery
58 905232 905239 4.0 KiB FFFF recoverysig
59 905240 946199 20.0 MiB FFFF hdcp
60 946200 1048599 50.0 MiB FFFF oempersist
61 1048600 1179671 64.0 MiB FFFF logdump
62 1179672 1183767 2.0 MiB FFFF sti
63 1183768 1445911 128.0 MiB A01C rawdump
64 1445912 1454103 4.0 MiB A027 modemst1
65 1454104 1462295 4.0 MiB A028 modemst2
66 1462296 1462807 256.0 KiB FFFF perm
67 1462808 1463319 256.0 KiB FFFF nvuser
68 1463320 1465367 1024.0 KiB FFFF metadata
69 1465368 1498135 16.0 MiB FFFF rcause
70 1498136 1522711 12.0 MiB FFFF bcota
71 1522712 1524759 1024.0 KiB FFFF blog
72 1524760 1565719 20.0 MiB FFFF bbpersist
73 1572864 9142271 3.6 GiB FFFF system
74 9142272 10780671 800.0 MiB FFFF vendor
75 10780672 13033471 1.1 GiB FFFF oem
76 13041664 15138815 1024.0 MiB A039 cache
77 15138816 122142686 51.0 GiB A03A userdata
Now let's get started with the modding procedure.
Step 1: Get the gpt_both0.bin
This can be found from your stock firmware. If it doesn't exist, you have to dump it. Take the phone with eMMC storage for example:
Code:
dd if=/dev/block/mmcblk0 of=/storage/emulated/0/gpt_both0.bin bs=512 count=67
For devices with UFS storage, you have to get gpt_both0.bin - gpt_both5.bin from stock firmware or dump from /dev/block/sda ~ /dev/block/sdf.
If it's dumped from the phone, save it to a safe place to ensure we can restore partition table anytime we want.
Step 2: Hack the gpt_both0.bin (or gpt_both*.bin for UFS storage) - rename partitions
Make a copy of the gpt_both0.bin and use Hex Editor to open the gpt_both0.bin.
The actual partition table is separated into 2 parts, one is main partition table, another is backup.
main partition table is located between these offsets: 0x400~0x43FF
backup partition table is located between these offsets: 0x4400~0x83FF
As contents of 0x400~0x43FF and 0x4400~0x83FF are identical, we just need to edit the content between 0x400~0x43FF, then copy what we have done between 0x400~0x43FF and overwrite into 0x4400~0x83FF.
Every 0x7F content between 0x400~0x43FF is information of a partition. Take this for example:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00000010 E7 1F 76 6E 50 DA DC 52 E6 6E 63 D4 6C 4D 06 C5 ç.vnPÚÜRæncÔlM.Å
00000020 00 10 10 00 00 00 00 00 FF 0F 12 00 00 00 00 00 ........ÿ.......
00000030 00 00 00 00 00 00 00 00 62 00 6F 00 6F 00 74 00 ........b.o.o.t.
00000040 5F 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 _.b.............
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x0~0x1F - GUID of the partition.
0x20~0x27 - Begin offset in reversed order. The unit is KiB. In this case, the begin offset is 0x0000000000101000.
0x28~0x2F - End offset in reversed order. In this case, the end offset is 0x0000000000120FFF.
0x38~0x7F - Partition label. Every character of the partition label need to be separated with 0x00.
Always remember to use the calculator came with BASE-N function (including Windows Calculator and many high-end scientific calculator) to calculate the length of partitions, so we can resize in the next step.
In this part, we will need to rename few partitions.
Take the boot_a and boot_b partitions for example. Just simply rename the partition label.
Before:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00001D80 86 7F 11 20 85 E9 57 43 B9 EE 37 4B C1 D8 48 7D †.. …éWC¹î7KÁØH}
00001D90 12 B0 CE 25 F6 D5 85 67 BC 87 81 4E 99 D2 CD 24 .°Î%öÕ…g¼‡.N™ÒÍ$
00001DA0 00 10 0E 00 00 00 00 00 FF 0F 10 00 00 00 00 00 ........ÿ.......
00001DB0 00 00 00 00 00 00 00 00 62 00 6F 00 6F 00 74 00 ........b.o.o.t.
00001DC0 5F 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 _.a.............
00001DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E00 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00001E10 E7 1F 76 6E 50 DA DC 52 E6 6E 63 D4 6C 4D 06 C5 ç.vnPÚÜRæncÔlM.Å
00001E20 00 10 10 00 00 00 00 00 FF 0F 12 00 00 00 00 00 ........ÿ.......
00001E30 00 00 00 00 00 00 00 00 62 00 6F 00 6F 00 74 00 ........b.o.o.t.
00001E40 5F 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 _.b.............
00001E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
After:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00001D80 86 7F 11 20 85 E9 57 43 B9 EE 37 4B C1 D8 48 7D †.. …éWC¹î7KÁØH}
00001D90 12 B0 CE 25 F6 D5 85 67 BC 87 81 4E 99 D2 CD 24 .°Î%öÕ…g¼‡.N™ÒÍ$
00001DA0 00 10 0E 00 00 00 00 00 FF 0F 10 00 00 00 00 00 ........ÿ.......
00001DB0 00 00 00 00 00 00 00 00 62 00 6F 00 6F 00 74 00 ........b.o.o.t.
00001DC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E00 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00001E10 E7 1F 76 6E 50 DA DC 52 E6 6E 63 D4 6C 4D 06 C5 ç.vnPÚÜRæncÔlM.Å
00001E20 00 10 10 00 00 00 00 00 FF 0F 12 00 00 00 00 00 ........ÿ.......
00001E30 00 00 00 00 00 00 00 00 72 00 65 00 63 00 6F 00 ........r.e.c.o.
00001E40 76 00 65 00 72 00 79 00 00 00 00 00 00 00 00 00 v.e.r.y.........
00001E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
As for modem_a and modem_b, here's what I did. You should do the same for bluetooth, dsp and mdtp partitions.
Before:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000800 A2 A0 D0 EB E5 B9 33 44 87 C0 68 B6 B7 26 99 C7 ¢*Ðëå¹3D‡Àh¶·&™Ç
00000810 2B 1D C0 46 24 90 83 B6 96 0B B5 1F 35 4B 61 FF +.ÀF$.ƒ¶–.µ.5Kaÿ
00000820 00 10 02 00 00 00 00 00 FF 7F 05 00 00 00 00 00 ........ÿ.......
00000830 00 00 00 00 00 00 00 10 6D 00 6F 00 64 00 65 00 ........m.o.d.e.
00000840 6D 00 5F 00 61 00 00 00 00 00 00 00 00 00 00 00 m._.a...........
00000850 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000860 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000880 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00000890 E7 52 D4 C9 31 F9 55 9D F6 A4 56 78 36 07 85 99 çRÔÉ1ùU.ö¤Vx6.…™
000008A0 00 80 05 00 00 00 00 00 FF EF 08 00 00 00 00 00 .€......ÿï......
000008B0 00 00 00 00 00 00 00 10 6D 00 6F 00 64 00 65 00 ........m.o.d.e.
000008C0 6D 00 5F 00 62 00 00 00 00 00 00 00 00 00 00 00 m._.b...........
000008D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000008E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000008F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
After:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000800 A2 A0 D0 EB E5 B9 33 44 87 C0 68 B6 B7 26 99 C7 ¢*Ðëå¹3D‡Àh¶·&™Ç
00000810 2B 1D C0 46 24 90 83 B6 96 0B B5 1F 35 4B 61 FF +.ÀF$.ƒ¶–.µ.5Kaÿ
00000820 00 10 02 00 00 00 00 00 FF 7F 05 00 00 00 00 00 ........ÿ.......
00000830 00 00 00 00 00 00 00 10 6D 00 6F 00 64 00 65 00 ........m.o.d.e.
00000840 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 m...............
00000850 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000860 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000880 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00000890 E7 52 D4 C9 31 F9 55 9D F6 A4 56 78 36 07 85 99 çRÔÉ1ùU.ö¤Vx6.…™
000008A0 00 80 05 00 00 00 00 00 FF EF 08 00 00 00 00 00 .€......ÿï......
000008B0 00 00 00 00 00 00 00 10 65 00 6C 00 69 00 6D 00 ........e.l.i.m.
000008C0 69 00 6E 00 61 00 74 00 65 00 64 00 5F 00 6D 00 i.n.a.t.e.d._.m.
000008D0 6F 00 64 00 65 00 6D 00 5F 00 62 00 00 00 00 00 o.d.e.m._.b.....
000008E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000008F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
For devices with AVB2 enabled, you should know how to repurpose dtbo and vbmeta partitions.
Step 3: Eliminate system_b, vendor_b, and repurpose remaining partitions
This depends on how your phone originally partitioned. In many cases for devices with eMMC storage, system_a, system_b, vendor_a, vendor_b and userdata are 5 last partitions of the phone.
Take this one for example. Before:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002C00 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002C10 42 C8 9A 2C 46 11 33 9D C7 90 B8 74 F4 FC F6 4B BÈš,F.3.Ç.¸tôüöK
00002C20 18 EC 1F 00 00 00 00 00 17 EC 6F 00 00 00 00 00 .ì.......ìo.....
00002C30 00 00 00 00 00 00 00 00 73 00 79 00 73 00 74 00 ........s.y.s.t.
00002C40 65 00 6D 00 5F 00 61 00 00 00 00 00 00 00 00 00 e.m._.a.........
00002C50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C80 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00002C90 D2 4C 63 24 6E 37 13 6F 57 5B 73 4A B3 8A 93 EC ÒLc$n7.oW[sJ³Š“ì
00002CA0 18 EC 6F 00 00 00 00 00 17 EC BF 00 00 00 00 00 .ìo......ì¿.....
00002CB0 00 00 00 00 00 00 00 00 73 00 79 00 73 00 74 00 ........s.y.s.t.
00002CC0 65 00 6D 00 5F 00 62 00 00 00 00 00 00 00 00 00 e.m._.b.........
00002CD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D00 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002D10 87 4C 96 DB C8 A9 3F 76 E8 BF FF 62 5B A4 42 20 ‡L–ÛÈ©?vè¿ÿb[¤B
00002D20 00 00 C0 00 00 00 00 00 FF FF CF 00 00 00 00 00 ..À.....ÿÿÏ.....
00002D30 00 00 00 00 00 00 00 10 76 00 65 00 6E 00 64 00 ........v.e.n.d.
00002D40 6F 00 72 00 5F 00 61 00 00 00 00 00 00 00 00 00 o.r._.a.........
00002D50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D80 D4 6C 03 77 D5 03 BB 42 8E D1 37 E5 A8 8B AA 34 Ôl.wÕ.»BŽÑ7娋ª4
00002D90 21 A8 AB 40 79 5E 89 16 78 16 A6 B6 17 D7 EA 01 !¨«@y^‰.x.¦¶.×ê.
00002DA0 00 00 D0 00 00 00 00 00 FF FF DF 00 00 00 00 00 ..Ð.....ÿÿß.....
00002DB0 00 00 00 00 00 00 00 10 76 00 65 00 6E 00 64 00 ........v.e.n.d.
00002DC0 6F 00 72 00 5F 00 62 00 00 00 00 00 00 00 00 00 o.r._.b.........
00002DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E00 E6 E7 81 1B 0D F5 9B 41 A7 39 2A EE F8 DA 33 35 æç...õ›A§9*îøÚ35
00002E10 9C 19 0C DB 03 B2 D8 DB 79 62 74 EB F6 88 6D C7 œ..Û.²ØÛybtëöˆmÇ
00002E20 00 00 E0 00 00 00 00 00 FF FF DF 00 00 00 00 00 ..à.....ÿÿß.....
00002E30 00 00 00 00 00 00 00 00 75 00 73 00 65 00 72 00 ........u.s.e.r.
00002E40 64 00 61 00 74 00 61 00 00 00 00 00 00 00 00 00 d.a.t.a.........
00002E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
We need to move 0x2D00~0x2D7F to 0x2C80~0x2CFF, and 0x2E00~0x2E7F to 0x2D00~0x2D7F, then fill 0x2D80~2E70 with 0x00.
And of course, rename system_a to system, vendor_a to vendor.
And here's the result:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002C00 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002C10 42 C8 9A 2C 46 11 33 9D C7 90 B8 74 F4 FC F6 4B BÈš,F.3.Ç.¸tôüöK
00002C20 18 EC 1F 00 00 00 00 00 17 EC 6F 00 00 00 00 00 .ì.......ìo.....
00002C30 00 00 00 00 00 00 00 00 73 00 79 00 73 00 74 00 ........s.y.s.t.
00002C40 65 00 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 e.m.............
00002C50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C80 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002C90 87 4C 96 DB C8 A9 3F 76 E8 BF FF 62 5B A4 42 20 ‡L–ÛÈ©?vè¿ÿb[¤B
00002CA0 00 00 C0 00 00 00 00 00 FF FF CF 00 00 00 00 00 ..À.....ÿÿÏ.....
00002CB0 00 00 00 00 00 00 00 10 76 00 65 00 6E 00 64 00 ........v.e.n.d.
00002CC0 6F 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 o.r.............
00002CD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D00 E6 E7 81 1B 0D F5 9B 41 A7 39 2A EE F8 DA 33 35 æç...õ›A§9*îøÚ35
00002D10 9C 19 0C DB 03 B2 D8 DB 79 62 74 EB F6 88 6D C7 œ..Û.²ØÛybtëöˆmÇ
00002D20 00 00 E0 00 00 00 00 00 FF FF DF 00 00 00 00 00 ..à.....ÿÿß.....
00002D30 00 00 00 00 00 00 00 00 75 00 73 00 65 00 72 00 ........u.s.e.r.
00002D40 64 00 61 00 74 00 61 00 00 00 00 00 00 00 00 00 d.a.t.a.........
00002D50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
You might have noticed, there're two huge gaps between system and vendor, vendor and userdata, so we need to edit the offset of vendor and userdata to eliminate the huge gaps.
In this case, the end offset of system partition is 0x00000000006FEC17. Therefore, the begin offset of vendor partition should be at least 0x00000000006FEC18. Just take note.
The original offset of vendor partition is 0x0000000000C00000~0x0000000000CFFFFF. It's not hard to get the length of vendor partition is 0xFFFFF.
With the help of calculator, we can get the new end offset of vendor partition is 0x00000000007FEC17.
As for userdata partition, the begin offset need to be at least 0x00000000007FEC18, but for end offset need to be the same to vendor partition. Therefore, bootloader will use allocate all of remaining storage space to userdata.
(This is for the most of cases, if userdata is the last partition of your phone)
Now we get new offset of vendor and userdata partition:
vendor: 0x00000000006FEC18~0x00000000007FEC17
userdata: 0x00000000007FEC18~0x00000000007FEC17
Input them into the partition table.
So the result is:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002C00 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002C10 42 C8 9A 2C 46 11 33 9D C7 90 B8 74 F4 FC F6 4B BÈš,F.3.Ç.¸tôüöK
00002C20 18 EC 1F 00 00 00 00 00 17 EC 6F 00 00 00 00 00 .ì.......ìo.....
00002C30 00 00 00 00 00 00 00 00 73 00 79 00 73 00 74 00 ........s.y.s.t.
00002C40 65 00 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 e.m.............
00002C50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002C80 11 B0 D7 97 DA 54 35 48 B3 C4 91 7A D6 E7 3D 74 .°×—ÚT5H³Ä‘zÖç=t
00002C90 87 4C 96 DB C8 A9 3F 76 E8 BF FF 62 5B A4 42 20 ‡L–ÛÈ©?vè¿ÿb[¤B
00002CA0 18 EC 6F 00 00 00 00 00 17 EC 7F 00 00 00 00 00 .ìo......ì......
00002CB0 00 00 00 00 00 00 00 10 76 00 65 00 6E 00 64 00 ........v.e.n.d.
00002CC0 6F 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 o.r.............
00002CD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002CF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D00 E6 E7 81 1B 0D F5 9B 41 A7 39 2A EE F8 DA 33 35 æç...õ›A§9*îøÚ35
00002D10 9C 19 0C DB 03 B2 D8 DB 79 62 74 EB F6 88 6D C7 œ..Û.²ØÛybtëöˆmÇ
00002D20 7F EC 18 00 00 00 00 00 7F EC 17 00 00 00 00 00 .ì.......ì......
00002D30 00 00 00 00 00 00 00 00 75 00 73 00 65 00 72 00 ........u.s.e.r.
00002D40 64 00 61 00 74 00 61 00 00 00 00 00 00 00 00 00 d.a.t.a.........
00002D50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002D90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Step 4: Copy what we have done to backup partition table, and save it as "gpt_main0.mod.bin"
Pretty simple. Copy the content between 0x400~0x43FF and overwrite it from 0x4400, so the backup partition table will get the same result.
Now save it as "gpt_main0.mod.bin".
Step 5: Flash it to your phone and check result
This may require your phone get critical unlocked (fastboot flashing unlock_critical).
Before you flash, you can use this command to check what are the partitions originally be:
For macOS / Linux distro:
Code:
fastboot getvar all|grep partition-size
For Windows:
Code:
fastboot getvar all 2>&1|findstr partition-size
Flash it with this command:
Code:
fastboot flash partition /path/to/gpt_main0.mod.bin
fastboot reboot-bootloader
For devices with UFS storage (take partition table of lun3 for example):
Code:
fastboot flash partition:3 /path/to/gpt_main3.mod.bin
fastboot reboot-bootloader
After that, you can use this command to check the result:
For macOS / Linux distro:
Code:
fastboot getvar all|grep partition-size
For Windows:
Code:
fastboot getvar all 2>&1|findstr partition-size
If values changed to what you have expected (unit is bytes), then the modification is successful.
From what I have tested, flash existing TWRP to recovery partition and boot it with recovery mode combination key will make the phone boot to TWRP successfully, and it can still mount system/vendor partitions - no modifications need to be done.
However, the phone will not boot with unmodified boot image, may need to modify fstab and init.rc to ensure it will boot on such environment, and this is up to developers.
If you only want to minimalize the system_b and vendor_b for maximum compatibility, then you cannot rename partitions, only resize can be done. You can allocate at least 1KiB for system_b and vendor_b to gain extra storage spaces for userdata.
Click to expand...
Click to collapse
That wraps up the entire guide, and I hope it could be helpful for custom ROM development.

Reserved #1

Reserved #2

What device(s) have you tested this on?

MishaalRahman said:
What device(s) have you tested this on?
Click to expand...
Click to collapse
Nokia 6.1 Plus, a.k.a Nokia X6 in China.
In theory this will also work on Nokia 6.1, Nokia 7, Nokia 7 Plus and Nokia 7.1.
I have never tested devices with UFS storage yet.