Database Info

HOWTO: Unpack, Edit, and Repack Boot Images

Several people have already figured out the details on their own, but I have gotten requests to do a more comprehensive tutorial on how the boot and recovery images are structured, and how you can edit them.
Background
Your phone has several devices which hold different parts of the filesystem:
Code:
#cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 04380000 00020000 "system"
mtd4: 04380000 00020000 "cache"
mtd5: 04ac0000 00020000 "userdata"
In this tutorial, we will deal with "recovery" and "boot". The "boot" device holds the files that are automatically loaded onto the root of your filesystem every time you boot (details below).
"system" holds everything that gets mounted in your system/ directory, and userdata/ is everything that shows up in data/ (this is all the apps you've installed, your preferences, etc).
The recovery and boot partitions are at /dev/mtd/mtd1 and /dev/mtd/mtd2, and before you do anything else you should back these up (note: this may not be the best way of doing this because it may not deal properly with bad blocks etc, but it's all we've got until somebody comes up with a better method, and besides you will probably be restoring from update.zip anyway):
Code:
# cat /dev/mtd/mtd1 > /sdcard/mtd1.img
# cat /dev/mtd/mtd2 > /sdcard/mtd2.img
The other thing you should do is put your favorite update.zip file into the root directory of your sd card so that if you screw up your boot partition you can boot into recovery mode and re-apply the update. You probably want one of the pre-rooted recovery images found elsewhere on the forums.
There is also another important file you should know about. In /system/recovery.img there is a full copy of everything that is loaded on mtd1. This file is automatically flashed onto mtd1 every time you shut down. That means two things: 1. Any changes you make directly to /dev/mtd/mtd1 get blown away on reboot and 2. If you want to change /dev/mtd/mtd1 you're probably better off just sticking the image in /system/recovery.img and rebooting. When creating your own custom update.zip files (especially when adapting the stock images), you can get tripped up if you forget to replace /system/recovery.img and it ends up overwriting /dev/mtd/mtd1 unbeknownst to you. Watch out.
Structure of boot and recovery images
The boot and recovery images are not proper filesystems. Instead, they are a custom android format consisting of a 2k header, followed by a gzipped kernel, followed by a ramdisk, followed by a second stage loader (optional, we have not seen these in the wild yet). This structure is outlined in mkbootimg.h:
Code:
+-----------------+
| boot header | 1 page
+-----------------+
| kernel | n pages
+-----------------+
| ramdisk | m pages
+-----------------+
| second stage | o pages
+-----------------+
n = (kernel_size + page_size - 1) / page_size
m = (ramdisk_size + page_size - 1) / page_size
o = (second_size + page_size - 1) / page_size
0. all entities are page_size aligned in flash
1. kernel and ramdisk are required (size != 0)
2. second is optional (second_size == 0 -> no second)
A ramdisk is basically a small filesystem containing the core files needed to initialize the system. It includes the critical init process, as well as init.rc, which is where you can set many system-wide properties. If you really want to know more about it, here is the documentation. Here's a list of files on a typical ramdisk:
Code:
./init.trout.rc
./default.prop
./proc
./dev
./init.rc
./init
./sys
./init.goldfish.rc
./sbin
./sbin/adbd
./system
./data
The recovery image typically has a few extra files, which constitute the recovery binary and supporting files (the application that gets run if you hold down home+power when rebooting). These files are:
Code:
./res
./res/images
./res/images/progress_bar_empty_left_round.bmp
./res/images/icon_firmware_install.bmp
./res/images/indeterminate3.bmp
./res/images/progress_bar_fill.bmp
./res/images/progress_bar_left_round.bmp
./res/images/icon_error.bmp
./res/images/indeterminate1.bmp
./res/images/progress_bar_empty_right_round.bmp
./res/images/icon_firmware_error.bmp
./res/images/progress_bar_right_round.bmp
./res/images/indeterminate4.bmp
./res/images/indeterminate5.bmp
./res/images/indeterminate6.bmp
./res/images/progress_bar_empty.bmp
./res/images/indeterminate2.bmp
./res/images/icon_unpacking.bmp
./res/images/icon_installing.bmp
./sbin/recovery
Unpacking, Editing, and Re-Packing the images
Note: below I give you the details for unpacking and repacking manually, but I have attached two perl scripts that do most of this for you
If you are good with a hex editor, you can open up any of these images and strip off the first 2k of data. Then, look for a bunch of zeroes followed by the hex 1F 8B (which is the magic number of a gzip file). Copy everything from the first line of the file, through the zeroes, and stopping at the 1F 8B. That is the kernel. Everything from the 1F 8B through the end is the ramdisk. You could save each of these files separately. In order to see the contents of the ramdisk, you need to un-gzip it and then un-cpio it. You could use a command like this (ideally after creating a new directory and cd'ing into it):
Code:
gunzip -c ../your-ramdisk-file | cpio -i
That will place all of the files from the ramdisk in your working directory. You can now edit them.
In order to re-create the ramdisk, you need to re-cpio them and re-gzip those files, with a command like the following (remember, cpio will include everything in the current working directory, so you probably want to remove any other cruft you might have in there):
Code:
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
The final step is to combine the kernel and your new ramdisk into the full image, using the mkbootimg program (which you should download and compile from the git repository):
Code:
mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel your-kernel-file --ramdisk newramdisk.cpio.gz -o mynewimage.img
Now, there's a lot of hassle in pulling apart files in hex editors and remembering all of these commands, so I wrote unpack and repack perl scripts for you (attached). Hooray.
Flashing your new image back onto the phone
You will probably only ever be flashing boot images directly to the phone, given the fact that /system/recovery.img automatically flashes the recovery device for you (as noted above). If you have created a new recovery image, just stick it in /system/recovery.img and reboot. If you are flashing a boot image, stick it on your phone via adb (a tool included in the Android SDK):
Code:
adb push ./mynewimage.img /sdcard
Then, open a shell to your phone via 'adb shell', get root, and do the following two commands to flash your new boot image:
Code:
# cat /dev/zero >> /dev/mtd/mtd2
write: No space left on device [this is ok, you can ignore]
# flash_image boot /sdcard/mynewimage.img
Reboot.
If your phone starts all the way up, congratulations. If not, you did something wrong and you'll need to boot into recovery mode and apply your update.zip file (reboot while holding down home+power, when you get the recovery screen press alt+L and then alt+S).
Something fun to do with your new found power
If you place a file titled initlogo.rle in the root directory of your boot image, the phone will display this image upon boot (after the "G1" image and before the Android animation). In order to create this file, you need to create a 320x480 image in Photoshop or Gimp and save it as a "raw image" file. You then need to compress that image with the program to565. More details on that here.
This is not the same thing as applying an update.zip
You will see other places on the forums that describe how to create customized update.zip files, as well as update.zip files that people are sharing. For example, there is a recent update.zip which is a modified version of rc30 (with the anti-root aspects disabled). The update.zip files include new boot images, recovery images, and typically replacements for the entire system/ directory as well as other updates. If you are creating a custom boot or recovery image, it is typically a good idea to start with the image distributed with the most recent update you have applied (flashing an image from an older release could have unintended consequences).
Questions?

hooray! you're awesome

Where does boot.img flash? What is the corresponding part of the system?

Dimath said:
Where does boot.img flash? What is the corresponding part of the system?
Click to expand...
Click to collapse
I'm not sure what exactly you mean, but when you do flash_image boot imagefile.img it will write imagefile.img to /dev/mtd/mtd2, which is where your phone looks for the boot files. Did that answer your question?

For your command...
Code:
cat /dev/zero >> /dev/mtd/mtd2
Do you mean
Code:
cat /dev/zero > /dev/mtd/mtd2
?
The idea being that you erase flash in the version with one '>', whereas you... append to the end of a device in the version with two '>'s? I can see the utility of erasing flash with one '>' but appending seems... odd. Am I missing something?

Is this any different than using the Dalvik Debug Monitor (DDMS) file manager found the the Android SDK? I'm able to push, pull, and delete files on my G1 with no problem.

Would this be the only way to rebuild a system app (i.e. Settings.apk) with more debug (Log. to extract via adb logcat over usb), then rebuild the entire system.img, then flash into the G1?

eckzow said:
For your command...
Code:
cat /dev/zero >> /dev/mtd/mtd2
Do you mean
Code:
cat /dev/zero > /dev/mtd/mtd2
?
The idea being that you erase flash in the version with one '>', whereas you... append to the end of a device in the version with two '>'s? I can see the utility of erasing flash with one '>' but appending seems... odd. Am I missing something?
Click to expand...
Click to collapse
I think you're right. I copied that from somebody else's instructions and it certainly seems to make more sense with one '>'. Anybody know for sure?
In any event, this is unnecessary in most cases because flash_image should overwrite the whole thing. The only exception is when you have an identical header on your image to the one that is already on the device. This shouldn't happen in my instructions (mkbootimg creates a header that includes the build timestamp) but I kept the instruction there just for good measure.

andonnguyen said:
Is this any different than using the Dalvik Debug Monitor (DDMS) file manager found the the Android SDK? I'm able to push, pull, and delete files on my G1 with no problem.
Click to expand...
Click to collapse
The adb push command I gave is no different, but you would still have to unpack/repack and flash_image according to my instructions.

I've tried these instructions on RC30 1.3. Basically I extracted, unpacked, and repacked, just to see if it would work. The resultant file is too large; it fails when you run flash_image.

I'm trying to modify my boot image of my ADP1 using the perl scripts, but I receive the following warning while decompressing the ramdisk:
Code:
$ unpack-bootimg.pl mtd2.img
kernel written to mtd2.img-kernel.gz
ramdisk written to mtd2.img-ramdisk.cpio.gz
removed old directory mtd2.img-ramdisk
[B]gzip: ../mtd2.img-ramdisk.cpio.gz: decompression OK, trailing garbage ignored
462 blocks[/B]
extracted ramdisk contents to directory mtd2.img-ramdisk/
Is this warning expected? Is safe to continue?
Also, I've found that the size of the modified packed image is far smaller than the original one
Code:
$ ll mtd2.img mtd2-modified.img
-rwx------ 1 ris ris 2621440 2009-01-07 19:19 mtd2.img
-rw-r--r-- 1 ris ris 1533952 2009-01-07 20:49 mtd2-modified.img
Update: I've tried anyway.
For the record, I've obtained the boot.img using cat, uncompressed with the perl script, modified default.prop, repacked with the perl script.
As you see from the code above, the img file is much smaller (Opening with a hex editor you can see that the end of the original image is full of 0xFF, so I believe it's ok, both the gzip warning and the different file sizes).
Reflashed it from recovery mode, using
fastboot flash boot mt2-modified.img
fastboot reboot
... and worked flawlessly
I'm leaving the coment for future references.
Thanks for the tutorial

[RiS] said:
gzip: ../mtd2.img-ramdisk.cpio.gz: decompression OK, trailing garbage ignored
462 blocks
Is this warning expected? Is safe to continue?
Click to expand...
Click to collapse
Yes, you would expect trailing zeroes, which would give you that error. The trailing zeroes exist in order to pad the image size to the nearest page boundary. They are added by mkbootimg.
[RiS] said:
Also, I've found that the size of the modified packed image is far smaller than the original one
As you see from the code above, the img file is much smaller (Opening with a hex editor you can see that the end of the original image is full of 0xFF, so I believe it's ok, both the gzip warning and the different file sizes).
Click to expand...
Click to collapse
Yep, that's exactly why. Nothing to worry about.
Thanks for the informative clarification.

alansj said:
There is also another important file you should know about. In /system/recovery.img there is a full copy of everything that is loaded on mtd1. This file is automatically flashed onto mtd1 every time you shut down. That means two things: 1. Any changes you make directly to /dev/mtd/mtd1 get blown away on reboot and 2. If you want to change /dev/mtd/mtd1 you're probably better off just sticking the image in /system/recovery.img and rebooting.
Click to expand...
Click to collapse
I'm using an stock ADP1, and the file /system/recovery.img does not exist. Is this expected?
Also, I've found out in JFv.1.31 that the recovery image is in /data/recovery.img (although there is no /data/recovery.img in my ADP1 neither..)

[RiS] said:
I'm using an stock ADP1, and the file /system/recovery.img does not exist. Is this expected?
Also, I've found out in JFv.1.31 that the recovery image is in /data/recovery.img (although there is no /data/recovery.img in my ADP1 neither..)
Click to expand...
Click to collapse
It deletes it after it flashes on the first bootup after you apply the update.

JesusFreke said:
It deletes it after it flashes on the first bootup after you apply the update.
Click to expand...
Click to collapse
Are you refering to /data/recovery.img or /system/recovery.img? or both?

[RiS] said:
Are you refering to /data/recovery.img or /system/recovery.img? or both?
Click to expand...
Click to collapse
I'm referring to /data/recovery.img in JFv1.2 and up (although there was a bug in the RC8 version of JFv1.2 that prevented it from being deleted)

So is there any reason why there is no /system/recovery.img on my ADP1?

When I use the unpack script on JF1.31 boot.img, it prints out like this:
"Could not find any embedded ramdisk images. Are you sure this is a full boot image?"
Any help?

[RiS] said:
So is there any reason why there is no /system/recovery.img on my ADP1?
Click to expand...
Click to collapse
Stock or JFv1.3?

JesusFreke said:
Stock or JFv1.3?
Click to expand...
Click to collapse
"Stock". I've just modified boot img to change default.prop

[GUIDE] Changing the Bootloader Graphic

WARNING: This guide involves modifying your phone's boot loader and may brick your phone if done incorrectly. It is most likely to soft brick your phone if something goes wrong, meaning it should be recoverable.
NOTE: This guide instructs how to replace the boot graphic in the boot loader but does not modify the kernel graphic. Doing this requires compiling the kernel.
Prerequisites:
Heimdall or Odin, with appropriate drivers. (The guide is for Heimdall)
A replacement.jpg graphic that is not greater than 68,849 bytes. The file should be 480x800.
A copy of param.lfs for your phone. This file is included in the Heimdall one-click packages, and probably other places.
Running Gingerbread bootloaders.
Steps:
Open both replacement.jpg and param.lfs in a hex editor.
Go to offset 532480 in param.lfs. At this location, there should be a JPG beginning of file (BOF) marker FF D8.
Verify that offset 601327 contains the JPG end of file (EOF) marker, FF D9. There are other JPG BOF and EOF markers between these two offsets because this JPG file contains embedded thumbnails for some stupid reason.
Go back to offset 532480. Use your hex editor to paste the contents of replacement.jpg into param.lfs at offset 532480 in overwrite mode. Use of overwrite mode will ensure that the file does not change size and other offsets are not affected. Use of a replacement.jpg less than 68,849 bytes ensures that other data within param.lfs is not overwritten.
Save new file as param2.lfs. Verify it is the same size as param.lfs
Heimdall:
Ensure that Heimdall, the Heimdall front-end, and appropriate drivers are installed.
Connect your phone via USB and start the Heimdall front-end.
Under the Utilities tab, click Save As and save your PIT as device.pit.
Click Download.
Under Flash tab, in the PIT subwindow, click Browse and select device.pit.
Click Add in the Partitions (Files) subwindow, and select PARAM from the Partition Details subwindow. NOTE: if you do not select the PARAM partition, there is potential to hard brick your device when you flash.
Click Browse in the File subwindow, and select your modified param2.lfs. NOTE: If your param2.lfs is corrupted, or if the flash otherwise fails, your device will be soft bricked and your device will be in download mode (although it will not have the familiar yellow screen). Attempt to reflash the PARAM partition with param.lfs.
Verify that PARAM is selected in the Partition Details subwindow. Click Start to flash param2.lfs with Heimdall to the PARAM partition.
Credit:
hexedit method: http://forum.xda-developers.com/showthread.php?t=1315401

These are some handy utility functions I wrote in Python.
This script finds most of the JPG files in param.lfs. It will choke on JPG files with embedded images.
Code:
import re
jpg = re.compile(b'\xff\xd8.*?\xff\xd9', re.DOTALL);
data = open('param.lfs','rb').read()
jpgs = re.findall(jpg, data)
for i,image in enumerate(jpgs):
open( str(i)+'.jpg', 'wb' ).write(image)
This lists all the JPG BOF and EOF file markers. Helps for spotting images with embedded thumbnails.
Code:
import re
import binascii
jpg = re.compile(b'\xff[\xd8\xd9]', re.DOTALL);
data = open('param.lfs','rb').read()
markers = re.findall(jpg, data)
for i, m in enumerate(markers):
print "%i: %s" % (i, binascii.hexlify(m))

An update to this post. I have written a script which is run on your desktop with a Python installation that perofrms the modification of the param.lfs binary. Attached to this post is a package containing (1) logoreplace.py, (2) param.lfs [from GB bootloader], (3) Sgs4g.pit [also from GB bootloader].
Also, I have attached a param_acid.lfs with the Team Acid logo. This will go well with your team acid kernels.
(1) ./logoreplace.py logo.jpg param.lfs
(2) adb reboot download
(3) Run heimdall-frontend
(4) Click "Flash" tab.
(5) Browse to Sgs4g.pit. Add.
(6) Select PARAM partition.
(7) Browse to param_acid.lfs
(8) Click "Start" to flash.
Here is the code:
Code:
#!/usr/bin/env python
import sys,os
if __name__ == "__main__":
if len(sys.argv) != 3:
print "Usage: %s <logo.jpg> <param.lfs>" % (sys.argv[0],)
else:
image = open(sys.argv[1],'rb').read()
fw = open(sys.argv[2],'rb+')
if len(image) <= 68849:
fw.seek(532480)
fw.write(image)
else:
print "Image file is too long. Must be <= 68849 bytes."

@tablador How do I use the script that performs the modification of the param.lfs binary (logoreplace.zip)?
I tired running the logoreplace.py after inserting my replacement.jpg in the directory on my phone and got:
Code:
/sdcard/logoreplace.py
import: not found
/sdcard/logoreplace.py 5:syntax error word unexpected (expecting ")")
I used both methods listed in the OP as well with no luck (Did not find the offsets mentioned in the first method and was a little lost on what to copy from the replacement.jpg).
I did read both OPs that you linked to in the credits.
I using the alternate method, I received an error when trying to copy replacement.jpg (In both ADB and Terminal):
Code:
cp: can't create '/mnt/.lfs/logo_T759.jpg': file exists
I am using vb final, and bh's rc1.

thomas.raines said:
@tablador How do I use the script that performs the modification of the param.lfs binary (logoreplace.zip)?
Click to expand...
Click to collapse
Are you running the script on your phone? The script runs on your desktop via Python. Sorry if that wasn't clear. Once you create the file, you flash it using Heimdall.
Also, I removed the alternate method information. As I noted, that method was untried and untested on this phone, and from what I can tell after trying it, does not seem to work. My best guess is that phone's bootloader has the offset of that information stored directly (e.g. bypasses the filesystem) so renaming the file does not work. OP all revised to reflect this.

Yes, I ran it in python. But it didn't change anything. I also renamed my image (replacement.jpg) to logo.jpg.
I added a raw_input() to see if I could see an error or something to indicate any kind of activity.
This is the output I got:
Code:
Usage: C:\Users\mydirectory\desktop\logoreplace\logoreplace.py <logo.jpg> <param.lfs>
Which is what you have set to print. Otherwise, there are no errors. I have my logo.jpg in the same directory as the logoreplace.py. What can I possibly be doing wrong?

How exactly are you running the script? And what OS?

tablador said:
How exactly are you running the script? And what OS?
Click to expand...
Click to collapse
Windows 7 (32)
I have double clicked on it, and tried running it manually using python.exe terminal and no errors. Am I suppose to copy my logo.jpg to /mtn/.lfs?
Would it be easier to just send you my logo and you could hook it up? lol...

How exactly are you running the script? If you don't tell me, I can't figure out what the problem is. Are you typing something into the commandline in windows? If so, what?

tablador said:
How exactly are you running the script? If you don't tell me, I can't figure out what the problem is. Are you typing something into the commandline in windows? If so, what?
Click to expand...
Click to collapse
I have tried typing the code you wrote in a python terminal for windows.
I have tried just running it by double clicking on it.
I just tried it in portable ubuntu by double clicking on it, but cannot get it to run (only open in text editor). I also changed it to open with python and I Usage: /home/pubunto/Desktop/logoreplace/logoreplace.py <logo.jpg> <param.lfs>.
I would think I would need to add my logo.jpg to .mnt/.lfs so it knew what image to look for.
I just tried running the logoreplace.py via pubuntu terminal. Here is the output:
Code:
[email protected]:/home/pubuntu/Desktop/logoreplace# ./logoreplace.py <logo.jpg> param.lfs
bash: ./logoreplace.py: Permission denied
[email protected]:/home/pubuntu/Desktop/logoreplace#

thomas.raines said:
I have tried typing the code you wrote in a python terminal for windows.
I have tried just running it by double clicking on it.
I just tried it in portable ubuntu by double clicking on it, but cannot get it to run (only open in text editor). I also changed it to open with python and I Usage: /home/pubunto/Desktop/logoreplace/logoreplace.py <logo.jpg> <param.lfs>.
I would think I would need to add my logo.jpg to .mnt/.lfs so it knew what image to look for.
I just tried running the logoreplace.py via pubuntu terminal. Here is the output:
Code:
[email protected]:/home/pubuntu/Desktop/logoreplace# ./logoreplace.py <logo.jpg> param.lfs
bash: ./logoreplace.py: Permission denied
[email protected]:/home/pubuntu/Desktop/logoreplace#
Click to expand...
Click to collapse
This is what you need to type:
Code:
./logoreplace.py logo.jpg param.lfs

tablador said:
This is what you need to type:
Code:
./logoreplace.py logo.jpg param.lfs
Click to expand...
Click to collapse
Yep. Just figured that out right after I sent the output. But now it change the param.lfs icon from a text icon to an blank icon with "usage" on the top. I flahsed it with heimdall which said heimdall crashed and got a oddly colorful strip on the top of the screen and now the phone is soft bricked... lol... I checked the size of my jpeg and see that it is 3 bytes over the allocated size...lol... Going to shrink it and try again... Will keep you posted...
EDIT
I got it to work! YAY!
Thanks for your help man!
The only thing, it displays before the normal boot splash logo (logo_vibrantplus.jpg). Is there a way to either replace logo_vibrantplus.jpg, or make it display after the default boot splash?

thomas.raines said:
Yep. Just figured that out right after I sent the output. But now it change the param.lfs icon from a text icon to an blank icon with "usage" on the top. I flahsed it with heimdall which said heimdall crashed and got a oddly colorful strip on the top of the screen and now the phone is soft bricked... lol... I checked the size of my jpeg and see that it is 3 bytes over the allocated size...lol... Going to shrink it and try again... Will keep you posted...
EDIT
I got it to work! YAY!
Thanks for your help man!
The only thing, it displays before the normal boot splash logo (logo_vibrantplus.jpg). Is there a way to either replace logo_vibrantplus.jpg, or make it display after the default boot splash?
Click to expand...
Click to collapse
That image is in the kernel. You would have to do your own compile. I know how to do it but it involves setting up a toolchain. I will make a guide when I have time...
Also, it is interesting that the script didn't give you an error when the filesize was bigger than it should have been. I will check that out.

tablador said:
That image is in the kernel. You would have to do your own compile. I know how to do it but it involves setting up a toolchain. I will make a guide when I have time...
Also, it is interesting that the script didn't give you an error when the filesize was bigger than it should have been. I will check that out.
Click to expand...
Click to collapse
Oh... I have no idea about setting up a toolchain or doing anything related to the kernel... yet...lol

thomas.raines said:
Oh... I have no idea about setting up a toolchain or doing anything related to the kernel... yet...lol
Click to expand...
Click to collapse
http://forum.xda-developers.com/wiki/Samsung_Galaxy_S/SGH-T959V/Building_From_Source

@FBis251 Thanks man, but still a little above my knowledge/experience level...lol...

I have attached a modified param.lfs file. I gzipped it. This should match the latest teamacid logo pretty well. Also attached is the jpg I used, which hopefully is viewable.

tablador said:
I have attached a modified param.lfs file. I gzipped it. This should match the latest teamacid logo pretty well. Also attached is the jpg I used, which hopefully is viewable.
Click to expand...
Click to collapse
not bad. gotta love plugins that modify already made images. plus if you're using team acid's latest kernel, you'll notice that they're already using the logo i made them.
sent from within pure darkness

tablador said:
I have attached a modified param.lfs file. I gzipped it. This should match the latest teamacid logo pretty well. Also attached is the jpg I used, which hopefully is viewable.
Click to expand...
Click to collapse
I was meaning to ask you for this. I really liked the video you linked us to on IRC. It makes it look so sleek.

droidmyst said:
not bad. gotta love plugins that modify already made images. plus if you're using team acid's latest kernel, you'll notice that they're already using the logo i made them.
sent from within pure darkness
Click to expand...
Click to collapse
This image will display for the one second or two before the kernel image you made loads up. Yep, used a simple Photoshop plugin because I am not much artistically inclined, at least with photoshop. Still, this kinda gives a fade-in effect when combined with your image used as the kernel image.
http://www.youtube.com/watch?v=kxBpKKDmnFY
FB, I was thinking this could be put into any one clicks you guys made if you wanted to get this in somewhere.

Make custom bootscreen or bootlogo “ image to rle”

To make logo.rle, easier way you can use Photoshop. Create a new file or new pictures as you want, setting the image mode to RGB, to make sure X10 image you created in the size width 480 x height 854, then save it in PNG format.
Then to change the format PNG to logo.rle, you can use a tool that was created by dooMLord "Boot screen logo creation package". I'm just more to clarify, especially for the new in this. Please download and see here:
http://forum.xda-developers.com/showthread.php?t=1140406
Prepare an image that has been created earlier.
Extract "boot_screen_logo_creation_package.rar" in a folder.
To further facilitate the work, copy the command prompt in the input to the windows/system32 folder boot screen logo creation package, put together all in one folder. Put your picture also earlier in the boot screen logo folder creation package that's already in the extract.
Change the name of your image becomes logo.png
Then click the command prompt.
Typing the following command:
convert_image_to_rle.bat <path_to_image_file>
Replace <path_to_image_file> the image file name that you create.
Example: convert_image_to_rle.bat logo.png
It will be two image files: logo.png.raw and logo.png.rle
Now you should have your own logo.rle.
Change the name logo.png.rle be logo.rle
This image is ready you are using, and can be inserted into your ramdisk.
To enter the drawing logo.rle you have made this into a ramdisk
Have a look at this post:
http://forum.xda-developers.com/showthread.php?t=1683832
Hope this helps.
Thanks to: Xda-developers
dooMLord : for boot_screen_logo_creation_package
And you all ..

Getting image out of splash.img

OK. This is a bit embarrassing. I created a splash screen 2 years ago from scratch. But, I didn't keep the original image I used to make it. I have the splash.img. I want to extract the original image from it. Can someone share the method of doing this? Thank you.

First youll have to re add the extention .nb at the end of the file. For example splash.img is kade to splash.img.nb then you Just reverse the command you used to convert to to a splash image
So instead of nbimg -F splash.bmp etc
You'll use nbimg -f splash.img.nb etc

marsdta said:
First youll have to re add the extention .nb at the end of the file. For example splash.img is kade to splash.img.nb then you Just reverse the command you used to convert to to a splash image
So instead of nbimg -F splash.bmp etc
You'll use nbimg -f splash.nb etc
Click to expand...
Click to collapse
Thanks! I tried that before, but I didn't know I had to add .nb extension to it first. I appreciate your help.

[GUIDE][TOOL]Nexus 9 Splash Screen Tool v1.6

This is a Windows batch script that converts png, jpg, bmp, or tif images into a raw rgb565 image, then flashes it to your Nexus 9 to replace the stock Google Splash Screen. With version 1.6 this script will work with any resolution image; using some built in scaling, cropping, and rotating. I have successfully tested this on my Wifi 32 GB Nexus 9 using Windows 7 Home Premium, but the batch file should work for all versions of Windows, even XP.
If you do not have windows and want instructions on how to do this manually, click the button below.
Make sure you have fastboot.exe, adb.exe, and your raw rgb565 image that you want to use in the same folder. Issue this command:
Code:
adb reboot bootloader
Please verify that you are in "FASTBOOT USB" mode and not "HBOOT"
In the next command replace imagefile.raw with the name of the raw file you want to use.
Please verify that your raw image is 6291456 bytes in size. This is checked for in my script, but you need to check it!
Why?? Because total pixels (1536*2048=3145728) * Bpp (2) = 6291456​
Code:
fastboot flash splash1 [i]imagefile.raw[/i]
fastboot reboot
That's it!​
You need to have an unlocked bootloader.
You have to have your necessary ADB drivers installed and functioning correctly.
You have to unzip the n9splash1.6.zip file into a new directory.
You can use pngs, bmps, jpgs, tifs, ....Pretty much any common format
To use, just drag and drop your image onto the n9splash.bat file
Make sure your Nexus is turned on and plugged into your computer
Follow the prompts from there
This download contains the programs ffmpeg.exe, adb.exe, & fastboot.exe.
It also contains my batch script, which can be viewed in the following post.
Notes:
To flash back to stock with v1.6, just open the "sys" folder. Inside is a "stock.bat" file. Run it, and of course make sure your device is plugged in to your computer and that your device is on.
With v1.6 you can also flash raw rgb565 files. The catch is that they have to already be the correct size, in bytes. There is no image information (like width, height, headers,...) in raw files as they are nothing but pixel data. So I can't take a raw file of yours and turn it into a ....x.... 2bpp image without knowing what the original width and pixel format is.
I check the size of the file several times before it is ever flashed, so you don't have to worry about a bad conversion being flashed.
Believe it or not the file size is the most important thing, it does not matter one bit what the file contains. But if it is 6291456 bytes, guess what? You are gonna have a new splash screen. It might look like a snow storm on your grandmothers TV, but there is no difference in rgb565 data and an executable files data, there is still 8 bits in a byte and that byte still has the same potential values.:cyclops:
If you don't care to see your images open up before rotating, or before reconverting and showing them to you before flashing, you can edit the n9splash.bat file and change:
Code:
set "showbeforeflashing=yesure"
set "showbeforerotating="
If you want it to show you the image, put anything to the right of the "=" sign. If you don't want it to open the image, have nothing after the equal sign (except for the closing quote). And of course save the file after you change it.
Version 1.6 probably will not work on Windows XP. You may get it to work by editing this line at the top of the batch file:
Code:
set "usedefaultviewer="
to
Code:
set "usedefaultviewer=yes"
Changelog:
Nov 9th, 2014 v1.6
Added the ability to use any resolution photo
If image needs to be rotated, it is automatic, you just choose right or left
Added an automatic aspect checker, and scaler
Added drag and drop support for images already in rgb565 pixel format
Added the binary copy of the stock splash screen from the bootloader
Added a stock.bat program in the sys folder to quickly flash binary stock image
Added a display of the image, if it needs to be rotated
Added a conversion to png after converting your image to raw to check before flashing
Nov 7th, 2014 Initial Upload v1.0
I take no responsibility for any damage caused by you trying this.
The script can be found in the second post!
Download
Nexus 9 Splash Tool v1.6
Download
Nexus 9 Splash Tool v1.0
Below I have provided some simple examples. A negative stock one and another one using the same 'catull' font that Google uses, but with the text "Nexus IX" instead.

Code:
@echo off&setlocal enabledelayedexpansion&set "vers=1.6"&title Nexus 9 Splash Tool v!vers!&color 0b&mode con cols=78 lines=45&cls&call :drawhead
set "videofilter="
set "showbeforeflashing=yesure"
set "showbeforerotating="
set "rotatesquares="
set "usedefaultviewer="
if exist "%~dp0sys\log\imageres" del /q "%~dp0sys\log\imageres"
set /a "expected_filesize=6291456"
set /a "aspectmultiplier=100000"
set /a "expected_pixels=%expected_filesize%/2"
set "loglevel=-loglevel debug"
set "hidebanner=-hide_banner"
set "ffmlog=>>"%~dp0sys\log\ffmpeg_log.txt" 2>&1"
if "%~1"=="stock" set "image_file=%~dp0sys\stock_binary\sp1.nb0"&set "base_name=Stock Google Splash Screen"&call :stock
set "image_file=%~1"
if not exist "%image_file%" call :nofile
if not exist "%~dp0sys\log\" mkdir "%~dp0sys\log"
set "irony="
cd /d "%~dp0"
for %%? in ("%image_file%") do set "base_name=%%~n?"&set "ext=%%~x?"&set "osize=%%~z?"
if /i "%ext%"==".bmp" goto :checkres
if /i "%ext%"==".jpg" goto :checkres
if /i "%ext%"==".jpeg" goto :checkres
if /i "%ext%"==".png" goto :checkres
if /i "%ext%"==".raw" if "%osize%"=="%expected_filesize%" call :fla**** "%image_file%"
if /i "%ext%"==".rgb565" if "%osize%"=="%expected_filesize%" call :fla**** "%image_file%"
if /i "%ext%"==".nb0" if "%osize%"=="%expected_filesize%" call :fla**** "%image_file%"
if not defined irony if "%osize%"=="%expected_filesize%" call :fla**** "%image_file%"
goto :checkres
:checkres
for /f "tokens=1-8* delims=," %%a in ('sys\bin\ffmpeg -i "%image_file%" 2^>^&1^|findstr /rxic:".*stream #0:0.*[0-9][0-9]x[0-9][0-9].*"') do (
echo.%%a >"%~dp0sys\log\imageres"
echo.%%b >>"%~dp0sys\log\imageres"
echo.%%c >>"%~dp0sys\log\imageres"
echo.%%d >>"%~dp0sys\log\imageres"
echo.%%e >>"%~dp0sys\log\imageres"
echo.%%f >>"%~dp0sys\log\imageres"
echo.%%g >>"%~dp0sys\log\imageres"
echo.%%h >>"%~dp0sys\log\imageres"
)
for /f "tokens=1-3 delims=x " %%d in ('type "%~dp0sys\log\imageres"^|findstr /rxic:".*[0-9][0-9]x[0-9][0-9].*"') do (set /a "width=%%d"&set /a "width=!width: =!"&set /a "height=%%e"&set /a "height=!height: =!")
if %width% gtr %height% goto :rotate
if defined rotatesquares if %width% equ %height% goto :rotate
set /a requiredaspect=%aspectmultiplier%*1536/2048
set /a aspectratio=%aspectmultiplier%*%width%/%height%
set /a pixels=%width%*%height%
if %aspectratio% neq %requiredaspect% goto :badresolution
if %pixels% neq %expected_pixels% goto :badresolution
goto :convertit
:badresolution
if "%aspectratio%"=="%requiredaspect%" echo.Auto resizing image.&set "videofilters=-vf "scale=1536:2048""&goto :resize
cls&call :drawhead&echo.&echo. Your image doesn't meet the required resolution of 1536x2048&echo.
:changeaspect
echo. Your image aspect ratio is different from the required 3:4 aspect ratio.&echo.
if %pixels% lss %expected_pixels% echo. Keep in mind that I can make your image bigger, but I can't add detail....
echo. ____________________________________________________________________________&echo. Please choose 1 or 2 and press ENTER&echo.&echo. 1 - Resize it by stretching or shrinking image ^(aspect ratio will change^)&echo. 2 - Keep aspect, but resize and crop ^(aspect ratio will stay the same^)&echo.
set /p ihatexp=?
if "%ihatexp%"=="1" set "videofilters=-vf "scale=1536:2048""&goto :resize
if "%ihatexp%"=="2" (
if %requiredaspect% gtr %aspectratio% set "videofilters=-vf "scale=1536:-1, crop=1536:2048""
if %requiredaspect% lss %aspectratio% set "videofilters=-vf "scale=-1:2048, crop=1536:2048""
goto :resize)
goto :badresolution
:resize
set "out_path=sys\temp"
if not exist "%~dp0%out_path%\" mkdir "%~dp0%out_path%"
%ffmlog%"%~dp0sys\bin\ffmpeg.exe" %hidebanner% %loglevel% -i "%image_file%" %videofilters% -y "%~dp0%out_path%\%base_name%.png"
call "%~dpnx0" "%~dp0%out_path%\%base_name%.png"
goto :convertit
:rotate
:again
cls&call :drawhead&echo.&echo.
echo. The image has to be rotated either left or right.
if defined showbeforerotating if not defined usedefaultviewer echo. CLOSE the image when you are done to continue
echo. Please choose 1 or 2 and press ENTER&echo.
echo. ____________________________________________________________________________
echo. 1 - Rotate Image Left&echo. 2 - Rotate Image Right&echo.
if defined showbeforerotating (
ping -n 3 127.0.0.1> nul
if defined usedefaultviewer start "" "%image_file%"
if not defined usedefaultviewer rundll32 "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %image_file%
)
set /p "ihatexp= ?"
if "%ihatexp%"=="2" set "videofilters=-vf "transpose=1""&goto :ready
if "%ihatexp%"=="1" set "videofilters=-vf "transpose=2""&goto :ready
goto :again
:ready
set "out_path=sys\temp"
if not exist "%~dp0%out_path%\" mkdir "%~dp0%out_path%"
%ffmlog%"%~dp0sys\bin\ffmpeg.exe" %hidebanner% %loglevel% -i "%image_file%" %videofilters% -y "%~dp0%out_path%\%base_name%.png"
call "%~dpnx0" "%~dp0%out_path%\%base_name%.png"
exit
:convertit
cls&call :drawhead
set "out_path=sys\raw images"
if not exist "%~dp0%out_path%\" mkdir "%~dp0%out_path%"
if exist "%~dp0%out_path%\!base_name!.raw" del /q "%~dp0%out_path%\!base_name!.raw"
echo.&echo. Converting file into a raw 2 byte per pixel rgb565 image..
%ffmlog%"%~dp0sys\bin\ffmpeg.exe" %hidebanner% %loglevel% -i "%image_file%" -f rawvideo -vcodec rawvideo -pix_fmt rgb565 -y "%~dp0%out_path%\!base_name!.raw"
for %%? in ("%~dp0%out_path%\!base_name!.raw") do set /a "out_filesize=%%~z?"
if not "!out_filesize!" == "%expected_filesize%" goto :badsize
call :fla**** "%~dp0%out_path%\%base_name%.raw"
exit
:stock
for %%? in ("%~dp0sys\stock binary\sp1.nb0") do set "out_filesize=%%~z?"
cls&call :drawhead
if exist "%~dp0sys\stock binary\sp1.nb0" echo.&echo. Preparing to flash a binary copy of the stock flash screen.&call :fla**** "%~dp0sys\stock binary\sp1.nb0"
cls&call :drawhead&echo. The stock binary image is missing, please re-download program.
ping -n 4 127.0.0.1> nul
start "" http://forum.xda-developers.com/nexus-9/themes-apps/tool-splash-screen-flasher-v1-0-t2931575/post56561564#post56561564&pause>nul&exit
exit
:fla****
if not "%base_name%"=="Stock Google Splash Screen" if defined showbeforeflashing call :regen "%~1"
cls&call :drawhead&echo. ____________________________________________________________________________&echo.
"%~dp0sys\bin\adb.exe" kill-server&&echo.
echo. Your image is ready to be flashed^!
echo. Press any key to reboot to the bootloader.&&pause>nul&&echo.______________________________________________________________________________&&"%~dp0sys\bin\adb.exe" reboot bootloader&&echo.&&echo.After your bootloader screen shows up, please verify that&&echo.you are in ^"FASTBOOT USB^" mode and press enter to flash the splash image.&&pause>nul
if exist "%~1" (
for %%? in ("%~1") do set /a "out_filesize=%%~z?"
if not "!out_filesize!"=="%expected_filesize%" (goto :badsize
) else ("%~dp0sys\bin\fastboot.exe" flash splash1 "%~1"&&echo.______________________________________________________________________________&&echo.&&echo.&&echo. Done..Press any key to reboot to your new splash screen..&&pause>nul&&"%~dp0sys\bin\fastboot.exe" reboot&&"%~dp0sys\bin\adb.exe" kill-server)
) else (goto :nofile)
rd /s /q "%~dp0\sys\temp"
exit
:regen
set "out_path=sys\temp"
if not exist "%~dp0%out_path%\" mkdir "%~dp0%out_path%"
%ffmlog%"%~dp0sys\bin\ffmpeg.exe" %hidebanner% %loglevel% -f rawvideo -vcodec rawvideo -pix_fmt rgb565 -s 1536x2048 -i "%~1" -y "%~dp0%out_path%\%base_name%_test.png"
echo.&echo. This is what it looks like when it is converted back into a viewable image.
echo. Close the image when you are done to continue&ping -n 4 127.0.0.1> nul
if defined usedefaultviewer start "" "%~dp0%out_path%\%base_name%_test.png"
if not defined usedefaultviewer rundll32 "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %~dp0%out_path%\%base_name%_test.png
goto :eof
:badsize
cls&call :drawhead&echo.
echo. The image you flash has to be 1536x2048..
echo. The filesize of the raw image in turn would
echo. be %expected_filesize%.&echo.&echo.Your raw image size is !out_filesize!&echo.&echo.&echo. Press Enter to delete file and exit.&pause>nul
del /q "%~dp0%out_path%\!base_name!.raw"&"%~dp0sys\bin\adb.exe" kill-server
exit
:drawhead
echo. __________________________________________________________________________-_-
echo. ____________________________________________________________________________
echo.
echo. Nexus 9 Splash Tool: v%vers% by makers_mark
echo. ____________________________________________________________________________&echo.
if not defined image_file (echo. Loading..............) else (echo. File: "%base_name%%ext%")
if defined width if defined height echo. Resolution: %width%x%height%
if defined out_filesize (echo. Size: %out_filesize%) else (echo. Size: %osize% ^(image hasn't been converted^))
echo. Target Size: %expected_filesize%
echo. ____________________________________________________________________________
echo.
goto :eof
:nofile
cls&call :drawhead&echo.&echo. You have to drag and drop your png, bmp, or jpg file onto&echo.the %~nx0 batch file&echo.&pause>nul&"%~dp0sys\bin\adb.exe" kill-server
exit

ty
so PNG's work awesome

rename the .img to bmp

USBhost said:
rename the .img to bmp
Click to expand...
Click to collapse
Cool! thanks!

How to solve the signature mismatched problem when flash a modified bootloader.
I have read your post about Google Splash on Nexus 7. I have found out the Google logo. with your help. However, when I flash the new bootloader into my N7, I got signature mismatched problem. Do you have any experience about this situation?

Hi,
Is not working here, i drop my png in n9splash.bat and the .bat closes itself and nothing else in the files.

heyker said:
I have read your post about Google Splash on Nexus 7. I have found out the Google logo. with your help. However, when I flash the new bootloader into my N7, I got signature mismatched problem. Do you have any experience about this situation?
Click to expand...
Click to collapse
Quick note to anyone reading this thread:
This user is talking about the Nexus 7 2013, it has a totally different bootloader setup than the Nexus 9. The thread that the user is referring to is this one: http://forum.xda-developers.com/showthread.php?t=2764354​Yeah, after I figured out how the image was encoded on the Nexus 7, the first thing I did was to try to change the image. I didn't try much and here is why. The signature mismatch is a safety in fastboot. There are ways around that (like "DD"), but then you would still have to conquer the even bigger wall of Qualcomms "Secure Boot". If you are really wanting to try and change it, you would have to find some way to disable secure boot. In your bootloader screen, there is some green text that says "Secure Boot: Enabled" (or something like that), you would need it to say "Secure Boot: Disabled"
I'm not saying it isn't possible, but no one has ever shared how to do that. There is a series of file checks that happen, where one file in the bootloader checks the next (or previous) and so on. To learn more about it, please visit E:V:A's thread about the bootloader. It is real thorough and involves a lot of leaked information, because after all, it is proprietary stuff you are messing with. While you are there give him a thanks if you don't mind.:good:
Max128 said:
Hi,
Is not working here, i drop my png in n9splash.bat and the .bat closes itself and nothing else in the files.
Click to expand...
Click to collapse
What version of Windows are you trying it on? Do you for some reason have Command Extensions disabled? Can you upload the file on here, or somewhere else and send me a PM with the link?

makers_mark said:
What version of Windows are you trying it on? Do you for some reason have Command Extensions disabled? Can you upload the file on here, or somewhere else and send me a PM with the link?
Click to expand...
Click to collapse
I use windows 8.1, Here is the picture i want convert: http://i.imgur.com/meGTv5n.png

Max128 said:
I use windows 8.1, Here is the picture i want convert: http://i.imgur.com/meGTv5n.png
Click to expand...
Click to collapse
I've sucessfully flashed your image using my Windows 7 computer, and I just did it on a Windows 8 computer. I'm updating to Windows 8.1 right now, to see if that makes a difference. One possibility is that for some reason "command extensions" has been disabled on your computer. You can test it by editing the n9splash.bat file with any text editor, and insert this at the very top line above everything else.
Code:
setlocal enableextensions
(it should be on it's own line, above everything else)
Save the batch file, and try it again.

@Max128
It worked fine on Windows 8.1 too. Are you trying to do this with v1.6 or v1? Because you can't use images that are out of aspect or out of resolution on v1. You can use any image with v1.6.
EDIT:
I've attached two files.
meGTv5n.cab is the raw image that you need to flash if you want to do this manually. It is not a cabinet file like the extension suggests, it is the raw rgb565 file of your htc logo. "fastboot flash splash1 meGTv5n.cab"
meGTv5n_test.png This is how the splash would look. This is also a file that you could use on version 1.0, if that is indeed what you have.

Hi,
I add your line like you said: setlocal enableextensions , and is still not working , the command prompt closes after i drop the image and nothing. Yes i use your last version 1.6.
Now.. i have flash your meGTv5n.cab and is working great on my tablet. Thanks you!

Have you find why this does not work for me? the conversion.

Max128 said:
Have you find why this does not work for me? the conversion.
Click to expand...
Click to collapse
No. It is really hard (but not impossible) for me to fix a problem when I can't replicate the symptoms. I have drawn it up as a fluke, since It worked perfectly for me on the same OS, but I didn't know you were still interested. But, if you want to try to make it work, I do have some things to try.
Copy and paste this code below. Save it as anything.bat. DRAG a file onto it, and report if it runs, AND when it stops running, if it does.
Code:
@echo off
echo.Echo off....Press any key.
pause>nul
color 0b
echo.Color set...Press any key.
pause>nul
setlocal enabledelayedexpansion
echo.Delayed expansion enabled.....Press any key.
pause>nul
set "vers=2000"
echo.Variable set...Press any key.
pause>nul
title Nexus 9 Splash Tool v!vers!
echo.Title set....Press any key.
pause>nul
mode con cols=78 lines=45
echo.New windowsize...Press any key.
pause>nul
echo.The file you dropped is %~1
echo.Press any key.
pause>nul
echo.Did you make it this far....
pause>nul
In the meantime, I have no problem converting images for you, if you pm me the image or link.

I created a .bat with your code and I drag an image into it.
I got this:
Echo off....Press any key.
Color set...Press any key.
Delayed expansion enabled.....Press any key.
Variable set...Press any key.
Title set....Press any key.
'mode' n'est pas reconnu en tant que commande interne
ou externe, un programme exécutable ou un fichier de commandes.
New windowsize...Press any key.
The file you dropped is
Press any key.
Did you make it this far....
Also when i drag my picture in the n9splash.bat, the window closes right away but I managed to see: findstr is not recognized as an internal control ..
This can probably help.

@Max128
Yeah, that can definitely help.
Open a cmd "command" window and type:
Code:
findstr /?
does it say the same thing?

Yes the same thing.

Max128 said:
Yes the same thing.
Click to expand...
Click to collapse
If you type:
Code:
echo.%path%
into command window, is "c:\windows\system32" listed?

No is not listed how fix it?

Max128 said:
No is not listed how fix it?
Click to expand...
Click to collapse
That's the problem. In the windows command shell you have internal commands; that are built into the command shell, and you have external commands, that are actual programs (most of which are shipped with Windows, but you obviously can make your own). I always thought findstr was a built in Windows internal command, but thanks to the pros at www.dostips.com, I have found out that is is an external command. It is located at C:\Windows\system32\findstr.exe (your drive letter may vary).
Here is how you change your path in Windows. You don't want to delete everything that is already there, you just want to add "c:\windows\system32" to the path. Make sure there is a semicolon separating it and all the other variables too.