use dd to root p970! - LG Optimus 3D

Op afraid that lg might know this and patch it. I call that's a bull. I don't think lg engineer didn't know how to use dd. As long as we have unecrypted bin file we can patch it. Btw, how can one conceal a patching method using simple dd when you have unpatch file and patched file to compare? Even I managed to figure it out. Op true intention known only to himself.
So, to patch your bin file: (this is done on ubuntu, i don't know if windows got dd)
1. Download cwm at http://download.clockworkmod.com/rec...8.1.3-p970.img to the folder where you keep your bin file.
2. Open terminal and cd to the same folder as above
3. What we need to find is the location where we're suppose to copy cwm into the bin file. dd is bit-stream reader and it will show us the location in term of bytes. We need to search for ANDROID! string. So type:
dd if=LGP970AT-00-V20b-SEA-XXX-JAN-02-2012+0_AP.bin| strings -n 8 -t d| grep ANDROID!
result:
1436661 ANDROID!
1703936 ANDROID!
6422528 ANDROID!
bla..bla..bla...
4. Look of the last entry which contain the ANDROID! string and take note of its byte location (6422528 in this case)
5. Now it's time to copy cwm into the bin file. Type:
dd if=<cwm.img> bs=1 seek=<byte location> conv=notrunc of=<rom.bin>
So in this case:
dd if=recovery-clockwork-touch-5.8.1.3-p970.img bs=1 seek=6422528 conv=notrunc of=LGP970AT-00-V20b-SEA-XXX-JAN-02-2012+0_AP.bin
6. That's it. Your rom is ready to be flash using smartflash tool. You can run the same command in step 3 to verify that cwm is succesfully copied into the bin file. If at the same byte location the ANDROID! string change to [email protected] then you're good to go.
Don't waste your bandwidth to download the op's file if you can do this yourself and beside there's nothing to test, not that op modified the rom in any way. You would be better off testing huexxx zues rom imho.
http://forum.xda-developers.com/showthread.php?t=1480392&page=11

So here's the first question: where from can we find an unecrypted bin rom for our O3D?
3rd step,after the command I don't get such lines
"1436661 ANDROID!
1703936 ANDROID!
6422528 ANDROID! "
I get a count of entries instead.

Related

[HOW-TO] ROM-HACKING: init.rc ext2-auto-mount / ROM Signing / ROM Kitchen

AS MENTIONED IN THE INTRODUCTION TEXT THIS HAS ONLY BEEN TESTED ON AMON RA ROM 1.6.2 BUT SHOULD REALLY WORK ON ANY ROM THAT HAS NO EXT2 AUTO-MOUNT. AND YEAH THIS WHOLE PROCESS HAS BEEN DONE ON A 32a BOARD. FOR THOSE THAT TRY THIS ON OTHER ROMS LET ME KNOW HOW IT GOES.
I've searched and shuffled through the entire forum and made inquiries to ROM authors without much light being shed on this issue. I doubt I am the only one who has been looking for a way of doing this so I decided to do a small HOW-TO. Here I will explain step by step as to how you can implement a script to be part of your ROM that will auto mount an ext2 partition on boot up if such partition is present. I have included all the tools I've used in order to pull this off, and as the title suggests this has only been done on Amon Ra's latest 1.6.2 ROM. In order to follow these instructions you are expected to allready have set up an adb enviroment on your linux box and for the signing process to work you must have sun-java present, the gnu java wont work. And of course a microSD card with an ext2 partition
1. Download install.sh to your home directory
Code:
wget http://www.grindhouse.no/androidtools/install.sh
chmod a+x install.sh
2. Now execute the install.sh script which will create a directory to work in and download a tool and script package and unpack it.
Code:
./install.sh
When the install.sh script is done you need to move the mkbootimg preferebly to your tools directory of your SDK.
Code:
mv toolstomove/mkbootimg <path/to/sdk/tools/mkbootimg>
3. Unpack the RA1.6.2 ROM into a directory in your home dir. In this HOW-TO we will use directory name "ra1.6.2" as an example through out the entire process.
4. Copy the boot.img from ra1.6.2 to the ROM-cooker dir
Code:
cp $HOME/ra1.6.2/boot.img $HOME/ROM-cooker/boot.img
cd $HOME/ROM-cooker
5. Use unpack.pl to extract the ramdisk from the boot image. I've modified the script a little so it automates the entire process and decompresses the ramdisk to a directory
Code:
./unpack boot.img
6. Now you can either replace the init.rc file here with the one I've included in this package or you can add these lines by yourself. In wich case do the following
Code:
cd boot.img-ramdisk
pico init.rc
Press CTRL+w and then CTRL+t and input 27. hit enter. This will take you to line 27 of init.rc so you can add a line right before the init process remounts the rootfs in read-only mode. Add following line:
Code:
mkdir /sdext2 0771 system system
Now scroll down to the end of the init.rc file and add the following:
Code:
service mountsdext2 /system/bin/mountsd
user root
group root
oneshot
7. You have now edited (or replaced) your init.rc file and prepared it to execute a script on boot that will detect an ext2 partition and boot it if there is one to be found. Now you have to make the mountsd script a part of the ROM. Do the following:
Code:
cd $HOME/ROM-cooker
mv toolstomove/mountsd $HOME/ra1.6.2/system/bin/mountsd
rm -rf toolstomove
8. Now that the init.rc file is sorted out and mountsd has been placed in /system/bin of the ROM so it is time to re-pack the boot.img:
Code:
cd $HOME/ROM-cooker
./repack boot.img-kernel boot.img-ramdisk boot.img
rm $HOME/ra1.6.2/boot.img
mv boot.img $HOME/ra1.6.2/boot.img
9. Your ROM now has a new boot image with an updated init.rc and the /system/bin dir has the script needed to auto-mount the microsd ext2. Now you must re-zip the ROM and sign it. Do the following:
Code:
cd $HOME/ra1.6.2
zip -r update.zip *
mv update.zip $HOME/ROM-cooker/update.zip
cd $HOME/ROM-cooker
./sign.pl update.zip
10. The ROM is now signed and you now have a file called update-signed.zip. Connect the phone to your computer and execute thus:
Code:
./push update-signed.zip
11. Now you are ready to flash the modified ROM which will auto-mount an ext2 partition on your microSD. There is no need to wipe before flashing. If you have no prior experience with ROM flashing or whatever just backup your current install. If you're using OpenHOME or anything similar, nothing will be changed or damaged but if you're using MontAlbert's themes with the ROM you will have to flash them again after flashing this modified ROM.
Code:
adb reboot recovery
12. Flash from choose zip and of course choose update-signed.zip. Reboot. After the system boots up again you can now check whats what with either one of the commands:
Code:
[email protected]:~$ adb shell mount | grep sdext2
/dev/block/mmcblk0p2 on /sdext2 type ext2 (rw,noatime,nodiratime,errors=continue)
[email protected]:~/boot$ adb shell busybox df -h | grep sdext2
/dev/block/mmcblk0p2 893.7M 13.0K 846.0M 0% /sdext2
13. Voila! Your RA 1.6.2 ROM now detects and mounts your microSD ext2 partition on boot. Woohoo?
I hope the HOW-TO was easy reading and that you have succeeded in hacking up your ROM. I know that certain ROMs have this as a built-in function but Amon Ra's does not. But since alot of people including myself use his ROM because of the high speed and stability I thought I should contribute to his project and add a cool (and missed?) function to it.
Mind you that you can use the ROM-cooker set to further adjust and hack up the ROM as you see fit. Happy learning!
Very nice!
Now the question many people will ask : why would you automount ext2 if you don't use apps2sd ?
I personally have ubuntu on my ext2 And besides this approach can be used for a number of things, people who have had the need, or wanted to experiment with init.rc doing things on boot, the mountsd script can easily be altered to do what ever needed.
For me its been a learning curve finding these things out, so by sharing it I may spare some people breaking their backs over this whole init.rc thing. people may want to modify init.rc for whatever reason, so I'm sure people wont have a problem finding a way of putting this to use, and its a subject that isnt all that covered on the forum .. and hey .. at least they get a rom kitchen out of the whole shabang
Very interesting! Thank you.
I used your unpack-program to unpack a recovery-image. It seems to work fine. What I am trying to do is change the state the recovery-image returns the phone to. Would it be possible to just replace your mountsd-script with, for example, a script that installs apps? Or is there a better way to do what Im trying to achieve?
Cheers,
edit: I noticed that on the emulator it is sufficient to just place an apk-file in "data/app" to get it installed. Could it be possible that this is all I need a script to do? :O or could I hurt my poor phone by doing so you think?
sandis84 said:
edit: I noticed that on the emulator it is sufficient to just place an apk-file in "data/app" to get it installed. Could it be possible that this is all I need a script to do? :O or could I hurt my poor phone by doing so you think?
Click to expand...
Click to collapse
That's indeed all you need to do.
Hi!
So I tried to create a signed update.zip, but it failed. It didnt create a "update-script"-file, so my device refused to install it. I wrote my own "update-script"-file, but then it complained "no digest" for the file. How do I solve this?
post the contents of your script people might see whats up
so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together
sitimber said:
so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together
Click to expand...
Click to collapse
Says where its at in the first line : )
Code:
wget http://www.grindhouse.no/androidtools/install.sh
But now that I checked, I have to apologize, I see I have a missed payment with my hosting, I'll fix that within the day. Also sorry I havent been answering the few questions here I've been afk cause of surgery.
sitimber said:
post the contents of your script people might see whats up
Click to expand...
Click to collapse
well, I looked in another "update-script" file and found this:
assert compatible_with("0.2") == "true"
assert getprop("ro.product.device") == "dream" || getprop("ro.build.product") == "dream"
show_progress 0.5 0
write_radio_image PACKAGE:radio.img
show_progress 0.5 10
Click to expand...
Click to collapse
So I figured that nothing was essential other then the line "write_radio_image PACKAGE:radio.img". Also ofcourse I made sure it contained the name of my image-file instead of "radio.img". This gave me the "no digest" message, so now I feel unsure on how to create a working update.zip.
edit:
SOLVED! How silly of me. When you sign the update, a hash of each file is put in manifest.mf. Since I added the update-script after signing the file, ofcourse the digest(hash) was missing. Now everything works alot better and I can proceed... until I get stuck again
Cheers,
edit2:
Just to get a better understanding, what exactly does each line do here? Or where can I read about this?
Code:
service mountsdext2 /system/bin/mountsd
user root
group root
oneshot
edit3:
Ok, so I have experimentet, but I still dont manage to solve those last steps. I tried to edit init.rc and just add "mkdir /testdir 0000 system system" where the other directories were created. I then repacked it, zipped it, signed it, put it on my sdcard, started up a custom recovery, installed the update and rebooted. Everything seems to work fine. But when I start adb and check around, I dont see the "testdir"-directory. Also when I check in init.rc my line is gone. Do you guys have an idea of where I went wrong?
sitimber said:
so is this all on linux?
also where are the script files for your tutorial
thanks for the time to put together
Click to expand...
Click to collapse
it doesnot necesarily have to be linux ...you can also do it in windows using cygwin and dsxda's android rom kitchen

[HOW-TO]Create Custom ODIN Images for Backup/Restore

I'm sure several people will be wanting this information, so I figured I would post it here for everyone. This will allow you to backup your system and create custom Odin images for restore purposes. For anyone unfamiliar with the Samsung system, they use Odin to flash things to the device, much like HTC has RUU and Moto has SBF. Odin files are either .tar files, or .tar.md5 files.
The .tar.md5 files are .tar files with the md5 checksum added to the end of the file. If you attempt to flash a .tar.md5 file, Odin will automatically check that the contents are what they should be before flashing and proceed with the flash if the md5 is valid, otherwise it will stop.
In Odin, you should use the PDA button for all flashing. The PIT button may be used as well, if we can get a valid .pit file for the device, but for now, PIT won't be used either. Other than PDA, Start/Reset are the only other buttons you need to worry about.
Now, on to creating the backup files. First, you will need your device to be rooted (perm or temp root will work), and you also need to have access to terminal on the phone, either via an emulator or adb shell access. To create the backup files, you won't need a Linux/UNIX system, but you will if you want to create a flashable Odin package. The following will output the files on the root of the SDCard, adjust the "of=" path if you want them somewhere else. It will also create the files for the proper filename for Odin as well. So to create the files, here are the commands you will use from root shell (#):
System:
Code:
dd if=/dev/block/stl10 of=/sdcard/factoryfs.rfs bs=4096
Kernel:
Code:
dd if=/dev/block/bml8 of=/sdcard/zImage bs=4096
Recovery:
Code:
dd if=/dev/block/bml9 of=/sdcard/recovery.bin bs=4096
DO NOT INCLUDE THE FOLLOWING IN ANYTHING BUT A PERSONAL BACKUP
Cache:
Code:
dd if=/dev/block/mmcblk0p3 of=/sdcard/cache.rfs bs=4096
DBData:
Code:
dd if=/dev/block/stl11 of=/sdcard/dbdata.rfs bs=4096
Data:
Code:
dd if=/dev/block/mmcblk0p1 of=/sdcard/movinand.bin bs=4096
The last three files (cache, dbdata, data) may contain personal information, so do not include these 3 files in anything but a personal backup/recovery package.
To create a flashable Odin package, you need to pull all of the files off of the phone/sdcard and onto your computer. From there, you use the following to create the package:
Code:
tar -H ustar -c factoryfs.rfs recovery.bin zImage > package_name.tar
md5sum -t package_name.tar >> package_name.tar
mv package_name.tar package_name.tar.md5
If you want to include cache/dbdata/data in the above for personal use, just add them after the "-c" and before the ">".
There are other files that may be in Odin packages, but they are protected by Samsung and cannot be dumped properly. The files are the bootloader, secondary bootloader, modems, and .lfs partitions. The files would be boot.bin, Sbl.bin, modem.bin (not sure what it would be for the CDMA/LTE dual modem here), and param.lfs. It however isn't that big of an issue that these can't be dumped as the can't really be altered by normal flashing of the device, and are usually only altered via OTA updates.
Thanks for this info imnuts! I unfortunately updated to the new update and would like to go back to rooted but cant until I downgrade.
Thanks!
Thanks for posting this. I'm going to attempt to make a personal backup and then I can factory reset the phone and make a stock version for people to use. I'm haven't installed the update yet either, so I'm hoping this will let people get back to ED1. I've also been playing around with theming using the fascinate community rom theme and ninjamorph to swap files. It'll take a while, but it's currently the only way I feel safe messing with framework-res.
wynalazca said:
Thanks for posting this. I'm going to attempt to make a personal backup and then I can factory reset the phone and make a stock version for people to use. I'm haven't installed the update yet either, so I'm hoping this will let people get back to ED1. I've also been playing around with theming using the fascinate community rom theme and ninjamorph to swap files. It'll take a while, but it's currently the only way I feel safe messing with framework-res.
Click to expand...
Click to collapse
I'm definitely looking forward to having a downgrade ROM image to get back to ED1!
So how do you add the last personal 3 i just got the droid charge and i am not very familiar with samsung files i had a droid x and a thunderbolt very shortly and am familiar with ruu and sbf but how do you add cache dbdata and the other one. I meab like the actual command not the instruction to put it after c
rami98 said:
So how do you add the last personal 3 i just got the droid charge and i am not very familiar with samsung files i had a droid x and a thunderbolt very shortly and am familiar with ruu and sbf but how do you add cache dbdata and the other one. I meab like the actual command not the instruction to put it after c
Click to expand...
Click to collapse
The only thing that would change would be the tar command. If you want to include the other files, it would be:
Code:
tar -H ustar -c cache.rfs dbdata.rfs factoryfs.rfs movinand.bin recovery.bin zImage > package_name.tar
md5sum -t package_name.tar >> package_name.tar
mv package_name.tar package_name.tar.md5
You just need to pull the files from your phone and have them in the same directory that you're in in terminal, and have them named appropriately. It also doesn't matter what order they are in (that I know of), I just have them in alphabetical order for ease of reading.
So im going to try and do the voodoo lagfix for the first time ever but I wanted to make a backup. Im on ED2 and NOT rooted so how would I go about making these backups?
imnuts said:
The only thing that would change would be the tar command. If you want to include the other files, it would be:
Code:
tar -H ustar -c cache.rfs dbdata.rfs factoryfs.rfs movinand.bin recovery.bin zImage > package_name.tar
md5sum -t package_name.tar >> package_name.tar
mv package_name.tar package_name.tar.md5
You just need to pull the files from your phone and have them in the same directory that you're in in terminal, and have them named appropriately. It also doesn't matter what order they are in (that I know of), I just have them in alphabetical order for ease of reading.
Click to expand...
Click to collapse
I tried the above and I keep getting this error message in the command prompt:
'tar' is not recognized as an internal or external command, operable program or batch file.
(I'm trying this on windows 7 professional)
Any help would be appreciated, thanks!
mypantsaretorn said:
I tried the above and I keep getting this error message in the command prompt:
'tar' is not recognized as an internal or external command, operable program or batch file.
(I'm trying this on windows 7 professional)
Any help would be appreciated, thanks!
Click to expand...
Click to collapse
You wouldn't by any chance be trying the "tar" command at a windows command prompt, would you?
imnuts said:
To create the backup files, you won't need a Linux/UNIX system, but you will if you want to create a flashable Odin package.
To create a flashable Odin package, you need to pull all of the files off of the phone/sdcard and onto your computer. From there, you use the following to create the package:
Code:
tar -H ustar -c factoryfs.rfs recovery.bin zImage > package_name.tar
md5sum -t package_name.tar >> package_name.tar
mv package_name.tar package_name.tar.md5
If you want to include cache/dbdata/data in the above for personal use, just add them after the "-c" and before the ">".
Click to expand...
Click to collapse
Course you might be running Linux in a vmware or Hyper-V environment....hint?
HTH
Damn! I didn't pay attention to the second part of that sentence! Lol
Thanks for the "hint"..
Sent from my SCH-I510 using XDA App
The other option would be using Cygwin, but I've never tried it, so it may or may not work.
imnuts said:
The other option would be using Cygwin, but I've never tried it, so it may or may not work.
Click to expand...
Click to collapse
cygwin works!
Edit: Here is how:
1. Search google for cygwin - download
2. Run - you will be prompted to get packages - I assumed "archive" was a good place to start - not sure if you need this or not...
3. When complete you will see a new icon on your desktop - double-click
4. Be patient as it loads
5. Copy the files output'ed from first post to same folder on PC
6. Back in cygwin:
a. cd x: (where x: is the drive letter of the drive that has the folder with the files)
b. tar -H ustar -c cache.rfs dbdata.rfs movinand.bin factoryfs.rfs recovery.bin zImage > package_name.tar
c: md5sum -t package_name.tar >> package_name.tar
d: mv package_name.tar package_name.tar.md5
Complete output of commands:
These files are for the users to personalise their cygwin experience.
They will never be overwritten nor automatically updated.
`./.bashrc' -> `/home/UWINKET//.bashrc'
`./.bash_profile' -> `/home/UWINKET//.bash_profile'
`./.inputrc' -> `/home/UWINKET//.inputrc'
`./.profile' -> `/home/UWINKET//.profile'
Your group is currently "mkgroup". This indicates that neither
your gid nor your pgsid (primary group associated with your SID)
is in /etc/group.
The /etc/group (and possibly /etc/passwd) files should be rebuilt.
See the man pages for mkpasswd and mkgroup then, for example, run
mkpasswd -l [-d] > /etc/passwd
mkgroup -l [-d] > /etc/group
Note that the -d switch is necessary for domain users.
[email protected] ~
$ cd h:
System Volume Information
[email protected] /cygdrive/h
$ cd downloads
[email protected] /cygdrive/h/downloads
$ cd charge
[email protected] /cygdrive/h/downloads/charge
$ cd tarbackup/
[email protected] /cygdrive/h/downloads/charge/tarbackup
$ tar -H ustar -c cache.rfs dbdata.rfs movinand.bin factoryfs.rfs recovery.bin
zImage > package_name.tar
[email protected] /cygdrive/h/downloads/charge/tarbackup
$ md5sum -t package_name.tar >> package_name.tar
[email protected] /cygdrive/h/downloads/charge/tarbackup
$ mv package_name.tar package_name.tar.md5
[email protected] /cygdrive/h/downloads/charge/tarbackup
$
Hmm flash did not work with my personal data in it - got an error. Created a new .tar file with just factoryfs.rfs recovery.bin and zImage and was able to flash that. TG for TiBu!
jism31 said:
Thanks for this info imnuts! I unfortunately updated to the new update and would like to go back to rooted but cant until I downgrade.
Click to expand...
Click to collapse
How do you start doing this. How do I get to root shell (#)... Thanks
AD
I plan to get rooted on ED1 so I can get a stock image backed up, and have a clean base to work from. Still getting my head around the odin stuff first.
RaptorMD said:
I plan to get rooted on ED1 so I can get a stock image backed up, and have a clean base to work from. Still getting my head around the odin stuff first.
Click to expand...
Click to collapse
you dont have to do that its already done
http://forum.xda-developers.com/showthread.php?t=1085190
Well, I successfully followed all the instructions and have created my first ODIN flashable file, I have not tried to flash it yet. I'm just curious, I pull all the different .rfs, .bin, and zImage on this file and noticed it's about 1.8gb file. Is this normal?
Also, before I try to flash this. Should I have dissable voodoo lagfix and converted back to rfs before I dumped the files?
Thanks for all the help!
JKChad said:
Well, I successfully followed all the instructions and have created my first ODIN flashable file, I have not tried to flash it yet. I'm just curious, I pull all the different .rfs, .bin, and zImage on this file and noticed it's about 1.8gb file. Is this normal?
Also, before I try to flash this. Should I have dissable voodoo lagfix and converted back to rfs before I dumped the files?
Thanks for all the help!
Click to expand...
Click to collapse
Yes, that's normal for it to be so large as dd will dump the partition, including empty space. If you were to compress it with zip or lzma, it'd drop down considerably.
Not sure about the voodoo part as I've never dumped files from an ext4 partition. I don't see any reason why it wouldn't work, but I'd flash with caution and have another working image ready just in case.
imnuts said:
Not sure about the voodoo part as I've never dumped files from an ext4 partition. I don't see any reason why it wouldn't work, but I'd flash with caution and have another working image ready just in case.
Click to expand...
Click to collapse
Shouldn't be an issue as long as he keeps the voodoo kernel.
Sent from my SCH-I510 using Tapatalk
Anybody try this with voodoo yet ?

[Tutorial] How to port cf-root to other i9003 Firmwares [23/02/2012]

Tutorial for Porting Cf-root To Newer Firmware's
There were quite a few requests for a tutorial to create ginger bread cf-root. So here it is folks.
Big Thanks to skin1980 for helping me out.
Credits:
Chainfire for the cf-root.
Skin1980 for porting it to Samsung Galaxy SLCD.
Prerequisites:
Any Linux. Basic knowledge of linux is mandatory.
Tools for Unpacking and Packing images.
Base Samsung Galaxy SLCD Gingerbread Cf-root.
Samsung Galaxy SLCD Gingerbread Firmware ROM for cf-root creation.
Downloads & Setup
Any Linux: For this tutorial I am using Linux Mint KDE. You are free to use the Linux of your choice. Ideal starting point for downloading and installing Linux would be Distrowatch.com.
Tools for unpacking and packing images: These are sets of tools that allow you to unpack and pack boot images. Basically one requires just a few tools to achieve.
Link to Download: cfroot-tools.zip - 19 KB.
Download and exatract it into your home folder. It will create a cfroot-tools folder under home folder. Go to the folder and execute the following comand:
Code:
chmod +x *
Base Cf-root: Download any latest cf-root from this Link. Extract the normalboot.img from the cf-root tar file.
normalboot.img: Require normalboot.img extracted from downloaded Gb ROM.
Hex editor: You will require and Hex Editor. I am using bless hex editor. You can use any one which you are comfortable or the one available under your linux distribution.
Open terminal window and enter the following commands:
Code:
[FONT=Microsoft Sans Serif][SIZE=2]cd
[/SIZE][/FONT][FONT=Microsoft Sans Serif][SIZE=2]gedit ~/.bashrc[/SIZE][/FONT]
You can use any editor of your choice. The main purpose is to set the tools path. At the bottom of this file, add the following lines:
Code:
PATH=$HOME/cfroot-tools:$PATH
export PATH
Save and close the file.
Logoff from linux and login again for the new path to take effect.
The Actual Process
For the purpose of tutorial, I am going to use XXKPQ cf-root as the base and DDKP3 for creating new one.
Create a folder called “cfroot” with out the quotes under home.
Go to the created folder and create two more folders: DDKP3 and XXKPQ.
Now copy the normalboot.img extracted from XXKPQ cf-root and copy it into the XXKPQ folder. Next copy the normalboot.img fromDDKP3 firmware and copy it into DDKP3 folder.
Now go to the cfroot-tools folder under HOME and copy the decom.sh and recom.sh into XXKPQ and DDKP3 folders.
The above steps can be accomplished by the below code. Open command window and type the following:
Code:
cd
mkdir ~/cfroot
mkdir ~/cfroot/XXKPQ
mkdir ~/cfroot/DDKP3
cd ~/cfroot/XXKPQ
cp ~/cfroot-tools/*.sh .
chmod +x *.sh
cd ~/cfroot/DDKP3
cp ~/cfroot-tools/*.sh .
chmod +x *.sh
You need to press enter after each command.
From terminal window, first to change directory to XXKPQ, type the following commands:
Code:
cd ~/cfroot/XXKPQ
./decom.sh
After the execution of the above command, the following files and folders will be created:
normalboot.img-base
normalboot.img-cmdline
normalboot.img-pagesize
normalboot.img-ramdisk.gz => Ramdisk
normalboot.img-zImage => Kernel
Click to expand...
Click to collapse
Apart from these files, a folder called ramdisk will be created, into which the contents of normalboot.img-ramdisk.gz would have been extracted.
Now once more from the terminal window execute the following command:
Code:
cd ~/cfroot/DDKP3
./decom.sh
Also make note of the following values, which are shown, when the decom.sh script is executed.
Code:
BOARD_KERNEL_BASE 81800000
BOARD_PAGE_SIZE 00001000
Now under DDKP3 folder, edit the recom.sh file. Replace the value after --base with the value after BOARD_KERNEL_BASE. Replace the value after --pagesize with value after BOARD_PAGE_SIZE. Save the file.
Now we can switch to file manager. It will be easier to work using a file manager from here on. Open the XXKPQ/ramdisk and DDKP3/ramdisk folders separately in file manager.
Copy the folders res & sbin from base cf-root (XXKPQ in our case) and paste into DDKP3/ramdisk folder. Overwrite all when prompted.
Copy all the files under XXKPQ/ramdisk (in the root) to DDKP3/ramdisk.
From XXKPQ/ramdisk/lib/modules/2.6.35.7/kernel/ copy the fs folder into DDKP3/ramdisk/lib/modules/2.6.35.7/kernel/.
At this point of time, we no longer require the XXKPQ folder. So we can close the file manager window browsing XXKPQ folder.
Now comes the tricky and critical part. This must be done very carefully. We need to edit the .ko files using a hex editor.
Under the kernel/crypto/ folder, there is a pcbc.ko file, edit it using an hex editor. Search for 2.6.35.7 using find option in the editor. Now note down the six digit numbers starting immediately after 2.6.35.7-CL. In our case the magic number is 882023. Close the file and the editor.
Now we open the kernel/fs/ folder in the file manager.
Now open the mbcache.ko file in the hex editor. Search for 2.6.35.7 again. As we can see that the six digits after 2.6.35.7-CL is not 882023. In our case it is 709629. We need to change 709629 to 882023 and save the file. Different editors provide for different methods of editing. In my case I can just simply click on starting number that is 7 and start typing 882023 and save the file.
Now you need to do the same for two more files under kernel/fs/jbd2/ and kernel/fs/ext4/.
Now go back to ramdisk folder. Under ramdisk/sbin/boot/ there is a file called install.sh. We are now going to edit this file. This not important that you edit this file.
Edit the first line and replace XXKPQ with DDKP3.
Similarly under the “# Once be enough”, there is another XXKPQ which is to be replace with DDKP3.
Now save this file.
Now back to command prompt and execute the following commands:
Code:
cd ~/cfroot/DDKP3
./recom.sh
Executing the above script recreates the normalboot.img-ramdisk.gz, the normalboot.img and create DDKP3-CFROOT-16-02-2012.tar.
The DDKP3-CFROOT-16-02-2012.tar is the cf-root for DDKP3 and can be flashed using ODIN as Pda file.
*
Thats it folks. Hope my effort is worthwhile and benefits some of you.
*
Additional Links:
A text file Create Custom Rom (though not for our phone but is quite useful all the same) - Found it while searching google. Don't know who created it. But here is the link. Create_Custom_Rom.txt - 5 KB
The link to tools zip mentioned in the above text file. tools.tar.gz - 49 MB
Script to uncompress and compress UC Kernel
uc_decom.sh - 258 b
uc_recom.sh - 382 b
10 Chars ......
For Future Use
Whoa! This is huge! Awesomr work man! Thanks.
Edit - No offence meant, but it would be appropriate if the title is How to "port" or similar. Since it ws "created" by ChainFire and we just porting it.
ganeshbiyer is good, very patient, did not think that my trouble!
Has been helping me! Am very grateful!
great job! & i already translate it into chinese^^
and a problem:
after i run the script "decom.sh",it display following words:
[[email protected] xxkpq]# ./decom.sh
./decom.sh: line 5: unpackbootimg: command not found
gunzip: ../normalboot.img-ramdisk.gz: No such file or directory
cpio: premature end of archive
[[email protected] xxkpq]#
help me please~what's going on?
cRainin said:
great job! & i already translate it into chinese^^
and a problem:
after i run the script "decom.sh",it display following words:
[[email protected] xxkpq]# ./decom.sh
./decom.sh: line 5: unpackbootimg: command not found
gunzip: ../normalboot.img-ramdisk.gz: No such file or directory
cpio: premature end of archive
[[email protected] xxkpq]#
help me please~what's going on?
Click to expand...
Click to collapse
unpackbootimg must be in the path.
also it must be executable.
ganeshbiyer said:
unpackbootimg must be in the path.
also it must be executable.
Click to expand...
Click to collapse
sorry,i paste the wrong code. my problem is this:
[[email protected] XXKPQ]$ ./decom.sh./decom.sh: /home/chenyu/cfroot-tools/unpackbootimg: /lib/ld-linux.so.2: bad ELF interpreter: No such file or directory
gzip: ../normalboot.img-ramdisk.gz: No such file or directory
cpio: premature end of archive
[[email protected] XXKPQ]$
cRainin said:
sorry,i paste the wrong code. my problem is this:
[[email protected] XXKPQ]$ ./decom.sh./decom.sh: /home/chenyu/cfroot-tools/unpackbootimg: /lib/ld-linux.so.2: bad ELF interpreter: No such file or directory
gzip: ../normalboot.img-ramdisk.gz: No such file or directory
cpio: premature end of archive
[[email protected] XXKPQ]$
Click to expand...
Click to collapse
Need to install the missing file ld-linux.so.2
Sent from my GT-I9003 using xda premium
Thank you Ganeshbiyer! this is the tutorial for which send multiple private messages and never answered .. Thanks again, nowI can make a version for Gingerbread UBKPD.
goodbye
Yeah ganesh! A superb work..well done bro
thanks bhaiya....
Thanks for the tutorial buddy
Hope it has been useful.
_
Release all PERFECT! I had no problem in making the entire guide .. BUT ... when flashing in ODIN, and says that when it failed to finish.
I knew that I would be so easy, so I started to analyze both folders (my UBKPD and XXKPQ) and did not get that at the root of KPD I have 12 files and only 11 KPQ. The 12th file executable type KPD called RECOVERY. This file should remove it before using recom.sh?
Thanks again for the guide. goodbye
Edit2:
Well, my little patience led me to delete that file and then went back to RECOVERY recom.sh run and throw me error that could not erase normalboot.img and did not understand, but looking at the files in the root, not the size you normalboot.img was higher than the stock then replace the stock normalboot (+5 mb), run again and finally he created recom.sh cf.root, I flash with ODIN successfully without any problem in these +30 minutes.
Thanks (again).
Now I have as including UV & OC (freqmax 1100MHz is very good speed and would think you do not need more with this phone)
maybe a stupid question:
would it work with other phones as well? natually with the files of the other phone and not with the 9003 files
fabsau said:
maybe a stupid question:
would it work with other phones as well? natually with the files of the other phone and not with the 9003 files
Click to expand...
Click to collapse
Well you can always try
thanks for your reply
I will try it soon^^
wait for my next reply
greetings fabsau
i do it all at this tutorial and it create .tar fine without trouble.. i flash with odin also no problem happen.. but while device open.. at boot logo get stuck or freeze at long time.. why it happen???
i confuse with this line:-
-Copy the folders res & sbin from base cf-root (XXKPQ in our case) and paste into DDKP3/ramdisk folder. Overwrite all when prompted.
-Copy all the files under XXKPQ/ramdisk (in the root) to DDKP3/ramdisk.
-From XXKPQ/ramdisk/lib/modules/2.6.35.7/kernel/ copy the fs folder into DDKP3/ramdisk/lib/modules/2.6.35.7/kernel/
Click to expand...
Click to collapse
why do not copy all the file in ramdisk n skip copy file inside the ramdisk folder.. it is difference?? please tell me if i do a mistake.

(How to) unpack/repack boot.img using terminal apk

This is a tutorial I've decided to put together as I'm learning to compile kernels. It will cover unpacking and repacking a boot.img and/or recovery.img, and also touch on unpacking the ramdisk after we have unpacked the boot.img This tutorial will only focus on executing this on a android device using the terminal emulator app but of course you could use these tools on a PC in a adb shell.
This would not be possible without the hard work of xda member @Modding.MyMind. I am not responsible for anything you do to your device by using these tools.
What you will need
1. Android device
2. Have root
3. Have busybox installed (1.23.1 is recommended)
4. Terminal Emulator app
5. Root Explorer app
6. Your devices boot.img and/or recovery.img
7. mkbootimg_tools-master.zip (download below)
https://www.dropbox.com/s/fiat0zrf2f533uq/mkbootimg_tools-master.zip?dl=0
DIRECTIONS
1. Let's pull the boot.img we are going to work with using dd. Open your terminal and type su > press enter. Type dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/sdcard/boot.img > press enter and now you should see a file on your sdcard called boot.img
2. Place the zip file on the root of your internal sdcard and extract it. You will see a folder called mkbootimg_tools-master and inside that folder you will see 2 folders. One called ARM and one called README.md Now we are going to copy the ARM folder to data/local/tmp and paste it inside of the tmp folder.
3. Now we need to go the ARM folder that you just copied inside tmp and set the permissions to 0777 (rwxrwxrwx) and also set the same permissions for each file inside the ARM folder.
4. Now go inside the ARM folder and copy the bash file to system/xbin and set the permission to chmod 0755 (rwxr-xr-x)
5. Ok now copy the boot.img file that we pulled onto your sdcard inside the ARM folder and leave the permissions for that file 0666 (rw-rw-rw-)
6. Open up your terminal emulator app and type su > press enter
7. Now we are going to change directories to the ARM folder which we want to be in by typing cd data/local/tmp/ARM > press enter
########################################
Now to unpack your boot.img
1. Type ./mkboot boot.img bootfolder > press enter and you will see the magic happen. It will automatically create a folder called bootfolder which is your project folder and you can name it whatever you like but I like to call it bootfolder and if I was unpacking a recovery.img I would call it recoveryfolder
2. So now you have your unpacked boot.img.
3. Now go to your terminal and type cd bootfolder > and press enter. We are going into your bootfolder now because that is where your ramdisk.gz is located and we are now going to decompress your ramdisk by typing gunzip -dc ramdisk.gz | cpio -i > and press enter and it will decompress your ramdisk for you.
4. So now you have unpacked a boot.img and also learned how to decompress your ramdisk.
########################################
How to decompress a ramdisk in lzma format
1. ./mkboot recovery.img workfolder
2. cd workfolder/ramdisk
3. Now type lzma -dc ../ramdisk.lzma | cpio -i; strings *.ko
4. Now you will have your lzma compressed ramdisk inside your workfolder
#######################################
Now we are going to repack your boot.img
1. In your terminal type cd .. > and press enter so you will move back 1 directory into your ARM folder.
2. Now to repack you are going to type ./mkboot bootfolder boot.img > and press enter and that will repack your boot.img for you
*wherever you saw me type a > don't ever type that as I was just showing that you are done the command or syntax and your are ready to press enter
Source code https://github.com/ModdingMyMind/mkbootimg_tools/commit/6c44267b4a8a43504c870678c68df6a31b8e2f18
Screenshot - https://www.dropbox.com/s/se171tzgnf6wp0q/Screenshot_2015-03-12-02-49-50.png?dl=0
Screenshot - https://www.dropbox.com/s/5bzt8p6l2ltosl6/Screenshot_2015-03-12-02-50-04.png?dl=0
Thanks to @leonardoafa for being a great help & friend
How different is it for a recovery image file please?
Is the same, just put your recovery.img in the ARM folder and you might want to call your project folder something different than bootfolder (ex; recoveryfolder) so you don't get confused or forget
Oh yes, however ramdisk folder is empty when you use only a recovery image. Less content of course.
image45 said:
Oh yes, however ramdisk folder is empty when you use only a recovery image. Less content of course.
Click to expand...
Click to collapse
When i use twrp everything is working perfect. Your ramdisk is probably in a lzma format I'm guessing
As you can see im inside of my ramdisk folder, which is inside my recoveryfolder
https://www.dropbox.com/sc/ffyy2ndrkl57hn4/AACV__FpJuScCvIvErx2WFffa
@image45 i added how to decompress a ramdisk in lzma format to the op
Nice guide :good:
Yes very detailed, thank you.
@skulldreamz
Hi my friend, do you still want to learn about scripts.
Please go to telegram app.
Thanks
@image45 can you sendme your image that uses a lzma compressed ramdisk. The project supports lzma so there should be no need to decompress it manually however, if the project is not doing what it should already be doing then I need to debug the script, find the culprit, make my fix, and push the changes to my github. Would be greatly appreciated. Thanks.
app
Hy,
I use this app for long time to open boot.img and extract ramdisk.
The app asked then if you want open the ramdisk also.
Only click on your boot.img and in 4 sec its open.
Second function is to pack a boot.img.
Very simple to use, also for beginners.
konsolen said:
Hy,
I use this app for long time to open boot.img and extract ramdisk.
The app asked then if you want open the ramdisk also.
Only click on your boot.img and in 4 sec its open.
Second function is to pack a boot.img.
Very simple to use, also for beginners.
Click to expand...
Click to collapse
It only decompresses gzip ramdisks. Doesn't support other types unless you modify the ramdisk.sh script used inside the apk. It also doesn't support images with dt binaries which is more common nowadays. I use to use this a long time ago but to say it simple, it is outdated and lacks support.
However, if it works then I say use it. Especially if the person isn't comfortable with command lines.
Very helpful thx
Thanks
Sent from my SAMSUNG-SGH-I747 using Tapatalk
I see this is an older thread but tried it on my Nexus 6p. When I repacked boot it was significantly smaller in size. It also has the warning of non standard address. Anything I should do or be aware of?
Fe Mike said:
I see this is an older thread but tried it on my Nexus 6p. When I repacked boot it was significantly smaller in size. It also has the warning of non standard address. Anything I should do or be aware of?
Click to expand...
Click to collapse
Try using mkboot....
https://github.com/xiaolu/mkbootimg_tools
The Sickness said:
Try using mkboot....
https://github.com/xiaolu/mkbootimg_tools
Click to expand...
Click to collapse
Thank you, bare with me as Im fairly new to this. Just to be clear, when i go to link there is the ARM folder that has all the same stuff in it or the single mkboot file thats 9.46mb in size? Not sure how to download just the mkboot file. When i click it, it just opens up the code. Do i copy and paste the code?
Fe Mike said:
Thank you, bare with me as Im fairly new to this. Just to be clear, when i go to link there is the ARM folder that has all the same stuff in it or the single mkboot file thats 9.46mb in size? Not sure how to download just the mkboot file. When i click it, it just opens up the code. Do i copy and paste the code?
Click to expand...
Click to collapse
You have to clone the source using "git clone" in your terminal. Which means you need to be on Linux
The Sickness said:
You have to clone the source using "git clone" in your terminal. Which means you need to be on Linux
Click to expand...
Click to collapse
Ok, I was able to clone using cygwin. But i was reading in the forums that the size of extracted boot from phone will not be the same as it being repacked. So I used original files from this post and and just extracted, unpacked, and repacked. Then just flashed img thru twrp and everthing went well. Thank you for your response.
SHM said:
It only decompresses gzip ramdisks. Doesn't support other types unless you modify the ramdisk.sh script used inside the apk. It also doesn't support images with dt binaries which is more common nowadays. I use to use this a long time ago but to say it simple, it is outdated and lacks support.
However, if it works then I say use it. Especially if the person isn't comfortable with command lines.
Click to expand...
Click to collapse
Why haven't you made something like this, he's just using someone else's tools, please MMM, you're the man

HOWTO: extract / modify kernel and initrd IE: rctd

Since so many people are asking, I figured I would write up a quick tutorial on how to modify a boot image. A boot image is a kernel, and an initrd packaged together along with some other information.
This will only concentrate on tearing one apart, modifying it, and putting it back together -- making your own kernel and packaging it is outside the scope.
So, the big thing going around right now is the fact that the lovely carriers have this process (rctd) that runs and chews up CPU. rctd stands for Root Check Toolkit Daemon -- and it does what it sounds like. It checks if you have root, it checks if the system partition has been modified, it checks if the kernel has been modified, etc...etc... Most importantly, it chews up a LOT of CPU and disk IO to do this.
For this to work, you need to have a Linux install, or WLS on Windows 10.
Ubuntu comes packaged with abootimg:
Code:
apt install abootimg
abootimg is used to extract / create / update the Android Boot Image, but first we need out boot image.
adb reboot recovery
adb pull /dev/block/bootdevice/by-name/boot boot.img
Now we extract it.
abootimg -x boot.img
This will give you 3 files:
bootimg.cfg // feel free to take a look if you want, but do not change anything in this file or your kernel probably won't boot.
zImage // This is the Linux kernel. If you grab the sources, and compile a kernel, this is what you get. Again, leave it alone.
initrd.img // This is the initrd (Initial Ramdisk). It is loaded by the kernel to give you a working environment before anything else is loaded. This is what we need to modify
Before we modify initrd, we have to extract it. It is a compressed cpio file. There are several ways to extract it, but this is the method I use:
Code:
mkdir initrd_temp
cd initrd_temp
zcat ../initrd.img | cpio -idv
zcat cats the file while decompressing it. cpio -idv ... -i means extract (yea, wtf), -d means create the directory tree, and -v just means verbose
So now we are in a directory (initrd_temp) with all the files that are in the initrd. The one we care about is init.lge.rc -- we need to edit this file.
If you open it up in an editor, search for this section:
Code:
# LG RCT(Rooting Check Tool)
service rctd /sbin/rctd
class late_start
user root
group root
seclabel u:r:rctd:s0
service ccmd /system/bin/ccmd
class core
user system
group system
socket ccmd stream 0660 root system
seclabel u:r:ccmd:s0
Delete all of that, or comment it out using # signs
Now we need to package everything back up.
Code:
find . | cpio --create --format='newc' | gzip -9 > ../newinitrd.img
cd ..
abootimg --create newboot.img -f bootimg.cfg -k zImage -r newinitrd.img
When you are done, you will have newboot.img, and you need to flash it.
Since we are still in recovery:
Code:
adb push newboot.img /sdcard
adb shell
cd /sdcard
dd if=newboot.img of=/dev/block/bootdevice/by-name/boot
Reboot and enjoy your new -- faster -- rctd and ccmd free kernel.
If doing it this manual way isn't for you, @Zacharee1 has created a script to automate the procedure. I wrote this for people that like to know exactly what is going on. Feel free to poke around in the other files that are in your initrd. You may find other things that you want to tweak. However, be careful, you could make a kernel that won't boot. If that happens, just get into recovery and flash one that does
-- Brian
Did anyone ever figure out what ccmd is?
I am 99% sure it allows remote command execution. Pull it, and take a hex editor to it...
It is nothing good, that is for sure.
It listens on a socket: socket ccmd stream 0660 root system
and
Code:
Unable to start CommandListener (%s)
No permission to run ccmd ccmode commands
Usage: ccmode enable
Usage: ccmode getflag
Usage: ccmode setflag <flag>
-- Brian
Im no good installing anything on windows ciao!!
It would be nice if someone with brains. Not me. Lol can figure out a new kernel for 10p h918 with no rctd and only kcal. ?
Sorry to hijack this thread, but I've made a Telegram thread for this subject https://t.me/joinchat/EkE57g6dCLopBy8xVQRT9w
With LG G5 h850 im not able to boot the image anymore. I always only get the fastboot screen. Maybe there is a difference?
@DMOEdetc If you pull your kernel and send me a link, I will take a look. As far as I know, the Android boot image hasn't changed since the first version.
The init that Android uses may not like files with CR/LF if you are editing it in Windows and not specifying LF only. init may think it is a corrupt file and therefore refuse to load it...
-- Brian

Categories

Resources