Related
For those who own G Pro 2 D838 that cannot enter stock recovery to run adb sideload option (ioroot25), this tutorial teaches you how to grant root access through normal adb (ioroot24).
After long time investigating LG TOT file structure, I've found the way to partially flash a partition. And if you flash, for example, F350K kernel into a D838, you can run modified ioroot24 batch file by adding LG-D838 in the model option list.
The steps are as follows:
0. Backup your critical data. Flashing TOT will do factory reset automatically. All user data except Ext-SD will be erased.
1. Find and download the firmware exactly matching your D838 (16GB or 32GB model, HK or TW model), and the DLL file (or extract from KDZ).
2. Find and download old version F350 firmware such as F350K 10d version (only old versions are compatible with ioroot24 method).
3. Download my sample TOT header file below (myboothdr.bin). This file is verified on D838 16GB Taiwan. May not work for 32GB version.
4. Download any KDZ/TOT extractor you like.
5. Download any CRC32 checksum program you like. I use HashMyFiles. And download any hex editor you like. I use xvi32.
6. Extract D838 firmware to get PrimaryGPT.bin (partition table), boot.bin (kernel) and the DLL file if KDZ.
7. Extract F350 firmware to get boot.bin. Rename it as boot350.bin
8. In Windows command prompt, combine PrimaryGPT.bin and boot.bin into d838body.bin by the following command:
copy /b PrimaryGPT.bin+boot.bin d838body.bin
Don't forget the argument "/b". It's very important to use the flag to do "binary mode" copy.
9. Calculate d838body.bin CRC32 checksum by your checksum program. This should be a 32-bit nubmer.
10. In sample header file "myboothdr.bin", Fill the CRC32 value at file offset 0x08. Please note that the file store number in little-endian order, so the byte order of the 32-bit CRC32 value should be reversed. For example, a calculated CRC32 value 0x12345678 should be filled as 78 56 34 12 in file offset 0x08, 0x09, 0x0a, 0x0b.
11. Combine header and body by the following command (the result file must be in "tot" file extension):
copy /b myboothdr.bin+d838body.bin d838kernel.tot
12. Repeat steps 8~11 but replace boot.bin with boot350.bin and d838kernel.tot with f350k4d848.tot.
Now you have two kernel TOT files for your D838.
13. Use LG Flash Tool to flash f350k4d838.tot with your D838 DLL ffile.
14. Manually run adb command similar with ioroot24 for F350. However, unplug and plug USB cable did not work for me. Switching between "Changing Only" and "MTP" works.
15. Use LG Flash Tool to flash back d838kernel.tot with your D838 DLL file.
The file "myboothdr.bin" contains some offset / size values which may not work for other region and/or 32GB D838. Make sure the size of boot.bin is 12058624 bytes. And try to investigate your partition table file PrimaryGPT.bin to make sure "boot" partition starting at 0x40000.
It is assumed that all 16GB models have the same partition geometry and same size of kernel image (boot.bin), so I GUESS all 16GB D838 could use this header file. But I am not responsible to this. To custom the header file for you D838 16GB or 32GB model, check the following items and modify the header if necessary:
1. Check you partition table file (PrimaryGPT.bin) to find the location of your kernel image partition. In D838 TW model, the kernel partition entry is at offset 0x700 (totally 0x80 bytes, 0x700~0x77f), offset 0x700+0x38 contains partition name 0x62,0x00,0x6F,0x00,0x6F,0x00, 0x74,0x00 (UTF16-LE string "boot"). And offset 0x700+0x20 contains kernel partition starting sector 0x00, 0x00, 0x04, 0x00 (32-bit number 0x00040000). If your D838 model has different value from 0x00040000, please modify my header file offset 0x2020 to your value.
2. Verify the files size of you boot.bin (and boot350.bin) to make sure if it is 12058624 bytes (0xb80000). If not, please stop here. Some calculation is required to modify my header file, and some partition size verification has to be made for your case.
Because the resulting tot files contain partition info and kernel image. You'd better use your own tot files. If you want to use others, please make sure it's for the same model, kernel version, ROM size (16 or 32GB), and region (TW, HK or SG).
Thanks:
autoprime's great ioroot tools
You are the man! I
Feel proud to be a Taiwanese
這才是愛台灣
humble suggestion, probably move this thread to development?
pcfree said:
For those who own G Pro 2 D838 that cannot enter stock recovery to run adb sideload option (ioroot25), this tutorial teaches you hot to grant root access through normal adb (ioroot24).
After long time investigating LG TOT file structure, I've found the way to partially flash a partition. And if you flash, for example, F350K kernel into a D838, you can run modified ioroot24 batch file by adding LG-D838 in the model option list.
The steps are as follows:
0. Backup your critical data. Flash TOT will do factory reset automatically.
1. Find and download the firmware exactly matching your D838 (16GB or 32GB model, HK or TW model), and the DLL file (or extract from KDZ).
2. Find and download old version F350 firmware such as F350K 10d version (only old versions are compatible with ioroot24 method).
3. Download my sample TOT header file below (myboothdr.bin). This file is verified on D838 16GB Taiwan. May not work for 32GB version.
4. Download any KDZ/TOT extractor you like.
5. Download any CRC32 checksum program you like. I use HashMyFiles.
6. Download any hex editor.
6. Extract D838 firmware to get PrimaryGPT.bin (partition table), boot.bin (kernel) and the DLL file if KDZ.
7. Extract F350 firmware to get boot.bin. Rename it as boot350.bin
8. In Windows command prompt, combine PrimaryGPT.bin and boot.bin into d838body.bin by the following command:
copy /b PrimaryGPT.bin+boot.bin d838body.bin
9. Calculate d838body.bin CRC32 checksum.
10. In sample header file "myboothdr.bin", Fill the CRC32 value at file offset 0x08.
11. Combine header and body by the following command (the result file must be in "tot" file extension):
copy /b mybootheader.bin+d838body.bin d838kernel.tot
12. Repeat steps 8~11 but replace boot.bin with boot350.bin and d838kernel.tot with f350k4d848.tot.
Now you have two kernel TOT files for your D838.
13. Use LG Flash Tool to flash f350k4d838.tot.
14. Manually run adb command similar with ioroot24 for F350. However, unplug and plug USB cable did not work for me. Switching between "Changing Only" and "MTP" works.
15. Use LG Flash Tool to flash back d838kernel.tot.
The file "myboothdr.bin" contains some offset / size values which may not work for other region and/or 32GB D838. Make sure the size of boot.bin is 12058624 bytes. And try to investigate your partition table file PrimaryGPT.bin to make sure "boot" partition starting at 0x40000.
Click to expand...
Click to collapse
Nice work! But speaking as a non-technical guy, do you think there'll be an easier, less scary, way of rooting the D838 soon?
I've rooted and flashed all my previous phones but these instructions sound very complicated indeed...
Appreciate your amazing work,
You're the miracle creator!!
我也要說…這才是愛台灣啦+1 ～^^
It's true.
The procedure is too complicate for beginner to root the D838.
But be honestly, this is one small step for a man, a giant leap for D838 device owners.
I believe author will try to reform the procedure into a simple way.
It just takes time to improve it.
Again, thanks for your great work on D838.
So close, but the LGFlashTool doesn't want to recognise my D838, even after trying every driver I could find... So I'm stuck at unlucky step 13!
Sent from my LG-D838 using Tapatalk
sub69 said:
So close, but the LGFlashTool doesn't want to recognise my D838, even after trying every driver I could find... So I'm stuck at unlucky step 13!
Sent from my LG-D838 using Tapatalk
Click to expand...
Click to collapse
Do you get the message "Failed previousLoad()"? This seems to be caused by an invalid tot file.
OP any chance you can just up the tot files?
thelestat said:
Do you get the message "Failed previousLoad()"? This seems to be caused by an invalid tot file.
Click to expand...
Click to collapse
I did, but I think as an LG n00b it's a PEBKAC error. I'll keep reading and let you know when it works...
Sent from my LG-D838 using Tapatalk
Wrong check sum
According to above tutorial.
Someone had reply that the checksum is inccorect.
The correct checksum is 30252AC8 for d838body.bin
and E5ED3232 for f350body.bin
That's another tutorial by Taiwan developer named "z30152" had simplified the procedure which much easier for most user.
You can refer to http://www.mobile01.com/topicdetail.php?f=581&t=3864486&p=1
jc042982 said:
According to above tutorial.
Someone had reply that the checksum is inccorect.
The correct checksum is 30252AC8 for d838body.bin
and E5ED3232 for f350body.bin
That's another tutorial by Taiwan developer named "z30152" had simplified the procedure which much easier for most user.
You can refer to http://www.mobile01.com/topicdetail.php?f=581&t=3864486&p=1
Click to expand...
Click to collapse
Yeah, not sure what I'm doing wrong - I'm sure I've input the CRC correctly, but it's just not playing ball. Will have a look at the other tutorial later...
Thinking about it, it's possibly failing because I'm using a 16Gb HKG phone with the .kdz of the HKG firmware, but I expected the process to be the same, even if the CRC's are different...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
sub69 said:
Yeah, not sure what I'm doing wrong - I'm sure I've input the CRC correctly, but it's just not playing ball. Will have a look at the other tutorial later...
Thinking about it, it's possibly failing because I'm using a 16Gb HKG phone with the HKG firmware, but I expected the process to be the same, even if the CRC's are different...
Click to expand...
Click to collapse
Follow the instruction here!
I think you can extract the HKG version firmware and follow the instruction to merge with F350K.
This should be work properly for HKG version 16GB.
jc042982 said:
Follow the instruction here!
I think you can extract the HKG version firmware and follow the instruction to merge with F350K.
This should be work properly for HKG version 16GB.
Click to expand...
Click to collapse
Ohhhhh, reverse the hex-pairs!
I'm an idiot, I always forget to do that. Thanks, it looks far more promising now.
May I know how do I start to do this with 32GB International version? Currently the firmware is D83810a-SEA-XX
Yep, that did it.
So for anyone else trying this, follow the instructions in the OP precisely, and you should be fine, with the caveat that in Point 10 YOU HAVE TO REVERSE THE CRC32 HEX PAIRS when adding them to 0x08 in "myboothdr.bin"
My CRC32 value was "e46a6dcb" so I had to add "CB 6D 6A E4" into myboothdr.bin
Great work pcfree, and many thanks to jc042982 for pointing this LG n00b in the right direction.
thanks
would you please explain inside the header file:
44 DD 55 AA
how to make these values?
hkfriends said:
thanks
would you please explain inside the header file:
44 DD 55 AA
how to make these values?
Click to expand...
Click to collapse
Don't touch those, just open your myboothdr.bin file in a Hex Editor (I used HxD) and change the four pairs shown below (my CRC32 value for this file came up as b00db074 in "HashMyFiles", so I had to enter "74 B0 0D B0"):
hkfriends said:
thanks
would you please explain inside the header file:
44 DD 55 AA
how to make these values?
Click to expand...
Click to collapse
Which KDZ you extract from? 16GB? or 32GB?
What country?
I am having a 16GB D838 International Edition (Taiwan)
and the procedure is workable for all D838.
This only thing you need to do is extract the correct file from your origin firmware.
It depends by what country version you purchase, such as Taiwan, HK, or Singapore...etc.
THE ONLY DIFFERENCE IS STEP 6.Extract D838 firmware to get PrimaryGPT.bin (partition table), boot.bin (kernel) and the DLL file if KDZ.
*PLEASE your own firmware and extract it!
Other procedures are all the same with the post.
Be careful with the 16GB and 32GB PrimaryGPT_0.bin!!!
jc042982 said:
Which KDZ you extract from? 16GB? or 32GB?
What country?
I am having a 16GB D838 International Edition (Taiwan)
and the procedure is workable for all D838.
This only thing you need to do is extract the correct file from your origin firmware.
It depends by what country version you purchase, such as Taiwan, HK, or Singapore...etc.
THE ONLY DIFFERENCE IS STEP 6.Extract D838 firmware to get PrimaryGPT.bin (partition table), boot.bin (kernel) and the DLL file if KDZ.
*PLEASE your own firmware and extract it!
Other procedures are all the same with the post.
Be careful with the 16GB and 32GB PrimaryGPT_0.bin!!!
Click to expand...
Click to collapse
yep... i double check all related TOT files with header starting "44 DD 55 AA"
so I believe it is TOT header signature only
the only thing need to cater is what you said, PrimaryGPT.bin (partition table), boot.bin (kernel)
I am thinking it can ported to oher models...
hkfriends said:
yep... i double check all related TOT files with header starting "44 DD 55 AA"
so I believe it is TOT header signature only
the only thing need to cater is what you said, PrimaryGPT.bin (partition table), boot.bin (kernel)
I am thinking it can ported to oher models...
Click to expand...
Click to collapse
After successful root your device.
You can revise the platform.xml by following the instruction post by http://forum.xda-developers.com/showthread.php?t=2537793
I am success revise the platform and this allow you to read-write your external SD card.
The next step is revise the NAV Key, make it smaller^^
Hi, I'm a Galaxy S7 user and I've been trying to make sparse system.img from firmware tar file into a twrp-flashable zip file but I'm not sure which is the best way.
All operations are performed on latest linux mint and I'm not going to use any kitchen. All binaries used to convert images are compiled from latest AOSP sources.
Here are some of the methods I've tried.
a) Extract everything from system.img and set metadata infos in updater-script, just like any other "rom"s. (e.g. SuperMan Rom)
Probably one of the simplest ways, and system files inside the zip can be modified easily - extract, edit, recompress.
But this method has a potential of destroying unique permissions/owner infos, such as those of symlinks.
I'd like to flash the system.img "as-is," without making a mess with whatever's inside the image.
b) Extract raw system.img directly to /dev/block/platform/155a0000.ufs/by-name/SYSTEM.
Not so bad. Raw system.img can be easily generated with simg2img. But turns out to take too much time to flash and doesn't get along well with DualBoot patcher.
c) Sparse dat, like the ones used in most AOSP-based roms
Probably the most ideal one. But when I took the following steps to make it, I found out that system partition size gets kinda damaged or something.
- Convert system.img to raw system.img with simg2img.
- Convert the raw system.img to sparse image again with ext2simg, to make img2sdat.py work properly.
- Convert the sparse image to sparse dat with xpirt's img2sdat.py.
- Finally, convert the generated sparse dat to raw system image with sdat2img.py to check if partition size matches.
Then I get the following results.
- Size of original raw system.img : 4404019200
- Size of raw system.img generated in last step : about ~100MB smaller
I know I can loop mount system.img and then make a new sparse image with make_ext4fs,
but it also breaks some permissions and make_ext4fs won't recognize file_contexts.bin from nougat firmware whereas it worked well with marshmallow's.
If anyone's got a better method or a solution for method c please leave a reply. Thanks in advance.
kykint said:
Hi, I'm a Galaxy S7 user and I've been trying to make sparse system.img from firmware tar file into a twrp-flashable zip file but I'm not sure which is the best way.
All operations are performed on latest linux mint and I'm not going to use any kitchen. All binaries used to convert images are compiled from latest AOSP sources.
Here are some of the methods I've tried.
a) Extract everything from system.img and set metadata infos in updater-script, just like any other "rom"s. (e.g. SuperMan Rom)
Probably one of the simplest ways, and system files inside the zip can be modified easily - extract, edit, recompress.
But this method has a potential of destroying unique permissions/owner infos, such as those of symlinks.
I'd like to flash the system.img "as-is," without making a mess with whatever's inside the image.
b) Extract raw system.img and directly to /dev/block/platform/155a0000.ufs/by-name/SYSTEM.
Not so bad. Raw system.img can be easily generated with simg2img. But turns out to take too much time to flash and doesn't get along well with DualBoot patcher.
c) Sparse dat, like the ones used in most AOSP-based roms
Probably the most ideal one. But when I took the following steps to make it, I found out that system partition size gets kinda damaged or something.
- Convert system.img to raw system.img with simg2img.
- Convert the raw system.img to sparse image again with ext2simg, to make img2sdat.py work properly.
- Convert the sparse image to sparse dat with xpirt's img2sdat.py.
- Finally, convert the generated sparse dat to raw system image with sdat2img.py to check if partition size matches.
Then I get the following results.
- Size of original raw system.img : 4404019200
- Size of raw system.img generated in last step : about ~100MB smaller
I know I can loop mount system.img and then make a new sparse image with make_ext4fs,
but it also breaks some permissions and make_ext4fs won't recognize file_contexts.bin from nougat firmware whereas it worked well with marshmallow's.
If anyone's got a better method or a solution for method c please leave a reply. Thanks in advance.
Click to expand...
Click to collapse
What you're doing is quite complicated if you don't use kitchen. Simplify it for yourself and use kitchen.
Sent from my SM-S903VL using Tapatalk
Droidriven said:
What you're doing is quite complicated if you don't use kitchen. Simplify it for yourself and use kitchen.
Sent from my SM-S903VL using Tapatalk
Click to expand...
Click to collapse
I know that kitchens can do that for me, but they also don't flash system.img as-is.
Maybe I should just take a more look into the sparse dat method and see what breaks the partition size.
This is a program that I wrote to decode and re-encode the OnePlus 5T "logo.bin" file. Please read below so you can better understand this type of encoding being used:
What Is A Raw Image?
A raw image, whether it be a file or an image in memory, is simply pixel data. There is no extra information like width, height, name, end of line... Absolutely nothing, just pixel data. If you have an image that is raw and the resolution is 1080x1920 and you are using a typical RGB24 or BGR24 (like the ones used here), then your exact filesize or size in memory will be 1080x1920x3! We use 3 here because there is one byte for the R or red component, one for the G (green), and one for the B(blue).
What Is A Run Length Encoded Image?
A run length image encoding uses a count ;usually a single byte (char), 2 bytes (short int), or 4 bytes (long int); and then the pixel components. So instead of writing out 300 bytes of '0's to make a line of 100 black pixels. Black is RGB(0,0,0). You could encode this as 100, 0, 0, 0. And only use 4 bytes of data to get the exact same image as the 300 byte raw image. All the run length encoding I've found, except the Motorola style which is a little different, use a run length encoding that is pixel-oriented like this.
Now I've found this new one and it is a byte-oriented run length encoding. This is for runs of bytes, not pixels. You may think, well whats the big deal? When you add a little area of color, you increase the run length encoded image in you logo.bin immensely! You use 6 bytes per pixel if there aren't any runs of color data. If you had an image that was a 1080x1920 black image with a 25 pixel horizontal line in the middle. The encoder would be doing runs of black data efficiently until it reached the red area.
.....0 255 0 255 0 255 0 255 0 255 0 133 /// we've reached the top left corner of the red line /// 13 1 30 1 255 1 // << that was just one red pixel!! in bgr color order (13, 30, 255) <<// And it keeps going through the rest of the red pixels on that line using 6 bytes per pixel, which is the opposite of compression. Before reaching the red line the encoding was decoding to 255 zeros over and over, until finally 133 zeros. 255 zeros is 85 black pixels stored in just 2 bytes!
This type of encoding is ONLY good for grey scale images. It is not good with color, but it still will handle color of course. In grey scale, the Red, Blue, and Green data components are always the same values. All the way from black (0,0,0) to white (255, 255, 255); including every shade of grey in between>>>(1,1,1) (2,2,2) (3,3,3)....(243, 243, 243) (254, 254, 254)<<<
One other difference in this method of run length encoding is that the color byte is before the count, which is backwards from all of the other methods.
The attachment contains the executable that was compiled using mingw32 on a 64 bit Windows 10 PC. The PNG library that I used is LodePng, the source is in the download.
Big thanks to @RajGopi for sharing his logo.bin with me and requesting this mod, and testing it as well!:good:
To use the OnePlus 5T Logo Injector:
Decode your logo.bin:
Code:
OP5tLogo -i logo.bin -d
All the PNG 's will be extracted from logo.bin. Edit the PNG(s) that you want to change...
Note:
Your original "logo.bin" file is never changed, it is just read. If the file you try to load isn't a logo.bin file, or a different style, then the program will tell you and exit.
Inject the image(s) back in to the logo.bin:
Code:
OP5tLogo -i logo.bin -j fhd_oppo fhd_at
To list whats in your logo file:
Code:
OP5tLogo -i logo.bin -l
For a more detailed list:
Code:
OP5tLogo -i logo.bin -L
If the colors are messed up use the "-s" switch while decoding.
Code:
OP5tLogo -i logo.bin -d -s
If you had to use the "-s" switch to decode properly, you'll have to use it to inject also:
Code:
OP5tLogo -i logo.bin -j image_name -s
Note:
You can put as many names after "-j" as you want, and it's not case sensitive. You also don't have to put the whole name. If you just put "-j fhd" every image in the logo.bin that starts with "fhd" will be injected. There has to be a PNG with the name in the directory though
The size of your modified.logo.bin will displayed along with the original size, if everything went good. The 'splash' partition is 16 MB on the OnePlus 5T. If you use too much color on too many of the images you will easily go over 16 MB. The program will tell you and delete the "modified.logo.bin" that was created. If for some strange reason you would like to keep it, use the "-B" flag on the command.
The last step is to flash the modified logo file via fastboot with the command
Code:
fastboot flash LOGO modified.logo.bin
Use this at your own risk.
Always make backups.
Always.
Glad to see your work here.
Been waiting for this.
Merry Christmas
RajGopi said:
Glad to see your work here.
Been waiting for this.
Merry Christmas
Click to expand...
Click to collapse
Merry Christmas to you too. Thank you for being humble, understanding, patient, polite, and more than likely an upstanding individual in your realm.
Cool, thanks for this!
thank u so much, i was trying to figure out how to do it with the OP3/T/5 and could not figure it out, it just crashed.
Bradl79 said:
thank u so much, i was trying to figure out how to do it with the OP3/T/5 and could not figure it out, it just crashed.
Click to expand...
Click to collapse
- Extract the .exe
- Right click while holding 'shift' in the same folder where the .exe is located and 'open command window' here
- Place logo.bin in the same folder
- Run the commands from OP
makers_mark said:
Flash the "modified.logo.bin" file through fastboot.
Click to expand...
Click to collapse
Please forgive my ignorance. I think I got everything done properly. I just don't know what you mean by the above statement.
Normally, if I flash a new recovery in fastboot, I use the phrase fastboot flash recovery xxxx.img
What phrase do I use to flash the new logo.bin file?
Thanks,
Peter
P.S. Where on my OP5T is the original logo.bin file located?
P.P.S. I believe I found my logo.bin file; however, it appears I made some kind of mistake and now I simply have a black splash screen, and nothing I do gets the default splash screen back, including Nandroid restore. It always remains black. Does anyone have an original OP5T logo.bin file they can give me to download? Also, the file I found is called LOGO, not logo.bin. It's in the following directory:
/dev/block/bootdevice/by-name/
P.P.S. I also believe I found the right command in fastboot. Is this the command to flash the logo.bin file:
fastboot flash LOGO logo.bin ???
PeterGuru said:
Please forgive my ignorance. I think I got everything done properly. I just don't know what you mean by the above statement.
Normally, if I flash a new recovery in fastboot, I use the phrase fastboot flash recovery xxxx.img
What phrase do I use to flash the new logo.bin file?
Thanks,
Peter
P.S. Where on my OP5T is the original logo.bin file located?
P.P.S. I believe I found my logo.bin file; however, it appears I made some kind of mistake and now I simply have a black splash screen, and nothing I do gets the default splash screen back, including Nandroid restore. It always remains black. Does anyone have an original OP5T logo.bin file they can give me to download? Also, the file I found is called LOGO, not logo.bin. It's in the following directory:
/dev/block/bootdevice/by-name/
P.P.S. I also believe I found the right command in fastboot. Is this the command to flash the logo.bin file:
fastboot flash LOGO logo.bin ???
Click to expand...
Click to collapse
Try this one, flash in recovery just like any flashable zip
Let me know if you still want stock logo
Yes, fastboot flash LOGO logo.bin
PeterGuru said:
Please forgive my ignorance. I think I got everything done properly. I just don't know what you mean by the above statement.
Normally, if I flash a new recovery in fastboot, I use the phrase fastboot flash recovery xxxx.img
What phrase do I use to flash the new logo.bin file?
Thanks,
Peter
P.S. Where on my OP5T is the original logo.bin file located?
P.P.S. I believe I found my logo.bin file; however, it appears I made some kind of mistake and now I simply have a black splash screen, and nothing I do gets the default splash screen back, including Nandroid restore. It always remains black. Does anyone have an original OP5T logo.bin file they can give me to download? Also, the file I found is called LOGO, not logo.bin. It's in the following directory:
/dev/block/bootdevice/by-name/
P.P.S. I also believe I found the right command in fastboot. Is this the command to flash the logo.bin file:
fastboot flash LOGO logo.bin ???
Click to expand...
Click to collapse
Thanks for the question, but 49 out of 50 times I do not have the device that I am working with. When you use fastboot program, you flash `x` partition with `y` file.
It doesn't matter what `y` is, but `x` is the name of the particular partition that is case sensitive. You can rename `y` whatever you want. It is hard to find partition dumps or names, so I can not worry about what the actual partition name is for a particular device. I could of asked @RajGopi when he tested, but I did not. With nearing 9 million people on XDA, I will gladly let people do their own research or what not before flashing anything for unsaid reasons which others will understand unsaid. In the past I have guided people to this thread. But thank you for wanting more clarification on the actual command with fastboot, I will include it in the post since this program is made specifically for the OP5t.
RajGopi said:
Try this one, flash in recovery just like any flashable zip
Let me know if you still want stock logo
Yes, fastboot flash LOGO logo.bin
Click to expand...
Click to collapse
Worked perfectly. Thank you.
Peter
---------- Post added at 07:22 AM ---------- Previous post was at 07:21 AM ----------
makers_mark said:
Thanks for the question, but 49 out of 50 times I do not have the device that I am working with. When you use fastboot program, you flash `x` partition with `y` file.
It doesn't matter what `y` is, but `x` is the name of the particular partition that is case sensitive. You can rename `y` whatever you want. It is hard to find partition dumps or names, so I can not worry about what the actual partition name is for a particular device. I could of asked @RajGopi when he tested, but I did not. With nearing 9 million people on XDA, I will gladly let people do their own research or what not before flashing anything for unsaid reasons which others will understand unsaid. In the past I have guided people to this thread. But thank you for wanting more clarification on the actual command with fastboot, I will include it in the post since this program is made specifically for the OP5t.
Click to expand...
Click to collapse
Thank you for the detailed reply. I appreciate all your hard work. Have a great day.
Peter
RajGopi said:
Try this one, flash in recovery just like any flashable zip
Let me know if you still want stock logo
Yes, fastboot flash LOGO logo.bin
Click to expand...
Click to collapse
Argh! While your zip file worked perfectly, I'm now trying to modify the PNG file. I got everything done correctly (I think), but when I flash it, I still have your logo, not mine. Obviously there's something I'm doing wrong. Is there anything special about the PNG file? When I copy the modified logo.bin file back to the ZIP file, do I use standard compression or no compression?
Any ideas?
Peter
P.S. I'm trying to get the following PNG file as my Splash Boot image. If someone could create a flashable zip, that would be great, but I still would like to know what I did wrong. I want to learn how to do it, as I did with my OnePlus5.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
PeterGuru said:
Argh! While your zip file worked perfectly, I'm now trying to modify the PNG file. I got everything done correctly (I think), but when I flash it, I still have your logo, not mine. Obviously there's something I'm doing wrong. Is there anything special about the PNG file? When I copy the modified logo.bin file back to the ZIP file, do I use standard compression or no compression?
Any ideas?
Peter
P.S. I'm trying to get the following PNG file as my Splash Boot image. If someone could create a flashable zip, that would be great, but I still would like to know what I did wrong. I want to learn how to do it, as I did with my OnePlus5.
Click to expand...
Click to collapse
I hope you are renaming the output file to logo.bin and replacing it in the zip
- Check for image resolution
- Normal/standard compression will do fine
RajGopi said:
I hope you are renaming the output file to logo.bin and replacing it in the zip
- Check for image resolution
- Normal/standard compression will do fine
Click to expand...
Click to collapse
Yes, I renamed it to logo.bin, and I tried both normal/standard compression and no compression, but it's not working. Your splash continues to display.
What about the image itself? Must it be 256 colour gammut? I'm also assuming that it has to be a PNG file.
Peter
P.S. I even tried flashing the new zip AND by the fastboot method: fastboot flash LOGO logo.bin
PeterGuru said:
Yes, I renamed it to logo.bin, and I tried both normal/standard compression and no compression, but it's not working. Your splash continues to display.
What about the image itself? Must it be 256 colour gammut? I'm also assuming that it has to be a PNG file.
Peter
P.S. I even tried flashing the new zip AND by the fastboot method: fastboot flash LOGO logo.bin
Click to expand...
Click to collapse
I'll give you flashable zip tomorrow with the image you provided.
Yes, it must be a PNG
RajGopi said:
I'll give you flashable zip tomorrow with the image you provided.
Yes, it must be a PNG
Click to expand...
Click to collapse
Thank you. In the meantime, I'm going to try and figure out what's going wrong. I simply can't let this go. I have to solve the problem.
Regards,
Peter
P.S. I figured it out. I had to modify the encoding command to make it all work.
Was using: OP5tLogo -i logo.bin -j fhd_oppo fhd_at
Changed to: OP5tLogo -i logo.bin -j fhd_plus_oppo fhd_plus_at
Now everything is working perfectly. Thank you for your assistance.
Hi, I'm interested in doing this, but I never edited my bootlogo, any help on how to get the logo.bin from my phone?
Syzew said:
Hi, I'm interested in doing this, but I never edited my bootlogo, any help on how to get the logo.bin from my phone?
Click to expand...
Click to collapse
Have a look here, https://forum.xda-developers.com/oneplus-5/themes/guide-customize-oem-bootlogo-logo-img-t3704393
scoobyjenkins said:
Have a look here, https://forum.xda-developers.com/oneplus-5/themes/guide-customize-oem-bootlogo-logo-img-t3704393
Click to expand...
Click to collapse
OP3TInject crashes whenever I try to convert my logo.img, guess something's wrong with my pc.
Syzew said:
OP3TInject crashes whenever I try to convert my logo.img, guess something's wrong with my pc.
Click to expand...
Click to collapse
Sorry, I meant there's instructions there on how to extract your logo.bin, use the tool from here to extract and inject images with your dumpling logo.bin
Syzew said:
OP3TInject crashes whenever I try to convert my logo.img, guess something's wrong with my pc.
Click to expand...
Click to collapse
I'm preparing a detailed Guide on how to prepare and implement a custom boot splash. I should have it ready for download within the hour.
Peter
---------- Post added at 03:27 PM ---------- Previous post was at 02:46 PM ----------
Okay, as mentioned in my previous post, below is a detailed Guide on how to create your own custom boot splash for the OnePlus5T.
Download the PDF file here: https://www.dropbox.com/s/t45ld1abip5orhv/OnePlus5T Custom Boot Splash.pdf?dl=1
Regards,
Peter
Here's what I did,
Got new LG G6 (H87110b).
Wanted to upgrade my unit (basically from Nougat to Oreo).
As I am not in AT&T network there was no OTA updates. So I decided to flash kdz.
First I took a full DUMP of the G6 using patched LG UP.
Then followed the guide in here and flashed H87320g_00_OPEN_CA_OP_0809.kdz on H87110b.
Then flashed US99721e_01_0211.kdz on H87320g.
Device worked well at first. But later I experienced certain touch lags (specially after sign in with Google account).
I reset the unit several times, updated all apps, disabled some bloatware apps, but the lag was increased day by day and experienced some heat around finger print scanner.
Later I discovered locking and uncloaking was able to temporally fix lag.
So I enabled Developer Options, then ticked Show touches option. Then I saw five symmetrical touches on my screen (please watch this video). Actually that was the reason to touch lag. Screen was touched by itself!
I guessed this could be a software issue. So I got a H87330b_00_OPEN_CA_OP_0917.kdz file and flashed it on US99721e.
So I got a H87330b Android Pie G6 but with same horrible touch issue. Upgrade wasn't helped me.
Someone please help to figure,
Is this a hardware issue or software issue?
If it is on the software side, will going back to stock H87110b solve this?
Then how can I restore back my DUMP?
Please help! I still LOVE my LG G6! :crying:
I wish @clsA or @runningnak3d will address on this please..
RoboB said:
I wish @clsA or @runningnak3d will address on this please..
Click to expand...
Click to collapse
Good morning, I watched the video and I'm not sure whats going on with the ghost touch. It seems to be in a pattern of some sort so it may be totally normal.
As for returning to stock with the LGUP Dump. Its a matter of fastboot flashing each of the partitions back to the phone one at a time. It is possible to create a ROM that's flashable with TWRP or a batch file to flash in fastboot. I'll try and find something for you to use as a template or a good example.
Alright here's the Back to stock Rom script for the LG V20 20H > https://www.androidfilehost.com/?fid=1322778262904015326
the file is found here in the root of the zip \META-INF\com\google\android\updater-script"
Code:
ui_print("Flashing H910_20h_Oreo_full_stock");
ui_print("Please wait...");
ui_print(" ");
package_extract_file("aboot", "/dev/block/bootdevice/by-name/aboot");
package_extract_file("abootbak", "/dev/block/bootdevice/by-name/abootbak");
package_extract_file("apdp", "/dev/block/bootdevice/by-name/apdp");
package_extract_file("boot", "/dev/block/bootdevice/by-name/boot");
package_extract_file("cmnlib", "/dev/block/bootdevice/by-name/cmnlib");
package_extract_file("cmnlib64", "/dev/block/bootdevice/by-name/cmnlib64");
package_extract_file("cmnlib64bak", "/dev/block/bootdevice/by-name/cmnlib64bak");
package_extract_file("cmnlibbak", "/dev/block/bootdevice/by-name/cmnlibbak");
package_extract_file("devcfg", "/dev/block/bootdevice/by-name/devcfg");
package_extract_file("devcfgbak", "/dev/block/bootdevice/by-name/devcfgbak");
package_extract_file("factory", "/dev/block/bootdevice/by-name/factory");
package_extract_file("hyp", "/dev/block/bootdevice/by-name/hyp");
package_extract_file("hypbak", "/dev/block/bootdevice/by-name/hypbak");
package_extract_file("keymaster", "/dev/block/bootdevice/by-name/keymaster");
package_extract_file("keymasterbak", "/dev/block/bootdevice/by-name/keymasterbak");
package_extract_file("laf", "/dev/block/bootdevice/by-name/laf");
package_extract_file("lafbak", "/dev/block/bootdevice/by-name/lafbak");
package_extract_file("modem", "/dev/block/bootdevice/by-name/modem");
package_extract_file("msadp", "/dev/block/bootdevice/by-name/msadp");
package_extract_file("persist", "/dev/block/bootdevice/by-name/persist");
package_extract_file("pmic", "/dev/block/bootdevice/by-name/pmic");
package_extract_file("pmicbak", "/dev/block/bootdevice/by-name/pmicbak");
package_extract_file("raw_resources", "/dev/block/bootdevice/by-name/raw_resources");
package_extract_file("raw_resourcesbak", "/dev/block/bootdevice/by-name/raw_resourcesbak");
package_extract_file("recovery", "/dev/block/bootdevice/by-name/recovery");
package_extract_file("recoverybak", "/dev/block/bootdevice/by-name/recoverybak");
package_extract_file("rct", "/dev/block/bootdevice/by-name/rct");
package_extract_file("rpm", "/dev/block/bootdevice/by-name/rpm");
package_extract_file("rpmbak", "/dev/block/bootdevice/by-name/rpmbak");
package_extract_file("sec", "/dev/block/bootdevice/by-name/sec");
package_extract_file("tz", "/dev/block/bootdevice/by-name/tz");
package_extract_file("tzbak", "/dev/block/bootdevice/by-name/tzbak");
package_extract_file("xbl", "/dev/block/bootdevice/by-name/xbl");
package_extract_file("xbl2", "/dev/block/bootdevice/by-name/xbl2");
package_extract_file("xbl2bak", "/dev/block/bootdevice/by-name/xbl2bak");
package_extract_file("xblbak", "/dev/block/bootdevice/by-name/xblbak");
ui_print("Now installing system -- please wait...");
package_extract_file("system", "/dev/block/bootdevice/by-name/system");
ui_print("Enjoy The Update");
To restore your modems you need to add this to the above script
Code:
package_extract_file("modem", "/dev/block/bootdevice/by-name/modem");
package_extract_file("modemst1", "/dev/block/bootdevice/by-name/modemst1");
package_extract_file("modemst2", "/dev/block/bootdevice/by-name/modemst2");
package_extract_file("fsg", "/dev/block/bootdevice/by-name/fsg");
Hint: you must use a text editor like Notepad++ if you edit the file.
Hint: it's actually easier to download the above Rom and just replace the files in the zip with yours
Your zip may not contain everything in the above zip. you can edit it as needed.
Ok, I got you. Thanks! But..,
clsA said:
Hint: it's actually easier to download the above Rom and just replace the files in the zip with yours
Your zip may not contain everything in the above zip. you can edit it as needed.
Click to expand...
Click to collapse
Good evening and thank you for your quick reply!
I downloaded H910_20h_Oreo_full_rooted.zip and opened it from 7zip.
There are 42 objects with one folder named META-INF and two .img files named h91020Hpatched_boot.img and v20h_stock_boot.img.
But my G6 DUMP folder has 70 items and no .img files.
So, here's what I'm to do. Please correct me if there's any mistake..
Delete all files in H910_20h_Oreo_full_rooted.zip (except META-INF folder) and copy all 70 files from DUMP in to the zip.
Open \META-INF\com\google\android\updater-script file and edit it as you described.
So there will be 70 lines like package_extract_file("xxxx", "/dev/block/bootdevice/by-name/xxxx"); and some ui_print commands.
Am I correct?
Is editing, updater-script file with Windows Notepad wrong?
What should do to .img files as I don't have any for G6?
RoboB said:
Good evening and thank you for your quick reply!
I downloaded H910_20h_Oreo_full_rooted.zip and opened it from 7zip.
There are 42 objects with one folder named META-INF and two .img files named h91020Hpatched_boot.img and v20h_stock_boot.img.
But my G6 DUMP folder has 70 items and no .img files.
So, here's what I'm to do. Please correct me if there's any mistake..
Delete all files in H910_20h_Oreo_full_rooted.zip (except META-INF folder) and copy all 70 files from DUMP in to the zip.
Open \META-INF\com\google\android\updater-script file and edit it as you described.
So there will be 70 lines like package_extract_file("xxxx", "/dev/block/bootdevice/by-name/xxxx"); and some ui_print commands.
Am I correct?
Is editing, updater-script file with Windows Notepad wrong?
What should do to .img files as I don't have any for G6?
Click to expand...
Click to collapse
you can forget the .img files their not important
what is important is all the files in the code are in the zip
I would first just ad the 42 files plus the 3 modem files to the zip
edit the script to include the modem files and use notepad++ ...windows notepad will not work
@clsA Though I got a flash-able zip, what can I do with a non rooted device?
I searched but couldn't find a way to root H873 one. So I think I should go back to Oreo US997 by flashing US99721e_01_0211.kdz via LG UP and try to root it.
Please let me know if I'm wrong..
RoboB said:
@clsA Though I got a flash-able zip, what can I do with a non rooted device?
I searched but couldn't find a way to root H873 one. So I think I should go back to Oreo US997 by flashing US99721e_01_0211.kdz via LG UP and try to root it.
Please let me know if I'm wrong..
Click to expand...
Click to collapse
If their is still no bootloader unlock for your device your pretty much Done. With an unlocked bootloader you could do the LGUP Dump restore via fastboot
the bad thing about using fastboot is their is no error correction, if you type one letter wrong you could brick you device forever.
That being said, If you still want to restore your backup the above script can be changed into a batch file of sorts.
Take the modem files as an example
Code:
package_extract_file("modem", "/dev/block/bootdevice/by-name/modem");
Becomes >>[COLOR="Blue"] fastboot flash modem modem[/COLOR]
package_extract_file("modemst1", "/dev/block/bootdevice/by-name/modemst1");
Becomes >>[COLOR="Blue"] fastboot flash modemst1 modemst1[/COLOR]
package_extract_file("modemst2", "/dev/block/bootdevice/by-name/modemst2");
Becomes >>[COLOR="Blue"] fastboot flash modemst2 modemst2[/COLOR]
package_extract_file("fsg", "/dev/block/bootdevice/by-name/fsg");
Becomes >>[COLOR="Blue"] fastboot flash fsg fsg[/COLOR]
The final .bat file would look like this
Code:
fastboot flash modem modem
fastboot flash modemst1 modemst1
fastboot flash modemst2 modemst2
fastboot flash fsg fsg
fastboot reboot
you would of course have renamed all the files, removing the _comx from them and copied them to the fastboot folder
If you make your script like this I suggest flashing it one line at a time and note any errors in the command prompt.
fastboot flash system system > could take a vary long time don't get in a hurry and just wait
Hint: Its also worth noting you most likely don't need to flash any file that ends in the letters bak
example laf gets flashed where lafbak doesn't
rpm gets flashed > rpmbak doesn't
this should shorten your list considerably
Code:
PS C:\platform-tools> fastboot flash aboot aboot target reported max download size of 536870912 bytes
sending 'aboot' (2048 KB)...
OKAY [ 0.094s]
writing 'aboot'...
FAILED (remote: device is locked. Cannot flash images)
finished. total time: 0.109s
@clsA And not supported by LG Developer - Unlock Bootloader at https://developer.lge.com/
RoboB said:
@clsA And not supported by LG Developer - Unlock Bootloader at https://developer.lge.com/
Click to expand...
Click to collapse
Yeah that's basically why I stuck with the V20 and it was my last LG
Sent from my ONEPLUS A6010 using Tapatalk
@clsA That means I have to live with this ghost touches? Oh! how sad..
BTW isn't there any way to make kdz file from DUMP?
The device is a Sam Gal A11W.
I want to change one text file in the /system partition.
In order to do that, I want to start from the stock firmware I already downloaded, make the change then flash the whole modified firmware.
There are 5 .tar.md5 files (4 if we consider only one of CSC_ and HOME_CSC_) in this firmware, which can be flashed just fine in their original form.
What I want to do is to:
1 - unpack the AP_***.tar file (contains meta-data/fota.zip, boot.img.lz4, carrier.img.lz4, dtbo.img.lz4, metadata.img.lz4, recovery.img.lz4, super.img.lz4, userdata.img.lz4, vbmeta.img.lz4)
2 - unlz4 the super.img.lz4,
3 - unsparse the super.img to super.ext4.img (using simg2img)
4 - lpunpack the super.ext4.img into individual dynamic partitions (there are only 4: odm.img, product.img, system.img, vendor.img - this is NOT an A/B device !!)
5 - modify the text file on system.img
6 - lpmake the super.ext4.img back from odm.img, product.img, system.img, vendor.img
7 - re-sparse the super.ext4.img back into super.img (using img2simg)
8 - lz4 the super.img back into super.img.lz4
9 - Re-TAR the super.img.lz4 file plus all the rest of the original .img.lz4 files back into the AP_***.tar file
10 - Flash the AP_***.tar file to this mother****ing piece of Samsung crap without errors, and that is WITHOUT UNLOCKED BOOTLOADER, because the scumbags eliminated the OEM Unlock option from the Dev Options.
What I already know is:
- How to do the whole process without preserving any signatures.
This is already explained in this thread:
Editing system.img inside super.img and flashing our modifications
I'm trying to modify my system.img (/system/build.prop) to include support for multi users. After struggling a lot, I've succeeded following your guide (that's an awesome work btw) to unpack, mount, modify, umount and repack super.img. Then...
forum.xda-developers.com
but the author assumes the bootloader can be unlocked and therefore doesn't deal with any signatures / security-crypto-baloney checks.
What I (still) need to know is:
1 - How many crypto-security-baloney-whatever-signatures are there on all these files ?
2 - How can I restore them during repackaging so the flashing process does not get screwed up by the locked phone ?
If anyone here knows the answer to these 2 things ... well I guess they must be the Android Godfather Almighty !!
have you figured this out?
FugkGoocle said:
The device is a Sam Gal A11W.
I want to change one text file in the /system partition.
In order to do that, I want to start from the stock firmware I already downloaded, make the change then flash the whole modified firmware.
There are 5 .tar.md5 files (4 if we consider only one of CSC_ and HOME_CSC_) in this firmware, which can be flashed just fine in their original form.
What I want to do is to:
1 - unpack the AP_***.tar file (contains meta-data/fota.zip, boot.img.lz4, carrier.img.lz4, dtbo.img.lz4, metadata.img.lz4, recovery.img.lz4, super.img.lz4, userdata.img.lz4, vbmeta.img.lz4)
2 - unlz4 the super.img.lz4,
3 - unsparse the super.img to super.ext4.img (using simg2img)
4 - lpunpack the super.ext4.img into individual dynamic partitions (there are only 4: odm.img, product.img, system.img, vendor.img - this is NOT an A/B device !!)
5 - modify the text file on system.img
6 - lpmake the super.ext4.img back from odm.img, product.img, system.img, vendor.img
7 - re-sparse the super.ext4.img back into super.img (using img2simg)
8 - lz4 the super.img back into super.img.lz4
9 - Re-TAR the super.img.lz4 file plus all the rest of the original .img.lz4 files back into the AP_***.tar file
10 - Flash the AP_***.tar file to this mother****ing piece of Samsung crap without errors, and that is WITHOUT UNLOCKED BOOTLOADER, because the scumbags eliminated the OEM Unlock option from the Dev Options.
What I already know is:
- How to do the whole process without preserving any signatures.
This is already explained in this thread:
Editing system.img inside super.img and flashing our modifications
I'm trying to modify my system.img (/system/build.prop) to include support for multi users. After struggling a lot, I've succeeded following your guide (that's an awesome work btw) to unpack, mount, modify, umount and repack super.img. Then...
forum.xda-developers.com
but the author assumes the bootloader can be unlocked and therefore doesn't deal with any signatures / security-crypto-baloney checks.
What I (still) need to know is:
1 - How many crypto-security-baloney-whatever-signatures are there on all these files ?
2 - How can I restore them during repackaging so the flashing process does not get screwed up by the locked phone ?
If anyone here knows the answer to these 2 things ... well I guess they must be the Android Godfather Almighty !!
Click to expand...
Click to collapse
Try using modified/patched Odin. As for trying to bypass unlocking the bootloader to flash the modified firmware or trying to "mimic" or "fake" the original signature, that isn't going to work. Samsung's proprietary signature is an enigma that can't be cracked. Though you might be able to match the MD5 by adding a dummy file to the file you are modifying and filing it bit/byte by bit/byte, one step at a time, the goal is to add characters to the file until it is large enough to make your modified file match the original file's MD5. That is if your modified file is smaller than the original file, if your modified file is larger than the original file, you can delete unimportant files from the modified MD5 file until it is smaller than the original MD5 and then create the dummy file filled with dummy characters until it exactly matches the original MD5 bit for bit. Then try flashing your MD5 file once you gets it's MD5 code matching bit for bit. Try the patched version of Odin to flash your modified file. No guarantees that it will work but part of the security checks during flashing checks the MD5 for a match/mismatch.
Rab_DaJew said:
have you figured this out?
Click to expand...
Click to collapse