Related
I'm working on a kernel for the Samsung Exhibit II. I used dsixda's Android Kitchen to rip the initramfs from the stock kernel, it looks good, and I can edit it and rejoin it to the stock zImage w/o problems. Boots fine.
When I compile the zImage from source, initramfs is apparently not making into the kernel.
Code:
Android 'magic' header not found at start of boot.img
Checking if it exists elsewhere ...
Warning: Android header not found in boot.img (unsupported format)
Kernel found at offset 24061976 in boot.img
Making folder BOOT-EXTRACTED ...
Extracting kernel ...
Error: zImage is empty!
Extracting ramdisk ...
Error: No ramdisk folder found!
However, initramfs is being found & generated by the kernel compile. In Kernel/usr:
3549184 Jan 25 16:02 initramfs_data.cpio
Click to expand...
Click to collapse
Dumping the contents of the cpio file show the expected initramfs.
Any help appreciated, thanks.
Me to.
Please help someone!
jocala said:
I'm working on a kernel for the Samsung Exhibit II. I used dsixda's Android Kitchen to rip the initramfs from the stock kernel, it looks good, and I can edit it and rejoin it to the stock zImage w/o problems. Boots fine.
When I compile the zImage from source, initramfs is apparently not making into the kernel.
Android 'magic' header not found at start of boot.img
Checking if it exists elsewhere ...
Warning: Android header not found in boot.img (unsupported format)
Kernel found at offset 24061976 in boot.img
Making folder BOOT-EXTRACTED ...
Extracting kernel ...
Error: zImage is empty!
Extracting ramdisk ...
Error: No ramdisk folder found!
However, initramfs is being found & generated by the kernel compile. In Kernel/usr:
Dumping the contents of the cpio file show the expected initramfs.
Any help appreciated, thanks.
Click to expand...
Click to collapse
You need to make sure you add location of initramfs to config file
:: LOVE MY HATERS :: DARKSIDE ::
where you add the location address of the file?
Hi,
I've managed to modify the bootargs image and changed the partition table to let the MMB-422 support a system partition of 500MB and a Userdata partition of 1500MB!!! I needed a larger userdata partition to run XBMC, now it works!
Features:
System partition size: 500MB
Userdata partition size: 1500MB
SDcard partition size: 1524MB
Bootlogo changed to HiMedia bootlogo because I like that one :razz:
Install:
Unzip the file to your harddrive...(you need 7zip to unzip it!!)
Run the Fastboot 3.1 program provided in the zip
Select the Partition_table_MMB422_500M_1500M.xml file
Be sure that every partition is selected!
Click 'Erase' button....
When finished close fastboot program and run it again
Then again select the Partition_table_MMB422_500M_1500M.xml file
Be sure that every partition is selected!
Now click 'Burn' button and wait until the firmware is completely flashed
The flash proces can take a while (15min) because of the larger partitions.....have patience!
Need more help? See meteorit.wikia.com/wiki/MMB-422.HDTV/Software-Updates#Update_from_android_2.2_.28FroYo.29_to_4.0.3_.28IceCreamSandwich.29
Download:
dropbox.com/s/twwxra6ubk2i9km/Meteorit%20MMB-422_500M-1500M.7z
Hi Boobes
I successfully burnt your Image to my MMB-422.HDTV to install XBMC, as you had done.
But if i try to install the actual XBMC für Android package (12.1. Frodo from XBMC repository) a message appears that this Version is not for this device !
coan you tell me which Version or how you have installed XBMC ?? thanks a lot in advance
Big11
XBMC MMB-422 HowTo
First of all, install all updates on your MMB-422 and be sure to have a proper internet connection. Then install MX-player from the android market.
Then install XBMC XAF build for Non-NEON set top boxes:
code.google.com/p/xbmc-android/downloads/detail?name=xbmcapp-armeabi-v7a-debug-2013-03-03-no-neon-744f0fb8de2b470b1d9957be1105fd5d0a25b0af.apk&can=2&q=
Then download playerfactory.xml
code.google.com/p/xbmc-android/downloads/detail?name=playercorefactory.xml&can=2&q=
Place the playerfactory.xml in the /data/Android/data/org.xbmc.xbmc/files/.xbmc/userdata directory
Then run XBMC!
Thanks a lot for your Support !! It really works now !!
The only thing is, i do not have a directory "/data/Android/data/org.xbmc.xbmc/files/.xbmc/userdata",
but just "/data/Android/data/org.xbmc.xbmc/files/" !?
Maybe this is causing of the box is not rooted ? or is it rooted ?? and if not, how can i do that ??
Have a nive day
Big11
XBMC userdata dir
Hi Big11,
the dir is located on your 'default storage space'. On my box it is an external SD-card and located at /mnt/sda/sda1/Android/data/org.xbmc.xbmc/files/.xbmc/userdata
the .xbmc folder is a hidden directory because of the dot in front of the dir name. To see that dir you have to enable the option to show hidden directorys in your favorite file manager. I use Filemanager HD from Rhythm software. You can find it in Android Play store.
What about Root function, I'm releasing a Toolbox for the MMB-422 ICS firmware in a short while. It will enable root functionality on our MMB-422 and some more features.
Maybe you can post this XBMC-howto on the android-hilfe.de forum because my German writing skills are not as good as my English writing skills. Reading of German fora is not a problem at all for me. Thanks in advance!
Thanks !! I found this Directory at all..
Thinking of the dot !!
I will provide this instruction at the Android-Hilfe-Forum
with pleasure..
Now i'm still looking forward for your ToolBox!
Thx a lot ! You made a great Box from this tiny Box for me !
I have been trying to backup the efs folder on Samsung galaxy Music GT-S6010 using EFS Professional v2.0.62 and when the software is "Extracting PIT from device for mapping ..." it shows "operation failed" and gives a prompt showing it was "Unable to extract PIT from device!".
I have attached a screenshot of the issue, anyone kindly help.
Similar problem on Galaxy S GT I9000, MORE DETAILS given
Hello,
I have a problem with EFS Professional. I searched the development thread (http://forum.xda-developers.com/showthread.php?t=1308546) and googled it as well. Although some solutions were offered my problem is not solved. I am not a complete newbie but not an expert either, so maybe I have a really simple issue here?
I am simply trying to backup the EFS partition on Samsung Galaxy S GT I9000.
The problem in short:
1. All seems to be well on welcome tab.
2. While running the backup, I get “Unable to read PIT file!” and the process stops.
3. If I run it again it skips the PIT file part saying “Skipped, already exists.” And then a popup shows saying “unable to create archive!”
4. Note: a tar.gz file is actually created and placed in a new EFSProBackup folder on the phone under /mnt/sdcard. The size of this file is only 29 Bytes and I think its basically an empty file).
Note that I did change my Busybox to version 1.20.0.git (but not 1.20.0 if it makes any difference?) as was suggested).
Can anyone help?
Please see a detailed description below.
Many thanks!
Detailed description:
• Using Windows XP
• EFS Professional 2.0.70
• Busybox 1.20.0.git
• Samsung USB Driver: 1.5.27.0_2
• Firewall – OFF
• USB Debugging – ON
• Mass Storage – OFF (I tried it with Mass Storage ON as well and it gives only the result as in step 2 described above no matter how many times I run it)
• Unknown Sources (if at all relevant) – ON
• Allow mock locations (if at all relevant) - ON
EFS Professional selections, logs & popups:
Welcome tab:
Log:
Checking application environment... Okay.
Initializing ADB server... Okay.
-----------------------------------
Performing device checks...
-----------------------------------
Root status: Perm Rooted.
SU binary version: 3.1.1
-----------------------------------
BusyBox status: Installed.
BusyBox binary version: 1.20.0.git
-----------------------------------
EFS Professional is ready for use.
-----------------------------------
Backup tab:
• device filter set to “*** All Partitions ***”
• selected the (only) one EFS partition found: /dev/block/stl3
• Pressed Backup
Log:
Checking device connection... Device is connected!
Checking for block device: '/dev/block/mmcblk0'... Okay.
Extracting PIT from device for mapping... Okay.
Operation failed!
A popup comes up saying: “Unable to read PIT file!”
• When I press Backup again
Log:
Checking device connection... Device is connected!
Checking for block device: '/dev/block/mmcblk0'... Okay.
Extracting PIT from device for mapping... Skipped, already exists.
Checking backup folder location... Okay.
Backing up selected partition(s)...
Creating archive: GT-I9000_20130928_114424.tar.gz...
Operation failed!
A popup comes up saying: “Unable to create archive”
Efs backup
Try online Nandroid backup app. It will back up everything including the EFS folder.
Perfect!
It's so much simpler and works like a dream! I just hope it will work as promised if anything goes wrong while flashing a new ROM!
Many thanks for your reply!
:good:
backup IMEI on galaxy ace 2 i8610
Hello
I have the same problem with my galaxy ace 2 i8610
I get a popup shows saying “unable to create archive!”
Does anyone can help me ?
Thanks
---------- Post added at 03:38 AM ---------- Previous post was at 03:29 AM ----------
Hello
I have a galaxy ace 2 i8610 and when I try to backup on EFS pro 2.0.70, I get this message :
Checking device connection... Device is connected!
Checking for block device: '/dev/block/mmcblk0'... Okay.
Extracting PIT from device for mapping... Skipped, already exists.
Checking backup folder location... Okay.
Backing up selected partition(s)...
Creating archive: GT-I8160_20131105_101505.tar.gz...
Operation failed!
Does anyone can help me ?
Thanks[
efs professinal erorr!
hiii....I was backuping my efs or radio's data from tablet n8000 but today i see this erorr!!! my efsprofessinal is in c:\ and adb devicse is working!!please guide mi...tanks
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
most part of Introduction from taken sdat2img thread
if you want extract non OTA zip i suggest to use sdat2img tool
FOR AB OTA ZIPS USE THIS SCRIPT AND PAYLOAD EXTRACTOR
in this tools i made block_image_update() function from android recovery to a binary to run on PC and patch system.img with DAT files on OTA package to update system.img by OTA
also we have apply_patch() function for patching boot.img and other files like firmwares
Introduction
You probably know already that starting from Android 5.x (Lollipop) compiled roms (aosp,cm,stock) are not compressed anymore the way they used to be on previous android versions. On previous versions all content inside /system folder that has to be extracted within our device was either uncompressed (simple /system folder inside our flashable zip) or compressed in a system.img file, which it is a ext4 compressed file; both of these, anyway, were readable and we could see all system files (app,framework, etc).
The problem comes in >=5.0 versions, this method is not used anymore. Why? Because roms started to be always larger, so it is necessary to compress them even more.
What does new Android zips (full roms, but also OTAs) contain?
New Android flashable zips are made this way:
boot.img (kernel)
file_contexts (selinux related)
META-INF (folder containing scripts)
system.new.dat (compressed /system partition)
system.patch.dat (for OTAs)
system.transfer.list (see explanation below)
and other patch files (.p only on OTA zip)
What does updater-script contains then?
The updater-script uses a brand new function: block_image_update(), this method basically decompresses necessary files inside the device. Let's study it.
From google git source code, if we go inside the new file /bootable/recovery/updater/blockimg.c, we find at the end of it the registration of the function block_image_update() as the method BlockImageUpdateFn() which starts at line 254. Here finally we find all information we need to know about the decompression of the .dat file(s). First file we analyze is system.transfer.list which Google tells us:
The transfer list is a text file containing commands to transfer data from one place to another on the target partition.
Click to expand...
Click to collapse
But what each line means?:
First line is the version number of the transfer list; 1 for android 5.0.x, 2 for android 5.1.x, 3 for android 6.0.x, 4 for android 7.x
Second line is the total number of blocks being written
Third line is how many stash entries are needed simultaneously (only on versions >= 2)
Fourth line is the maximum number of blocks that will be stashed simultaneously (only on versions >= 2)
Fifth line and subsequent lines are all individual transfer commands.
Click to expand...
Click to collapse
all transfer commands is :
bsdiff
*erase
free
imgdiff
move
*new
stash
*zero
BlockImageUpdate is reading system.transfer.list and executing all commands
But BlockImageVerify doesn’t execute * commands, which not to make changes on system.img just verifying update can happen
original sdat2img tool only support "new" command
Ok, but how to Patch the system.img with OTA files?
All instructions are below. binaries are involved. Please read carefully step by step.
You can use/modify these files and/or include them in your work as long as proper credits and a link to this thread are given.
If you have questions or problems
write here
Thanks
- @xpirt , for original sdat2img tool and useful thread
XDA:DevDB Information
IMG Patch Tools, sdat2img for OTA zips, Tool/Utility for all devices (see above for details)
Contributors
erfanoabdi
Source Code: https://github.com/erfanoabdi/imgpatchtools
Version Information
Status: Testing
Created 2017-07-21
Last Updated 2020-01-23
Usage
Code:
./BlockImageUpdate <system.img> <system.transfer.list> <system.new.dat> <system.patch.dat>
args:
<system.img> = block device (or file) to modify in-place
<system.transfer.list> = transfer list (blob) from OTA/rom zip
<system.new.dat> = new data stream from OTA/rom zip
<system.patch.dat> = patch stream from OTA/rom zip
Code:
./ApplyPatch <file> <target> <tgt_sha1> <size> <init_sha1(1)> <patch(1)> [init_sha1(2)] [patch(2)]...
args:
<file> = source file from rom zip
<target> = target file (use "-" to patch source file)
<tgt_sha1> = target SHA1 Sum after patching
<size> = file size
<init_sha1> = file SHA1 sum
<patch> = patch file (.p) from OTA zip
Code:
usage: ./scriptpatcher.sh <updater-script>
args:
<updater-script> = updater-script from OTA zip to patch recovery commands
Example
for example from updater-script of OTA we have:
Code:
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat")
apply_patch("EMMC:/dev/block/bootdevice/by-name/boot:33554432:f32a854298814c18b12d56412f6e3a31afc95e42:33554432:0041a4df844d4b14c0085921d84572f48cc79ff4",
"-", 0041a4df844d4b14c0085921d84572f48cc79ff4, 33554432,
f32a854298814c18b12d56412f6e3a31afc95e42,
package_extract_file("patch/boot.img.p"))
after getting system.img and boot.img from firmware This is equals of previous functions on PC with this tools:
Code:
~$ ./BlockImageUpdate system.img system.transfer.list system.new.dat system.patch.dat
~$ ./ApplyPatch boot.img - 0041a4df844d4b14c0085921d84572f48cc79ff4 33554432 f32a854298814c18b12d56412f6e3a31afc95e42
scriptpatcher.sh will generate all commands automatically from updater script so run it like:
Code:
~$ ./scriptpatcher.sh META-INF/com/google/android/updater-script > fullpatch.sh
check fullpatch.sh your self, you need to provide all images and files in correct name and patch as mentioned in mount and other commands of fullpatch.sh
Building Requirements
For Building this tool you need :
zlib
libbz2
openssl
It currently supports Linux x86/x64 & MacOS, Not tested on Windows.
Compile and Build command:
Code:
make
Youtube
Download links:
GitHub Release
Changelog:
GitHub Commits
Known Bugs/Issues:
Plz test and report
Nice work
Very nice
Sent from my LG-LS997 using Tapatalk
Wow, I tried to apply OTAs manually myself, but never got it to work. Getting the propper tools from you is awesome!
One tiny question though: Does applying/verifying a system update to system.img require a lot of temporary space or memory?
I am running Ubuntu x64 in a VM (VirtualBox) on Windows 10. Verifying a system update doesn't really do much, except keeping the CPU busy.
This is the output of "./BlockImageVerify system.img system.transfer.list system.new.dat system.patch.dat":
Code:
performing verification
creating cache dir cache
cache dir: cache
blockimg version is 3
maximum stash entries 236
creating stash cache/537ed49fb5f6c32dc3d205d78b6084fe54f70cd3/
The cache folder remains empty, there is no harddisk activity and only the CPU is working at 100 %. I interrupted BlockImageVerify after 30 minutes.
daniel_m said:
Wow, I tried to apply OTAs manually myself, but never got it to work. Getting the propper tools from you is awesome!
One tiny question though: Does applying/verifying a system update to system.img require a lot of temporary space or memory?
I am running Ubuntu x64 in a VM (VirtualBox) on Windows 10. Verifying a system update doesn't really do much, except keeping the CPU busy.
This is the output of "./BlockImageVerify system.img system.transfer.list system.new.dat system.patch.dat":
The cache folder remains empty, there is no harddisk activity and only the CPU is working at 100 %. I interrupted BlockImageVerify after 30 minutes.
Click to expand...
Click to collapse
Ah actually yes you need free space on RAM as much as both patch.dat and new.dat sizes
It's on my todo list to fix it, https://github.com/erfanoabdi/imgpatchtools/blob/master/blockimg/blockimg.cpp#L383
How to extract the file system.new.dat
evangelico793 said:
How to extract the file system.new.dat
Click to expand...
Click to collapse
You can find it in OTA zip
Motorola? See this : motorola.erfanabdi.ir
erfanoabdi said:
You can find it in OTA zip
Motorola? See this : motorola.erfanabdi.ir
Click to expand...
Click to collapse
No longer look at the picture
erfanoabdi said:
You can find it in OTA zip
Motorola? See this : motorola.erfanabdi.ir
Click to expand...
Click to collapse
Something Looks Wrong ReCheck inputs Or No Update Available
for moto g4 play 6.0.1
evangelico793 said:
No longer look at the picture
Click to expand...
Click to collapse
Please send picture again
404 not found
evangelico793 said:
Something Looks Wrong ReCheck inputs Or No Update Available
for moto g4 play 6.0.1
Click to expand...
Click to collapse
You are doing something wrong see thread for help and examples
@erfanoabdi
Thank you a ton for these tools!
They work like a charm :good:
I knew there must be a way to do this, but it's definitely above my paygrade.
@erfanoabdi
I've been trying scriptpatcher.sh on various updater-scripts and have noticed some bugs.
If you're interested in looking at the files, let me know and I'll post them.
Q9Nap said:
@erfanoabdi
I've been trying scriptpatcher.sh on various updater-scripts and have noticed some bugs.
If you're interested in looking at the files, let me know and I'll post them.
Click to expand...
Click to collapse
Yeah, there's lots of bugs in that script
I appreciate any kind of help
So far i know :
Only supporting /dev/block/boot.../by-name partitions
Can't mount ext4 in macOS
I disabled verify, but we can verify images
And i haven't tested it so much
If it gets more complicated Maybe we have to rewrite it on python.
erfanoabdi said:
Yeah, there's lots of bugs in that script
I appreciate any kind of help
So far i know :
Only supporting /dev/block/boot.../by-name partitions
Can't mount ext4 in macOS
I disabled verify, but we can verify images
And i haven't tested it so much
If it gets more complicated Maybe we have to rewrite it on python.
Click to expand...
Click to collapse
*removed*
@erfanoabdi
I noticed that there was an update to the source today to enable the bonus file argument.
I tried to create a recovery.img with a boot.img, recovery-from-boot.p, and recovery-resource.dat.
I tried patching to create a new recovery image and also tried patching the boot image in place.
It always returns "Unknown patch file format".
I am able to use these files to create recovery with the on-device applypatch binary, so not sure why it's throwing the "unknown patch file format" error.
Q9Nap said:
@erfanoabdi
I noticed that there was an update to the source today to enable the bonus file argument.
I tried to create a recovery.img with a boot.img, recovery-from-boot.p, and recovery-resource.dat.
I tried patching to create a new recovery image:
#Output:
creating cache dir cache
cache dir: cache
patch boot.img:
failed to stat "recovery.img": No such file or directory
Unknown patch file format
Done with error code : 1
and also tried patching the boot image in place:
#Output:
creating cache dir cache
cache dir: cache
patch boot.img:
Unknown patch file format
Done with error code : 1
I am able to use these files to create recovery with the on-device applypatch binary, so not sure why it's throwing the "unknown patch file format" error.
Any ideas? Is my syntax incorrect?
Click to expand...
Click to collapse
That was chainfire commit changes how can i say "no" to his PR
I didn't had time to check it
I'll check it out when I could
Q9Nap said:
@erfanoabdi
I noticed that there was an update to the source today to enable the bonus file argument.
I tried to create a recovery.img with a boot.img, recovery-from-boot.p, and recovery-resource.dat.
I tried patching to create a new recovery image:
#Output:
creating cache dir cache
cache dir: cache
patch boot.img:
failed to stat "recovery.img": No such file or directory
Unknown patch file format
Done with error code : 1
and also tried patching the boot image in place:
#Output:
creating cache dir cache
cache dir: cache
patch boot.img:
Unknown patch file format
Done with error code : 1
I am able to use these files to create recovery with the on-device applypatch binary, so not sure why it's throwing the "unknown patch file format" error.
Any ideas? Is my syntax incorrect?
Click to expand...
Click to collapse
I've tested recovery-from-boot by chainfire and i can confirm its working
Also i fixed no such file error
Try to compile new source
*edit*
Fixed!
Hello, recently I looked into LG backup and restore application using static analysis.
Note: this is based on version lg bnr 8.0.26 from 2020-02-13, tested with 7.0.20 from 2008-12-31
Here is the extract tool:
https://github.com/Mysak0CZ/LBFtool
And here is the technical part (you don't need to read this, if you just want to extract your data):
The file contains 2 headers (one of them is referred to as "new")
These are XML documents encrypted using AES/ECB/PKCS5Padding + SHA256 and null IV with static password
Code:
cd562f61-5399-3978-ac76-7c54b0508010
And they look like this:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<BackUp>
<Common>
<Name>LGBackup_200217_1</Name> <!-- Name of the backup file -->
<Id>Randomly generated UUID</Id> <!-- Id of the backup file -->
<IsNew>True</IsNew> <!-- IsNew is same in new and old header -->
<Version>1.00</Version>
<Attr Name="product_model">LM-X525</Attr>
<Attr Name="os_version">9</Attr>
<!-- And other attributes including google email -->
</Common>
<BackupItem Category="settings_DB" StartOffset="59392" DataSize="136626" />
<BackupItem Category="MEDIA_DB" StartOffset="901169" DataSize="78393344" FileName="external.db" />
<!-- Other backuped items -->
</BackUp>
The "new" header has more information than original header, but same structure.
The attribute "IsNew" signals the presence of the new header. (and is True in both files)
All numbers inside file are in Big-endian.
And this is the structure of the file (decimal position):
Code:
0: Unknown - 0x00 for me
1: Int32 - size of the new header
5: Int64 - offset to the new header (usually 13)
13 ... EOF-33: data
EOF-33: 20 bytes - SHA1 hash of the password (if present, otherwise still data)
EOF-13: Int64 - offset to the (old) header
EOF-5: Int32 - size of the (old) header
EOF-1: Bool - Lock byte - the file is (0x01) or isn't (0x00) protected by password
The password is only checked during import, not used to encrypt data (so to remove password, just set the last byte to 0)
Every "BackupItem" entry has a "Category".
Special case is Category="APPLICATION" with this structure:
Code:
<BackupItem Category="APPLICATION">
<APPLICATION Name="com.lge.ime" StartOffset="19221586" DataSize="2385983" Package="com.lge.ime">
<Attr Name="com.lge.ime">com.lge.ime</Attr>
</APPLICATION>
<APPLICATION Name="org.exmple.app" StartOffset="1429652009" DataSize="3420160" FileName="org.exmple.app.tar" Package="org.exmple.app">
<Attr Name="org.exmple.app">org.exmple.app</Attr>
</APPLICATION>
<!-- ... -->
</BackupItem>
All applications are tar files that contain 2 folders:
app - contains the apk file
data - application's internal data
All other items have:
StartOffset - Offset inside file
DataSize - Self explanatory
FileName - Not all have this, but most do; it is the original name of the backuped file.
The files are not compressed nor encrypted.
Footnote: This is my first post on XDA, so sorry for any mistakes I made (including my english) and feel free to correct me/give me advice.
Mysak0CZ said:
Hello, recently I looked into LG backup and restore application using static analysis.
Note: this is based on version lg bnr 8.0.26 from 2020-02-13, tested with 7.0.20 from 2008-12-31
Here is the extract tool:
And here is the technical part (you don't need to read this, if you just want to extract your data):
The file contains 2 headers (one of them is referred to as "new")
These are XML documents encrypted using AES/ECB/PKCS5Padding + SHA256 and null IV with static password
And they look like this:
The "new" header has more information than original header, but same structure.
The attribute "IsNew" signals the presence of the new header. (and is True in both files)
All numbers inside file are in Big-endian.
And this is the structure of the file (decimal position):
The password is only checked during import, not used to encrypt data (so to remove password, just set the last byte to 0)
Every "BackupItem" entry has a "Category".
Special case is Category="APPLICATION" with this structure:
All applications are tar files that contain 2 folders:
app - contains the apk file
data - application's internal data
All other items have:
StartOffset - Offset inside file
DataSize - Self explanatory
FileName - Not all have this, but most do; it is the original name of the backuped file.
The files are not compressed nor encrypted.
Footnote: This is my first post on XDA, so sorry for any mistakes I made (including my english) and feel free to correct me/give me advice.
Click to expand...
Click to collapse
Nice job dude! just a the quick recommendation: I would suggest that you put your code on gitlab or GitHub so it will become easier for others to contribute
Sent from my OnePlus 6T using XDA Labs
Hi. I'm trying to use this tool but I don't know how to use it. I followed the instructions and downloaded Python. but none of the other steps are working for me. I have my backup on my PC and am trying to extract my files into normal formats as I wish to move away from the LG platform. Thank you.
---------- Post added at 07:20 AM ---------- Previous post was at 06:57 AM ----------
Nevermind, I found a work around.
For anyone else in the future wondering: If you select backup with the app on the phone and backup to the internal memory, it will create .pdf files of all text/images in internal storage>>Quickmemo+. This doesn't help to retrieve the audio or video recordings, but at least that way you can retrieve your text files/images.
Tried script on old backup, failed with error.
Mysak0CZ said:
Hello, recently I looked into LG backup and restore application using static analysis.
Note: this is based on version lg bnr 8.0.26 from 2020-02-13, tested with 7.0.20 from 2008-12-31
Here is the extract tool:
And here is the technical part (you don't need to read this, if you just want to extract your data):
The file contains 2 headers (one of them is referred to as "new")
These are XML documents encrypted using AES/ECB/PKCS5Padding + SHA256 and null IV with static password
Code:
cd562f61-5399-3978-ac76-7c54b0508010
...
[/CODE]
All applications are tar files that contain 2 folders:
app - contains the apk file
data - application's internal data
All other items have:
StartOffset - Offset inside file
DataSize - Self explanatory
FileName - Not all have this, but most do; it is the original name of the backuped file.
The files are not compressed nor encrypted.
Footnote: This is my first post on XDA, so sorry for any mistakes I made (including my english) and feel free to correct me/give me advice.
Click to expand...
Click to collapse
My first post as well. Thanks for the script. I ran it on an old backup I was hoping to extract contacts from. See excerpt with error below.
C:\Temp\LG G4\Backup>python extract.py LGBackup_190218.lbf
[+] Backup size: 597864605
Parsing...
Reading header
[*] Header start offset: 597792768
[*] Header length: 71824
[+] Header read OK
Reading header (new)
[*] Header start offset: 7021235167904623918
Traceback (most recent call last):
File "extract.py", line 125, in <module>
root = readHeader(True)
File "extract.py", line 99, in readHeader
size = getBackupInfoSize(isNew)
File "extract.py", line 88, in getBackupInfoSize
raise Exception("Invalid header length.")
Exception: Invalid header length.
C:\Temp\LG G4\Backup>
Click to expand...
Click to collapse
I'm a complete newbie with Python, haven't done any coding in over a decade. Where do I go from here?
Ninja_Toad said:
My first post as well. Thanks for the script. I ran it on an old backup I was hoping to extract contacts from. See excerpt with error below.
I'm a complete newbie with Python, haven't done any coding in over a decade. Where do I go from here?
Click to expand...
Click to collapse
Hi! Your backup seem to be at least partially corrupted. (The new header position seems to start at 7021235167904623918, however the file is only 597864605 bytes long). Fortunatly there are two headers in the backup and the old one seems to be ok (You got "[+] Header read OK" for the old header). So you can try ignoring the "new" header.
To ignore the faulty header just set the relevant "FORCE_*_HEADER" to True in the script header. In your case just set "FORCE_OLD_HEADER = True".
Also note, that extracting contacts in readable format is beyond this script's current scope. This can however be done manually. After you get your data successfully extracted, look for export/data/contacts_DB file. This is a TAR file in which you need to find file "data/data/user/0/com.android.providers.contacts/databases/contacts2.db". This is the contact database as your phone stores it. To actually extract the contacts, you will need to find a way to convert the database to some other format (I have't looked into how the contacts are stored, you will need to do your own googling)
Files extracted but...
hello guys,
I also managed to extract my files using the hack mentioned above (force old headers to TRUE) since by using the default script i was also getting a similar error as above.
However now all of my files (pictures in particular) are corrupted and i cannot seem to be able to open them using several editors.
Anyone else had the same issue?
Thanks in advance!
serlal said:
hello guys,
I also managed to extract my files using the hack mentioned above (force old headers to TRUE) since by using the default script i was also getting a similar error as above.
However now all of my files (pictures in particular) are corrupted and i cannot seem to be able to open them using several editors.
Anyone else had the same issue?
Thanks in advance!
Click to expand...
Click to collapse
Yes I have exactly same issue as you have. All exported files cannot be read.
Hello @tking2000 and @serlal, this script was written based on versions that are available to me. There are two possibilities of what is happening:
1) The file was badly corruped, however the old header stayed itact. (This is the likely case, if you are trying this tool because your phone refused to restore the backup)
2) The file was made by version that does something differently and the script doesn't account for it.
In the first case there is nothing anyone can do (short of trying some corrupted file recovery software hoping the corruption is only minor)
In the second case, you can try sending me a PM with following information, so I can have a look and confirm whether this is truly the case (and improve the script)
1) The script's output
2a) The <Version> and <Attr Name="settingVersionName"> from the <Common> part of the header
2b) If you aren't concerned about privacy or it is just easier for you: just send the whole header file
3) The version of the com.lge.bnr app (LG Mobile Switch); this is not necessary, but may help me
Feel free to censor anything you are sending with [CENSORED] (like your email or filenames)
I have no experience with python, but I have one of these lbf files and I'm trying to figure out how to make it work and all I get is couldn't get library pycryptodome. How do I get Python 3.8.3 to get this library?
Multipart backups
Hello everyone,
I just finished an update, that should enable the tool to extract backups that have multiple files.
If you received "Exception: Invalid header length." in the past and your backup has multiple files, try the script now; your backups are likely to extract correctly now.
This is the likely case for: @Ninja_Toad @serlal and @tking2000
This was made possible thanks to @cheesyzombie who sent me the data I asked for.
@kamikazkid, You don't need to know Python to use this tool, the easiest way is to enter the commands in quotes on the github page into the console (To open the console Shift+Right click in the folder with backups and choose "Open command window here").
Just:
Download the zip on the github page (Under "Code" button)
Make sure the extract.py and your backup are in the same folder
Follow the usage, skip the 4th step and replace xxxxxx to match your backup name.
I figured it out, it was something with windows 10 and the version of python installation I used. Microsoft garbaging things up as usual, thanks for the help though. Thanks, I recovered my files from my old phone successfully.
I have no experience withc++, but I have one of these lbf files and I'm trying to figure out how to make it work, it is a great this forum
Is there a way to import the _DB files (contacts, messages, call logs etc.) back to a phone?
I asked before:
https://forum.xda-developers.com/lg-g3/general/restore-backup-lbf-lineage-17-t4172483#post83644281
Thank you so much for this! I was able to extract the Messaging data from an LG G8 ThinQ. Does anybody know the easiest way to view that data on my PC?
Hi, you can follow these steps to extract data fron _db files:
1) Send the _db files like contacts_db, messages_db to any android phone
2) Double tap on the file and open it using File Manager (which is by default on Mi phones)
3) The file will now open as a folder. Continue opening the folders until you reach to the last file.
4) The last file is the database file. It won't open directly. Select the file and extract the file.
5) Now transfer the file to computer and you can now view it using SQLite DB Browser if its a contacts file or you can use any VMG reader if its a messages file.
Hope this helps you.
Hi @Mysak0CZ, just follow your instructions on GitHub but when I run the command on Command Prompt, nothing happens. Just like this:
F:\>python -m pip install pycryptodome
F:\>python extract.py LGBackup-201031.lbf
When I enter nothing happened. Kindly help to advise for this.
Thank you
Problem in powershell
Mysak0CZ said:
Hi! Your backup seem to be at least partially corrupted. (The new header position seems to start at 7021235167904623918, however the file is only 597864605 bytes long). Fortunatly there are two headers in the backup and the old one seems to be ok (You got "[+] Header read OK" for the old header). So you can try ignoring the "new" header.
To ignore the faulty header just set the relevant "FORCE_*_HEADER" to True in the script header. In your case just set "FORCE_OLD_HEADER = True".
Also note, that extracting contacts in readable format is beyond this script's current scope. This can however be done manually. After you get your data successfully extracted, look for export/data/contacts_DB file. This is a TAR file in which you need to find file "data/data/user/0/com.android.providers.contacts/databases/contacts2.db". This is the contact database as your phone stores it. To actually extract the contacts, you will need to find a way to convert the database to some other format (I have't looked into how the contacts are stored, you will need to do your own googling)
Click to expand...
Click to collapse
Hi, I am trying to extract via your method but in the power shell in sending the command "python extract.py LGBackup_1x0x07.lbf" it does not execute and brings me back the initial path line. Do you have solutions in this regard? Thanks in advance
Ps. I use Win10
Worked so well. I only needed to recover images and audio recordings after realizing that LG backup tool won't restore on other brand phones.
Thank you!!
Mysak0CZ said:
Hello, recently I looked into LG backup and restore application using static analysis.
Note: this is based on version lg bnr 8.0.26 from 2020-02-13, tested with 7.0.20 from 2008-12-31
Here is the extract tool:
https://github.com/Mysak0CZ/LBFtool
And here is the technical part (you don't need to read this, if you just want to extract your data):
The file contains 2 headers (one of them is referred to as "new")
These are XML documents encrypted using AES/ECB/PKCS5Padding + SHA256 and null IV with static password
Code:
cd562f61-5399-3978-ac76-7c54b0508010
And they look like this:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<BackUp>
<Common>
<Name>LGBackup_200217_1</Name> <!-- Name of the backup file -->
<Id>Randomly generated UUID</Id> <!-- Id of the backup file -->
<IsNew>True</IsNew> <!-- IsNew is same in new and old header -->
<Version>1.00</Version>
<Attr Name="product_model">LM-X525</Attr>
<Attr Name="os_version">9</Attr>
<!-- And other attributes including google email -->
</Common>
<BackupItem Category="settings_DB" StartOffset="59392" DataSize="136626" />
<BackupItem Category="MEDIA_DB" StartOffset="901169" DataSize="78393344" FileName="external.db" />
<!-- Other backuped items -->
</BackUp>
The "new" header has more information than original header, but same structure.
The attribute "IsNew" signals the presence of the new header. (and is True in both files)
All numbers inside file are in Big-endian.
And this is the structure of the file (decimal position):
Code:
0: Unknown - 0x00 for me
1: Int32 - size of the new header
5: Int64 - offset to the new header (usually 13)
13 ... EOF-33: data
EOF-33: 20 bytes - SHA1 hash of the password (if present, otherwise still data)
EOF-13: Int64 - offset to the (old) header
EOF-5: Int32 - size of the (old) header
EOF-1: Bool - Lock byte - the file is (0x01) or isn't (0x00) protected by password
The password is only checked during import, not used to encrypt data (so to remove password, just set the last byte to 0)
Every "BackupItem" entry has a "Category".
Special case is Category="APPLICATION" with this structure:
Code:
<BackupItem Category="APPLICATION">
<APPLICATION Name="com.lge.ime" StartOffset="19221586" DataSize="2385983" Package="com.lge.ime">
<Attr Name="com.lge.ime">com.lge.ime</Attr>
</APPLICATION>
<APPLICATION Name="org.exmple.app" StartOffset="1429652009" DataSize="3420160" FileName="org.exmple.app.tar" Package="org.exmple.app">
<Attr Name="org.exmple.app">org.exmple.app</Attr>
</APPLICATION>
<!-- ... -->
</BackupItem>
All applications are tar files that contain 2 folders:
app - contains the apk file
data - application's internal data
All other items have:
StartOffset - Offset inside file
DataSize - Self explanatory
FileName - Not all have this, but most do; it is the original name of the backuped file.
The files are not compressed nor encrypted.
Footnote: This is my first post on XDA, so sorry for any mistakes I made (including my english) and feel free to correct me/give me advice.
Click to expand...
Click to collapse
ok I am so lost. And here is the technical part (you don't need to read this, if you just want to extract your data):
that statement would make it appear easy. well the link only takes you to the code, there is no tool and nothing with "new" as header. so ive tried deciphering what to do for hours now and i cant figure npthing out. rooted and flashed my lgv20 and did a backup with lg bridge beforehand. trying to restore and phone connects to computer fine but doesnt regster in lg bridge so that is why i need to extract .lbf file. can someone make this easier?
hello..it ended up successful.but there is no jpeg or mp4 file on DCIM folder..how can i restore them?should i do somthing with the script? i don't know pyton