[Android Q&A, Help & Troubleshooting] RiverSource:
Hello,

I have not analysed the differences between KF6 and KP4 in detail. But I can say, that beside the image itself the kernel and the initramfs are definitely different. Kernel as well as initramfs are bigger in KP4, the init.rc is longer. Therefore I'm not sure, if it may cause problems, if you use a "wrong" kernel.

But I'm pretty sure, that a system will boot, if a wrong kernel is installed. Maybe it will cause problems later on, but booting itself should work. And this should be enough for rooting the phone. Therefore the way rooting a firmware without an appropriate Root Kernel could be:

- Flash the Root Kernel

- Boot the phone until the lock screen appears (The phone is rooted now)

- Press the power button until the "shut down" dialogue appears

- Shut down the phone

- Flash the Stock Kernel for the firmware

After this procedure, the phone should be rootet and working flawlessly with the original kernel. You can extract the original kernel from an firmware image using my extract.sh.

Some people asked me to document, how a boot.img is modified. Of course I will do this.

First of all, I have created a script which is capable of creating SMD archives from any files. I call it "pack2.sh". ;) You will need it after modifying the boot.img in order to create a SMD archive only containing the Kernel.

Syntax:

./pack2.sh TYPE Archive.SMD file1 file2 file3 file4 .... filex

Type is:

-p (for PDA archives)

-c (for CSC archives)

-m (for Modem archives)

Archive.SMD ist the target name for the archive

file1 ... filex are the filenames to include in the archive. Examples:

./pack2.sh -p Kernel.smd boot.img

Creates a PDA archive for Odin only containing the Kernel.

./pack2.sh -p SMD_I9001BOKF6_I9001BOKF6_CL319318_REV00_user_low_ship_EMMC_test.smd partition.bin dbl.mbn osbl.mbn amss.mbn EMMCBOOT.MBN adsp.mbn boot.img system.ext4 cache.ext4 recovery.img persist.ext4 emmcparam.bin

Creates the complete KF6 Firmware.

#!/bin/bash

if [ "${1}" == "-p" ]
then
echo "Creating PDA Archive"
echo -n "PDASMDIMG" > newheader
dd if=/dev/zero of=newheadertmp bs=1 count=7 2>/dev/null
cat newheadertmp >> newheader
elif [ "${1}" == "-c" ]
then
echo "Creating CSC Archive"
echo -n "CSCSMDIMG" > newheader
dd if=/dev/zero of=newheadertmp bs=1 count=7 2>/dev/null
cat newheadertmp >> newheader
elif [ "${1}" == "-m" ]
then
echo "Creating Modem Archive"
echo -n "MODEMSMDIMG" > newheader
dd if=/dev/zero of=newheadertmp bs=1 count=5 2>/dev/null
cat newheadertmp >> newheader
else
echo "Missing Parameter!"
echo "Usage: ..."
exit 1
fi

# We use always 2560 Bytes Header. Make it dynamic, if you want. :)

offset=2560
length=0
loop=3

#we need one loop for each file. First argument is archive type, then the filenames
let "loops = $# + 1"

while (( loop < loops ))
do
if [ -e "${!loop}" ]
then
# calculate filesize
filesize=$(stat -c%s ${!loop})
hexsize=`echo ""$filesize" "16" o p" | dc`
hexstring="00000000${hexsize}"
stringlen=`echo ${#hexstring}`
hexsize="${hexstring: -8}"
byte1="\x${hexsize:6:2}"
byte2="\x${hexsize:4:2}"
byte3="\x${hexsize:2:2}"
byte4="\x${hexsize:0:2}"
echo -n -e "${byte1}${byte2}${byte3}${byte4}" >> newheader

#calculate offset
hexsize=`echo ""$offset" "16" o p" | dc`
hexstring="00000000${hexsize}"
stringlen=`echo ${#hexstring}`
hexsize="${hexstring: -8}"
byte1="\x${hexsize:6:2}"
byte2="\x${hexsize:4:2}"
byte3="\x${hexsize:2:2}"
byte4="\x${hexsize:0:2}"
echo -n -e "${byte1}${byte2}${byte3}${byte4}" >> newheader

#next offset is after the next file
let "offset += filesize"

# a 1000 - why ever
echo -n -e "\x01\x00\x00\x00" >> newheader

# filetype. Seems to specify the partition or something
type=`expr match "${!loop}" 'partition'`
if (( type > 0 ))
then
echo -n -e "\x00\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'osbl'`
if (( type > 0 ))
then
echo -n -e "\x46\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'EMMCBOOT'`
if (( type > 0 ))
then
echo -n -e "\x47\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'boot.img'`
if (( type > 0 ))
then
echo -n -e "\x48\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'amss'`
if (( type > 0 ))
then
echo -n -e "\x49\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'dbl'`
if (( type > 0 ))
then
echo -n -e "\x4D\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'adsp'`
if (( type > 0 ))
then
echo -n -e "\x50\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'persist'`
if (( type > 0 ))
then
echo -n -e "\x90\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'recovery'`
if (( type > 0 ))
then
echo -n -e "\x91\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'emmcparam'`
if (( type > 0 ))
then
echo -n -e "\x92\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'system'`
if (( type > 0 ))
then
echo -n -e "\x93\x00\x00\x00" >> newheader
fi
type=`expr match "${!loop}" 'cache'`
if (( type > 0 ))
then
echo -n -e "\x94\x00\x00\x00" >> newheader
fi

#filename
echo -n "${!loop}" >> newheader
length=`expr length ${!loop}`
let "count = 16 - length"
dd if=/dev/zero of=newheadertmp bs=1 count=${count} 2>/dev/null
cat newheadertmp >> newheader

# MD5 checksum
checksum=`md5sum ${!loop} | tr '[a-z]' '[A-Z]'`
echo -n ${checksum:0:32} >> newheader
else
echo "File not found: ${!loop}"
exit 1
fi
let "loop += 1"
done

#the header should have 2560 bytes
filesize=$(stat -c%s newheader)
let "size = 2560 - filesize"

dd if=/dev/zero of=newheadertmp bs=1 count=${size} 2>/dev/null

cat newheadertmp >> newheader
rm newheadertmp

# now create complete archive from header and files
loop=3

cat newheader > ${2}

while (( loop < loops ))
do
cat ${!loop} >> ${2}
let "loop += 1"
done
rm newheader

Now the way for modifying the boot.img:

- Extract the Image

- split the boot.img in Kernel and initramfs

- extract initramfs

- modify initramfs

- compress initramfs

- combine Kernel and new initramfs to modified boot.img

- (create SMD Archive and flash with odin).

Dealing with Androids boot.img is described hier:

http://android-dls.com/wiki/index.p...cking.2C_Editing.2C_and_Re-Packing_the_images

Splitting the boot.img files into Kernel and initramfs I have used the script mentioned there: http://android-dls.com/files/linux/split_bootimg.zip

./split_bootimg.pl boot.img

Extracting the initramfs works exactly as described there:

mkdir ramdisk
cd ramdisk
gzip -dc ../boot.img-ramdisk.gz | cpio -i

After extracting the initramfs I have added the su and the Superuser.apk in a new created directory. The scripts added are offered by me in the posts above.

I have used the first method with cpio to compress the initramfs:

find . | cpio -o -H newc | gzip > ../ramdisk-new.gz

I have not tried the mkbootfs, but I think, it should also work.

The last step is mkbootimg:

mkbootimg --base 0x00400000 --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot.img

I have found the base address in the kernel source code for the i9001 from opensource.samsung.com. It is stored in the default kernel config for SGS Plus. Please have a look in the readme.txt included in the Source archive in order to find out, how to deal with the Samsung source code.

From the modified boot.img I have created a SMD File with pack2.sh. Thats all, folks. :o