[Samsung Galaxy Mini] stepph:
About Boot.img and Recovery.img

I tested this method on my duped BML files, and on some downloaded ROM.

in bootimg.h - from Android SDK (so i suppose, but i found in this forum)

#define BOOT_MAGIC "ANDROID!"
#define BOOT_MAGIC_SIZE 8
#define BOOT_NAME_SIZE 16
#define BOOT_ARGS_SIZE 512

struct boot_img_hdr
{
unsigned char magic[BOOT_MAGIC_SIZE];
unsigned kernel_size; /* size in bytes */
unsigned kernel_addr; /* physical load addr */
unsigned ramdisk_size; /* size in bytes */
unsigned ramdisk_addr; /* physical load addr */
unsigned second_size; /* size in bytes */
unsigned second_addr; /* physical load addr */
unsigned tags_addr; /* physical addr for kernel tags */
unsigned page_size; /* flash page size we assume */
unsigned unused[2]; /* future expansion: should be 0 */
unsigned char name[BOOT_NAME_SIZE]; /* asciiz product name */
unsigned char cmdline[BOOT_ARGS_SIZE];
unsigned id[8]; /* timestamp / checksum / sha1 / etc */
};

/*
** +-----------------+
** | boot header | 1 page
** +-----------------+
** | kernel | n pages
** +-----------------+
** | ramdisk | m pages
** +-----------------+
** | second stage | o pages
** +-----------------+
**
** n = (kernel_size + page_size - 1) / page_size
** m = (ramdisk_size + page_size - 1) / page_size
** o = (second_size + page_size - 1) / page_size
**
** 0. all entities are page_size aligned in flash
** 1. kernel and ramdisk are required (size != 0)
** 2. second is optional (second_size == 0 -> no second)
** 3. load each element (kernel, ramdisk, second) at
** the specified physical address (kernel_addr, etc)
** 4. prepare tags at tag_addr. kernel_args[] is
** appended to the kernel commandline in the tags.
** 5. r0 = 0, r1 = MACHINE_TYPE, r2 = tags_addr
** 6. if second_size != 0: jump to second_addr
** else: jump to kernel_addr

So i opened my file, and found

414E4452 4F494421 C8F42E00 00806013 0E143000 00006014 00000000 00005014 00016013 00100000 00000000 ...

that is

00000000 struct BOOT_IMG_HDR
00000000 magic[8]	ANDROID!
00000008 DWORD kernel_size	3077320
0000000C DWORD kernel_addr	325091328
00000010 DWORD ramdisk_size	3150862
00000014 DWORD ramdisk_addr	341835776
00000018 DWORD second_size	0
0000001C DWORD second_addr	340787200
00000020 DWORD tags_addr	325058816
00000024 DWQRD page_size	4096
00000028 unused[2]	0
00000030 name[16]	0
00000040 cmdline[512]	0
00000240 id[8]	xxxxxxx

so i calculate

n = (3077320 + 4096 - 1) / 4096 = 752
m = (3150862 + 4096 - 1) / 4096 = 770
o = (0 + 4096 - 1) / 4096 = 0

** +-----------------+
** | boot header | 1 page = 0 to 4095 (h00000FFF)
** +-----------------+
** | kernel | 752 pages = 4096 to 4096+752*4096 = 3084287 (h002F0FFF)
** +-----------------+
** | ramdisk | 770 pages = 3084288 to 3084288+770*4096 = 2378055679 (h8DBE3FFF)
** +-----------------+

so i spli the file in 3 parts : header, kernel, and ramdisk.

NOTE: at offset 18825 (h4989) i find 1F 8F that is the head of a gzipped file..

so i split kernel in kernel.head and kernel.gz => decompressed in kernel.tail.

This worked, sinc in decompressed part i found readable strings...

Ramdisk is ramdisk.cpio.gz, so i was able to decompress it and get the filesystems loaded on start.

There are many interesting files...

TASS.rle and TASS-HUI.rle (the original logo, and the logo for italy - HUI is my region)

init and init.rc - and some other script file, that i saw on root folder of my devices

some folders with bins, and so on...

When i use this method with dumped Recovery.img and downloaded ClockWorkMod_recovery.img, i get i working...

So i'll investigate about differences in ramdisk files of those...

=======================================================================================

... continued in [post 14] - without phone - ...