[Android Software/Hacking General [Developers Only]] SnakyJake:
Hi rels,

regarding your problem with your boot.img:

only rkcrc does not do the job.

Please to the following:

first get the size of the new boot.img (without rkcrc!)

lets take 496513 bytes for example.

Put this in some calculator which converts it to HEX, like 496513 dezimal is 79381 hex

Now fill your new hexsize with zeros, until you have 4 bytes (1 byte = 2 digits in hex), so 79381 will become 00079381, now turn this around bytewise, like this: 00 07 93 81 becomes 81 93 07 00

Now do a rkcrc on your boot.img, whose size will increase by 4 bytes checksum.

Now put your boot.img in some hexeditor, and add 8 bytes to the beginning:

4 bytes header: KRNL

4 bytes size: (the bytes you calculated) 81 93 07 00

done.

Now flash THAT file - it should work!

---------- Post added at 02:38 PM ---------- Previous post was at 01:49 PM ----------

Hi, me again,

after Presitigio released IceCreamSandwich for my PMP5080B RK29 based tablet, I had new work...

First superuser. Some su is already included! - but not working all the way I want.

So first rip apart the update.img (I will not explain how to do this again, rkunpack should do...)

What I saw so far is: it works quite different to the "old" android 2.3 image.

boot.img is not extracted anymore, no kernel.img and stuff.

(later more)

But first I concentrated on system.img, and the way to patch system.img is the same as always, except you have to overwrite the su binary in /system/xbin (and maybe create a softlink in /system/bin)

usable su binaries and SuperUser.apk are flying around the internet. Put SuperUser.apk in /system/app if you want to have it fixed in your system image. Remember: this still is cramfs! ReadOnly (search my other posts how to extract cramfs, insert su and superuser.apk, repack cramfs and flash it.)

Ok. Now the hard one: writable system.img

Like before: system.img is cramfs, ext3 is my goal. Probably ext4 works too, have not tried yet.

First good thing: they increased the space for system.img to almost 500MB (which is quite stupid, since cramfs only can do 268MB, but for extfs its great)

The old problem: the filesystem cannot be created on a linux machine, it has to be done on the tablet.

So lets do that.

First enable your adbd (usb debugger) in your tablet settings.

Get adb on some PC.

Plug in your device via USB and go to command prompt (on your PC) and type:

adb root //(should restart adb in root mode. maybe you don't need that)
adb shell //(gives you a shell on your device)
dd if=/dev/zero of=/sdcard/extfilesys count=942080 //(942080 is the new size of the system partition, 0xE6000 - check your params file!)

now you should have an empty file in /sdcard which has the target size of our new system.img

on my tablet I did not have the e2fsprogs, which you need compiled for arm processor. You can find them with google search, like "e2fsprogs android arm" or something

download them and put them on your device, you need mke2fs and tune2fs

you can do it with adb. First exit your adb-shell with "exit" and put your files on the device with

adb push mke2fs /sdcard/mke2fs
adb push tune2fs /sdcard/tune2fs

Now go back in your shell

adb shell
/sdcard/mke2fs /sdcard/extfilesys //this is not a block device: yes, continue
exit

Now we need to put the files in there.

First get the file on your PC:

adb pull /sdcard/extfilesys extfilesys

on linux mount your "old" cramfs and your new ext3fs and copy all files:

sudo bash //should do that as root
mkdir syscramfs
mount oldsystem.img syscramfs
mkdir sysext3
mount extfilesys.img sysext3
cp -a syscramfs/* sysext3

I checked the permissions of the syscramfs folder and saw an user id of 65535 and group id of 145, so I better set this on the new system folder

chown 65535:145 sysext3
umount syscramfs
umount sysext3

now put the file back on your device and to a fscheck (maybe need e2fsck from e2fsprogs)

adb push extfilesys /sdcard/extfilesys
adb shell
e2fsck -f /sdcard/extfilesys

Should be all ok, enable journal for ext3:

/sdcard/tune2fs -j /sdcard/extfilesys
exit

get the file on your PC

adb pull /sdcard/extfilesys extfilesys

Ok, now you have an ext3-system image.

Flushing this will not help yet, since the boot.img still wants to mount cramfs.

Lets change that.

First the boot partition has changed. Bad thing about it: it uses some sha1 checksum and I do not know how to calculate it, since its not the standard one calculated by mkbootimg (a tool from android sdk floating around the internet - does not work with my device because of wrong base addresses and checksums!)

The good part is: the bootloader still loads the "old" partitions, if found.

Puuuh, here we go:

first rip apart your boot.img

for this search for split_bootimg.pl on google (need perl for this!)

rip it:

./split_bootimg.pl boot.img

should give you:

boot.img-kernel

boot.img-ramdisk.gz

ok, your kernel is here. Hope you still got the rkcrc tool, we need it now.

rkcrc boot.img-kernel boot.img-kernel-crc

Get the size of the original boot.img-kernel (like 6656036), calc in hex (like 00659024) and reverse bytes (like 24906500), open your boot.img-kernel-crc in hexedit and add "KRNL" plus size at the beginning (should be exactly 8 bytes, 4 bytes KRNL and 4 bytes size - check this: the crc-file should now be 12 bytes larger that your original kernel image)

Now we need good old rkflashtool:

Look in your params file where to flash the kernel. Here its 0x4000 with a size of 0x4000 (8MB)

sudo rkflashtool w 0x4000 0x4000 <boot.img-kernel-crc

Now same to the bootimage, which is our ramdisk-file.

First we need to edit init.rc

So extract your boot directory like this:

gunzip boot.img-ramdisk.gz
mkdir boot
cd boot
cpio -id <../boot.img-ramdisk

Now "boot" should be filled with the boot filesystem

edit init.rc and search for "cramfs"

change it to ext3 and put a remount-line afterwards to mount it readonly (for security, you will be able to remount it rw on your device later!)

In the following example the # comments out the old cramfs line...

#mount cramfs mtd@system /system
mount ext3 mtd@system /system
mount mtd@system /system ro remount

Save and exit.

Rebuild your boot image.

In your boot directory do

find . | cpio -o -H newc >../newboot.img
cd ..
gzip -n newboot.img

Should have a new boot image, about the size as the original one.

Now the stuff we already done to our kernel:

Do an rkcrc, get the original size, calc it in hex, swap bytes, open hexedit, add "KRNL" and size, and flash

rkcrc newboot.img newboot.img-crc
ls -l newboot.img //(to get the size)

(now calc this size in hex, swap bytes, and hexedit the crc-file)
(check the offset of your boot image in params file, here offset and size are 0x8000)

sudo rkflashtool w 0x8000 0x8000 <newboot.img-crc

sudo rkflashtool b //reboot device

Have fun trying this :-) Its not hard if you have it done once or twice...

If you done something wrong the device might overwrite your boot partition with its recovery. You can check on this with "rkflashtool r 0x8000 0x100 >test". If your test file begins with "ANDROID!" its the new style boot.img from the firmware and not yours...

Questions? Did I forget anything?