[RAZR i Android Development] osm0sis:
Is [MENTION=4040302]turl1[/MENTION] still around by any chance?

I'm looking to update his and [MENTION=1813976]shakalaca[/MENTION]'s work on intel-boot-tools into a more general solution that can detect what type of header it's looking at and determine the right length of unknown, bootstubstack, etc. based on that.

Here's what I've got from my research dissecting their work and ripping apart a number of images myself:

Intel OS header

header, 56 byte (38 hex):
24 4F 53 24 00 00 01 0B 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 7D 43 00 00 01 00 00 00 leno-k900
24 4F 53 24 00 00 01 AB 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 D1 4E 00 00 00 00 00 00 zphone6-t00g
24 4F 53 24 00 00 01 2A 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 57 49 00 00 00 00 00 00 dell-v8
24 4F 53 24 00 00 01 8C 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 F2 4A 00 00 00 00 00 00 mpad-me572c-boot
24 4F 53 24 00 00 01 90 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 CA 62 00 00 0C 00 00 00 mpad-me572c-recovery
24 4F 53 24 00 00 01 2D 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 52 4B 00 00 00 00 00 00 mpad-me581cl
24 4F 53 24 00 00 01 A2 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 DA 4C 00 00 00 00 00 00 mpad-me176c
24 4F 53 24 00 00 01 90 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 EA 4E 00 00 00 00 00 00 tpad-tf103c-boot
24 4F 53 24 00 00 01 2C 01 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 10 01 00 10 10 01 4A 5E 00 00 0C 00 00 00 tpad-tf103c-recovery
=$OS$ magic (7) |xo|id (28) |sectors (4)|imgtype (4)
* * *
*xor (1) = xor checksum of header with this byte as 00
*sectors (4) = totalImageSize / SECTOR_SIZE - 1 [ SECTOR_SIZE = 512 byte (200 hex) ]

*imgtype (4)
0x00 for signed boot
0x01 for unsigned boot
0x0C for signed recovery
0x0D for unsigned recovery
0x0E for signed fastboot (provisioning)
0x0F for unsigned fastboot (provisioning)

head padding, 456 byte (1c8 hex):
FF x 384 bytes (180 hex)
00 x 70 bytes (46 hex)
55 AA (=trailer)

signature
0 byte (0 hex) leno-k900 (no gap)
480 byte (1e0 hex) dell-v8, zphone6-t00g (00 x 80 hex, then RðŸåx header - contains further size and SHA-256 sum of signed data)
728 byte (2d8 hex) mpad-me572c, mpad-me581cl (00 x 80 hex, then $MOSS/$ROSS header for kernel/recovery)
1024 byte (400 hex) mpad-me176c, tpad-tf103c ($OSM header)

cmdline, 1024 byte (400 hex), padded with 00 where unused [ moto-razri begins here - has no header ]

bzImageSize (4)
00 00 62 00 (LE, eg. 00620000 hex = 6422528 byte on zphone6-t00g)

initrdSize (4)
00 70 3b 00 (LE, eg. 003B7000 hex = 3895296 byte on zphone6-t00g)

SPIUARTSuppression (4):
00 00 00 00

SPIType (4):
FF 00 00 00 (all BUT leno-k900, where is 00 x 4)

padding, 3056 byte (bf0 hex):
BD 02 BD 02 BD 12 BD 12 (all BUT leno-k900, where is 00 x 8) (?only when signed)
00 x 3048 bytes (be8 hex)

bootstubstack
4096 byte (1000 hex) leno-k900 (? +zphone pre-4.4)
8192 byte (2000 hex) dell-v8, mpad-me176c, mpad-me572c, tpad-tf103c, zphone6-t00g:
FC FA BC 00 (?magic on all BUT leno-k900, where is FC FA 2E 0F)

bzImage = pxelinux loader + bzImage (bzImageSize in LE):
pxelinux loader, 495 byte (1ef hex) on all BUT leno-k900, where is 506 byte (1fa hex):
EA 05 00 C0 (?magic on all BUT tpad-tf103c, where is 4D 5A EA 07 00 C0)
bzImage:
FF FF 1D 01 (?magic)

initrd (initrdSize in LE):
1F 8B 08 00 00 00 00 00 00 03 (gzip magic)

tail padding (necessary only to align to nearest 512-byte sector)
0 byte (0 hex) mpad-me176c, tpad-tf103c
32 byte (20 hex) zphone6-t00g
75 byte (4B hex) dell-v8
296 byte (128 hex) mpad-me572c, mpad-me581cl
468 byte (1d4 hex) leno-k900

[ 5163728 byte (4ecad0 hex) + ?tailer "CUSTOMER 7......................MOT_AP256......................." moto-razri only ]

I'm particularly concerned with what determines the imgtype field in the header, and how the pack-intel tool seems to truncate a bit of the untouched ramdisk in my dell-v8 test image when stitching them back together afterward, and whether tail padding or the trailer are necessary, or should be dumped as well (along with imgtype?) to be reincorporated during repack.

Thanks for any help anyone can provide and great work thus far!

Edit: Updated with new imgtype info, see below as well.