yashsingh1/xdaforums huggingface dataset:
[Android Software Development] sga999:
I look forward to testing your new AIK mobile release. Since the Windows version worked, I assume it already had a bigger limit?

It might be nice to have a different error message for the image-new.img naming issue. But maybe that's unnecessary since I may be the only one who has ever tried that!

In the OP, instruction 3 says "Alter the ramdisk as you like". This is why I was trying to copy the ramdisk-twrp.cpio file there. I wonder if there should be an instruction there about adding/deleting files in split_img, just as you explained to me.

I have 2 devices that you might want to add to the working devices list. Essential PH-1 and Leeco Le Pro 3. For the latter, I did more of a minimal test. All I did was unpack and repack a boot image and made sure that the device still booted after flashing it. But it's up to you as to whether you think that's good enough to add it to the working list. For the former, I did the unpack, add/delete to split_img, repack (and the attempt to unpack that result, which you will fix).

Many thanks.
[Android Software Development] osm0sis:
No limit anywhere but Android due to filesystem restrictions. Everything else is pretty self-explanatory if you look around after unpacking.
[Android Software Development] Eliminater74:
[MENTION=4544860]osm0sis[/MENTION],

I have been using your tools for years, your work is much appreciated.. Anyhow, I have a question that I have asked a few other devs in this area..

I been deving and customizing on OEM devices like LG, HTC, OnePlus and so on for some years now. I just recently jumped into Android Boxes as well.......

For the most part, Android Boxes are easy to deal with.. since they all use u-boot (universal bootloader), The one I have has a Amlogic s905x2 chipset,

no problem, its always nearly impossible to brick even more now since I Solder on a momentary Switch thats normally open to the emmc Shorting pins that allows

me to put device into maskrom mode that bypasses bootloader and so on to flash Direct to emmc with USB Burning Tool.. anyhow.. Now that I clarified that up,

My question is this, I have a ROM image that I have flashed and it workes, its original designed for a certified Android box by mecool km3 android 9, but it has avb 2 and like most all other

android 9 boot images, No ramdisk in boot.img only in system.img ....................... and since its certified by google original.. they locked everything down on it.. so the normal press button inside AV hole doesnt

allow you to boot into recovery and the normal USB male 2 male running USB burning tool wont work.. the only way to flash another rom over that is by putting it into MaskROM Mode.. by the added switch I solder on it..

Reason be, AVB v2, Now I seen a few other Amlogic roms with same chipset that doesnt sign the boot and vbmeta.. would it be possible to just switch the 2 out and see if that bypasses the lock down?

or is there a way to sign avb v2 with google test keys and remove original OEM keys or disable it all together Like x96 Max does............. sorta..

I am only asking in here because your tool is next to the closes I seen that unpacks and repacks as well as signing boot and I think vbmeta but not sure on that........

If you have no idea, or cant help.. or whatever, Thanks for at least taking the time to read this..

but any help, would be great...............

I have also been talking with [MENTION=4993401]bker[/MENTION]ler and working with his tools here: https://github.com/bkerler?tab=repositories

Mostly https://github.com/bkerler/android_universal and https://github.com/bkerler/dump_avb_signature

well thanks..
[Android Software Development] osm0sis:
Sounds like you need to root/mod it with Magisk (or the magiskboot tool) to disable dm-verity/AVB2. Some devices allow wiping vbmeta to disable things, others have a modified vbmeta that must be used.. that's about all I know about that stuff. You can also try re-signing things with AVBv2 using avbtool, but I don't think any ROM checking the signature will allow the AVBv2 verity/test keys.

I played around with avbtool at one point to get it running on-device, but other than that haven't really bothered: https://xdaforums.com/showpost.php?p=74498246&postcount=11453
[Android Software Development] Eliminater74:
thank you.. after some work I was able to get avbtool to work like it should I suppose by using your examples and so on... had a bit of issues at first.. and I have not verified that it worked just yet.. but its a start.

and thanks....
[Android Software Development] Rortiz2:
[MENTION=4544860]osm0sis[/MENTION] worked like a charm on BQ Aquaris M8 and M10!
[Android Software Development] osm0sis:
[MENTION=8978978]Rortiz2[/MENTION] Interesting! Last anyone told me the M8 boot.img had a BFBF pre-header signature that the device checked against so any repacks wouldn't boot. Has this changed?
[Android Software Development] lex-uz:
boot.img from Skyworth 50G2A

Friends, I need help. There is a boot.img from Skyworth 50G2A Chinese TV (Android 8, MediaTek MT5891, kernel 3.10.79). This boot is unpacked successfully, but there are problems with packing back. If you simply unpack it, without any changes packing it back, then flash it into the TV, then the TV goes into the bootloop and is no longer loaded.

Here is what was learned:

1. The boot.img header contains standard meta-information, such as kernel size, its address, ramdisk size, its address, page size (2048), etc.

2. ramdisk is cpio packed in gz

3. Judging by the boot.img header - ramdisk size = 7 113 952 bytes (0x006C8CE0)

4. But when manually unpacking, gunzp swears at "trailing garbage ignored", because At the end of the ramdisk.cpio.gz archive, some "garbage" is added, here it is:

h ttp://cs5-3.4pda.to/16871877/cpio.gz.png

5. If I take a native boot, and in the HEX editor I change at least one byte from this "garbage", then I flash the boot.img TV and it gets into the bootloop.

Tell me, what can it be in this "garbage"?

my boot.img: h ttps://clck.ru/HK3ag
[Android Software Development] osm0sis:
Almost certainly what you're looking at is a signature, or maybe a dt (even though it's not in a recognizable dt format).

Your only option to try is to repack the boot.img then try add the signature back on the end. If you're lucky the bootloader is stupid and will only check if a signature exists, and not verify whether it actually matches the content it is signing.
[Android Software Development] lex-uz:
Have you ever seen such a signature on other devices?
[Android Software Development] osm0sis:
Not that exact one after a ramdisk, but Samsung does a post-image signature that is also exactly 256 bytes, but is only enforced on some devices.
[Android Software Development] nalas:
Hi, it is inside....but in split_img folder so this is a new starndard of Samsung - always complicated :) : ramdisk.img file this is not in folder like before was : RAMDISK but is again packed as ramdisk.img file.

I think we have to find the way - or update AiK about find ramdisk.img file in spli_img folder....

Can You look at this [MENTION=4544860]osm0sis[/MENTION] ?

Big thx for You hard work.

EDIT

Once Ive unpacked it via lz4 windows stuff next some windows kitchen and I saw ramdisk.img in split_img folder....

..but i dont know so this was an bad file bcose not correcly unpacked or what...

oki- Ive found.... new S10 kernels are made for treble system and has no ramdisk inside - only binary part of the kernel :

look here https://xdaforums.com/galaxy-s10/development/magisk-root-galaxy-s10-series-t3918699 .

and https://source.android.com/devices/bootloader/system-as-root
[Android Software Development] osm0sis:
^ Which is what I said :laugh:
[Android Software Development] initguru:
Hi op, thanks for the useful tool.

I have been hearing ur signature here and there :)

Recently I have tried to unpack and repack some boot.img by aik but it seems weird.

I'm attaching boot.img, would u plz look into it?

Unpacking looks fine but image-new.img after repacking becomes unknown format.

Kust unpacking then repacking without any modification have a same result.

https://drive.google.com/file/d/1Mx1tK36LCCg6yEzzNMCm8v7qEhfBGxxg/view?usp=drivesdk
[Android Software Development] lex-uz:
I managed to connect to the service connector of the TV and see what happens at the time of loading the custom boot:

1. loading my uboot

2. kernel and ramdisk integrity check:

if ramdisk is missing 256 bytes, then we get an error "ramdisk: signature verification failed"

I found the source code uboot:

github.com/opensource-hisense/SmartTV-Series8/blob/4dd524a6b517ee9fd8d76816ab99d3c7aba7bc68/Opensource%20Software/uboot/board/mt5891/mt5891_secure_rom.c#L630

There is a description of this signature:

Len 1 1 221 1 32
+--+--+---------------+--+-----------------------------+
|02|00|PADDING MISC V1|00| SHA256 Of binary |
+--+--+---------------+--+-----------------------------+

need help decoding "sig_authetication" function
[Android Software Development] osm0sis:
Problem is they're likely comparing against a custom corporate key with that "padding misc", but it's definitely worth a try to take the ramdisk-new.cpio.gz from a repack, then add the padding and checksum from the original in split_img to it, then replace the one in split_img with the new one and repackimg --original to force it to use your modified one in split_img. For bonus points if that doesn't work you could change the sha256 sum with the one of your ramdisk-new.cpio.gz.

If that one fails then we'll know if it's doing a legit comparison against a key or not.
[Android Software Development] osm0sis:
Seems to unpack fine here as does a repack. Did you remember to rename image-new.img to something else before attempting to unpack?
[Android Software Development] lex-uz:
I did an experiment: I took kernel from another TV manufacturer (256 bytes were also present there) and added my own ramdisk. Such boot.img passed the test. Я думаю, что эти 256 байт - это стандартная подпись для MT5891.

where can i get the original padding and checksum? I did not understand what it is?

PS: I tried changing 1 byte from ramdisk in boot.img. This option does not work. I get a signature verification error. These 256 bytes are computed throughout the ramdisk.cpio.gz file.
[Android Software Development] osm0sis:
I just took a closer look at the split_img zImage and ramdisk.cpio.gz and they are indeed both signed, but they also don't have any bytes in common, especially not "\x02\x00" + "PADDING MISC V1" + "\x00" as the code you found suggested. My guess is it's a newer version of the same idea, where it's not just a SHA256 anymore, but now the entire 256 bytes is a checksum/signature of some kind, and does not look easy to reverse engineer unless you find updated source that explains it.

I've added Skyworth 50G2A TV to the OPs under "Confirmed not working". :good:
[Android Software Development] initguru:
That's right! after renaming it can be unpacked well, but just boot into fastboot mode when flash it.

There may be something I did wrong when compiled the kernel Image.gz...

Thanks for the help.
[Android Software Development] ezzony:
Hi, fairly new to all this and I'm a bit lost.

I have used other tools available for Windows to unpack and repack my fone's boot.img. Flashed it back and fone booted ok. Now all I want to do is add one file to the ramdisk, repack the ramdisk, repack the boot.img and done. The tools I'm using don't have a function to repack the ramdisk but it does extract them when it unpacks the boot.img. How do I repack the ramdisk? And what are the commands? Or where can I look it up the correct syntax?

Edit: Managed to get it done after having a cup of coffee lol
[Android Software Development] ashyx:
Everything you are asking is CLEARLY explained in the instructions in the OP.

I fact its pretty self explanatory and couldn't be simpler.
[Android Software Development] jcmm11:
Pixel 3 XL, Android 10, using the mobile version (3.5)

I wanted to try a straight unpack/repack for starters. The unpack threw an error mounting the ramdisk. Device or resource busy.

See attached image.
[Android Software Development] osm0sis:
I've already got a fix in for this in v3.6. :)
[Android Software Development] ahhl:
can't find the link
[Android Software Development] osm0sis:
Because it hasn't been released yet. ;)
[Android Software Development] osm0sis:
[MENTION=5795078]anagramgenius[/MENTION], could you add put a pause command where those icacls commands were in unpackimg.bat, attempt an unpack and then while it's paused open a command prompt in the AIK directory and give me the output of "icacls ." and "icacls ramdisk" ? I think I should be able to add the permissions your setup might be missing when I removed inheritance.
[Android Software Development] anagramgenius:
For "icacls ."

. BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\Authenticated Users:(I)(M)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

For "icacls ramdisk"

ramdisk BUILTIN\Administrators:(F)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files
[Android Software Development] osm0sis:
Awesome. I think we're on to something here. I'll PM you probably tomorrow with a test version to hopefully fix things once and for all! :D

Edit: [MENTION=5795078]anagramgenius[/MENTION] check your PMs. ;)
[Android Software Development] gforums:
Hi there,

I'm pretty new to aik and would like to try unpacking a boot.img file from a Rockchip px5 cpu device.

The file in question: http://daten.gforums.de/magisk_px5/boot.img

I have tried the windows and the mobile version, both are showing me the file as AOSP version (I expected KRNL) and do not find a ramdisk in the file.

My aim was to unpack, repack as AOSP, patch it with Magisk, unpack and repack as KRNL again. In short, I'd like to have a working boot.img patched with Magisk for my px5 Android device.

Any help is much appreciated.

Thanks a lot and best wishes

Christian
[Android Software Development] osm0sis:
It does appear to already be AOSP, and hdr_v1 at that, so there is no ramdisk. It might be system-as-root with the files in the system partition, or it might be something like Huawei's Treble where the ramdisk might be in a separate partition.

That said you could definitely just attempt to patch the boot.img you provided with Magisk Manager and see if it works!
[Android Software Development] gforums:
thank you!

wanted to give it a try but currently I am struggling with a probalbly non working reset key on my android car stereo. Means, in case of a bootloop cased by the boot.img file, I am currently not able or at least I do not know how to enter recovery mode to fix that - in case it shouldn't work.

therefore first I am waiting for any help on that topic and if I find a way to enter recovery during device is booting, I am keen to try :)

thanks a lot!

Christian
[Android Software Development] Angyone1:
Hello all , noob question, I have reinstalled win 10 for many problems and now when I try to make permissive boot for my mi note 3 I receive an error when repacking.. any idea ? thx
[Android Software Development] osm0sis:
You forgot to reinstall Java.
[Android Software Development] Angyone1:
ohhhh thank you very much !!!!!!! :good::good::good::laugh:
[Android Software Development] Rortiz2:
Hey, sorry. I just saw the quote:p

Well this type of boot.img named "boot-sign.img" are using an special "MAGIC" header that can be removed with dd if.

After remove that, simply unpack with normal method:

dd if=boot-sign.img of=boot.img bs=$((0x4040)) skip=1

This applies to all -sign images. If you want a reference, I made a script for unpack system-sign.img:

https://github.com/R0rt1z2/signimg2img

And yeah, I can boot the IMG without that BFBF header. That header is only for be able to flash the boot with SP Flash Tools.
[Android Software Development] CXZa:
Good tool. :good:

But this sudo is annoying a

bit

as it causes virus alert (false) and is a

bit

big for the job.

It can be done in many ways - as you all know...

https://ss64.com/vb/syntax-elevate.html

What I made, was the following changes to use Johannes Passing's elevated command line tool instead.

https://jpassing.com/2007/12/08/launch-elevated-processes-from-the-command-line/

https://github.com/jpassing/elevate/releases/download/1.0/elevate.zip

It's a

bit

bigger than others like it

but

it has that advantage that its not thought as virus

https://www.virustotal.com/gui/file...3cd1f4d66aa18b7c91396b24bbe72061d54/detection

repackimg.bat, lines 98-103

if not "[%sumsg%]" == "[]" (
"%bin%"\elevate -wait -k "%bin%"\docpio.bat
) else (
call "%bin%"\docpio.bat /b
)
if not errorlevel == 0 goto error

docpio.bat

@echo Off
Setlocal
set "bin=%~dp0"
cd /d "%bin%"
cd ..\ramdisk
"%bin%"\find . | "%bin%"\cpio -H newc -R 0:0 -o -F ..\ramdisk-new.cpio 2>nul
exit %1 %errorlevel%

and also removed lines 75-84 from repackimg.bat as not needed anymore.

:cool:
[Android Software Development] CXZa:
BTW, in the summer someone asked help for Nubia Red Magic 3. Not my device but I tend to check some of these "newer" firmwares occasionally if the question is interesting enough....

Android Image Kitchen didn't extract its boot. Some other tool might, but it would nice if AIK would too.

UNCOMPRESSED_IMG it said in it, if it says what needs to be added...

edit: boot.img attached
[Android Software Development] osm0sis:
Works fine here:

Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers

Supplied image: boot.img

Setting up work folders...

Image type: AOSP

Signature with "AVBv2" type detected.

Splitting image to "split_img/"...
BOARD_KERNEL_CMDLINE console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0xa90000 androidboot.hardware=qcom androidboot.console=ttyMSM0 androidboot.memcg=1 lpm_levels.sleep_disabled=1 video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 service_locator.enable=1 swiotlb=2048 firmware_class.path=/vendor/firmware_mnt/image loop.max_part=7 androidboot.usbcontroller=a600000.dwc3 buildvariant=user
BOARD_KERNEL_BASE 00000000
BOARD_NAME
BOARD_PAGE_SIZE 4096
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 00008000
BOARD_RAMDISK_OFFSET 01000000
BOARD_SECOND_OFFSET 00f00000
BOARD_TAGS_OFFSET 00000100
BOARD_OS_VERSION 9.0.0
BOARD_OS_PATCH_LEVEL 2019-03
BOARD_HEADER_VERSION 1
BOARD_HEADER_SIZE 1648

Warning: No ramdisk found to be unpacked!

Done!
[Android Software Development] CXZa:
Thanks!

Didn't check this any further then and now found this big file in my 3.4 folder.

Tested it with 3.6 and got the same result.

Like 100 Mb partition but no ramdisk?

So, the ramdisk must be somewhere else then...
[Android Software Development] osm0sis:
It's system-as-root, so there is none. The files are in the system partition now. Most of that 96mb is empty space.
[Android Software Development] CXZa:
Okay, thanks! One learns something new everyday...

Repacked it was like less than half. Yeah, some space wasting there...

about elevation:

I have used that VBScript trick in some of my scripts, but in this case that exe is better.

(Lately I've just told user to run bat again as admin if s/he's not. The easiest solution)

BTW, if you want to implement the elevated the way I did it, by all means...

Saves you some time to other projects... ;)
[Android Software Development] wzsx150:
hello，could you tell me how to compile BootSignature_Android.jar ?

thank you very much.

by the way, your AIK 3.6 donot need administrator permission for magisk patched boot. good job!!

---------- Post added at 02:32 ---------- Previous post was at 02:32 ----------

hello，could you tell me how to compile BootSignature_Android.jar ?

thank you very much.

by the way, your AIK 3.6 donot need administrator permission for magisk patched boot. good job!!
[Android Software Development] osm0sis:
[MENTION=6376476]fawazahmed0[/MENTION] compiled it so perhaps he can provide more details.

AIK v3.6 will still need Administrator permissions to repack the .backup directory in a Magisk patched boot.img, but it requests them itself via sudo.exe so it should be pretty automatic.

sudo.exe just needs to be whitelisted in Windows Defender. I might try to recompile sudo.exe without compression to see if it trips Defender less.
[Android Software Development] wzsx150:
I know it need sudo.exe. I mean it is automatic, better than v3.5, and the same as v3.4.

In a word, it is so good.

thank you very much!
[Android Software Development] fawazahmed0:
[MENTION=7350669]wzsx150[/MENTION] Refer the quoted post, Won't be able to help you more than this, I am not that helpful as [MENTION=4544860]osm0sis[/MENTION] :)
[Android Software Development] CXZa:
Removing upx will do the opposite...

(at least usually it's so when checked with virustotal )
[Android Software Development] wzsx150:
thank you.
[Android Software Development] fawazahmed0:
Latest bootSignature.jar location

[MENTION=7350669]wzsx150[/MENTION] [MENTION=4544860]osm0sis[/MENTION] , just wanted add, we can always get the latest bootsignature.jar from https://ci.android.com

Steps to get it:

1. Go to https://ci.android.com

2. Type the branch name as aosp-master (currently you don't have to do this, as it is the default branch)

3. click on download button on any of the aosp_** build.

4. Download the otatools.zip

5. Extract otatools.zip , in framework folder, it will have boot_signer.jar (This is same as bootsignature.jar)

And we can convert this into dexed (mobile) version, by using dx tool.

Steps to get it:

1. Go to https://ci.android.com

2. Type the branch name as aosp-build-tools

3. click on download button on any of the latest build.

4. Download build-common-prebuilts.zip

5. Extract it , in framework folder, it will have dx.jar

Usage: java -jar dx.jar --dex --output=boot_signer_mobile.jar boot_signer.jar

Running the boot_signer_mobile.jar in mobile:

Example: dalvikvm -cp boot_signer_mobile.jar com.android.verity.BootSignature /boot boot.img verifiedboot.pk8 verifiedboot.x509.der boot_signed.img
[Android Software Development] osm0sis:
Cool find! I'm thinking I'll have to start self-compiling for the next AIK release though, since it broke compatibility with signing the sha256 bootimg variant once they added hdr_v1/2 support. :silly:
[Android Software Development] fawazahmed0:
I am not sure about that, have you tried the latest jar from https://ci.android.com/, might have fixed the issue, if that doesn't work, I guess it will be better to file a bug at here:

https://issuetracker.google.com/issues?q=status:open componentid:381517

In component: 381517 (Building AOSP)

They might take little time to start working on this issue like 1-2 months or maybe never, but it's better to file the bug:)
[Android Software Development] osm0sis:
Yeah I plan to give the latest a try before I look into self-compiling, and I'll probably file a bug with the patch they'd need, but they most likely won't care about supporting an unofficial variant of their format.

Here's the file in question if you're interested: https://gitlab.com/osm0sis/boot-img...osp-sha256-avb1-osver-dt-xiaomi_mi5c-boot.img