yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] dieselnutjob:
I tried the imgrepackerrk on Manjaro linux and with the /cid option it unpacked an RK3566 firmware file just great. Thanks!

My understanding is that the individual img files that imgrepackerrk produces are then further packed and there is a RockChip tool called afptool to pack/unpack them.

The version of afptool that I have is not able to unpack these img files.

The firmware that I am experimenting with is here

https://files.pine64.org/os/Quartz64/android/Quartz64_model-A_20210604_stock_android11_emmcboot.img.gz

Can you comment or advise please? thanks
[Upgrading, Modifying and Unlocking] dieselnutjob:
I have compared some of the .img files that imgrepackerrk extracted from the factory firmware file, with images that I made myself using dd to dump partitions from a running system to an SDcard.

Most of them appear to be the same. So they are aren't "packed". I honestly don't know what the afptool is for.

I am trying to figure out how to create a firmware image from a running system for a device for which the manufacturer has not supplied a firmware image. I would like to be able to revert it back if I ever brick it.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
1. Extract the modified partitions from the configured device

2. Unpack the proprietary firmware (*.img)

3. Replace the necessary parts with the extracted ones (in paragraph 1)

4. Pack the firmware
[Upgrading, Modifying and Unlocking] dieselnutjob:
If I open this firmware https://files.pine64.org/os/Quartz6...el-A_20210604_stock_android11_emmcboot.img.gz with rkimagerepackerrk then I get the following image files:-

MiniLoaderAll.bin

uboot.img

misc.img

dtbo.img

vbmeta.img

boot.img

recovery.img

baseparameter.img

super.img

and it gives this parameter.txt

FIRMWARE_VER: 11.0
MACHINE_MODEL: rk3566_rgo
MACHINE_ID: 007
MANUFACTURER: rockchip
MAGIC: 0x5041524B
ATAG: 0x00200800
MACHINE: rk3566_rgo
CHECK_MASK: 0x80
PWR_HLD: 0,0,A,0,1
TYPE: GPT
CMDLINE:mtdparts=rk29xxnand:
0x00002000@0x00002000(security),
0x00002000@0x00004000(uboot),
0x00002000@0x00006000(trust),
0x00002000@0x00008000(misc),
0x00002000@0x0000a000(dtbo),
0x00000800@0x0000c000(vbmeta),
0x00014000@0x0000c800(boot),
0x00030000@0x00020800(recovery),
0x000c0000@0x00050800(backup),
0x000c0000@0x00110800(cache),
0x00008000@0x001d0800(metadata),
0x00000800@0x001d8800(baseparameter),
0x004b0000@0x001d9000(super),-@0x00689000(userdata:grow)

If I burn this firmware onto a Quartz64 using RKDevTool v2.84 and then boot it up, and then reboot to Loader mode, in RKDevTool if I hit the "Dev Partition" button I get this

Partition is gpt
NO LBA Size Name
01 0x00002000 0x00002000 security
02 0x00004000 0x00002000 uboot
03 0x00006000 0x00002000 trust
04 0x00008000 0x00002000 misc
05 0x0000a000 0x00002000 dtbo
06 0x0000c000 0x00000800 vbmeta
07 0x0000c800 0x00014000 boot
08 0x00020800 0x00030000 recovery
09 0x00050800 0x000c0000 backup
10 0x00110800 0x000c0000 cache
11 0x001d0800 0x00000800 metadata
12 0x001d8800 0x00000800 baseparameter
13 0x001d9000 0x004b0000 super
14 0x00689000 0x06df2fc0 userdata

So my question is... if security, trust, backup, cache, metadata, userdata are not in the firmware, then how do they end up on the device after the firmware is applied?

If partitions are labelled in the parameter.txt file but there is no image for a partition does RKDevTool just create a new empty, formatted partition? which would make sense for userdata, cache etc.
[Upgrading, Modifying and Unlocking] Superkekko80:
I have the same problem too.

Has anyone solved?

the signature verification always fails with all the software I tried

Do you have advice?
[Upgrading, Modifying and Unlocking] mrleongalaxyum:
Yes, I do in fact.

I smashed mine with a hammer and solved all the problems.

Afterwards I bought a better one. :)
[Upgrading, Modifying and Unlocking] Superkekko80:
It is not a solution.

Just to sign a zip?

To edit the file I used S.U.R by Jamflux https://github.com/jamflux/sur

my log: https://www.mediafire.com/file/qyfx2l3xn2zapx8/log.txt/file

thanks

my screen:

https://disk.yandex.com/i/jldKbpi7MXqvJA

But anyway I can't sign correctly
[Upgrading, Modifying and Unlocking] xixihaha:
Thanks so much for this useful tool.

I used it to unpack RK3566 img files successfully with cid option.

But I met issue when using it to do further unpack of boot.img. It falls into infinite loop. Could you help to take a look? Thanks so much.

The files can be found here https://drive.google.com/file/d/13RZDWUd3Dp_5trzYH8Z_PtBRTHsRA8L-/view?usp=sharing

link updated
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Try to use another test version https://1drv.ms/u/s!ApT2PdXy7niKgwDS0fmgFnkJGGvB
[Upgrading, Modifying and Unlocking] xixihaha:
Thanks so much. This one works great. I'll do more test on it.
[Upgrading, Modifying and Unlocking] sumwong:
@RedScorpioXDA thanks a lot for this great tool!

I am encountering a problem with repacking an img. It seems to struggle with the system.img (system (unknown/empty?), ImgFSize = 0x00000000 in log file). I checked the file and it seems to be okay. All other .img files are being read okay. The file has 4096MB - is that the problem or am I doing something else wrong?
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Please provide link to firmware
[Upgrading, Modifying and Unlocking] bamlusarzu:
deleted
[Upgrading, Modifying and Unlocking] digitaldaz21:
Hi

I am trying to repack the firmware for a T95 plus android TV box

The firmware is available at https://drive.google.com/file/d/1DDsvqOQyo0YJcxztOhPdZHXyGE4jqfvr/

I can use the tool and pack and then repack but then I cannot load the generated image into any of the tools to write it, I get error loading firmware failed.

The box is an rk3566 unit.

The two commands I am using are:

imgRePackerRK.exe /cid T95PLUS-3566-LPDDR-920M-v1.09-20220506.img

Followed by:

imgRePackerRK.exe T95PLUS-3566-LPDDR-920M-v1.09-20220506.img.dump

Even without modifying any files and doing just those two commands causes the error.

The firmware loads fine before I unpack and repack.

Am I doing something wrong?

Thanks

Daz
[Upgrading, Modifying and Unlocking] xinulhacker:
Use Android Image Kitchen
[Upgrading, Modifying and Unlocking] digitaldaz21:
Thanks for the reply, I've managed to work around this for now anyway, what I was trying to do was nuke a couple of partitions so that the box would fail to boot android and go for the SD card.

I managed to do it with AndroidTool
[Upgrading, Modifying and Unlocking] hotnikq:
@RedScorpioXDA

Please Reupload imgRePackerRK_107h_test.zip

The link is down!

RK3566

0x33353638

Unsupported ChipID

SOLVED:

Under Linux:

sudo ./imgrepackerrk /cid imagefile.img
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
This is described in the help
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Use https://1drv.ms/u/s!ApT2PdXy7niKgwDS0fmgFnkJGGvB
[Upgrading, Modifying and Unlocking] tvladan:
@RedScorpioXDA

Hello and thank you for this tool. I am trying to unpack an update rk img 3399 but I am getting the following errors:

Stored and calculated rkCRC summ are not equal

Stored and calculated MD5 summ are not equal

Spoiler content hidden.

The image is located here (inside zip): https://drive.google.com/file/d/1Uj9JO4DUxYfHQIFMRsemQq0NAOM6iEzV/view?usp=share_link

Can you please help me unpack / repack this ... my (****ty STM32) HU lost sound because of wrong flashed firmware and now I am trying to find a way to flash my backed up partitions (via adb) back to the board.

Thanks.

LE: The Latest RKDevTools can unpack the image just fine, but I have not found a way to pack it back (in Windows) and to flash it via MASKROM back to the device.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
@tvladan

Microsoft OneDrive

1drv.ms
[Upgrading, Modifying and Unlocking] deadman96385:
Hey @RedScorpioXDA, used your dumper to dump this random rockchip device I had. I tried to use this unpacker on the uboot img. But its reporting an unknown RKUbook_HDR.SHAsize =32

Spoiler content hidden.

Here is the uboot image

mirror_uboot.img

drive.google.com
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
I have never seen a uboot with such a SHA size before. When the time comes, I'll take a look. It may be possible to do unpacking/packing.
[Upgrading, Modifying and Unlocking] QATech20:
Ran into the same as deadman while trying to unpack a uboot.img I pulled from a RK3288.

Spoiler content hidden.

If it helps the Rockchip RK3288 I extracted it from is running Android 7.1.2. Trying to unpack it so I can modify the boot order for a firmware upgrade.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Microsoft OneDrive

1drv.ms
[Upgrading, Modifying and Unlocking] TBM 13:
Trying to pack uboot.img with an uboot binary built by me for rk3368, but I'm getting "Primary uboot (.\uboot.img.dump\uboot.bin) too large".

Original uboot is 993 KB, new one is 1,04 MB. Why is it considered too large when the size of the uboot partition is 4 MB?

SHASize is 0x00000020 btw
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
There is too little information for research
[Upgrading, Modifying and Unlocking] josemarprete:
I'm completely layman. I need to extract the DTB from an Android tv box with SoC RK3566. Does anyone know how to do it?

I'm using google translator!
[Upgrading, Modifying and Unlocking] willian.sanchez.98871174@:
Hello, could you help me? I'm trying to install the firmware of the H96 MAX V58 BUT AT THE MOMENT OF OPENING THE Firmware with Android tools, Error Loading finware Failed appears... And I've tried several Firmware and they all give me the same thing, could someone help me please?
[Upgrading, Modifying and Unlocking] TBM 13:
Another guy ran into this same issue. He unpacked uboot.img, patched it to remove the 32MB eMMC dump restriction and couldn't repack it because the binary was too big. He tried to patch your tool to remove the size check and that worked perfectly, so you may want to take a look to it
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
I don't remember introducing restrictions. Give a link to an example for tests
[Upgrading, Modifying and Unlocking] TBM 13:
Nevermind this. I tried to reproduce the issue with his uboot binary but its size was normal (below 1 MB) and had no issues, so he may have done something wrong. Sorry for the confusion.

The restriction is indeed in the tool, but I guess there's a reason for it.

View attachment 5996143

Anyway, great work with all of your tools. They are really helpful, specially this one.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
You're right. But I don't remember why I set the restriction (I didn't write it for myself in the source code). Therefore , I have somewhat expanded the limits

Microsoft OneDrive

1drv.ms
[Upgrading, Modifying and Unlocking] waldopulanco:
is there a possibility, there is miniloader inside the firmware backup by rkdumper?

list of image

View attachment 6005549

I Accidentally download wrong firmware and the bootloader was replace, and I cannot recover my tv box. it always maskrom mode, it cannot enter on loader mode, I tried many bootloader on the internet but failed to enter on loader mode.

here is my topic thread:

https://xdaforums.com/t/help-mxq-pro-4k-5g-rk3128-was-bricked-by-wrong-firmware.4626933/
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
rkDumper does not save the miniloader, because only 2 parts of it are stored in the available memory of the device. These 2 parts can be dumped in a special mode.
[Upgrading, Modifying and Unlocking] waldopulanco:
I had replaced my original miniloader. so no miniloader inside of backup.img or even on radical_update.img? is it possible to recover the original miniloader on my device? thank you
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
The original miniloader could be found in other firmware by identifying 2 of its original parts, but, as I understand it, you have not saved them.
[Upgrading, Modifying and Unlocking] waldopulanco:
the Problem is I dont know the version of my device miniloader I tried from v2.17 up to 2.40, 2.47 and 2.52 but same result always maskrom mode, in version 2.52 my backup firmware was accepted but maskrom mode it cannot enter on loader mode. is there any ways to know what is the right version of miniloader to boot up my device in loader mode? thank you so much sir for the responsed.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Unfortunately, my knowledge is not enough
[Upgrading, Modifying and Unlocking] waldopulanco:
sorry, anyway thank you so much for the response
[Upgrading, Modifying and Unlocking] waldopulanco:
rk3128A not rk3128 this is different, here is error when repacking

PS: How do I use the RSA Key again when repacking?
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
The problem with RSA has not been solved (I'm unlikely to do this)
[Upgrading, Modifying and Unlocking] waldopulanco:
but can you solve this problem for rk3128a when repacking? thanks
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
I can't promise anything.

PS. You forgot to give a link to the file
[Upgrading, Modifying and Unlocking] waldopulanco:
thank you!
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Oh-oh-oh. The source file uses RSA. There's nothing I can do to help you.
[Upgrading, Modifying and Unlocking] waldopulanco:
how about this one?
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Similarly
[Upgrading, Modifying and Unlocking] waldopulanco:
wow Lol. why RK3128A so secured Lol :ROFLMAO::ROFLMAO:... I dont have an option now, do you have an idea how to create bootloader and uboot. I finally found bootloader but it cant accept any firmware except the firmware where the bootloader came from. but if I use different firmware but the bootloader is same it cannot accept "Not allow to boot no secure sign image!" anyway thank you for the effort.

secure boot is enable, I dont have an idea to disable it,
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Alas, I'm not that smart
[Upgrading, Modifying and Unlocking] niquedegraaff:
UPDATE:

There is only one solution for this: You have to build the original rk2918_tools on Linux yourself (use WSL on windows), and then you can unpack and pack with the original tools. There was no other way. I managed to replace the recovery.img from my original firmware image with a customized TWRP one.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Explain what this message refers to
[Upgrading, Modifying and Unlocking] waldopulanco:
I am trying to create a bootloader now for rk3128a. I have original rk3128_ddr_300MHz_v2.bin and rk3128_usbplug_v2.bin from the original bootloader. but after comfiling using rkbin on my ubuntu. my device is maskrom mode. but the original files is from the bootlader when my device is booted. I compare the flashdata and flashboot from the original bootloader. but they are not same. but the ddr and usbplug is I use the original, and compile it.

the flashdata and flashboot is came from the following lines.

here is a sample on ini to create a bootloader from rkbin

I change the other value to make match the original files from my working bootloader.

I hope someone can Explain why the flashboot and flashdata is different from the original?thanks!
[Upgrading, Modifying and Unlocking] waldopulanco:
according to this list the RK31xx is ChipID=0x00000070. I use uart serial console during booting of my device which is cpu rk3128a on my serial log the chip type is ChipType = 0xa 1367, or sometime ChipType = 0xa 1366.

I tried to search this chiptype on google but nothing found. I found only ChipType = 0xa, 1368. which is rk3128.

I found this RK31xx (ChipID=0x00000070); on boot_merger. I am creating bootloader for rk3128a. I have the original rk3128a bootloader. I unpacked it and copy the RK3128_DDR3_300M_V2.bin and rk312xusbplug.bin

according to the rules of version.

the major version is v2 is the version of "RK3128_DDR3_300M_V2.bin"

and the minor version 32 is from "rk312x_miniloader_v2.32.bin"

that is why I search this and download "rk312x_miniloader_v2.32.bin".

on rkbin/RKBOOT/ there is ini setting for different type of chip. I edited the "RK3128MINIALL.ini"

the FlashData is from "RK3128_DDR3_300M_V2.bin"

the FlashBoot is from "rk312x_miniloader_v2.32.bin"

after compile, I unpacked it and compare using hex the FlashBoot to the original flashboot of rk3128a, but its different.

I suspect is in boot_merger. that is why I open the boot_merger.h and found the RK31xx ChipID=0x70. is it possible the rk3128a is different chip id? that is why the encryption on boot_merger to the flashboot is different compare to the original?

and what is the meaning of capital (L) on bootloader?

thanks in advance!
[Upgrading, Modifying and Unlocking] niquedegraaff:
That I was unable to create a valid RK3318 img from the original rom image (RK3318_user_H96MaxRK3318_10_20220530.1412.img)

I unpack the original rom with imgrepackerRK

I do not do anything with the unpacked files..

I immediately repack it again with imgrepackerRK

After repacking (without doing anything to the files) the tool generates a new image which i am unable to use. It misses the loader.img file. I can see that by the filesize difference, it exactly misses the loader.img file size.

When I use the official tool (img_unpack) to verify that, I can not even unpack the image generated by this tool:

Error: Invalid rom file: RK3318_user_H96MaxRK3318_10_20220530.1412.img

Normally, when unpacking the original img with official tools you'll see

./unpacked/loader.img

./unpacked/update.img

And in the update.img, we will see /Images/recovery.img and so on.

But this imgrepackerrk tool does not unpack this way, it directly unpacks /original_firmware.img/update.img and totally ignores the loader.img. Where is the loader.img? Why is it not repacking with the loader.img? I'm pretty sure that this is the cause for my ' invalid rom file' error.
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
Provide a link to the firmware
[Upgrading, Modifying and Unlocking] niquedegraaff:
RK3318_user_H96MaxRK3318_10_20220530.1412.img

drive.google.com

(via https://www.h96tvbox.com/firmware-download/)
[Upgrading, Modifying and Unlocking] imaHabbaProblems:
Hi, when repacking the contents of .dump directory and attempting to flash it to the device tools are complaining about invalid tags.

Using FactoryTool it reports the firmware is for target "RK35" (should be "RK3566") and "Linux Upgrade Tool" reports the following:

Rockusb>cd
List of rockusb connected
DevNo=1 Vid=0x2207,Pid=0x350a,LocationID=15 Mode=Loader SerialNo=5ecbfe2285fe537b
Found 1 rockusb,Select input DevNo,Rescan press <R>,Quit press <Q>:1
Rockusb>uf RK3566_userdebug_H96_Max_V56.img
Loading firmware...
Loading firmware failed!
Note:invalid tag of firmware,please check firmware
Rockusb>

The log files of Dump and Repack (debug, verbose):

Dump: https://gist.github.com/xXx-Raven-x...7a6208994#file-imgrepackerrk-linux-unpack-log

Repack: https://gist.github.com/xXx-Raven-x...7a6208994#file-imgrepackerrk-linux-repack-log

hopefully you can see those gists.

Some output from Upgrade Tool (Linux):

Rockusb>v
Upgrade Tool v2.1

Rockusb>rcb
Capability:15 07 00 00 00 00 00 00
Direct LBA: enabled
First 4m Access: enabled
Read Com Log: enabled
Read Secure Mode: enabled
New IDB: enabled
Switch Storage: enabled

Rockusb>rid
Flash ID:45 4D 4D 43 20

Rockusb>rci
Chip Info: 38 36 35 33 0 0 0 0 0 0 0 0 0 0 0 0

Download for the stock image:

https://drive.google.com/file/d/1Dtz8gbyx7sCCFPp1YKkXQav6ZA9POWTx/view?usp=sharing

(Note: I have renamed the image file for the tests)
[Upgrading, Modifying and Unlocking] waldopulanco:
sir do you have an idea how to backup miniloader on working device? i tried to 0x40 but blank data. according to rockchip the miniloader save at sector 0x40. but its blank when I dump it. thanks
[Upgrading, Modifying and Unlocking] Barkuti:
Dear RedScorpioXDA,

More or less recently I've been taking a look at a couple cheap RK3566 Android TV boxes from different brands. A friend of me wanted to upgrade his very limited smart TV, so I told him that if he could give me some gratuity I would get a decent Android TV box and get it properly ready for him by installing a good set of software and removing its limitations. But the stuff didn't go well, mainly because both of the RK3566 Android boxes came with a firmware bug in the “/system/etc/keylayout/Generic.kl” file which I couldn't fix due to unproper rooting and firmware limitations.

The bug which I am speaking of is already very old, and is documented in the page X96 TV box issue – how to fix it when Enter key interprets as “q”? @ NoviSign.

It really pisses me off that these chinese morons are shipping TV boxes plagued with this error, and it's been many years since reported already! 😲 And while I don't know who is the retarded, irresponsible software developer team making the base firmware images for the various manufacturers of these boxes, the problem is there and it's very serious.

Having said the above, could you please update your imgRePackerRK software to make it fully compatible with RK3566/RK3568 images (and RK3588 if possible)? I did some tests with it on a few firmware files from different RK3566 boxes, but it didn't work well.

User imaHabbaProblems must have contacted you about this, and I already see he already posted here concerning issues with imgRePackerRK… 🤔

Your help is much appreciated. Thank you for creating this tool, and thank you in any case.
[Upgrading, Modifying and Unlocking] BoBe23:
Hi, how to unpack and repack rk3528 Android 13 Firmware ?
[Upgrading, Modifying and Unlocking] RedScorpioXDA:
What exactly is the problem? Can't you repack the firmware? If the mentioned file is in the ext3/4 file system, I will not do this, you can find various developed tools
[Upgrading, Modifying and Unlocking] snam11:
you could go into twrp recovery (or just adb connect while you're in recovery mode), mount the system partition:

mount -o rw /system

and from there edit/replace the kl file

like:

cd /system/usr/keylayout/

vi Generic.kl (and than save the edited file)

or if you have stored somewhere the file (i.e download folder):

rm /system/usr/keylayout/Generic.kl

cp /sdcard/download/Generic.kl /system/usr/keylayout/

you could also rip the system partition, edit/replace the file, repack the img and flash it back on the device.

you need linux to do so,but is not that hard:

let's suppose you've dumped your system partition and copied to a folder:

mount -o loop,rw -t ext4 rippedsystemimage.img /nameofthefolder/

it should mount the content of the img into this folder, and you can edit/delete the file, and when you've done:

umount nameofthefolder

than you have to reflash the img back to the device
[Upgrading, Modifying and Unlocking] Barkuti:
Thanks for contributing snam11, but I solved the problem more than a month ago. The long explanation is in post #26 of the thread RK3566 / RK3568 TV boxes: rooting, TWRP? and etcetera:

That was it.

There is no TWRP for these devices, and compiling or building it is out of my reach with my current knowledge.

Rip the system partition? How? I recall sending some fastboot commands to the box and if I recall correctly there was something to rip partitions (???), something which I invoked for the sake of curiosity but I got an “unsupported operation” message or something alike; can't say for sure, of course, I'd have to check it again.

I have the box's firmware in an img file, so no need to rip anyway.

This is pretty useful information; thank you. 🤗

However, what I have is the full firmware img file (≈2.5 GB), so I'm not sure that what you say is applicable. Hope so, though.