[Transformer TF300T Q&A, Help & Troubleshooting] sbdags:
mmcblk0 layout

All dumps were done on Asus Eee Pad Transformer Infinity TF700T, 64GB version, firmware 9.4.5.26, locked

mmcblk0 off-partition section

Offset: 0 (0x0)

Size: 38273024 (0x2480000)

Read command: busybox dd if=/dev/block/mmcblk0 of=/mnt/sdcard/mmcblk0pre1.img bs=524288 count=73

Offset: 0 (0x0)

Size: 3670016 (0x380000)

Contains: Zeroes

Purpose: Unknown

Extract command: dd if=mmcblk0pre1.img of=mmcblk0pre1s1.img bs=3670016 count=1

Process command: tr -d '\0' <mmcblk0pre1s1.img >mmcblk0pre1s1nz.img # mmcblk0pre1s1nz.img must be empty file

Offset: 3670016 (0x380000)

Contains: Recovery kernel image followed by zeroes

Size: 8388608 (0x800000)

Extract command: dd if=mmcblk0pre1.img of=mmcblk0pre1s2.img bs=524288 skip=7 count=16

Process commands:

perl split_bootimg.pl mmcblk0pre1s2.img

mkdir mmcblk0pre1s2.img-ramdisk

cd mmcblk0pre1s2.img-ramdisk

zcat ../mmcblk0pre1s2.img-ramdisk.gz | cpio -i

cd ..

# end Process commands

Offset: 12058624 (0xb80000)

Contains: Regular boot kernel image followed by zeroes

Size: 8388608 (0x800000)

Extract command: dd if=mmcblk0pre1.img of=mmcblk0pre1s3.img bs=524288 skip=23 count=16

Process commands:

perl split_bootimg.pl mmcblk0pre1s3.img

mkdir mmcblk0pre1s3.img-ramdisk

cd mmcblk0pre1s3.img-ramdisk

zcat ../mmcblk0pre1s3.img-ramdisk.gz | cpio -i

cd ..

# end Process commands

Offset: 20447232 (0x1380000)

Contains: Block of 16 bytes followed by 0x2de0 hexadecimal numbers followed by FF

Size: 12288 (0x3000)

Extract command: dd if=mmcblk0pre1.img of=mmcblk0pre1s4.img bs=524288 skip=39

Vital data:

Extract command: dd if=mmcblk0pre1s4.img of=mmcblk0pre1s4ss2.img bs=4096 skip=3

Binary part of vital data:

Extract command: dd if=mmcblk0pre1s4ss1.img of=mmcblk0pre1s4ss1ch1.img bs=16 count=1

Hexadecimal part of vital data:

Extract command: dd if=mmcblk0pre1s4ss1.img of=mmcblk0pre1s4ss1ch2.img bs=16 count=734 skip=1

Process command: unhex <mmcblk0pre1s4ss1ch2.img >mmcblk0pre1s4ss1ch2bin.img

FF part of vital data:

Extract command: dd if=mmcblk0pre1s4ss1.img of=mmcblk0pre1s4ss1ch3.img bs=16 skip=735

Process command: tr -d '\377' <mmcblk0pre1s4ss1ch3.img >mmcblk0pre1s4ss1ch3nff.img # mmcblk0pre1s4ss1ch3nff.img must be empty file

Zeroes:

Extract command: dd if=mmcblk0pre1s4.img of=mmcblk0pre1s4ss1.img bs=4096 count=3

Process command: tr -d '\0' <mmcblk0pre1s4ss2.img >mmcblk0pre1s4ss2nz.img # mmcblk0pre1s4ss2nz.img must be empty file

Purpose: Probably encrypted bootloader

mmcblk0p1

Offset: 38273024 (0x2480000)

Size: 805306368 (0x30000000)

File system size: 196608 * 4096 = 805306368 (fully occupies partition)

Format: Linux ext4 filesystem

Mounted at: /system

Mount options: read only, extended attributes, ACL

Permissions: only root can manipulate

Contains: Base system and embedded applications

Purpose: Base system

mmcblk0p2

Offset: 843579392 (0x32480000)

Size: 448790528 (0x1ac00000)

File system size: 109568 * 4096 = 448790528 (fully occupies partition)

Format: Linux ext4 filesystem

Mounted at: /cache

Mount options: read/write, no SUID, no device nodes, no atime

Permissions: only root can manipulate, UID system and GID cache can read and write

Contains: Cache

Purpose: Application cache

Note: The volume has the same UUID as mmcblk0p1

mmcblk0p3

Offset: 1292369920 (0x4d080000)

Size: 2097152 (0x200000)

File system size: 512 * 4096 = 2097152 (fully occupies partition)

Linux rev 1.0 ext3 filesystem

Not mounted

Permissions: GID system can manipulate

Contains: Empty file system

Purpose: Recovery /misc

Referenced by: /system/lib/libandroid_runtime.so recovery ramdisk: /etc/recovery.fstab

Note: File system is referenced in recovery as emmc, not ext3!

mmcblk0p4

Offset: 1294467072 (0x4d280000)

Size: 855638016 (0x33000000)

File system size: 208896 * 4096 = 855638016

Linux rev 1.0 ext3 filesystem

Not mounted

Permissions: GID system can manipulate

Contains: Empty file system

Purpose: Recovery /staging

Referenced by: recovery ramdisk: init.rc /etc/recovery.fstab

mmcblk0p5

Offset: 2150105088 (0x80280000)

Size: 5242880 (0x500000)

File system size: 5092 * 1024 = 5147488

Format: FAT32 file system, no partition table, MS-DOS "Non-system disk" boot block

Not mounted

Permissions: only root can manipulate

Contains: File system with files:

Serial numbers (ISN, PPID, SSN, UUID)

Calibration data (AL3010 light sensor, AMI304 magnetic sensor, KXTF9 motion sensor)

Purpose: Device specific unique system data, mounted as /btmac during Android boot

Referenced by: /system/bin/wifimacwriter /system/bin/brcm_patchram_plus /system/bin/sensors-config /system/bin/sixpair ramdisk: /init recovery ramdisk: /etc/recovery.fstab /init

mmcblk0p5 off file-system area

Offset in section: 5147488 (0x4e8b60)

Size: 28672 (0x7000)

Read command: busybox dd if=/dev/block/mmcblk0p5 of=/mnt/sdcard/mmcblk0p5s2.img bs=1024 skip=5092

Process command: tr -d '\0' <mmcblk0p5s2.img >mmcblk0p5s2nz.img # mmcblk0p5s2nz.img must be empty file

mmcblk0p6

Offset: 2155347968 (0x80780000)

Size: 524288 (0x80000)

Format: binary data

Permissions: UID drm can manipulate

Contains: 208 bytes of binary data, the rest are zeroes

Purpose: DRM, probably contains encrypted DRM key

Referenced by: /system/bin/wvdrmserver /system/vendor/lib/drm/libdrmwvmplugin.so

mmcblk0p7

Offset: 2155872256 (0x80800000)

Size: 5242880 (0x500000)

Format: empty

Contains: Zeroes

Purpose: Unknown

mmcblk0p8

Offset: 2161115136 (0x80d00000)

Size: 61415620608 (0xe4ca80000)

File system size: 14994040 * 4096 = 61415587840

Format: Linux ext4 filesystem

Mounted at: /data

Mount options: read/write, no SUID, no device nodes, no atime

Permissions: only root can manipulate, read and write are directory specific

Contains: User applications, user data, and virtual internal SD card

Note: /data/media is mounted via UID/GID stripping FUSE as /mnt/sdcard

mmcblk0p8 off file-system area

Offset in section: 61415587840 (0xe4ca78000)

Size: 32768 (0x8000)

Read command: busybox dd if=/dev/block/mmcblk0p8 of=/mnt/sdcard/mmcblk0p8s2.img bs=4096 skip=14994040

mmcblk0 off-partition section

Offset: 63576735744 (0xecd780000)

Size: 524288 (0x80000)

Read command: busybox dd if=/dev/block/mmcblk0 of=/mnt/sdcard/mmcblk0post8.img bs=524288 skip=121263

Process command: tr -d '\0' <mmcblk0p8s2.img >mmcblk0p8s2nz.img # mmcblk0p8s2nz.img must be empty file

Offset: 63576735744 (0xecd780000)

Offset in section: 0 (0x0)

Size: 507392 (0x7be00)

Contains: Zeroes

Purpose: Unknown

Extract command: dd if=mmcblk0post8.img of=mmcblk0post8s1.img bs=507392 count=1

Process command: tr -d '\0' <mmcblk0post8s1.img >mmcblk0post8s1nz.img # mmcblk0post8s1nz.img must be empty file

Offset: 63577243136 (0xecd7fbe00)

Offset in section: 507392 (0x7be00)

Size: 16896 (0x4200)

Contains: EFI Partition table (partition names: APP, CAC, MSC, USP, PER, YTU, CRA, UDA)

Extract command: dd if=mmcblk0post8.img of=mmcblk0post8s2.img bs=512 skip=991

Purpose: Partition table

Total size of mmcblk0: 63577260032 (0xecd800000)

Notes:

can manipulate = can read, write partition vital data, only root can mount

can read, write = can read, write partition file system contents

Read commands are ran on the Transformer

Extract and process commands are run anywhere, with pre-read image file in the current directory.

You need dd with large files support. Vanilla dd on TF700T does not support large files. Busybox dd does.