[Android Q&A, Help & Troubleshooting] bethnesbitt:
Dissemble preloader.bin - unlock bootloader?

The preloader is the bootloader. After dissembling the preloader.bin, somewhat successfully, in IDA PRO, here is what I see for partitions:

In ida, open the preloader.bin, change the dropdown to ARM little endian, unsure about size for rom and the loading address, tried many different sizes and start address, each time give me a somewhat of a different outcome.

[IMG="Load new binary in IDA and select ARM Little Endian"]http://xdaforums.com/attachment.php?attachmentid=3040132&stc=1&d=1417299933[/IMG]​

Select Arm Little Endian​

[IMG="Choose the loading address and size for ROM"]http://xdaforums.com/attachment.php?attachmentid=3040134&stc=1&d=1417299933[/IMG]

Not sure about the Rom Size, did try size for RAM but would not encode. Have tried different sizes for ROM, getting different outputs. Using the loading address as 0x0, which is the linear start address in the scatter for preloader seems to make sense, could be wrong. Beware though, the larger size you try, the laggier your PC will get :(​

Now when the preloader.bin is done loading, go to

E

dit menu and select all. Now press the letter C on your keyboard for code, choose

A

nalyse and say yes. When done analyzing, you can scroll through the code, it doesn't analyze everything you will see some code that was not analyzed, those are in gold, if you select all that unanalyzed code by pressing shift+arrowdown, then press C it will analyze that code, you may want to go through and do that little cleanup.

Towards the bottom, you will see ASCII text that was decoded, here is what shows for my partitions.

ROM:00017518 dword_17518 DCD 0x201A626, 0 ; DATA XREF: sub_11CC+2o

ROM:00017518 ; ROM:off_11D4o

ROM:00017520 DCD dword_600000 <- PRELOADER

ROM:00017524 ALIGN 0x10

ROM:00017530 DCD 0x201A630, 0

ROM:00017538 DCD dword_80000 <-- MBR

ROM:0001753C DCD 0, 0, 0

ROM:00017548 DCD 0x201A634, 0

ROM:00017550 DCD dword_80000 <-- EBR1

ROM:00017554 ALIGN 0x10

ROM:00017560 DCD 0x201A639, 0

ROM:00017568 DCD dword_300000 <-- PRO_INFO

ROM:0001756C DCD 0, 0, 0

ROM:00017578 DCD 0x201A642, 0

ROM:00017580 DCD dword_500000 < -- NVRAM

ROM:00017584 ALIGN 0x10

ROM:00017590 DCD 0x201A648, 0

ROM:00017598 DCD dword_A00000 <-- PROTECT_F

ROM:0001759C DCD 0, 0, 0

ROM:000175A8 DCD 0x201A652, 0

ROM:000175B0 DCD dword_A00000 <-- PROTECT_S

ROM:000175B4 ALIGN 0x10

ROM:000175C0 DCD 0x201A65C, 0

ROM:000175C8 DCD dword_20000 <-- SEFCG

ROM:000175CC DCD 0, 0, 0

ROM:000175D8 DCD 0x201A663, 0

ROM:000175E0 DCD dword_60000 <- UBOOT/LK.BIN

ROM:000175E4 ALIGN 0x10

ROM:000175F0 DCD 0x201A669, 0

ROM:000175F8 DCD dword_600000 < -- BOOTIMG

ROM:000175FC DCD 0, 0, 0

ROM:00017608 DCD 0x201A671, 0

ROM:00017610 DCD dword_600000 <-- RECOVERY

ROM:00017614 ALIGN 0x10

ROM:00017620 DCD 0x201A67A, 0

ROM:00017628 DCD dword_40000 <-- SEC_RO

ROM:0001762C DCD 0, 0, 0

ROM:00017638 DCD 0x201A684, 0

ROM:00017640 DCD dword_80000 < -- MISC

ROM:00017644 ALIGN 0x10

ROM:00017650 DCD 0x201A689, 0

ROM:00017658 DCD dword_300000 <-- LOGO

ROM:0001765C DCD 0, 0, 0

ROM:00017668 DCD 0x201A68E, 0

ROM:00017670 DCD dword_A00000 <-- EXPDB

ROM:00017674 ALIGN 0x10

ROM:00017680 DCD 0x201A694, 0

ROM:00017688 DCD 0x28A00000, 0, 0, 0 < -- ANDROID SYSTEM

ROM:00017698 DCD 0x201A69E, 0

ROM:000176A0 DCD 0x17800000, 0, 0, 0 < -- CACHE

ROM:000176B0 DCD 0x201A6A4, 0

ROM:000176B8 DCD 0x20000000, 0, 0, 0 <-- USERDATA

If you compare that to your scatter, you will see that they match up, right in order per the scatter as well as when you go into:

adb shell
cat /proc/dumchar_info > /sdcard/dumchar.txt

Katherick, for your question, yes the recovery can be modified, now another option is using a hexdump. Maybe somebody can point us to using hexdump to modify and saving it back to the binary format. First you would have to figure out how to change the value in the preloader.bin of your recovery, not sure if just that ascii value has to be changed, or is there another place. Once you decompile the preloader.bin in IDA, you can see where those ASCII values point to identifiers throughout the code in various spots, except for the partition sizes.

Now, for the ascii, here is a little bit from mine:

ROM:00013426 aPreloader DCB "PRELOADER",0 ; DATA XREF: sub_DB84+B0o
ROM:00013426 ; ROM:off_DCD0o ...
ROM:00013430 aMbr DCB "MBR",0
ROM:00013434 aEbr1 DCB "EBR1",0
ROM:00013439 aPro_info DCB "PRO_INFO",0
ROM:00013442 aNvram DCB "NVRAM",0
ROM:00013448 aProtect_f DCB "PROTECT_F",0
ROM:00013452 aProtect_s DCB "PROTECT_S",0
ROM:0001345C aSecure DCB "SECURE",0 ; DATA XREF: sub_D7F8+5Co
ROM:0001345C ; ROM:off_D8E8o ...
ROM:00013463 aUboot DCB "UBOOT",0 ; DATA XREF: ROM:000027C8o
ROM:00013463 ; ROM:off_2848o ...
ROM:00013469 aBootimg DCB "BOOTIMG",0 ; DATA XREF: sub_DB84+38o
ROM:00013469 ; ROM:off_DCBCo ...
ROM:00013471 aRecovery DCB "RECOVERY",0 ; DATA XREF: sub_DB84+68o
ROM:00013471 ; ROM:off_DCC4o ...
ROM:0001347A aSecstatic DCB "SECSTATIC",0 ; DATA XREF: sub_DB84+118o
ROM:0001347A ; ROM:off_DCF0o
ROM:00013484 aMisc DCB "MISC",0
ROM:00013489 aLogo_0 DCB "LOGO",0 ; DATA XREF: sub_D544+6Ao
ROM:00013489 ; ROM:off_D61Co ...
ROM:0001348E aExpdb DCB "EXPDB",0
ROM:00013494 aAndsysimg DCB "ANDSYSIMG",0 ; DATA XREF: sub_DB84+112o
ROM:00013494 ; ROM:off_DCECo
ROM:0001349E aCache DCB "CACHE",0 ; DATA XREF: sub_DB84+DEo
ROM:0001349E ; sub_DB84+12Ao ...
ROM:000134A4 aUser DCB "USER",0 ; DATA XREF: sub_DB84+124o
ROM:000134A4 ; ROM:off_DCF8o
ROM:000134A9 aFat DCB "FAT",0
ROM:000134AD aDeviceApcDomai DCB 0xA ; DATA XREF: sub_1208+8o
ROM:000134AD ; ROM:off_130Co

and here is the identifier:

ROM:0000DCB4 off_DCB4 DCD aUboot - 0xDB8E ; DATA XREF: sub_DB84+4r
ROM:0000DCB4 ; "UBOOT"
ROM:0000DCB8 off_DCB8 DCD aLogo_0 - 0xDBA8 ; DATA XREF: sub_DB84+1Er
ROM:0000DCB8 ; "LOGO"
ROM:0000DCBC off_DCBC DCD aBootimg - 0xDBC0 ; DATA XREF: sub_DB84+36r
ROM:0000DCBC ; "BOOTIMG"
ROM:0000DCC0 off_DCC0 DCD aAndroid - 0xDBD8 ; DATA XREF: sub_DB84+4Er
ROM:0000DCC0 ; "ANDROID"
ROM:0000DCC4 off_DCC4 DCD aRecovery - 0xDBF0 ; DATA XREF: sub_DB84+66r
ROM:0000DCC4 ; "RECOVERY"
ROM:0000DCC8 off_DCC8 DCD aSec_ro - 0xDC08 ; DATA XREF: sub_DB84+7Er
ROM:0000DCC8 ; "SEC_RO"
ROM:0000DCCC off_DCCC DCD aSeccnfg - 0xDC20 ; DATA XREF: sub_DB84+96r
ROM:0000DCCC ; "SECCNFG"
ROM:0000DCD0 off_DCD0 DCD aPreloader - 0xDC38 ; DATA XREF: sub_DB84+AEr
ROM:0000DCD0 ; "PRELOADER"
ROM:0000DCD4 off_DCD4 DCD aUsrdata - 0xDC50 ; DATA XREF: sub_DB84+C6r
ROM:0000DCD4 ; "USRDATA"
ROM:0000DCD8 off_DCD8 DCD aCache - 0xDC66 ; DATA XREF: sub_DB84+DCr
ROM:0000DCD8 ; "CACHE"
ROM:0000DCDC off_DCDC DCD aSPartNameSNotF - 0xDC80 ; DATA XREF: sub_DB84+F2r
ROM:0000DCDC ; "[%s] part name '%s' not found\n"
ROM:0000DCE0 off_DCE0 DCD aLib - 0xDC82 ; DATA XREF: sub_DB84+F6r
ROM:0000DCE0 ; "LIB"
ROM:0000DCE4 off_DCE4 DCD aSec_util_c - 0xDC8E ; DATA XREF: sub_DB84+100r
ROM:0000DCE4 ; "sec_util.c"
ROM:0000DCE8 off_DCE8 DCD a0 - 0xDC90 ; DATA XREF: sub_DB84+102r
ROM:0000DCE8 ; "0"
ROM:0000DCEC off_DCEC DCD aAndsysimg - 0xDC9A ; DATA XREF: sub_DB84:loc_DC94r
ROM:0000DCEC ; "ANDSYSIMG"
ROM:0000DCF0 off_DCF0 DCD aSecstatic - 0xDCA0 ; DATA XREF: sub_DB84:loc_DC9Ar
ROM:0000DCF0 ; "SECSTATIC"
ROM:0000DCF4 off_DCF4 DCD aSecure - 0xDCA6 ; DATA XREF: sub_DB84:loc_DCA0r
ROM:0000DCF4 ; "SECURE"
ROM:0000DCF8 off_DCF8 DCD aUser - 0xDCAC ; DATA XREF: sub_DB84:loc_DCA6r
ROM:0000DCF8 ; "USER"
ROM:0000DCFC off_DCFC DCD aCache - 0xDCB2 ; DATA XREF: sub_DB84:loc_DCACr
ROM:0000DCFC ; "CACHE"

Issue is though, I cannot find the partition sizes the way I can when looking at the ASCII and Identifiers.

Now to change the cache size or any other size, in the ascii where, for example, the cache size of mine is:

ROM:000176A0 DCD 0x17800000, 0, 0, 0

1. Make sure to mouse click on the partition size before going into the hex, this will bring you right to it in hex, where it can be changed.

2. Click on the tab that says HEX View-A and lets say you want to decrease it cut it in half for example: 17800000/2 = BC00000 or 394264576/2= 197132288 which is a hex value of BC00000.

So in the HEx View-A, make sure the size is selected, you want to change 80 17 to 00 BC, it has to be entered from right to left so that the IDA View-A can read it from left to right.

Thing is, I tried a few things:

In on the menu, selecting

E

dit > export data, and exporting it as raw binary then in terminal

dd if=preloader.txt > preoader.bin

Did not work

Also tried:

E

dit > apply patch > apply patch to input program did not work either, both just caused my tablet to get stuck at the boot logo.

Now this, as mentioned could be possibly because, I am doing the conversion correctly when making the changes, but:

Where is that identifier for the partition sizes, or is there one?

Is IDA decompiling it correctly?

Where is the identifier for FAT?

Where is the partition size for FAT?

Does the reason the EBR1 hack work, per my blog instructions, because there is no partition size for FAT in the bootloader?

Once, just to see what would happen, and it worked, I decreased my cache, this was hard to get the phone to like, but it worked. Next I increased the cache, the phone seemed okay with that hack.

Here are those instructions to modify the EBR1 and increase/decrease cache