[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] foobar66:
[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"

This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.

On the back of my thread on the splash screen (see https://xdaforums.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), [MENTION=4441934]AnoopKumar[/MENTION] and I started checking the bootloader.

The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.

(https://xdaforums.com/showpost.php?p=78409574&postcount=28)

All below is on Linux ... I am not a Windows guru ...

Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".

> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a

You will now have the dump of the bootloader partition in the file

Then, use "binwalk" to see what is inside the abl_a image:

> binwalk -e img.abl_a

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes

I am thinking that bytes 0...4487 is the real bootloader code, so:

> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size

Not sure why it says "corrupt section header size".

Then check the detail of the ELF file:

> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0

There are no sections in this file.
There are no sections to group in this file.

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000

There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.

Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52

The bootloader binary code is in the LOAD segment

More to follow later ... have to catch some sleep now ...