[Android Stick & Console AMLogic based Computers] effgee:
Formatting is screwy, suggest to view it here:

How to patch AMLogic TV Boxes boot partition to enable Magisk to function properly.

Last Updated: 2021-08-17 Written by: effgee These instructions are how to patch a boot image for Amlogic based boxes, specifically of the X96 type to enable Magisk to function properly. The instructions are generalized and may work for any Amlogic boxes. These are written instructions based on th...

rentry.co

XDA doesnt let me upload .txt or .md files. sigh.

Pdf attached but meh..

Video can be downloaded on the 4pda forums, or alternatively here:

185.77 MB file on MEGA

mega.nz

The 4pda forums are Russian only and some of the files there you must have an account first to download, hence the Mega video link.

All research and discovery due to Chela_vek and others involved on the 4pda forums.

I've just made it a bit more digestible, to assist more people.

# How to patch AMLogic TV Boxes boot partition to enable Magisk to function properly.

Last Updated: 2021-08-17

Written by: effgee

These instructions are how to patch a boot image for Amlogic based boxes, specifically of the X96 type to enable Magisk to function properly. The instructions are generalized and may work for any Amlogic boxes.

- These are written instructions based on the video (video is named "bandicam.mp4" in that thread) presented here.

- https://4pda.to/forum/index.php?showtopic=774072&st=25020#entry91068157

- The video, while very thorough, does not perform all the steps in the optimal order. There will be some backtracking which can be a bit confusing.

I have done this procedure for:

- X96 Max Plus q2, X96Max_Plus_Q2_20201209-1446.img firmware

- X96 Air Extreme, CONCEPTUM rebrand 4/32 stock firmware (when mentioning "my edits" it is indicative for this particular firmware)

Both of these were accomplished using Magisk v.23

[h3]Pre-requisites [/h3]

Before starting, you need:

- The original boot.img from your firmware, or TWRP backup of the boot (not bootloader) partition.

- Install Magisk Manager on the device.

- Open Magisk manager. Click install. (Root not needed, you will have Magisk root after.)

- You should have an option to use "Recovery Mode", select it.

- Choose "Select and Patch a file". Feed it your original boot.img.

- Magisk will put a "Magisk Patched" boot.img in your downloads.

- The next hex editing steps are performed on the "Magisk Patched" boot.img

Hexeditor Settings

16 bytes per row (The usual for most editors)

That is 16 columns of XX.

___

[h3]Video 0:00 to 2:00 [/h3]

- Open the Magisk modified boot.img in your hex editor.

- Go to offset ``[code single]00000B50[/code]``

- Get the values of the first 3 columns.

- ``[code single] 0C 81 97 [/code]`` for this particular file.

- Reverse their order,

- ``[code single] 97 81 0C [/code]``

- Open up windows calculator and put it into programmer / hex mode.

- With the calculator, add the reversed value,

- ``[code single] 97 81 0C [/code]`[code single] + [/code]`[code single]840[/code]`[code single] = [/code]`[code single]97 89 4C[/code]``

- In the hex editor. Go to the calculated position in the file (from beginning of the file) and step back 1 byte/column and get the address:

- ``[code single]97894B[/code]`` This is the END position.

- Search in the file for ``[code single]1F8B08[/code]`[code single], found at: [/code]`[code single]77BC[/code]`[code single] & [/code]`[code single]9D1800[/code]``

- We want the first occurrence from the beginning of file

- ``[code single]77BC[/code]`` is our START position.

This information comes in handy later.

___

[h3]Video 2:02[/h3]

[h4]Extract the kernel from the image[/h4]

- Open the boot.img in 7zip and extract it.

- You will get an error about extra data beyond the payload you can safely ignore it as long as it extracts the file.

- If 7zip refuses to extract the file, extract it using the Uniextract utility.

- Uniextract will create a bunch of files, one of them named 'kernel.

- Then use 7zip to extract it that 'kernel' file. You will probably get an error about payload data which can be safely ignored.

- Name the extracted kernel file "k"

- This is important as we are stripping the file name from the gzipped file during the following edit and the filename affects the lenghts of the bytes!

- Load the "k" file into the hex editor.

[h4]Replacing skip_initramfs with want_initramfs in the kernel[/h4]

- Search for ``[code single]736B69705F696E697472616D6673[/code]`[code single] and replace with [/code]`[code single]77616E745F696E697472616D6673[/code]`` in the "k" file in hex.

- This searches for ``[code single]skip_initramfs[/code]`[code single] and replaces it with [/code]`[code single]want_initramfs[/code]``.

[h4]Recompress the kernel[/h4]

- Using cygwin or Linux for Windows subsystem or a linux box, recompress the kernel

- ``[code single]gzip -9 k[/code]`` this should create a k.gz file. (Yes, the -9 is important.)

[h4]Zeroing out the filename from the compressed kernel[/h4]

- Load the newly created file ``[code single]k.gz[/code]`` into the hexeditor.

- The very top row has some data that identifies the filename in the gz file. We must remove this information, and if you named the kernel anything but exactly 'k' before you gzipped it, these bytes will be different. Go back and do it again.

- On the first row fill with zeros, positions ``[code single]03[/code]`[code single] through [/code]`[code single]07[/code]`` on first row.

- On the same first row, select ``[code single]0A[/code]`[code single] and [/code]`[code single]0B[/code]`` & delete those bytes.

- This finishes removing filename headers from the gzipped kernel. ``[code single]k.gz[/code]``

- Save the k.gz file.

[h4]Get length of k.gz (Compressed, modified kernel image)[/h4]

- Select all and copy the length. k.gz LENGTH ``[code single]971182[/code]``

- Note down the length of the file we will use it a bit later.

[h3]Video 3:45[/h3]

___

[h3]Video 3:46[/h3]

[h4]Creation of the zim file (zImage)[/h4]

This is where the video becomes a bit unclear and it appears there are extra unnecessary steps. I have tried to simplify it.

- Go back to the boot.img loaded in the hex editor.

- From the first segment, get your end position, ``[code single]97894B[/code]``

- Go to that offset position and right below it there should be a couple rows of data, then a few (1 or 2) to many (10-20!) rows of only zeros.

- What you want to do is select blocks from ``[code single]840[/code]`` to the last full row of all zeros.

- In my file it is positions ``[code single]840[/code]`[code single] TO [/code]`[code single]978FFF[/code]``.

- In the demo video it is ``[code single]840[/code]`[code single] to [/code]`[code single]91D7FF[/code]``.

- Each boot.img will be different.

- Copy those blocks and create a new file ``[code single]zim[/code]`` and paste them there.

[h3]Video 4:41[/h3]

___

[h3]Video 4:42[/h3]

[h3]Editing the zim file.[/h3]

- In the ``[code single]zim[/code]`` file you pasted the previously copied blocks into...

- Search for ``[code single]1F8B08[/code]``

- In my file and the demo video, it is FOUND at: ``[code single]6F7C[/code]`` = KERN_START_POSITION

- From the previously found length of the ``[code single]k.gz[/code]`[code single] data: [/code]`[code single]971182[/code]`[code single]

- Using the KERN_START_POSITION ([/code]`[code single]6F7C[/code]`[code single]) as offset go to k.gz LENGTH ([/code]`[code single]971182[/code]``) amount of blocks forward.

- This offset can be named POINTER_ONE, take note of it.

- In the demo video the jumped to position is: ``[code single]91CEDD[/code]`` = POINTER_ONE

- In my file the jumped to position is: ``[code single]9780FE [/code]`` = POINTER_ONE

- From POINTER_ONE offset, zero it and any remaining bytes in that row.

- From POINTER_ONE offset, go back one byte.

- This will be the final position when we paste k.gz data into this file. Note it down

- Demo file: Back one byte position = 91CDDC

- My file: Back one byte position = 9780FD

[h3]Video 5:25[/h3]

[h5]Updating POINTER_ONE record.[/h5]

- From POINTER_ONE row, go down 2 rows and look at the first 3 bytes.

- Insert the reversed POINTER_ONE offset into those first three bytes.

- EX: POINTER_ONE offset ``[code single]91CEDD[/code]`[code single], reverse it to [/code]`[code single]DDCD91[/code]``

- On my edit, it already matched so nothing to do here.

[h3]Video 5:39[/h3]

[h5]Getting the second pointer[/h5]

- The second pointer is 4 steps back from POINTER_ONE offset.

- Call this the POINTER_TWO offset. Write it down.

- ex: POINTER_ONE offset =``[code single]91CEDD[/code]`[code single], Go back 4 bytes & POINTER_TWO offset = [/code]`[code single]91CED9[/code]``

- Note down POINTER_TWO offset as well as reverse it

- POINTER_TWO offset = ``[code single]91CED9[/code]`[code single] then REVERSED = [/code]`[code single]D9 CE 91[/code]``

[h3]Video 5:49[/h3]

[h5]Updating POINTER_TWO record.[/h5]

- Go to offset 300.

- Edit offsets ``[code single]30C[/code]`[code single], [/code]`[code single]30D[/code]`[code single], [/code]`[code single]30F[/code]`[code single] to match REVERSED POINTER_TWO offset. ex. [/code]`[code single]D9 CE 91[/code]``

- On my edit, it already matched so nothing to do here.

[h3]Video 6:17[/h3]

[h5]Inserting k.gz into zim file[/h5]

- In zim file.

- Select blocks from KERN_START_POSITION (``[code single]6F7C[/code]`[code single]) to POINTER_ONE offset, back 1 byte ex; [/code]`[code single]91CDDC[/code]``

- Delete the selection.

- Go to k.gz file, ctrl+a and copy.

- Back to zim file and paste the copied data from the position that you deleted ex. ``[code single]6F7C[/code]``.

- Ensure that it inserts (not overwrites) and the row containing the POINTER_ONE record points to the exact end of the pasted data.

- Save zim file if everything is ok.

[h3]Video 7:05[/h3]

[h5]Inserting zim into boot.img file[/h5]

- In the zim file, select all and copy.

- Go to boot.img file.

- If the instructions were followed exactly, you will still have a selection of data used to copy and paste the inital zim file.

- ex. Offsets ``[code single]840[/code]`[code single] to [/code]`[code single]91D7FF[/code]``

- Paste the copied zim data into this selection, using OVERWRITE not insert.

- The idea is the file from the edited zim data must fit exactly into the boot.img selection.

- Save the boot.img somewhere, suggest to use a new file.

# And that's it, its done.

- Flash this file via TWRP to the boot partition.

- If it doesn't work, watch the video again and read carefully the "Editing the zim file." and down instructions.

-effgee

Big thanks to Chela_vek (and anyone else involved) who figured out what was need to get Magisk running on these Amlogic boxes.