No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
libmincrypt
mincrypt
.gitignore
Android.mk
Makefile
NOTICE
README
bootimg.h
dtbtool.c
dtbtool.txt
mkbootimg.c
unpackbootimg.c

README

Marvell PXA1088 Board boot image tools for Samsung Galaxy Core Mini 4G, Samsung Galaxy Tab 4 7.0, Samsung Galaxy Xcover 3

More information on the PXA1088 bootimg header differences here:
https://forum.xda-developers.com/showthread.php?p=53464533

Unpack boot.img:
$ mkdir boot
$ ./pxa1088-unpackbootimg -i boot.img -o boot

Unpack ramdisk:
$ mkdir -p boot/ramdisk
$ cd boot/ramdisk/
$ gunzip -c ../boot.img-ramdisk.gz | cpio -i
$ cd ../

Unpack uImage (for Xcover 3):
$ dumpimage -l boot.img-zImage > uImage.txt
$ dumpimage -i boot.img-zImage -p 0 Image.gz
$ gunzip Image.gz

Repack ramdisk:
Ramdisk can be packed only with minigzip not normal gzip.
Of course only if you need exactly the same output image as input.
$ mkbootfs ramdisk | minigzip > boot.img-ramdisk-new.gz

Repack uImage (for Xcover 3):
zImage is packed with gzip maximum compression without header.
zImage.new - your altered unpacked kernel.
$ gzip -n -9 -k zImage.new
WARNING!!! Repacked image will always have a different hashsum because
uImage has a timestamp in its header so mkimage will take the machine time,
but the resulting uImage will still be valid.
uImage header information can be found in uImage.txt.
$ mkimage -A arm64 -O linux -T kernel -C gzip -a 01000000 -e 01000000 -d zImage.new.gz -n "pxa1928dkb linux" "boot.img-zImage.new"

Repack boot.img:
unpackbootimg now has an --unknown value flag so you can alter it if needed.
$ ./pxa1088-mkbootimg --kernel boot.img-zImage.new \
--ramdisk boot.img-ramdisk-new.gz --dt boot.img-dtb \
--signature boot.img-signature --unknown 0x03000000 -o ../boot-new.img
$ cd ../

The signature doesn't seem to be enforced, so you can try without the --signature
option. By comparing boot image to recovery image, I found a different
signature and of course a different ramdisk but the rest is the same, including
kernel and device tree table.

On Xcover 3 the signature also has the 16 byte "SEANDROIDENFORCE" string prepended to it.
You can use only this to get rid of the annoying red phrase "android is not seandroid enforcing".
Of course the resulting image will never be identical without it but is still valid.
So without the signature you can use the following:
$ ./pxa1088-mkbootimg --kernel boot.img-zImage.new \
--ramdisk boot.img-ramdisk-new.gz --dt boot.img-dtb \
--unknown 0x03000000 -o ../boot-new.img
$ echo "SEANDROIDENFORCE" >> boot-new.img

Unknown seems to be different in different devices so I added a flag for writing it.
As I understand 0x03000000 is used for Xcover 3 and 0x02000000 for Tab 4 and Core Mini 4G.
This is possibly a version number denoting the signature/kernel differences.

To confirm these tools' reliability, you can unpack and then repack original
boot/recovery image without modification. You will get two identical images,
which can be checked using a diff tool.

Generate kernel spesific device tree table:
$ ./pxa1088-dtbTool -o boot.img-dt-new -p kernel/scripts/dtc/ kernel/arch/arm/boot/dts/

Repack a new recovery as a flashable Odin:
$ tar -H ustar -c recovery-testkey.img > recovery-testkey.img.tar
$ md5sum -t recovery-testkey.img.tar >> recovery-testkey.img.tar
$ mv recovery-testkey.img.tar recovery-testkey.img.tar.md5

DISCLAIMER:

USE THESE TOOLS AT YOUR OWN RISK, I DON'T OWN A TAB 4 7.0, CORE MINI 4G OR XCOVER 3 FOR TESTING

kumajaya, June 2014
AKuHAK, October 2016
osm0sis, May 2017