Related
Hello everyone,
This is a AP.bin extractor
rewritten in plain C based on xonar_'s work and support both linux and win32
navossoc@xda introduced the "LGExtract.exe". the encrypyted/compressed kdz can be extracted/decrypted to AP.bin/CP.fls by LGExtract.exe
xonar_ made BIN/FLS extractor
http://forum.xda-developers.com/showthread.php?t=1879915
and release source(win32)
•http://forum.xda-developers.com/showpost.php?p=31432471&postcount=11 (original Java version by xonar_)
•http://forum.xda-developers.com/showpost.php?p=33426102&postcount=37 (win32 C port by navossoc)
•http://forum.xda-developers.com/showpost.php?p=34022349&postcount=141
Basically, the AP.bin file is plain raw file, the bootable images can be extracted by searching specific pattern "ANDROID!".
based on this work, I can figure out the AP.bin header information without searching specific pattern to extract boot.img/ext4 partitions/bootloader etc.
Usage
Download attached file. It include both win32 and linux binary and it's source(GPL).
• show AP.bin information
Code:
extract P990_AP.bin
• extract specific section
Code:
extract P990_AP.bin 3
• or extract all images
Code:
extract P990_AP.bin -1
TODO
• show filenames or partitions
References
mman-win32 is used to port win32 binary
• mman-win32 (GPLv2) by kutuzov - http://code.google.com/p/mman-win32/
• http://forum.xda-developers.com/showpost.php?p=34078601&postcount=148
ChangeLog
•*oops! no source change. just replace with working extract.exe (reported by spyrosk and Kostja_V)
Credits
• navossoc - the Author of LGExtract.exe and win32 C port of extractor.
• xonar_ - BIN/FLS extractor and it's java source.
This is a cool tool, wkpark, but I don't understand the difference to the already available tool here:
(it already does extract AP.bin files of the latest ICS leaks, dumping all the available partitions.
But I guess your tool does dump more things like header and bootloader? Could you please write the differences of those two tools?
Also it would be cool to get a tool which is capable of re-merging changed partitions (system.img, boot.img, recovery.img, cracked bootloader) again to a AP.bin --- would that possible? We could create Smartflah-Custom-ROMs then!)
Stefan Gündhör said:
This is a cool tool, wkpark, but I don't understand the difference to the already available tool here:
(it already does extract AP.bin files of the latest ICS leaks, dumping all the available partitions.
But I guess your tool does dump more things like header and bootloader? Could you please write the differences of those two tools?
Also it would be cool to get a tool which is capable of re-merging changed partitions (system.img, boot.img, recovery.img, cracked bootloader) again to a AP.bin --- would that possible? We could create Smartflah-Custom-ROMs then!)
Click to expand...
Click to collapse
as I already mentioned, just rewritten in plain C to make it more portable to support both linux and win32
and make it more unix friendly
and this tool print the exact address and size of images to make it possible to use "dd" to fix AP.bin without any specific tools
e.g.)
Code:
$ extract SU660_AP.bin
filesize: 939524096
[01] address=0x00100000 size=0x00300000
[02] address=0x00400000 size=0x00080000
[03] address=0x00480000 size=0x00180000
[04] address=0x00600000 size=0x20000000
[05] address=0x20600000 size=0x00800000
[06] address=0x20e00000 size=0x01400000
[07] address=0x22200000 size=0x15e00000
$ extract SU660_AP.bin 6 # 6 is recovery.img
...
$ dd if=cwm.img of=SU660_AP.bin bs=1024 seek=$(printf "%d" $((0x20e00000 / 1024))) conv=notrunc
now we got CWM injected AP.bin!
But currently you cant use this method for ICS firmwares
wkpark said:
as I already mentioned, just rewritten in plain C to make it more portable to support both linux and win32
and it is more unix friendly
Click to expand...
Click to collapse
Aaaah okay cool
What about the re-merging thing, do you think you could maybe look into that?
Edit: Ah I see you updated your post, thanks!
Simply awesome. Thanks wkpark!
Very good utility, bravo!
I have been able to decipher everything except partitions 1 and 2, in total there are 7 partitions
1. 01.img
2. 02.img
3. bootloader.img
4. boot.img
5. recovery.img
6. data.img
7. ext3_system.img
I have created a shell for Linux
Use
Copy the file P990_AP.bin into the AP_Toolkit folder /
Run menuen.sh or menues.sh
Look very useful! Tnx dude!
Homero2 said:
Very good utility, bravo!
I have been able to decipher everything except partitions 1 and 2, in total there are 7 partitions
1. 01.img
2. 02.img
3. bootloader.img
4. boot.img
5. recovery.img
6. data.img
7. ext3_system.img
I have created a shell for Linux
Use
Copy the file P990_AP.bin into the AP_Toolkit folder /
Run menuen.sh
Click to expand...
Click to collapse
I guess the order of images are not always the same,
the V30C of SU660 is somewhat different, so this script is not compatible with SU660
some images like as bootable images can be detected by the following method
the bootable images easily checked by dd
Code:
[ $(dd if=boot.img bs=1 count=8 2>/dev/null) = 'ANDROID!' ] && echo "this a is bootable image"
OK, actually the structure varies between models, I have checked that there are differences between P990 and SU660.
And within the same model varies structure?, I've tried several versions of P990 and it seems that the structure is maintained.
Homero2 said:
Very good utility, bravo!
I have been able to decipher everything except partitions 1 and 2, in total there are 7 partitions
1. 01.img
2. 02.img
3. bootloader.img
4. boot.img
5. recovery.img
6. data.img
7. ext3_system.img
I have created a shell for Linux
Use
Copy the file P990_AP.bin into the AP_Toolkit folder /
Run menuen.sh or menues.sh
Click to expand...
Click to collapse
If I remember well partition 1 is the bct file. I suppose that partition 2 has something to do with partition layout .
Sent from my LG-P990 using xda app-developers app
This is a new version, it is more complex than the previous version, also includes the BAT version for Window.
Forgive if there is any error in the Windows version, long time that I do not write anything serious for Windows.
In the menu you can choose the model (P990 or SU660)
Researching a bit I have seen that the 01.img portion is the star.bct, but...
The original file weighs in at 4.0kb, which is obtained with AP_Tool weighs 3.0 MB
With a hex editor I saw that the heading is:
Code:
32 DB 10 C0 A8 A2 5 C 3F 1B 17 34 84 15 57 C6
Looking for I found 7 headers, I extracted them and got 7 files which then I expose in the order found within the 01.img file
star_0.bct - 4.0Kb - this is good (exactly of 000 to FFF)
star_1.bct - 508.0Kb
star_2.bct to star_6.bct - 512.0Kb
Guys,
the extract exe in first post does not work properly. I think it doesn't extract the partitions at the right headers.
I extracted the V28g bin file and the system and data partitions when mounted are unreadable.
Using the extract2 (attached) the partitions are readable perfectly.
The sizes also, differ between the two set of partitions.
I felt I had to let you know.
spyrosk said:
Guys,
the extract exe in first post does not work properly. I think it doesn't extract the partitions at the right headers.
I extracted the V28g bin file and the system and data partitions when mounted are unreadable.
Using the extract2 (attached) the partitions are readable perfectly.
The sizes also, differ between the two set of partitions.
I felt I had to let you know.
Click to expand...
Click to collapse
Did you use the LG extract.exe or other tool to get the ap.bin?
It works perfectly with the lgextract.exe that's why I wrote this post
And why don't you attach your source code?
Isn't it modified extract.c?
Or just binary hacked executable
found at the navossoc's post?
The license of this source code is GPL but you didn't include modified source code in it.
Sent from my LG-P990 using xda app-developers app
wkpark said:
Did you use the LG extract.exe or other tool to get the ap.bin?
It works perfectly with the lgextract.exe that's why I wrote this post
And why don't you attach your source code?
Isn't it modified extract.c?
Or just binary hacked executable
found at the navossoc's post?
The license of this source code is GPL but you didn't include modified source code in it.
Sent from my LG-P990 using xda app-developers app
Click to expand...
Click to collapse
I did use LGExtract.exe to get the bin.
I just downloaded the binary in the first post of this thread. I didn't touch the source code.
The tool from OP doesn't work for me too. The extracted system.img size is 515mb, but should be 512, so it is not flashable via nvflash.
On the screenshot you can see, that files extracted using extract-v0.1 from the OP and extract2 from the http://forum.xda-developers.com/showpost.php?p=34100186&postcount=2 have different sizes.
spyrosk said:
Guys,
the extract exe in first post does not work properly. I think it doesn't extract the partitions at the right headers.
I extracted the V28g bin file and the system and data partitions when mounted are unreadable.
Using the extract2 (attached) the partitions are readable perfectly.
The sizes also, differ between the two set of partitions.
I felt I had to let you know.
Click to expand...
Click to collapse
Kostja_V said:
The tool from OP doesn't work for me too. The extracted system.img size is 515mb, but should be 512, so it is not flashable via nvflash.
On the screenshot you can see, that files extracted using extract-v0.1 from the OP and extract2 from the http://forum.xda-developers.com/showpost.php?p=34100186&postcount=2 have different sizes.
Click to expand...
Click to collapse
thankyou for your testing!!
confirmed !
my bad.. I uploaded not correctly patched win32 executable by mistake.
I just replace the old one with a working win32 binary.
Homero2 said:
Researching a bit I have seen that the 01.img portion is the star.bct, but...
The original file weighs in at 4.0kb, which is obtained with AP_Tool weighs 3.0 MB
With a hex editor I saw that the heading is:
Code:
32 DB 10 C0 A8 A2 5 C 3F 1B 17 34 84 15 57 C6
Looking for I found 7 headers, I extracted them and got 7 files which then I expose in the order found within the 01.img file
star_0.bct - 4.0Kb - this is good (exactly of 000 to FFF)
star_1.bct - 508.0Kb
star_2.bct to star_6.bct - 512.0Kb
Click to expand...
Click to collapse
the image 01(BCT) and 02(PT. Partition Table) are updated by the Smartflash or NVFlash automagically.
you can't even simply download(flash) the BCT/PT image at all
like as MBR and PT, the BCT also duplicated itself
@wkpark hi,
I bumped into the following issue, when I first had an idea making an option in AIO-Toolkit to switch between locked and yours unlocked new bootloader.
I extracted stock bootloader image with your bin extractor.
I also checked its md5 with a backed-up (by nvflash) one's (which was smartflashed) and are the same.
So far so good and your bin extractor works perfectly.
When I try to flash it, nvflash always stops here | 1507328/1572864 bytes sent
Do you have any idea why this happens?
Since the unlocked one is much smaller than the total size of the partition, I suppose stock one has about the same actual size.
Could you please make an image of the stock one for me (with its data only)? get the original from here
cause I don't know how to do it myself and actually I am on a leave and I don't have any linux pc available.
I'd like to give a try because now I am curious, why the cracked one can be flashed and the stock not.
Thank you in advance for your help
Cheers
spyrosk said:
@wkpark hi,
I bumped into the following issue, when I first had an idea making an option in AIO-Toolkit to switch between locked and yours unlocked new bootloader.
I extracted stock bootloader image with your bin extractor.
I also checked its md5 with a backed-up (by nvflash) one's (which was smartflashed) and are the same.
So far so good and your bin extractor works perfectly.
When I try to flash it, nvflash always stops here | 1507328/1572864 bytes sent
Do you have any idea why this happens?
Since the unlocked one is much smaller than the total size of the partition, I suppose stock one has about the same actual size.
Could you please make an image of the stock one for me (with its data only)? get the original from here
cause I don't know how to do it myself and actually I am on a leave and I don't have any linux pc available.
I'd like to give a try because now I am curious, why the cracked one can be flashed and the stock not.
Thank you in advance for your help
Cheers
Click to expand...
Click to collapse
Hi! I was facing the same problem like you. Open the bootloader.bin in a hex editor (WinHEX or any other hexeditor) and delet all the FF hex values from the end of the file. I hope it will work for you
Edit: I deleted the FF a valuses frrom the the backed up bootloader
Hello,
I tried to install CWM and bricked the phone
Model: LG L90 D410
It appeared the error:
ERROR Boot Certification Verify, and Logo LG.
So I tried using the download mode to use KDZ,
when I enter the Download Mode, the error persists (see printscreen) and the screen turns off.
LGFlashTool and windows device manager does not recognize the phone, all drives have been updated.
plz help.
Additional information:
Hard reset works, but after doing the reset, the problem is the same. Boot error and Download Mode with Secure Boot Error (attached image) .
PC is still not recognizing the phone and nothing i can do.
Sorry my English
Read: http://forum.xda-developers.com/lg-l90/help/secure-boot-error-boot-certification-t2895538
F. Gacrux said:
Read: http://forum.xda-developers.com/lg-l90/help/secure-boot-error-boot-certification-t2895538
Click to expand...
Click to collapse
For me does not work because I can't flash KDZ, I do not have access to the Download Mode for this (see image).
And I can't do this http://forum.xda-developers.com/lg-l90/general/guide-fastboot-l90-d415-t2827825 because I don't have access to the phone (does not appear connected to PC).
Maybe this: http://forum.xda-developers.com/lg-l90/help/bricked-d410-t3094018/post61741908
Or this: http://forum.xda-developers.com/showthread.php?t=2582142
Make sure to use the right sbl1, aboot, rpm, tz and recoveryimages of your model. If you don't find those files, maybe someone can backup the partitions for you, I own a different model D410HN
F. Gacrux said:
Maybe this: http://forum.xda-developers.com/lg-l90/help/bricked-d410-t3094018/post61741908
Or this: http://forum.xda-developers.com/showthread.php?t=2582142
Make sure to use the right sbl1, aboot, rpm, tz and recoveryimages of your model. If you don't find those files, maybe someone can backup the partitions for you, I own a different model D410HN
Click to expand...
Click to collapse
Thanks for your attention! My phone is the same.
But as said, the computer (Linux or Windows) did not recognize the phone, COM, Modem, Unknown device, nothing...
Hard Disk Low Level Format Tool only appears my HD, so i am stuck in step 3.
niquelfer said:
Thanks for your attention! My phone is the same.
But as said, the computer (Linux or Windows) did not recognize the phone, COM, Modem, Unknown device, nothing...
Hard Disk Low Level Format Tool only appears my HD, so i am stuck in step 3.
Click to expand...
Click to collapse
In this case the right binaries can be retrieved from the dz inside the kdz with LG Firmware Extract.
Regard your device not being recognized, can you please run USBDeview (run as admin, download: http://www.nirsoft.net/utils/usb_devices_view.html), plug the USB cable in your device, refresh and see if something popup in the connected devices list? Your need the qhsusb_bulk to show up in device manager. Maybe removing not connected devices in usbdeview to clear drivers and rebooting your PC can work.
This Tutorial worked very well. Thanks all.
http://forum.xda-developers.com/lg-...ick-hard-bricked-l90-variants-t3173429/page15
D410
F. Gacrux said:
Maybe this: http://forum.xda-developers.com/lg-l90/help/bricked-d410-t3094018/post61741908
Or this: http://forum.xda-developers.com/showthread.php?t=2582142
Make sure to use the right sbl1, aboot, rpm, tz and recoveryimages of your model. If you don't find those files, maybe someone can backup the partitions for you, I own a different model D410HN
Click to expand...
Click to collapse
Hey. I need these img files sbl1, aboot, rpm, tz for my LG l90 dual D410. Please help
Jaimil said:
Hey. I need these img files sbl1, aboot, rpm, tz for my LG l90 dual D410. Please help
Click to expand...
Click to collapse
Extract from your KDZ file.
Hello! I was following the guide of wiping everything except internal storage and sdcard like the guide said. However now i only see TWRP folder on the /sdcard when trying to flash zip. How do i transfer files, or is there some fastboot file to flash or a guide which i can use to bring my device back alive? Fastboot and TWRP boots, but i cannot access some partitions. Thank you
Edit: Already tried to flash the boot.img that was on the EliteROM v4 zip, however the Product, Vendor, Version, Cust and Data versions are still messed up. I need help on repartinioning advice.
Also now i managed to flash system.imgi, but the partitions need to be resized probably to be used. How is the repartitioning possible the easiest way?
That's very wrong. You only needed to wipe system, data and cache,
sniperlife:D said:
That's very wrong. You only needed to wipe system, data and cache,
Click to expand...
Click to collapse
Hassanmirzans guide says " Wipe Everything in wipe section (dont wipe sdcard) and Format Data & Change FileSystem to f2fs otherwise phone wont boot,,, and reboot twrp and follow next steps,,," which is what i did.
Do you have any more tips? Currently i cannot even use the update.app method at all.
Edit: I just did try the update.zip method, and it says "Software install failed! The update package does not exist. Please download the package again." My computer recognizes the phone as Huawei honor 9p lite now, and i have checked that the UPDATE.APP is under dload folder. Tried with internal storage as well as external sd already.
Edit2: was corrupt UPDATE.APP, now it says "Software install failed! Incompabile package . Please download the package again." Or something similar, do i need to reflash OEM info or something to make my device Honor 5C again?
I solved this because of przemas2468 at modaco. He had posted the OEMinfo file if you manage to mess up your device, which can be found from here: http://www.mediafire.com/file/fn2pv4uucjh63xo/oeminfo_b100_c432.zip
onnz423 said:
I solved this because of przemas2468 at modaco. He had posted the OEMinfo file if you manage to mess up your device, which can be found from here: http://www.mediafire.com/file/fn2pv4uucjh63xo/oeminfo_b100_c432.zip
Click to expand...
Click to collapse
What was your version and model? We have some oeminfo file that may save you from such situations
shashank1320 said:
What was your version and model? We have some oeminfo file that may save you from such situations
Click to expand...
Click to collapse
Thanks man, however i already got the OEMINFO file, and will upload it into a mirror soon. Apperantly it is not possible on XDA to lock thread.
onnz423 said:
Thanks man, however i already got the OEMINFO file, and will upload it into a mirror soon. Apperantly it is not possible on XDA to lock thread.
Click to expand...
Click to collapse
Share the link i will update to my repository and anyone can use. Its locked and a common thread for all models.
shashank1320 said:
Share the link i will update to my repository and anyone can use. Its locked and a common thread for all models.
Click to expand...
Click to collapse
Here you go: https://mega.nz/#!QTZV2YJA!nZASaoDeTiGAx1bwNOu_pnTcGLiraGCqOXMwPkvffj8
This at least worked for NEM-L21. The UPDATE.APP process would not succeed without this file.
onnz423 said:
Here you go: https://mega.nz/#!QTZV2YJA!nZASaoDeTiGAx1bwNOu_pnTcGLiraGCqOXMwPkvffj8
This at least worked for NEM-L21. The UPDATE.APP process would not succeed without this file.
Click to expand...
Click to collapse
Thanks for sharing this. I will update the repository thread asap
hello everybody
i've rooted my moto E4 plus, using this guide:
https://forum.xda-developers.com/moto-e4-plus/how-to/moto-e4-plus-guide-to-rooting-mediatek-t3668753
and everything worked well.. however - i would like to update my phone software, and i do not know what spell to cast now..
what is the best way to go now?
thanks
Restore stock firmware, that includes stock recovery.
ATTACK said:
Restore stock firmware, that includes stock recovery.
Click to expand...
Click to collapse
hi ATTACK, thanks for reply.
i've tried to restore scattered file (bunch of bin-s) using miracle box, but without success. it seams that miracle is not able to restore these files as phones firmware - or i am doing something wrong.
procedure:
i run miracle box, i choose adequate mtk version, i pick write mode, and select .txt (scatter file). in the same dir there are many .bin files..
what should i do?
thanks
vladimirnikolic said:
hi ATTACK, thanks for reply.
i've tried to restore scattered file (bunch of bin-s) using miracle box, but without success. it seams that miracle is not able to restore these files as phones firmware - or i am doing something wrong.
procedure:
i run miracle box, i choose adequate mtk version, i pick write mode, and select .txt (scatter file). in the same dir there are many .bin files..
what should i do?
thanks
Click to expand...
Click to collapse
i get messages:
Waiting for USB Port...
Set MediaTek PreLoader USB VCOM Port (COM7)
Please Hold "ON" to connect with the phone...
Connected to Phone.
CPU: MT6735 SW:0000 Ver: CB00
Downloading Boot8 ...
EMMC Size: 0x03A3E00000
Flash Type: EMMC
INT/EXT RAM Size: 0x0+0x0
Writing(Nand/eMMC)...
>>Error1: no 5A
.. update - i've tried with sp flash tool as well - but it seems that it cannot recognize the scattered file format. the software crashes when i try to load .txt file
Use fastboot to flash the .IMG files. There should be a guide somewhere. It's either here or in the Moto E4 fourm.
sp tools works fine form me.
I buy z999 unlock ver on eBay.
and ROM_AXON_M_VDF_SDCARD_SOFTWARE_PACKAGE_MR00a.zip on leakite.com update my phone
but z999 does not boot and charge. Unable to start recovery mode.
only Qualcomm HS-USB QDLoader 9008 (COM port num) Is Verified When Connecting to Computer. <-----maybe not completely dead. i think
first
Mi Flash and 350810B1502AXON M with CN1.11 rom
but can not receive hello packet error. why?????
two
QPIL tool.
But i'm not found Z999 firehose programmers file and raw programm xml file
Where can I get ?
Three
SP flash tool.
i'm not found Z999 scatter file. <---- i Need!!!!
I tried the MT6753_Android_scatter file instead. But the button was not activated and I gave up.
I need Z999 firehose programmers file and raw programm xml file or Z999 scatter file.
If there is another way, please let me know.
reply or [email protected]
oneiricboy said:
I buy z999 unlock ver on eBay.
and ROM_AXON_M_VDF_SDCARD_SOFTWARE_PACKAGE_MR00a.zip on leakite.com update my phone
but z999 does not boot and charge. Unable to start recovery mode.
only Qualcomm HS-USB QDLoader 9008 (COM port num) Is Verified When Connecting to Computer. <-----maybe not completely dead. i think
first
Mi Flash and 350810B1502AXON M with CN1.11 rom
but can not receive hello packet error. why?????
two
QPIL tool.
But i'm not found Z999 firehose programmers file and raw programm xml file
Where can I get ?
Three
SP flash tool.
i'm not found Z999 scatter file. <---- i Need!!!!
I tried the MT6753_Android_scatter file instead. But the button was not activated and I gave up.
I need Z999 firehose programmers file and raw programm xml file or Z999 scatter file.
If there is another way, please let me know.
reply or [email protected]
Click to expand...
Click to collapse
Take a look here https://forum.xda-developers.com/axon-m/development/rom-zte-axon-m-stock-firmware-firehose-t3909847