If you interested in extracting the kernel image from the Samsung Galaxy S5 ROM, you should follow the following steps.
This is was tested with the G900VVRU1ANCG_G900VVZW1ANCG_VZW stock ROM firmware.
The first is extracting the files from the ROM firmware file, this is explained in many places and won't be covered here.
Extract the boot.img to some directory, using the Android unpackbootimg utility:
Code:
unpackbootimg -i boot.img -o boot/
After extracting the boot.img file you will usually end up with the following file list:
Code:
boot.img-base
boot.img-cmdline
boot.img-pagesize
boot.img-ramdisk.gz <- this includes the root (/) files, like init*.rc and SELinux policy files
boot.img-zImage <- compressed image of the Android Linux kernel
Next step will be extracting the compressed kernel image from the zImage file. The Android kernel is a self-extracting compressed file, while different devices use different compression methods. While looking at the file contents using hex editor, you can see the decompression code at the beginning, and then at some point the compressed data begins. The compressed image begins where you find the LZO magic header.
Code:
static const unsigned char lzop_magic[9] = {
0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
};
Save the data from the LZO magic header to the end of the file with the zImage.kernel file name.
This firmware and kernel are using LZO compression, and there is an easy to use utility called lzop that is used for the decompression of the file. Just run the following command to decompress the kernel from the zImage.kernel file:
Code:
lzop -d -c zImage.kernel > zImage.kernel.decompressed
And now you have the decompressed kernel for the device ready for exploration, which is also attached to this post.
Note:
I've tried using different scripts that do the job, including galaxys2_kernel_repack and http://forum.xda-developers.com/showthread.php?t=901152 but both failed while extracting the kernel image, although were able to extract the begin position for the LZO compression header.
But it does trip KNOX after flashing, doesn't it?
roman.blachman said:
If you interested in extracting the kernel image from the Samsung Galaxy S5 ROM, you should follow the following steps.
This is was tested with the G900VVRU1ANCG_G900VVZW1ANCG_VZW stock ROM firmware.
The first is extracting the files from the ROM firmware file, this is explained in many places and won't be covered here.
Extract the boot.img to some directory, using the Android unpackbootimg utility:
Code:
unpackbootimg -i boot.img -o boot/
After extracting the boot.img file you will usually end up with the following file list:
Code:
boot.img-base
boot.img-cmdline
boot.img-pagesize
boot.img-ramdisk.gz <- this includes the root (/) files, like init*.rc and SELinux policy files
boot.img-zImage <- compressed image of the Android Linux kernel
Next step will be extracting the compressed kernel image from the zImage file. The Android kernel is a self-extracting compressed file, while different devices use different compression methods. While looking at the file contents using hex editor, you can see the decompression code at the beginning, and then at some point the compressed data begins. The compressed image begins where you find the LZO magic header.
Code:
static const unsigned char lzop_magic[9] = {
0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
};
Save the data from the LZO magic header to the end of the file with the zImage.kernel file name.
This firmware and kernel are using LZO compression, and there is an easy to use utility called lzop that is used for the decompression of the file. Just run the following command to decompress the kernel from the zImage.kernel file:
Code:
lzop -d -c zImage.kernel > zImage.kernel.decompressed
And now you have the decompressed kernel for the device ready for exploration, which is also attached to this post.
Note:
I've tried using different scripts that do the job, including galaxys2_kernel_repack and http://forum.xda-developers.com/showthread.php?t=901152 but both failed while extracting the kernel image, although were able to extract the begin position for the LZO compression header.
Click to expand...
Click to collapse
I tried that and was given a warning of trailing bytes by `lzop`. Later when i do a `file` command on the resulting uncompressed file, it is not a vmlinux ELF image, rather it is a data file. How are we able to repack this image back into zImage? Any advise is appreciated thanks.
What i do if i have boot.img-kernel and boot.img-kernel_offset?
DGKG said:
What i do if i have boot.img-kernel and boot.img-kernel_offset?
Click to expand...
Click to collapse
The boot.img-kernel is your zimage file
What Source you used for Unpack?
Can you share link for you Scripts? or can you provide link to scripts for unpacking and repacking Note 9 Exynos Kernel?
Thanks
Related
Hi All,
I am working on MotoX kernel(3.4.42) , after compilation of kernel source code i am able to generate zImage. I have written zImage to original boot.img using following command
$ abootimg -u boot.img -k zImage
with this boot.img(with custom zImage) I flashed using following command
$fastboot flash boot boot.img
After booting my MotoX phone , my touch screen is not responding. I observed touch screen I2c driver is not initilized because device tree image(dt.img) is not loading by zImage during booting .
Can any one please help how to create dt.img with compiled dtb files and flash in to device???????
Thanks
Ram
516
Any one any help???????
ram1443 said:
Any one any help???????
Click to expand...
Click to collapse
im really surprised you expected most people to know the answer to your question. anyways you can rip t he prebuilt dtb from you stock boot.img using these tools right here : https://github.com/xiaolu/mkbootimg_tools and then use them to repack your zimage. abootimg isnt useful in its current form it seems.
if you wish to compile the dts files into dtb ones youll need to run a script on them, here is teh guide that taught me how to http://www.wiki.xilinx.com/Build+Device+Tree+Blob
shabbypenguin said:
im really surprised you expected most people to know the answer to your question. anyways you can rip t he prebuilt dtb from you stock boot.img using these tools right here : https://github.com/xiaolu/mkbootimg_tools and then use them to repack your zimage. abootimg isnt useful in its current form it seems.
if you wish to compile the dts files into dtb ones youll need to run a script on them, here is teh guide that taught me how to http://www.wiki.xilinx.com/Build+Device+Tree+Blob
Click to expand...
Click to collapse
Hi shabbypenguin,
Thanks for your help,
Now i am able to boot with my custom zImage and default dt.img afeter following above links. but i am unable to generate custom dt.img from my compiled dtb files.
To generate dt.img i am doing below steps:
COMMAND:
-------------
$ ./dtbTool -s 2048 -o ./dt.img -p ../../source/kernel_kitkat/out/target/product/generic/obj/kernel/scripts/dtc/ ../../source/kernel_kitkat/out/target/product/generic/obj/kernel/arch/arm/boot/
OUTPUT :
-----------
Input directory: '../../source/kernel_kitkat/out/target/product/generic/obj/kernel/arch/arm/boot/'
Output file: 'dt.img'
Found file: msm8960ab-ultra-maxx-p1.dtb ... skip, failed to scan for 'qcom,msm-id = <' tag
Found file: msm8960ab-ultram-p3.dtb ... skip, failed to scan for 'qcom,msm-id = <' tag
=> Found 0 unique DTB(s)
Can you please guide me how to generate dt.img from compiled dtb files??
Thanks
Ram
Greetings
I followed these procedures, and pushed the boot.img with Odin, but the phone goes into download mode stating: "Could not do normal boot." Can anyone see what I am doing wrong? How can I troubleshoot the issue? Is there some way I can look at some logs somewhere? I did save my recovery.log file from twrp to the sdcard before I loaded the backedup files and rebooted the phone. I put them here is there anything else I can do?
I tried the same thing with boot.img and I got the following:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ ./mkboot boot.img ksumag
Unpack & decompress boot.img to ksumag
kernel : zImage
ramdisk : ramdisk
page size : 2048
kernel size : 8262680
ramdisk size : 1064985
dtb size : 1300480
base : 0x00000000
kernel offset : 0x00008000
ramdisk offset : 0x02000000
second_offset : 0x00f00000
tags offset : 0x01e00000
dtb img : dt.img
cmd line : console=null androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3
ramdisk is gzip format.
Unpack completed.
[email protected]:~/xiaolu/mkbootimg_tools$ cd ksumag/
[email protected]:~/xiaolu/mkbootimg_tools/ksumag$ ls
dt.img img_info ramdisk ramdisk.gz zImage
[email protected]:~/xiaolu/mkbootimg_tools/ksumag$
I put the scsi_wait.ko ( name? ) file in ramdisk /dev folder, and replaced the zImage and dt.img file with the ones I made, and packed them into my own boot.img file.
Here is the output:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ ./mkboot ksumag/ boot.img
mkbootimg from ksumag//img_info.
kernel : zImage
ramdisk : new_ramdisk.gz
page size : 2048
kernel size : 8262680
ramdisk size : 1082259
dtb size : 1300480
base : 0x00000000
kernel offset : 0x00008000
ramdisk offset : 0x02000000
tags offset : 0x01e00000
dtb img : dt.img
cmd line : console=null androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3
Kernel size: 8262680, new ramdisk size: 1082259, boot.img: 10893312.
boot.img has been created.
...
Then I put all files in a tar file. I did make a couple of mistakes with files names, which I hope did not damage the boot.img file.
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img >> boot.img
tar: boot.img: file is the archive; not dumped
[email protected]:~/xiaolu/mkbootimg_tools$ ls
ARM dtbToolCM ksumag mkbootimg recovery.img
boot.img dtbtool.txt lz4 MyKernel.tar.md5 recovery.tar.md5
commands dtc mkboot oldfiles shahin
dtbTool ksuamg mkbootfs README.md sm-n900p-test1
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img > boot.img
tar: boot.img: file is the archive; not dumped
[email protected]:~/xiaolu/mkbootimg_tools$ tar -H ustar -c boot.img > boot.tar
[email protected]:~/xiaolu/mkbootimg_tools$
Then I took the hash of the entire thing:
Code:
[email protected]:~/xiaolu/mkbootimg_tools$ md5sum -t boot.tar >> boot.tar
[email protected]:~/xiaolu/mkbootimg_tools$ mv boot.tar boot.tar.md5
[email protected]:~/xiaolu/mkbootimg_tools$
What are you trying to get
kenny1991 said:
What are you trying to get
Click to expand...
Click to collapse
I am trying to get a flashable image. The file I get from the above procedure goes on my phone, but the kernel does not seem to be loaded. I am still learning about the boot process, and I do not know if my phone just has a bootloader or a bootstrap also; regardless it seems to not load the kernel since it goes into download mode. The recovery.log does not show anything either. I posted in pastebin. I can put link to it here if you think it would help. My goal is to flash my phone with a copy of the kernel which I built myself.
Oh you need a developer to respond for that.
kenny1991 said:
Oh you need a developer to respond for that.
Click to expand...
Click to collapse
Do you know if I can move this thread myself or perhaps request it from one of the admins? I do not know how effective it would be if I put a link to this discussion in the developer forum.
You may ask as you can't move it. You should move it to developers discussion forum
Hello mates!
I've been playing with XT1097's boot.img and need some help as my boot.img fails to boot if I repack ramdisk.
Using abootimg
Extracting boot.img contents:
Code:
abootimg -x boot.img ==> produces bootimg.cfg, initrd.img and zImage files in the current directory
Updating boot.img contents without touching ramdisk (using the one extracted in the previous step):
Code:
abootimg -u boot.img -r initrd.img
If I extract initrd.img and try to repack it, then system fails at boot:
Extracting ramdisk (initrd.img) contents:
Code:
abootimg-unpack-initrd ==> produces a ramdisk subdir
Repacking without modyfing ramdisk folder contents:
Code:
abootimg-pack-initrd newramdisk.img
Updating boot.img with newramdisk.img
Code:
abootimg -u boot.img -r newramdisk.img
Even though the generated boot.img's size matches the original one - 10444800 bytes - system gets stuck at boot logo.
The same issue happens if I use these tools combined:
mkbootimg, unmkbootimg, gzip and cpio
Any ideas are welcome
I tried the following:
Download toolchain from https://android.googlesource.com/pl....9/+/e54105c9f893a376232e0fc539c0e7c01c829b1e
Download clang-4639204
sudo apt-get install -y build-essential kernel-package libncurses5-dev bzip2
sudo apt-get install flex bison
sudo apt-get install libelf-dev
export CROSS_COMPILE=/home/gilius/Desktop/tool/bin/aarch64-linux-android-
export ARCH=arm64
enter the 9820 directory
sudo -i
make xynos9820-beyond2lte_defconfig
make -j10
Am getting the following errors:
Code:
arch/arm64/Makefile:27: ld does not support --fix-cortex-a53-843419; kernel may be susceptible to erratum
arch/arm64/Makefile:57: Detected assembler with broken .inst; disassembly will be unreliable
../PLATFORM/prebuilts/clang/host/linux-x86/clang-4639204/bin/clang.real: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory
../PLATFORM/prebuilts/clang/host/linux-x86/clang-4639204/bin/clang.real: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory
../PLATFORM/prebuilts/clang/host/linux-x86/clang-4639204/bin/clang.real: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory
../PLATFORM/prebuilts/clang/host/linux-x86/clang-4639204/bin/clang.real: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory
CHK include/config/kernel.release
../PLATFORM/prebuilts/clang/host/linux-x86/clang-4639204/bin/clang.real: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory
Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler
make: *** [Makefile:1244: prepare-compiler-check] Error 1
make: *** Waiting for unfinished jobs....
Hi,
for me : sudo ln -s /usr/lib/libtinfo.so /usr/lib/libtinfo.so.5 did the trick but I am now stuck with some assembly instructions "not existing" errors when compiling arch/arm64/kernel/vdso/gettimeofday.S
did you made any progress?
Update : linking libtinfo.so.6 to libtinfo.so.5 solved it but also failed with :
scripts/selinux/genheaders/genheaders.c:19:
./security/selinux/include/classmap.h:251:2: erreur: #error New address family defined, please update secclass_map.
251 | #error New address family defined, please update secclass_map.
| ^~~~~
make[3]: *** [scripts/Makefile.host:102: scripts/selinux/genheaders/genheaders] Error 1
make[2]: *** [scripts/Makefile.build:673: scripts/selinux/genheaders] Error 2
make[1]: *** [scripts/Makefile.build:673: scripts/selinux] Error 2
make: *** [Makefile:607: scripts] Error 2
I am currently trying it on archlinux and the ncurses5-compat-libs package didn't put a new library in my path I will try later on another distro see if it's just a library error.
Update 2 :
Compiled fine using rhel 8, I had to install ncurses compat libs and create a symbolic link from python2 to python in my $PATH.
Does it boot?
Does your kernel boot?
Mine, keep stuck at Samsung logo
Akugila said:
Does your kernel boot?
Mine, keep stuck at Samsung logo
Click to expand...
Click to collapse
Non, I can't even go further the unlocked warning screen, but my repacking of the image is wrong, my new image is always lighter than the original, I am using magiskboot to do it. How are you doing it ?
try AIK
shmsh9 said:
Non, I can't even go further the unlocked warning screen, but my repacking of the image is wrong, my new image is always lighter than the original, I am using magiskboot to do it. How are you doing it ?
Click to expand...
Click to collapse
Ahh, fool me. it's stuck at warning screen too (forgot there are another samsung logo during boot)
I use AIK [https://forum.xda-developers.com/showthread.php?t=2073775] for packing, the size is the same with original (I use "Image" file)
kernel build error: expected parameter declarator
Did you get these compilation errors?
In file included from kernel/bounds.c:10:
In file included from ./include/linux/page-flags.h:10:
In file included from ./include/linux/bug.h:5:
In file included from ./arch/arm64/include/asm/bug.h:37:
In file included from ./include/asm-generic/bug.h:16:
In file included from ./include/linux/kernel.h:14:
./include/linux/printk.h:149:24: error: expected parameter declarator
static inline __printf(1, 2) __cold
^
./include/linux/printk.h:149:24: error: expected ')'
./include/linux/printk.h:149:23: note: to match this '('
static inline __printf(1, 2) __cold
^
./include/linux/printk.h:149:23: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
static inline __printf(1, 2) __cold
^
void
./include/linux/printk.h:149:29: error: expected ';' after top level declarator
static inline __printf(1, 2) __cold
^
Linaro 4.9.4 aarch64-linux-gnu compiler tools for S10 5G kernel build
floor51 said:
Did you get these compilation errors?
In file included from kernel/bounds.c:10:
In file included from ./include/linux/page-flags.h:10:
In file included from ./include/linux/bug.h:5:
In file included from ./arch/arm64/include/asm/bug.h:37:
In file included from ./include/asm-generic/bug.h:16:
In file included from ./include/linux/kernel.h:14:
./include/linux/printk.h:149:24: error: expected parameter declarator
static inline __printf(1, 2) __cold
^
./include/linux/printk.h:149:24: error: expected ')'
./include/linux/printk.h:149:23: note: to match this '('
static inline __printf(1, 2) __cold
^
./include/linux/printk.h:149:23: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
static inline __printf(1, 2) __cold
^
void
./include/linux/printk.h:149:29: error: expected ';' after top level declarator
static inline __printf(1, 2) __cold
^
Click to expand...
Click to collapse
I found that using the Linaro 4.9.4 aarch64-linux-gnu compiler tools solved this:
https://releases.linaro.org/compone...4.9.4-2017.01-x86_64_aarch64-linux-gnu.tar.xz
I was previously using the toolchain that is in ianmacd's github repo here:
https://github.com/ianmacd/beyond2l...p/gcc-cfp-jopp-only/aarch64-linux-android-4.9
I changed this:
#CROSS_COMPILE ?= $(srctree)/toolchain/gcc-cfp/gcc-cfp-jopp-only/aarch64-linux-android-4.9/bin/aarch64-linux-android-
...to:
CROSS_COMPILE ?= ~/dev/projects/android/kernel/gcc-linaro-4.9.4-2017.01-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
I also used Linaro for CLANG_TRIPLE.
And I used clang for CC:
CC = ~/dev/projects/android/kernel/clang-4639204/bin/clang
...from here:
https://android.googlesource.com/pl...archive/android-9.0.0_r1/clang-4639204.tar.gz
All that info would have helped me a lot anyway. Hope it helps someone. Not that I've tried the image on device yet.
Hey,
I have managed to build the kernel by following the instructions in the samsung readme.
Code:
$ export ANDROID_MAJOR_VERSION=p
$ make ARCH=arm64 exynos9820-d2s_defconfig
$ make ARCH=arm64
I end up with an Image file and Image.gz with the same Image file inside. I'm not sure if this has built correctly as people talk about being able to use Android kitchen or similar unpacker to unpack and repack the img file. With the Image file I receive it is incompatible with Android Kitchen and another Perl unpacker I have tried.
When you compile your kernel do you get an Image.img file? Or the same as me, just Image, and if so, how do you make it usable?
JPNZ4 said:
Hey,
I have managed to build the kernel by following the instructions in the samsung readme.
Code:
$ export ANDROID_MAJOR_VERSION=p
$ make ARCH=arm64 exynos9820-d2s_defconfig
$ make ARCH=arm64
I end up with an Image file and Image.gz with the same Image file inside. I'm not sure if this has built correctly as people talk about being able to use Android kitchen or similar unpacker to unpack and repack the img file. With the Image file I receive it is incompatible with Android Kitchen and another Perl unpacker I have tried.
When you compile your kernel do you get an Image.img file? Or the same as me, just Image, and if so, how do you make it usable?
Click to expand...
Click to collapse
glad to hear that you could build the kernel.
could you please elaborate which build env you used and which version?
make clean destroys my build env and i needed some patches to make it even compile in the first place.
could you run the kernel successfully on the device?
I have a ROM that I can flash on Samsung S10 5G(Qualcomm) successfully. My goal is to check whether I can modify `system.img` file of the ROM or not but before modification, I just want to verify that the AP file can be flashed after unpacking and packing of the `system.img`. To check this I have tried following:
Unpack-Pack AP file:
A) `tar` flashing:
1. Extracted AP file using `tar -xf AP...tar.md5` command.
2. Compress the extracted files using `tar -cvf AP...tar *`
3. Flash it with Odin3 v3.13.
B) `tar.md5` flashing:
- Get tar by following steps in A) and then run `md5sum -t AP...tar >> AP...tar` and `mv AP...tar AP...tar.md5`
Both `Ap...tar` and `AP...tar.md5` flashed successfully.
Unpack-Pack `system.img.ext4.lz4`
1. Extracted AP file using `tar -xf AP...tar.md5` command. Extracted files are "*boot.img.lz4*, *meta-data*, *userdata.img.ext4.lz4*, *carrier.img.ext4.lz4*, *persist.img.ext4.lz4*, *vbmeta.img.lz4*, *dqmdbg.img.ext4.lz4*, *recovery.img.lz4*, *vendor.img.ext4.lz4*, *dtbo.img.lz4*, *system.img.ext4.lz4*".
2. Extract system file using `unlz4 system.img.ext4.lz4` command. This is giving me a `system.img.ext4` Android sparse image.
3. Tried following commands to compress `system.img.ext4` without doing any modification:
lz4 system.img.ext4 system.img.ext4.lz4 - Default Compression
lz4 -9 system.img.ext4 system.img.ext4.lz4 - High Compression
lz4 -l system.img.ext4 system.img.ext4.lz4 - Default Compression in Legacy format
lz4 -l -9 system.img.ext4 system.img.ext4.lz4 - High Compression in Legacy format
lz4 -0 -l system.img.ext4 system.img.ext4.lz4 - No Compression in Legacy format
lz4 -B4 system.img.ext4 system.img.ext4.lz4 - Default Compression with Block size 4
lz4 -B5 system.img.ext4 system.img.ext4.lz4 - Default Compression with Block size 5
lz4 -B6 system.img.ext4 system.img.ext4.lz4 - Default Compression with Block size 6
lz4 --no-frame-crc system.img.ext4 system.img.ext4.lz4 - Default Compression with no crc frame
Click to expand...
Click to collapse
and make an AP file by replacing the original `system.img.ext4.lz4` file with the compressed file from above command(one at one time) and tried to flash it but every time it fails with **"Odin FAIL! LZ4 is invalid"**
LZ4 command detail:
1. Working on Ubuntu 18
2. Using "LZ4 command line interface 64-bits r128, by Yann Collet (Apr 3 2018)"
Tried with "LZ4 command line interface 64-bits v1.9.2, by Yann Collet" but get the same result.
`file system.img.ext4.lz4` output:
- Original file: `system.img.ext4.lz4: LZ4 compressed data (v1.4+)`.
- My version with both LZ4 (r128 and v1.9.2):
1. For file compressed with legacy flag(-l): `system.img.ext4.lz4: LZ4 compressed data (v0.1-v0.9)`
2. For file compressed without legacy flag(-l): `system.img.ext4.lz4: LZ4 compressed data (v1.4+)`
So, I think it means the file should be compressed without legacy flag.
Size
1. With `-9` flag i.e. High Compression the output file is of 3.3 GB.
2. Without `-9` flag i.e. Default Compression the output file is of 3.6 GB.
The Original file is of size 3.6 GB so, I think high compression should not be used.
But still the same error throws by Odin.
Any suggestion why it is happening?
having the same problem here.anyone have a solution?
Why Ya dont use "lz4 -m *.lz4" command after Extract with tar, its Decompress all Files in one Process!!
But iam have the same Problem i would a Existing Package tar.md5 Extract and Replace the system.img.lz4 with a newer Version, so i have Compress the IMG to LZ4 with these Command
"lz4 -B6 --content-size system.img system.img.lz4" and then Pack all to tar and add md5sum!! and Flash the Package it would like ya Failed at System Flash Process!!!