Develop Bugs

[Discussion] Extracting/modifying script.bin - Allwinner A20/A23/A30/A31 tablets

Hello folks,
Been hacking firmwares for Allwinner SOC-based tablets for a while. The key to "porting" firmwares bertween similar tablets used to be the script.bin / script0.bin files found in the bootloader (nanda) FAT partition.
However since Kitkat things have changed and these files are no more. The data still is somewhere though, and probably in the same format.
When a stock flashable image is available, imgRePacker or DragonFace allows for extracting the binary (config.fex) file and corresponding source (sys_config.fex). However I'm wondering how to get this from a tablet for which no such Livesuit/Phonenixsuit image is available.
After many hours of hacking, I've eventually found a way to extract it from a live, booted (and rooted) tablet because the data is mapped into the SOC's virtual address space (details will come in a later post if there's interest).
I have yet to find a way to dump it from the tablet's NAND flash memory. AFAIK this data is *not* in a section of the NAND flash memory that's accessible through the /dev/block/nandX partition devices.
I've made some progress by using the Phoenixcard tool and make it generate a bootable SD card with a full Android firmware aboard (as opposed to the minimal system used for an upgrade). The binary "script.bin" data can be found in a section of the SD card formatted in what looks like a proprietary, very rudimentary filesystem (well, more like subpartitions with a name really). Reverse-engineeering this doesn't look very difficult, it's basically a table of contents with a name and a logical block number. However I have found no way yet to reach this area of the tablet's internal NAND flash memory.
Not sure that studying the publicly released A23 SDK v1.0 code will lead to a solution because AFAIK it seems to be for Jellybean (4.2) firmwares, which still used the old script.bin in bootloader partition scheme.
I've spent much time Googling for this and haven't found any public information on this, so I'm opening this thread with the hope that it will catch the right people's eyes.

just picked up a generic a83 tablet and i'm anticipating this sort of thing. my hardware info is at your disposal. i'll be digging in myself in the next few days to dump the nand and see what i can and can't to with the stock rom.
cpuinfo is reporting sun8i, i thought the a83 was sun9i, so i need to clarify that. stock rom is KK 4.4.4 no su. let me know if you want to collaborate.

Maybe not perfect but the fastest way is use /sys/class/script/dump, you only need to know the section names
Code:
[email protected]:/sys/class/script # echo lcd0_para > dump
echo lcd0_para > dump
[email protected]:/sys/class/script # cat dump
cat dump
++++++++++++++++++++++++++__sysfs_dump_mainkey++++++++++++++++++++++++++
name: lcd0_para
sub_key: name type value
lcd_bl_en gpio (gpio: 25, mul: 1, pull 0, drv -1, data 1)
lcd_power gpio (gpio: 204, mul: 1, pull 0, drv -1, data 1)
lcd_pwm gpio (gpio: 161, mul: 2, pull 0, drv 2, data 1)
lcd_gpio_0 gpio (gpio: 158, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_1 gpio (gpio: 159, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_2 gpio (gpio: 23, mul: 1, pull 0, drv 2, data 0)
lcd_gpio_3 gpio (gpio: 157, mul: 1, pull 0, drv 2, data 1)
lcd_gpio_4 gpio (gpio: 26, mul: 1, pull 0, drv 2, data 1)
lcdd2 gpio (gpio: 72, mul: 2, pull 0, drv 2, data -1)
lcdd3 gpio (gpio: 73, mul: 2, pull 0, drv 2, data -1)
lcdd4 gpio (gpio: 74, mul: 2, pull 0, drv 2, data -1)
lcdd5 gpio (gpio: 75, mul: 2, pull 0, drv 2, data -1)
lcdd6 gpio (gpio: 76, mul: 2, pull 0, drv 2, data -1)
lcdd7 gpio (gpio: 77, mul: 2, pull 0, drv 2, data -1)
lcdd10 gpio (gpio: 80, mul: 2, pull 0, drv 2, data -1)
lcdd11 gpio (gpio: 81, mul: 2, pull 0, drv 2, data -1)
lcdd12 gpio (gpio: 82, mul: 2, pull 0, drv 2, data -1)
lcdd13 gpio (gpio: 83, mul: 2, pull 0, drv 2, data -1)
lcdd14 gpio (gpio: 84, mul: 2, pull 0, drv 2, data -1)
lcdd15 gpio (gpio: 85, mul: 2, pull 0, drv 2, data -1)
lcdd18 gpio (gpio: 88, mul: 2, pull 0, drv 2, data -1)
lcdd19 gpio (gpio: 89, mul: 2, pull 0, drv 2, data -1)
lcdd20 gpio (gpio: 90, mul: 2, pull 0, drv 2, data -1)
lcdd21 gpio (gpio: 91, mul: 2, pull 0, drv 2, data -1)
lcdd22 gpio (gpio: 92, mul: 2, pull 0, drv 2, data -1)
lcdd23 gpio (gpio: 93, mul: 2, pull 0, drv 2, data -1)
lcdclk gpio (gpio: 94, mul: 2, pull 0, drv 3, data -1)
lcdde gpio (gpio: 95, mul: 2, pull 0, drv 2, data -1)
lcdhsync gpio (gpio: 96, mul: 2, pull 0, drv 2, data -1)
lcdvsync gpio (gpio: 97, mul: 2, pull 0, drv 2, data -1)
deu_mode int 0
lcdgamma4iep int 22
smart_color int 90
lcd_used int 1
lcd_if int 6
lcd_driver_namestring "b079xan01"
lcd_x int 768
lcd_y int 1024
lcd_width int 0
lcd_height int 0
lcd_dclk_freq int 66
lcd_pwm_freq int 50000
lcd_pwm_pol int 1
lcd_bl_0_percentint 2
lcd_bl 5_percentint 5
lcd_bl_10_percentint 15
lcd_bl_25_percentint 20
lcd_bl_50_percentint 37
lcd_bl_75_percentint 58
lcd_bl_100_percentint 73
lcd_hbp int 120
lcd_ht int 948
lcd_hspw int 64
lcd_vbp int 80
lcd_vt int 1140
lcd_vspw int 50
lcd_hv_if int 0
--------------------------__sysfs_dump_mainkey--------------------------

@lolet: thanks for the tip. I was already aware of this. It's a handy way to grab the textual contents of a particular section but there are drawbacks: you can't request too long of a section or the complete data, on my A23 tablet it causes a kernel panic. Probably an unhandled buffer overflow.
I've found another way to get the full, binary (compiled) data by running the following script on the tablet:
Code:
#!/system/bin/sh
SYS_CONFIG_MEMBASE="0x43000000"
SYS_CONFIG_MEMSIZE="0x10000"
CHUNK="0x200"
OUTFILE=/mnt/sdcard/sysconfig_dump.txt
rm $OUTFILE
let address=$SYS_CONFIG_MEMBASE
let "end=(SYS_CONFIG_MEMBASE+SYS_CONFIG_MEMSIZE)"
while [ $address -lt $end ]; do
let "last=(address+CHUNK-1)"
busybox printf "%04x,%04x\n" $address $last
busybox printf "%04x,%04x\n" $address $last > /sys/class/sunxi_dump/dump
cat /sys/class/sunxi_dump/dump >> $OUTFILE
let "address=(address+CHUNK)"
done
This produces a file going like:
Code:
0x43000000: 0x00000045 0x00000000 0x00000001 0x00000002
The next Perl script will put back the data in the correct byte order and convert it to raw binary data:
Code:
#!/usr/bin/perl
while(<>) {
chomp;
@words = split;
shift @words;
foreach $w (@words) {
$w =~ s/^0x//;
$w = reverse(pack('H*', $w));
print $w;
}
}
(reads hex dump on stdin, produces binary data on stdout)
The resultant binary file has passed the "fexc -I bin -O fex binfile fexfile" test successfully and checking a sample of sections against the data returned by the method you have mentioned has shown the data as consistent.
However, neither of this provides an answer to my main question: where is the bloody data in the NAND flash of the tablet when it's no longer in the script.bin/script0.bin files from the bootloader partition?

lanning: is uboot even using script.bin? I've just started poking around, and the uboot output over serial during startup includes this peculiar line:
Code:
mount part name bootloader
cant open script.bin, maybe it is not exist
looks like maybe my tablet is asking your question too...?

@jawbonegroove: well, I haven't got as far as hooking a serial interface to my Allwinner tablets yet, because I need to buy a converter first. It's in my todo list.
So I haven't seen this message.
I presume that uboot does use sysconfig data, but it might be able to get it from the legacy location (script.bin file in bootloader FAT partition) and the new one (somewhere well hidden on the NAND flash). Not finding it in the legacy location might cause this message to be sent out, don't know.
What I know for sure is that the kernel does find and use sysconfig data, wherever it is, because it's mapped to the kernel VM and kernel modules use this data to configure themselves.
And by the way, it's "Lannig", no "n" before the "g", thanks

lanniG: (sorry) I also haven't done much with serial yet, mainly just logged a normal boot. It does also show this nand layout...
Code:
--------fastboot partitions--------
-total partitions:10-
-name- -start- -size-
bootloader : 1000000 1000000
env : 2000000 1000000
boot : 3000000 1000000
system : 4000000 30000000
misc : 34000000 1000000
recovery : 35000000 2000000
cache : 37000000 30000000
metadata : 67000000 1000000
private : 68000000 1000000
UDISK : 69000000 0
-----------------------------------

@jawbonegroove (now I'm trying not to misspell it ): you said you got this chinglish message "cant open script.bin, maybe it is not exist". From what log did you get it? It comes from u-boot, I'm fairly sure of this. The dmesg command doesn't show messages coming from that early in the boot process, only kernel messages.
The partitioning: nothing out of the usual here. These can be addressed through the /dev/block/nandX (X=a,b,...) and /dev/block/by-name/* device files.
AFAIK from my searches, the binary configuration data formely contained in script.bin is nowhere to be found in any of these partitions. So my guess is that it's outside of the NAND flash memory addressable through these devices files. Possibly in between the MBR and the nanda partition.

yeah, that was uboot over the serial console. i just used serial again to root it last night so i've got nand images to play with now. in regards to the op:
Code:
[email protected]:/ # mount -t vfat /dev/block/nanda /data/nanda
[email protected]topus-ibt:/ # cd /data/nanda/
[email protected]:/data/nanda # find .
.
./font24.sft
./bat
./bat/low_pwr.bmp
./bat/bat0.bmp
./bat/bat1.bmp
./bat/bat3.bmp
./bat/bat9.bmp
./bat/bat8.bmp
./bat/bat2.bmp
./bat/bootlogo.bmp
./bat/bat4.bmp
./bat/bempty.bmp
./bat/bat5.bmp
./bat/bat7.bmp
./bat/bat6.bmp
./bat/battery.bmp
./bat/battery_charge.bmp
./bat/low_pwr_bak.bmp
./bat/bat10.bmp
./bootlogo.bmp
./font32.sft
./magic.bin
./data.notfirstrun
i don't have a script.bin, but i've got a magic.bin. (and, it does try and boot from an sdcard partitioned for uboot. i'll probably try to put together a bootable sd image sooner than later.)
what do your nanda and kernel cmdline look like?
[edit] also, have you used meminfo?

I've had a few A23 tablets in my hands, most KK-based and one JB (4.2).
Some don't have any script0.bin/script.bin file in the bootloader partition, but a magic.bin file just as you mention. However if you open this file you'll see that it has most likely nothing to do with h/w configuration. It's just a few hex strings looking like filesystem UUIDs.
Some of them do have a script0.bin file only (no script.bin) which I'm almost sure is completely ignored (I've tried modifying it with no visible effect). Checking its contents against the config data extracted from the live tablet as explained above (kernel memory dump through the /sys interface) shows that it does not even match 100%. I suspect it's a leftover.
Besides this, bootloader partition's contents looks exactly like what you've listed.
Command line: nothing unusual:
Code:
console=ttyS0,115200 rw init=/init loglevel=4
Have you actually managed to make a fully bootable SD yet for an A23 tablet? I'm not sure I get what you wrote. If you did, please tell us more. That's something I've done in the A10 times but it was using a special version of u-boot I don't know where to find for the A23.

hm, good to know. i haven't found many resources for sunxi hardware...linux-sunxi has some good info but its scattered and they seem kind of militant about joining their cause before they'll help you...
ill keep digging.

didn't see that last sentence before. no, this a83 is my first allwinner...i say it tried to boot because when i put in an sd card with uboot mbr and friends (semi-random device fs image), it powered on but with no visible response -- it didn't just continue with a nand boot until i pulled the card and hard reset it. maybe all that tells me is that i don't need to muck about with button sequences or whatnot to boot from sd.

Oh well, no need to try this actually.
Allwinner devices do have the SD card before the internal NAND in the boot sequence. So they will try booting from the SD if they find an uboot structure there. This is true since the A10 days (and still is).

ERROR: HRESULT = 0x8024a110

Can't send update to my Lumia build 10.10.10586.29 i have always
Code:
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\Thierry\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
[1] Started device 6ea0f2436b51fa6d88d745b2c8dde3d3
[1] Transferring files started
[1] Transferring files complete: 2 files
[1] Update started
[1] Installation failed (HRESULT = 0x8024a110)
[1] Failed (0x8024a110)
ERROR: 0x8024a110
Command failed. (HRESULT = 0x8024a110)

Im trying to deploy old nokia.service_ndtksvc.generic.spkg.cab
0x80188306
E_FILE_COLLISION
More than one package targeted for the same partition contained the same file.

titi66200 said:
Can't send update to my Lumia build 10.10.10586.29 i have always
Code:
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\Thierry\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
[1] Started device 6ea0f2436b51fa6d88d745b2c8dde3d3
[1] Transferring files started
[1] Transferring files complete: 2 files
[1] Update started
[1] Installation failed (HRESULT = 0x8024a110)
[1] Failed (0x8024a110)
ERROR: 0x8024a110
Command failed. (HRESULT = 0x8024a110)
Click to expand...
Click to collapse
Astoria's dead. Get over it.

Encryption fails with LOS13

After flashing an M9 with LOS 13, the device does not encrypt and fails to start. I get the following error in logs:
------------------------------------------------------------------------------------------------------------------------------------
E/QSEECOMAPI:: Error::ioctl call to wipe the encryption key for usage 1 failed with ret = -1, errno = 14
[ I/ ]
Keymaster version is not 1.0
[ D/ ]
HW based disk encryption is enabled
[ E/ ]
get_tmp_passwd: Passed argument is NULL
E/QSEECOMAPI:: Error::ioctl call to create encryption key for usage 1 failed with ret = -1, errno = 22
E/Cryptfs: Error enabling encryption after framework is shutdown, no data changed, restarting system
------------------------------------------------------------------------------------------------------------------------------------
If anyone could help with a workaround or had the same issue, it would be very helpful.

PackageManager denied permission leading to FC of app

I'm running stock 6.0 on a UsU'd LG G4 vs986 that is rooted with Magisk. In trying to install the onX Hunt app and it claims to have been installed but when opening, it immediatly force closes. I ran adb bugreport while installing the app and the bug report shows
Code:
01-01 20:47:55.592 13367 13367 W System : ClassLoader referenced unknown path: /system/priv-app/GooglePackageInstaller/lib/arm64
01-01 20:47:55.594 13367 13367 D FingerprintProtector: This is not product version.
01-01 20:47:55.623 13367 13367 W : Unable to open '/data/app/onxmaps.hunt-1/split_config.armeabi_v7a.apk': Permission denied
01-01 20:47:55.623 13367 13367 W zipro : Error opening archive /data/app/onxmaps.hunt-1/split_config.armeabi_v7a.apk: I/O Error
01-01 20:47:55.623 13367 13367 D asset : failed to open Zip archive '/data/app/onxmaps.hunt-1/split_config.armeabi_v7a.apk'
01-01 20:47:55.623 13367 13367 W PackageManager: Failure retrieving resources for onxmaps.hunt
01-01 20:47:55.671 13086 13097 I DefContainer-JNI: error opening: /data/media/0/Android/data/onxmaps.hunt/cache: Permission denied
Looking at a backup from the same device from before having done a wipe of data, cache, system, dalvik and internal storage and doing a fastboot flash of 6.0 stock, I find that there are files missing from /data/app/onmaps.hunt-1/ which is the cause of the app force closing. I tried copying the files over from the backup but it still fails to make the app work. I also tried changing ownership of those files but not sure if they should be system.install or system.system or something else.
I've also tried installing the apk using adb install onxhunt.apk and get the same results.
I found the problem. It turns out that the onxhut apk was incomplete as it was just the base.apk which was only 13 MB and when I installed gplaycli to download the app, I found it was 84 MB. I had initially used Ad Apk Extractor to get the onXhunt apk from another phone that had installed it directly from the Play store.
Does anyone know of an app that would properly back up apks for apps such as onXhunt?

Broken boot process/file system?

After rebooting my A5 2017 a few days ago, it seems to have some problems. It does "boot" fine, asks for my (encryption) password, and goes to the "starting phone..." screen.
After this the screen goes blank. Pressing the power button once doesn't do anything. Holding the power button shows a screen with the options: lockdown (doesn't work), power off and restart.
It does not show my launcher nor anything else, just those lockdown, poweroff and restart button.
Code:
-------- beginning of system
E vold : Failed to chmod /data/system_ce/0: No such file or directory
E vold : Failed to chmod /data/misc_ce/0: No such file or directory
E vold : Failed to chmod /data/media/0: No such file or directory
E StorageManagerService: No valid MediaStore provider found
<>
TaskPersister: restoreTasksForUserLocked: Unable to list files from /data/system_ce/0/recent_tasks
BackupPasswordManager: Unable to read backup pw version
BackupPasswordManager: Unable to read saved backup pw hash
--------- beginning of kernel
After which this stands out to me (removed a whole lot of "yunk"):
Code:
<>
W vold : Trim failed on /data: Inappropriate ioctl for device
W vold : Failed to open none: No such file or directory
<>
--------- beginning of crash
F libc : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 4119 (main), pid 4119 (main)
F libc : crash_dump helper failed to exec
E [3: kworker/3:2: 2713] cnss_wlan_unregister_oob_irq_handler: no OOB task is running
E [3: kworker/3:2: 2713] wlan_platform_sdio_enumerate: notify_func=ffffffc000818658, mmc_host_dev=ffffffc0b94ca818, device_present=0
E : [3: kworker/3:2: 2713] card removed
E [0: kworker/u16:3: 1448] mmc1: card remove detected
E [0:iptables-restor: 3899] audit: rate limit exceeded
--------- beginning of main
<>
E CarrierIdProvider: read carrier list from ota pb failure: java.io.FileNotFoundException: /data/misc/carrierid/carrier_list.pb: open failed: ENOENT (No such file or directory)
<>
E rkstack.proces: failed to connect to jdwp control socket: Connection refused
E com.android.se: failed to connect to jdwp control socket: Connection refused
E m.android.phon: failed to connect to jdwp control socket: Connection refused
E ndroid.setting: failed to connect to jdwp control socket: Connection refused
< above multiple times >
E StorageSessionController: Failed to exit session: emulated;0. Killing MediaProvider...
E StorageSessionController: com.android.server.storage.StorageSessionController$ExternalStorageServiceException: Failed to end session: [SessionId: emulated;0. UpperPath: /storage/emulated. LowerPath: /data/media
<>
E StorageManagerService: Failed to mount volume VolumeInfo{emulated;0}:
E StorageManagerService: type=EMULATED diskId=null partGuid= mountFlags=PRIMARY|VISIBLE
E StorageManagerService: mountUserId=0 state=CHECKING
E StorageManagerService: fsType=null fsUuid=null fsLabel=null
E StorageManagerService: path=/storage/emulated internalPath=/data/media
E StorageManagerService:
E StorageManagerService: com.android.server.storage.StorageSessionController$ExternalStorageServiceException: Failed to start session: [SessionId: emulated;0. UpperPath: /storage/emulated. LowerPath: /data/media]
<>
E StorageUserConnection: Service: [ComponentInfo{com.android.providers.media.module/com.android.providers.media.fuse.ExternalStorageServiceImpl}] is null. User [0]
<>
E StorageManagerService: Failed to notify volume state changed to the Storage Service
E StorageManagerService: com.android.server.storage.StorageSessionController$ExternalStorageServiceException: Failed to notify volume state changed for vol : StorageVolume: Internal shared storage
< All StorageManagerService/StorageUserConnection error's above multiple times>
F zygote64: jni_internal.cc:729] JNI FatalError called: (com.android.providers.media.module) frameworks/base/core/jni/com_android_internal_os_Zygote.cpp:786: Failed to mount /data_mirror/data_de/null/0/com.google.android.gms to /data/user_de/0/com.google.android.gms: No such file or directory
F zygote64: runtime.cc:655] Runtime aborting...
F zygote64: runtime.cc:655] Dumping all threads without mutator lock held
<>
E libc : failed to raise ambient capability 0: Operation not permitted
E libc : failed to raise ambient capability 1: Operation not permitted
< Above repeated but then number increases >
E DEBUG : failed to readlink /proc/6117/fd/0: Permission denied
E DEBUG : failed to readlink /proc/6117/fd/1: Permission denied
< Above repeated but then number increases >
F crash_dump64: crash_dump.cpp:474] failed to attach to thread 6117, already traced by 0 ()
E libprocessgroup: Error encountered killing process cgroup uid 10187 pid 6108: Permission denied
< A lot repeated errors of the Permission/denied and operation not permitted above + the StorageManagerService/StorageUserConnection errors >
Based on those errors, I think my /data partition is broken. However, when booting into TWRP recovery, the partition looks fine and I can browse all the files?
ROM: official lineageOS
Please let me know if you know how to fix this, or how to troubleshoot further. It's luckily not my main phone, but I'd like it to be usable again.