Develop Bugs

Extracted ramdisk from boot.img inside RUU_Supersonic_1.32.651.1_Radio_1.39.00.04.26

I've extracted the ramdisk from the boot.img which was posted by Football in the RUU_Supersonic_1.32.651.1_Radio_1.39.00.04.26 file.
This contains all the bootable files which are executed once the kernel loads...
to extract all the files from the ramdisk
normally, these are the commands:
mkdir ramdisk
cd ramdisk
gzip -dc ../boot.img-ramdisk.gz | cpio -i
BUT for some reason between my uploading and the host, the .gz gets corrupted. i put all the files into a .tar
tar -xvf EVO-stock-ROM-ramdisk.tar
http://www.joeyconway.com/evo/kernel/EVO-stock-ROM-ramdisk.tar
this is the directory listing from the ramdisk (yea im using my moment dev environment...)
[email protected]:~/evo/updates/dst/boot/ramdisk$ ls -l
total 168
-rw-r--r-- 1 moment moment 216 2010-05-22 16:23 bootcomplete.supersonic.rc
drwxrwx--x 2 moment moment 4096 2010-05-22 16:23 data
-rw-r--r-- 1 moment moment 118 2010-05-22 16:23 default.prop
drwxr-xr-x 2 moment moment 4096 2010-05-22 16:23 dev
-rwxr-x--- 1 moment moment 103548 2010-05-22 16:23 init
-rwxr-x--- 1 moment moment 1677 2010-05-22 16:23 init.goldfish.rc
-rwxr-x--- 1 moment moment 14403 2010-05-22 16:23 init.rc
-rwxr-x--- 1 moment moment 4840 2010-05-22 16:23 init.supersonic.rc
drwxr-xr-x 2 moment moment 4096 2010-05-22 16:23 proc
drwxr-x--- 2 moment moment 4096 2010-05-22 16:23 sbin
-rw-r--r-- 1 moment moment 75 2010-05-22 16:23 shutdown.supersonic.rc
drwxr-xr-x 2 moment moment 4096 2010-05-22 16:23 sys
drwxr-xr-x 2 moment moment 4096 2010-05-22 16:23 system
Edit: To flash kernels on the EVO, I created a simple app: FlashImageGUI - http://forum.xda-developers.com/showthread.php?t=1083260

i can't download this, it give me a error saying file is damaged

super-6-1 said:
i can't download this, it give me a error saying file is damaged
Click to expand...
Click to collapse
wow, good catch. im not sure why its being corrupted so i made all the files and directory into a .tar!
thanks for the feedback!

there are a few scripts to do what uve done here. 1) extract-ramdisk.pl and 2) split-bootimg.pl. there are a few others but these are the two i choose to use. anyhow it looks like a normal ramdisk from a snapdragon device.

toastcfh said:
there are a few scripts to do what uve done here. 1) extract-ramdisk.pl and 2) split-bootimg.pl. there are a few others but these are the two i choose to use. anyhow it looks like a normal ramdisk from a snapdragon device.
Click to expand...
Click to collapse
sweet, i used split-bootimg.pl, worked great. im new to all this so im very glad we're on the same page!
what kind of tools do we have to put a modified boot.img back onto the EVO?

Could we update the boot.img by utilizing the ROM Update Utility functionality--by flashing an updated .nbh to the phone?

joeykrim said:
sweet, i used split-bootimg.pl, worked great. im new to all this so im very glad we're on the same page!
what kind of tools do we have to put a modified boot.img back onto the EVO?
Click to expand...
Click to collapse
google "rom cooking lox" and ull find all u need to know about it

toastcfh said:
google "rom cooking lox" and ull find all u need to know about it
Click to expand...
Click to collapse
thanks! i googled it and found this thread
http://htcpedia.com/forum/showthread.php?t=1404
and then a thread of yours linking back to that thread.
from what i've read in that thread and other threads, using the recovery on the phone to apply an update.zip which we create and sign, seems to be the most common method to update the phone with our own ROM.
i have one question. will the stock recovery on the EVO apply the update.zip i build and sign? or do we need a custom recovery before we can apply our update.zip files we've built and signed?
also for anybody with an EVO, feel like testing? im willing to work and create a custom update.zip which I think should give us root, I have a few different methods in mind from my last rooting experience of an Android phone,the samsung moment android 2.1 upgrade, a few weeks ago...but its really hard for me to know never having used or seen the HTC android platform and not having the EVO until the 4th...
i wish i had an EVO to test with...!

joeykrim said:
thanks! i googled it and found this thread
and then a thread of yours linking back to that thread.
from what i've read in that thread and other threads, using the recovery on the phone to apply an update.zip which we create and sign, seems to be the most common method to update the phone with our own ROM.
i have one question. will the stock recovery on the EVO apply the update.zip i build and sign? or do we need a custom recovery before we can apply our update.zip files we've built and signed?
also for anybody with an EVO, feel like testing? im willing to work and create a custom update.zip which I think should give us root, I have a few different methods in mind from my last rooting experience of an Android phone,the samsung moment android 2.1 upgrade, a few weeks ago...but its really hard for me to know never having used or seen the HTC android platform and not having the EVO until the 4th...
i wish i had an EVO to test with...!
Click to expand...
Click to collapse
I believe that the current SPL will only run signed HTC updates, and that the common attack vector is to find a way to overwrite the default SPL with a custom widget in order to disable checks for signed updates and other annoyances. (please correct me if I'm wrong!)
My question I'm trying to figure out now is how does HTC sign the ROMs?

andrew500 said:
I believe that the current SPL will only run signed HTC updates, and that the common attack vector is to find a way to overwrite the default SPL with a custom widget in order to disable checks for signed updates and other annoyances. (please correct me if I'm wrong!)
My question I'm trying to figure out now is how does HTC sign the ROMs?
Click to expand...
Click to collapse
They take their private key and sign it...

This is mindboggling, nonetheless.
Oh the joy.

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

boot.img-ramdisk.gz: not in gzip format

Hello, I'm trying to modified the kernel of my phone, but I have one problem, when I try to decompile boot.img-ramdisk.gz (with ubuntu) it appear a message that put boot.img-ramdisk.gz: not in gzip format and I cant.
Regards

pepe471 said:
Hello, I'm trying to modified the kernel of my phone, but I have one problem, when I try to decompile boot.img-ramdisk.gz (with ubuntu) it appear a message that put boot.img-ramdisk.gz: not in gzip format and I cant.
Regards
Click to expand...
Click to collapse
what do you want to do ? did you compile the kernel and now maybe you want to prepare boot.img ? or what
anyway there is a .perl script to split boot.img in zImage (kernel compiled) and ramdisk also this will extract ramdisk in "out" folder so work with this folder to change things to ramdisk
search for split_bootimg.pl and you get the answer !
I think here you have a complete reference http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images

ruscan.calin said:
what do you want to do ? did you compile the kernel and now maybe you want to prepare boot.img ? or what
anyway there is a .perl script to split boot.img in zImage (kernel compiled) and ramdisk also this will extract ramdisk in "out" folder so work with this folder to change things to ramdisk
search for split_bootimg.pl and you get the answer !
I think here you have a complete reference http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
Click to expand...
Click to collapse
I want to chage the boot logo and the g-sensor configuration.
I extract the boot.img-kernel and the boot.img-ramdisk.gz with split_bootimg.pl, but then I can't extract the files of boot.img-ramdisk.gz
Thank you

ruscan.calin said:
what do you want to do ? did you compile the kernel and now maybe you want to prepare boot.img ? or what
anyway there is a .perl script to split boot.img in zImage (kernel compiled) and ramdisk also this will extract ramdisk in "out" folder so work with this folder to change things to ramdisk
search for split_bootimg.pl and you get the answer !
I think here you have a complete reference http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
Click to expand...
Click to collapse
Arrogant answer without any help. If you would care to read what people write you would have noticed that he wanted to unpack the boot.img-ramdisk.gz.
I'm trying the same with a ramdisk here but get the same error. And yeah, i did read the tutorial you've link + http://forum.xda-developers.com/showthread.php?t=1477845.
And both say nothing about how to handle the errors we got.
After some googling, and trying out two approaches, i finally found the solution.
The third one i came across worked, at least for me:
http://forum.xda-developers.com/showpost.php?p=31954123&postcount=913
The "boot.img-ramdisk.gz" was compressed in lzma format. So the correct command would be:
lzma -dc ../boot.img-ramdisk.gz | cpio -i
Ramdisk unpacked. Enjoy.

Kaskade said:
Arrogant answer without any help. If you would care to read what people write you would have noticed that he wanted to unpack the boot.img-ramdisk.gz.
I'm trying the same with a ramdisk here but get the same error. And yeah, i did read the tutorial you've link + http://forum.xda-developers.com/showthread.php?t=1477845.
And both say nothing about how to handle the errors we got.
After some googling, and trying out two approaches, i finally found the solution.
The third one i came across worked, at least for me:
http://forum.xda-developers.com/showpost.php?p=31954123&postcount=913
The "boot.img-ramdisk.gz" was compressed in lzma format. So the correct command would be:
lzma -dc ../boot.img-ramdisk.gz | cpio -i
Ramdisk unpacked. Enjoy.
Click to expand...
Click to collapse
or if you are in linux.. since you are making kernel.. you will be..
anyway.. if you are getting this error.. just rename the file with .lzma extension..
then use archive manager or Xarchiver application in linux and extract it.. then extract the file obtained again... you will get all the files and folders inside ramdisk.. no need of any kitchen/anything.. as linux can handle lzma natively

Kaskade said:
Arrogant answer without any help. If you would care to read what people write you would have noticed that he wanted to unpack the boot.img-ramdisk.gz.
I'm trying the same with a ramdisk here but get the same error. And yeah, i did read the tutorial you've link + http://forum.xda-developers.com/showthread.php?t=1477845.
And both say nothing about how to handle the errors we got.
After some googling, and trying out two approaches, i finally found the solution.
The third one i came across worked, at least for me:
http://forum.xda-developers.com/showpost.php?p=31954123&postcount=913
The "boot.img-ramdisk.gz" was compressed in lzma format. So the correct command would be:
lzma -dc ../boot.img-ramdisk.gz | cpio -i
Ramdisk unpacked. Enjoy.
Click to expand...
Click to collapse
Hi,
I am on Linux.
I have installed lzma on the home dir.
I don't know why I am getting Decode error.
[email protected]:~/VIJAY/andriod/work3$ ls -lrt
total 239840
[SIZE="2][COLOR="DarkGreen"]drwxr-xr-x 3 vramaraj sw-team 4096 Oct 9 2011 data/
-rw-r--r-- 1 vramaraj sw-team 70 May 16 2012 installbusybox
drwxr-xr-x 4 vramaraj sw-team 4096 Oct 6 19:03 sdcard/
drwxr-xr-x 16 vramaraj sw-team 4096 Nov 28 22:14 system/
-rw-r--r-- 1 vramaraj sw-team 4073472 Dec 2 22:27 boot.img
-rw-r--r-- 1 vramaraj sw-team 302938 Dec 3 21:14 logo.bin
-rw-r--r-- 1 vramaraj sw-team 236601691 Jan 31 22:18 YONIP_MP_A919_v1.zip
-rwxr-xr-x 1 vramaraj sw-team 6773 Jan 31 22:18 split_bootimg.pl*
drwxr-xr-x 3 vramaraj sw-team 4096 Jan 31 22:19 META-INF/
-rw-r--r-- 1 vramaraj sw-team 3477896 Jan 31 22:50 boot.img-kernel
-rw-r--r-- 1 vramaraj sw-team 591679 Jan 31 22:50 boot.img-ramdisk.gz
-rwxrwxrwx 1 vramaraj sw-team 229 Jan 31 22:55 extractboot*
drwxr-xr-x 3 vramaraj sw-team 4096 Jan 31 22:55 out/
drwxr-xr-x 2 vramaraj sw-team 4096 Jan 31 23:32 ramdisk/[/COLOR][/SIZE]
[email protected]:~/VIJAY/andriod/work3$
[email protected]:~/VIJAY/andriod/work3/out/ramdisk$ ~/lzma -dc ../../boot.img-ramdisk.gz | cpio -i
/users/home40/vramaraj/lzma: Decoder error
cpio: premature end of archive
[email protected]:~/VIJAY/andriod/work3/out/ramdisk$

Deadly said:
or if you are in linux.. since you are making kernel.. you will be..
anyway.. if you are getting this error.. just rename the file with .lzma extension..
then use archive manager or Xarchiver application in linux and extract it.. then extract the file obtained again... you will get all the files and folders inside ramdisk.. no need of any kitchen/anything.. as linux can handle lzma natively
Click to expand...
Click to collapse
Interesting!
I have a similar problem where gzip complained that my boot.img-ramdisk.gz is not in gzip format.
At the advice of this thread [and some others] I ran:
lzma -t boot.img-ramdisk.gz
xz -t boot.img-ramdisk.gz
Neither one worked, so at the advice of your post I copied the file to both a ".lzma" and a ".xz" extension.
Again, neither the lzma nor xz command-line tool worked, but again at the advice of your post I opened them in Ubuntu's Archive Manager and both view and extract just fine!
CORRECTION:
I was too optimistic: Archive Manager can view the file but cannot extract it.
I pulled my file from an official OEM update.zip file that I successfully updated from.
Maybe the file is really corrupt? (which is hard to believe since my update was successful)
Maybe split_bootimg.pl corrupted it?
What command-line do I need to extract these files from...well...the command-line?
Thanks!
Pv
---------- Post added at 07:22 PM ---------- Previous post was at 07:08 PM ----------
swooby said:
CORRECTION:
I was too optimistic: Archive Manager can view the file but cannot extract it.
I pulled my file from an official OEM update.zip file that I successfully updated from.
Maybe the file is really corrupt? (which is hard to believe since my update was successful)
Maybe split_bootimg.pl corrupted it?
Click to expand...
Click to collapse
Looks like it was user error...just not mine!
The update.zip file already has a "ramdisk.img" image in it.
That file binarily identical to the boot.img-ramdisk.gz file that is inside the update.zip's boot.img.
Someone messed up!
I think I've got it from here!
Thanks for a place to brainstorm!
Pv

pepe471 said:
Hello, I'm trying to modified the kernel of my phone, but I have one problem, when I try to decompile boot.img-ramdisk.gz (with ubuntu) it appear a message that put boot.img-ramdisk.gz: not in gzip format and I cant.
Regards
Click to expand...
Click to collapse
if you have a windows OS or Wine.. you can use my GZ fixer..
http://www.wcn.it/Fix-GZ-archives.exe
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

help
I use cygwin to unpack boot.img
Im using code gzip -dc ./boot.img-ramdisk.gz | cpio -i and get error
im success using code lzma -dc ./boot.img-ramdisk.gz | cpio -i
and now im not understand code to compile my ramdisk again...
can anyone help me ?

If you have this problem and above solutions don't work for you (like me), maybe it's compressed in another file format; for example my ramdisk was compressed using LZ4.. to know this under Linux you just use command file <your ramdisk> and it will output your ramdisk file info, after knowing the compression format just google how to decompress that format and you're done

where can download Fix-GZ-archives.exe

[Help Thread][ Moto G7 Play ](2019) Ask Any Question, Noob Friendly

[SIZE=+2]This thread has been created
for
Questions & Answers/Troubleshooting[/SIZE]​[SIZE=+2]Specific to[/SIZE]
Moto G7 Play
2019​
Please feel free to share issues, questions and offer help. Noob questions are welcomed.
It is always best to use the Thanks button , in lieu of simply posting "Thank you".
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Please keep discussion focused, on questions pertaining to this Device
List of supporters...
...
...
...​To those seeking help: Please don't bombard the supporters with PMs asking for help. Instead, ask your question here in the thread so others can benefit from the solution to your problem as well. If you want to be sure someone particular gets notified of your question, put his / her username directly after an @.
If you have ROM related questions, post in the relevant ROM Q&A thread (if there is one) or directly in the ROM development thread. Thank you!
Supporters: If you want to be put on or off the list, just make a request here in the thread!
Before posting anything, I strongly advise you to read
Forum Rules
[GUIDE] - XDA New User Guide - Getting started on XDA
XDA Tour
[Index]Motorola Flashing Utilities, Firmware, and more
Index for Device Thread Link
Please look for a similar thread when visiting another device forum.
If you would like to create a [Help Thread] please Click Here.
​

Frequently asked Questions
Models:
XT195-2 Dual-sim
Countries or regions available: Brazil.
XT1952-3 Single-sim
Countries or regions available: USA.
XT1952-4 republic wireless
I'm not planning on adding every Rom or Mod,
but if you have a suggestion for other links
Please post them here.
FAQs
UnLocking the Bootloader
ReLocking the Bootloader
[Fixing] Baseband <not found> / IMEI=0 / No Network After Flash / Issues
Fixing your Moto stuck in Qualcomm QHSUSB_Bulk or qloader mode
successful blankflash on xt1952-4 by goesham2
Using Lenovo's MOTO Smart Assistant to Update/Repair/Backup
Custom Roms/Recovery/Root/
Firmware
Guide][Channel][Stock]Moto g7 play Factory Firmware Images by lexiyuri
https://mirrors.lolinet.com/firmware/moto/
[Index]Motorola Flashing Utilities, Firmware, and more
News, specs...
https://www.xda-developers.com/moto-g7-moto-g7-play-moto-g7-plus-moto-g7-power-forums/
https://help.republicwireless.com/hc/en-us/articles/360021389773-Moto-G7-Play-Tech-Specs
https://www.phonemore.com/models/motorola/moto-g7-play/
.

Trying to root my phone

rodneyb1966 said:
Trying to root my phone
Click to expand...
Click to collapse
I'm sure you will need to unlock the bootloader, and install a custom recovery first.
Sent from my Atom using XDA Labs

How long will it take to get root? it is very bad to use a non-root device.

I guess maybe this model is out somewhere in the world, but the G7 was released today March 1st 2019 from Motorola in the USA. The G7 Play is expected to be released around March 20 2019.

Can the front LED flash be used as a notification light?

I have a problem
I unlocked the bootloader and I can not lock it again.
after unlocking, always when the phone turns on, the screen is all black and "bad key" appears in the upper left corner.
I tried relocking the bootloader, reinstalling the stockrom, but it does not work. the bootloader remains locked. The message "check 'allow oem unlock' in android settings" appears.
Does anyone know how I can relock the bootloader?

Marcondes BR said:
I unlocked the bootloader and I can not lock it again.
after unlocking, always when the phone turns on, the screen is all black and "bad key" appears in the upper left corner.
I tried relocking the bootloader, reinstalling the stockrom, but it does not work. the bootloader remains locked. The message "check 'allow oem unlock' in android settings" appears.
Does anyone know how I can relock the bootloader?
Click to expand...
Click to collapse
The bad key screen is normal for an unlocked Moto phone
Sent from my sailfish using XDA Labs

sd_shadow said:
The bad key screen is normal for an unlocked Moto phone
Sent from my sailfish using XDA Labs
Click to expand...
Click to collapse
Yeah, I know. That does not even bother me.
I just want to relock the bootloader and I can not.

Marcondes BR said:
Yeah, I know. That does not even bother me.
I just want to relock the bootloader and I can not.
Click to expand...
Click to collapse
Motorola devices are notorious bad at relocking the bootloader.
Sent from my PH-1 using XDA Labs

i activated the usb debug and now when my phone is not plugged VIA USB it shuts down and when i try to turn it on it starts restarting again and again. it had been working perfect prior to this

Rooting G7 Play should be similar with G7.
I successfully rooted two G7 using Magisk patching boot.img method. However, it's recommended to download full ROM just in case.
I posted root method for G7 in general discussion.
Currently recovery is not available because stock recovery is missing. It's possible recovery is fused into boot.img.
Make sure you unlock bootloader before proceeding

mingkee said:
Rooting G7 Play should be similar with G7.
I successfully rooted two G7 using Magisk patching boot.img method. However, it's recommended to download full ROM just in case.
I posted root method for G7 in general discussion.
Currently recovery is not available because stock recovery is missing. It's possible recovery is fused into boot.img.
Make sure you unlock bootloader before proceeding
Click to expand...
Click to collapse
I unlocked the bootloader and patched the boot.img with magisk, and flashed the patched_boot.img with fastboot, but It did nothing lol
Maybe something related with It having both boot_a and boot_b ? Any tips?

Junior lage said:
I unlocked the bootloader and patched the boot.img with magisk, and flashed the patched_boot.img with fastboot, but It did nothing lol
Maybe something related with It having both boot_a and boot_b ? Any tips?
Click to expand...
Click to collapse
Does Magisk Manager show any error?

mingkee said:
Does Magisk Manager show any error?
Click to expand...
Click to collapse
it does not. magisk log >>
Code:
- Copying image to cache
- Device platform: armeabi-v7a
- Downloading zip
... 0%
- Boot image is signed with AVB 1.0
1038+1 records in
1038+1 records out
1063528 bytes transferred in 0.013 secs (81809846 bytes/sec)
- Unpacking boot image
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Parsing boot image: [/data/user_de/0/com.topjohnwu.magisk/install/boot.img]
HEADER_VER [1]
KERNEL_SZ [10005694]
RAMDISK_SZ [7746596]
SECOND_SZ [0]
EXTRA_SZ [0]
RECOV_DTBO_SZ [0]
OS_VERSION [9.0.0]
PATCH_LEVEL [2018-12]
PAGESIZE [2048]
NAME []
CMDLINE [console=ttyMSM0,115200,n8 androidboot.console=ttyMSM0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlycon=msm_hsl_uart,0x78af000 firmware_class.path=/vendor/firmware_mnt/image androidboot.usbconfigfs=true vmalloc=300M loop.max_part=7 printk.devkmsg=on androidboot.hab.csv=1 androidboot.hab.product=channel androidboot.hab.cid=50 buildvariant=user veritykeyid=id:b640f6ee9102b88daa3450b13ef25fc9eb143d63]
CHECKSUM [ad29965b4c6d3c2ae7e4f885ec014a6fa91c2e5f]
DTB [303582]
KERNEL_FMT [raw]
RAMDISK_FMT [gzip]
- Checking ramdisk status
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Loading cpio: [ramdisk.cpio]
- Stock boot image detected
- Backing up stock boot image
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Compressing to [stock_boot_825eefb2020fd276640da7d3e95730814d41acd1.img.gz]
- Patching ramdisk
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Loading cpio: [ramdisk.cpio]
Add entry [init] (0750)
Patch with flag KEEPVERITY=[true] KEEPFORCEENCRYPT=[true]
Loading cpio: [ramdisk.cpio.orig]
Backup mismatch entry: [init] -> [.backup/init]
Add entry [.backup/.magisk] (0000)
Dump cpio: [ramdisk.cpio]
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
- Repacking boot image
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Parsing boot image: [/data/user_de/0/com.topjohnwu.magisk/install/boot.img]
HEADER_VER [1]
KERNEL_SZ [10005694]
RAMDISK_SZ [7746596]
SECOND_SZ [0]
EXTRA_SZ [0]
RECOV_DTBO_SZ [0]
OS_VERSION [9.0.0]
PATCH_LEVEL [2018-12]
PAGESIZE [2048]
NAME []
CMDLINE [console=ttyMSM0,115200,n8 androidboot.console=ttyMSM0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlycon=msm_hsl_uart,0x78af000 firmware_class.path=/vendor/firmware_mnt/image androidboot.usbconfigfs=true vmalloc=300M loop.max_part=7 printk.devkmsg=on androidboot.hab.csv=1 androidboot.hab.product=channel androidboot.hab.cid=50 buildvariant=user veritykeyid=id:b640f6ee9102b88daa3450b13ef25fc9eb143d63]
CHECKSUM [ad29965b4c6d3c2ae7e4f885ec014a6fa91c2e5f]
DTB [303582]
KERNEL_FMT [raw]
RAMDISK_FMT [gzip]
Repack to boot image: [new-boot.img]
HEADER_VER [1]
KERNEL_SZ [10005694]
RAMDISK_SZ [7993310]
SECOND_SZ [0]
EXTRA_SZ [0]
RECOV_DTBO_SZ [0]
OS_VERSION [9.0.0]
PATCH_LEVEL [2018-12]
PAGESIZE [2048]
NAME []
CMDLINE [console=ttyMSM0,115200,n8 androidboot.console=ttyMSM0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlycon=msm_hsl_uart,0x78af000 firmware_class.path=/vendor/firmware_mnt/image androidboot.usbconfigfs=true vmalloc=300M loop.max_part=7 printk.devkmsg=on androidboot.hab.csv=1 androidboot.hab.product=channel androidboot.hab.cid=50 buildvariant=user veritykeyid=id:b640f6ee9102b88daa3450b13ef25fc9eb143d63]
CHECKSUM [eb27d967baf70b37301b36d9a422435b5b54dc]
MagiskBoot v18.1(18100) (by topjohnwu) - Boot Image Modification Tool
Cleaning up...
- Signing boot image with test keys
****************************
Patched image is placed in
/storage/emulated/0/Download/patched_boot.img
****************************
- All done!

Junior lage said:
it does not. magisk log >>
Click to expand...
Click to collapse
Did you install Magisk Manager after flashed patched boot?

mingkee said:
Did you install Magisk Manager after flashed patched boot?
Click to expand...
Click to collapse
I did, and it shows that magisk isn't installed...
Did I miss anything ?
I did flash the stock rom and patch it again for a whole day, and did not get it to work.
This phone is just stubborn...
I'll repeat it a couple more times to log everything and hope i missed something basic and get root to work within the day

Did you find boot a & b in the ROM?
It looks strange but it may be G7 Play issue

If I do a
Code:
fastboot boot patched_boot.img
It wont boot, And the bootloader logs says It is an incomplete boot image..
But when I use :
Code:
fastboot flash boot patched_boot.img
It only gives me a warning that the image is smaller then It should be, but flahing is successful. Magisk wont work tho...
I'll try something else for now... Thank you for your help

[GUIDE] What should I backup before trying to customize my MERLIN device ? (Redmi Note 9 / Redmi 10X 4G)

WARNINGS:​
NEVER try to flash in "format all" mode ! Otherwise, you will LOSE all secure and identifying infos for your device. Like IMEI.
Keep your backup files safe and secure ! If you can, encrypt them.
Never try to share your backups or your security and privacy will be compromised.
USE AT YOUR OWN RISK. I AM NOT RESPONSIBLE FOR YOUR ACTIONS.​
Why to backup ?
If you backup the partitions listed here, you can avoid mistakes without risking all of your device's identification details.
Like IMEI, WiFi MAC, Bluetooth MAC, calibration data, NVDATA, NVRAM, RADIO/MODEM/BASEBAND and others.
How to backup ?
You can backup using TWRP, PBRP, DD, SP Flash Tool or anyway you want.
How to restore ?
You can restore using TWRP, PBRP, DD, SP Flash Tool or anyway you want.
I suggest you to use same tool of backup.
Partition: frp​Description: This partition stores persistent data for factory reset protection. Like google account and miaccount/micloud.​Size: 1.024 KiB (1 MiB)​Block: /dev/block/mmcblk0p5​Start address: 0x5508000​Length: 0x100000​
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Partition: md_udc​Description: This partition stores master keys for encrypting and decrypting files.​Size: 23.144 KiB (22,6 MiB)​Block: /dev/block/mmcblk0p9​Start address: 0x6e08000​Length: 0x169a000​
Partition: nvcfg​Description: This partition stores variable configs of NVDATA and NVRAM.​Size: 32.768 KiB (32 MiB)​Block: /dev/block/mmcblk0p11​Start address: 0xa4a2000​Length: 0x2000000​
Partition: nvdata​Description: This partition stores variable data of secure and identifying infos for your device. Like IMEI, WiFi MAC, Bluetooth MAC, calibration data and others.​Size: 65.536 KiB (64 MiB)​Block: /dev/block/mmcblk0p12​Start address: 0xc4a2000​Length: 0x4000000​
Partition: nvram​Description: This partition stores persistent data of secure and identifying infos for your device. Like IMEI, WiFi MAC, Bluetooth MAC, calibration data and others.​Size: 65.536 KiB (64 MiB)​Block: /dev/block/mmcblk0p21​Start address: 0x19f00000​Length: 0x4000000​
Partition: persist​Description: This partition stores persistent data for factory reset protection. Like google account and miaccount/micloud.​Size: 49.152 KiB (48 MiB)​Block: /dev/block/mmcblk0p13​Start address: 0x104a2000​Length: 0x3000000​
Partition: proinfo​Description: This partitions stores persistent data of default structure for NVRAM/RADIO/MODEM/BASEBAND.​Size: 3.072 KiB (3 MiB)​Block: /dev/block/mmcblk0p19​Start address: 0x18200000​Length: 0x300000​
Partition: protect1 (or protect_f)​Description: This partition stores variable data of SIM/RADIO/MODEM/BASEBAND settings and infos.​Size: 8.192 KiB (8 MiB)​Block: /dev/block/mmcblk0p15​Start address: 0x164a2000​Length: 0x800000​
Partition: protect2 (or protect_s)​Description: This partition stores variable data of SIM/RADIO/MODEM/BASEBAND settings and infos.​Size: 11.640 KiB (11,36 MiB)​Block: /dev/block/mmcblk0p16​Start address: 0x16ca2000​Length: 0xb5e000​
Partition: seccfg​Description: This partition stores the state of the bootloader. (Locked or Unlocked.)​Keep atention: If you backup this partition in locked bootloader, it will keep locked after restoring. If you want to backup this partition in unlocked bootloader, you need to unlock bootloader first.​Size: 8.192 KiB (8 MiB)​Block: /dev/block/mmcblk0p17​Start address: 0x17800000​Length: 0x800000​
Do you need help with your MERLIN device ?
Read this FAQ: https://forum.xda-developers.com/t/...for-merlin-redmi-note-9-redmi-10x-4g.4225163/

Can't figure out how to do a backup with SP flash tool. What's the easiest way?

ticotexas said:
Can't figure out how to do a backup with SP flash tool. What's the easiest way?
Click to expand...
Click to collapse
You can backup with sp flash tool easily too.
Use this readback file:
[READBACK][FLASH] Read Back file for backuping using flash tool from MERLIN (Xiaomi Redmi Note 9 / Xiaomi Redmi 10X 4G)
Works with: - Xiaomi Redmi Note 9 - Xiaomi Redmi 10X 4G How to use it: 1. Paste the file inside home folder of flash tool. (If there is an existing file, you need to overwrite it.) 2. Open flash tool. 3. Open "download" tab, select scatter...
forum.xda-developers.com

Where do I get the Scatter-loading file and Authentication file?

ticotexas said:
Where do I get the Scatter-loading file and Authentication file?
Click to expand...
Click to collapse
You can skip auth file if you use any of these DA (download-agent) file:
[DA][FLASH] DA files for flashing to MERLIN using FLASH TOOL (Xiaomi Redmi Note 9 / Xiaomi Redmi 10X 4G)
Downloads: - SP Flash Tool (Windows) https://spflashtools.com/windows - SP Flash Tool (Linux) https://spflashtools.com/linux Alternative Downloads: If you are having problems for flashing on Windows with sp flash tool, give a try on these...
forum.xda-developers.com
Scatter file for MERLIN:
[SCATTER][FLASH] Scatter file for flashing using flash tool to MERLIN (Xiaomi Redmi Note 9 / Xiaomi Redmi 10X 4G)
Works with: - Xiaomi Redmi Note 9 - Xiaomi Redmi 10X 4G Options for download: - Untouched Original Stock Rom. - Original Stock Rom with disabled boundary check. (File sufix: boundary_false) - All partitions allowed for download mode with...
forum.xda-developers.com

I selected a Scatter loading file, and when I choose download, it says, Please select one ROM at least before execution. Closed, reopened, chose Read Back. Doesn't seem to do anything or ask to save a backup. This is totally unintuitive. I may have to try the magisk without backing up. I can't figure this out.

ticotexas said:
I selected a Scatter loading file, and when I choose download, it says, Please select one ROM at least before execution. Closed, reopened, chose Read Back. Doesn't seem to do anything or ask to save a backup. This is totally unintuitive. I may have to try the magisk without backing up. I can't figure this out.
Click to expand...
Click to collapse
May you attach the screenshot, please?

Learning About AVB Android Verified Boot (Boot.img dtb.img, vbmeta.img, and the "staging blob")

Edit-- after studying a couple days I understand why no modification to the images would work, which is due to AVB. I have a lot more studying to do and I will explain better. This thread is currently a mess of notes from a noob picking a kind lady's brain
Hello All~!
This is an effort to understand what exactly is going on with the files contained in the boot.img from our shield --edit to understand this on the shield, we must understand the other images as well (dtb, vbmeta. and the "staging blob" that comes with the shield)
ImgUtil
Miss @Renate has developed a wonderful tool to allow us to see the contents of our boot.img by placing her tool in the same folder as the boot.img and running this code:
Code:
imgutil.exe /v /l boot.img
Spoiler: SHOW
STOCK BOOT IMAGE:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
DEV BOOT IMAGE:
IMAGES THAT COME WITH SHIELD
This was only possible Thanks to Renate.
AVB NOTES:
Finally figured out how to actually use the avb tool.. I feel stupid. Copy this script and make a new file called avbtool
Per this link I learned how to make an empty vbmeta with the tool, i had to add "python" to the front
Code:
python avbtool make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img
That allowed me to generate an empty vbmeta
The avbtool help menu:
View attachment 5792745
Signing boot images for Android Verified Boot (AVB) [v8]
Various Android devices support Android Verified Boot (AVB). A part of this is more commonly known as dm-verity, which verifies system (and vendor) partition integrity. AVB can however also verify boot images, and stock firmwares generally...
forum.xda-developers.com
super helpful
Boot Flow | Android Open Source Project
source.android.com

There can be image signing with vbmeta and/or AVB on the image itself.
Whether these are enforced is another question and can most easily be determined by experimenting.
Most people grab a boot image out of a partition. The whole partition.
In the days before AVB0 signing this meant you might copy a 64M partition and get 24M of actual image and 40M of zeroes.
In the days after AVB0 signing this meant you get 24M of actual image, 2k of signing, 40M of zeroes and an itty-bitty AVB0 footer.
That AVB0 footer is a pesky detail.
You can see it if you have the whole partition and use a hex editor at the very end (size-4096).
As Magisk deals with boot images I should double check what they do. I believe they don't modify the AVB0 footer at all.
Using my EDL client edl.exe there is the /t option to trim an image to the real ~24M live bit.
In imgutil.exe there is the /p option to strip padding.
If your fastboot works fine, you have a nice recovery and you feel confident you can experiment.
You can trim your stock boot image of its padding using imgutil.exe (which I believe leaves the AVB0 header intact), then:
Code:
fastboot erase boot
fastboot flash boot mytrimmedstock.img
You can even trim away the AVB0 header (using the address shown in imgutil.exe) and see if that works with erase, flash.
Then there is the vbmeta. That is a check on things too, whether enforced or not is also a question.
You can often replace it with an disabled vbmeta image.
Your dtb is in a separate partition.
On my main device it's on the kernel. I modify (in hex instead of dtc round-tripping) it to not verify /vendor.

@Renate Thank You, Seriously For Your Time. I was Just Looking at your EDL tool! I am going to play with all of this now. I cannot even begin to tell you how happy this has made me.
This is the link to her edl tool
EDL Utility

i deleted the vbmeta link that was originally listed here. ordinarily i would leave the comment up for knowledge, but I don't want anyone to get off the path. We need to learn the avb tools and generate our own, not use others due to the cryptographic hashes associated with each image that chains to the "staging" blob

Hi @Renate May I bother you again? I am stuck on two parts,
You mention editing the dtb to not verify /vendor could you help me to understand how to do that?
I threw my dtb.img into HXD and searched for "vendor" and it brought up this
Spoiler: SHOW
but I am unsure if this is what I need or what to change it to?
Also I wanted to try to do what you say here "You can even trim away the AVB0 header (using the address shown in imgutil.exe) and see if that works with erase, flash."
I took that to mean use imgutil.exe to /d the Header1 file? Is that wrong? I tried all these but I cannot figure out on my own how to do it
Spoiler: SHOW
>.> i at least figured out the padding part

No, I'm not saying that you have to change dtb.
In today's world you can "modify" things by using Magisk modules (and not modifying /system) or by burning your bridges and just modifying /system.
If you do that you'll have to get rid of all verification (and FEC if present) and you it make updates impossible without reverting back to stock.
Your choices are influenced by what the OEM offers for updates and how much you want to sink your teeth into swamp critters.
Looking at a dtb in raw hex will make you go blind.
You should use dtc to disassemble/assemble.
It's probably not on your device but it is in any Linux.
I use my own dtbview.exe (not ready for prime-time) to get a dump with addresses.
If you like (for learning) post your dtb.

@Renate this is the dtb image, and thank you for telling me about dtc LOL I will get that installed in my ubuntu VM.

Also @Renate is this the right tool?
Spoiler: SHOW

Yeah, that's the right tool.
I don't know if the mysterious new header on Android is part of Linux or not.
So your dtb partition is 2M
The end of actual data is 7c394, so basically 1/4 of the partition.
But it's also AVB signed, look at offset 7d000
And its silly footer at 1fffc0
Here's the listing for your edification

Spoiler: DTC FOR WINDOWS
I came across this dtc tool for windows made by amlogic, it was originally shared here, bundled with other things
How to Extract a Device Tree File from Android Firmware Files - CNX Software
Up to now, all our cheap Android devices were based on older Linux kernel (3.0.x, 3.4.x) that still used board files (arch/arm/board, but we've recently
www.cnx-software.com
Spoiler: SHOW
I extracted just it
dtc-tool.exe
drive.google.com
I checked it on virus total
VirusTotal
VirusTotal
www.virustotal.com

@Renate Hi, I'm going to probably bother you till you block me...
But could you explain to me how you were able to take that dtb image I shared with you to turn it into the text file? I tried to use the dtc tool in linux and on windows but I cannot figure out how to get the listing like you did.
Here's what I was trying

jenneh said:
Blob has incorrect magic number
Click to expand...
Click to collapse
Yeah, it does!
That's what I've been fighting about. They decided to add some header.
Some dtb's have multiple separate models built in. Why? I have no idea.
Instead of ye olde fashioned "a dtb is that period" they decided to put in a header.
I'm sure that's it's documented somewhere.
If you are just doing this for your own amusement, knock the first 128 bytes off the file and it can be disassembled.

@Renate I Really Am doing this for my own fun. But For A Total Noob, can you explain what this means? "knock the first 128 bytes off the file and it can be disassembled" I'm so very sorry. I have always been intrigued with disassembly but I do not know very much

Somebody at Android decided for whatever reason to extend the Linux DTB by putting another header before it.
Obviously Linux doesn't know or care what Android does.
If you look at offset 0x80 you'll see the normal signature of 0xd00feed (in bigend).
We can discuss whether that's politically questionable, but that's the way it is.

@Renate I guess what I am having trouble understanding, is where are these offsets that you are pointing me to with all this valuable information? Like you said here "If you look at offset 0x80 you'll see the normal signature of 0xd00feed (in bigend)."
When I look at the offsets in the text file I don't see anything called 0x80 it's the same trouble for me to fully understand what you were telling me earlier
Spoiler: SHOW
"But it's also AVB signed, look at offset 7d000
And its silly footer at 1fffc0"
How do I see these offsets that you so awesomely took the time to point out?

jenneh said:
When I look at the offsets in the text file I don't see anything called 0x80...
Click to expand...
Click to collapse
When you look at something like this you're looking at a raw chunk of memory.
As such, every bit of it, err, every byte of it has an address.
The first byte is zero and it goes up from there.
"0x80" is hex 80, (i.e. 128 bytes) into the file.

Renate said:
When you look at something like this you're looking at a raw chunk of memory.
As such, every bit of it, err, every byte of it has an address.
The first byte is zero and it goes up from there.
"0x80" is hex 80, (i.e. 128 bytes) into the file.
Click to expand...
Click to collapse
Does that mean these first 8 lines of offsets are the the first bytes? Is this what I would want to blank out to remove the header?

So, look at the line with 00000080: d0 0d fe ed, "doodfeed"!
It's not a question of "blanking" it's a question of "skipping".
Although I don't o-fish-ally release it, here is modfile.exe: modfile
Code:
C:\>copy dtb dtb-short
C:\>modfile dtb-short /s 80

Renate said:
So, look at the line with 00000080: d0 0d fe ed, "doodfeed"!
Click to expand...
Click to collapse
Gosh, Thank You. "d0 0d fe ed, "doodfeed"!" This, this did it for me to Understand. Haha. Thank You for the modfile tool as [email protected]@!
I got to get some sleep, but rest assured I will be back tomorrow to bother you even more!

@Renate Good Morning!! THANK YOU for helping me to learn how to "Skip" the erroneous header! This is something I Literally would never have learned Without You! Your modfile tool is so Neat! Also appreciate the Semantics!!
FIRST QUESTION! How do I produce a text output file similar to the one you shared with me? As in one that has all the offsets at the beginning of the line?
I ran this command after the skip (It finally worked yay!! No magic number problem!!):
Code:
dtc-tool.exe -I dtb -o dtb.txt dtb.img
I got this output text, which is noticeably missing the offsets that your copy provided.
Spoiler: SHOW
Spoiler: DTC MANUAL
Here is the manual for other people learning:
manual.txt « Documentation - dtc/dtc.git - The Device Tree Compiler
git.kernel.org
Spoiler: I SAW BOOTLOADER.
SECOND QUESTION! Theoretically, if I wanted to add a new Bootloader to be able to run windows, Would that be done in here? Or more specifically, somewhere in the DTS? We don't have to go into technical specifics yet... unless you want to but is it possible?
THIRD QUESTION! When I was learning how to flash the images onto the Shield, Nvidia made mentions to use this command to flash the "staging blob" I have always wondered Why and What is this, is it needed do you know?
Spoiler: SHOW
Thank you as always for your time