Skip to content

[question] Can we get both phys value on Mediatek device without root using vendor_boot?聽#313

Description

@OhMyDitzzy

I have bad communication skills, so sorry if there is anything lacking 馃槄

docs/kernel_profiles/MEDIATEK.md says kernel_phys_load and
kernel_phys_offset "cannot be obtained from the image" and requires a
rooted shell reading /proc/iomem + /proc/kallsyms via tools/mtk-phys/.

That's correct, Different from Snapdragon where the equivalent physical-address info
lives in xbl_config.img and has its own (different) extraction story. But
on MediaTek specifically, vendor_boot.img's header already carries the
value needed: the kernel_addr field (what calls --base +
--kernel_offset) turned out to equal the real physical load address on
every MTK device I checked

I have created a tool that extracts the phys value from the vendor_boot partition.

Here for screenshoot:

Image

So, I assume that MTK kernels typically have a text_offset of 0 (meaning _text is placed exactly at the RAM base, without the additional 0x80000 offset)鈥攁nd the kernel_phys_offset (DRAM base) can vary by device; it isn't limited to just 0x40000000 or 0x80000000. The suffix values can be 80000 (or 800 for 32 bit devices) or 00000.

However, this is still my assumption and this tool has not been tested on other Mediatek devices. It needs to be tested on other Mediatek devices.

@NickJi2019

Activity

  1. OhMyDitzzy commented on Oct 6, 2026

    @OhMyDitzzy
    ContributorAuthor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions