Need some help... #78

eternalstarfire · 2021-11-16T03:34:32Z

eternalstarfire
Nov 16, 2021

I checked out master, and ran ./gradlew unpack and ended up with this error:

w: /tmp/androidbootimage/abie_git/Android_boot_image_editor/bbootimg/src/main/kotlin/avb/desc/HashDescriptor.kt: (87, 43): Parameter 'parent' is never used

> Task :unpack FAILED
14:58:09:338 WARN PackableLauncher - [boot.img] will be handled by [BootImgParser]
14:58:09:454 WARN PackableLauncher - 'unpack' sequence initialized
14:58:09:462 INFO BootImgParser - header version 231424
14:58:09:603 WARN BootHeaderV3 - BootImgHeaderV3/V4 constructor
Exception in thread "main" java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at kotlin.reflect.jvm.internal.calls.CallerImpl$Method.callMethod(CallerImpl.kt:97)
        at kotlin.reflect.jvm.internal.calls.CallerImpl$Method$Instance.call(CallerImpl.kt:113)
        at kotlin.reflect.jvm.internal.KCallableImpl.call(KCallableImpl.kt:108)
        at cfig.packable.PackableLauncherKt.main(PackableLauncher.kt:105)
Caused by: java.lang.AssertionError: Assertion failed
        at cfig.bootimg.v3.BootHeaderV3.<init>(BootHeaderV3.kt:55)
        at cfig.bootimg.v3.BootV3$Companion.parse(BootV3.kt:53)
        at cfig.packable.BootImgParser.unpack(BootImgParser.kt:49)
        ... 8 more

I can see that the header version is coming from the probeHeaderVersion function, and that's returning the 32bit integer starting at 0x28, but as mine has 00 88 03 00 in the 4 bytes starting at 0x28:

So it returns a header version of 231424, which isn't 0-4...

This is a lineageOS boot image, extracted via TWRP.

When I modified 0x28-0x31 to be all 0x00s, then I could successfully unpack ✅:

16:22:19:291 WARN PackableLauncher - [boot.img] will be handled by [BootImgParser]
16:22:19:404 WARN PackableLauncher - 'unpack' sequence initialized
16:22:19:421 INFO BootImgParser - header version 0
16:22:19:434 WARN BootHeaderV2 - BootImgHeader constructor
16:22:19:690 WARN EnvironmentVerifier - lz4 not installed
16:22:19:884 INFO ZipHelper - decompress(gz) done: build/unzip_boot/ramdisk.img.gz -> build/unzip_boot/ramdisk.img
16:22:19:886 INFO AndroidCpio - Cleaning /tmp/androidbootimage/abie_git/Android_boot_image_editor/build/unzip_boot/root ...
16:22:19:910 WARN AndroidCpio -   root/config has improper file mode 500, fix it
16:22:20:040 INFO AndroidCpio - cpio trailer found, mode=000001a4
16:22:20:041 INFO Common -  ramdisk extracted : build/unzip_boot/ramdisk.img -> build/unzip_boot/root
16:22:20:049 INFO BootV2 - verify type is VB1.0, skip AVB parsing
16:22:20:091 INFO BootV2 -
                        Unpack Summary of boot.img
┌───────────────────────────────────────┬──────────────────────────────────────┐
│What                                   │Where                                 │
└───────────────────────────────────────┴──────────────────────────────────────┘
┌───────────────────────────────────────┬──────────────────────────────────────┐
│image info                             │build/unzip_boot/boot.json            │
├───────────────────────────────────────┼──────────────────────────────────────┤
│kernel                                 │build/unzip_boot/kernel               │
├───────────────────────────────────────┼──────────────────────────────────────┤
│ramdisk                                │build/unzip_boot/ramdisk.img.gz       │
│\-- extracted ramdisk rootfs           │build/unzip_boot/root                 │
└───────────────────────────────────────┴──────────────────────────────────────┘
16:22:20:158 WARN PackableLauncher - 'unpack' sequence completed

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.2/userguide/command_line_interface.html#sec:command_line_warnings

... and repack (no errors):

16:23:50:955 WARN PackableLauncher - [boot.img] will be handled by [BootImgParser]
16:23:51:079 WARN PackableLauncher - 'pack' sequence initialized
16:23:51:086 INFO BootImgParser - Loading config from build/unzip_boot/boot.json
16:23:51:301 INFO Common - Deleting build/unzip_boot/ramdisk.img.gz ...
16:23:51:304 INFO Common - Deleting build/unzip_boot/ramdisk.img ...
16:23:51:307 INFO Common - Packing rootfs build/unzip_boot/root ...
16:23:51:328 INFO AndroidCpio - loading build/unzip_boot/ramdisk.img_filelist.txt
16:23:51:924 INFO ZipHelper - compress(gz) done: build/unzip_boot/ramdisk.img.gz
16:23:51:924 INFO Common - build/unzip_boot/ramdisk.img.gz is ready
16:23:52:182 INFO BootV2 - Writing data ...
16:23:53:241 INFO BootV2 - [aosp/system/tools/mkbootimg/mkbootimg.py, --header_version, 0, --base, 0x0, --kernel, build/unzip_boot/kernel, --kernel_offset, 0x8000, --ramdisk, build/unzip_boot/ramdisk.img.gz, --ramdisk_offset, 0x2000000, --pagesize, 2048, --cmdline, console=ttyHSL0,115200,n8 androidboot.hardware=bacon user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=msm_sdcc.1 buildvariant=userdebug, --os_version, 7.1.2, --os_patch_level, 2018-04-00, --tags_offset, 0x1e00000, --id, --output, boot.img.google]
0xeba5d90c6b71d22685015f39f7657f825e25ec72000000000000000000000000
16:23:53:884 INFO Common - boot.img.clear hash 90f8df2e67fd3e9ca9ae3f6b9345084eef17c94d, boot.img.google hash 90f8df2e67fd3e9ca9ae3f6b9345084eef17c94d
16:23:53:885 INFO Common - Hash verification passed: 90f8df2e67fd3e9ca9ae3f6b9345084eef17c94d
16:23:53:887 INFO Signer - Signing with verified-boot 1.0 style
16:23:53:903 INFO Signer - java -jar aosp/boot_signer/build/libs/boot_signer.jar /boot boot.img.clear aosp/security/verity.pk8 aosp/security/verity.x509.pem boot.img.signed
16:23:54:535 INFO VendorBoot -
                        Pack Summary of boot.img
┌───────────────────────────────────────┬──────────────────────────────────────┐
│What                                   │Where                                 │
└───────────────────────────────────────┴──────────────────────────────────────┘
┌───────────────────────────────────────┬──────────────────────────────────────┐
│re-packed boot.img                     │boot.img.signed                       │
└───────────────────────────────────────┴──────────────────────────────────────┘
16:23:54:545 WARN PackableLauncher - 'pack' sequence completed

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.2/userguide/command_line_interface.html#sec:command_line_warnings

...⚠ but the original boot image is 16.00MB and the repacked image is only 7.31MB... ❓

cfig · 2021-11-16T05:06:40Z

cfig
Nov 16, 2021
Maintainer

Can you share the boot.img?

1 reply

eternalstarfire Nov 16, 2021
Author

Here is a GDrive link.

cfig · 2021-11-16T05:33:30Z

cfig
Nov 16, 2021
Maintainer

Oh, the unrecognized header version seems to be "device tree image size"
https://review.lineageos.org/c/LineageOS/android_system_tools_mkbootimg/+/287107
This should be the lineageos dialect of boot.img.
Need some time to read the code.

0 replies

cfig · 2021-11-17T10:59:23Z

cfig
Nov 17, 2021
Maintainer

I can extract the "dt" from boot.img, at file offset 0x750800, size 0x0x38800 (226KiB).
The "dt" seems a little strange:

00750800: 5143 4454 0200 0000 0400 0000 c200 0000  QCDT............
00750810: 0800 0000 0000 0000 0000 0100 0008 0000  ................
00750820: 0080 0300 d200 0000 0800 0000 0000 0000  ................
00750830: 0000 0100 0008 0000 0080 0300 d500 0000  ................
00750840: 0800 0000 0000 0000 0000 0100 0008 0000  ................
00750850: 0080 0300 d800 0000 0800 0000 0000 0000  ................
00750860: 0000 0100 0008 0000 0080 0300 0000 0000  ................
00750870: 0000 0000 0000 0000 0000 0000 0000 0000  ................

The actual dtb blob seems to start after 2KiB + 0x750800, aka. 0x751000.

00751000: d00d feed 0003 7801 0000 0038 0003 1ef4  ......x....8....
00751010: 0000 0028 0000 0011 0000 0010 0000 0000  ...(............
00751020: 0000 590d 0003 1ebc 0000 0000 0000 0000  ..Y.............
00751030: 0000 0000 0000 0000 0000 0001 0000 0000  ................
00751040: 0000 0003 0000 0004 0000 0000 0000 0001  ................
00751050: 0000 0003 0000 0004 0000 000f 0000 0001  ................
00751060: 0000 0003 0000 0023 0000 001b 5175 616c  .......#....Qual
00751070: 636f 6d6d 204d 534d 2038 3937 3450 726f  comm MSM 8974Pro
00751080: 2d41 4320 4f6e 652b 2041 3030 3031 0000  -AC One+ A0001..
00751090: 0000 0003 0000 0027 0000 0021 7163 6f6d  .......'...!qcom

The actual blob can be decompiled with dtc.

But after the declared "dt" area, I can also find some unknown data.
Let's grep the dtb blob magics(0xd00dfeed big endian) in the file:

00751000: d00d feed 0003 7801 0000 0038 0003 1ef4  ......x....8....
00799800: d00d feed 0002 e032 0000 0038 0002 907c  .......2...8...|
007c8000: d00d feed 0002 fe41 0000 0038 0002 abc8  .......A...8....
007f8000: d00d feed 0003 050a 0000 0038 0002 b22c  ...........8...,
00828800: d00d feed 0003 0561 0000 0038 0002 b29c  .......a...8....
00859000: d00d feed 0002 dc6e 0000 0038 0002 8c80  .......n...8....
00887000: d00d feed 0002 e2c7 0000 0038 0002 92a0  ...........8....
008b5800: d00d feed 0002 e31e 0000 0038 0002 9310  ...........8....
008e4000: d00d feed 0002 bbc4 0000 0038 0002 7270  ...........8..rp
00910000: d00d feed 0002 ba71 0000 0038 0002 7114  .......q...8..q.
0093c000: d00d feed 0002 e4f5 0000 0038 0002 9858  ...........8...X
0096a800: d00d feed 0002 e51c 0000 0038 0002 9898  ...........8....
00999000: d00d feed 0002 e013 0000 0038 0002 93ec  ...........8....
009c7800: d00d feed 0002 e03a 0000 0038 0002 942c  .......:...8...,
009f6000: d00d feed 0002 d3ab 0000 0038 0002 8928  ...........8...(
00a23800: d00d feed 0002 d3d2 0000 0038 0002 8968  ...........8...h
00a51000: d00d feed 0002 e6cd 0000 0038 0002 96f8  ...........8....
00a7f800: d00d feed 0003 03ef 0000 0038 0002 b1ec  ...........8....
00ab0000: d00d feed 0003 4452 0000 0038 0002 f224  ......DR...8...$
00ae4800: d00d feed 0002 e1eb 0000 0038 0002 928c  ...........8....
00b13000: d00d feed 0000 65e5 0000 0038 0000 5a7c  ......e....8..Z|
00b19800: d00d feed 0002 e6f1 0000 0038 0002 971c  ...........8....
00b48000: d00d feed 0002 df27 0000 0038 0002 9020  .......'...8... 
00b76000: d00d feed 0003 03fb 0000 0038 0002 b1f8  ...........8....
00ba6800: d00d feed 0002 e20f 0000 0038 0002 92b0  ...........8....

Please comment if you know its meaning/definition. I never built full lineage images, I can have a try if I have time later.

2 replies

cfig Dec 16, 2021
Maintainer

I downloaded lineage os code, and found the target product should define BOARD_KERNEL_SEPARATED_DT to enable the feature(reuse headerVersion as dt length).
But I didn't find any profile using it, maybe it's out of the main repo of lineageOS?

eternalstarfire Dec 16, 2021
Author

Thanks @cfig - thankfully I've received a replacement phone, so I no longer have a reason to rebuild the boot image for my old one.
I also discovered that I can power up the old phone with the backplate off when I tried shorting the connection where the power button leads join to the main board - #winning
I'm not surprised you couldn't find any profile using that define - the boot image is possibly older than lineageOS's github history.

starbucks2010 · 2022-05-28T23:51:32Z

starbucks2010
May 28, 2022

Hello, Is it possible to use the command ./gradlew pack bypassing the hash check? Thanks
I need to swap the kernel file inside build folder before repacking and it doesn't allow me (ERROR Common - Hash verification failed).

Thanks.

1 reply

cfig May 29, 2022
Maintainer

Hi @starbucks2010 ,
The "Hash verification failed" should be a problem bug.
To bypass the check, you can edit file "bbootimg/src/main/kotlin/bootimg/Common.kt", function "assertFileEquals()" and just "return true".
Or you can attach your boot image here, then I can have a try and fix the program bug.

Thanks~

starbucks2010 · 2022-05-29T10:37:43Z

starbucks2010
May 29, 2022

Thank you for taking your time to look into this.
Here I attach you the log file of unpacking stock boot.img from a S22 Ultra (S908B, the modded zImage (kernel) and the stock boot.img). The command pack was run after I replace the zImage (kernel file) into the build folder.

stock boot.img - https://drive.google.com/file/d/1uVj3sZ32I4BUIxd6Ar9wuIatTNREA1VQ/view?usp=sharing
error file - https://drive.google.com/file/d/1DvY4ssl5A3G0EFFW5F4A8r4tx_KJ8_ZL/view?usp=sharing
modded kernel image - https://drive.google.com/file/d/1877GmsV94JWmtfWwKvjR3h_uGKYOs5D_/view?usp=sharing

1 reply

cfig May 29, 2022
Maintainer

Same as issue:
#88

Latest master branch has the fix. Nicely have a try :)

starbucks2010 · 2022-05-29T15:37:34Z

starbucks2010
May 29, 2022

One more thing if you don't mind. What's the difference between the .clear and the .signed boot files besides the size?

Thank you.

1 reply

cfig May 29, 2022
Maintainer

.clear + AVB metadata = .signed

.signed has additional verified boot(AVB) metadata and padding zeros.

Need some help... #78

Uh oh!

eternalstarfire Nov 16, 2021

Replies: 6 comments · 6 replies

Uh oh!

cfig Nov 16, 2021 Maintainer

Uh oh!

eternalstarfire Nov 16, 2021 Author

Uh oh!

cfig Nov 16, 2021 Maintainer

Uh oh!

cfig Nov 17, 2021 Maintainer

Uh oh!

cfig Dec 16, 2021 Maintainer

Uh oh!

eternalstarfire Dec 16, 2021 Author

Uh oh!

starbucks2010 May 28, 2022

Uh oh!

cfig May 29, 2022 Maintainer

Uh oh!

starbucks2010 May 29, 2022

Uh oh!

cfig May 29, 2022 Maintainer

Uh oh!

starbucks2010 May 29, 2022

Uh oh!

cfig May 29, 2022 Maintainer

eternalstarfire
Nov 16, 2021

Replies: 6 comments 6 replies

cfig
Nov 16, 2021
Maintainer

eternalstarfire Nov 16, 2021
Author

cfig
Nov 16, 2021
Maintainer

cfig
Nov 17, 2021
Maintainer

cfig Dec 16, 2021
Maintainer

eternalstarfire Dec 16, 2021
Author

starbucks2010
May 28, 2022

cfig May 29, 2022
Maintainer

starbucks2010
May 29, 2022

cfig May 29, 2022
Maintainer

starbucks2010
May 29, 2022

cfig May 29, 2022
Maintainer