cfig / Android_boot_image_editor

Parsing and re-packing Android boot.img/vbmeta.img/payload.bin, supporting Android 15
Apache License 2.0
995 stars 227 forks source link

Unpack vendor_boot failed #101

Closed nakixii closed 1 year ago

nakixii commented 1 year ago
Starting a Gradle Daemon (subsequent builds will be faster)

> Task :unpack FAILED
01:11:53.463 [main] WARN  cfig.packable.PackableLauncher - [vendor_boot.img] will be handled by [VendorBootParser]
01:11:53.510 [main] WARN  cfig.packable.PackableLauncher - 'unpack' sequence initialized
01:11:53.512 [main] INFO  cfig.packable.IPackable - deleting build/unzip_boot/ ...
01:11:53.518 [main] INFO  Helper - deleting uiderrors
01:11:53.603 [main] WARN  cfig.bootimg.v3.VendorBootHeader - VendorBootHeader constructor
01:11:53.624 [main] WARN  cfig.bootimg.v3.VendorBoot - VrtEntry(size=809653825, offset=16777216, type=NONE, name='', boardIdStr='', file='build/unzip_boot/ramdisk.1')
01:11:53.912 [main] INFO  Helper - CMD: [lz4, -t, build/unzip_boot/ramdisk.img], workDir: null
build/unzip_boot/ram : decoded 132087296 bytes                                 
01:11:53.960 [main] INFO  cfig.bootimg.Common - ramdisk is compressed lz4
01:11:53.963 [main] INFO  Helper - CMD: [lz4, -d, -fv, build/unzip_boot/ramdisk.img.lz4, build/unzip_boot/ramdisk.img], workDir: null
*** LZ4 command line interface 64-bits v1.9.2, by Yann Collet ***
build/unzip_boot/ram : decoded 132087296 bytes                                 
01:11:54.192 [main] INFO  cfig.utils.DTC - parsing DTB: build/unzip_boot/dtb
FATAL ERROR: Blob has incorrect magic number
01:11:54.194 [main] ERROR cfig.utils.DTC - can not parse DTB: build/unzip_boot/dtb
01:11:54.197 [main] INFO  cfig.bootimg.v3.VendorBoot - dumping vendor ramdisk 1/1 ...
Exception in thread "main" java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at kotlin.reflect.jvm.internal.calls.CallerImpl$Method.callMethod(CallerImpl.kt:97)
        at kotlin.reflect.jvm.internal.calls.CallerImpl$Method$Instance.call(CallerImpl.kt:113)
        at kotlin.reflect.jvm.internal.KCallableImpl.call(KCallableImpl.kt:108)
        at cfig.packable.PackableLauncherKt.main(PackableLauncher.kt:108)
Caused by: java.lang.OutOfMemoryError: Java heap space
        at cfig.helper.Helper$Companion.extractFile(Helper.kt:119)
        at cfig.bootimg.Common$Companion.dumpRamdisk(Common.kt:127)
        at cfig.bootimg.Common$Companion.dumpRamdisk$default(Common.kt:125)
        at cfig.bootimg.v3.VendorBoot.extractImages(VendorBoot.kt:376)
        at cfig.packable.VendorBootParser.unpack(VendorBootParser.kt:34)
        ... 8 more

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':unpack'.
> Process 'command '/home/nakixii/Android-studio/jre/bin/java'' finished with non-zero exit value 1

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.

* Get more help at https://help.gradle.org

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.4/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 30s
10 actionable tasks: 4 executed, 6 up-to-date

vendor_boot download link: https://drive.google.com/file/d/1Ch1RFpDFYXtyJaHHBU6nRCXXLMniWP0w/view?usp=drivesdk

cfig commented 1 year ago

Hi @nakixii , Thanks for reporting incompatibility issues. I did a quick check of the image, it seems the image has strange value in ramdisk table entry size. Is this image modified by some 3rd party tool? Or do you build it by yourself?

nakixii commented 1 year ago

Hi @nakixii , Thanks for reporting incompatibility issues. I did a quick check of the image, it seems the image has strange value in ramdisk table entry size. Is this image modified by some 3rd party tool? Or do you build it by yourself?

It's an official image on Redmi K50 MIUI 13.1.22.9.19.DEV.

cfig commented 1 year ago

Hi @nakixii , Just tried with aosp unpack_bootimg.py,

red➜  ~/big/a/system/tools/mkbootimg git:(c6bbbe1) ✗ ./unpack_bootimg.py --boot_img ~/work/boot/vendor_boot.img --out out                       
Traceback (most recent call last):
  File "/home/yu/big/a/system/tools/mkbootimg/./unpack_bootimg.py", line 563, in <module>
    main()
  File "/home/yu/big/a/system/tools/mkbootimg/./unpack_bootimg.py", line 558, in main
    info = unpack_bootimg(args.boot_img, args.out)
  File "/home/yu/big/a/system/tools/mkbootimg/./unpack_bootimg.py", line 486, in unpack_bootimg
    info = unpack_vendor_boot_image(image_file, output_dir)
  File "/home/yu/big/a/system/tools/mkbootimg/./unpack_bootimg.py", line 426, in unpack_vendor_boot_image
    ramdisk_name = cstr(unpack(
UnicodeDecodeError: 'utf-8' codec can't decode byte 0x80 in position 15: invalid start byte

Not sure if XiaoMi has changed the default "mkbootimg" tool.

cfig commented 1 year ago

Let's check the "vendor ramdisk total size" field of the image header: image The binary hex is 0x121fb803, interpret it as little endian int, we get 0x03b81f12 = 62398226 bytes ~= 59.5 MB.

Also the dtb seems incorrect.

15:24:31.147 [main] INFO  cfig.utils.DTC - parsing DTB: build/unzip_boot/dtb
FATAL ERROR: Blob has incorrect magic number
15:24:31.149 [main] ERROR cfig.utils.DTC - can not parse DTB: build/unzip_boot/dtb
nakixii commented 1 year ago

The dtb problem seems to be caused by the offset. After skipping the first 32 (I'm not sure) bytes manually, dtc can convert it correctly.

cfig commented 1 year ago

That's good. About "ramdisk", it can be manually extracted with mkdir temp && cd temp && cpio -iv < ../build/unzip_boot/ramdisk.img "dtb" can be manually extracted as you have successfully done.

anyway, it doesn't feel good to support such modified image formats ~~

nakixii commented 1 year ago

OK.