cfig / Android_boot_image_editor

Parsing and re-packing Android boot.img/vbmeta.img/payload.bin, supporting Android 15
Apache License 2.0
995 stars 227 forks source link

Xiaomi MI5 (gemini) does not boot after re-pack #117

Open zvirja opened 1 year ago

zvirja commented 1 year ago

Scenario:

  1. Download recovery.img for LineageOS 19.1 from here: https://download.lineageos.org/devices/gemini/builds
  2. Unpack ./gradlew unpack
  3. Repack without any changes ./gradlew pack

After that I try booting using fastboot boot - it hangs for a bit and later phone simply boots to a normal boot instead of recovery. Of course I can boot LOS recovery or TWRP - that works just fine.

I've tried all of the output images - none of them works. I also tried with LineageOS 18.1 recovery - the same issue. So I imagine it's device specific.

The unpack/pack output does not contain any error and everything looks smooth.

I found that you don't specifically support Xiaomi MI5, but you seem to support other Xiaomi device.

Could you please suggest what the possible issue could be?

Thank you very much for your time and the tool - it's great!

zvirja commented 1 year ago

After further testing I found that the following steps works:

  1. Unpack using tool: ./gradlew unpack
  2. Repack without modifications of RAM disk: aosp/system/tools/mkbootimg/mkbootimg.py --header_version 0 --base 0x0 --kernel "build/unzip_boot/kernel" --kernel_offset 0x80008000 --ramdisk build/unzip_boot/ramdisk.img.xz --ramdisk_offset 0x81000000 --pagesize 4096 --cmdline "androidboot.hardware=qcom ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff loop.max_part=7 buildvariant=userdebug" --os_version 11.0.0 --os_patch_level 2023-03-00 --tags_offset 0x80000100 --id --output recovery.img.custom

I am able to boot the produced recovery.img.custom.

So it looks like the issue is somewhere in the RAM disk building 😕

zvirja commented 1 year ago

I finally found what is the issue. When compressing the file to xz, you use CRC64 by default. But Xiaomi gemini fails for that and works only if I use CRC32. The default LienageOS ramdisk compression method is following: LZMA2:25 CRC32

I can achieve this effect invoking xz -zkf recovery.img-ramdisk -8 --check=crc32

I quickly checked your source code and it seems XZCompressorOutputStream does not support specifying the compression method 😟

cfig commented 1 year ago

Thanks for the professional ticket and the great analysis. I didn't notice the CRC32/64 part, so it would be better to set the CRC32 as default for xz? (if XZCompressorOutputStream, I may turn to xz command instead, but it loses some portability a little bit).

cfig commented 1 year ago

Hi @zvirja, Can you attach the "recovery.img" again? Previous download link doesn't work now.

cfig commented 1 year ago

xz file format: https://tukaani.org/xz/xz-file-format.txt 2.1.1.2. Stream Flags

Supported by: https://github.com/cfig/Android_boot_image_editor/commit/e7ed8fb8e3445a840cc6f8002f3611c97d5a75a6

cfig commented 1 year ago

I finally found what is the issue. When compressing the file to xz, you use CRC64 by default. But Xiaomi gemini fails for that and works only if I use CRC32. The default LienageOS ramdisk compression method is following: LZMA2:25 CRC32

I can achieve this effect invoking xz -zkf recovery.img-ramdisk -8 --check=crc32

I quickly checked your source code and it seems XZCompressorOutputStream does not support specifying the compression method worried

We can set CRC32/CRC64 now. But I haven't found way to identify the compression level of a xz file, so the compression level is still default(6) when packing ramdisk.

cfig commented 11 months ago

Maybe related with this issue: https://github.com/cfig/Android_boot_image_editor/issues/128

Rofikkernel commented 11 months ago

https://github.com/kdrag0n/velocity_tissot/blob/master/flasher/boot-patcher.sh

i found that crc32 in that link but for xz format only using that

case "$rdformat" in bzip2) compress="bzip2 -9c" ;; gzip) compress="pigz -p 8 -9c" ;; lz4) compress="$bin/lz4 -9" ;; lzo) compress="lzop -9c" ;; lzma) compress="$bin/xz --format=lzma --lzma1=dict=16MiB -9" ;; xz) compress="$bin/xz --check=crc32 --lzma2=dict=16MiB -9" ;; *) abort "Unknown ramdisk compression format ($rdformat)" ;; esac

in unpacked vendor_boot.img alioth ramdisk in gz format