search

cfig / Android_boot_image_editor

Parsing and re-packing Android boot.img/vbmeta.img/payload.bin, supporting Android 15
Apache License 2.0
1.04k stars 232 forks source link

Pixel6 official boot.img unpack failed #93

Closed 5n0wfish closed 2 years ago

5n0wfish commented 2 years ago

The ver 12.1.0 (SP2A.220405.004, Apr 2022) unpack succeeded, but the ver 12.1.0 (SQ3A.220705.003, Jul 2022) had wrong.

cfig commented 2 years ago

boot.img in "oriole-sq3a.220705.003":

$ md5sum boot.img
8d71e89f8a0ecc288e14ca7d06cb0e99  boot.img

My local test pass.

Can you paste your log?

5n0wfish commented 2 years ago

Yeah, oriole-sq3a.220705.003=>boot.img can be certainly unpacked. But boot.img=>kernel is not a really kernel.

$ hexdump -C kernel |head -5
00000000  02 21 4c 18 fd 8d 3e 00  95 4d 5a 00 91 ff bf 9a  |.!L...>..MZ.....|
00000010  14 00 01 00 20 cc 02 06  00 2f 0a 00 01 00 0b f9  |.... ..../......|
00000020  00 41 52 4d 64 40 00 00  00 50 45 00 00 64 aa 02  |.ARMd@...PE..d..|
00000030  1c 00 f1 00 a0 00 06 02  0b 02 02 14 00 00 96 02  |................|
00000040  00 00 35 14 00 76 e8 03  6b 02 00 00 01 26 00 00  |..5..v..k....&..|

In a really kernel like SP2A.220405.004 , ARMd is located at offset 0x38, but oriole-sq3a.220705.003 not.

cfig commented 2 years ago

Good catch ~

Latest boot.img=>kernel is an lz4 compressed kernel. If you decompress it:

red➜  ~/work/boot git:(394bfc5) ✗ lz4cat build/unzip_boot/kernel | xxd -g1 | head -5
00000000: 4d 5a 00 91 ff bf 9a 14 00 00 00 00 00 00 00 00  MZ..............
00000010: 00 00 cc 02 00 00 00 00 0a 00 00 00 00 00 00 00  ................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030: 00 00 00 00 00 00 00 00 41 52 4d 64 40 00 00 00  ........ARMd@...
00000040: 50 45 00 00 64 aa 02 00 00 00 00 00 00 00 00 00  PE..d...........

You can see "ARMd" is located at the expected offset. Cheers!

cfig commented 2 years ago

Close it. Please comment if you still meet any problems ~