Database Users

Modify boot.img to have true root

I am trying to unpack boot.img and modify the property in default.prop file.
But after I flash the modified boot.img, the phone cannot boot.
I think the only step that I can go wrong is the parameter of mkbootimg.
And here is the command line that I use.
./mkbootimg --kernel boot.img-kernel --ramdisk boot.img-ramdisk.cpio.gz --base 0x81000000 --pagesize 4096 --ramdiskaddr 0x81800000 -o boot.img
Original boot.img is attached, it is actually nexus4 4.4 boot.img.
Thanks!

What do you mean by true root? And the android kernel is just different from the default Linux kernel, so I'd say their commands might not be interchangeable.
Sent from my Nexus 4 using Tapatalk

Build own kernel and stuck on LG logo

Hi,
if i try to build my own kernel for d802, i have a little problem. it should be for cm-11.0 and i tried the stock cm-11.0 kernel to test it.
i use:
./dtbTool -s 2048 -o dt.img -p cm11/scripts/dtc/ cm11/arch/arm/boot/
to get my dt.img
and:
./mkbootimg --kernel cm11/arch/arm/boot/zImage --ramdisk ramdisk.gz --cmdline "console=ttyHSL0,115200,n8 androidboot.hardware=g2 user_debug=31 msm_rtb.filter=0x0" --base 0x00000000 --offset 0x05000000 --tags-addr 0x04800000 --pagesize 2048 --dt dt.img -o boot.img
to build the boot.img (ramdisk extracted from cm11).
i put it into a loki-fied .zip to install it and the installation works, but if i try to boot it stuck on lg logo. can anyone help me? is there a problem with my lines above?

AuxXxilium said:
Hi,
if i try to build my own kernel for d802, i have a little problem. it should be for cm-11.0 and i tried the stock cm-11.0 kernel to test it.
i use:
./dtbTool -s 2048 -o dt.img -p cm11/scripts/dtc/ cm11/arch/arm/boot/
to get my dt.img
and:
./mkbootimg --kernel cm11/arch/arm/boot/zImage --ramdisk ramdisk.gz --cmdline "console=ttyHSL0,115200,n8 androidboot.hardware=g2 user_debug=31 msm_rtb.filter=0x0" --base 0x00000000 --offset 0x05000000 --tags-addr 0x04800000 --pagesize 2048 --dt dt.img -o boot.img
to build the boot.img (ramdisk extracted from cm11).
i put it into a loki-fied .zip to install it and the installation works, but if i try to boot it stuck on lg logo. can anyone help me? is there a problem with my lines above?
Click to expand...
Click to collapse
hey .. that looks correct to me. what rom are you trying to boot your boot.img with? i know if u using the latest CM11 branch it adds alot of commits that require new blobs .. unless that rom has those new blobs it won't boot.

houstonn said:
hey .. that looks correct to me. what rom are you trying to boot your boot.img with? i know if u using the latest CM11 branch it adds alot of commits that require new blobs .. unless that rom has those new blobs it won't boot.
Click to expand...
Click to collapse
i tried on a your rom but it didn't boot. i'll try it on cm11 to confirm it. thx for your help.

[Tutorial]Kernel Post Compilation Guide; how to turn kernel into img

There are many great guides online on how to compile a kernel, but they often skimp on the last and most important part, how to get it into a working img. Therefore, without further ado, these are the steps
Prerequisites:
-Linux
-Good-ish command line experience
-Mkbootimg https://github.com/Team-DevElite/mkbootimg-python3
-you will need this https://forum.xda-developers.com/showthread.php?t=2073775
-Python 3
Step 1:
-Extract image kitchen
-Download a working kernel and extract boot image
-Place it into image kitchen's folder
-Type this into the terminal(of course, set permissions first)
Code:
./unpackimg.sh <boot image>
You will now get something similar to this.
Code:
BOARD_KERNEL_CMDLINE androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] coherent_pool=2M enforcing=0
BOARD_KERNEL_BASE 80000000
BOARD_NAME
BOARD_PAGE_SIZE 4096
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 00008000
BOARD_RAMDISK_OFFSET 02200000
BOARD_SECOND_OFFSET 00f00000
BOARD_TAGS_OFFSET 02000000
SAVE THE OUTPUT INTO A TEXT FILE
Step 2: Getting the Ramdisk
-Go to the folder, split_img
-Copy ramdisk.cpio.gz into a conveinient folder
Step 3:
Now, get the values from Step 1
-Seperate them like this and get rid of whitespace between the \s
Code:
--ramdisk <ramdisk location> \
--cmdline "androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] coherent_pool=2M enforcing=0" \
--base 0x80000000 \
--pagesize 4096 \
--ramdisk_offset 0x02200000 \
--tags_offset 0x02000000 \
Now Figure out the directory of your compiled kernel
64bit
Code:
arch/arm64/boot/
32bit
Code:
arch/arm/boot
Depending on your kernel, the kernel file will either be image-gz.dtb or zImage.
Either way its the same step.
Next, add this argument to the one we made above
Code:
--kernel <path to kernel output file>
Step 4 FINAL:
-Set the permissons for mkbootimg
-add this argument to the one above
Code:
--output boot.img
Now your arguments list should look something like this
Code:
--kernel <kernel file> \
--ramdisk <ramdisk file> \
--cmdline "androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected]
coherent_pool=2M enforcing=0" \
--base 0x80000000 \
--pagesize 4096 \
--ramdisk_offset 0x02200000 \
--tags_offset 0x02000000 \
--output boot.img \
-cd into the directory containing mkbootimg
-Now add ./mkbootimg to the front of it and execute!
-Check that it looks something like this
Code:
./mkbootimg \
--kernel <kernel file> \
--ramdisk <ramdisk file> \
--cmdline "androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] coherent_pool=2M enforcing=0" \
--base 0x80000000 \
--pagesize 4096 \
--ramdisk_offset 0x02200000 \
--tags_offset 0x02000000 \
--output boot.img \
you should now see a boot.img generated
HIT Thanks if I helped
thanks to @osm0sis for his awesome tools!

Thanks for nice and easy guide

Manjot xda said:
There are many great guides online on how to compile a kernel, but they often skimp on the last and most
Thanks for nice and easy guide
Click to expand...
Click to collapse
Thank you, and please don't quote the op, please edit and shorten your post.
Regards
-LLJY

Sry mostly i use other forums there is no rule like don't quote whole op so ignore that post edited. Again nice tutorial

Missed the ramdisk flag while building the new image and my device failed to boot multiple times. Thanks for the detailed guide (pressed the button )!

Can you make a guide video ? And this can not work on Windows ?

shinigami_tsin said:
Can you make a guide video ? And this can not work on Windows ?
Click to expand...
Click to collapse
No to both

I know this is a rather old thread, but I just wanted to say thank you for this. I do a lot of modding and other tricks and hacks on Amazon Fire HD 10 (we were just recently able to unlock them) and it was nice to read a small and straight forward guide without anything being deleted or commented out. As such, I was able to use this method to make a fresh boot.img and it booted the very first time. It's an awesome feeling when that happens, given we often do more unintentional (or intentional) destruction to them.

Can't repack boot image

Hello,
I am trying to edit the boot.img (modified to not force encrypt the userdata) of my device.
I extracted the boot image with umkbootimage and then I extracted the initramfs with the following command:
Code:
gunzip -c ../initramfs.cpio.gz | cpio -i
Then i repacked the ramfs with the command (without changing nothing):
Code:
find . | cpio -o -H newc | gzip > ../new-ramdisk.cpio.gz
Finally, I repacked the boot image with mkbootimg and the following arguments:
Code:
mkbootimg --kernel zImage --ramdisk new-ramdisk.cpio.gz --base 0x0 --ramdisk_offset 0x002000000 --tags_offset 0x01e00000 --cmdline 'androidboot.hardware=angler androidboot.console=ttyHSL0 msm_rtb.filter=0x37 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 boot_cpus=0-3' --pagesize 4096 -o new_boot.img
The new boot image won't boot up. When I use the original initramfs to create the boot image, everything works great.
Another issue is that after the repacking the size of the initramfs changed.
Someone have any idea what should I do?

@batman1010 you need that

How to repack boot.img

Hi.
I have successfully rooted SM-T725 device and installed twrp. After booting in twrp I get boot.img.
Code:
dd if=/dev/block/by-name/boot of=/data/media/0/Download/boot.img
I unpack boot.img with tool from github /osm0sis/pxa-mkbootimg.git with command
Code:
./pxa-unpackbootimg -i boot.img -o out
When I try to pack it again with command
Code:
./pxa-mkbootimg --kernel out/boot.img-zImage --dt out/boot.img-dt --base 0 --pagesize 4096 --board SRPRL03A001 --kernel_offset 0x00008000 --ramdisk_offset 0x02000000 --second_offset 0x00f00000 --tags_offset 0x00000001 --cmdline "console=null androidboot.hardware=qcom video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 swiotlb=1" --output boot-new.img
it makes file with different size then original boot.img
and after flashing to boot partition, the device boots in download mode with the following error:
"partition vbmeta
Reason vbmeta: Error verifying vbmeta image: O_O_INDIVLDVMT_EDRHS_IMTHSGAUEMSAC"
How can I fix this?

I solved it. I used wrong pxamkbootimg. You need to use mkbootimg, not pxamkbootimg.
I used all parameters that unpackbootimg shows when unpacking boot.img, so the correct command is
Code:
./mkbootimg --kernel out.boot/boot.img-zImage --ramdisk out.boot/boot.img-ramdisk.gz --output boot-new.img \
--board SRPRL03A001 --base 0 --pagesize 4096 --hash sha1 \
--os_version 9.0.0 --os_patch_level 2019-03 --header_version 1 \
--kernel_offset 00008000 --ramdisk_offset 02000000 --second_offset 00f00000 --tags_offset 01e00000 \
--cmdline "console=null androidboot.hardware=qcom video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 swiotlb=1"
Now my boot-new.img is working and tablet boots to android well.

Hi,
I just bought same model and like to know wich method you used.
i don't ask for a comlete guide as i know the amount of time and answer it comes with, but just know i you find a sm-t725 specific way or used a wifi version designed for.
Thx.

LtGarcia said:
Hi,
I just bought same model and like to know wich method you used.
i don't ask for a comlete guide as i know the amount of time and answer it comes with, but just know i you find a sm-t725 specific way or used a wifi version designed for.
Thx.
Click to expand...
Click to collapse
At first I got root, instruction is here https://forum.xda-developers.com/tab-s5e/how-to/galaxy-tab-s5e-sm-t720-root-t3947806
After that I found that twrp is ready and flashed it, but lost root. I think because twrp and magisk lives in recovery now. https://twrp.me/samsung/samsunggalaxytabs5ewifi.html
Then I rooted twrp and flashed it again and now I have my device with twrp and root.
I used twrp for wifi version and it works.

Thanks i rooted yesterday with this post thinking i can use sm-t720 method and you just confirmed me i can use sm-t720 twrp (for sm-t725) too. I will try to do same as you did. My final challenge will be to find a way to change my TVV csc into XEF as this tablet seems to be regionnaly locked.
Thanks again for your help.