Related
Hi there,
Here is a command line tool that can extract and rebuild a flash.bin file for the LG KS20.
First, the options available :
Code:
LGFlashMuncher.exe [options] path [output]
EXTRACT Options ---(at least one option required)-----------------------------
-r : extract Raw data
-h : extract header
-m : extract MBR
-p : extract partitions
-t : trim extracted partitions
-l : output layout informations to file 'flash.xml'
-o : output OS.nb compatible file
output : path to output directory (must exists)
CREATE Options ---(all options required)-------------------------------------
-c file : create new flash.bin outputed to 'file'
(MBR and fat partition are taken from original flash.bin)
-e file : use 'file' for header
-0 file : use 'file' for partition 0 (boot)
-1 file : use 'file' for partition 1 (rawfs)
-2 file : use 'file' for partition 2 (imgfs)
COMMON Option ---------------------------------------------------------------
path : path to flash.bin file
Next, how to extract data from a flash.bin to a directory named output :
Code:
LGFlashMuncher.exe -htmlp FLASH.bin output
How to rebuild a new flash.bin :
Code:
LGFlashMuncher.exe -c newflash.bin -e header.bin -0 part_0_BOOT.bin -1 part_1_RAWFS.bin -2 part_2_IMGFS.bin FLASH.bin
(This rebuild process requires an existing flash.bin file)
At the moment, this tool use the partition layout and the empty fat32 (last partition) found in the original flash.bin file. The next step will be rebuild the partition layout.
I've made some test with this tool, but I cannot be sure it will work in all situations. Spocky had a preview of this tool a couple of days ago, and he successfully built a french 10G and a french 10A : I'm sure he will soon share his knowledge...
Very Nice job !
Thank.
Très bon travail MisterJP.
Merci.
Does this mean we can flash the files we extract with pdocread? (part00.raw, etc)
I think that for the moment only part02.raw
@+
dorik2k said:
Does this mean we can flash the files we extract with pdocread? (part00.raw, etc)
Click to expand...
Click to collapse
If the generated files are image of your phone partitions, then I guess it's possible if you respect the partitions order.
Hi, misterjp
In your LGFlashMuncher.exe there is an option:
-o : output OS.nb compatible file
I am just wondering is it FLASH.bin to OS.nb?
And is there any way to convert OS.nb back to FLASH.bin?
The reason that i want to do that is because in that case, i can convert a OS.nb which hv a larger partition table to Flash.bin for cooking
Thx in advance
Hi raykisi,
Sorry, but this tool is not able at this time to re-build an Flash.bin from an OS.nb file. It was just a test option while I was testing my code.
I'm planning on updating this tool, but it takes time and I don't have many these days.
JP.
o...gd to hear that you are going to update this tool, we would wait, take you time. And thx for your great work
Hey, sorry about the question.. i know i'm such a noob, but i'm brazilian and my "english understanding" is kind of weak sometimes.. So...
Is there any way to extract the Flash.bin and others of my current ROM? I mean, the actual ROM of my phone?
I'm asking this because here in Brazil we have the MS25/MS20.. A kind of KS20 without 3G, wifi, and front camera devices.. but same processor and same everithing else.. so, I think LG BRASIL will not provide the roms so early, but the v10a are full of bugs! Also i can`t flash with a KS20 rom, because that missing devices and because my operator phone frequency is 850 MHz (VIVO).
well, someone have an idea? Or a link? Or a read recomendation?
Brazilian people are really needing help with this, and we are getting tired to search with no answers..
Thank`s a lot!
QMAT - QC Mobile Analysis Tool
What is it ?
It is a development and debugging tool for Qualcomm mobiles - the only tool you'll ever need for research and development.
Who may need it ?
Mobile engineers / reverse engineers and cryptoanalysts
Crypto Functions :
- Calculate CRC-30, CRC-32, SHA1, SHA2 (SHA224 + SHA256), MD4 and MD5 of any file
- Bruteforce bytes to fit CRC-30 needed when qcsblhd_cfgdata.mbn was edited
- Decrypt and Encrypt any RSA-Message, including ASN-1 / SHA Signatures. (you can add publickeys to publickeys.xml)
- Generate RSA Private Key and create .pvk files
- Check firmware signature given Modulus and Exponent (for HTC and BQS mobiles)
- Extract information from .pvk files
- Search for algorithms in binary files (find cryptomethods + signatures) CRC8, CRC16, CRC32, MD4, MD5, SHARK, HAVAL, GZIP, ZIP, SHA1, ... and much more (you can add cryptosignatures to crypto.xml)
JTAG Interface :
(soon via Segger J-Link)
Functions for QC mobiles :
1. Load binary files for :
Extraction of certificates
Extraction of BMPs,GIFs,PNGs, JPGs
2. Load Partition File to get overview about NAND/NOR structure
3. Send any String to a COM/USB Port and backup all your SMS !
4. Make usage of QCs Diag USB/COM Port Interface
(Useful for any QC mobile in the world)
Standard Features :
- Send standard diag commands or any hexadecimal command you want (database included)
- Read out all NVItems (range given)
(all that exist, more than QPST normally extracts)
- Backup and Restore all NVItems
- Read out and Dump Firmware in Memory (SRam)
- Read out complete EFS
- Switch to FTM Mode (or anything else you want)
- Get infos about phone, codes ..... etc ..... a lot more functions
- Generate SimSecure Command to write to SimSecure using given file (may brick your phone when used without knowledge)
- Full Feature EFS Browser
Bootloader / DownloadMode Features :
- Load any file to mobile at any address and execute (bootloader f.e.)
- Read out complete NAND Memory using bootloader (range given) with included MSM6250/A bootloader or any given bootloader
Usage : Take out battery, put in battery, press ON # to enter emergency mode, Execute Loader
or (with SL91,SF71 f.e.) enable FTM mode, Execute Loader
- Use any Download Mode or Bootloader Command to experiment
- Read application memory of newer Diag Ver 6 in Download Mode
- Show complete infos about used NAND after loading of Bootloader
Flasher Features :
Flash any QC mobile (OBL Multiboot) with given bootloader
- Flash PBL (dangerous), QCSBL, QCSBL Header and Config Bits, Partition, OEMSBL, OEMSBL Header, AMSS, AMSS Header and EFS
Functions for BQS only :
1. Load AMSS to extract files or useful infos
(EF81, E81C, EF91, SXG75, EF82, SF71, SL91 or similiar ones)
Features :
Extract Infos from AMSS : USBID, Product.Nr., SVN, SwBuild, Mobiletype
Extract internal filesystem (mif,bar,sig etc. files)
Extract AMSS signature bytes (if production key)
Show all file references used by mobile
2. Check Firmware validity (signature)
3. Sim_Secure extraction/decryption (non-public)
4. Master-/Usercode/Unlock extraction and direct unlock (non-public)
Functions for HTC only :
1. Check validity of HTC firmware (signature check)
2. Cut out signatures from .nbh file
3. Split radio.nb into qualcomm files for analysis
4. Find HTC Public keys using Cryptosearch
5. Generate Security passwords (SPL + radio) for newer HTC
6. Generate NBH Files (you can add any device into devlist.xml)
7. Dump Files from NBH (you can add any type into nbhtype.xml)
8. Fix radio.nb checksum
9. Generic Bootloader / AT Command interface with logging functions
Functions for Network Engineers
Network Calculators :
TDMA (GSM/UMTS) :
--------------------
IMEI
GSM A5-1
GSM A5-2
GSM A5-3
3G ECSD
GEA3 - GPRS
3G SNOW
3G UEA2
3G UIA2
GSM A3/A8 COMP128 V1
GSM A3/A8 COMP128 V2
GSM A3/A8 COMP128 V3
3G Milenage
3G Milenage Resync
CDMA :
-------
CAVE
CAVE Authentication
CAVE CMEA
CAVE EMEA
CAVE EMEA_NF
CAVE Wireless Residential Extension
CAVE Datakey / Look Up Table / Mask
CAVE DTC / DCCH
CAVE KSG
CAVE Long Block
CAVE Short Block
CAVE Enhanced Message
CAVE Enhanced Voice Privacy
CAVE Enhanced Data Mask
and much more ....
Planned in future :
1. Bugfixes
2. EFS Restore to Zip File
3. QC Jtag interface using Segger J-Link ARM
4. LNBS HTC support to replace MTTY 5. Tooltips showing real addresses in graphical window
5. CDMA Write functions
6. Read out / Write back Addressbook
7. Restore backupped SMS to phone
8. much much more
NO UNLOCKING ! PLEASE DO NOT REQUEST. THIS PROJECT IS FOR EDUCATIONAL PURPOSES ONLY, NOT TO HARM COMPANIES FOR THEIR EFFORTS.
What we need :
- Any contribution to the project is welcome.
- Donations for new hardware and software for further development of this tool.
Link to the project files :
------------------------
Version 4.21 (Major Release) Stable
QMAT Homepage
Cya and keep on reversing,
Viper BJK
==> Donate via PayPal <==
Thanks, that's very useful. Keep up the good work!
Update : Version 3.51
---------------------
- Crypto Bugfixes solved
- Com Port Bugfixes solved
Added QMAT 3.51 manual to download page
Cya,
Viper BJK
Update : 3.52
-------------
What's new ?
1. Added SHA2 crypto search algos (SHA224 and SHA256)
2. Added SHA2 (SHA224 and SHA256) and MD5 hash generation
3. Some Bugfixes
4. HTC Security Generator for all newer HTC models (reverse genned) :
SPL and radio (works with Diamond !!)
Note : For Copy'n'Paste .. do not use MTTY, but Putty !!!
See new manual for further details ....
Enjoy !
Cya,
Viper BJK
nice one..!
Thanks
New version : 3.54
------------------
Updates :
- Added SHA-256 from HTC
- Improved RSA Decryption ... now better readable
- Added function to reverse byte strings for RSA Decryption
- Bugfixes
Cya,
Viper BJK
Update:
Small SHA2 bugfix
Good information. thanks
New version : 3.6
------------------
Updates :
- Added NBH Generator Tool
=> you can add any device to devlist.xml
=> you can sign rom files either using pvk file or using dummy signature
- Added NBH Dump Tool
=> Remove Signatures function or
=> Extract any part you wish or
=> Extract all files from nbh
=> Show infos about nbh file
=> Add new deviceparts (typeinfo) to nbhtype.xml
- Added publickeys as XML
=> add any public key to publickeys.xml
- Added tool to fix radio.nb checksum
Bugfixes :
- Fixed NBH Signature extraction
- Fixed RSA Function
For the design of NBH Tools, I was strictly influenced by Olipro's work
Cya,
Viper BJK
This is a real work....!!!!
thx for this great program
Update : 3.61
-------------
What is new ?
-------------
After being fed up with buggy Putty + Mtty, I implemented
HTC Bootloader AT Command Interface. (see picture below)
Also I was missing a good copy paste function for my hex editor.
Why wasn't it working before ?
=> HTC Bootloader isn't able to take more than one byte sent.
So :
- Implemented HTC Bootloader AT Command Tool (works also for other ones)
- Several severe bugfixes (like Display fixes)
- Fixed RSA Decryption bug (Pubkeys loaded incorrectly from xml)
What will be next ?
------------------
As I'm a Vista user (sic!) I also use the really old Activesync driver.
But this one lacks of high-speed transfer, so I'm going to implement a solution
for newer HTC phones and newer OS, as Micros*** changed to WinUSB Interface (which is better imho than virtual com port).
So :
- Will implement REAL Usb interface, no virtual serial port use
Cya,
Viper BJK
Small update :
--------------
WinUSB is now fully implemented !
It really works like a charm, much faster than putty or mtty, and really stable.
mb command runs like hell
Even better, you can break off USB connection and continue seconds after reading out bytes .... this is big news
So ... Vista Users, use new WMDC drivers, forget about old activesync one.
And as for the XP users, download WinUSB runtimes now
Bad to say, but of course WinUSB won't work with old activesync.
I'm going to implement now a logfunction for binary data, so it can be used with pdump. Once I understand how "autodownload" works, I will implement it also so that my tool can replace mtty.
If there are any wishes what should be implemented, say so
Of course I will open source for WinUSB connection for those who want to port their tools.
Cya,
Viper BJK
Update 3.70
------------
What is new ?
--------------
- Big bugfixes
- Added new WinUSB and Serial Interface for HTC Bootloader (with binary log AND pdump support)
- Added partition tool to show MORE info
- Complete new Serial interface
- Added feature to use different bootloader commands for nand reading
- Added feature to read different sizes for nand reading
- Fixed radio.nb extraction
- Fixed radio.nb checksum calculation
- etc. ..... see Manual 3.7 for complete introduction
Cya,
Viper BJK
Update 3.71
------------
Sorry for that one ... WinUSB didn't work due to memory leak.
Fixed ....
Cya,
Viper BJK
Update 3.72
------------
What's new ?
-------------
- Included HTC Security Decoder in AT Command Interface
(easier to use)
- Fixed USB / SER Problems
- HTCE/HTCS were not displayed correctly
- Fixed Display Scroll Problems in AT Command Interface
Enjoy !
Cya,
Viper BJK
Update 3.73 *Speed release !*
------------
As someone really needed this func, the following was added :
- htc at command interface bytelog can now be any filename (select log file)
- You can send any data to encapsulate, for example you want to send bytes 0x00 0x01 0x02 and 0x03 .... enter "00010203", press encap button and
bytes will be send using correct HTC "HTCS....HTCE" encap
Cya,
Viper BJK
- removed -
Update 3.74 *Special Edition for CMonex*
------------------------------------------
News :
- Added function to upload files in encapsulated header
- Bugfixes
Cya,
Viper BJK
News :
-------
3.74 has a lot of bugs in it, so sorry for that.
Download of my tool is atm not possible, I'm looking for another hoster.
New version 3.75 will be soon out, adding several bugfixes and nvitems support for HTC. Also, beginning with 3.75, my software will be shareware.
People that already donated 15 EUR will of course get source and registration key as usual for free.
Expect news soon.
Cya,
Viper BJK
ThanX Alot for this GREAT Tool !
Keep up your Good Work !
Is it possible to upload this tool on the board ? I have a forbidden acces to the google code page ... :'(
Auto Installer V1.0
Synopsis:
I've written a small utility with a whole mix of features, primarily designed to enable easy setup of your favourite cabs, shortcuts, icons etc...
It's written in Mortscript, but you don't need to worry about that... everything is installed from a plain text INI file:
Features:
-Specify which cab files to install automatically (silently, or with user interaction)
-Specify which registry entries to create / modify
-Specify Hi-Res custom icons for your applications and tools (WM6.5 Only)
-Specify which shortcuts to create in the Start/Program Files menu
-Specify the Start/Program Files menu structure (groups/folders etc)
-Specify TF3D shortcuts for Manila 2 and 2.5
-Specify TF3D weather locations for Manila 2 and 2.5
-Specify HTC Task Manager 'x' button options
-Specify Windows Screen Font Size
-Choose to execute every item in your setup config, or just execute specific sections.
Coming Soon Features:
-Specify files you'd like to back up
-Specify tasks to kill before install
-Specify tasks to start after install
Installation Instructions:
-Download zip file here: AutoInstaller V1.0
-Extract the zip file to a folder of your choice on your device (preferably on the SD Card so that it's not lost after a hard reset!
-Read the usage guidelines
-That's it
Usage Guidelines
Usage Guidelines:
The application contains 3 files:
1) AutoInstaller.exe (this is the main executable file)
2) AutoInstaller.mscr (this is the source code for the script. Do not modify this file unless you're a script programmer)
3) AutoInstaller.ini (this the file that you edit to configure)
All three files MUST reside together in the same folder (any folder)
AutoInstaller.ini and how to:
Cab File Installation
You can install multiple cab files using the [Cab Install] section of the ini file.
The format of each entry in the section must be as follows:
<Unique Friendly Name>=<Cab filename>,<Silent install>
<Unique Friendly Name> MUST be unique, but is just any friendly string identifying the cab to be installed.
<Cab filename> is the full path to the cab file to install
<Silent install> determines if the installation should be silent (TRUE) or interactive (FALSE). Note: Most cab files will install silently, but some will still force user interaction. This is not a problem, but be aware that some files do this.
Also be aware, that if a cab file forces a reboot of the device without asking, then this cab is not suitable for installation via this script, since a reboot will terminate the script.
Example:
[Cab Install]
Facebook =\Storage Card\Setup\Install Cabs\Facebook\Facebook_v1.0.0.7p.cab,TRUE
Google Maps=\Storage Card\Setup\Install Cabs\Google Maps\GoogleMaps.cab,TRUE
My Mail Settings=\Storage Card\Setup\Install Cabs\My Mail Settings\MyMailSettings.cab,TRUE
SPB Wireless Monitor=\Storage Card\Setup\Install Cabs\SPB Wireless Monitor\SpbWirelessMonitor3.arm.cab,TRUE
Total Commander=\Storage Card\Setup\Install Cabs\Total Commander\tcmdpocketarm.cab,TRUE
WunderRadio=\Storage Card\Setup\Install Cabs\WunderRadio\wunderradio_ppc.cab,TRUE
Panoramic Calc Pro=\Storage Card\Setup\Install Cabs\Panoramic Calc Pro\PanoramicCalcPro.cab,TRUE
Neos Driver Pack=\Storage Card\NeoS2007_Driverpack_3.cab,TRUE
Registry Writes
Registry entries to be created/written can be specified in the [Registry_Writes] section of the ini file.
The format for each entry in the section must be as follows:
<RegistryKey>=<>,<Value>
<RegistryKey> is the full path of the key to be written
<Type> is the type of value to be written to the registry, it may be STRING, DWORD or BINARY
<value> is the actual value to be written
Example:
[Registry_Writes]
HKCR\CLSID\{DD9B73F6-9EED-4ED0-84CF-422AF83512DB}\fileext=STRING,6a5KkkrKKwKK
HKLM\Software\jeyo\WunderRadio\regcode=STRING,12345678931B
HKLM\Software\jeyo\WunderRadio\regver=STRING,151W14
Usage Guide
Create Shortcuts
Shortcuts to be created can be specified in the [Create Shortuts] section of the ini file.
The format for each entry in the section must be as follows:
<shortcut file to create>=<file to link to>
<shortcut file to create> is the full path of the shortcut file to be created
<file to link to> is the full path of the target file being linked to
Example:
[Create Shortcuts]
\Windows\Start Menu\Programs\iGO8.lnk=\Storage Card\igo8\iGO8.exe
\Windows\Start Menu\Programs\Reboot.lnk=\Storage Card\Scripts\reboot.mscr
Move Files
Files to be moved may be specified in the [Move Files] section of the ini file.
The format for each entry in the section must be as follows:
<Source File>=<Destination File>
<Source File> is the full path of the file you wish to move
<Destination File> is the full path of the file you wish to move it to
Example:
[Move File]
\Windows\Start Menu\Programs\iGO8.lnk=\Windows\Start Menu\Programs\Navigation\iGO8.lnk
\Windows\Start Menu\Programs\reboot.lnk=\Windows\Start Menu\Programs\Utils\iGO8.lnk
Create Custom Icons (WM6.5 Only)
Custom Hi Res Icons in PNG (with transparency) may be specified in the [Custom Icons] section of the ini file.
The format for each entry in the section must be as follows:
<Start menu link file>=<png file>
<Start menu link file> is the path of the lnk file RELATIVE to the \Windows\Start Menu\Programs folder
<png file> is the full path of the desired png file to use for the custom icon. NOTE: the png file MUST be exactly 90x90 pixels.
Example:
[Custom Icons]
iGO8.lnk=\Storage Card\Custom Icons\iGO8.png
Google Maps.lnk=\Storage Card\Custom Icons\Google Maps.png
TF3D Shortcuts
TF3D V2 or V2.5 shortcuts can be specified using the [TF3DV2 Shortcuts] or [TF3DV2.5 Shortcuts] section of the ini file.
The format of each entry in the section must be as follows:
<shortcut index>=<friendly name>,<shortcut target>
<shortcut index> is the position / index of the shortcut entry (0 to 17 for TF3D V2) or (0 to 8 for TF3D V2.5)
<friendly name> is the friendly name of the shortcut that will be displayed on the TF3D screen
<shortcut target> is the full path of the target file
Example:
[TF3DV2 Shortcuts]
0=Igo8,\Storage Card\igo8\iGO8.exe
[TF3DV2.5 Shortcuts]
0=Igo8,\Storage Card\igo8\iGO8.exe
3=Google Maps,\Google\Google Maps.exe
TF3D Weather Locations
TF3D (V2 or V2.5) weather locations can be specified in the [TF3D Weather Locations] section of the ini file.
The format of each entry in the section must be as follows:
<weather index>=<weather location>
<weather index> is a value from 0 to n representing the order/index of the weather locations
<weather location> is a specially formatted location string identifying the location (more in this later, there's a utility to 'grab' them included in the installer!
Example:
[TF3D Weather Locations]
0=EUR|UK|UK001|ABERDEEN
1=EUR|UK|UK001|LONDON
2=EUR|UK|UK001|BRISTOL
3=EUR|UK|UK001|LIVERPOOL
Screen Options
Screen option can be specified using the [Screen Options] section of the ini file.
The format of each entry in the section must be as follows:
<option name>=<value>
<option name> is either TextSize or TrueType
<value> depends on the <option name> for TextSize it can be Tiny, Small, Medium, Large or ExtraLarge. For TrueType it's either True or False.
Example:
[Screen Options]
TextSize=Tiny
TrueType=True
Reserved 3
Reserved for even more instructions
I'll give it a bash next time I flash a rom but it sounds a lot like Sashimi
crankshaft said:
I'll give it a bash next time I flash a rom but it sounds a lot like Sashimi
Click to expand...
Click to collapse
I strongly suspect it is... although I'm guessing a lot smaller and simpler...
I wasn't aware of Sashimi until you mentioned it, and I'm checking it out, although it looks pretty comprehensive, it also looks quite daunting.... meaning you may as well have written the installation in Mortscript in the first place by the time it's all configured!
However, I suspect there's a couple of nice little things in my script (like the custom icons, and TF3D weather etc that folks might find useful... I wrote it for myself, but thought I'd share!
have a little problem
when i run the AutoInstall.exe this error comes
There is no application associated with "AutoInstaller". Run the application first, then open this file from within the application
abzza,
You need MortScript installed.
I did tried. For some of my application which required manual interaction,
runwait doesn't do the proper thing as it continue on next cab installtion when some
manual dialog popped up.
Huawei Update Extractor
After messing around a bit with the perl tools available for extracting Huawei update.app files,
i got the idea to create an own (windows) tool.
Requirements
(All versions <= v0.9.9.3 need .Net Framework 3.5)
Latest version uses .Net Framework 4.6.1
Install
Extract the content of the zip to a folder somewhere on your system.
Execute HuaweiUpdateExtractor.exe
I'm planning to create an installer sometime.
Usage
Press the browse (...) button and select an update.app file. Select a device or unknown and press on the open button.
You'll see the content of the update.app file in the listview.
Select one or more files and right click. Choose Extract selected from the context menu.
Choose the ouput folder and press ok.
Or just right click on the list and select Extract all, choose the output folder again and press ok.
Press close on the extract window.
You can sort the list on sequence, filename and size. Just press on the desired column header.
Command line:
HuaweiUpdateExtractor extract input output [profile]
HuaweiUpdateExtractor repack input output profile
Profile
The profiles.xml file is used to identify the files in the update.app file. Every file in the update.app has a sequence or type, which is also
shown in the list. Those sequences or types are used to identify the file/device partition.
Example:
Code:
<?xml version="1.0"?>
<Profiles>
<Profile name="Unknown" author="worstenbrood">
<Files/>
</Profile>
<Profile name="Huawei G510-0100" author="worstenbrood">
<Files>
<File sequence="00000000" partition="/dev/block/mmcblk0p17">system.img</File>
<File sequence="40000000" partition="/dev/block/mmcblk0p13">recovery.img</File>
<File sequence="80000000" partition="/dev/block/mmcblk0p03">baseband.img</File>
<File sequence="EC000000">version.txt</File>
<File sequence="E4000000">splash.raw565</File>
<File sequence="FC000000" partition="/dev/block/mmcblk0p12">boot.img</File>
<File sequence="70000000" partition="/dev/block/mmcblk0p16">cust.img</File>
<File sequence="30000000" partition="/dev/block/mmcblk0p18">userdata.img</File>
<File sequence="FE000000" filetype="signature">signature</File>
<File sequence="FF000000" filetype="checksum">crc</File>
</Files>
</Profile>
<Profile name="Huawei P6" author="worstenbrood">
<Files>
<File type="system" partition="/dev/block/mmcblk0p16">system.img</File>
<File type="cache" partition="/dev/block/mmcblk0p17">cache.img</File>
<File type="cust" partition="/dev/block/mmcblk0p18">cust.img</File>
<File type="userdata" partition="/dev/block/mmcblk0p19">userdata.img</File>
<File type="modemimage" partition="/dev/block/mmcblk0p13">modemimage.img</File>
<File type="boot" partition="/dev/block/mmcblk0p12">boot.img</File>
<File type="recovery" partition="/dev/block/mmcblk0p11">recovery.img</File>
<File type="md5rsa" filetype="signature">signature</File>
<File type="crc" filetype="checksum">crc</File>
</Files>
</Profile>
</Profiles>
<Profiles>
- Root tag of the xml file.
<Profile>
- Identifies a device
- attribute name: name of the device
- attribute author: author of the device
<Files>
- File root tag
<File>
- Identifies a file
- attribute sequence: sequence of the file in update.app
- attribute type: type of the file in the update.app
- attribute partition: destination partition on the device
- attribute filetype: can be one of the following values:
* signature: used to identify the signature file
* checksum: used to identify the checksum file
- value: file name
You can add or edit devices. If you want them to integrate in newer version, pm 'em to me.
I'm gonna make some auto update for the device file somewhere in the future
To add your devices profile you'll have to identify your device partitions and map them against the files inside the update.app.
Thread about identifying partitions: http://forum.xda-developers.com/showthread.php?t=1959445
Roadmap
- You tell me ...
Credits
ZeBadger ([email protected]) for figuring out the file headers
S34Qu4K3 for the P6 partition layout
ngamyarthar for adding ALOT of devices!
Changelog
v0.9.1.0
- Create update zip works now, this requires to have a PERFECT device entry in the devices file. The sequence is used to identify the file AND partition. Only files that have these two will be included in the zip. USE WITH CAUTION, MAKE SURE THE PARTITION IS CORRECT OR YOU'LL END UP FLASHING THE WRONG IMAGES TO THE WRONG PARTITION !! I'M NOT RESPONSABLE FOR BRICKING YOUR DEVICE! IF YOU DON'T KNOW WHAT YOU'RE DOING, THEN DON'T USE IT!
v0.9.1.1
- Added Type to the filelist (shows INPUT for g510 roms, but shows some useful info on P6 roms)
v0.9.2.0
- Files now can also be identified by the type attribute in devices.xml
- Added P6 device
v0.9.3.0
- Crc check during extract
- Crc check during creating flashable zip
- Added row to see file is flashable
v0.9.5.0
- Added repack
- Added icons and tooltip
- Added settings
- Experimental, no signing on repack, crc file gets generated
- Alot of stuff i forgot
v0.9.6.0
- Added command line options
v0.9.7.0
- Added G300 profile (thx ZeBadger)
- Added detailed info about the file (libmagic) in the tooltip on the extract list. This way it is easier to identify files inside the update.
(see screenshot). It will detect ext/fat/... partitions.
v0.9.7.1
- Alot of devices added in profiles (Credits to ngamyarthar, thanks alot dude!)
- Added android boot/recovery image recognition in magic.mgc
v0.9.7.2
- Made setup
-v0.9.7.4
- App will now remember last used profile.
- Fixed bug in repack code (remainder writing)
- Added signing options (During repack, once set, it will use the selected keyfile (PEM format) and algorithm to create the signature file. If there is no file selected or the file doesn't exist, it will use the existing signature file.)
Example of keyfile content:
Code:
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDU9GF9tdk59edEXWX4MEJNjMqGce/CqqGZSDBwnAzHITZYBm+y
ZEVkaOGGdPY7rmmWO6w3P/+nPVHO0kxA1/J+FY+sbUF7uz0kzVDxuW6t5KDc9Qr4
NRAE1ZzX0eB0aYpLImlqI7yigih6ds+Yp83mTbF+BiaFTLLtMVdWS7wQiwIDAQAB
AoGBAMok2E4+Sl9sfwU0K1E2bhmzJaQNj2wYEKGyFtkuKCr16eIQ6gJKkFxJ+ppp
eDsaynujVUx04bbczEUo9t0un603s5HAGq6USO5flERco0TlNw7xnTornPPrNxfU
sXOtIGzb0FlRuC129JqZJ9QsfvOyt3KIWwmJqc0R/k0xB8uRAkEA9+v1ohNXB8CL
plhQOtq0ueWrf9CCCeiqhf6ijg7UEegMLGKZ2gFMvMNwuojz/pbQmHdWTU9eC0k1
3yiAwHtcLQJBANvkvjXdzCYHO6nWOH1vf8DRLwCnwEteyxJ2qnrqKLS3fxCjWN4h
4vSNqgC9uoLEb/6T/72XTdG9gS8GsuoAupcCQBZ4eIb8IcM+HGozTvJGqGLBAk5P
Y7nqMKp8bddaWLZWxeOv/CnaPE5PmIQPra3BlZ58EoJnUyrKs+tKDIFlrPECQQC9
Ie0cxc4e81+0/+WMtkdq4EGOTbsO2NTP57NQj3E9pwqqk+UPApSEBgkwJAB1E2LE
1CVGvAoaGeYwPZHLxZ63AkEAugR+cC+5/BtTeMeXEcijnU0qkgkwLCMgTB1DIoMm
X0/wRGPPmZpGmMStHd+87ZxQSOiq5nAyZ4riFXLziUNOlA==
-----END RSA PRIVATE KEY-----
-v0.9.7.5
- Default sorting on filename
- Small changes in structure of profiles.xml
-v0.9.7.6
- Added progress for signing and checksum generation
- Extract/CreateZip order by offset
- Repack order by Signature, Checksum, Files
-v0.9.7.7
- Doubleclick on item in extract files listview copies tooltip text to clipboard
- Added detailed android boot/recovery image detection to magic.mgc
- Added SecVRL header (the 2048 byte header in front of fastboot/boot/recovery image) detection
-v0.9.7.8
- Added timestamp options in settings
- Added tooltips in settings
- Some ui changes (which hopefully fix the missing "..." button issue)
-v0.9.7.9
- Some small ui fixes
- When saved location of the app is on a monitor that isn't attached anymore, app location is restored to center of primary screen.
-v0.9.8.0
- Some small ui changes
- Sort profiles by name
- Remember last used directory
- Added profile for Huawei G526 (Credits Roman Dmitriev)
-v0.9.9.0
- Added compatibility for wine/mono
- Fixed bug in settings (Verify header checksum)
- Made the app localizable (Download the Resources_EN example, if you make a translation, make sure that your assembly start with "Resources_" and ends with the TwoLetterISOLanguageName (eg. EN for english) of your culture and put the assembly in the same directory as the application)
- Added profile for Huawei Ascend Mate 7 (Thanks to sketchykingy)
-v0.9.9.1
- Added missing translatable resources (updated Resources_EN)
- Added profile for Huawei MediaPad X1 7.0 (7D-503L) (Credits ElectroMyStyle)
-v0.9.9.2
- Fixed int overflow (extracting big files)
-v0.9.9.3
- Added drag/drop for files and folders.
-v0.9.9.5 - 12/12/2016
- Upgraded to .Net Framework 4.6.1
- Fixed libmagic calling convention
- Huawei Mediapad M2 8.0 (M2-802L) profile by @beast.in.black
- Huawei Ascend P8 (GRA-L09) profile by @nexolight
- Huawei Mate S profile by @philipp900
- Huawei P8 lite profile by @linus2014
- Huawei Honor 5x (Kiwi-L2X) profile by @deadman96385
26122015
Created an opensource c# library to work with update.app files:
https://github.com/worstenbrood/HuaweiUpdateLibrary
Enjoy
Download
- v0.9.9.3: Setup - Zip
- v0.9.9.5: Zip
Mirror
Donate if you like my work.
Is it possible to repack update.app?
If so, could you implemet such feature?
xan said:
Is it possible to repack update.app?
If so, could you implemet such feature?
Click to expand...
Click to collapse
Since i almost finished update zip creation (new version tomorrow), i have put it on the roadmap (already thought about it anyway )
The problem is sign the app, not repack it
Sent from my HUAWEI P6-U06 using xda app-developers app
S34Qu4K3 said:
The problem is sign the app, not repack it
Sent from my HUAWEI P6-U06 using xda app-developers app
Click to expand...
Click to collapse
I dont think its signed, but it has a per file per block checksum which should be correct...
worstenbrood said:
I dont think its signed, but it has a per file per block checksum which should be correct...
Click to expand...
Click to collapse
So, repack is useless, i tried it, you need to resign the app to make the new checksums match or it will give you an error when you flash it via default recovery.
Don't missunderstand me, is a great tool, and simplifies the unpack/repack for more unexperienced users, but without the sign, you can't flash it, that's what i say that is a bit useless (like the other scripts to unpack and repack)
S34Qu4K3 said:
So, repack is useless, i tried it, you need to resign the app to make the new checksums match or it will give you an error when you flash it via default recovery.
Don't missunderstand me, is a great tool, and simplifies the unpack/repack for more unexperienced users, but without the sign, you can't flash it, that's what i say that is a bit useless (like the other scripts to unpack and repack)
Click to expand...
Click to collapse
I'll investigate some more when i have the time. Also the signing part is why i actually made a function to create a flashable zip from it, this way you CAN flash it with a custom recovery (ok you need an unlocked bootloader, but why would'nt you do that anyway )
worstenbrood said:
I'll investigate some more when i have the time. Also the signing part is why i actually made a function to create a flashable zip from it, this way you CAN flash it with a custom recovery (ok you need an unlocked bootloader, but why would'nt you do that anyway )
Click to expand...
Click to collapse
That's great
Huawei Update Extractor
v0.9.2.0
- Files now can also be identified by the type attribute in devices.xml
- Added P6 device
Click to expand...
Click to collapse
Please add Ascend P2
Thanks
Carlos Varella said:
Please add Ascend P2
Thanks
Click to expand...
Click to collapse
S34Qu4K3 made a nice post on how to identify the partitions on your phone, after identifying them you have to map them to the files inside the update.app. Since i don't have access to an P2 i'm counting on you guys to complete the devices.xml file.
http://forum.xda-developers.com/showthread.php?t=2398404
Excellent work Worstenbrood! :good:
The tool is very good. I've tried with several Update.app and all OK.
It would be very interesting to get to repack the file Update.app because still do not have a custom recovery bootable. With the current cwm recovery can not extract files. Img a partition.
May you work on the file repack Update.app
The author Genokolar the custom recovery of Honor 2 miui port and a large majority of Huawei moblies have to pack and repack the file Update.app (over 4 months ago):
https://github.com/genokolar/unpacker_huawei/blob/master/unpack.php
That really says there that forked from tewilove / unpacker_huawei
Best Regards
Next version will have a repack function included, i'm adjusting the UI but most of the repacking code is already written.
worstenbrood said:
Next version will have a repack function included, i'm adjusting the UI but most of the repacking code is already written.
Click to expand...
Click to collapse
Excellent news!
Update to v0.9.5.0, added repack function, it only repacks the file + recalculates all checksums and the checksum file. No signing is done yet ! Since i have no access to a huawei device atm it would be nice to see some results (i'm wondering if the order of the files inside the update.app is important)
Thank you for the update. BTW, the Huawei Ascend Mate has the same partition information as the P6 so should be easy to add to the tool. I've been using it to unpack Mate updates with success.
flibblesan said:
Thank you for the update. BTW, the Huawei Ascend Mate has the same partition information as the P6 so should be easy to add to the tool. I've been using it to unpack Mate updates with success.
Click to expand...
Click to collapse
Then it is just a matter of cloning the P6 profile inside the profiles.xml and changing the Name attribute or changing the name so that it suits both...
Any updates may be sent to me
worstenbrood said:
Then it is just a matter of cloning the P6 profile inside the profiles.xml and changing the Name attribute or changing the name so that it suits both...
Any updates may be sent to me
Click to expand...
Click to collapse
Confirm, it work too with D1QXL
Amazing, I found anywhere and none of them work. Great Tool
My I ask one feature? pack/unpack *.img
In my device, Ascend D1 Quad XL, every image has additional 2048 header before ANDROID magic word.
To extract boot.img/recovery.img, dsixda's Android Kitchen remove the 2048 header, save as new boot.img then extract it. Repack it.
But then, the repack image have no 2048 header. So I can't flash it manually to device.
Would yo learn/track this 2048 header
Thank's
twins.7 said:
Confirm, it work too with D1QXL
Amazing, I found anywhere and none of them work. Great Tool
My I ask one feature? pack/unpack *.img
In my device, Ascend D1 Quad XL, every image has additional 2048 header before ANDROID magic word.
To extract boot.img/recovery.img, dsixda's Android Kitchen remove the 2048 header, save as new boot.img then extract it. Repack it.
But then, the repack image have no 2048 header. So I can't flash it manually to device.
Would yo learn/track this 2048 header
Thank's
Click to expand...
Click to collapse
Thanks.
I want to keep the app as generic as possible, you can easily write a bat file that does that
worstenbrood said:
Thanks.
I want to keep the app as generic as possible, you can easily write a bat file that does that
Click to expand...
Click to collapse
No, I mean this 2048 header are unique. That's why I need your help to determine contain of header.
without that header I can't flash img to device. Each change in img, the header must change too.
twins.7 said:
Confirm, it work too with D1QXL
Amazing, I found anywhere and none of them work. Great Tool
My I ask one feature? pack/unpack *.img
In my device, Ascend D1 Quad XL, every image has additional 2048 header before ANDROID magic word.
To extract boot.img/recovery.img, dsixda's Android Kitchen remove the 2048 header, save as new boot.img then extract it. Repack it.
But then, the repack image have no 2048 header. So I can't flash it manually to device.
Would yo learn/track this 2048 header
Thank's
Click to expand...
Click to collapse
twins.7 said:
No, I mean this 2048 header are unique. That's why I need your help to determine contain of header.
without that header I can't flash img to device. Each change in img, the header must change too.
Click to expand...
Click to collapse
Share an image with me (with the header included) and i'll take a look when i have some time.
GitHub - Evsio0n/rsce-go: Rockchip resource image (RSCE) Pack/Unpack Tool written in Go
Rockchip resource image (RSCE) Pack/Unpack Tool written in Go - GitHub - Evsio0n/rsce-go: Rockchip resource image (RSCE) Pack/Unpack Tool written in Go
github.com
Rockchip resources image(RSCE) is a binary file which contains device tree blob and additional resources (like vendor splash screen) and appears as boot.img-second on unpacking.
Author: @evsio0n
Usage-u: Unpack the RSCE file to the specified directory.
e.g. ./rsce_tool -u ./boot-second
-p: Pack the file to RSCE file.
e.g. ./rsce_tool -p ./rk-kernel.dtb -p ./logo.bmp -p ./logo-kernel.bmp
use it at your own risk.
Beautiful tool, beats manually doing it every single time.