Develop Bugs

[GUIDE] Extract .rfs files

I came from HTC Hero to the Samsung Galaxy S GT-I9000
So I had never problems with cooking something up, but in the Galaxy I faced .rfs files and a flashing tool I can't use on linux...
So I searched through some boards to find a way to extract the .rfs files here a working guide for the S I9000.
What you need
Linux (tested with Debian testing)
It's pretty simple, execute this commands as root on your computer
SHORT WAY (thanks to mimocan)
Code:
# mount -o loop factory.rfs /some_dir
LOOOONG WAY
Attatch the rfs file to the loop device
Code:
# losetup /dev/loop0 /somedir/factoryfs.rfs
Create a directory to mount the device
Code:
# mkdir /somedir/mnt
Mount the device
Code:
# mount /dev/loop0 /somedir/mnt
the content of the rfs is NOT saved on the sdcard! you have to copy it!
Now you can copy the content from the /sdcard/tmp directory to the sdcard
Code:
# cp -R /somedir/mnt /somedir/factoryfs
hope this is helpful for someone

Code:
#mount -o loop factory.rfs /some_dir
should do the same

This works because rfs is based on vfat.
But have you ever tried this on cache.rfs or dbdata.rfs?
The mounted folder is empty. The cache.rfs in my case was around 1.2 mb.
Maybe the 1.2 mb are journaling data rfs uses?
I also tried mounting cache.rfs and dbdata.rfs directly on my sgs without any luck.
Since the phone has built in rfs drivers it should be able to mount it.

psternx said:
This works because rfs is based on vfat.
But have you ever tried this on cache.rfs or dbdata.rfs?
The mounted folder is empty. The cache.rfs in my case was around 1.2 mb.
Maybe the 1.2 mb are journaling data rfs uses?
I also tried mounting cache.rfs and dbdata.rfs directly on my sgs without any luck.
Since the phone has built in rfs drivers it should be able to mount it.
Click to expand...
Click to collapse
If you open the cache.rfs or dbdata.rfs from a PDA build (tested I900XXJP3) in a hexeditor you will see they are empty, just the headers and a lot of zeros

Have you been able to modify something from a rfs file and save it?

Actually Cache.rfs file in CSC is a renamed update.zip. At least with a few firmwares I have tried. So just open it with, for example, 7-zip and you can browse the files.

deleted............

Tried to mount a cache.rfs and got a "Device or resource busy".
Then tried to open it trough MagicISO, and voilá, I got the CSC files I needed

Now im into modifying factoryfs.rfs and hoping you can give me some tips.
Alt1
mount -o loop factoryfs.rfs directory & Copy files to a new place and edit them but how to create a .rfs from that point?
Alt2
sudo mount -v -o rw,loop,uid=$UID factoryfs.rfs Directory
Edit the files , umount the .rfs . Mount it again but the the changes are gone.
How do you do it?
Thanks.

a-son said:
Now im into modifying factoryfs.rfs and hoping you can give me some tips.
Alt1
mount -o loop factoryfs.rfs directory & Copy files to a new place and edit them but how to create a .rfs from that point?
Alt2
sudo mount -v -o rw,loop,uid=$UID factoryfs.rfs Directory
Edit the files , umount the .rfs . Mount it again but the the changes are gone.
How do you do it?
Thanks.
Click to expand...
Click to collapse
for me, i'll definitelty mod it elsewhere

ykk_five said:
for me, i'll definitelty mod it elsewhere
Click to expand...
Click to collapse
Thanks for answer.
Alt 1 i suppose you mean. But how to create the .rfs ?

a-son said:
Thanks for answer.
Alt 1 i suppose you mean. But how to create the .rfs ?
Click to expand...
Click to collapse
yess!!!!
how to recompile the .rfs ?????

KBJ911 said:
yess!!!!
how to recompile the .rfs ?????
Click to expand...
Click to collapse
BUMP!
Actually some cache.rfs aren't simple renamed zipfiles, as they (i.e. multi-csc) also contains more stuff
So I loopmounted rw the vfat cache.rfs, extracted and modified the contained sec_csc.zip (this one IS an update.zip structured file...)
But when I put it inside, sync, unmount and mount again to verify stuff, I got a corrupted filesystem and a corrupted zip file.
Any clue to successfully modify contents of such .rfs ?

mopodo said:
I came from HTC Hero to the Samsung Galaxy S GT-I9000
So I had never problems with cooking something up, but in the Galaxy I faced .rfs files and a flashing tool I can't use on linux...
So I searched through some boards to find a way to extract the .rfs files here a working guide for the S I9000.
What you need
Linux (tested with Debian testing)
It's pretty simple, execute this commands as root on your computer
SHORT WAY (thanks to mimocan)
Code:
# mount -o loop factory.rfs /some_dir
LOOOONG WAY
Attatch the rfs file to the loop device
Code:
# losetup /dev/loop0 /somedir/factoryfs.rfs
Create a directory to mount the device
Code:
# mkdir /somedir/mnt
Mount the device
Code:
# mount /dev/loop0 /somedir/mnt
the content of the rfs is NOT saved on the sdcard! you have to copy it!
Now you can copy the content from the /sdcard/tmp directory to the sdcard
Code:
# cp -R /somedir/mnt /somedir/factoryfs
hope this is helpful for someone
Click to expand...
Click to collapse
Is there a way to convert it back to rfs?

@all
Is there a way to convert it back to rfs?

criskelo said:
@all
Is there a way to convert it back to rfs?
Click to expand...
Click to collapse
If you used the shortway # mount -o loop factory.rfs /some_dir
than you can modify the files in some_dir.
when finished simple un mount the some_dir and the files are saved in the factory.rfs
Then tar and md5 the factory.rfs and you can flash it with odin

in windows use "magiciso" to extract .rfs

lownoise said:
Then tar and md5 the factory.rfs and you can flash it with odin
Click to expand...
Click to collapse
I lost at there, what does that means?

From linux
fastcx said:
I lost at there, what does that means?
Click to expand...
Click to collapse
From the linux command line you have to use
tar -cf filename.tar factory.rfs
md5sum filename.tar >filename.tar.md5

If you have extracted it with MagicISO and now just want to create it back to factoryfs.rfs can I do this with Cygwin and what would the command line be?

ext4 extraction from system.sin issues

Hi,
As you probably know, ext4 image can be extracted from system.sin but cannot be mounted. When trying to mount it, it fails with :
[ 1476.821582] EXT4-fs (loop0): bad geometry: block count 262144 exceeds size of device (144631 blocks)
I open this thread just to share what I did around the issue and maybe have some helpful quotes about it
Here is what I did (under linux)
# First create an zero filled file. Size is system partition size (262144 blocks of 4096 each)
dd if=/dev/zero of=/home/xperia/virtualfs bs=4096 count=262144
# Attach file to loopback
sudo losetup /dev/loop0 /home/xperia/virtualfs
# Format it with same features as system partition on phone
sudo mkfs.ext4 -O has_journal,^ext_attr,^dir_index,^flex_bg,^huge_file,resize_inode,filetype,extent,sparse_super,large_file,^uninit_bg,^dir_nlink,^extra_isize -v /dev/loop0
# Write extracted system.sin.ext4 extracted image to loopback
sudo dd if=system.sin.ext4 of=/dev/loop0
# Mount filesystem
sudo mount /dev/loop0 /mnt
It can be mounted and I can have folder structure but I can't work with files. Editing default.prop gives me a non readable file.
But we can go a step ahead as we can now mount the image.
Still some issues have to be worked out.

The poit is, why we cant mount system.img on ICS but we can on GB?
maybe someone can contact with sony t oask
im extracting the .sin to .img like always but its impossible to mount.. what are you using to extract the .sin to a .ext4?
BTW, thanks for the info, i've been trying to modify system.img since ICS appeared.
EDIT: of, ext4 can be extracte with flashtool ~.~
maybe we need to read something from system.partinfo

Yakandu said:
The poit is, why we cant mount system.img on ICS but we can on GB?
maybe someone can contact with sony t oask
im extracting the .sin to .img like always but its impossible to mount.. what are you using to extract the .sin to a .ext4?
BTW, thanks for the info, i've been trying to modify system.img since ICS appeared.
EDIT: of, ext4 can be extracte with flashtool ~.~
maybe we need to read something from system.partinfo
Click to expand...
Click to collapse
Yes Flashtool can extract image from system.sin.
partinfo is partition information used by loader in flashmode to identify where to flash image on phone. (Something like start nand address of system partition)

so, any ideas why ext4 cant be mounted? maybe its encrypted or something..

Sorry for double post, i found a solution
Flash the system through a .ftf with flashtools
Flash a custom kernel with recovery (or the nozomi recovery)
Backup nandroid
We get a system.ext4.tar ··· move it to your developement folder
Create a folder (mkdir system)
Enter nautilus with root acces
Extract system files to the created folder
Modify whatever you want
Make a flashable system.img with: "./mkuserimg.sh -s /system ./system.img ext4 ./temp 1024M"
AND ITS WORKING!

Yakandu said:
Sorry for double post, i found a solution
Flash the system through a .ftf with flashtools
Flash a custom kernel with recovery (or the nozomi recovery)
Backup nandroid
We get a system.ext4.tar ··· move it to your developement folder
Create a folder (mkdir system)
Enter nautilus with root acces
Extract system files to the created folder
Modify whatever you want
Make a flashable system.img with: "./mkuserimg.sh -s /system ./system.img ext4 ./temp 1024M"
AND ITS WORKING!
Click to expand...
Click to collapse
This solution is already known
But my goal is to be able to mod a system partition without having to flash it before. And more, understand why extracted system image cannot be mounted and how to work this out

oh, ok xD
i didnt know that solution, its new for me

Yakandu said:
Sorry for double post, i found a solution
Flash the system through a .ftf with flashtools
Flash a custom kernel with recovery (or the nozomi recovery)
Backup nandroid
We get a system.ext4.tar ··· move it to your developement folder
Create a folder (mkdir system)
Enter nautilus with root acces
Extract system files to the created folder
Modify whatever you want
Make a flashable system.img with: "./mkuserimg.sh -s /system ./system.img ext4 ./temp 1024M"
AND ITS WORKING!
Click to expand...
Click to collapse
Have you already tried flashing this img on your device? I have already tried this solution twice but didn't succeed (@Spectre51 that's why I haven't replied your PM yet). system.img was succesfully created but I got boot loop when I flashed it on my device.

Hi Androxyde,
I figured it out, basically we have to dig further in sin format as new ext4 sins skips part of the file. See my thread for more details.
PS: Thanks for flashtool, it's a great tool!
LeTama

letama said:
Hi Androxyde,
I figured it out, basically we have to dig further in sin format as new ext4 sins skips part of the file. See my thread for more details.
PS: Thanks for flashtool, it's a great tool!
LeTama
Click to expand...
Click to collapse
:good:

[dev]How to Un/Re/Pack a Boot.blob and unyaff a boot.img

Technically i have to give credit to scott crossler
www.scottsroms.com
for showing me the method
and then i came upon turges
faq
Thanks Turge and Scott and whomever created these blobpacktools
but since i keep getting pms
and im sure you do to
scott
Here are the steps for repacking the boot.img. Some involve running the commands via cygwin, others involve running them via the Windows Command Prompt.
The instructions for installing cygwin, extracting and repacking the boot.img were found here: http://www.freeyourandroid.com/guide...ot-img-windows
Once you have setup cygwin, extract the attached files in a folder under your "home" folder in cygwin.
Also unzip blob tools into the same folder as your boot.blob
1.
Code:
copy boot.blob to the same folder and run the following via
the Windows Command Prompt to extract the boot.img from the boot.blob:
BlobUnpack.exe boot.blob
ren boot.blob.LNX boot.img
which will create boot.img
2.
Code:
From the cygwin bash terminal window,
switch to the same folder and run the following
to extract the ramdisk from the boot.img:
./extractboot boot.img
You now have an out/ramdisk folder
that contains the files you want to edit.
3.
Code:
Once done, repack the ramdisk and kernel into boot_new.img
with the following command (via cygwin once again):
./packboot
4.
Code:
then from the Command Prompt repack boot_new.img
into boot2.blob using the following:
blobpack -s boot2.blob LNX boot_new.img
5.
Code:
You can now flash the boot.blob to the staging
partition via a command in updater-script:
Code:
package_extract_file("/boot.blob", "/dev/block/mmcblk0p4");
or by using adb while in recovery/android:
Code:
dd if=/sdcard/boot2.blob of=/dev/block/mmcblk0p4

Lastly the rundown is like this
if you want to take a ota blob
and extract the contents for a raw base
and a raw kernel
1
take the ota and extract the blob file and place
in your folder with blobtools
2. then run
Code:
blobunpack.exe blob
Which now creates
Blob.APP =System.img (can be renamed system.img and unyaffed in the kitchen)or straight cygwin
Blob.sos=Recovery Img
Blob.Ebt=Bootloader information
Blob.Lnx=kernel (can also just be renamed boot.img and unyaffed in kitchen)
Blob.pt=Partition info
so to repack lets say your custom remade image
and your custom kernel
and a recovery of your choice
run
Code:
blobpack.exe -s blob lnx boot.img sos twrp.blob app system.img
then simply take the blob replace in the ota file
and flash in recovery
and it should flash a rom packed as a blob

Hi!
...also you can flash the new boot.blob via fastboot mode
>fastboot-i 0x0B05 flash boot boot.blob
:good:

Call me stupid, but what does repacking the boot.img do? I never pm'ed you, but what would we gain from this. a lil lost

unpacking a boot.img allows you to take a stock already built kernel
and make specific changes to the ramdisk
more specifically
default.prop
can make kernel insecure
debuggable
bootanimation enabled
blah blah blah
and init.rc
but also
cardhu
and goldfish.rc
and init.trace
and init.usb
then repacked and good to flash

seanzscreams said:
Lastly the rundown is like this
if you want to take a ota blob
and extract the contents for a raw base
and a raw kernel
1
take the ota and extract the blob file and place
in your folder with blobtools
2. then run
Code:
blobunpack.exe blob
Which now creates
Blob.APP =System.img (can be renamed system.img and unyaffed in the kitchen)or straight cygwin
Blob.sos=Recovery Img
Blob.Ebt=Bootloader information
Blob.Lnx=kernel (can also just be renamed boot.img and unyaffed in kitchen)
Blob.pt=Partition info
so to repack lets say your custom remade image
and your custom kernel
and a recovery of your choice
run
Code:
blobpack.exe -s blob lnx boot.img sos twrp.blob app system.img
then simply take the blob replace in the ota file
and flash in recovery
and it should flash a rom packed as a blob
Click to expand...
Click to collapse
Hi!
For a linux (Ubuntu) machine you can easily unpack blob.APP
> sudo mkdir mnt
> sudo mount -o loop blob.APP mnt
- now in your mnt directory , you will have /system ! :good:

Hi,
My TF300tl can't unlock bootloader. so can I use this way to pack custom ROM ( cm11, liplop...) as official ROM to flash for my tablet ?

konnichiwa said:
Hi,
My TF300tl can't unlock bootloader. so can I use this way to pack custom ROM ( cm11, liplop...) as official ROM to flash for my tablet ?
Click to expand...
Click to collapse
I wouldn't think so, as the ROM would have to be signed to be official

Need stock 4.3.1 kernel

I need the official tmob noteII jb 4.3.1 kernel in tar or zip can anyone give me a link please
or latest official kernel

(Assuming you're running under Windows.)
Download the complete stock ROM from sammobile or the like. You could also get the boot.img from a repacked zip here, but YMMV.
Extract boot.img from the .tar.md5 file with a compression utility that handles tar archives, 7-Zip works well for this. (The error message about the end of the file is normal, that's because the MD5 hash isn't part of a normal tar archive.)
Get cygwin, namely its tar.exe command. With boot.img in your Cygwin home directory, from the Cygwin shell run:
tar -H ustar -cf youroutputfilename.tar boot.img
As an aside, my Windows-based setup to make Odin-flashable images is fancier than that. I've added the Cygwin binaries to my PATH environment variable (jury is still out on whether that's a good idea overall, but it works for a number of tricks) and I've created a script named tarodin.cmd in that directory which contains the following command:
tar -H ustar -cf %1 sboot.bin tz.img md5.img efs.img m9kefs1.bin m9kefs2.bin m9kefs3.bin param.bin boot.img recovery.img system.img modem.bin tombstones.img cache.img hidden.img userdata.img
The missing files just cause an error to show but the file itself works perfectly. I haven't bothered adding the MD5 hash, but it could be done.
The other way is to take a working t0lte kernel zip and substitute the boot.img in it then flash through recovery.
Good luck,
Darkshado

Got Kernel working
Darkshado said:
(Assuming you're running under Windows.)
Download the complete stock ROM from sammobile or the like. You could also get the boot.img from a repacked zip here, but YMMV.
Extract boot.img from the .tar.md5 file with a compression utility that handles tar archives, 7-Zip works well for this. (The error message about the end of the file is normal, that's because the MD5 hash isn't part of a normal tar archive.)
Get cygwin, namely its tar.exe command. With boot.img in your Cygwin home directory, from the Cygwin shell run:
tar -H ustar -cf youroutputfilename.tar boot.img
As an aside, my Windows-based setup to make Odin-flashable images is fancier than that. I've added the Cygwin binaries to my PATH environment variable (jury is still out on whether that's a good idea overall, but it works for a number of tricks) and I've created a script named tarodin.cmd in that directory which contains the following command:
tar -H ustar -cf %1 sboot.bin tz.img md5.img efs.img m9kefs1.bin m9kefs2.bin m9kefs3.bin param.bin boot.img recovery.img system.img modem.bin tombstones.img cache.img hidden.img userdata.img
The missing files just cause an error to show but the file itself works perfectly. I haven't bothered adding the MD5 hash, but it could be done.
The other way is to take a working t0lte kernel zip and substitute the boot.img in it then flash through recovery.
Good luck,
Darkshado
Click to expand...
Click to collapse
Thanks bud used the Kernel and subbed it in zip that did the trick God Bless

Repack system.img with simg2img/mkuserimg

Has anyone been able to repack system.img using these tools? I've tried a couple variations of of parameters for mkuserimg, but everytime it gets stuck on the boot animation.
simg2img ./system.img system.raw
sudo mount -t ext4 -o loop system.raw ./mount/system/
sudo mkuserimg.sh -s mount/system/ system_new.img ext4 /system 3221028864
I've also tried
sudo mkuserimg.sh -s mount/system/ system_new.img ext4 /system 3195826176
Neither one works. The first one gets the file size of the .raw files to match, but the number of blocks (per tune2fs) differ. The second one gets the number of blocks to match, but not the .raw file sizes.
The base system.img I have flashes without any problems.
Appreciate any help!

Did you disabled the encryption in the boot.img ? It might be getting stuck since the signatures don't match. Have a look at the boot.img used to root. The fstab entries are relaxed. I think there is another change from stock.

gee one said:
Did you disabled the encryption in the boot.img ? It might be getting stuck since the signatures don't match. Have a look at the boot.img used to root. The fstab entries are relaxed. I think there is another change from stock.
Click to expand...
Click to collapse
Definitely using a boot.img with encryption disabled. Using this one: http://forum.xda-developers.com/apps/supersu/wip-android-6-0-marshmellow-t3219344
I've tried running both stock system.img through the repack process and a AOSP built system.img and both images stop working once run through mkuserimg
Maybe I'll give the ElementalX kernel a try.