Extracting Stock OOS payload.bin - OnePlus 7T Questions & Answers

I have installed everything needed for the payload dumper, but I am getting the following error when trying to extract a OOS payload.bin:
Code:
Processing LOGO partitionTraceback (most recent call last):
File "payload_dumper.py", line 157, in <module>
dump_part(part)
File "payload_dumper.py", line 100, in dump_part
out_file = open('%s/%s.img' % (args.out, part.partition_name), 'wb')
FileNotFoundError: [Errno 2] No such file or directory: 'output/LOGO.img'
Edit: figured it out.
For others with this problem, the instructions are not 100% correct. They say:
Download payload_dumper.py and update_metadata_pb2.py
Click to expand...
Click to collapse
But having only these two files is not sufficient. I got it working by downloading the entire repo as a zip and placing the payload file in that folder.

creeve4 said:
I have installed everything needed for the payload dumper, but I am getting the following error when trying to extract a OOS payload.bin:
Code:
Processing LOGO partitionTraceback (most recent call last):
File "payload_dumper.py", line 157, in <module>
dump_part(part)
File "payload_dumper.py", line 100, in dump_part
out_file = open('%s/%s.img' % (args.out, part.partition_name), 'wb')
FileNotFoundError: [Errno 2] No such file or directory: 'output/LOGO.img'
Edit: figured it out.
For others with this problem, the instructions are not 100% correct. They say:
But having only these two files is not sufficient. I got it working by downloading the entire repo as a zip and placing the payload file in that folder.
Click to expand...
Click to collapse
Having same issue. Trying to extract an incremental OTA Payload, but getting exact same error. I did download the source files and still get the same error. Here is the Payload extractor I am using. Maybe you were using a different one.
GitHub - vm03/payload_dumper: Android OTA payload dumper
Android OTA payload dumper. Contribute to vm03/payload_dumper development by creating an account on GitHub.
github.com

Related

Android Kitchen not working properly on Fedora 16 x64 [Solved]

Has anyone been able to get the android kitchen to actually work on Fedora 16 and if so, how?
The reason I ask is because it does start and it does find the system.img and boot.img but its complaining during the working folder set up. See below:
Code:
Creating working folder WORKING_112911_011054 ...
Copying boot.img ...
Copying system.img ...
Adding an update-script ...
Chunk size is 2048 bytes in system.img
Spare size calculated to be 64 bytes
Compiling unyaffs ...
In file included from /usr/include/features.h:387:0,
from /usr/include/sys/types.h:26,
from unyaffs.c:10:
/usr/include/gnu/stubs.h:9:27: fatal error: gnu/stubs-64.h: No such file or directory
compilation terminated.
Error: unyaffs not successfully compiled!
Never mind. I fixed it already.
So I'll share. If you run into that error just open up a new terminal and type:
Code:
su -
yum install glibc-devel.x86_64 --disablerepo=adobe\*
Simple enough, lol
sir
wildstang83 said:
Never mind. I fixed it already.
So I'll share. If you run into that error just open up a new terminal and type:
Code:
su -
yum install glibc-devel.x86_64 --disablerepo=adobe\*
Simple enough, lol
Click to expand...
Click to collapse
do you know how to add device in android kitchen?

Can't unpack a system.img?

Just for the hell of it, I'd like to unpack a system.img the easy way. I tried unyaffs for Windows but it doesn't seem to work. Does the factory images from Google even use the yaffs format?
When I try to unyaffs system.img, I get this which I condumped:
Code:
0 [main] unyaffs 6232 exception::handle: Exception: STATUS_ACCESS_VIOLATIO
N
831 [main] unyaffs 6232 open_stackdumpfile: Dumping stack trace to unyaffs.e
xe.stackdump
What am I doing wrong? I open a command window in the directory of the image file, make sure unyaffs.exe and cygwin1.dll is there and then type "unyaffs system.img"
Same question here
Don't forget to hit thanks
I have already posted how to do this in this post... Have a look at the last few lines of the "How to flash" section in blue.

Recover files from backup

Hi there.
Few months ago, before updating my z1 compact to 5.1.1, i've done a backup with sony pc companion, but i decided to not restore it.
Now i need some notes and files in that backup, so is there a way to get them without restoring everything? I tried to open the .dbk file with 7zip, but the notes backup file has no extension so i don't know how to open.
Thank you.
dario2510 said:
Hi there.
Few months ago, before updating my z1 compact to 5.1.1, i've done a backup with sony pc companion, but i decided to not restore it.
Now i need some notes and files in that backup, so is there a way to get them without restoring everything? I tried to open the .dbk file with 7zip, but the notes backup file has no extension so i don't know how to open.
Thank you.
Click to expand...
Click to collapse
I think backups are usually ext4. Try Ext4 unpacker or Ext2 explore.
dario2510 said:
Hi there.
Few months ago, before updating my z1 compact to 5.1.1, i've done a backup with sony pc companion, but i decided to not restore it.
Now i need some notes and files in that backup, so is there a way to get them without restoring everything? I tried to open the .dbk file with 7zip, but the notes backup file has no extension so i don't know how to open.
Thank you.
Click to expand...
Click to collapse
Tested with 7zip on the phone and seems to be working. My backups are TWRP, and info is packed in ext4.win files. 7z e command unpacked it.
Here's the output, (terminal wouldn't let me take a screenshot)...
7z e system.ext4.win000
7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=C,Utf16=off,HugeFiles=on,4 CPUs)
Processing archive: system.ext4.win000
Extracting AndroidManifest.xml
Extracting res/layout-v17/settings_checkbox.xml
Extracting res/layout/disclaimer_dialog1.xml
Extracting res/layout/disclaimer_dialog2.xml
Extracting res/layout/disclaimer_dialog3.xml
Extracting res/layout/disclaimer_prototype.xml
file settings_checkbox.xml
already exists. Overwrite with
res/layout/settings_checkbox.xml?
(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? Y
Extracting res/layout/settings_checkbox.xml
Extracting res/mipmap-hdpi-v4/ic_settings.png
file ic_settings.png
already exists. Overwrite with
res/mipmap-mdpi-v4/ic_settings.png?
(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? A
Extracting res/mipmap-mdpi-v4/ic_settings.png
Extracting res/mipmap-xhdpi-v4/ic_settings.png
Extracting res/mipmap-xxhdpi-v4/ic_settings.png
Extracting res/xml/settings.xml
Extracting resources.arsc
Extracting META-INF/MANIFEST.MF
Extracting META-INF/SONY-ERICSSON-E-PLATFORM-SIGNING-LIVE-864F-3.SF
Extracting META-INF/SONY-ERICSSON-E-PLATFORM-SIGNING-LIVE-864F-3.RSA
Extracting classes.dex
Everything is Ok
Files: 17
Size: 433866
Compressed: 1618233344
[email protected]:/sdcard1/twrp/BACKUPS/CB5A20B0Q8/2015-12-25--.236 #
levone1 said:
Tested with 7zip on the phone and seems to be working. My backups are TWRP, and info is packed in ext4.win files. 7z e command unpacked it.
Here's the output, (terminal wouldn't let me take a screenshot)...
7z e system.ext4.win000
7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=C,Utf16=off,HugeFiles=on,4 CPUs)
Processing archive: system.ext4.win000
Extracting AndroidManifest.xml
Extracting res/layout-v17/settings_checkbox.xml
Extracting res/layout/disclaimer_dialog1.xml
Extracting res/layout/disclaimer_dialog2.xml
Extracting res/layout/disclaimer_dialog3.xml
Extracting res/layout/disclaimer_prototype.xml
file settings_checkbox.xml
already exists. Overwrite with
res/layout/settings_checkbox.xml?
(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? Y
Extracting res/layout/settings_checkbox.xml
Extracting res/mipmap-hdpi-v4/ic_settings.png
file ic_settings.png
already exists. Overwrite with
res/mipmap-mdpi-v4/ic_settings.png?
(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? A
Extracting res/mipmap-mdpi-v4/ic_settings.png
Extracting res/mipmap-xhdpi-v4/ic_settings.png
Extracting res/mipmap-xxhdpi-v4/ic_settings.png
Extracting res/xml/settings.xml
Extracting resources.arsc
Extracting META-INF/MANIFEST.MF
Extracting META-INF/SONY-ERICSSON-E-PLATFORM-SIGNING-LIVE-864F-3.SF
Extracting META-INF/SONY-ERICSSON-E-PLATFORM-SIGNING-LIVE-864F-3.RSA
Extracting classes.dex
Everything is Ok
Files: 17
Size: 433866
Compressed: 1618233344
[email protected]:/sdcard1/twrp/BACKUPS/CB5A20B0Q8/2015-12-25--.236 #
Click to expand...
Click to collapse
I haven't understood how this could have helped me, but i solved in another way:
I found notes folder in backup directory, then I used this program to extract files from fullbackupdata and finally i found my notes written in some databes files.
Hope this could help someone.

Oreo: fstab.qcom in ramdisk

After extracting the ramdisk from the stock boot image of OSS5.0 / Android O 8.0 for Oneplus3, I noticed that fstab.qcom file is no longer there in the ramdisk. Until OSS4.5.1 / Android N 7.1 this file was present and could be edited to set the flag for data partition to encryptable and to also remove the verity flag ...both of which I found to be very useful.
Appreciate if someone can please help me understand what has changed in the Android O 8.0 and what would be the method to achieve the above?
Looking at https://forum.xda-developers.com/oneplus-3t/how-to/disable-dm-verity-force-encryption-op3t-t3688748 and https://forum.xda-developers.com/attachment.php?attachmentid=4302571&d=1507993390, it appears that the fstab.qcom file has moved to /system/vendor/etc/fstab.qcom in Oreo in keeping with Android O / 8.0 specifications. Changing that file means modifying the system partition, which I don't mind as I like to modify the hosts file as the barest minimum change even in my daily use device. But still wondering if the same can be achieved by Magisk and how. Appreciate if someone can help me understand this.
Today's learning:
1. Android O kernel specifications include early mounting of some partitions and Oneplus 3 specifies the system partition in its device tree blobs (dtb).
2. These dtb are part of (...appended to) the real kernel image and not on a separate partition / blob.
3. There are 13 dtb appended to Oneplus 3 kernel and each of them has an entry relevant to fstab which mounts system with the verify flag.
4. Again, in keeping with Android O specifications, fstab.qcom (...now located in the /vendor/etc/ directory) does not include a line for the system partition (...commented out) as mounting the system partition is already taken care of through the dtb in the kernel.
5. That means system modifications cannot be done until the dtb are cleaned of verify flag .... or perhaps the whole of the code mounting the system partition in dtb is deleted and then fstab.qcom is restored in the ramdisk.
Haven't yet tried this and it will be helpful if someone more knowledgeable can confirm that these are the steps to be done to modify the system partition.
@rk2612 great findings and write up!
Just saw your post at magisk beta thread. I'm facing same problem on xperia device with Oreo, and I think we need to change the flag as you stated there.
I've already tried flashing magisk, but dm-verity is still being triggered and phone falls in a bootloop after it reboots.
I'd like to try this method out on my xperia, but I don't know how to convert dtb into dts, and vice versa. Any help on this would be great! Thanks in advance!!
serajr said:
@rk2612...
I've already tried flashing magisk, but dm-verity is still being triggered and phone falls in a bootloop after it reboots.
I'd like to try this method out on my xperia, but I don't know how to convert dtb into dts, and vice versa. ...
Click to expand...
Click to collapse
Have you tried patching with Magisk Beta v1456? That seems to take care of the verity flag in the dtb of OnePlus 3.
On Ubuntu, you can install dtc (device tree compiler ...Refer http://manpages.ubuntu.com/manpages/xenial/man1/dtc.1.html ) to handle conversion from dtb to dts or vice versa.
rk2612 said:
Have you tried patching with Magisk Beta v1456? That seems to take care of the verity flag in the dtb of OnePlus 3.
On Ubuntu, you can install dtc (device tree compiler ...Refer http://manpages.ubuntu.com/manpages/xenial/man1/dtc.1.html ) to handle conversion from dtb to dts or vice versa.
Click to expand...
Click to collapse
Thank you bro!
Yes, I had, latest beta v1456!
Gonna try it out and report back here later!!
serajr said:
...
I'd like to try this method out on my xperia, ....
Click to expand...
Click to collapse
serajr said:
Thank you bro!
Yes, I had, latest beta v1456!
Gonna try it out and report back here later!!
Click to expand...
Click to collapse
According to https://github.com/topjohnwu/Magisk/blob/master/scripts/boot_patch.sh (...line 93 onwards) Sony devices may not be handled well by Magisk.
rk2612 said:
According to https://github.com/topjohnwu/Magisk/blob/master/scripts/boot_patch.sh (...line 93 onwards) Sony devices may not be handled well by Magisk.
Click to expand...
Click to collapse
Bro, this is an known issue for all xperia users. Always before we flash magisk (os SuperSU), we do need to convert xperia stock kernel (elf format) to boot.img (aosp format), and fastboot it!
And for the records, this is exactly what I've found with dtc:
Code:
firmware {
android {
compatible = "android,firmware";
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc/7464900.sdhci/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,discard";
fsmgr_flags = "wait";
status = "disabled";
};
system {
compatible = "android,system";
dev = "/dev/block/platform/soc/7464900.sdhci/by-name/system";
type = "ext4";
mnt_flags = "ro,barrier=1,discard";
fsmgr_flags = "wait[B][COLOR="Red"],verify[/COLOR][/B]";
status = "ok";
};
};
};
};
Removed ,verify and conveted back to dtb. Gonna test it out (report you back later)!
Thank you!
i have a one plus 5T and i dont see an DTB files in the boot.img
can someone post a walk through on how to do this manually without magisk or supersu?
i know i can modify the fstab in system/vendor/etc
but what are the dtb files exactly? and where are they located / how are they extracted?
virtyx said:
i have a one plus 5T and i dont see an DTB files in the boot.img
can someone post a walk through on how to do this manually without magisk or supersu?
i know i can modify the fstab in system/vendor/etc
but what are the dtb files exactly? and where are they located / how are they extracted?
Click to expand...
Click to collapse
DTB are Device Tree Blobs / Binary and not files. These are appended to the kernel in the boot.img.
On Ubuntu, you can install dtc (device tree compiler ...Refer http://manpages.ubuntu.com/manpages/...an1/dtc.1.html ) to handle conversion from dtb to dts or vice versa.
You can also hex edit the boot.img and delete the text ",verify" at each instance it is found. Or use Linux command line to do that if you're familiar with that.
Sorry, don't have the spare time right now to write a detailed walk through. Maybe this weekend.
rk2612 said:
DTB are Device Tree Blobs / Binary and not files. These are appended to the kernel in the boot.img.
On Ubuntu, you can install dtc (device tree compiler ...Refer http://manpages.ubuntu.com/manpages/...an1/dtc.1.html ) to handle conversion from dtb to dts or vice versa.
You can also hex edit the boot.img and delete the text ",verify" at each instance it is found. Or use Linux command line to do that if you're familiar with that.
Sorry, don't have the spare time right now to write a detailed walk through. Maybe this weekend.
Click to expand...
Click to collapse
thank you
is it possible to extracat the DTB files on a windows machine?
i know after OS install the fstab is located at /system/etc/vendor which we can edit before first boot
but id prefer to edit the DTB files in the boot, and add mounting flags for each partition.
virtyx said:
thank you
is it possible to extracat the DTB files on a windows machine?
i know after OS install the fstab is located at /system/etc/vendor which we can edit before first boot
but id prefer to edit the DTB files in the boot, and add mounting flags for each partition.
Click to expand...
Click to collapse
I didn't look around for a windows tool to extract DTBs.
In Oreo, fstab file contains the mount points for all other partitions except /system and you can edit the fstab file as in previous android versions. The only partition which is mounted early through the DTBs is /system and you will see that the /system mount entry in fstab is commented out as that is not needed.
To mount /system with verity disabled, you will need to remove the flag "verify" from the DTBs. I'm attaching a text version of one of the 13 DTBs contained in OnePlus 3's boot image as an example. You will notice the following code
Code:
fsmgr_flags = "wait,verify"
...and you need to remove ",verify" to make it
Code:
fsmgr_flags = "wait"
To remove ",verify" from the DTBs, you can either:
1. Hex edit the boot image but this will leave the verity key in the ramdisk (...may work but I haven't tried).
2. (a) Unpack the boot image; (b) hex edit the kernel (to which dtbs are appended) and remove ",verify"; (c) extract ramdisk and remove verity.key; (d) repack ramdisk; and (e) repack the boot image: should work
3. (a) Unpack the boot image, (b) extract the dtb appended to kernel / zImage; (c) convert the dtb to dts (text format); (d) text edit the dts to remove ",verify"; (e) then reconvert dts to dtb; (f) append all the modified dtbs to the kernel; and finally (g) repack the boot image (...also remove the verity.key from the ramdisk before repacking the boot image): this would be the cleanest approach but more cumbersome.
Tools needed on Ubuntu machine with Python installed:
1. Unpack and repack boot image: use unpackbootimg and mkbootimg scripts (Python) from lineageos code: https://github.com/LineageOS/android_system_core/tree/cm-14.1/mkbootimg
2. Extract kernel and dtbs using python script: https://github.com/PabloCastellano/extract-dtb
3. Convert dtb to dts and back: use Ubuntu package dtc: http://manpages.ubuntu.com/manpages/xenial/man1/dtc.1.html
rk2612 said:
I didn't look around for a windows tool to extract DTBs.
In Oreo, fstab file contains the mount points for all other partitions except /system and you can edit the fstab file as in previous android versions. The only partition which is mounted early through the DTBs is /system and you will see that the /system mount entry in fstab is commented out as that is not needed.
To mount /system with verity disabled, you will need to remove the flag "verify" from the DTBs. I'm attaching a text version of one of the 13 DTBs contained in OnePlus 3's boot image as an example. You will notice the following code
Code:
fsmgr_flags = "wait,verify"
...and you need to remove ",verify" to make it
Code:
fsmgr_flags = "wait"
To remove ",verify" from the DTBs, you can either:
1. Hex edit the boot image but this will leave the verity key in the ramdisk (...may work but I haven't tried).
2. (a) Unpack the boot image; (b) hex edit the kernel (to which dtbs are appended) and remove ",verify"; (c) extract ramdisk and remove verity.key; (d) repack ramdisk; and (e) repack the boot image: should work
3. (a) Unpack the boot image, (b) extract the dtb appended to kernel / zImage; (c) convert the dtb to dts (text format); (d) text edit the dts to remove ",verify"; (e) then reconvert dts to dtb; (f) append all the modified dtbs to the kernel; and finally (g) repack the boot image (...also remove the verity.key from the ramdisk before repacking the boot image): this would be the cleanest approach but more cumbersome.
Tools needed on Ubuntu machine with Python installed:
1. Unpack and repack boot image: use unpackbootimg and mkbootimg scripts (Python) from lineageos code: https://github.com/LineageOS/android_system_core/tree/cm-14.1/mkbootimg
2. Extract kernel and dtbs using python script: https://github.com/PabloCastellano/extract-dtb
3. Convert dtb to dts and back: use Ubuntu package dtc: http://manpages.ubuntu.com/manpages/xenial/man1/dtc.1.html
Click to expand...
Click to collapse
ah i see
i guess i should really dual boot this machine haha
i found the mounting options in hex editor for the boot.img (/system and /vendor, i think 13 instances of both)
also the verity.key can be delete when unpacking the boot.img and repacking it with no verity.key.
thank you, i think im able to modify it on a windows machine, ill try it out as soon as a stable oreo comes out for the 1+5T
I already have the dtb edited. how can I add them back to the zImage or the boot.img?
Thank you very much
kenet said:
I already have the dtb edited. how can I add them back to the zImage or the boot.img?
Thank you very much
Click to expand...
Click to collapse
Actually the appending should be done like
Code:
cat zImage [I][U]<DTB_FILE_NAME>[/U][/I].dtb > zImage-dtb
So you can get a zImage with dtb

Finding file_contexts from stock image

Hello,
After modifying my system.img filesystem, I need to find the adequat file_contexts file for my PixelC to be able repack my system file as an image.
To do so, I opened the boot.img image and extracted the ram disk.
Unfortunately I could not find a file name "file_contexts" but only "plat_file_contexts" or "nonplat_file_contexts" which ended up making the tablet not boot.
Where can I find the appropriate file_contexts for the Pixel C ?
Thank you.
Das Kartoffel said:
Hello,
After modifying my system.img filesystem, I need to find the adequat file_contexts file for my PixelC to be able repack my system file as an image.
To do so, I opened the boot.img image and extracted the ram disk.
Unfortunately I could not find a file name "file_contexts" but only "plat_file_contexts" or "nonplat_file_contexts" which ended up making the tablet not boot.
Where can I find the appropriate file_contexts for the Pixel C ?
Thank you.
Click to expand...
Click to collapse
When you change system.img .. do you remove DM-verity too ?
Otherwise it will never boot.
No need for file_contexts .. just use simg2img tool to make sparse image again ..or keep it as ext4 system.img.
It seems like file_contexts got split between plat_ and nonplat_ from Android 8.0 on. See this: https://source.android.com/security/selinux/compatibility

Categories

Resources