[Without PC] Unpack, Edit, Repack boot.img

Note:
-- The mkbootimg binary is based upon the AOSP with some added modifications to work in conjunction with unmkbootimg.
-- The unmkbootimg binary is based on the original mkbootimg source but with reverse engineering to compliment its helpful use in extraction and thus providing the needed command to rebuild properly.
-- The mkbootfs binary is based on the source provided within the dsixda kitchen to insure the proper structural repacking of the ramdisk, etc.


Requirements:
-- BusyBox (cpio, gunzip and gzip is mandatory)
-- /System Write Permissions (Does not need to be a modified kernel)
-- Terminal Emulator
-- ES File Explorer (or similar)
-- Hex Editor (or use of DD)

-- Unzip boot_manipulation.zip on your device and copy the three files over to /system/bin. Those three files inside the .zip will be named unmkbootimg, mkbootfs and mkbootimg.
-- EDIT: I have included a flashable zip for these files.
-- Set permissions to rwxr-xr-x (755) on each binary. Note: The flash zip does this already.

-- Open up your android terminal emulator.

-- Now go ahead and pull your boot.img from your device (or use another one if you wish). Here is an example:

Code:

root@android:/ # dd if=/dev/block/mmcblk0p20 of=/data/local/tmp/boot.img
dd if=/dev/block/mmcblk0p20 of=/data/local/tmp/boot.img
32768+0 records in
32768+0 records out
16777216 bytes transferred in 1.496 secs (11214716 bytes/sec)
root@android:/ #

-- Open up your boot.img with the Hex Editor and look for: ANDROID!. Remove everything before it so that the ANDROID! header is the first to be read then save it over top of the boot.img. NOTE: This is only required if you are using a stock boot.img. Here is an example:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  A5 F0 BA B7 B0 43 E3 F8 3C E1 63 55 AE 75 C6 69  ¥ðº·°Cãø<ácU®uÆi
00000010  11 27 16 2F 51 48 E5 41 6F ED E1 7D C9 61 FB 3B  .'./QHåAoíá}Éaû;
00000020  5F 45 49 EE 48 79 6E 4E FB DE 18 FC A0 F4 9A C3  _EIîHynNûÞ.ü*ôšÃ
00000030  43 11 35 67 AD 7E 2F D8 F6 E8 B1 4D 7D E0 45 B6  C.5g.~/Øöè±M}àE¶
00000040  E2 08 5F 0B 56 7F 45 71 3D 38 E2 C4 76 3E 53 EE  â._.V.Eq=8âÄv>Sî
00000050  A4 3D 83 9F A2 BE D5 F4 75 5D B5 08 4E CC 9B BC  ¤=ƒŸ¢¾Õôu]µ.NÌ›¼
00000060  7F 7A 9E 3D 4B 19 1B 91 6D FB 82 A0 B5 A8 38 88  .zž=K..‘mû‚*µ¨8ˆ
00000070  25 07 B5 1B 74 A2 03 62 BE 78 FA 33 96 A0 32 70  %.µ.t¢.b¾xú3–*2p
00000080  05 56 50 EF 88 C1 F3 73 E4 C5 73 6A 4E F8 CA 0A  .VPïˆÁósäÅsjNøÊ.
00000090  D7 EF 2A 7F 09 30 21 BF 63 61 35 9A 9B 8A 62 42  ×ï*..0!¿ca5š›ŠbB
000000A0  28 C2 78 08 B0 CD 94 5F 7E EC F6 BA AD E6 AE 23  (Âx.°Í”_~ìöº.æ®#
000000B0  3E FD D8 A0 F1 F6 6D E2 D9 1E 2C E5 9F 91 84 92  >ýØ*ñömâÙ.,埑„’
000000C0  2E F0 6E 3C 1D 2B 1A D5 61 18 B2 F4 E0 66 B5 2F  .ðn<.+.Õa.²ôàfµ/
000000D0  AE 97 9F F8 53 65 CE ED 68 43 4B 2B D5 A1 B6 D9  ®—ŸøSeÎíhCK+Õ¡¶Ù
000000E0  7D 36 CE A9 CC EC F4 5A 07 D8 99 5A 91 CC 8F 71  }6ΩÌìôZ.Ø™Z‘Ì.q
000000F0  A1 8D D7 82 C3 20 AB 7A 07 68 10 2D CC F6 A8 F9  ¡.ׂà «z.h.-Ìö¨ù
00000100  41 4E 44 52 4F 49 44 21 08 D6 56 00 00 80 40 80  ANDROID!.ÖV..€@€
00000110  0E F0 07 00 00 80 80 81 00 00 00 00 00 00 30 81  .ð...€€.......0.
00000120  00 01 40 80 00 08 00 00 00 00 00 00 00 00 00 00  ..@€............
00000130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

-- Please note, HTC uses a 256 bit signature prior to the ANDROID! magic found in the boot.img. This may vary with other devices so keep that in mind. To remove the 256 bit junk so the boot.img is read properly you can use a hex editor and delete it or you can use DD. The following dd command I will be using is based on K2_CL in regards to the partition for our boot.img. Please make necessary adjustments to this command by insuring you know the location and where abouts of your own boot.img; Example:

Code:

dd bs=256 skip=1 if=/dev/block/mmcblk0p20 of=/data/local/tmp/boot.img

-- Alright, so we have the unmkbootimg, mkbootfs and mkbootimg located in /system/bin. We have pulled our boot.img and removed the junk before the magic android value: ANDROID!. Let's continue.

-- Go back to your android terminal emulator and change directories to /data/local/tmp. Here is an example:

Code:

root@android:/ # cd /data/local/tmp
cd /data/local/tmp
root@android:/data/local/tmp #

-- Now run unmkbootimg. Here is an example:

Code:

root@android:/data/local/tmp # unmkbootimg -i boot.img
unmkbootimg -i boot.img
kernel written to 'kernel' (5690888 bytes)
ramdisk written to 'ramdisk.cpio.gz' (521735 bytes)

To rebuild this boot image, you can use the command:
  mkbootimg --base 0 --pagesize 2048 --kernel_offset 0x80408000 --ramdisk_offset 0x81808000 --second_offset 0x81300000 --tags_offset 0x80400100 --cmdline 'console=ttyHSL0,115200,n8 user_debug=31' --kernel kernel --ramdisk ramdisk.cpio.gz -o boot.img
root@android:/data/local/tmp #

-- Before you go any futher, copy all text within your android terminal emulator and paste it in to a text document. I personally use 920 Text Editor from the play store. You will do this so when the time comes you can open it back up and copy/paste the command to rebuild your boot.img as listed (This will save you some time).

-- Congratulations, you have done well so far. By typing and entering the command 'ls', you can see what all is in your directory. Here is an example:

Code:

root@android:/data/local/tmp # ls
ls
boot.img
init.rc
kernel
ramdisk.cpio.gz
root@android:/data/local/tmp #

-- Now lets create a folder and lets call it ramdisk. Here is an example:

Code:

root@android:/data/local/tmp # mkdir ramdisk
mkdir ramdisk
root@android:/data/local/tmp #

-- Now lets change directories to that ramdisk folder. Here is an example:

Code:

root@android:/data/local/tmp # cd ramdisk
cd ramdisk
root@android:/data/local/tmp/ramdisk #

-- Go ahead and extract ramdisk.cpio.gz. Here is an example:

Code:

root@android:/data/local/tmp/ramdisk # gunzip -c ../ramdisk.cpio.gz | cpio -i
isk.cpio.gz | cpio -i     <                                                   
1851 blocks
root@android:/data/local/tmp/ramdisk #

-- Congratulations, you have done well so far. By typing and entering the command 'ls', you can see what all is in your directory. Here is an example:

Code:

root@android:/data/local/tmp/ramdisk # ls
ls
cwkeys
data
default.prop
dev
fstab.k2_cl
init
init.goldfish.rc
init.qcom.rc
init.qcom.sh
init.rc
init.target.rc
init.target.recovery.rc
init.trace.rc
init.usb.rc
proc
sbin
sys
system
ueventd.goldfish.rc
ueventd.rc
ueventd.target.rc
root@android:/data/local/tmp/ramdisk #

-- Now feel free at this point to make your edits within the ramdisk folder. When complete then come back and we shall finish the job.

-- Go ahead and move back out of the ramdisk folder by the following command:

Code:

root@android:/data/local/tmp/ramdisk # cd ..
cd ..
root@android:/data/local/tmp #

-- You should now be in /data/local/tmp/.

-- Lets go ahead and repack the contents found in the ramdisk folder. Here, we will make use of the mkbootfs binary. Please take note that your original is named 'ramdisk.cpio.gz'. Here we will be repacking and renaming it to 'myramdisk.gz'. Here is an example:

Code:

root@android:/data/local/tmp # mkbootfs ./ramdisk | gzip > myramdisk.gz
mkbootfs ./ramdisk | gzip > myramdisk.gz
root@android:/data/local/tmp #

-- Open up your saved text file as instructed earlier and scroll to where you see this:

Code:

To rebuild this boot image, you can use the command:
  mkbootimg --base 0 --pagesize 2048 --kernel_offset 0x80408000 --ramdisk_offset
 0x81808000 --second_offset 0x81300000 --tags_offset 0x80400100 --cmdline 'conso
le=ttyHSL0,115200,n8 user_debug=31' --kernel kernel --ramdisk ramdisk.cpio.gz -o
 boot.img

-- Look for --ramdisk ramdisk.cpio.gz and INSURE you change it to --ramdisk myramdisk.gz. Also go ahead and change boot.img to modboot.img. Now copy the mkbootimg command and paste it in to your android terminal emulator. Press enter.

-- There are multiple ways you can apply the new boot.img. The smartest way would be to use fastboot so that you may boot the image vice flashing it in case you screwed something up on your own accord. However, I personally will write the boot.img straight to the boot partition using dd, then I reboot the device. If you wish to do the same then that is fine. 

-- Now you have your new Modded Boot Image. Enjoy, and as always... CLICK THANKS if this was helpful to you and....

--- Happy Hunting!!!

Screen Shots:











boot_manipulation.zip (16.7 KB)

flash_boot_manipulation.zip (140 Kb)