Site icon 峰哥分享

A Rough log of android recovery img

Adb shell

// To check the current system mount

root@endeavoru:/proc # cat /proc/mounts | grep system

/dev/block/platform/sdhci-tegra.3/by-name/APP /system ext4 ro,seclabel,relatime,user_xattr,acl,barrier=0,data=ordered 0 0

root@endeavoru:/ # mount | grep system

/dev/block/platform/sdhci-tegra.3/by-name/APP /system ext4 ro,seclabel,relatime,user_xattr,acl,barrier=0,data=ordered 0 0

root@endeavoru:/system # busybox mount | grep system

/dev/block/platform/sdhci-tegra.3/by-name/APP on /system type ext4 (ro,seclabel,relatime,user_xattr,acl,barrier=0,data=ordered)

What’s the difference between busybox mount and mount?

// To make root folder writable

127|root@endeavoru:/ # mkdir a

mkdir failed for a, Read-only file system

255|root@endeavoru:/ # mount -o remount,rw /

root@endeavoru:/ # mkdir a

root@endeavoru:/ # ls

root@endeavoru:/ # mount -o remount,ro /

root@endeavoru:/ # mkdir b

mkdir failed for b, Read-only file system

255|root@endeavoru:/ # mount -o remount,rw /

root@endeavoru:/ # rmdir a

// To find out which partition is recovery

root@endeavoru:/ # cat /cache/recovery/last_log |grep recovery

Starting recovery on Fri Feb 23 13:00:26 2018

recovery filesystem table

  1 /recovery emmc /dev/block/mmcblk0p5 (null) 0

root@endeavoru:/ # cat /cache/recovery/last_log | more

Starting recovery on Fri Feb 23 13:00:26 2018

can’t open /dev/tty0: No such file or directory

framebuffer: fd 3 (720 x 1280)

recovery filesystem table

=========================

  0 /tmp ramdisk (null) (null) 0

  1 /recovery emmc /dev/block/mmcblk0p5 (null) 0

  2 /boot emmc /dev/block/mmcblk0p4 (null) 0

  3 /cache ext4 /dev/block/mmcblk0p13 (null) 0

  4 /data ext4 /dev/block/mmcblk0p15 (null) 0

  5 /sdcard vfat /dev/block/mmcblk0p14 (null) 0

  6 /system ext4 /dev/block/mmcblk0p12 (null) 0

  7 /misc emmc /dev/block/mmcblk0p17 (null) 0

// To List all partitions

root@endeavoru:/ # cat /proc/partitions

major minor  #blocks  name

 179        0   30535680 mmcblk0

 179        1       6144 mmcblk0p1

 179        2       2048 mmcblk0p2

 179        3       6144 mmcblk0p3

// To backup recovery

root@endeavoru:/ # cat /dev/block/mmcblk0p5 > /mnt/sdcard/recovery.img

root@endeavoru:/ # ls -l /mnt/sdcard/recovery.img

-rwxrwx— root     sdcard_r  8388608 2018-03-01 11:03 recovery.img

// Use adb pull to download the backup recovery.img file

fengnz@mac:~/HTC_One > adb pull /mnt/sdcard/recovery.img .

/mnt/sdcard/recovery.img: 1 file pulled. 0.6 MB/s (8388608 bytes in 13.321s)

// To download unmkbootimg go to

// To show image info (docker usage is off topic here)

docker cp unmkbootimg ubuntu:/root/

docker cp recovery.img ubuntu:/root/

docker exec -it ubuntu bash

cd root

root@072407a24838:~# ./unmkbootimg recovery.img

unmkbootimg version 1.2 – Mikael Q Kuisma <kuisma@ping.se>

Kernel size 5197608

Kernel address 0x10008000

Ramdisk size 2171498

Ramdisk address 0x11000000

Secondary size 0

Secondary address 0x10f00000

Kernel tags address 0x10000100

Flash page size 2048

Board name is “”

Command line “”

This image is built using standard mkbootimg

Extracting kernel to file zImage …

Extracting root filesystem to file initramfs.cpio.gz …

All done.

—————

To recompile this image, use:

  mkbootimg –kernel zImage –ramdisk initramfs.cpio.gz -o new_boot.img

—————

// To copy the ramdisk file out

fengnz@mac:~/HTC_One > docker cp ubuntu:/root/initramfs.cpio.gz .

// You can unzip this file and check the content

You can’t mount a recovery image as it’s not a regular file system. Read this for more info.

Check the res/images folder, you will see a bunch of images which may tell you where this recovery comes from.

// To unzip it in ubuntu docker

root@072407a24838:~# mkdir ramdisk

root@072407a24838:~# cd ramdisk/

root@072407a24838:~/ramdisk# apt-get install cpio

root@072407a24838:~/ramdisk# gunzip -c ../initramfs.cpio.gz | cpio -i

6419 blocks

root@072407a24838:~/ramdisk# ls

data           init                        res             system

default.prop   init.rc                     sbin            tmp

dev            init.recovery.endeavoru.rc  seapp_contexts  ueventd.goldfish.rc

etc            proc                        sepolicy        ueventd.rc

file_contexts  property_contexts           sys

You can modify the ramdisk files and repack it with the following command.

find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz

root@072407a24838:~/ramdisk# find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz

6419 blocks

root@072407a24838:~/ramdisk# cd ..

root@072407a24838:~# ls

initramfs.cpio.gz   ramdisk  recovery.img  zImage

newramdisk.cpio.gz  rec      unmkbootimg

root@072407a24838:~# ls -l

total 18100

-rw-r–r–  1 root root    2171498 Mar  1 23:06 initramfs.cpio.gz

-rw-r–r–  1 root root    2180261 Mar  1 23:48 newramdisk.cpio.gz

// Use this docker container for mkbootimg

// Run mkbootimg docker container

docker run -it -d –name mkbootimg –privileged=true –volume $(pwd)/kernel:/kernel dvitali/android-build-tools

// Move file from ubuntu container to this one

docker cp ubuntu:/root/ temp

fengnz@mac:~/HTC_One > docker cp temp/root mkbootimg:/

fengnz@mac:~/HTC_One > docker exec -it mkbootimg bash

cd root

mkbootimg –cmdline ‘no_console_suspend=1 console=null’ –kernel zImage –ramdisk newramdisk.cpio.gz -o mynewimage.img

root@2008c25fe133:~# ls -l

total 25308

-rw-r–r–  1  501 dialout 2171498 Mar  1 23:06 initramfs.cpio.gz

-rw-r–r–  1 root root    7380992 Mar  2 00:31 mynewimage.img

-rw-r–r–  1  501 dialout 2180261 Mar  1 23:48 newramdisk.cpio.gz

drwxr-xr-x 11  501 dialout    4096 Mar  1 23:48 ramdisk

drwxr-xr-x  2  501 dialout    4096 Mar  1 22:24 rec

-rw-r–r–  1  501 dialout 8388608 Mar  1 22:06 recovery.img

A new image is created, but it’s smaller than original. I am not sure whether it’s correct.

Exit mobile version