Skip to content

Instantly share code, notes, and snippets.

@ashutosh-mishra
Forked from azureru/extract android kernel.md
Last active April 5, 2025 18:02
Show Gist options
  • Save ashutosh-mishra/863d7f3b0a3099842530244b8bb8696d to your computer and use it in GitHub Desktop.
Save ashutosh-mishra/863d7f3b0a3099842530244b8bb8696d to your computer and use it in GitHub Desktop.

Revisions

  1. ashutosh-mishra revised this gist Nov 24, 2017. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion edit-init-rc.md
    Original file line number Diff line number Diff line change
    @@ -7,10 +7,11 @@ on property:dev.bootcomplete=1
    # exec - system system -- /system/bin/sh /data/local/bootscript/testservice.sh
    ```
    Script can contains applications start, stop commands
    ```
    /system/bin/am startservice com.example.android.testservice/.MyService
    /system/bin/am stopservice com.example.android.testservice/.MyService
    /system/bin/am start/kill/force-stop com.example.android.testservice/.MainActivity

    ```

    # Get the image - Extracting Existing Kernel + Ramfs

  2. ashutosh-mishra revised this gist Nov 24, 2017. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions edit-init-rc.md
    Original file line number Diff line number Diff line change
    @@ -1,10 +1,16 @@
    # init.rc changes
    init.rc changes to run any script
    Can be used to start any android application, service
    ```
    on property:dev.bootcomplete=1
    exec - system system -- /system/bin/sh <custom script path>
    # exec - system system -- /system/bin/sh /data/local/bootscript/testservice.sh
    ```
    Script can contains applications start, stop commands
    /system/bin/am startservice com.example.android.testservice/.MyService
    /system/bin/am stopservice com.example.android.testservice/.MyService
    /system/bin/am start/kill/force-stop com.example.android.testservice/.MainActivity


    # Get the image - Extracting Existing Kernel + Ramfs

  3. ashutosh-mishra revised this gist Nov 24, 2017. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions edit-init-rc.md
    Original file line number Diff line number Diff line change
    @@ -123,6 +123,8 @@ find . | cpio -o -H newc | gzip > ../initramfs.cpio.gz # From the extracted
    References:

    http://droidcore.blogspot.in/2012/12/how-to-edit-initrc-in-android.html

    https://github.com/135f2l/AndroidNativeDaemon

    https://android.stackexchange.com/questions/184074/selinux-prevents-my-init-rc-exec-command-to-execute

  4. ashutosh-mishra revised this gist Nov 24, 2017. 2 changed files with 128 additions and 106 deletions.
    128 changes: 128 additions & 0 deletions edit-init-rc.md
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,128 @@
    # init.rc changes
    init.rc changes to run any script
    ```
    on property:dev.bootcomplete=1
    exec - system system -- /system/bin/sh <custom script path>
    # exec - system system -- /system/bin/sh /data/local/bootscript/testservice.sh
    ```

    # Get the image - Extracting Existing Kernel + Ramfs

    Enter the machine using `adb shell`
    Identify the partition either using
    Run `cat /proc/partitions` OR
    parted utility


    Dump the partition to a file using dd

    ```
    dd if=/dev/block/mmcblk0p6 of=/data/kernel_ramfs.img
    ```

    Extract it to your linux system `adb pull /data/kernel_ramfs.img`


    # Install abootimg

    Run `sudo apt-get install abootimg`


    # Check the Kernel Dump

    Run `abootimg -i kernel_ramfs.img`. It need to show

    ```
    Android Boot Image Info:
    * file name = kernel_ramfs.img
    * image size = 16777216 bytes (16.00 MB)
    page size = 2048 bytes
    * Boot Name = ""
    * kernel size = 9797076 bytes (9.34 MB)
    ramdisk size = 2017625 bytes (1.92 MB)
    * load addresses:
    kernel: 0x40008000
    ramdisk: 0x41000000
    tags: 0x40000100
    * empty cmdline
    * id = 0x7c37c0d4 0xcefde745 0xe81b85ba 0xf05275ba 0xbe7de0ad 0x00000000 0x00000000 0x00000000
    ```

    That means you dump the correct kernel+ramfs

    # Extract Kernel Dump

    ```
    abootimg -x kernel_ramfs.img
    ```

    It will extract `zImage` and also `initrd.img`

    # Extract Ramdisk, Modify And Repack

    ```
    mkdir initrd
    cd initrd
    cat ../initrd.img | gunzip | cpio -vid
    ```

    Modify the ramdisk accordingly (e.g. you modify init.rc or add another additonal files)
    Then repack accordingly

    ```
    cd initrd
    find . | cpio --create --format='newc' | gzip > ../myinitrd.img
    ```

    # Repacking Boot.Img

    ```
    cd ..
    abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitrd.img
    ```
    Repacking might fail due to size issue, remove unnecessary comments, files from ramdisk image and try again after recreating initrd image.

    # Reflash
    Enter in fastboot mode
    ```
    adb reboot-bootloader
    sudo fastboot devices -l # To check whether device entered in fastboot mode
    sudo fastboot erase boot # Erase existing boot image
    sudo fastboot flash boot boot.img # Flash new image
    sudo fastboot reboot # To come out from fastboot mode
    ```

    # Verify the changes
    Verify init.rc for changes
    Verify dmesg, logcat(Any init.rc script invokation error will come in dmesg)


    Another way
    Download the Extract Tools..!! - https://drive.google.com/file/d/0B4fizJM7V7pPMUNkNzNEV01Sb28/view

    1) Get boot.img file

    2) unpack boot.img file
    ~/Downloads/Extract\ Tolls/unmkbootimg boot.img

    3) Extract ramdisk (initramfs)
    gzip -dc initramfs.cpio.gz | cpio -i

    4) Re-pack ramdisk
    find . | cpio -o -H newc | gzip > ../initramfs.cpio.gz # From the extracted folder

    5) Re-pack boot img
    ~/Downloads/Extract\ Tolls/mkbootimg --kernel kernel.gz --ramdisk ../initramfs.cpio.gz -o new_boot.img

    References:

    http://droidcore.blogspot.in/2012/12/how-to-edit-initrc-in-android.html
    https://github.com/135f2l/AndroidNativeDaemon
    https://android.stackexchange.com/questions/184074/selinux-prevents-my-init-rc-exec-command-to-execute

    106 changes: 0 additions & 106 deletions extract android kernel.md
    Original file line number Diff line number Diff line change
    @@ -1,106 +0,0 @@
    # Extracting Existing Kernel + Ramfs

    Enter the machine using `adb shell`

    Run `cat /proc/partitions`

    ```
    # Path Purpose Size
    0 /dev/block/mmcblk0 7761920
    1 /dev/block/mmcblk0p1 data 6085631
    2 /dev/block/mmcblk0p2 bootloader 16384
    3 /dev/block/mmcblk0p3 1
    5 /dev/block/mmcblk0p5 uboot 16384
    6 /dev/block/mmcblk0p6 kernel 16384
    7 /dev/block/mmcblk0p7 system 786432
    8 /dev/block/mmcblk0p8 misc 16384
    9 /dev/block/mmcblk0p9 recovery 32768
    10 /dev/block/mmcblk0p10 sysrecovery 16384
    11 /dev/block/mmcblk0p11 private 16384
    12 /dev/block/mmcblk0p12 Reserve0 16384
    13 /dev/block/mmcblk0p13 klog 32768
    14 /dev/block/mmcblk0p14 Reserve1 16384
    15 /dev/block/mmcblk0p15 Reserve2 655360
    ```

    Dump the partition to a file using dd

    ```
    dd if=/dev/block/mmcblk0p6 of=/data/kernel_ramfs.img
    ```

    Extract it to your linux system `adb pull /data/kernel_ramfs.img`


    # Install abootimg

    Run `sudo apt-get install abootimg`


    # Check the Kernel Dump

    Run `abootimg -i kernel_ramfs.img`. It need to show

    ```
    Android Boot Image Info:
    * file name = kernel_ramfs.img
    * image size = 16777216 bytes (16.00 MB)
    page size = 2048 bytes
    * Boot Name = ""
    * kernel size = 9797076 bytes (9.34 MB)
    ramdisk size = 2017625 bytes (1.92 MB)
    * load addresses:
    kernel: 0x40008000
    ramdisk: 0x41000000
    tags: 0x40000100
    * empty cmdline
    * id = 0x7c37c0d4 0xcefde745 0xe81b85ba 0xf05275ba 0xbe7de0ad 0x00000000 0x00000000 0x00000000
    ```

    That means you dump the correct kernel+ramfs

    # Extract Kernel Dump

    ```
    abootimg -x kernel_ramfs.img
    ```

    It will extract `zImage` and also `initrd.img`

    # Extract Ramdisk, Modify And Repack

    ```
    mkdir initrd
    cd initrd
    cat ../initrd.img | gunzip | cpio -vid
    ```

    Modify the ramdisk accordingly (e.g. you modify init.rc or add another additonal files)
    Then repack accordingly

    ```
    cd initrd
    find . | cpio --create --format='newc' | gzip > ../myinitrd.img
    ```

    # Repacking Boot.Img

    ```
    abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitrd.img
    ```

    # Adb Put and Redumping

    ```
    adb push myboot.img /data/myboot.img
    adb shell dd if=mybootimg of=/dev/block/mmcblk0p6
    ```

    Reboot - And pray for the best

  5. @azureru azureru renamed this gist Jul 25, 2017. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion extract.md → extract android kernel.md
    Original file line number Diff line number Diff line change
    @@ -98,7 +98,7 @@ abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitrd.img
    # Adb Put and Redumping

    ```
    adb put myboot.img /data/myboot.img
    adb push myboot.img /data/myboot.img
    adb shell dd if=mybootimg of=/dev/block/mmcblk0p6
    ```

  6. @azureru azureru revised this gist Oct 27, 2016. 1 changed file with 7 additions and 4 deletions.
    11 changes: 7 additions & 4 deletions extract.md
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,7 @@
    # Extracting Existing Kernel + Ramfs

    Enter the machine using `adb shell`

    Run `cat /proc/partitions`

    ```
    @@ -22,18 +23,20 @@ Run `cat /proc/partitions`
    15 /dev/block/mmcblk0p15 Reserve2 655360
    ```

    3. Dump partition using dd
    Dump the partition to a file using dd

    ```
    dd if=/dev/block/mmcblk0p6 of=/data/kernel_ramfs.img
    ```

    4. Extract it to your linux system `adb pull /data/kernel_ramfs.img`
    Extract it to your linux system `adb pull /data/kernel_ramfs.img`


    # Install abootimg

    Run `sudo apt-get install abootimg`


    # Check the Kernel Dump

    Run `abootimg -i kernel_ramfs.img`. It need to show
    @@ -60,7 +63,7 @@ Android Boot Image Info:
    * id = 0x7c37c0d4 0xcefde745 0xe81b85ba 0xf05275ba 0xbe7de0ad 0x00000000 0x00000000 0x00000000
    ```

    That means you've dump the correct kernel+ramfs
    That means you dump the correct kernel+ramfs

    # Extract Kernel Dump

    @@ -79,7 +82,7 @@ cat ../initrd.img | gunzip | cpio -vid
    ```

    Modify the ramdisk accordingly (e.g. you modify init.rc or add another additonal files)
    Then repact accordingly
    Then repack accordingly

    ```
    cd initrd
  7. @azureru azureru revised this gist Oct 27, 2016. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions extract.md
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,8 @@
    # Extracting Existing Kernel + Ramfs

    1. Enter the machine using `adb shell`
    2. Run `cat /proc/partitions`
    Enter the machine using `adb shell`
    Run `cat /proc/partitions`

    ```
    # Path Purpose Size
    0 /dev/block/mmcblk0 7761920
  8. @azureru azureru revised this gist Oct 27, 2016. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion extract.md
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,6 @@

    1. Enter the machine using `adb shell`
    2. Run `cat /proc/partitions`

    ```
    # Path Purpose Size
    0 /dev/block/mmcblk0 7761920
  9. @azureru azureru created this gist Oct 27, 2016.
    103 changes: 103 additions & 0 deletions extract.md
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,103 @@
    # Extracting Existing Kernel + Ramfs

    1. Enter the machine using `adb shell`
    2. Run `cat /proc/partitions`

    ```
    # Path Purpose Size
    0 /dev/block/mmcblk0 7761920
    1 /dev/block/mmcblk0p1 data 6085631
    2 /dev/block/mmcblk0p2 bootloader 16384
    3 /dev/block/mmcblk0p3 1
    5 /dev/block/mmcblk0p5 uboot 16384
    6 /dev/block/mmcblk0p6 kernel 16384
    7 /dev/block/mmcblk0p7 system 786432
    8 /dev/block/mmcblk0p8 misc 16384
    9 /dev/block/mmcblk0p9 recovery 32768
    10 /dev/block/mmcblk0p10 sysrecovery 16384
    11 /dev/block/mmcblk0p11 private 16384
    12 /dev/block/mmcblk0p12 Reserve0 16384
    13 /dev/block/mmcblk0p13 klog 32768
    14 /dev/block/mmcblk0p14 Reserve1 16384
    15 /dev/block/mmcblk0p15 Reserve2 655360
    ```

    3. Dump partition using dd

    ```
    dd if=/dev/block/mmcblk0p6 of=/data/kernel_ramfs.img
    ```

    4. Extract it to your linux system `adb pull /data/kernel_ramfs.img`

    # Install abootimg

    Run `sudo apt-get install abootimg`

    # Check the Kernel Dump

    Run `abootimg -i kernel_ramfs.img`. It need to show

    ```
    Android Boot Image Info:
    * file name = kernel_ramfs.img
    * image size = 16777216 bytes (16.00 MB)
    page size = 2048 bytes
    * Boot Name = ""
    * kernel size = 9797076 bytes (9.34 MB)
    ramdisk size = 2017625 bytes (1.92 MB)
    * load addresses:
    kernel: 0x40008000
    ramdisk: 0x41000000
    tags: 0x40000100
    * empty cmdline
    * id = 0x7c37c0d4 0xcefde745 0xe81b85ba 0xf05275ba 0xbe7de0ad 0x00000000 0x00000000 0x00000000
    ```

    That means you've dump the correct kernel+ramfs

    # Extract Kernel Dump

    ```
    abootimg -x kernel_ramfs.img
    ```

    It will extract `zImage` and also `initrd.img`

    # Extract Ramdisk, Modify And Repack

    ```
    mkdir initrd
    cd initrd
    cat ../initrd.img | gunzip | cpio -vid
    ```

    Modify the ramdisk accordingly (e.g. you modify init.rc or add another additonal files)
    Then repact accordingly

    ```
    cd initrd
    find . | cpio --create --format='newc' | gzip > ../myinitrd.img
    ```

    # Repacking Boot.Img

    ```
    abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitrd.img
    ```

    # Adb Put and Redumping

    ```
    adb put myboot.img /data/myboot.img
    adb shell dd if=mybootimg of=/dev/block/mmcblk0p6
    ```

    Reboot - And pray for the best