Extracting stock Boot, Recovery and Persist images

[zgfg]

Talking here about how to extract the stock Boot, Recovery and Persist images, needed in case of e.g. bootloop upon flashing Magisk or TWRP, to reflash the stock image(s).
Also, boot image is needed for patching from Magisk Manager (and flashing by Fastboot), as a preferable way to install Magisk.
Stock Recovery is needed if you want to revert from the custom one, and stock Persist is important because it contains certificate for Widevine L1 (needed for Full HD in eg Netflix)

From Recovery (zip) firmware

Download the Recovery (zip) image from:
https://c.mi.com/oc/miuidownload/detail?device=1700361

Extract the archive and find the boot.img inside.
However, it does not contain recovery.img

From Fastboot (tgz) firmware

Similarly, download the Fastboot (tgz) image from:
https://c.mi.com/oc/miuidownload/detail?guide=2
(check Desktop site if opening from the mobile browser)

Extract the archive, find the images folder with boot.img and recovery.img inside

From TWRP or OrangeBox

Boot and Persist images can be disk-dumped from TWRP or OrangeFox, from its Terminal, with the command:

dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img

Dumped images will be saved to Internal memory - both the official TWRP and OrangeFox support internal storage encryption (use your Android lock-screen password/pin), hence no need to format Data for TWRP to dump to Internal memory

Note:
Observe that if Magisk was installed, dumped Boot image won't be the stock one but the one already patched by Magisk

We could similarly dump the Recovery image, but since we must dump from TWRP or OorangeFox,
the dumped image won't be the stock one but the image of the installed custom Recovery

From Terminal Emulator app

Similarly, Recovery and Persist mages can be disk-dumped from Terminal emulator app:

su
dd if=/dev/block/bootdevice/by-name/recovery of=/sdcard/recovery.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img

By ADB

Finally, Recovery and Persist images can be also disk-dumped from ADB:

adb shell
su
dd if=/dev/block/bootdevice/by-name/recovery of=/sdcard/recovery.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img

Of course, ADB with drivers must be properly installed to the PC, and ADB debugging must be enabled in Settings, Developer options menu on the phone.
PC must be authorized from the phone once they get connected by USB cable

Finally, after the su command, root privilege must be granted to the Terminal emulator app before proceeding with dd command

Take care not to miss the authorization and root granting pop-ups on the phone if screen was switched of

Notes:

Observe that in both cases of Terminal emulator app and ADB, if custom Recovery was already installed, then you will be dumping the image of that custom Recovery

We can similarly dump the Bot image from Terminal emulator app or by ADB - but the root (Magisk) was prerequisite, hence the dumped image will be the Boot image already patched by Magisk

 

[zgfg]

(Extracted stock) image files can be flashed by various ways

From Fastboot

Image files must be on the PC:

fastboot flash boot boot.img
fastboot flash recovery recovery.img

(I didn't test for persist.img, but found a note somewhere that it doesn't work)

You can also temporarily boot with the given boot.img (it won't be flashed and next time you reboot, it will reboot with the boot image that was flashed/installed previously):

fastboot boot boot.img

(As far as I tested, it's not possible similarly to temporarily boot with the given recovery image, without really flashing it)

By ADB

Image files must be on Internal memory at /
At the same place wherre you disk-dumped them

Adb must be enabled, phone must be rooted and adb must be granted root privilege

dd if=/sdcard/boot.img of=/dev/block/bootdevice/by-name/boot
dd if=/sdcard/recovery.img of=/dev/block/bootdevice/by-name/recovery
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist

From Terminal Emulator app

Similarly like by adb, but here just use "su dd" instead of "adb shell su dd"

Of course, phone must be rooted and Terminal Emulator app must be granted root privilege

From TWRP

From Advanced, Terminal.
Similarly like by adb, but use just "dd" instead of "adb shell su dd"

However, boot.img and recovery.img can be also flashed from Install menu in TWRP.
Select Image (by default is ZIP File), navigate to your boot.img (recovery.img) and select to flash to Boot (Recovery).
Persist.img cannot be flashed that way because e.g., official TWRP does not offer to patch to Persist

From OrangeFox

Image files can be flashed by "dd" command, just like from TWRP (OrangeFox is developed on top of TWRP)

However, image files can be also flashed directly from the main menu in OrangeFox.
Not only boot.img and recovery.img but also persist.img - see attached screenshot

 

[zgfg]

Reserved

 

[zgfg]

Same applies also for disk-dumping/flashing persistbak.img

It's a good idea to backup both Persist and PersistBack, if something goes wrong you can also restore persisback.img to Persist

Btw, backup (dd) also sdf.img and keep;
dd if=/dev/block/sdf of=/sdcard/sdf.img
restore if you loose IMEIs:
dd if=/sdcard/sdf.bin of=/dev/block/sdf

 

[Cni]

The fastboot rom comes with the stock persist image?

Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.

---------- Post added at 02:31 PM ---------- Previous post was at 02:31 PM ----------

The fastboot rom comes with the stock persist image?

Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.

 

[zgfg]

The fastboot rom comes with the stock persist image?

Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.

---------- Post added at 02:31 PM ---------- Previous post was at 02:31 PM ----------

The fastboot rom comes with the stock persist image?

Maybe with that and the new 3.4.0 recovery (which can flash persist) I can get widevine l1 back.

I doubt you could find persist.img in tgz but download, extract and check

However, you can disk-dump persist.img and persistbak.img, save, rename persistbak.img to persist.img and flash it back, maybe it still contains your L1 certificate

If anything goes wrong, just flash your persist.img back

 

[tylerberk]

Has anyone got the L1 certificate using this method?

 

[Micdu70]

Has anyone got the L1 certificate using this method?

No, you can't get back Widevine L1...

 

[Immortal68]

Super useful guide, especially if you already have a ROM installed and don't want to download the whole ROM again. Tahnk you for the tips, OP!

 

[Ajgor alli]

boot, recovery, Huawei Lua-u22​