Learning About AVB Android Verified Boot (Boot.img dtb.img, vbmeta.img, and the "staging blob")

jenneh · Nov 25, 2022

I'm running out of room in my old notes and I found this command that does even better what I wanted to do

Code:

 find /dev/block -path \*/by-name -exec ls -l {} \;

BEAUTIFUL <3
Source: https://android.stackexchange.com/q...there-so-many-partitions-in-dev-block-mmcblk0

This video shows radio or wi-fi hacking

What busy box actually is I have always heard of busy box but I had not enough Linux knowledge to understand.. so now this video makes sense

RP1 RP2 RP3+ RP= Route Processor

Relevant for next project

Nvidia Shield TV SSD - done

It's done. I repleced original SSHD with SAmsung SSD. If someone else is interested in how to do this I'll help. ******************************************************* Some users and moderator has asked me to add mote information what this is...

forum.xda-developers.com

We can learn how to change out the shield's hard drive in the future and in learning how to do so, you could translate that to phones or anything anydroid

Why?

dev/block has all the images but

dev/block/platform/sdhci-tegra.3/by-name has the images as well. Now is this 2 separate files and taking up two times the space? Or are they somehow referencing the same partition somehow in the background? I am confused

Pull all parts

Code:

adb root
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/APP of=/storage/F4D8-568C/APP
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/BMP of=/storage/F4D8-568C/BMP
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/BPF of=/storage/F4D8-568C/BPF
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/CAC of=/storage/F4D8-568C/CAC
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/DTB of=/storage/F4D8-568C/DTB
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/EBT of=/storage/F4D8-568C/EBT
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/EKS of=/storage/F4D8-568C/EKS
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/FB of=/storage/F4D8-568C/FB
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/FCT of=/storage/F4D8-568C/FCT
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/LNX of=/storage/F4D8-568C/LNX
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/MDA of=/storage/F4D8-568C/MDA
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/MSC of=/storage/F4D8-568C/MSC
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/NCT of=/storage/F4D8-568C/NCT
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RBL of=/storage/F4D8-568C/RBL
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP1 of=/storage/F4D8-568C/RP1
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP2 of=/storage/F4D8-568C/RP2
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP3 of=/storage/F4D8-568C/RP3
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP4 of=/storage/F4D8-568C/RP4
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP5 of=/storage/F4D8-568C/RP5
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP6 of=/storage/F4D8-568C/RP6
adb shell dd if=/dev/block/platform/sdhci-tegra.3/by-name/RP7 of=/storage/F4D8-568C/RP7

Why you shouldn't be a bad guy

jenneh · Nov 26, 2022

@Renate Hi there I hope you had a nice Thanksgiving! Would you happen to be know if this is normal?

I know all the devices have the /dev/block section with the mmc named partitions, which are different for each device.

My question is, is it normal for a device to have another folder under "platform" or something similar with all the images again by name?

And Are these images actually stored on the device physically Twice? Or do you know how they could possibly be referencing the same file at the same time without adding space? I dd'd them and they are full images

Renate · Nov 26, 2022

jenneh said:
And Are these images actually stored on the device physically Twice?

No, that -> tells you that they are just symbolic links.
On some devices the "friendly names" are cryptic. On others some of them are more descriptive.

Code:

$ cd /dev/block/by-name/
$ ls -l
total 0
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 abl_a -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 abl_b -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 apdp -> /dev/block/mmcblk0p58
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 bluetooth_a -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 bluetooth_b -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 boot_a -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 boot_b -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 carrier -> /dev/block/mmcblk0p56
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 cid -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 cmnlib64_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 cmnlib64_b -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 cmnlib_a -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 cmnlib_b -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 ddr -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 devcfg_a -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 devcfg_b -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 devinfo -> /dev/block/mmcblk0p57
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 dhob -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 dsp_a -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 dsp_b -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 dtbo_a -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 dtbo_b -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 frp -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 fsc -> /dev/block/mmcblk0p71
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 fsg_a -> /dev/block/mmcblk0p69
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 fsg_b -> /dev/block/mmcblk0p70
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 hw -> /dev/block/mmcblk0p72
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 hyp_a -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 hyp_b -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 keymaster_a -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 keymaster_b -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 kpan -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 limits -> /dev/block/mmcblk0p65
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 logfs -> /dev/block/mmcblk0p60
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 logo_a -> /dev/block/mmcblk0p54
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 logo_b -> /dev/block/mmcblk0p55
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 metadata -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 misc -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 18 1970-04-18 05:37 mmcblk0 -> /dev/block/mmcblk0
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 modem_a -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 modem_b -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 modemst1 -> /dev/block/mmcblk0p67
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 modemst2 -> /dev/block/mmcblk0p68
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 msadp -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 padA -> /dev/block/mmcblk0p74
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 padB -> /dev/block/mmcblk0p76
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 persist -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 prodpersist -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 prov_a -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 prov_b -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 qupfw_a -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 qupfw_b -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 recovery_a -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 recovery_b -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 rpm_a -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 rpm_b -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 sp -> /dev/block/mmcblk0p73
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 spunvm -> /dev/block/mmcblk0p59
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 ssd -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 storsec_a -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 storsec_b -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 super -> /dev/block/mmcblk0p75
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 tz_a -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 tz_b -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 uefisecapp_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 uefisecapp_b -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 uefivarstore -> /dev/block/mmcblk0p66
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 userdata -> /dev/block/mmcblk0p77
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 utags -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 utagsBackup -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 vbmeta_a -> /dev/block/mmcblk0p61
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 vbmeta_b -> /dev/block/mmcblk0p62
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 vbmeta_system_a -> /dev/block/mmcblk0p63
lrwxrwxrwx 1 root root 21 1970-04-18 05:37 vbmeta_system_b -> /dev/block/mmcblk0p64
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 xbl_a -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 xbl_b -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 xbl_config_a -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 1970-04-18 05:37 xbl_config_b -> /dev/block/mmcblk0p4
$

jenneh · Nov 27, 2022

So yesterday I was able to trick the shield into letting me download the 9.1 firmwares by pushing the stock build.prop to the rooted image. I want to write that whole process down so I don't lose it. I don't know what to do with these things but I will find out.

To get full read write access to the device:
adb root
adb disable-verity
adb reboot
adb root
adb remount

How to get Clean build.prop from STOCK Firmware.

To get this, use 7zip to extract the system.img and go into the system/system folder.

The build.prop file will be in there. You can then push it to the shield:
adb push build.prop /system

After a reboot, if you go into Settings > Device Preferences > About > System Upgrade
You are presented with an option to "Download" or "Download and Install"

Select "Download" and when it is complete, the firmware will be saved in /data/ota_package

Running this command will pull the firmware for us
adb pull /data/ota_package/PUBLICf77c312b128b6bde79b389a322706382.zip

What's inside the thing.. Idk what to do with it. I will see what I can
Well I mean I could open the images up if they dont flash over easily and just write a script to port the contents to the rooted copy maybe

The install Will Fail, it wont break anything on the rooted image, but it wont install on its own without some tinkering it looks like

What is a br file?
"A BR file is a file compressed using Brotli, an open-source data compression algorithm"

BR File Extension - What is a .br file and how do I open it?

Learn about .BR files and view a list of programs that open them.

fileinfo.com

How to open Brotli files:

Download PeaZip Portable free RAR ZIP files archiver utility

Download PeaZip Portable, RAR ZIP files archiver utility. Free, portable WinRar WinZip alternative software, no installation needed.

peazip.github.io

What is the format of the "BMP" partition?

I understand that you don’t. That’s why I want to know if there is any information about the format of the BMP partition, so that I don’t have to debug-dump-reverse-engineer it myself.

forums.developer.nvidia.com

Code:

4
73661
0
0
erase 6,659,1663,70925,97792,98818,135526
new 8,0,38,39,41,45,147,2175,3057
new 2,3057,4081
new 2,4081,5105
new 2,5105,6129
new 2,6129,7153
new 2,7153,8177
new 2,8177,9201
new 2,9201,10225
new 2,10225,11249
new 2,11249,12273
new 2,12273,13297
new 2,13297,14321
new 2,14321,15345
new 2,15345,16369
new 2,16369,17393
new 2,17393,18417
new 2,18417,19441
new 2,19441,20465
new 2,20465,21489
new 2,21489,22513
new 2,22513,23537
new 2,23537,24561
new 2,24561,25585
new 2,25585,26609
new 2,26609,27633
new 2,27633,28657
new 2,28657,29681
new 2,29681,30705
new 2,30705,31729
new 2,31729,32753
new 4,32753,32770,32803,33810
new 2,33810,34834
new 2,34834,35858
new 2,35858,36882
new 2,36882,37906
new 2,37906,38930
new 2,38930,39954
new 2,39954,40978
new 2,40978,42002
new 2,42002,43026
new 2,43026,44050
new 2,44050,45074
new 2,45074,46098
new 2,46098,47122
new 2,47122,48146
new 2,48146,49170
new 2,49170,50194
new 2,50194,51218
new 2,51218,52242
new 2,52242,53266
new 2,53266,54290
new 2,54290,55314
new 2,55314,56338
new 2,56338,57362
new 2,57362,58386
new 2,58386,59410
new 2,59410,60434
new 2,60434,61458
new 2,61458,62482
new 2,62482,63506
new 2,63506,64530
new 2,64530,65554
new 2,65554,66578
new 2,66578,67602
new 2,67602,68626
new 2,68626,69650
new 6,69650,70413,98304,98306,136038,136297
new 2,136297,137321
new 4,137321,138196,138239,138240
zero 8,38,39,41,45,147,659,1663,2170
zero 8,2170,2175,32770,32803,70413,70925,97792,98266
zero 6,98266,98304,98306,98818,135526,136000
zero 4,136000,136038,138196,138239

Code:

4
428295
0
0
erase 4,916,7711,426285,515483
new 8,0,140,142,144,159,404,8223,8860
new 2,8860,9884
new 2,9884,10908
new 2,10908,11932
new 2,11932,12956
new 2,12956,13980
new 2,13980,15004
new 2,15004,16028
new 2,16028,17052
new 2,17052,18076
new 2,18076,19100
new 2,19100,20124
new 2,20124,21148
new 2,21148,22172
new 2,22172,23196
new 2,23196,24220
new 2,24220,25244
new 2,25244,26268
new 2,26268,27292
new 2,27292,28316
new 2,28316,29340
new 2,29340,30364
new 2,30364,31388
new 2,31388,32412
new 4,32412,32770,32895,33561
new 2,33561,34585
new 2,34585,35609
new 2,35609,36633
new 2,36633,37657
new 2,37657,38681
new 2,38681,39705
new 2,39705,40729
new 2,40729,41753
new 2,41753,42777
new 2,42777,43801
new 2,43801,44825
new 2,44825,45849
new 2,45849,46873
new 2,46873,47897
new 2,47897,48921
new 2,48921,49945
new 2,49945,50969
new 2,50969,51993
new 2,51993,53017
new 2,53017,54041
new 2,54041,55065
new 2,55065,56089
new 2,56089,57113
new 2,57113,58137
new 2,58137,59161
new 2,59161,60185
new 2,60185,61209
new 2,61209,62233
new 2,62233,63257
new 2,63257,64281
new 2,64281,65305
new 2,65305,66329
new 2,66329,67353
new 2,67353,68377
new 2,68377,69401
new 2,69401,70425
new 2,70425,71449
new 2,71449,72473
new 2,72473,73497
new 2,73497,74521
new 2,74521,75545
new 2,75545,76569
new 2,76569,77593
new 2,77593,78617
new 2,78617,79641
new 2,79641,80665
new 2,80665,81689
new 2,81689,82713
new 2,82713,83737
new 2,83737,84761
new 2,84761,85785
new 2,85785,86809
new 2,86809,87833
new 2,87833,88857
new 2,88857,89881
new 2,89881,90905
new 2,90905,91929
new 2,91929,92953
new 2,92953,93977
new 2,93977,95001
new 2,95001,96025
new 2,96025,97049
new 2,97049,98073
new 4,98073,98306,98431,99222
new 2,99222,100246
new 2,100246,101270
new 2,101270,102294
new 2,102294,103318
new 2,103318,104342
new 2,104342,105366
new 2,105366,106390
new 2,106390,107414
new 2,107414,108438
new 2,108438,109462
new 2,109462,110486
new 2,110486,111510
new 2,111510,112534
new 2,112534,113558
new 2,113558,114582
new 2,114582,115606
new 2,115606,116630
new 2,116630,117654
new 2,117654,118678
new 2,118678,119702
new 2,119702,120726
new 2,120726,121750
new 2,121750,122774
new 2,122774,123798
new 2,123798,124822
new 2,124822,125846
new 2,125846,126870
new 2,126870,127894
new 2,127894,128918
new 2,128918,129942
new 2,129942,130966
new 2,130966,131990
new 2,131990,133014
new 2,133014,134038
new 2,134038,135062
new 2,135062,136086
new 2,136086,137110
new 2,137110,138134
new 2,138134,139158
new 2,139158,140182
new 2,140182,141206
new 2,141206,142230
new 2,142230,143254
new 2,143254,144278
new 2,144278,145302
new 2,145302,146326
new 2,146326,147350
new 2,147350,148374
new 2,148374,149398
new 2,149398,150422
new 2,150422,151446
new 2,151446,152470
new 2,152470,153494
new 2,153494,154518
new 2,154518,155542
new 2,155542,156566
new 2,156566,157590
new 2,157590,158614
new 2,158614,159638
new 2,159638,160662
new 2,160662,161686
new 2,161686,162710
new 2,162710,163734
new 4,163734,163842,163967,164883
new 2,164883,165907
new 2,165907,166931
new 2,166931,167955
new 2,167955,168979
new 2,168979,170003
new 2,170003,171027
new 2,171027,172051
new 2,172051,173075
new 2,173075,174099
new 2,174099,175123
new 2,175123,176147
new 2,176147,177171
new 2,177171,178195
new 2,178195,179219
new 2,179219,180243
new 2,180243,181267
new 2,181267,182291
new 2,182291,183315
new 2,183315,184339
new 2,184339,185363
new 2,185363,186387
new 2,186387,187411
new 2,187411,188435
new 2,188435,189459
new 2,189459,190483
new 2,190483,191507
new 2,191507,192531
new 2,192531,193555
new 2,193555,194579
new 2,194579,195603
new 2,195603,196627
new 2,196627,197651
new 2,197651,198675
new 2,198675,199699
new 2,199699,200723
new 2,200723,201747
new 2,201747,202771
new 2,202771,203795
new 2,203795,204819
new 2,204819,205843
new 2,205843,206867
new 2,206867,207891
new 2,207891,208915
new 2,208915,209939
new 2,209939,210963
new 2,210963,211987
new 2,211987,213011
new 2,213011,214035
new 2,214035,215059
new 2,215059,216083
new 2,216083,217107
new 2,217107,218131
new 2,218131,219155
new 2,219155,220179
new 2,220179,221203
new 2,221203,222227
new 2,222227,223251
new 2,223251,224275
new 2,224275,225299
new 2,225299,226323
new 2,226323,227347
new 2,227347,228371
new 4,228371,229378,229503,229520
new 2,229520,230544
new 2,230544,231568
new 2,231568,232592
new 2,232592,233616
new 2,233616,234640
new 2,234640,235664
new 2,235664,236688
new 2,236688,237712
new 2,237712,238736
new 2,238736,239760
new 2,239760,240784
new 2,240784,241808
new 2,241808,242832
new 2,242832,243856
new 2,243856,244880
new 2,244880,245904
new 2,245904,246928
new 2,246928,247952
new 2,247952,248976
new 2,248976,250000
new 2,250000,251024
new 2,251024,252048
new 2,252048,253072
new 2,253072,254096
new 2,254096,255120
new 2,255120,256144
new 2,256144,257168
new 2,257168,258192
new 2,258192,259216
new 2,259216,260240
new 2,260240,261264
new 2,261264,262288
new 2,262288,263312
new 2,263312,264336
new 2,264336,265360
new 2,265360,266384
new 2,266384,267408
new 2,267408,268432
new 2,268432,269456
new 2,269456,270480
new 2,270480,271504
new 2,271504,272528
new 2,272528,273552
new 2,273552,274576
new 2,274576,275600
new 2,275600,276624
new 2,276624,277648
new 2,277648,278672
new 2,278672,279696
new 2,279696,280720
new 2,280720,281744
new 2,281744,282768
new 2,282768,283792
new 2,283792,284816
new 2,284816,285840
new 2,285840,286864
new 2,286864,287888
new 2,287888,288912
new 2,288912,289936
new 2,289936,290960
new 2,290960,291984
new 2,291984,293008
new 2,293008,294032
new 4,294032,294914,295039,295181
new 2,295181,296205
new 2,296205,297229
new 2,297229,298253
new 2,298253,299277
new 2,299277,300301
new 2,300301,301325
new 2,301325,302349
new 2,302349,303373
new 2,303373,304397
new 2,304397,305421
new 2,305421,306445
new 2,306445,307469
new 2,307469,308493
new 2,308493,309517
new 2,309517,310541
new 2,310541,311565
new 2,311565,312589
new 2,312589,313613
new 2,313613,314637
new 2,314637,315661
new 2,315661,316685
new 2,316685,317709
new 2,317709,318733
new 2,318733,319757
new 2,319757,320781
new 2,320781,321805
new 2,321805,322829
new 2,322829,323853
new 2,323853,324877
new 2,324877,325901
new 2,325901,326925
new 2,326925,327949
new 2,327949,328973
new 2,328973,329997
new 2,329997,331021
new 2,331021,332045
new 2,332045,333069
new 2,333069,334093
new 2,334093,335117
new 2,335117,336141
new 2,336141,337165
new 2,337165,338189
new 2,338189,339213
new 2,339213,340237
new 2,340237,341261
new 2,341261,342285
new 2,342285,343309
new 2,343309,344333
new 2,344333,345357
new 2,345357,346381
new 2,346381,347405
new 2,347405,348429
new 2,348429,349453
new 2,349453,350477
new 2,350477,351501
new 2,351501,352525
new 2,352525,353549
new 2,353549,354573
new 2,354573,355597
new 2,355597,356621
new 2,356621,357645
new 2,357645,358669
new 2,358669,359693
new 2,359693,360717
new 2,360717,361741
new 2,361741,362765
new 2,362765,363789
new 2,363789,364813
new 2,364813,365837
new 2,365837,366861
new 2,366861,367885
new 2,367885,368909
new 2,368909,369933
new 2,369933,370957
new 2,370957,371981
new 2,371981,373005
new 2,373005,374029
new 2,374029,375053
new 2,375053,376077
new 2,376077,377101
new 2,377101,378125
new 2,378125,379149
new 2,379149,380173
new 2,380173,381197
new 2,381197,382221
new 2,382221,383245
new 2,383245,384269
new 2,384269,385293
new 2,385293,386317
new 2,386317,387341
new 2,387341,388365
new 2,388365,389389
new 2,389389,390413
new 2,390413,391437
new 2,391437,392461
new 2,392461,393485
new 2,393485,394509
new 2,394509,395533
new 2,395533,396557
new 2,396557,397581
new 2,397581,398605
new 2,398605,399629
new 2,399629,400653
new 2,400653,401677
new 2,401677,402701
new 2,402701,403725
new 2,403725,404749
new 2,404749,405773
new 2,405773,406797
new 2,406797,407821
new 2,407821,408845
new 2,408845,409869
new 2,409869,410893
new 2,410893,411917
new 2,411917,412941
new 2,412941,413965
new 2,413965,414989
new 2,414989,416013
new 2,416013,417037
new 2,417037,418061
new 2,418061,419085
new 2,419085,420109
new 2,420109,421133
new 2,421133,422157
new 2,422157,423181
new 2,423181,424205
new 2,424205,425229
new 4,425229,425773,515995,516475
new 2,516475,517499
new 2,517499,518523
new 2,518523,519547
new 2,519547,520571
new 2,520571,521595
new 2,521595,522619
new 2,522619,523643
new 4,523643,524173,524287,524288
zero 8,140,142,144,159,404,916,7711,8206
zero 14,8206,8223,32770,32895,98306,98431,163842,163967,229378,229503,294914,295039,425773,426155
zero 6,426155,426285,515483,515995,524173,524287

Code:

Code:

ota-property-files=metadata:69:307
ota-required-cache=0
ota-type=BLOCK
post-build=NVIDIA/mdarcy/mdarcy:11/RQ1A.210105.003/7825230_3062.3935:user/release-keys
post-build-incremental=7825230_3062.3935
post-sdk-level=30
post-security-patch-level=2022-04-05
post-timestamp=1655329637
pre-device=mdarcy

Dr Katie was on David Bombal's podcast and intrigued me enough to look up her channel and she does an amazing job explaining things about bounties to encourage me to do some things.

HackerOne | #1 Trusted Security Platform and Hacker Program

Reduce the risk of a security incident by working with the world’s largest community of trusted ethical hackers. HackerOne offers bug bounty, VDP, security assessments, attack surface management, and pentest solutions.

hackerone.com

apk decompiler

Releases · skylot/jadx

Dex to Java decompiler. Contribute to skylot/jadx development by creating an account on GitHub.

github.com

All this Once Nonsense in Fastboot Now looks like Candy. Gosh I want to do All the Things

it let me delete that rp4 partition that I didn't know existed. so what would happen if I delete the bootloader? haha I imagine it is obvious so I wont try right now

DP 5.0.1 How to add the UDA partition?

Hey, I have flashed the system with the standard flash partition table flash_l4t_t194_spi_emmc_p3668.xml: <partition name="UDA" type="data"> <allocation_policy> sequential </allocation_policy> <filesystem_type> basic </filesystem_type> <size> 18432 </size> <file_system_attribute> 0...

forums.developer.nvidia.com

Creating emmc flashable image from a sd card image

I was able to create a working image on a Jetson NX development kit that uses sd card storage. We would like to extract the image into a .img that can be flashed into a 16Gb emmc production module of the Jetson NX. Thanks.

forums.developer.nvidia.com

[REFERENCE] How to compile an Android kernel

Introduction Hello everyone, I will be going over how to compile a kernel from beginning to end! Prerequisites: A Linux environment (preferably 64-bit) Knowledge of how to navigate the command line Common sense A learning spirit, there will be...

forum.xda-developers.com

jenneh · Nov 28, 2022

Hi @Renate! I was wondering if you have ever experienced lag in the adb shell? For instance if you are pulling a file in one window and in another you are trying to poke around in the shell. For me with command prompt, powershell, or the terminal emulator app, when running pull with a shell open, I get typing lag. This doesn't happen on my linux vm, but I wonder if you knew something I could do on windows to run adb better? I'm using the latest one from the android studio

Renate · Nov 28, 2022

jenneh said:
I was wondering if you have ever experienced lag in the adb shell?

No, I've found ADB to be pretty efficient when using multiple shells or adbsync.exe or adbgrab.exe
Still, Google gets no credit for an adb.exe that takes over a second to start. I guess they just put lots of delays in to work around some race condition on an i386.

jenneh · Nov 28, 2022

@Renate Thank You for letting me bounce questions off you. Your mentioning of the i386 made me think that this is perhaps yet another cute little AMD bug and Considering all the articles with Ryzen and adb problems, I now know where to research. THANKS this is driving me crazy. I refuse to change to intel because to be honest I enjoy solving the strange problems the amd cpu creates.. especially in virtualization

jenneh · Nov 28, 2022

starting a new section for notes

This article basically explained to me that somewhere in that mess of images I pulled, lies my bootloader partition I have been looking for... for sooo long x.x the op's bootloader partition was named "aboot"

How to Discover Hidden Fastboot Commands

There are many hidden fastboot commands on your device. In order to find them, we will need to dump the bootloader and examine the contents!

www.xda-developers.com

Now I know what "strings" does. Added that to my MAP the systems are all the same, Linux~!

Code:

strings * | findstr /i oem

What the heck is docker

Patching the adb daemon to run as root

How to get root on nontraditional Android devices by patching the adbd binary.

harrisonsand.com

Root issues:Magisk and MagiskHide Installation and Troubleshooting guide

www.didgeridoohan.com

jenneh · Nov 29, 2022

Hi @Renate! I hope your day is going well!

I was wondering if you could answer a question about Magisk today?

Am I able to share with others a patched boot.img made from magisk, for the same device, on the same firmware, and would the patched image just work on the other person's device?

Like after instructing them to erase the boot partition in fastboot and reflash the mod? Gosh could it be so simple?

For Context my friend Dawn was able to teach me about Magisk Delta, and we were able to use it to root our stock fimwares on the shield. So I was able to get the two firmwares they haven't released for us on their site yet and I was wondering if I just shared a modded boot.img and easy instructions how to flash that partition and push over the magisk apk, if that would just work for others without a bootloop?

I appreciate your time as always!

Renate · Nov 29, 2022

Magisk and its variants just start from a stock boot image.
You can swap the modified image with friends as long as the original boot images were compatible.

jenneh · Dec 1, 2022

Good Morning @Renate!

I have a different Problem today, maybe you have experienced it before or have a suggestion?

So the problem is I rooted a Stock firmware, but since it's stock it won't let me run adb as root.

Do you know of a magisk module or some way to fix this? I have done some research and tried some repos and will continue trying but maybe you know a fix? Every change I made in the build.prop resulted in the android man dying x.x

Renate · Dec 1, 2022

jenneh said:
So the problem is I rooted a Stock firmware...

This is not clear. Are you running Magisk?

If you directly modify build.prop in /system (or in super) you will break verification with vb_meta.
Normally you don't want to modify build.prop anyway.

If you are running Magisk you can just:

Code:

C:\>adb shell
$ su
#

If you are not running Magisk and you want to directly make modifications you will need to defeat vb_meta (and possibly vb_vendor, vb_system...)

If you want ADB to be root without su (of some kind) you will need to change the build type or patch adbd,

jenneh · Dec 1, 2022

@Renate thank you! Sorry I didn't make things clear! "Patch Adbd " I think is what I need to do. I found this guide https://harrisonsand.com/posts/patching-adb-root/ it actually makes sense so I am going to try it. Thank You... gosh you have helped me to do things I literally dreamed about.

Well I am having problems doing the magisk boot tools like he says in the guide so I think I could use your imgutil to do the same? Going to try now

Renate · Dec 1, 2022

jenneh said:
I found this guide...

Ha, ha, I've never seen that but I've been doing exactly that for years.
I just jump over all that minijail stuff.

jenneh · Dec 1, 2022

Miss @Renate I am a dumb dumb and I have never even heard of a mini jail until today x.x It's fascinating you have been doing it so long. Do you have any guidance how I can just "jump over" the jail? This is the boot.img I am working with. I really really am trying to understand and not just have things done x.x but I don't know what to do. I mean I played with your tools again, extracted the kernel and payload, and played with modfile to try to skip but I wasn't successful

Renate · Dec 1, 2022

jenneh said:
This is the boot.img I am working with.

Well, it's very nice, but being ramdisk-less there's no adbd in it.
It's probably in /system/bin

jenneh · Dec 1, 2022

Renate said:
Well, it's very nice, but being ramdisk-less there's no adbd in it.
It's probably in /system/bin

Ooohh so I know it is, and I tried taking the adbd from the rooted firmware and installing it in stock, this resulted in adb refusing connections entirely. So could I just take the stock adbd and modify it somehow?

I guess for context when I say "rooted" firmware, I mean the read write developer images nvidia shared as opposed to their stock images

adbd

drive.google.com

I found the mini jail now but would I start with a .minijail or minijail without the period and does it end with or without one?

Renate · Dec 1, 2022

jenneh said:
I found the mini jail now...

Nope. You found the text string "minijail_changing_gid".
If you changed that it would only change the text printed in the log.
You want to find where that string is being used.
For that you need to disassemble.

Code:

    2110:	f0ffffe0 	adrp	x0, 1000 ; "ADB_EXTERNAL_STORAGE"
    2114:	91204000 	add	x0, x0, #0x810
    2118:	940004e6 	bl	34b0 ; getenv()@plt
    211c:	b40000e0 	cbz	x0, 2138
    2120:	aa0003e1 	mov	x1, x0
    2124:	f0ffffe0 	adrp	x0, 1000 ; "EXTERNAL_STORAGE"
    2128:	911cf000 	add	x0, x0, #0x73c
    212c:	320003e2 	orr	w2, wzr, #0x1
    2130:	940004e4 	bl	34c0 ; setenv()@plt
    2134:	14000005 	b	2148
    2138:	f0000008 	adrp	x8, 5000 ; 00005000
    213c:	f9418d08 	ldr	x8, [x8,#792]
    2140:	39400108 	ldrb	w8, [x8]
    2144:	37004908 	tbnz	w8, #0, 2a64
    2148:	140000e1 	b	24cc

Yours will, of course, be different.

jenneh · Dec 1, 2022

@Renate how do I disassemble it? Is there a tool in hxd? Sorry I really am brand new. and Thank You as always.

--EDIT I remembered a video I watched on youtube that showed me how to load the binary files in ghidra I forgot it tries to load it as elf if you drop it in the batch, that is why it didn't work for me

Renate · Dec 1, 2022

jenneh said:
I got it to load

You're on the right track.

There's many different kinds of disassemblers.
Some just look at individual instructions and say what they do. (like objdump).
Others try to figure out what's going on (like IDA or Ghidra).

Like the first two lines of my example above shows:

Code:

Load the x0 register with 0x1000
Add 0x800 to the x0 register

You need a bit of insight to say, "hey after the second instruction we've got 0x1800 in the x0 register!"
But why would you need 0x1800?
Normally you don't use the adrp unless you want to get something relative in memory.
So you look in the image for what's at 0x1800 (relative to the loading address).
It could be the first 1000 digits of pi, but wait, it kind of looks like a string for a human. What is it?
It's "ADB_EXTERNAL_STORAGE".

Now, especially if we have a pretty close version of the source code to look at we can compare where that string is used.

Of course, things can get more complicated. If the source reads:

Code:

static void calculate_fuzz(int lint)
{
   printf("Lint value is %u", lint);
}

void process(void)
{
   calculate_fuzz(314);
   calculate_fuzz(42);
}

You'll see that there is never actually a subroutine called "calculate_fuzz".
It ends up being:

Code:

void process(void)
{
   printf("Lint value is %u", 314);
   printf("Lint value is %u", 42);
}

Finally, there are binary files that just have instructions and data all mixed up and nothing telling you what's what.
There are loadable files (like ELF, adbd being one of those) and there are different sections, some headers,
like the 0x7f, E, L, F your program is trying to interpret as instructions.
You need to tell your program, this is an ELF file, behave yourself. Only disassemble the disassemblerable parts!

Learning About AVB Android Verified Boot (Boot.img dtb.img, vbmeta.img, and the "staging blob")

Senior Member

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Senior Member

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Attachments

Recognized Contributor / Inactive Recognized Dev

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Recognized Contributor / Inactive Recognized Dev

Similar threads

Top Liked Posts