[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition

[munjeni]

Disclaimer:

Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything else!


How to use superunpack:

- First step, unpack super.sin using my tool or use @IgorEisberg unsin tool
- Step two, Superunpack. On windows just drag and drop unpacked super image onto our exe to start extraction. Also you can use it from command line, from script or from etc. On Linux use it from command line. No need to set slot like it was a case on lpunpack, our tool will auto extract all slot images for you, enjoy!
- If you need to unpack partition images in RW mode add parameter 1 at the end of command line e.g. "superunpack super.img 1", than resize partition using resize2fs, repair and unshare blocks using e2fsck. Or if you unpack without rw you no need to resize or repair it, just mount it ro.

How to manualy patch super partition in under Linux:
https://forum.xda-developers.com/t/...s-rw-in-super-partition.4120963/post-87112415

Note that, superunpack is a tool for extract all logical partitions from super image or directly from super partition.

How to use superrepack:

adb push superrepack.arm64_pie /data/local/tmp
adb shell
su
cd /data/local/tmp
mv superrepack.arm64_pie superrepack
chmod 755 superrepack
stop
./superrepack /dev/block/bootdevice/by-name/super system_a
sync
reboot

Note that, superrepack is a tool to convert logical RO partitions iside your phone super partition to RW mode without extracting anything, all things is done on the fly directly inside super partition/image! In this example system_a partiton is converted to the rw mode, if you need other partitions to rw just change system_a argument. Or if you need all partitions to rw mode do it without partition rw argumet e.g: "./superrepack /dev/block/bootdevice/by-name/super". YOU MUST RUN TOOL 4-5 TIMES UNTIL ALL ERRORS DISAPEARS!!! One of the well known errors is: "Couldn't clone file: Could not allocate block in ext2 filesystem". Look at /data/local/tmp/script.log each time and make sure it not contain any error otherwise you are not done things right and partition is not repaired yet!!! More info -> https://forum.xda-developers.com/t/...s-rw-in-super-partition.4120963/post-84966715

Platform:

- Superunpack is working on Windows, Linux, Android, Darwin11, just chose right binary.
- Superrepack is working only under android


Changelog:

- version 1 (21.Jun.2020), initial version
- version 1.1 (22.Jun.2020), dump file format detection, partition size correction in case ext4, partition group detection, have extraction progress bar, improvements
- version 2 (03.04.2021) implemented possibility to extract partition images to rw mode using Superunpack & I have made new tool called Superrepack
- version 2 (04.04.2021) implemented arguments so you would do conversion on single partition instead of doing it on all partitions
- version 3 (04.04.2021) implemented return codes and implemented output logs to be more scripting friendly
- version 4 - not released
- version 5 (08.04.2021) implemented resize and repair partitions after switching to rw mode. Implemented build script for building resize2fs, e2fsck, simg2ims, img2simg, lptools
- version 6 (08.04.2021) better loop device detection and setup
- version 7 (08.04.2021) fix selinux status detection
- version 8 (15.04.2021) fix loop device setup in superrepack
- version 9 (16.04.2021) make losetup android compatible
- version 10 - not released
- version 11 (01.05.2021) simplified, removed needs for parameter rw, implemented dm-verity disabler
- version 12 (05.05.2021) make old logs always deleted before fresh log is created, this prevent concentation with old logs
- version 13 (06.05.2021) make linux version so you should do the things on your super partition dump in linux machine
- version 14 (07.05.2021) fix compilation mess between linux and android
- version 15 (08.05.2021) use libselinux to determine and set selinux to permissive mode instead of popening getenforce-setenforce tools

Credits:

- me and me


Source code:

- source code -> https://github.com/munjeni/super_image_dumper

 

[bigrammy]

hardcoded, no external libs, no android libs.
- my source code, later

Yet Another great tool!! :highfive:
Thanks!

 

[munjeni]

New version is out, v11, it now detect file format, partition size correction in case ext4, partition group detection, have extraction progress bar, and it looks like:

---------------------------------------------------------
Super image dumper v_11 (by expert :) munjeni @ xda 2020)
---------------------------------------------------------

LpMetadataGeometry magic = 0x616c4467
LpMetadataGeometry struct size = 0x34
LpMetadataGeometry sha256 = 12FF55F0ABA7B506F25CB5DA5DCA09344234E8DF1D9C93AE82A499D98019467E
LpMetadataGeometry metadata_max_size = 0x10000
LpMetadataGeometry metadata_slot_count = 0x3
LpMetadataGeometry logical_block_size = 0x1000

LpMetadataHeader magic = 0x414c5030
LpMetadataHeader major_version = 10
LpMetadataHeader minor_version = 0
LpMetadataHeader header_size = 0x80
LpMetadataHeader header sha256 = CCF4F5D07842AAAE7C1B87F0E025512CF7AEA426D477B1E5175DA3D74F9B1C8C
LpMetadataHeader tables_size = 0x2e8
LpMetadataHeader tables sha256 = 52578668F89D8BCDA1BD1F748F2F69ED874C10A7062C85EF9970EE05D90161B1
LpMetadataHeader partitions offset = 0x0
LpMetadataHeader partitions num_entries = 0x8
LpMetadataHeader partitions entry_size = 0x34
LpMetadataHeader extents offset = 0x1a0
LpMetadataHeader extents num_entries = 0x5
LpMetadataHeader extents entry_size = 0x18
LpMetadataHeader groups offset = 0x218
LpMetadataHeader groups num_entries = 0x3
LpMetadataHeader groups entry_size = 0x30
LpMetadataHeader block_devices offset = 0x2a8
LpMetadataHeader block_devices num_entries = 0x1
LpMetadataHeader block_devices entry_size = 0x40

Partitions = 5 used, 3 not used, total 8

  partition_1_name = system_a
    attributes = 0x1
    first_extent_index = 0x0
    num_extents = 0x1
    group_index = 0x1
    partition_group = somc_dynamic_partitions_a
    extent num_sectors = 0x336390 (0x66c72000 bytes total)
    extent target_type = 0x0
    extent target_data = 0x800 (dumping offset = 0x100000)
    extent target_source = 0x0
      Filetype EXT4. EXT4 size = 0x6526c000
      Dumping system_a.ext4 ...
      ....................................................
      ....................................................
      ....................................................
      ..............................................
  partition_2_name = system_b
    attributes = 0x1
    first_extent_index = 0x1
    num_extents = 0x1
    group_index = 0x2
    partition_group = somc_dynamic_partitions_b
    extent num_sectors = 0xab178 (0x1562f000 bytes total)
    extent target_type = 0x0
    extent target_data = 0x337000 (dumping offset = 0x66e00000)
    extent target_source = 0x0
      Filetype EXT4. EXT4 size = 0x150b3000
      Dumping system_b.ext4 ...
      ..........................................
  partition_3_name = product_a
    attributes = 0x1
    first_extent_index = 0x2
    num_extents = 0x1
    group_index = 0x1
    partition_group = somc_dynamic_partitions_a
    extent num_sectors = 0x2b62b8 (0x56c57000 bytes total)
    extent target_type = 0x0
    extent target_data = 0x3e2800 (dumping offset = 0x7c500000)
    extent target_source = 0x0
      Filetype EXT4. EXT4 size = 0x5565b000
      Dumping product_a.ext4 ...
      ....................................................
      ....................................................
      ....................................................
      ..............
  partition_4_name = product_b (not unused)
    attributes = 0x1
    first_extent_index = 0x3
    num_extents = 0x0
    group_index = 0x2
    partition_group = somc_dynamic_partitions_b
    extent num_sectors = NULL
    extent target_type = NULL
    extent target_data = NULL
    extent target_source = NULL
      Skipping dump.

  partition_5_name = vendor_a
    attributes = 0x1
    first_extent_index = 0x3
    num_extents = 0x1
    group_index = 0x1
    partition_group = somc_dynamic_partitions_a
    extent num_sectors = 0x186d58 (0x30dab000 bytes total)
    extent target_type = 0x0
    extent target_data = 0x699000 (dumping offset = 0xd3200000)
    extent target_source = 0x0
      Filetype EXT4. EXT4 size = 0x30141000
      Dumping vendor_a.ext4 ...
      ....................................................
      ............................................
  partition_6_name = vendor_b (not unused)
    attributes = 0x1
    first_extent_index = 0x4
    num_extents = 0x0
    group_index = 0x2
    partition_group = somc_dynamic_partitions_b
    extent num_sectors = NULL
    extent target_type = NULL
    extent target_data = NULL
    extent target_source = NULL
      Skipping dump.

  partition_7_name = odm_a
    attributes = 0x1
    first_extent_index = 0x4
    num_extents = 0x1
    group_index = 0x1
    partition_group = somc_dynamic_partitions_a
    extent num_sectors = 0xa60 (0x14c000 bytes total)
    extent target_type = 0x0
    extent target_data = 0x820000 (dumping offset = 0x104000000)
    extent target_source = 0x0
      Filetype EXT4. EXT4 size = 0x132000
      Dumping odm_a.ext4 ...

  partition_8_name = odm_b (not unused)
    attributes = 0x1
    first_extent_index = 0x5
    num_extents = 0x0
    group_index = 0x2
    partition_group = somc_dynamic_partitions_b
    extent num_sectors = NULL
    extent target_type = NULL
    extent target_data = NULL
    extent target_source = NULL
      Skipping dump.
Press any key to continue . . .

If you need to mount ext4 partition on Linux you need to mount partition RO or it will not mount!

 

[munjeni]

I'm not one of those who make paid software and promote on xda, my work is always free. Even I'm always providing source code for free, source code of this tool is here -> https://github.com/munjeni/super_image_dumper , enjoy!

 

[bigrammy]

I'm not one of those who make paid software and promote on xda, my work is always free. Even I'm always providing source code for free, source code of this tool is here -> https://github.com/munjeni/super_image_dumper , enjoy!

You are the best and I and many others thank you for make life so easy for us. :highfive:
PS: I will send you a PM with something you may find interesting and useful. :fingers-crossed:

 

[paijoe88]

Can I make this tool for remake oem.sin?
I have fw Xperia docomo bundling,and many bloatware,so I wont to remake oem.sin and deleted any bloatware, can I?


??sorry my English por????

 

[munjeni]

Can I make this tool for remake oem.sin?
I have fw Xperia docomo bundling,and many bloatware,so I wont to remake oem.sin and deleted any bloatware, can I?


?sorry my English por??

No you can't. Tool is unpacker only, it extracts oem from super image but doesn't reconstruct it back to super image. Even there is no known tool to make valid sin back because of signature.

 

[munjeni]

Seems readonly partitions like oem, system, vendor...etc can be set to read-write mode via LP_PARTITION_ATTR overiding LpMetadataPartition.attributes 1 with 0. Anybody tried android version of this tool? E.g. dump block device e.g. /dev/block/bootdevice/super

RO flags (0x1), when it is set to 0x0 its RW mode, but header sha256 checksums of the LpMetadataGeometry and LpMetadataHeader also need to be modified in case we overvrite flags with RW mode!

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000003080 73 79 73 74 65 6D 5F 61 00 00 00 00 00 00 00 00 system_a........
000003090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000030A0 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
0000030B0 01 00 00 00 73 79 73 74 65 6D 5F 62 00 00 00 00 ....system_b....
0000030C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000030D0 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ................
0000030E0 01 00 00 00 02 00 00 00 70 72 6F 64 75 63 74 5F ........product_
0000030F0 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............
000003100 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ................
000003110 02 00 00 00 01 00 00 00 01 00 00 00 70 72 6F 64 ............prod
000003120 75 63 74 5F 62 00 00 00 00 00 00 00 00 00 00 00 uct_b...........
000003130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003140 01 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 ................

 

[munjeni]

Removed fake pie binary and made new true pie 64 bit binary for android. With it you can dump your super partition on your own phone e.g.

adb push superunpack.arm64_pie /data/local/tmp

adb shell
su
cd /data/local/tmp
chmod 755 superunpack.arm64_pie
./superunpack.arm64_pie /dev/block/bootdevice/by-name/super

and whola all ext4 partitonins from your super partition is extracted to the /data/local/tmp folder.

 

[lebigmac]

bump. Any news regarding forcing system to be read/write in Android 10 ?

Thanks for your hard work @munjeni

 

[munjeni]

See post 8.

In most case if you change those byte vbmeta protection will do a bootloop, so I think no way to set it to force rw except if you unlock bootloader and disable vbmeta protection trought fastboot (more info -> https://forum.xda-developers.com/t/tool-newflasher-xperia-command-line-flasher.3619426/post-84509179)

 

[lebigmac]

Seems readonly partitions like oem, system, vendor...etc can be set to read-write mode via LP_PARTITION_ATTR overiding LpMetadataPartition.attributes 1 with 0. Anybody tried android version of this tool? E.g. dump block device e.g. /dev/block/bootdevice/super

RO flags (0x1), when it is set to 0x0 its RW mode, but header sha256 checksums of the LpMetadataGeometry and LpMetadataHeader also need to be modified in case we overvrite flags with RW mode!

I replaced all 4 occurences of these three bytes in my super.img like you suggested and flashed it to my phone.
It didn't boot probably due to the invalid sha256 checksums as you predicted.

Which bytes I must hex edit in the extracted system.ext4 in order to make it rw? I was thinking maybe the shared_blocks feature?

 

[munjeni]

You should read this to get idea -> https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout

TO be honest I never modified RO partitions. it can be probably done using parted, fsck and similar tools so you no need to do it by hexediting, try google a bit for idea I realy don't know

 

[lebigmac]

TO be honest I never modified RO partitions. it can be probably done using parted, fsck and similar tools so you no need to do it by hexediting, try google a bit for idea I realy don't know

@munjeni thank you so much for writing this amazing superunpack tool!
Thanks to your program and thanks to another tutorial I was able to create an automated bash script that transforms all read only partitions inside super.img (system, vendor , product, etc...) into read write-able partitions again and then flash to device as a brand new super.img.

HERE is the link to new universal version

 

[bynarie]

Disclaimer:

Superunpack tool was made for testing and educational purposes, ME is not responsible for what you do on/with your device using superunpack, you must agree that you using superunpack on your own risk, I am not responsible for anything else!

How to use:

- First step, unpack super.sin using my tool or use @IgorEisberg unsin tool
- Step two, on windows just drag and drop unpacked super image onto our exe to start extraction. Also you can use it from command line, from script or from etc. On Linux use it from command line. No need to set slot like it was a case on lpunpack, our tool will auto extract all slot images for you, enjoy!



Platform:

- Superunpack is working on Windows, Linux, Android, Darwin11, just chose right superunpack binary.


Changelog:

- version 10 (21.Jun.2020), initial version
- version 11 (22.Jun.2020), dump file format detection, partition size correction in case ext4, partition group detection, have extraction progress bar, improvements


Credits:

- not right now


Source code:

- tool is based on just this header, the rest of things is myself implemented - hardcoded, no external libs, no android libs.
- my source code -> https://github.com/munjeni/super_image_dumper

Wow, this is pretty impressive my friend. Big props!! Just curious, what's the difference with "this" utility(superunpack) and the standard android lpunpack?

 

[munjeni]

Wow, this is pretty impressive my friend. Big props!! Just curious, what's the difference with "this" utility(superunpack) and the standard android lpunpack?

Diferencie is that my tool not use any external dependencies so can be build easily as a static binary. Seccond diferencie is its easy to use, just drag and drop file to extract. I'm not tried lpunpack so I can't tell the exact diferencie, you tell me

 

[lebigmac]

Diferencie is that my tool not use any external dependencies so can be build easily as a static binary. Seccond diferencie is its easy to use, just drag and drop file to extract. I'm not tried lpunpack so I can't tell the exact diferencie, you tell me

lpunpack:

• works with sparse files
• creates .img files
• gives zero text output so you don't know what's happening under the hood
• extracts all partitions even the empty ones

Superunpack:

• works with raw files
• creates .ext4 files
• gives lots of text info so you know exactly what's going on
• only extracts the partitions that are not empty

These are the main differences that I noticed.

 

[BlazingKahn35]

Hey friend I get this error can you help me out?

[Novice alert]

 

[bynarie]

lpunpack:

• works with sparse files
• creates .img files
• gives zero text output so you don't know what's happening under the hood
• extracts all partitions even the empty ones

Superunpack:

• works with raw files
• creates .ext4 files
• gives lots of text info so you know exactly what's going on
• only extracts the partitions that are not empty

These are the main differences that I noticed.

Nice !

 

[bynarie]

Diferencie is that my tool not use any external dependencies so can be build easily as a static binary. Seccond diferencie is its easy to use, just drag and drop file to extract. I'm not tried lpunpack so I can't tell the exact diferencie, you tell me

Good stuff, thank you!