Skip to content

Instantly share code, notes, and snippets.

@ashutosh-mishra
Forked from azureru/extract android kernel.md
Last active March 13, 2024 07:22
Show Gist options
  • Star 11 You must be signed in to star a gist
  • Fork 8 You must be signed in to fork a gist
  • Save ashutosh-mishra/863d7f3b0a3099842530244b8bb8696d to your computer and use it in GitHub Desktop.
Save ashutosh-mishra/863d7f3b0a3099842530244b8bb8696d to your computer and use it in GitHub Desktop.
How to run custom script from init.rc, How to Extract Android Kernel And Modify The Boot Ramdisk(Android 4+)

init.rc changes

init.rc changes to run any script Can be used to start any android application, service

on property:dev.bootcomplete=1
    exec - system system -- /system/bin/sh <custom script path>
    # exec - system system -- /system/bin/sh /data/local/bootscript/testservice.sh

Script can contains applications start, stop commands

/system/bin/am startservice com.example.android.testservice/.MyService
/system/bin/am stopservice com.example.android.testservice/.MyService
/system/bin/am start/kill/force-stop com.example.android.testservice/.MainActivity

Get the image - Extracting Existing Kernel + Ramfs

Enter the machine using adb shell Identify the partition either using Run cat /proc/partitions OR parted utility

Dump the partition to a file using dd

dd if=/dev/block/mmcblk0p6 of=/data/kernel_ramfs.img

Extract it to your linux system adb pull /data/kernel_ramfs.img

Install abootimg

Run sudo apt-get install abootimg

Check the Kernel Dump

Run abootimg -i kernel_ramfs.img. It need to show

Android Boot Image Info:

* file name = kernel_ramfs.img

* image size = 16777216 bytes (16.00 MB)
  page size  = 2048 bytes

* Boot Name = ""

* kernel size       = 9797076 bytes (9.34 MB)
  ramdisk size      = 2017625 bytes (1.92 MB)

* load addresses:
  kernel:       0x40008000
  ramdisk:      0x41000000
  tags:         0x40000100

* empty cmdline
* id = 0x7c37c0d4 0xcefde745 0xe81b85ba 0xf05275ba 0xbe7de0ad 0x00000000 0x00000000 0x00000000

That means you dump the correct kernel+ramfs

Extract Kernel Dump

abootimg -x kernel_ramfs.img

It will extract zImage and also initrd.img

Extract Ramdisk, Modify And Repack

mkdir initrd
cd initrd
cat ../initrd.img | gunzip | cpio -vid

Modify the ramdisk accordingly (e.g. you modify init.rc or add another additonal files) Then repack accordingly

cd initrd
find . | cpio --create --format='newc' | gzip > ../myinitrd.img

Repacking Boot.Img

cd ..
abootimg --create myboot.img -f bootimg.cfg -k zImage -r myinitrd.img

Repacking might fail due to size issue, remove unnecessary comments, files from ramdisk image and try again after recreating initrd image.

Reflash

Enter in fastboot mode

adb reboot-bootloader
sudo fastboot devices -l            # To check whether device entered in fastboot mode
sudo fastboot erase boot            # Erase existing boot image
sudo fastboot flash boot boot.img   # Flash new image
sudo fastboot reboot                # To come out from fastboot mode

Verify the changes

Verify init.rc for changes Verify dmesg, logcat(Any init.rc script invokation error will come in dmesg)

Another way Download the Extract Tools..!! - https://drive.google.com/file/d/0B4fizJM7V7pPMUNkNzNEV01Sb28/view

  1. Get boot.img file

  2. unpack boot.img file ~/Downloads/Extract\ Tolls/unmkbootimg boot.img

  3. Extract ramdisk (initramfs) gzip -dc initramfs.cpio.gz | cpio -i

  4. Re-pack ramdisk find . | cpio -o -H newc | gzip > ../initramfs.cpio.gz # From the extracted folder

  5. Re-pack boot img ~/Downloads/Extract\ Tolls/mkbootimg --kernel kernel.gz --ramdisk ../initramfs.cpio.gz -o new_boot.img

References:

http://droidcore.blogspot.in/2012/12/how-to-edit-initrc-in-android.html

https://github.com/135f2l/AndroidNativeDaemon

https://android.stackexchange.com/questions/184074/selinux-prevents-my-init-rc-exec-command-to-execute

@dazza5000
Copy link

Does this work on devices with dm-verity / magisk installed?

@biaocy
Copy link

biaocy commented Jun 22, 2022

Do you know why the device can't boot after doing the above procedure?

I tested the above procedure and modified init.rc and add some file in initrd, then repack it a new boot.img,
but the device can't boot after I flash the new boot.img.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment