Android image kitchen windows

Windows ports of the necessary Linux utils for Android image (kernel/recovery) mod work:

mkbootimg, unpackbootimg: https://github.com/osm0sis/mkbootimg
pxa-mkbootimg, pxa-unpackbootimg: https://github.com/osm0sis/pxa-mkbootimg
elftool: https://github.com/osm0sis/elftool
unpackelf: https://github.com/osm0sis/unpackelf
mboot: https://github.com/osm0sis/mboot
dumpimage, mkimage: https://www.denx.de/wiki/U-Boot/WebHome
mkmtkhdr: https://github.com/osm0sis/mkmtkhdr
loki_tool: https://github.com/djrbliss/loki
futility: https://github.com/osm0sis/futility
boot_signer.jar (requires JRE 8+): https://xdaforums.com/android/software-hacking/signing-boot-images-android-verified-t3600606
blobpack, blobunpack: https://github.com/AndroidRoot/BlobTools
dhtbsign: https://github.com/osm0sis/dhtbsign
rkcrc: https://github.com/linux-rockchip/rkflashtool
sony_dump: https://xdaforums.com/crossdevice-dev/sony/tool-unpack-format-sony-kernel-image-t3530077
bzip2, cat, chmod, cpio, cut, dd, file, find, gzip, hexdump, lzop, printf, tail, truncate, xz;
cygbz2-1, cygcrypto-1.1, cyggcc_s-1, cygiconv-2, cygintl-8, cyglzma-5, cyglzo2-2, cygmagic-1, cygncursesw-10.dll, cygstdc++-6.dll, cygssl-1.1, cygwin1, cygz: https://cygwin.com/
lz4: https://lz4.github.io/lz4/
sudo: https://github.com/mattn/sudo
magic: https://www.darwinsys.com/file/

See the Mobile Edition (AIK-mobile) initial release notes for the specifics on the native Android version.
Likewise for the Linux/macOS Edition (AIK-Linux) initial release notes.

My original intent was to have this package dependency-free, but as you can see, I did have to include Cygwin. Initially just for mkbootimg since the huaixzk standalone version wouldn’t work (it wasn’t loading the kernel as binary, thanks trevd); then I discovered that using the GNUWin32 cpio to unpack somehow didn’t play nice with repacking the ramdisk in a usable state, so at that point I decided I might as well go Cygwin across the board. As it is, I’ve included the latest Cygwin-dependent executables and required libraries from their repos and built my own custom Cygwin image and ramdisk utilities built from the latest sources.

Originally only for Google Pixel/Nexus/AOSP standard boot.img files, built-in support has now expanded to Google Pixel/AOSP vendor_boot.img files, Android Verified Boot (AVBv1)/ChromeOS/SignBlob signed boot.img files, Barnes & Noble Nook «Green Loader» signed boot.img files, Samsung/Spreadtrum DHTB header signed boot.img files, the Samsung/Marvell PXA1088/1908 board boot.img variant (AOSP-PXA), Loki patched boot.img files, amonet patched boot.img files, Sony SIN signed/packaged kernel.elf extraction, Sony ELF kernel.elf files, Intel OSIP Android image files, DENX U-Boot uImage files, Rockchip KRNL signed ramdisk image files, MTK headers for kernel/ramdisk, and LG Bump/Samsung SEAndroid footers for boot.img.

The main advantage here is you don’t need Cygwin shell or PERL scripts. Other guides exist but none of them are universal for target device, compression and/or developed for Windows, Android ARM/x86/MIPS + ARM64/x86_64/MIPS64, and now macOS. With this universality in mind I’ve automated the whole process with batch/shell scripts.

My development work on my many projects comes out of my free time, so if you enjoy this project or anything else I’ve done on xda, please consider sponsoring my ongoing work using my GitHub Sponsors profile. For a one-time donation you can hit the donate link from my profile. Thank you for your support!Instructions

1)

Unzip.
2) Either use the command-line «unpackimg <image-filename.img>», or simply drag-and-drop the image. This will split the image and unpack the ramdisk to a subdirectory.
3) Alter the ramdisk as you like.
4) The repackimg script requires no input and simply recombines the previously split kernel with the newly packed modified ramdisk using all the original image information (which was also split and saved).
5) The cleanup script resets the folder to its initial state, removing the split_img+ramdisk directories and any new packed ramdisk or image files.

There are a few optional, advanced command-line arguments for repackimg: «—original», which will cause it to repack using the original split ramdisk instead of repacking, this is useful for testing or trimming dumps; «—origsize», which will cause it to repack then pad it to the size of the original image, this is useful for repacking dumps to then be fastboot flashed; «—level» with 1-9 and possibly 0 allows changing the compression level used to repack to more closely match the original; «—avbkey» with (optionally path and) a keyname allows changing from the default AOSP verity key; «—forceelf» to attempt to make an older unpacked Sony ELF file repack as an ELF.

All scripts also allow unpacking/repacking with the current directory instead of the AIK directory if «—local» is the first command-line argument.

Supported ramdisk compression formats in the *-ramdiskcomp file are gzip, lzop, lzma, xz, bzip2, lz4, lz4-l (for lz4 legacy), cpio (for uncompressed), and empty (for no ramdisk).

Usage is similar for the Android and Linux versions, again, just review the release notes for them.

Hopefully this is some help to someone. It’s been extremely useful for me in my messing around with kernel ramdisks, which is why I created it in the first place.

Enjoy!
Questions, comments and feedback welcome.

If you are reporting a problem with your device, please clearly state your device name and model/variant, attach a log, as well as provide a link to the image file.

Downloads

Android.Image.Kitchen.v3.8-Win32.zip

UPDATE-AIK.Mobile.Installer.v3.8-ALL-signed.zip

AIK-Linux-v3.8-ALL.tar.gz

Source Code
https://github.com/osm0sis/Android-Image-Kitchen

Credits & Thanks: All authors of the included binaries and libraries for their amazing work, as linked (or linked via GitHub) above. Peteragent5, alansj & iridaki for the general methods used in their PERL scripts and Linux guides. SuperR. & tobias.waldvogel for the general methods used in their kernel.elf unpacking scripts. _that and rayman for the general methods used to repack a working boot.blob. Chainfire for the ChromeOS and SEAndroid general methods. cybojenix for the Bump general method. xyz` & k4y0z for the amonet general method.

Thanks to Goatshocker for testing out things for the HTC image issues, leading to the workaround and subsequent fix, avinashrocks1990 & tajimura for testing out compression support and the large pagesize fix, civato for testing out dtb support, talich for testing out the Linux version, shoey63 for testing out Linux + ELF support, moonbutt74 for testing out Android-x86 support, nathanchance for testing out the new AIK-mobile cpio method on his Pixel 2, leading to important fixes for its support, shakalaca for the great help with completing and testing Intel OSIP support, and Postman1year & CXZa for their help testing to find out the workaround for the Cygwin cut + symlink regression issues. Huge thank you to trevd and Modding.MyMind/SHM for all the contributing work they’ve each done and support they’ve provided.

Disclaimer: Naturally, you take all the responsibility for what happens to your device when you start messing around with things.

Download counts:

AIK — v1.0: 1540; +HTCFix: 430. v1.5: 4718. v1.6: 3556. v1.8: 8678; +Lok2Img: 1629. v1.9: 2580. v2.0: 22886. v2.2: 20522. v2.3: 14524. v2.4: 84432; +LokiAddon: 20071. v2.5: 5004. v2.6: 9354. v2.7: 5442. v2.8: 6639. v2.9: 7672. v3.0: 2810. v3.1: 6502. v3.2: 27104. v3.3: 17736. v3.4: 25988. v3.5: 19051. v3.6: 32472. v3.7: 21457.
Mobile — v1.0: 311. v1.1: 265. v1.2: 302. v1.3: 100. v1.4: 486. v1.5: 224. v1.6: 3303. v1.7: 7798. v1.8: 16286. v1.9: 3800. v2.0: 5444. v2.1: 2526. v2.2: 926. v2.3: 1346. v2.4: 18426. v2.5: 2586. v2.6: 6068. v2.7: 2936. v2.8: 3932. v2.9: 4181. v3.0: 1301. v3.1: 3300. v3.2: 3254. v3.3: 6824. v3.4: 10786. v3.5: 8624. v3.6: 14020. v3.7: 8951.
Linux — v1.0: 75. v1.1: 208. v1.2: 233. v1.3: 112. v1.4: 421. v1.5: 173. v1.6: 1838. v1.7: 2596. v1.8: 4818. v1.9: 604; +v1.9.1: 1068. v2.0: 1836. v2.1: 1240. v2.2: 466. v2.3: 522. v2.4: 8126. v2.5: 1052. v2.6: 2018. v2.7: 1248. v2.8: 2486. v2.9: 5057. v3.0: 1455. v3.1: 2957. v3.2: 14508. v3.3: 10046. v3.4: 16294. v3.5: 12651. v3.6: 16478. v3.7: 12927.

Known Working Devices

Amazon Fire HD 10
Asus Nexus 7 (2012, 2013)
Asus Transformer Pad
Asus Zenfone (2, 5)
Auchan QiLive (Q5, Q7)
Barnes & Noble Nook ( , HD+, 7)
BQ Aquaris M8
Coolpad Catalyst
Essential PH-1
Google Pixel (C, , XL, 2, 2 XL, 3, 3 XL, 3a, 3a XL, 4, 4 XL, 4a, 4a 5G, 5, 5a)
Huawei Ascend Y300
Huawei Mate 8
Huawei Nexus 6P
Huawei U8800 Ideos X5
HTC Nexus 9
HTC One (M7, M8, S, X)
HTC Vivid/Raider 4G
HP Slate 21
LeEco Le Pro3
Lenovo A706
Lenovo K900
Lenovo Vibe K5
LG G(2, 2 Mini, 3, 3 Stylus, 5)
LG GPad (7.0, 8.3, X 8.0)
LG Nexus (4, 5, 5X)
LG Optimus (3D, 4X HD)
LG Stylo 3 Plus
LG V(10, 20)
Micromax Ninja/Bolt A27
Motorola Moto G (2013, 2014)
Motorola Moto X 2014
Motorola Nexus 6
Nextbit Robin
OnePlus (One, 2, X, 3, 3T, 5, 5T, 6, 6T, 7, 7 Pro, 7T, 7T Pro, 8, 8 Pro, 8T, 9R, 9, 9 Pro)
OnePlus Nord ( , N10 5G, N100)
Pantech Vega Iron
Pantech Vega Secret Note
Samsung Galaxy A3 2016
Samsung Galaxy Ace II X
Samsung Galaxy Core Mini 4G
Samsung Galaxy Mega
Samsung Galaxy Nexus
Samsung Galaxy Note (2, 3, 4, Pro 12.2)
Samsung Galaxy S(3, 3 Mini, 4, 5, 6, 7, 8, 8+)
Samsung Galaxy Star
Samsung Galaxy Tab (2 7.0, 3 10.1, 4 7.0, 4 8.0, 4 10.1, A 7.0, A 10.1, Pro 8.4)
Samsung Galaxy Victory
Samsung Galaxy Xcover 3
Samsung Nexus 10
Sony Xperia (Arc S, M, Neo, Neo V, SP, Tab Z4, Z, Z1, Z5)
Spice Mi-355 Stellar Craze
Vodafone Smart Ultra 6
Xiaomi Mi Pad
Xiaomi Poco X2
Xiaomi Redmi (6A, Note 3 Pro)

Confirmed Not Working Devices

• Blackview BV4000 — some newer MediaTek (MTK) devices use special image signing that adds a «BFBF» pre-header signature. While present on multiple MTK devices, it only appears to be enforced by the bootloader on some. See this post.
• HTC Desire 326G, Huawei Honor Bee, Huawei MediaPad T1 7.0 — some newer Spreadtrum devices use special image signing that adds a «SPRD-SECUREFLAG» pre-header signature, so images will unpack/repack but most likely won’t boot unless run through their internal signing tool. See this post.
• Nibiru V05-A, Pipo Max — some RockChip (RK) devices use a variant of the AOSP image format with extra checksums and hidden sections with extra data. There is not currently an open source tool that can handle repacking these. See this post.
• Samsung Galaxy S (Advance, Captivate, Vibrant), Samsung Galaxy S2, Samsung Galaxy Note & Samsung Galaxy Tab — contain zImage (kernel) + ramdisk (possibly within the zImage) but are the «headerless» Linux kernel blob format and require a full cross-compiler to repack correctly. See this post.
• Samsung [various] — the image and SEANDROIDENFORCE footer are followed by a signature that, while present on many Samsung devices, only appears to be enforced by the bootloader on some. See this post.
• Skyworth 50G2A TV — some newer MediaTek (MTK) devices use special image part signing that adds a 256-byte checksum/signature to both Image.gz-dtb/zImage-dtb (kernel) and ramdisk.cpio.gz, so images will unpack/repack but most likely won’t boot unless run through their internal signing tool. See this post.
• Xiaomi Mi Box 3S, ZTE B860H STB — some newer Amlogic devices use special image signing that adds an «AMLSECU!» signature within the header and appears to encrypt the ramdisk, so the image itself will unpack/repack but cannot be re-signed, and the ramdisk cannot be unpacked or modified.

Note: For devices requiring Loki patched images (e.g. LG G2, AT&T Samsung Galaxy S4), your device’s aboot.img dump must be in the script directory to Re-Loki. (Thank you to jeboo for the original one-way Lok2Img Workaround’s binary source, used prior to the official Loki Tool gaining un-Loki support).

Release Notes

Android Image Kitchen — Unpack/Repack Kernel+Recovery Images, and Edit the ramdisk.

My initial intention with this was to gather Windows ports of the necessary Linux utils for Android image (kernel/recovery) mod work with as few dependencies (like Cygwin, etc.) as possible. Here’s what I ended up with:

unpackbootimg — http://github.com/huaixzk/android_win_tool/
mkbootfs, mkbootimg — http://xdaforums.com/showthread.php?t=443994
cpio, gzip, libiconv2, libintl3 — http://gnuwin32.sourceforge.net/
cygwin1 — http://cygwin.com/

As you can see, in the end I did have to include Cygwin for mkbootimg since the huaixzk standalone version doesn’t appear to work for some reason. I’ve left a note with the author and will update the package to remove Cygwin if he ever fixes the issue. As it is, I’ve included the cygwin1.dll as it’s the only one required, and grabbed the working Cygwin-dependent executable from another thread.

Hi Buddy,

I like what you’re doing here, cygwin dependencies are no good…….. native on whatever platform you’re using is the way to go…. with that in mind here’s a mkbootimg compiled from the aosp source tree.using the MIN_GW toolchain, not a cygwin in sight

not tested it but should be alright for you…….I think I’ll finish the job and smash it althought into one tool, saving f***king about., it’ll will come in useful on linux too

Thanks, seems that works fine now.

EDIT:
Generates new-image.img, but this recovery is unbootable. I tested it with the same recovery.img, without to change anything, just unpack/repack. The generated image is unbootable. Device just stuck on boot logo.

Crap. I’ll take it down for now and do some testing. Might be a few days. Things were working over here with the few images I’d tried before. Maybe I messed something up once the scripts got more robust. Batch is an ugly way to do things.

Thanks for the help testing.

Hi Buddy,

I like what you’re doing here, cygwin dependencies are no good…….. native on whatever platform you’re using is the way to go…. with that in mind here’s a mkbootimg compiled from the aosp source tree.using the MIN_GW toolchain, not a cygwin in sight

not tested it but should be alright for you…….I think I’ll finish the job and smash it althought into one tool, saving f***king about., it’ll will come in useful on linux too

Thanks bro! I’ll throw that in with the new (hopefully working) version. :good:

And hey go ahead and finish the job if you like. Coding is better than scripting so I’d be happy to get a mod to remove this thread once something better comes along.

It’s all Cygwin for now but trevd has been great and offered to port some things over properly while weeding out the issues, so expect a new release, completely dependency free and automated as always in the coming months, all thanks to him.

The mkbootimg command does have an extra parameter:

mkbootimg —kernel zImage —ramdisk ramdisk.cpio.gz —base 80400000 —ramdiskaddr 81800000 —cmdline console=ttyHSL0,115200,n8 -o boot.img

Not yet sure if that ramdiskaddr is the magic difference or not. That ramdiskaddr parameter doesn’t even exist in any win32 compile I’ve seen of mkbootimg. I just downloaded a few images (the Dark Jelly ones we tested before) to hexedit and compare. I’ll post again shortly on that.

Since repacking the original ramdisk still wouldn’t boot for the HTC One S in my tests with Goatshocker (which is crazy because it should all be exactly the same), I did just that with Fusion v3.2 and then ran a diff on the original and repack. Doing the same for a GN kernel produces zero differences, ie. the files are identical, but interestingly enough for the One S images there is a single difference, and it’s in the header.

fv32-boot.xxd versus repack-boot.xxd:

0000000: 414e 4452 4f49 4421 0879 5100 0080 4080  ANDROID!.yQ...@.
0000010: b4a2 0200 0000 [color=blue]80[/color]81 0000 0000 0000 3081  ......[color=blue].[/color].......0.
0000020: 0001 4080 0008 0000 0000 0000 0000 0000  ..@.............
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 636f 6e73 6f6c 653d 7474 7948 534c 302c  console=ttyHSL0,
0000050: 3131 3532 3030 2c6e 3800 0000 0000 0000  115200,n8.......
----
0000000: 414e 4452 4f49 4421 0879 5100 0080 4080  ANDROID!.yQ...@.
0000010: b4a2 0200 0000 [color=red]40[/color]81 0000 0000 0000 3081  ......[color=red]@[/color].......0.
0000020: 0001 4080 0008 0000 0000 0000 0000 0000  ..@.............
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 636f 6e73 6f6c 653d 7474 7948 534c 302c  console=ttyHSL0,
0000050: 3131 3532 3030 2c6e 3800 0000 0000 0000  115200,n8.......

Same change with the TWRP recovery images for the One S (ville) and One X (evita). So somehow I believe that’s our problem with certain HTC devices… No idea why such a thing would occur. I looked into S-ON a bit and it seems that’s controlled from the radio, and would prevent the image from being written, so it shouldn’t have to do with that either. Perhaps it has to do with that extra ramdiskaddr parameter somehow affecting the header.

I could write an extra batch file that flips that byte as a workaround, but I’d prefer to actually figure out why it happens and fix that..

Any ideas or leads on why this single byte difference would occur are welcome, but in the meantime the workaround should make this «universal» again.