Skip to content
/ bxxt Public

📦 安卓 BOOT.IMG/RECOVERY.IMG/SELINUX/PROPERTY 解包打包实用工具,启动镜像编辑解包打包,selinux 修改,ro 属性修改。

License

Unknown and 2 other licenses found

Licenses found

Unknown
COPYING
GPL-2.0
COPYING.GPL
LGPL-2.1
COPYING.LGPL
Notifications You must be signed in to change notification settings

rev1si0n/bxxt

WHAT IT IS

简体中文介绍

prebuilt all platform binaries download from here https://github.com/rev1si0n/bxxt-binaries (idk how to use github auto release)

bxxt is another wheel designed for noob author's needs. now it can only run in the android host, it means you can only run this tool in the phone or emulator (not your computer)

feature:

  • run perfectly in twrp environment

  • pack/unpack boot.img (may be also recovery.img)

include any device tree in the boot.img, it will decompile it and show you the plain text. and also decompressed kernel.

  • edit/inject selinux/sepolicy

  • patch binary file

  • set android readonly property (ro.x) , global effect (apps/commands), see usage below for details

most tools can run without root, but run-time sepolicy inject and set readonly property needs you run as root.

the bad news is it only support android 6.0 - 10.0, may be support android 11 (depends on the boot.img version).

sorry about my code style, it may hard to read.

HOW TO BUILD

easy and simple, but you need to download android-ndk-r20b first.

$ cd /path/to/bxxt;
$ /path/to/android-ndk-r20b/build/ndk-build -j 8;
...
$ ls -l libs/*

if you are using linux/macos with docker and don't want to install ndk in the host, you can also

$ cd /path/to/bxxt; bash build.sh;

BASIC USAGE

  • unpack boot.img
$ # create an empty output directory first
$ mkdir out
$ bxxt boot -i boot.img -o out/
  • unpacked boot.img structure
$
$ # there's may be some dt.dts-xx files, means as same as kernel.dts-xx
$ #
$ # there also may exist a file named extra.data, it's the data we cant
$ # recognize or processed. this extra.data usually an android certificate
$ # or avb or unknown dtb. we need to append it when you pack the boot.img.
$ #
$ ls /path/to/out
-rw-rw-rw-    1 0        0              738 Mar 27 10:31 METADATA       # meta data
-rw-------    1 0        0         39450632 Mar 27 10:31 kernel         # decompressed linux kernel
-rw-rw-rw-    1 0        0           624384 Mar 27 10:31 kernel.dts-00  # device tree (plain text, you can modify it)
-rw-rw-rw-    1 0        0           633469 Mar 27 10:31 kernel.dts-01
-rw-rw-rw-    1 0        0           624449 Mar 27 10:31 kernel.dts-02
drwxr-xr-x    9 0        0             4096 Mar 27 10:31 ramdisk        # ramdisk directory
-rw-r--r--    1 0        0                0 Mar 26 18:02 recovery_dtbo  # recovery_dtbo file
-rw-r--r--    1 0        0                0 Mar 26 18:02 second         # second file
$
$ ls /path/to/out/ramdisk
drwxr-xr-x    2 0        0             4096 Jan  1  1970 apex
drwxr-xr-x    2 0        0             4096 Jan  1  1970 debug_ramdisk
drwxr-xr-x    2 0        0             4096 Jan  1  1970 dev
-rwxr-x---    1 0        0          1891328 Jan  1  1970 init
drwxr-xr-x    2 0        0             4096 Jan  1  1970 mnt
drwxr-xr-x    2 0        0             4096 Jan  1  1970 proc
drwxr-xr-x    2 0        0             4096 Jan  1  1970 sys
-rw-r--r--    1 0        0              524 Jan  1  1970 verity_key
$
$ # you can modify any lines in METADATA except marked as `DO NOT MODIFY` below
$ cat /path/to/out/METADATA
bxxt.kernel_addr=8000
bxxt.ramdisk_addr=1000000
bxxt.second_addr=f00000
bxxt.tags_addr=100
bxxt.dtb_addr=0
bxxt.recovery_dtbo_offset=0
bxxt.name=
bxxt.cmdline=androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37
bxxt.extra_cmdline=
bxxt.kernel_compression=1             # ! DO NOT MODIFY
bxxt.header_version=0                 # ! DO NOT MODIFY
bxxt.os_version=14000144
bxxt.header_size=0                    # ! DO NOT MODIFY
bxxt.page_size=1000
bxxt.kernel_size=14890c7              # ! DO NOT MODIFY
bxxt.ramdisk_size=c5302               # ! DO NOT MODIFY
bxxt.second_size=0                    # ! DO NOT MODIFY
bxxt.recovery_dtbo_size=0             # ! DO NOT MODIFY
bxxt.dtb_size=0                       # ! DO NOT MODIFY
$
$ # i have compiled kernel from source myself (Image/Image.gz/Image.gz-dtb)
$ # how do i relpace it?
$ # answer (priority high to low):
$ # 1. if you have an Image.gz-dtb file, replace kernel with it then edit METADATA set kernel_compression to 0 and delete all files named kernel.dts*
$ # 2. if you have an Image.gz file, then replace kernel file with it and edit METADATA, set kernel_compression to 0
$ # 3. if you have an Image file, replace kernel file with it directly.
$
$ # decompiled dts file (if exist), you can also modify it
$ head /path/to/out/kernel.dts-00
/dts-v1/;

/ {
        #address-cells = <0x2>;
        #size-cells = <0x2>;
        model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 MTP";
        compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
$
  • pack boot.img

NOTICE: this may generate a image that size exceeds your boot partition is. if size too large error occurs when you flash the boot_modified.img, try add extra option -e skip-unknown-data like bxxt -i out/ -o boot_modified.img -e skip-unknown-data regenrate the image and flash it

$ bxxt -i out/ -o boot_modified.img
  • patch binary
$ # @ means AT, @offset:size=to_byte_seq, the max `size` is 8
$ # that to_byte_seq is what you see in any hex editor
$ # if hex editor shows 00000000: 0A 0B 0C 0D 11 22 33 44
$ # and you want to modify 0A 0B to CC EE, just use
$ bxxt patch @00000000:2=ccee /path/to/binary/file
$ # or if you want the whole `0A 0B 0C 0D 11 22 33 44` to `01 02 03 04 05 06 07 08`
$ # use
$ bxxt patch @00000000:8=0102030405060708 /path/to/binary/file
$
$ # disable vbmeta verification example
$ bxxt patch @00000078:4=00000002 /dev/block/by-name/vbmeta_a
  • sepolicy modify, inject

remember to use single quote to wrap around the -s parameter.

modify sepolicy file

$ # input (-i) and output (-o) file can be the same
$ bxxt sepol -s 'create deltaforce' -i /path/to/sepolicy -o /path/to/out/sepolicy

live mode (running system)

$ # live mode example
$ bxxt sepol -s 'create deltaforce' -l

all supported commands (-s)

create aaaa # create a domain
permissive aaaa # permissive a domain
enforce aaaa # enforce a domain
allow aaaa bbbb:file * # allow doamin aaaa's all operations to bbbb's file
disallow aaaa bbbb:file *
allow aaaa bbbb:file open # only allow doamin aaaa's open operation to bbbb's file
disallow aaaa bbbb:file open
  • set readonly property (without reboot)
$ bxxt setprop ro.build.fingerprint whathell

notice: set ro.debuggable to 1 will not get the result you want cause android already initialized this attribute to a const variable at the boot time, if you want all apps are debuggable, you should use:

$ bxxt setdebuggable 1
$ # bxxt setdebuggable 0

this will let your device a HOT-REBOOT, your device will behave like a normal reboot but only the android service over the linux kernel.

LICENSE

see COPYING under the source root.

About

📦 安卓 BOOT.IMG/RECOVERY.IMG/SELINUX/PROPERTY 解包打包实用工具,启动镜像编辑解包打包,selinux 修改,ro 属性修改。

Resources

License

Unknown and 2 other licenses found

Licenses found

Unknown
COPYING
GPL-2.0
COPYING.GPL
LGPL-2.1
COPYING.LGPL

Stars

Watchers

Forks

Packages

No packages published

Languages