x

#{title}

#{text}

Revised on May 22, 2013 03:56 by forbiddenera
Table of contents

Update

Xlab has a tool to unpack and repack images on GitHub called Allwinner Kitchen. You may find that much easier than doing it by hand (as is described below).

Introduction

In the past few days, the developer of DroidMote has successfully created a custom LiveSuite image for the MK802, and this guide is based on his experience that he has shared with us.

This guide details how to deconstruct an existing image, such as the default image, and to build your own new image.

This guide requires a native Windows installation, I've tried to do it from Ubuntu using a Windows VM and it didn't work. This installation also requires a Linux install, either in a VM or a native install.

Required tools

Extracting and building the stock image (Windows)

Extract a10_flash_kitchen_v1.zip and look inside the directory, you'll see packer_gb and packer_ics. packer_ics is for Android ICS, so that is the one you will be using.

01_flash_kitchen.png

Open packer_ics and you will notice a bunch of directories and a couple of .bat scripts. We will spend a lot of time in these directories.

02_flash_kitchen_ics.png

Extract the stock firmware you downloaded earlier, and copy the .img file into this directory. Rename the file to original.img.

03_flash_kitchen_ics_image.png

Run the extract_image.bat script, and a command window will pop up while it is extracting.

04_flash_kitchen_ics_extract_bat.png

The command window will output like the following, it will display Press any key to continue . . . when it is complete. Press a key to close the window.

05_extract_output.png

Once the command window is closed, open the _extract directory and all of the extracted files will be there. The three following files are the ones we are interested in: RFSFAT16_BOOT_00000000000.fex (the boot partition), RFSFAT16_RECOVERY_0000000.fex (the recovery partition), RFSFAT16_SYSTEM_000000000.fex (the system partition, ext4 sparse).

NOTE and WARNING (from a reader): Some systems may also have a RFSFAT16_BOOTLOADER_00000.fex, which may also be required for your device to boot properly. There are some vague instructions @ this TechKnow forums post. I (the reader) will attempt to clarify and modify this page with the updated additional instructions for these devices to aid in making these instructions more universal for anyone using LiveSuit.

06_extract_dir.png

Extracting, modifying and building partitions (Linux)

Setting up Linux

First of all, I won't go into detail about how to install and use Linux, as it is out of the scope of this guide. I will, however, go into great detail about the commands that have to be run, so it would be possible to follow the guide without deep Linux knowledge.

I would recommend installing an Ubuntu 12.04 64-bit VM using the free VirtualBox. Make sure you use the 64-bit version as some of the tools required are 64-bit. Also, you will need to install ia32-libs using sudo apt-get install ia32-libs from the terminal.

In my case, I added my Windows drive in the shared folders settings before launching the VM, and set it to auto mount. I then added my user to the vboxsf group, allowing read and write access to these directories (/mount/share_name). To add your user to the vboxsf group, use sudo usermod -aG vboxsf username from the terminal where username is the username of your user.

Once you've installed and booted into Ubuntu, you'll see something like this:

15_ubuntu.png

Prepare files

First, click on the home folder icon on the left, and navigate to your Windows drive. My Windows drive was at /media/sf_WINDOWS, which is accessible in the file manager via File System -> media -> sf_WINDOWS. If you get a permissions error, either you haven't added your user to the vboxsf group, or if you have done that you might need to log off and back on.

Now browse to your a10_flash_kitchen_v2/packer_ics/_extract directory, and locate the files RFSFAT16_BOOT_00000000000.fex, RFSFAT16_RECOVERY_0000000.fex, RFSFAT16_SYSTEM_000000000.fex.

16_ubuntu_extracted_files.png

Copy these files, and create a directory in your Home and paste the files in there. I created a directory called custom image. Be careful with having spaces in directory names, as the directory name will have to be quoted when we are in the terminal. Eg. cd "custom image".

17_ubuntu_copied_files.png

Rename the files as follows:

RFSFAT16_BOOT_00000000000.fex -> boot.img
RFSFAT16_RECOVERY_0000000.fex -> recovery.img
RFSFAT16_SYSTEM_000000000.fex -> system.fex

After renaming, your files should like like the following:

18_ubuntu_renamed_files.png

Copy the tools.tar.gz archive you downloaded earlier into the same directory.

19_ubuntu_copy_tools.png

To extract the tools, right click on the file and click Extract here.

20_ubuntu_tools_extract.png

This will extract the tools into a tools subdirectory.

21_ubuntu_tools_extracted.png

Now we want to do some work in the terminal. Click the Dash home button on the left.

22_ubuntu_dash_button.png

Type terminal to show the terminal application. Hit enter and the terminal will appear.

23_ubuntu_dash_terminal.png

Boot partition

Execute the following commands, substituting "custom image" for the name of the directory you created in your home. Running ls at the end will show the files we now have in the directory.

$ cd "custom image"
$ tools/split_bootimg.pl boot.img
$ ls

24_split_bootimg_command.png

Now extract the ramdisk file into a ramdisk subdirectory.

$ mkdir ramdisk
$ cd ramdisk
$ gunzip -c ../boot.img-ramdisk.gz | cpio -i
$ ls

25_extract_ramdisk.png

You are now able to modify the files as needed. For example, the DroidMote developer added insmod /system/vendor/modules/uinput.ko to the init.sun4i.rc file to load uinput on boot.

Once you have finished modifying the file, we will rebuild the image. Run the following commands.

$ cd ..
$ tools/mkbootfs ramdisk | gzip > ramdisk-new.gz
$ tools/mkbootimg --base 0x40000000 --kernel boot.img-kernel --ramdisk ramdisk-new.gz --cmdline 'console=ttyS0,115200 rw init=/init loglevel=8' -o new-boot.img
$ ls

26_build_new_boot.png

Recovery partition

This follows the same process as the boot partition. Execute the following commands to extract the image:

$ tools/split_bootimg.pl recovery.img
$ rm -rf ramdisk
$ mkdir ramdisk
$ cd ramdisk
$ gunzip -c ../recovery.img-ramdisk.gz | cpio -i
$ ls

27_split_and_extract_recovery_ramdisk.png

Modify files as needed, then rebuild the image with the following commands:

$ cd ..
$ tools/mkbootfs ramdisk | gzip > ramdisk-new.gz
$ tools/mkbootimg --base 0x40000000 --kernel recovery.img-kernel --ramdisk ramdisk-new.gz --cmdline 'console=ttyS0,115200 rw init=/init loglevel=8' -o new-recovery.img
$ ls

28_build_new_recovery.png

System partition

The process for the system partition is different, because it is not bootable and because it is ext4 sparse, so it cannot be mounted straight away. Execute the following commands to convert and mount the image:

$ tools/simg2img system.fex system.img
$ mkdir system
$ sudo mount -o loop system.img system
$ cd system
$ ls

29_convert_system.png

Here are the system files, modify as needed. Once you are done, execute the following commands to rebuild the system image:

$ cd ../tools
$ sudo ./mkuserimg.sh -s ../system ../new-system.fex ext4 ../tmp 300M
$ cd ..
$ sudo umount system
$ ls

30_build_new_system.png

Now switch back to the file browser and you will see many new files in your directory. The three files that you are interested in are new-boot.img, new-recovery.img, new-system.fex.

31_files_to_copy.png

Copy these to your Windows drive to the directory a10_flash_kitchen_v2/packer_ics/_input.

32_copy_to_input.png

Building the new image (Windows)

Once the files are copied, jump back to Windows and rename the files as following:

new-boot.img -> root.fex
new-recovery.img -> recovery.fex
new-system.fex -> system.fex

33_rename_files.png

Now we need to make some modifications to the image config file. Navigate to the files directory and you should see image.cfg.

09_image_config_location.png

Open this file using your text editor that supports Unix line endings. Using Notepad will break this file. Locate the two lines that reference OEM and VOEM as is highlighted below.

10_image_config_contents.png

Comment these lines by adding a semicolon (;) to the start of each line. Do not make any other modifications. Save the file once you have made the change.

11_image_config_commented.png

Go back to the packer_ics root directory and find the create_image.bat script. It will open a console while it is creating the new image.

34_create_image_script.png

Once the process is complete, you will see Press any key to continue . . . and you will have a new image called output.img.

35_create_image_output.png

Use LiveSuit to flash this image to an MK802. If you brick the device and it doesn't boot, just flash the stock firmware to bring the device back to life.

Good luck! Share your exploits, and if you come up with some cool images, contact us for access to the file server to share them!