Dumping ROM from MK802-3s to PC

[vik2009]

Hi,

I have a Rikomagic MK802-3s new with firmware 20130410 (is new).
What's the procedure for dump the firmware into a file .img?

Thanks a lot,
Vik

[Finless]

Doi you have ADB setup on your PC and can you connect to the device with your PC via ADB?

If so, I can walk you through the process.

Bob

[vik2009]

No problem using ADB. I'm a developer. I know how works.
Thanks,

Doi you have ADB setup on your PC and can you connect to the device with your PC via ADB?

If so, I can walk you through the process.

Bob

[Finless]

OK cool....

So lets see if you have enough root privs.

At prompt type adb shell
type su
Does the prompt come back with a #

If not you need to root the device. But most ROMs these days will give you root over ADB.

Let me know,
Bob

[vik2009]

No problem, the rom is rooted as the previus version.

Is this the information? http://www.freaktab.com/showthread.p...sing-ADB-guide

OK cool....

So lets see if you have enough root privs.

At prompt type adb shell
type su
Does the prompt come back with a #

If not you need to root the device. But most ROMs these days will give you root over ADB.

Let me know,
Bob

[vik2009]

The process works with all RK3066? I have a Yuandao Window Vido N90S too.

No problem, the rom is rooted as the previus version.

Is this the information? http://www.freaktab.com/showthread.p...sing-ADB-guide

[Finless]

RKdump wont work on 3066.

So the best way is to use DD.

First do this at the shell prompt.

cat /proc/mtd

Post what it says here and we will continue.

Bob

[vik2009]

RKdump wont work on 3066.

So the best way is to use DD.

First do this at the shell prompt.

cat /proc/mtd

Post what it says here and we will continue.

Bob

Several commands:

root@android:/sdcard/romdump # cat /proc/mtd
dev: size erasesize name
mtd0: 00400000 00004000 "misc"
mtd1: 00800000 00004000 "kernel"
mtd2: 01000000 00004000 "boot"
mtd3: 01000000 00004000 "recovery"
mtd4: 18000000 00004000 "backup"
mtd5: 08000000 00004000 "cache"
mtd6: 50000000 00004000 "userdata"
mtd7: 00400000 00004000 "kpanic"
mtd8: 20000000 00004000 "system"
mtd9: 143c00000 00004000 "user"

root@android:/data # ./romdump
Android ROM dumper v0.82b
(c)2011 Sebastian404
Device : MK802IIIS-eng 4.1.1 JRO03H eng.zs.20130410.134337 test-keys
Creating required files... done.
Opening mtd table... done.
Dumping kernel config... sh: cat: /proc/config.gz: No such file or directory done.
Dumping boot partition... done.
Dumping recovery partition... done.
Dumping system partition... done.
Creating Checksums... done.
Cleaning up... done.
All done.

root@android:/sdcard/romdump # ls -lah
total 736641
drwxrwxr-x 2 system sdcard_r 8.0K Apr 26 12:39 .
drwxrwxr-x 17 system sdcard_r 8.0K Jan 1 1970 ..
-rwxrwxr-x 1 system sdcard_r 16.0M Apr 26 12:38 boot.img
-rwxrwxr-x 1 system sdcard_r 275 Apr 26 12:39 checksum.md5
-rwxrwxr-x 1 system sdcard_r 0 Apr 26 12:38 config.gz
-rwxrwxr-x 1 system sdcard_r 16.0M Apr 26 12:38 recovery.img
-rwxrwxr-x 1 system sdcard_r 1.6K Apr 26 12:38 system.info.gz
-rwxrwxr-x 1 system sdcard_r 327.6M Apr 26 12:39 system.tar

I think that the goal is get this files:
boot.img
kernel.img
misc.img
recovery.img
system.img

Commands for RAW (dd):

mtd0: 00400000 00004000 "misc"
# dd if=/dev/block/mtdblock0 of=/mnt/sdcard/ROM/misc.dump count=4194304

mtd1: 00800000 00004000 "kernel"
# dd if=/dev/block/mtdblock1 of=/mnt/sdcard/ROM/kernel.dump count=8388608

mtd2: 01000000 00004000 "boot"
# dd if=/dev/block/mtdblock2 of=/mnt/sdcard/ROM/boot.dump count=16777216

mtd3: 01000000 00004000 "recovery"
# dd if=/dev/block/mtdblock3 of=/mnt/sdcard/ROM/recovery.dump count=16777216

mtd8: 20000000 00004000 "system"
# dd if=/dev/block/mtdblock8 of=/mnt/sdcard/ROM/system.dump count=536870912

mtd4: 18000000 00004000 "backup"
mtd5: 08000000 00004000 "cache"
mtd6: 50000000 00004000 "userdata"
mtd7: 00400000 00004000 "kpanic"
mtd9: 143c00000 00004000 "user"

I've gotten:

root@android:/sdcard/ROM # ls -lah
total 1138721
drwxrwxr-x 2 system sdcard_r 8.0K Apr 26 13:15 .
drwxrwxr-x 18 system sdcard_r 8.0K Apr 26 13:04 ..
-rwxrwxr-x 1 system sdcard_r 16.0M Apr 26 13:09 boot.dump
-rwxrwxr-x 1 system sdcard_r 8.0M Apr 26 13:04 kernel.dump
-rwxrwxr-x 1 system sdcard_r 4.0M Apr 26 13:09 misc.dump
-rwxrwxr-x 1 system sdcard_r 16.0M Apr 26 13:09 recovery.dump
-rwxrwxr-x 1 system sdcard_r 512.0M Apr 26 13:17 system.dump

Compressing:
# dd if=/mnt/sdcard/ROM/kernel.dump of=/mnt/sdcard/ROM/kernel.img bs=8007720 count=1
, and gotten:
-rwxrwxr-x 1 system sdcard_r 8.0M Apr 26 13:04 kernel.dump
-rwxrwxr-x 1 system sdcard_r 7.6M Apr 26 13:26 kernel.img



continue... compressing others...

Is it right?

[Finless]

Looks good.

However if the company flashed the backup.img then you will have the complete ROM there which will include the loader and parameter files. Dump that and see if you can use either wendal tools or rkunpack to unpack backup.img.

Bob

[vik2009]

Looks good.

However if the company flashed the backup.img then you will have the complete ROM there which will include the loader and parameter files. Dump that and see if you can use either wendal tools or rkunpack to unpack backup.img.

Bob

The backup.img is empty. I've opened it in hex editor and it's empty.
I have mounted system.img in linux and works.
I have neither loader and boot.img.
How Can I compress system.img? its size is 536Mb.
How Can I continue?

Thanks Bob,

[Finless]

Bummer.... Oh well... It super nice to get everything from backup.img


System.img is nothing more than a raw EXT4 file system. You don't compress it or rkcrc it.

If you want to make it smaller, then you make a new system.img using DD. Then format it ext4.
Then copy over all the files from the old system.img leaving out APPs and stuff you don't want.


Do you know how to unpack boot?

Bob

[vik2009]

Bummer.... Oh well... It super nice to get everything from backup.img

Do you know how to unpack boot?

Bob

No, ¿how?

[Finless]

No, ¿how?

Unpacking boot.img will depend if your rom has kernel in boot.img or not. There are 2 different formats of boot.img. Open boot.img in a hex editor and tell me what the header says. If is says KRNL then it does not have kernel inside. If it says Android then it has kernel. Tell me which you have and I will give you the script I use.

Bob

[vik2009]

Unpacking boot.img will depend if your rom has kernel in boot.img or not. There are 2 different formats of boot.img. Open boot.img in a hex editor and tell me what the header says. If is says KRNL then it does not have kernel inside. If it says Android then it has kernel. Tell me which you have and I will give you the script I use.

Bob

ANDROID!$0z

[Finless]

OK so it has kernel in it with initramfs.

Use this perl script.

#!/usr/bin/perl -W

use strict;
use bytes;
use File::Path;

die "did not specify boot img file\n" unless $ARGV[0];

my $bootimgfile = $ARGV[0];

my $slurpvar = $/;
undef $/;
open (BOOTIMGFILE, "$bootimgfile") or die "could not open boot img file: $bootimgfile\n";
my $bootimg = <BOOTIMGFILE>;
close BOOTIMGFILE;
$/ = $slurpvar;

# chop off the header
$bootimg = substr($bootimg,2048);

# we'll check how many ramdisks are embedded in this image
my $numfiles = 0;

# we look for the hex 00 00 00 00 1F 8B because we expect some trailing padding zeroes from the kernel or previous ramdisk, followed by 1F 8B (the gzip magic number)
while ($bootimg =~ m/\x00\x00\x00\x00\x1F\x8B/g) {
$numfiles++;
}

if ($numfiles == 0) {
die "Could not find any embedded ramdisk images. Are you sure this is a full boot image?\n";
} elsif ($numfiles > 1) {
die "Found a secondary file after the ramdisk image. According to the spec (mkbootimg.h) this file can exist, but this script is not designed to deal with this scenario.\n";
}

$bootimg =~ /(.*\x00\x00\x00\x00)(\x1F\x8B.*)/s;

my $kernel = $1;
my $ramdisk = $2;


open (KERNELFILE, ">$ARGV[0]-kernel.gz");
print KERNELFILE $kernel or die;
close KERNELFILE;

open (RAMDISKFILE, ">$ARGV[0]-ramdisk.cpio.gz");
print RAMDISKFILE $ramdisk or die;
close RAMDISKFILE;

print "\nkernel written to $ARGV[0]-kernel.gz\nramdisk written to $ARGV[0]-ramdisk.cpio.gz\n";
if (-e "$ARGV[0]-ramdisk") {
rmtree "$ARGV[0]-ramdisk";
print "\nremoved old directory $ARGV[0]-ramdisk\n";
}

mkdir "$ARGV[0]-ramdisk" or die;
chdir "$ARGV[0]-ramdisk" or die;
system ("gunzip -c ../$ARGV[0]-ramdisk.cpio.gz | cpio -i");

print "\nextracted ramdisk contents to directory $ARGV[0]-ramdisk/\n";