amlogic S905X udpate imge的压缩和解压

Posted 2022-12-04 TonyHo

使用的板子是khadas VIM

amlogic的升级和烧写有多种方式, 常见的是USB烧写和SD卡烧写. USB烧写的流程其实是解压update.img中的文件,然后push到RAM中运行. 然后再push文件到ram中烧写. 这个和Freescale的MFGTools类似.

update.img的生成

生成update.img的命令如下,可以看到不同文件在update.img中被包含, 中括号里面是文件名字和分区名字, 这个信息在后面的解压中会被用到.

$ ./vendor/amlogic/tools/aml_upgrade/aml_image_v2_packer -r out/target/product/kvim/upgrade/aml_upgrade_package.conf out/target/product/kvim/upgrade/ out/target/product/kvim/update.img
[Msg]Pack Item[USB         ,              DDR] from (out/target/product/kvim/upgrade/u-boot.bin.usb.bl2),sz[0xc000]B,
[Msg]Pack Item[USB         ,            UBOOT] from (out/target/product/kvim/upgrade/u-boot.bin.usb.tpl),sz[0xd0000]B,ft[normal]	
[Msg]Pack Item[UBOOT       ,     aml_sdc_burn] from (out/target/product/kvim/upgrade/u-boot.bin.sd.bin),sz[0xdc200]B,ft[normal]	
[Msg]Pack Item[ini         ,     aml_sdc_burn] from (out/target/product/kvim/upgrade/aml_sdc_burn.ini),sz[0x24d]B,
[Msg]Pack Item[PARTITION   ,             boot] from (out/target/product/kvim/upgrade/boot.img),sz[0x7ee800]B,ft[normal]	
[Msg]Pack Item[VERIFY      ,             boot] from (out/target/product/kvim/upgrade/boot.img),vry[sha1sum aa0fea3f2bd1ffe15f8f5c9ff1d71609ee7db42d]	
[Msg]Pack Item[PARTITION   ,       bootloader] from (out/target/product/kvim/upgrade/u-boot.bin),sz[0xe0000]B,ft[normal]	
[Msg]Pack Item[VERIFY      ,       bootloader] from (out/target/product/kvim/upgrade/u-boot.bin),vry[sha1sum 3f5d17c6352bdb7bdff9a1114da3ce6f36c3803d]	
[Msg]Pack Item[PARTITION   ,             logo] from (out/target/product/kvim/upgrade/logo.img),sz[0x11b5b0]B,ft[normal]	
[Msg]Pack Item[VERIFY      ,             logo] from (out/target/product/kvim/upgrade/logo.img),vry[sha1sum bf640f9e75764aa138a5783550d3f842814ed171]	
[Msg]Pack Item[xml         ,         manifest] from (out/target/product/kvim/upgrade/manifest.xml),sz[0xe2f2]B,
[Msg]Pack Item[dtb         ,           meson1] from (out/target/product/kvim/upgrade/meson.dtb),sz[0x94dd]B,
[Msg]Pack Item[conf        ,         platform] from (out/target/product/kvim/upgrade/platform.conf),sz[0xca]B,
[Msg]Pack Item[PARTITION   ,         recovery] from (out/target/product/kvim/upgrade/recovery.img),sz[0xab5800]B,ft[normal]	
[Msg]Pack Item[VERIFY      ,         recovery] from (out/target/product/kvim/upgrade/recovery.img),vry[sha1sum 3dc97761a4200b31e7898aa32a4465e3d792bc61]	
[Msg]Pack Item[PARTITION   ,           system] from (out/target/product/kvim/upgrade/system.img),sz[0x222f3954]B,ft[sparse]	
[Msg]Pack Item[VERIFY      ,           system] from (out/target/product/kvim/upgrade/system.img),vry[sha1sum c4e2bb6e4fadfe8762490d99be6d9b85a9fd7f29]	
[Msg]version:0x2 crc:0xf2f5fb70 size:597054308 bytes[569MB]
Pack image[out/target/product/kvim/update.img] OK

Update.img的解压

参考下面这个地址中的.c文件

http://freaktab.com/forum/tv-player-support/amlogic-based-tv-players/s912/others-aml-s912/knowledge-tutorials-av/608116-how-to-recover-so-you-bricked-your-box

因为他的这个是为S912S为处理的, 对于S905X而言也是类似的, 同时因为他默认指定了一个打开的文件, 因此我改了一下:

#include <errno.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <arpa/inet.h>

uint32_t convert(uint8_t *test, uint64_t loc) 
    return ntohl((test[loc] << 24) | (test[loc+1] << 16) | (test[loc+2] << 8) | test[loc+3]);


void main(int argc, char * argv[]) 
    FILE *fileptr;
    uint8_t *buffer;
    long filelen;

    FILE *f;
    char *filename;
    uint64_t record;
    uint64_t record_loc;
    uint64_t file_loc;
    uint64_t file_size;

    printf("file is %s\\n", argv[1]);
    fileptr = fopen(argv[1], "rb");
    fseek(fileptr, 0, SEEK_END);
    filelen = ftell(fileptr);
    rewind(fileptr);

    buffer = (uint8_t *)malloc((filelen+1)*sizeof(uint8_t));
    fread(buffer, filelen, 1, fileptr);
    fclose(fileptr);

    for (record = 0; record < (uint8_t)buffer[0x18]; record = record + 1)
        record_loc = 0x40 + (record * 0x240);

        filename = (malloc(32));
        sprintf(filename,"%s.%s",(char *)&buffer[record_loc+0x120], (char *)&buffer[record_loc+0x20]);

        file_loc = convert(buffer,record_loc+0x10);
        file_size = convert(buffer,record_loc+0x18);

        f = fopen(filename, "wb");
        if (f == NULL) 
            printf("ERROR: could not open output\\n");
            printf("the error was: %s\\n",strerror(errno));
            free(filename);
            continue;
        
        fwrite(&(buffer[file_loc]), sizeof(uint8_t), (size_t)file_size, f);
        fclose(f);
        free(filename);
    
    free(buffer);

将这个代码保存, 使用gcc直接编译, 然后就可以带一个update.img为参数运行了, 即可得到对应的解压文件.

解压后各个文件的意义

因为解压后的名字都是NAME.PARTITION这样的命名, 这个需要看前面提到的update.img的生成log中对应

使用SD卡烧写

SD卡的烧写一样可以参考下面文章中的dd:

http://freaktab.com/forum/tv-player-support/amlogic-based-tv-players/s912/others-aml-s912/knowledge-tutorials-av/608116-how-to-recover-so-you-bricked-your-box

具体而言就是将uboot.bin.sdcard dd到第二个sector, 然后拷贝各种配置文件.