Replicant

h1. AddingADBRootToAnImage

In this tutorial we'll add adb root support to an existing Replicant release.

This is valid for the following configuration:

* *Image*: replicant-6.0-0004-rc1-maguro.zip

* *Device*: Galaxy Nexus (GT-I9250)

You also need to have unbootimg installed. In Parabola this is part of the "fso-unbootimg package":https://www.parabola.nu/packages/?sort=&q=fso-unbootimg . It's also possible to compile that tool by hand or to other alternative tools that do exactly the same thing.

You'll need to adapt it slightly for other devices.

First extract the boot.img from the zip

<pre>

$ mkdir temp

$ cd temp 

$ unzip ../replicant-6.0-0004-rc1-maguro.zip

$ file boot.img

boot.img: Android bootimg, kernel, ramdisk, page size: 2048, cmdline (androidboot.hardware=tuna)

</pre>

Then extract the kernel, and initramfs from the boot.img. Also save the infos such as the load address, etc in boot.txt:

<pre>

$ unbootimg --kernel kernel.img --ramdisk ramdisk.cpio.gz -i boot.img | tee boot.txt

total image size:   5619712

kernel size:        4604340

kernel load addr:   0x80008000

ramdisk size:       1009915

ramdisk load addr:  0x81000000

2nd boot size:      0

2nd boot load addr: 0x80f00000

kernel tags addr:   0x80000100

page size:          2048

board:              `'

cmdline:            `androidboot.hardware=tuna'

id:                 9b90141066f527ecd3909d2ab8e383ebd995fd40000

</pre>

Then uncompress the initramfs

<pre>

$ gunzip ramdisk.cpio.gz

$ file ramdisk.cpio 

ramdisk.cpio: ASCII cpio archive (SVR4 with no CRC)

</pre>

Then edit the default.props, we use sed on the raw cpio image for simplicity (we don't have permissions and username to take care of this way):

<pre>

$ sed 's#ro.adb.secure=1#               #' -i ramdisk.cpio

$ sed 's#ro.secure=1#ro.secure=0#' -i ramdisk.cpio

$ sed 's#persist.sys.usb.config=none#persist.sys.usb.config=adb #' -i ramdisk.cpio

</pre>

Then recompress the initramfs

<pre>

$ gzip ramdisk.cpio

</pre>

We then recreate the image with the infos we saved in boot.txt. Note that the base is 0x80000000. The kernel has an offset and will be in 0x80008000:

<pre>

$ mkbootimg --cmdline="androidboot.hardware=tuna" --kernel kernel.img --ramdisk ramdisk.cpio.gz  --base 0x80000000 -o boot_new.img

</pre>

Verify that we got all the arguments right:

<pre>

$ unbootimg -i boot_new.img | tee boot_new.txt

$ diff -u boot.txt boot_new.txt

$ --- boot.txt	2020-02-18 00:39:59.890285634 +0100

+++ boot_new.txt	2020-02-18 00:44:16.208897037 +0100

@@ -1,7 +1,7 @@

 total image size:   5619712

 kernel size:        4604340

 kernel load addr:   0x80008000

-ramdisk size:       1009915

+ramdisk size:       1010280

 ramdisk load addr:  0x81000000

 2nd boot size:      0

 2nd boot load addr: 0x80f00000

@@ -9,4 +9,4 @@

 page size:          2048

 board:              `'

 cmdline:            `androidboot.hardware=tuna'

-id:                 9b90141066f527ecd3909d2ab8e383ebd995fd40000

+id:                 dd37b2ae1e50be62fe5c94b81b85aa56ffea17be000

</pre>

You can then reflash the boot.img image.

Don't forget to adjust the heimdall arguments for your device.

If in doubt, it's better to consult the Replicant installation instructions that have the good heimdall arguments, as wrong arguments can completely break your device, making it too complicated to repair (you'd have to un-solder and re-solder resistors that are hardly visible).

<pre>

heimdall flash --boot boot.img --recovery boot.img

</pre>

Then you can use adb:

<pre>

$ adb logcat -b main

</pre>

h2. Example for the GT-I9300

This is valid for the following configuration:

* *Image*: replicant-6.0-0004-rc1-i9300.zip

* *Device*: Galaxy SIII (GT-I9300)

For other devices like the GT-I9300, the boot.img (or recovery.img) have other parameters:

<pre>

 unbootimg -i boot.img 

total image size:   4239360

kernel size:        3391376

kernel load addr:   0x40008000

ramdisk size:       844653

ramdisk load addr:  0x41000000

2nd boot size:      0

2nd boot load addr: 0x40f00000

kernel tags addr:   0x40000100

page size:          2048

board:              `'

cmdline:            `console=ttySAC2,115200'

id:                 d34c0412b72d37a2287331e28d902a769c4a86e9000

</pre>