Customized Android firmware

Preface

To customize Android firmware, there are two methods:

Modify source code, then compile and package to new firmware.

Patch based on existing firmware.

The former can customize Android on any level freely, but require
compiling environment with high performance, and personal
knowledgeable skill in Linux kernel and Android. Please see the detail
in

Build_android

.

We introduce the latter one here. It is divided in three stages:
extract, customize and package. We use Linux as the host OS, and
utilities which are all open source.

Image format

Our new update image, "release_update.img" here, contains bootloader
"loader.img" and the actual firmware data update.img. That is,
"release_undate.img" is a wrapper of "loader.img" and "update.img".

   release_update.img
   |- loader.img
   `- update.img

"update.img" is a composite file, which contains multiple files
described by package-file. A typical package-file is:

   # NAME    Relative path
   #
   # HWDEF   HWDEF
   package-file package-file
   bootloader Image/MiniLoaderAll.bin
   parameter  Image/parameter.txt
   trust      Image/trust.img
   uboot      Image/uboot.img
   misc       Image/misc.img
   resource   Image/resource.img
   kernel     Image/kernel.img
   boot    Image/boot.img
   recovery   Image/recovery.img
   system     Image/system.img
   backup     RESERVED
   update-script update-script
   recover-script recover-script

package-file  update.img package description file, update.img also
contains a package-file.

Image/MiniLoaderAll.bin  Start the loader - bootloader.

Image/parameter.txt  Parameter file, can set the kernel boot
parameters, there are important partition information.

Image/trust.img  trust.img is the U-Boot as the secondary loader
package.

Image/misc.img  Image of misc partition, used to control whether
Android starts normally or enters Recovery Mode.

Image/kernel.img  Android kernel.

Image/resource.img  Resource image with kernel boot image and kernel
Device Tree Blob.

Image/boot.img  The memory boot disk (initrd) of the Android kernel,
the first root file system to be loaded after the kernel is started,
contains important initialization actions that generally do not need
to be changed.

Image/recovery.img  Android image,including Recovery Mode with kernel
and root file system of Recovery Mode.

Image/system.img  Corresponds to the Android /system partition and is
the following custom object.

Unpacking is extracting the "update.img" from "release_update.img",
then the extracted with "package-file" statement by multiple files.

Packaging is an inverse process to synthesize the multiple files
listed in the package-file to "update.img", add to the "loader.img",
and finally generate the "release_update.img".

Prepare the Tools

   git clone https://github.com/TeeFirefly/rk2918_tools.git
   cd rk2918_tools
   make
   sudo cp afptool img_unpack img_maker mkkrnlimg /usr/local/bin

Extrace Firmware

Extract the release_update.img

   $ cd /path/to/your/firmware/dir
   $ img_unpack Firefly-RK3399_20161027.img img
   rom version: 6.0.1
   build time: 2016-10-27 14:58:18
   chip: 33333043
   checking md5sum....OK

Extract the update.img

   $ cd img
   $ afptool -unpack update.img update
   Check file...OK
   ------- UNPACK -------
   package-file	0x00000800	0x00000280
   Image/MiniLoaderAll.bin	0x00001000	0x0003E94E
   Image/parameter.txt	0x00040000	0x00000350
   Image/trust.img	0x00040800	0x00400000
   Image/uboot.img	0x00440800	0x00400000
   Image/misc.img	0x00840800	0x0000C000
   Image/resource.img	0x0084C800	0x0003FE00
   Image/kernel.img	0x0088C800	0x00F5D00C
   Image/boot.img	0x017EA000	0x0014AD24
   Image/recovery.img	0x01935000	0x013C0000
   Image/system.img	0x02CF5000	0x2622A000
   RESERVED	0x00000000	0x00000000
   UnPack OK!

View the file tree under the update directory

   $ cd update/
   $ tree
   .
   ├── Image
   │   ├── boot.img
   │   ├── kernel.img
   │   ├── MiniLoaderAll.bin
   │   ├── misc.img
   │   ├── parameter.txt
   │   ├── recovery.img
   │   ├── resource.img
   │   ├── system.img
   │   ├── trust.img
   │   ├── uboot.img
   ├── package-file
   └── RESERVED

   1 directory, 12 files

Now that the firmware has been unpacked successfully, let's start
customizing it.

Customize

Customize the system.img

"system.img" is an image file with ext4 filesystem format, which can
be mounted into system to modify directly

   sudo mkdir -p /mnt/system
   sudo mount -o loop Image/system.img /mnt/system
   cd /mnt/system
   # Add or delete apks inside. Pay attention to the free space. You canno add too many apks.
   # Edit complete. Unmount it.
   cd /
   sudo umount /mnt/system

Please note, the free space of "system.img" is nearly zero. If you
want more, you have to expand it, and change partition settings in
parameter file accordingly.

Here is an example of how the expand the image. Before expanding, run
mount to make sure that system.img is not mounted (Unmount it if it
is):

Add 128M disk space

   dd if=/dev/zero bs=1M count=128 >> Image/system.img
   # Update filesystem records
   e2fsck -f Image/system.img
   resize2fs Image/system.img

Packing

First, you need to check the size of "system.img". Make sure it is
matched with partition setting in parameter file. If not, modify the
parameter file to adjust the partitions.

For example, you can find the "CMDLINE" line in parameter file
parameter.txt, which has the string "system":

   0x00200000@0x000B0000(system)

The number before symbol @, is the size of the partition, in unit of
512 bytes (traditional disk sector size). Therefore this system
partition has a size of:

   $ echo $(( 0x00200000 * 512 / 1024 / 1024))M
   1024M

As long as the size of "system.img" does not exceed 1024M, the
parameter file does not need to be changed.

If size of "system.img" does not go beyond 1024M, there is no need to
change parameter file.

If the partitions do not changed, you can flash the new system.img to
the device for a test. Otherwise, you need to package a new firmware,
flash it and test.

Here are the steps to package "update.img":

Package update.img:

   # The current directorys still update/, which has package-file. All files listed in package-file are available.
   # Copy the parameter file, which is the default one used by afptool.
   $ cp Image/parameter.txt parameter
   $ afptool -pack . ../update_new.img
   ------ PACKAGE ------
   Add file: ./package-file
   Add file: ./Image/MiniLoaderAll.bin
   Add file: ./Image/parameter.txt
   Add file: ./Image/trust.img
   Add file: ./Image/uboot.img
   Add file: ./Image/misc.img
   Add file: ./Image/resource.img
   Add file: ./Image/kernel.img
   Add file: ./Image/boot.img
   Add file: ./Image/recovery.img
   Add file: ./Image/system.img
   Add file: ./RESERVED
   Add CRC...
   ------ OK ------
   Pack OK!

Package release_update.img:

   $ img_maker -rk33 loader.img update_new.img release_update_new.img
   generate image...
   append md5sum...
   success!

Congratulations, "release_update_new.img" is the final firmware image
file ready to flash.

FAQS

Q1 :

 How to change firmware version?

A1 :

 In parameter file, find the following line and modify it. The version
can only contain digital numbers, and the two dots can not be omitted.

   FIRMWARE_VER: 7.1.1