Monday, May 7, 2012

Unpack boot.superboot.img Android boot image

Today I've rooted my HTC One V, guided by this excellent guide.

But I wanted to know what the contents of boot.superboot.img were so I could understand the process better. This post is by no means an explanation of the rooting process, I recommend following reading materials for this: general explanation android rooting.

To view/unpack an android boot.img you first need to download the tools. I tested this on a Scientific Linux release 6.1 (Carbon).

wget https://android-serialport-api.googlecode.com/files/android_bootimg_tools.tar.gz
If you extract this tarball with tar xvzf  android_bootimg_tools.tar.gz You get two binaries: unpackbootimg and  mkbootimg.

(Update: instead of unpackbootimg, you could use perl split_bootimg.pl also)

Use ./unpackbootimg -i <img> -o <outputpath> to unpack to a folder that is created upfront
results:
boot.superboot.img-pagesize
boot.superboot.img-cmdline
boot.superboot.img-base
boot.superboot.img-zImage ---> kernel
boot.superboot.img-ramdisk.gz ---> ramdisk

The interesting part will be in the ramdisk.

To extract the ramdisk in your current directory you can execute following command.

gunzip -c  boot.superboot.img-ramdisk.gz | cpio -i
results:

cwkeys
data
default.prop
dev
init
init.bliss.rc
init.debug_mfgkernel.rc
init.debug_normal.rc
init.goldfish.rc
init.primou.rc
init.rc
init.usb.rc
proc
sbin
superboot --> The contents of this directory will root our phone.
sys
system
ueventd.goldfish.rc
ueventd.primou.rc
ueventd.rc

----
ls superboot/
su superboot.sh Superuser.apk


The superboot.sh basically just copies the su and Superuser.apk to the filesystem, where they can be used by application that require root access.

Note that the su binary has the setuid bit set
-rwsr-sr-x 1 root root 91980 May 6 23:03 /system/xbin/su