MobileRead Forums - View Single Post

knc1 · 04-08-2016, 03:32 PM

Notice above, that 'load binary file from a dos filesystem' thingy?

What better 'binary file' to load than the Kindle's kernel?
Most likely, with a modified initial ram fs filesystem, one that will give us an interactive shell.

When the mtdblock1 storage was copied out - the copy was of the entire storage area and the kernel uImage only uses part of that area.

So where does that image file in that storage area end?

One way:

Code:

NOR $ file mtdblock1
mtdblock1: u-boot legacy uImage, s050110-1006221747-TN2.0.4~2.6., Linux/ARM, OS Kernel Image (Not compressed), 1887240 bytes, Tue Jun 22 20:03:02 2010, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xE212A2C3, Data CRC: 0xFA767E08

An (old school) one image uImage - 1887240 + the 64 byte uImage header == 1887304 bytes

Another way:

Code:

NOR $ od -A d mtdblock1
- - - - -
1887280 146024 000034 046030 000035 046054 000035 000000 000000
1887296 000000 000000 000000 000000 177777 177777 177777 177777
1887312 177777 177777 177777 177777 177777 177777 177777 177777
*
3670016

Note: File padding is usually 0's and erased flash is always 1's.
So count 'em: 1887296 + 8 == 1887304 bytes

Yeah! I can still do simple math!

So only grab the first 1,887,304 bytes from the storage image file:

Code:

NOR $ dd  if=mtdblock1 of=uImage-1 bs=1887304 count=1
1+0 records in
1+0 records out
1887304 bytes (1.9 MB) copied, 0.00524526 s, 360 MB/s

That file is checksum'd - if we got it wrong, mkimage -l will refuse to tell us anything about it:

Code:

NOR $ mkimage -l uImage-1
Image Name:   s050110-1006221747-TN2.0.4~2.6.2
Created:      Tue Jun 22 20:03:02 2010
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:    1887240 Bytes = 1843.01 kB = 1.80 MB
Load Address: 80008000
Entry Point:  80008000

The u-boot, mkimage tool likes it, we must have gotten it copied correctly, otherwise it would only tell us: "corrupted file" if the checksums didn't pass.

Now that uImage-1 file has the Linux kernel with the initial filesystem appended to it.
**all** that needs to be done is to take it apart, then take apart the initramfs part, modify the initramfs section as desired, put everything back together, then use mkimage to wrap it back up in a u-boot friendly header.
**ALL** (as in: 'the only thing(s) to do')
Right!

04-08-2016, 03:32 PM	#7
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Notice above, that 'load binary file from a dos filesystem' thingy? What better 'binary file' to load than the Kindle's kernel? Most likely, with a modified initial ram fs filesystem, one that will give us an interactive shell. When the mtdblock1 storage was copied out - the copy was of the entire storage area and the kernel uImage only uses part of that area. So where does that image file in that storage area end? One way: Code: NOR $ file mtdblock1 mtdblock1: u-boot legacy uImage, s050110-1006221747-TN2.0.4~2.6., Linux/ARM, OS Kernel Image (Not compressed), 1887240 bytes, Tue Jun 22 20:03:02 2010, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xE212A2C3, Data CRC: 0xFA767E08 An (old school) one image uImage - 1887240 + the 64 byte uImage header == 1887304 bytes Another way: Code: NOR $ od -A d mtdblock1 - - - - - 1887280 146024 000034 046030 000035 046054 000035 000000 000000 1887296 000000 000000 000000 000000 177777 177777 177777 177777 1887312 177777 177777 177777 177777 177777 177777 177777 177777 * 3670016 Note: File padding is usually 0's and erased flash is always 1's. So count 'em: 1887296 + 8 == 1887304 bytes Yeah! I can still do simple math! So only grab the first 1,887,304 bytes from the storage image file: Code: NOR $ dd if=mtdblock1 of=uImage-1 bs=1887304 count=1 1+0 records in 1+0 records out 1887304 bytes (1.9 MB) copied, 0.00524526 s, 360 MB/s That file is checksum'd - if we got it wrong, mkimage -l will refuse to tell us anything about it: Code: NOR $ mkimage -l uImage-1 Image Name: s050110-1006221747-TN2.0.4~2.6.2 Created: Tue Jun 22 20:03:02 2010 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1887240 Bytes = 1843.01 kB = 1.80 MB Load Address: 80008000 Entry Point: 80008000 The u-boot, mkimage tool likes it, we must have gotten it copied correctly, otherwise it would only tell us: "corrupted file" if the checksums didn't pass. Now that uImage-1 file has the Linux kernel with the initial filesystem appended to it. all that needs to be done is to take it apart, then take apart the initramfs part, modify the initramfs section as desired, put everything back together, then use mkimage to wrap it back up in a u-boot friendly header. ALL (as in: 'the only thing(s) to do') Right! Last edited by knc1; 04-09-2016 at 04:08 AM.