1 changed files with 90 additions and 0 deletions
@ -0,0 +1,90 @@
|
||||
--- |
||||
title: "Unbrick \"Cannot load Android system\"" |
||||
date: 2022-05-10T09:52:39+02:00 |
||||
draft: false |
||||
--- |
||||
|
||||
Disclaimer: I have no idea on which phones it works, |
||||
it might actually brick your phone even more, etc. |
||||
If in doubt, don't listen to me. |
||||
|
||||
Short answer: |
||||
- enter fastboot (depends on your phone) |
||||
- create an 8KB empty file - `truncate -s 8K file` |
||||
- flash it to `para`/`boot_para`/sometimes `misc` - `fastboot flash para file` |
||||
- reboot |
||||
|
||||
Long answer - a short tale about living with a broken phone: |
||||
|
||||
Honestly, this might not even apply to you. There's the "Try again" option. |
||||
But, you see, I have a broken power button and couldn't select it... |
||||
I've been doing some software patches to my phone to mitigate this hardware issue, |
||||
most notably making [a few patches][1] to my phone's bootloader, incl. |
||||
one that makes it boot on plugged USB cable, because sadly on this phone it's |
||||
not a togglable option, like others have. (`fastboot oem off-mode-charge 0`) |
||||
|
||||
Unfortunately, the patches did not help this time. I was presented with |
||||
two options and no way to pick either of them. Tried disconnecting my battery |
||||
and connecting it back, to no avail - bootloader just skipped straight to recovery, |
||||
completely ignoring the volume buttons. Making matters even worse, the recovery |
||||
didn't handle USB in any way - no fastbootd, no adb, no anything. Just the screen |
||||
of doom and my phone lying to my face with the ominous "Cannot load Android system". |
||||
|
||||
After trying all the simple solutions, I realized my only hope was to |
||||
patch the bootloader again (lol) and make it boot regular boot.img. |
||||
To make stuff a bit easier, I focused first on getting working fastboot; |
||||
from there I can just override the bootloader again and reboot without |
||||
having to use the dreaded Smart Phone Flash Tool, just `fastboot flash lk lk.img`. |
||||
|
||||
So... I opened Ghidra alongside MediaTek's Little Kernel-based bootloader code, |
||||
generously leak^Wopen-sourced by Umidigi with the Linux sources and other stuff. |
||||
At first I tried to find stuff related to the actual issue itself - `wipe`, `erase`, |
||||
anything like that, but couldn't find anything meaningful. Ended up spending multiple |
||||
hours trying to map the C code onto functions Ghidra was showing me, expecially that |
||||
some of them were so highly optimized, that the decompiler was completely lost. |
||||
Fortunately, it yielded some nice results - at the end of `mt_boot_init` there was |
||||
a following snippet: |
||||
```c |
||||
/* Will not return */ |
||||
boot_linux_from_storage(); |
||||
|
||||
fastboot: |
||||
target_fastboot_init(); |
||||
``` |
||||
|
||||
This meant that if I'm lucky, I can get to fastboot with just one simple patch, |
||||
replacing the branch instruction to `boot_linux_from_storage` with a NOP or two. |
||||
And lucky I was, because a while later I had [the patch][2] ready and it worked! |
||||
Less fortunately, removing that call meant that it couldn't boot *any* Linux, |
||||
and the Android recovery is one too. My workaround turned out to be another laptop |
||||
with SPFT that reflashed only the `lk` partition - seems a bit pointless, but |
||||
it allowed me for faster prototyping, because I could do most of the stuff from |
||||
my Linux workstation and only use Windows for clicking one button. |
||||
|
||||
What followed was a lot of trial and error with changing various things, |
||||
including trying to repack the recovery - turns out [magiskboot][3] can be ran |
||||
on a regular Linux machine and is _really_ good at its job; you can just unpack |
||||
the Magisk .apk file and run `lib/x86_64/libmagiskboot.so`. |
||||
Sadly, I didn't get much further with that, so I gave up on experimentation |
||||
and opened [Android Code Search][4] in hopes of finding something useful. |
||||
|
||||
From perspective, I wish I did that sooner, because only after a few minutes |
||||
of looking around the code, I found [bootloader_message.cpp][5] which revealed |
||||
that the bootloader uses the `misc` partition to communicate with recovery. |
||||
The partition wasn't there on my phone, but now that I knew where to look, |
||||
I opened the recovery executable from my phone in Ghidra and found out that MTK |
||||
uses the name `para` instead, for some reason. With all that, I ensured that |
||||
making the partition empty [wouldn't break anything][6] and just flashed it. |
||||
|
||||
With all that, after a few days of messing around, I finally booted my phone |
||||
(and promptly dropped it in the bathtub the same day, causing it to bootloop |
||||
again before I managed to backup any data from it :) ) |
||||
Fortunately, it managed to survive and serves me as a backup phone to this day. |
||||
|
||||
|
||||
[1]: https://github.com/ptrcnull/umidigi-f2-patches |
||||
[2]: https://github.com/ptrcnull/umidigi-f2-patches/blob/master/force_fastboot.patch |
||||
[3]: https://topjohnwu.github.io/Magisk/tools.html |
||||
[4]: https://cs.android.com/ |
||||
[5]: https://cs.android.com/android/platform/superproject/+/master:bootable/recovery/bootloader_message/bootloader_message.cpp |
||||
[6]: https://cs.android.com/android/platform/superproject/+/master:bootable/recovery/bootloader_message/bootloader_message.cpp;l=142 |
||||
Loading…
Reference in new issue