prepatch full GKI fail.

[Aarqw12]

hi, so lets explain my problems I have build full gki witch kernelsu (and other mod) its result 4 img generated : boot.img , vendor_boot.img , vendor_dlkm.img , dtbo.img . flashing only boot.img will no boot regarding to change I made.

I see avbroot support only --prepatched for boot. could you look into it ?

[chenxiaolong]

Sorry, I don't quite understand what you are asking for. Could you explain a bit more?

Are you asking for a new option in avbroot that allows any partition to be replaced?

[Aarqw12]

Sorry, I don't quite understand what you are asking for. Could you explain a bit more?

Are you asking for a new option in avbroot that allows any partition to be replaced?

yes replace vendor_boot , vendor_dlkm , dtbo , boot

also I have followed all step in my pixel 6 for flash stock rom using patched magisk boot for test I have do :
-- preparation , key created ex ...

I flash :

Flash the boot images that were extracted

for image in extracted/*.img; do
partition=$(basename "${image}")
partition=${partition%.img}

fastboot flash "${partition}" "${image}"

done

Flash the AVB signing public key

fastboot erase avb_custom_key
fastboot flash avb_custom_key /path/to/avb_pkmd.bin

reboot , rom boot properly but its impossible to relock bootloader I get error
FAILED (remote: 'invalid android images, skip locking')

I have go in recovery and doing adb sideload patched rom , its boot again but still impossible to lock bootloader

[chenxiaolong]

yes replace vendor_boot , vendor_dlkm , dtbo , boot

OK, got it. I think that should be pretty simple to implement. I'll look into it soon.

reboot , rom boot properly but its impossible to relock bootloader I get error
FAILED (remote: 'invalid android images, skip locking')

Hmm, I have no idea what would cause this. I searched around for the invalid android images, skip locking error and it seems that some people run into that even with the unmodified factory image.

I did see someone mention that restoring to stock with https://flash.android.com/ once resolved the issue (instead of factory image + flash_all.sh). Maybe that's worth a try?

[Aarqw12]

yes replace vendor_boot , vendor_dlkm , dtbo , boot

OK, got it. I think that should be pretty simple to implement. I'll look into it soon.

reboot , rom boot properly but its impossible to relock bootloader I get error
FAILED (remote: 'invalid android images, skip locking')

Hmm, I have no idea what would cause this. I searched around for the invalid android images, skip locking error and it seems that some people run into that even with the unmodified factory image.

I did see someone mention that restoring to stock with https://flash.android.com/ once resolved the issue (instead of factory image + flash_all.sh). Maybe that's worth a try?

I have doing search its mean bootloader detect not all partition is in "stock state" ( boot modified like kernelsu , any mod , problem avb ... ) for avoid brick its abort by this error . I need relook what is wrong in payload.bin patching process for my device payload.bin is no properly patched for my bootloader.

[Aarqw12]

https://flash.android.com/ just not work in my devices ) error detection device ...

but I have find solution : - download factory rom - change slot of bootloader & flash_all.sh

flash avbroot patch : flash boot.img , vendor_boot.img , vbmeta.img & avb custom key , now its work !

thanks for avbroot project !

[chenxiaolong]

Great, glad you got it working!

[Aarqw12]

yes replace vendor_boot , vendor_dlkm , dtbo , boot

OK, got it. I think that should be pretty simple to implement. I'll look into it soon.

reboot , rom boot properly but its impossible to relock bootloader I get error
FAILED (remote: 'invalid android images, skip locking')

Hmm, I have no idea what would cause this. I searched around for the invalid android images, skip locking error and it seems that some people run into that even with the unmodified factory image.

I did see someone mention that restoring to stock with https://flash.android.com/ once resolved the issue (instead of factory image + flash_all.sh). Maybe that's worth a try?

Hi I have created simple script for wait its replace in payload.bin boot.img,vendor_boot.img,vendor_dlkm,dtbo.img I need. its only simple script I patch payload.bin before using avbroot I guess --argument prepatch can be modified in avbroot for allow that .

`import os
import shutil

def replace_files(payload_bin, boot_img, vendor_boot_img, vendor_dlkm_img, dtbo_img):
"""Replaces the boot.img, vendor_boot.img, vendor_dlkm.img, and dtbo.img files in the payload.bin file with the specified files.

Args:
payload_bin: The path to the payload.bin file.
boot_img: The name of the boot.img file.
vendor_boot_img: The name of the vendor_boot.img file.
vendor_dlkm_img: The name of the vendor_dlkm.img file.
dtbo_img: The name of the dtbo.img file.

Raises:
FileNotFoundError: If any of the specified files do not exist.
"""

if not os.path.exists(payload_bin):
raise FileNotFoundError("The payload.bin file does not exist.")

with open(payload_bin, "rb") as payload_bin_file:
contents = payload_bin_file.read()

with open(boot_img, "rb") as boot_img_file:
boot_img_data = boot_img_file.read()

with open(vendor_boot_img, "rb") as vendor_boot_img_file:
vendor_boot_img_data = vendor_boot_img_file.read()

with open(vendor_dlkm_img, "rb") as vendor_dlkm_img_file:
vendor_dlkm_img_data = vendor_dlkm_img_file.read()

with open(dtbo_img, "rb") as dtbo_img_file:
dtbo_img_data = dtbo_img_file.read()

new_contents = contents[:]
new_contents = new_contents.replace(boot_img_data, boot_img_data)
new_contents = new_contents.replace(vendor_boot_img_data, vendor_boot_img_data)
new_contents = new_contents.replace(vendor_dlkm_img_data, vendor_dlkm_img_data)
new_contents = new_contents.replace(dtbo_img_data, dtbo_img_data)

with open(payload_bin, "wb") as payload_bin_file:
payload_bin_file.write(new_contents)

if name == "main":
payload_bin = os.path.join(os.getcwd(), "payload.bin")
boot_img = "boot.img"
vendor_boot_img = "vendor_boot.img"
vendor_dlkm_img = "vendor_dlkm.img"
dtbo_img = "dtbo.img"

replace_files(payload_bin, boot_img, vendor_boot_img, vendor_dlkm_img, dtbo_img)

print("The files have been replaced successfully.")`

[chenxiaolong]

Could you give #103 a try? With the new changes, you should be able to do this:

avbroot \
    --prepatched boot.img \
    --boot-partition @gki_kernel \
    --replace dtbo dtbo.img \
    --replace vendor_boot vendor_boot.img \
    --replace vendor_dlkm vendor_dlkm.img \
    # Remaining args...

--rootless --replace boot boot.img also works, but using --prepatched for the boot image is better because it verifies that the kernel version is compatible.

[Aarqw12]

Could you give #103 a try? With the new changes, you should be able to do this:

avbroot \
    --prepatched boot.img \
    --boot-partition @gki_kernel \
    --replace dtbo dtbo.img \
    --replace vendor_boot vendor_boot.img \
    --replace vendor_dlkm vendor_dlkm.img \
    # Remaining args...

--rootless --replace boot boot.img also works, but using --prepatched for the boot image is better because it verifies that the kernel version is compatible.

its working !

for documentation you should add in case image is not a vbmeta valid ( compiled from kernel source for ex only boot have hash ) its require for other image :

1 ) avbroot/external/avb/avbtool.py add_hash_footer --image myimage.img --partition_name mypartition --partition_size or --dynamic_partition_size

2 ) avbroot
--prepatched boot.img
--boot-partition @gki_kernel
--replace dtbo dtbo.img
--replace vendor_boot vendor_boot.img
--replace vendor_dlkm vendor_dlkm.img
# Remaining args...

[Aarqw12]

ok its have created vbmeta corruption something is no patched properly in

--replace dtbo dtbo.img
--replace vendor_boot vendor_boot.img
--replace vendor_dlkm vendor_dlkm.img

• I have unlocked bootloader and reset vbmeta ...

[chenxiaolong]

ok its have created vbmeta corruption something is no patched properly in

--replace dtbo dtbo.img --replace vendor_boot vendor_boot.img --replace vendor_dlkm vendor_dlkm.img

* I have unlocked bootloader and reset vbmeta ...

I just pushed a change that might fix this. I accidentally messed up the dependency solver, so it might have patched vbmeta_vendor after vbmeta (instead of before).

[Aarqw12]

ok its have created vbmeta corruption something is no patched properly in
--replace dtbo dtbo.img --replace vendor_boot vendor_boot.img --replace vendor_dlkm vendor_dlkm.img

* I have unlocked bootloader and reset vbmeta ...

I just pushed a change that might fix this. I accidentally messed up the dependency solver, so it might have patched vbmeta_vendor after vbmeta (instead of before).

ok thanks I will re-test

[chenxiaolong]

seem my image dtbo,vendor_boot , vendor_dlkm is not a valid vbmeta image.

so I have tried to add from avbtool.py the add_hash_footer but its return error in process avbroot patching :

Oh, by the way, vendor_dlkm must use add_hashtree_footer instead of add_hash_footer because it's an ext4 filesystem (uses dm-verity).

I've never built a GKI before. Does the GKI build system have a way to automatically add the vbmeta footers?

[Aarqw12]

seem my image dtbo,vendor_boot , vendor_dlkm is not a valid vbmeta image.
so I have tried to add from avbtool.py the add_hash_footer but its return error in process avbroot patching :

Oh, by the way, vendor_dlkm must use add_hashtree_footer instead of add_hash_footer because it's an ext4 filesystem (uses dm-verity).

I've never built a GKI before. Does the GKI build system have a way to automatically add the vbmeta footers?

no in kernel build environment of google its only for boot.img ( for gki ) https://android.googlesource.com/kernel/gs/+/refs/heads/android-gs-pantah-5.10-t-qpr3-beta-3/build.config.gs101#72

google assume you compile only ROM for enable AVB ...