[ pixel 8 ] replace partition fail

[Aarqw12]

hi,

for replace partition I use this command :

avbroot ota patch
--input shiba-ota-ud1a.231105.004-49029a3a.zip
--replace boot boot.img.signed
--replace dtbo dtbo.img
--replace vendor_kernel_boot vendor_kernel_boot.img
--replace vendor_dlkm vendor_dlkm.img
--replace system_dlkm system_dlkm.img
--key-avb avb.key
--key-ota ota.key
--cert-ota ota.crt
--magisk Magisk-v26.4.apk
--magisk-preinit-device metadata

its return error :

[*] Patching vbmeta images: vbmeta_system, vbmeta_vendor, vbmeta
Error: Failed to patch OTA zip

Caused by:
0: Failed to patch payload: payload.bin
1: vbmeta_system's descriptor for system_dlkm must match system_dlkm's self descriptor

any idea for fix this error ?

I used after build :

avbtool add_hash_footer --image system_dlkm.img --partition_name system_dlkm --dynamic_partition_size
avbtool add_hash_footer --image dtbo.img --partition_name dtbo --partition_size --dynamic_partition_size
avbtool add_hashtree_footer --image vendor_dlkm.img --partition_name vendor_dlkm --do_not_generate_fec
avbtool add_hash_footer --image vendor_kernel_boot.img --partition_name vendor_kernel_boot --dynamic_partition_size
avbtool add_hash_footer --image boot.img --partition_name boot --dynamic_partition_size

[chenxiaolong]

I'll work on improving the error message to be clear. The problem is that you're adding a hash descriptor to system_dlkm instead of a hash tree descriptor. vbmeta_system expects system_dlkm to contain a hash tree descriptor, causing the mismatch.

You can inspect the descriptors using either avbroot:

avbroot avb info -i <partition>.img

or avbtool:

avbtool info_image --image <partition>.img

---

By the way, I would not recommend using --do_not_generate_fec (for vendor_dlkm). It disables the forward error correction feature in dm-verity. If there's minor corruption in the partition, like a bit flip, it can't be automatically corrected and might prevent the device from booting.

[Aarqw12]

I'll work on improving the error message to be clear. The problem is that you're adding a hash descriptor to system_dlkm instead of a hash tree descriptor. vbmeta_system expects system_dlkm to contain a hash tree descriptor, causing the mismatch.

You can inspect the descriptors using either avbroot:

avbroot avb info -i <partition>.img

or avbtool:

avbtool info_image --image <partition>.img

By the way, I would not recommend using --do_not_generate_fec (for vendor_dlkm). It disables the forward error correction feature in dm-verity. If there's minor corruption in the partition, like a bit flip, it can't be automatically corrected and might prevent the device from booting.

I see I have corrupt vbmeta error I will recheck all image

[Aarqw12]

After more check image boot , system_dlkm , vendor_kernel_boot generated by compiler have fec error for avbtool and prevent my device to boot

I'm still investigating why they are fec missing error for avbtool

[chenxiaolong]

I'm still investigating why they are fec missing error for avbtool

fec is a separate tool. If you downloaded avbtool separately (vs. building AOSP from source), it might not be installed.

---

If you don't mind taking a bit of a different approach, you can use avbroot to handle all the AVB tasks. For example:

1. Extract the original partitions.

   avbroot ota extract -i shiba-ota-ud1a.231105.004-49029a3a.zip -d extracted

2. Unpack the original (for example) system_dlkm image.

   mkdir extracted/system_dlkm
   cd extracted/system_dlkm
   avbroot avb unpack -i ../system_dlkm.img

3. Replace the unpacked raw.img with the unsigned image you built and then repack it. The will create a new image with your data + the AVB parameters from the original image, so no need for avbtool anymore.

   cp /your/custom/system_dlkm.img raw.img
   avbroot avb pack -o modified.img -k ../../avb.key

4. (Repeat for other partitions)

5. Patch the OTA with new modified images.

   avbroot ota patch \
       --input shiba-ota-ud1a.231105.004-49029a3a.zip \
       --replace boot extracted/boot/modified.img \
       --replace dtbo extracted/dtbo/modified.img \
       --replace vendor_kernel_boot extracted/vendor_kernel_boot/modified.img \
       --replace vendor_dlkm extracted/vendor_dlkm/modified.img \
       --replace system_dlkm extracted/system_dlkm/modified.img \
       --key-avb avb.key \
       --key-ota ota.key \
       --cert-ota ota.crt \
       --magisk Magisk-v26.4.apk \
       --magisk-preinit-device metadata

[Aarqw12]

Haaa I will use your method more simple

[Aarqw12]

avbroot avb pack -o modified.img -k ../../avb.key

for system_dlkm its can't work " Error: Failed to write appended AVB image " " mage size is too small to fit header or footer "

cause : google in newer sources have added 1 modules in system_dlkm so size is increased...

I have edit manually avb.toml its still fail ...

so I have after search find all tools nenessary for run avbtool https://android.googlesource.com/kernel/prebuilts/build-tools

avbtool add_hashtree_footer --image system_dlkm.img
--partition_name system_dlkm
--partition_size $(stat --format=%s system_dlkm.img)
--key custom_rsa4096_private.pem
--algorithm SHA256_RSA4096
--hash_algorithm sha256

/usr/bin/avbtool: Adding hashtree_footer failed: Image size of 11546624 exceeds maximum image size of 11481088 in order to fit in a partition size of 11751424..

Im out of idea for patch this new partition in pixel 8 ...

[Aarqw12]

avbtool info_image --image system_dlkm.img
Footer version: 1.0
Image size: 11751424 bytes
Original image size: 11546624 bytes
VBMeta offset: 11743232
VBMeta size: 512 bytes

Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 0 bytes
Auxiliary Block: 256 bytes
Algorithm: NONE
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.2.0'
Descriptors:
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 11546624 bytes
Tree Offset: 11546624
Tree Size: 98304 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 11644928
FEC size: 98304 bytes
Hash Algorithm: sha256
Partition Name: system_dlkm
Salt: 0f2828d35221521646dc96a856fee28f03173fdf458657d5c30757cd16c3b195
Root Digest: 47eeb78931f229910ef9d454a7e36f5b44ae1a075b34e952b4b979926074af57
Flags: 0

[chenxiaolong]

It should be possible to increase the partition size since the Pixel 8 series uses dynamic partitions. You can just pick any size that works (either with image_size field in avb.toml for avbroot or --partition_size for avbtool). The only requirement is that the size must be a multiple of 4096 and it must be at least 8192 bytes bigger than your unsigned image.

At least on my Pixel 8 Pro, the total size for all dynamic partitions is ~7.9 GiB:

husky:/ # blockdev --getsize64 /dev/block/by-name/super
8531214336

so you should be able to pick a larger size for system_dlkm with no problems (the stock firmware is about ~5.2 GiB).

[Aarqw12]

It should be possible to increase the partition size since the Pixel 8 series uses dynamic partitions. You can just pick any size that works (either with image_size field in avb.toml for avbroot or --partition_size for avbtool). The only requirement is that the size must be a multiple of 4096 and it must be at least 8192 bytes bigger than your unsigned image.

At least on my Pixel 8 Pro, the total size for all dynamic partitions is ~7.9 GiB:

husky:/ # blockdev --getsize64 /dev/block/by-name/super
8531214336

so you should be able to pick a larger size for system_dlkm with no problems (the stock firmware is about ~5.2 GiB).

Original size: 11751424 bytes
Additional size requirement: 8192 bytes
Total required size: 11759616 bytes
Rounded up to the nearest multiple of 4096: 11763712 bytes

/usr/bin/avbtool: Adding hashtree_footer failed: Image size of 11546624 exceeds maximum image size of 11493376 in order to fit in a partition size of 11763712..

mhmm ...

[chenxiaolong]

Oh shoot, I forgot it also adds the hash tree and FEC data, which could be a couple megabytes...

I think it's probably easier to just not be exact and pick something like 20 or 32 MiB.

[Aarqw12]

Oh shoot, I forgot it also adds the hash tree and FEC data, which could be a couple megabytes...

I think it's probably easier to just not be exact and pick something like 20 or 32 MiB.

so I applied 16998400.

avbtool add_hashtree_footer --image system_dlkm.img
--partition_name system_dlkm
--partition_size 16998400
--key custom_rsa4096_private.pem
--algorithm SHA256_RSA4096
--hash_algorithm sha256

avbroot :
1: system_dlkm descriptor (HashTree) in vbmeta_system must be a chain descriptor

so I use your method :

I have modifed in avb.toml image size .

avbroot avb pack -o modified.img -k ../../custom_rsa4096_private.pem
[*] Leaving AVB header unsigned

avbroot ota patch
--input shiba-ota-ud1a.231105.004-49029a3a.zip
--replace boot modified-boot.img
--replace system_dlkm modified.img
--key-avb custom_rsa4096_private.pem
--key-ota custom_ota_rsa4096_private.pem
--cert-ota ota.crt
--magisk Magisk-v26.4.apk
--magisk-preinit-device metadata

reboot to recovery > adb sideload > device is corrupt error

[Aarqw12]

Oh shoot, I forgot it also adds the hash tree and FEC data, which could be a couple megabytes...

I think it's probably easier to just not be exact and pick something like 20 or 32 MiB.

finally I found right step for system_dlkm thanks for all your help !

1 ) I compile my compile here for the test its gki so I have boot & system_dlkm to replace

2 ) boot :

avbtool add_hash_footer --image boot.img
--partition_name boot
--partition_size 67108864

system_dlkm : avbtool add_hashtree_footer --image system_dlkm.img
--partition_name system_dlkm
--partition_size 16998400

avbroot : avbroot ota patch
--input shiba-ota-ud1a.231105.004-49029a3a.zip
--replace boot boot.img
--replace system_dlkm system_dlkm.img
--key-avb custom_rsa4096_private.pem
--key-ota custom_ota_rsa4096_private.pem
--cert-ota ota.crt
--magisk Magisk-v26.4.apk
--magisk-preinit-device metadata

adb sideload and its boot

[chenxiaolong]

Great, thanks for reporting back with the solution!