Skip to content

Commit 2037990

Browse files
committed
Add a shellcode to bypass abl dt overlay failure.
1 parent f6e8758 commit 2037990

File tree

2 files changed

+65
-0
lines changed

2 files changed

+65
-0
lines changed

Config/DualBoot.Sm8250DT.cfg

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
StackBase=0x9FC00000
2+
StackSize=0x00300000
Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**
2+
* A Wrapper for Linux Kernel to by pass android dtb check
3+
*
4+
* Qualcomm application bootloader (ABL) will check msm-id/board-id
5+
* or apply overlay before booting kernel. By replacing android dtb with linux dtb,
6+
* abl will failed to check or apply dtbo and then refuse to boot.
7+
* This wrapper is used to bypass the check.
8+
*
9+
* Scheme:
10+
* Only replace kernel instead of replacing dtb. But inject the dtb in kernel
11+
*
12+
* Step:
13+
* Inject this wrapper into kernel header and make a payload with linux kernel + linux dtb.
14+
* Then, repack the android boot image with the payload, but not replace dtb.
15+
* Linux will boot successfully then.
16+
*
17+
* Note:
18+
* You need to add memory region for linux dtb in device tree manually
19+
* otherwise linux will NOT boot.
20+
*
21+
* Usage:
22+
* ./DualBootKernelPatcher OriginalKernel mainline_dtb output DualBoot.Sm8250DT.cfg ShellCode.KernelWrapper.bin
23+
* Then repack android image with the output file.
24+
*
25+
* Inspired by @bigfootACA
26+
*
27+
*/
28+
29+
/* Dummy Header for shellcode */
30+
.include "DummyHead.S"
31+
32+
_ShellCodeStart:
33+
// Calculate UEFI FD(dtb addr here) start address and store in X4
34+
adr x4, _KernelHead // Store kernel head address in x4.
35+
ldr x5, _KernelSize // Store kernel size in x5.
36+
add x4, x4, x5 // Add kernel base + kernel size, store value in x4.
37+
38+
// Copy dtb to safe place (StackRegion, you can configure it freely in DualBoot config file)
39+
ldr x5, _StackBase // Store FD Base in x5.
40+
ldr x6, _StackSize // Store FD Size in x6.
41+
bl _CopyLoop // Copy DTB to stack region.
42+
43+
// Set X0 to StackBase, which is the new DTB address
44+
ldr x0, _StackBase // Store stack base address in x5.
45+
b _LinuxStart // Boot linux kernel.
46+
b _Dead // We should never get here.
47+
48+
// Copy Sub program, X4 is src, X5 is dst, X6 is size
49+
_CopyLoop:
50+
ldp x2, x3, [x4], #0x10 // Save value at [x4](pointer) to x2 and x3, then x4 add 16.
51+
stp x2, x3, [x5], #0x10 // Save value in x2 and x3 to [x5](pointer), then x5 add 16
52+
subs x6, x6, #0x10 // x6 - 16, if , set CPSR register to 0.
53+
b.ne _CopyLoop // Check CPSR, if CPSR != 0, jump back to _CopyLoop.
54+
ret // Return when finish.
55+
56+
_Dead:
57+
b _Dead // We should never get here.
58+
59+
.text
60+
.align 4
61+
62+
_ShellCodeEnd:
63+
/* Do not remove the last line */

0 commit comments

Comments
 (0)