├── .gitattributes ├── README.md ├── SystemExtractor ├── bin │ ├── Imgextractor.exe │ ├── msvcr100.dll │ └── sdat2img.exe └── img解包.cmd ├── brotli ├── brotli.exe └── br解包.cmd └── sdat2img ├── cygwin1.dll ├── cygz.dll ├── dat解包.bat └── sdat2img.py /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Android10-system.img-unpack 2 | EMUI10 MIUI12 Flyme8 firmware unpack. Android system.img unpack repack on Windows10. 3 | Android 8以上 ROM解包工具 4 | 5 | # 文件说明： 6 | 1.brotli：解压工具，用于将「system.new.dat.br」文件解压为「system.new.dat」 7 | 2.sdat2img：格式转换工具，用于将「system.new.dat」文件转换为ext4格式的「system.new.img」 8 | 3.SystemExtractor：解包工具，用于将「system.new.img」解包 9 | 10 | # 引用说明： 11 | 本工具为一套组合使用工具，实测可在Win10系统上解包Android 8、Android 9、Android 10的ROM固件（包含EMUI10、MIUI12、Flyme8等主流固件），其中引用如下： 12 | 1.brotli：来自[google / brotli](https://github.com/google/brotli) 13 | 2.sdat2img：来自[xpirt / sdat2img](https://github.com/xpirt/sdat2img) 14 | 3.SystemExtractor：来自XDA论坛; 15 | 16 | # 使用说明： 17 | **解包流程**：brotli解压「system.new.dat.br」得到「system.new.dat」 → sdat2img转换「system.new.dat」得到「system.img」 → 最后SystemExtractor实现「system.img」解包（骤步进行） 18 | 19 | **详细说明**： 20 | 21 | 1. 以小米10 Pro [MIUI 12](https://www.miui.com/download-365.html)固件解包为例，首先从固件中提取「system.new.dat.br」和「system.transfer.list」 两个文件，放进brotli文件夹； 22 | 23 | 2. 双击br解包.cmd执行命令，等待解包完成得到「system.new.dat」文件，然后将「system.new.dat」和「system.transfer.list」 剪切到sdat2img文件夹； 24 | 25 | 3. 双击dat解包.bat执行命令，等待解包完成得到「system.new.img」文件，然后将「system.new.img」剪切到SystemExtractor里的extract_file_here文件夹； 26 | 27 | 4. 双击img解包.cmd执行命令,输入数字1按回车开始解包，等待解包完成会生成「system.new_」文件夹，你需要的包内容就在里面；保存路径是在extract_file_here文件夹里； 28 | 29 | 5. 每个解包步骤需要等待5~6分钟，请耐心等待（具体要看包大小以及电脑配置） 30 | 31 | 32 | **下载地址**： 33 | GitHub：https://github.com/upleung/Android10-system.img-unpack/releases/tag/system.img-unpack 34 | 蓝奏云：https://zelink.lanzous.com/iQbtKgd7ulc 35 | 36 | # 写在最后： 37 | 1. EMUI10需要先用[Huawei Update Extractor](https://club.huawei.com/thread-15265009-1-1.html) 将UPDATA.APP中的img文件提取出来才能进行解包操作； 38 | 39 | 2. 在Windowns平台解一个ROM包需要较长时间（10~15分钟不等），为了更直观、更安全与稳定，所以在这里我采用了分步执行解包。当然也有一步执行到底的工具，例如XDA上一名意大利开发者整合到一起的CRB固件管理工具。解包录屏在剪辑中，完成后会上传到B站； 40 | -------------------------------------------------------------------------------- /SystemExtractor/bin/Imgextractor.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/SystemExtractor/bin/Imgextractor.exe -------------------------------------------------------------------------------- /SystemExtractor/bin/msvcr100.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/SystemExtractor/bin/msvcr100.dll -------------------------------------------------------------------------------- /SystemExtractor/bin/sdat2img.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/SystemExtractor/bin/sdat2img.exe -------------------------------------------------------------------------------- /SystemExtractor/img解包.cmd: -------------------------------------------------------------------------------- 1 | @echo off 2 | title SYSTEM.NEW.DAT Extractor v1.2 - 4pda.ru + forum.xda-developers.com 3 | cd /d "%~dp0" 4 | 5 | :home 6 | cls 7 | echo. 8 | echo ############################################################################ 9 | echo # Special thanks: # 10 | echo # "Alexey71" - http://forum.xda-developers.com/member.php?u=4896512 # 11 | echo # "BrateloSlava" - http://forum.xda-developers.com/member.php?u=4842205 # 12 | echo # "xpirt" - http://forum.xda-developers.com/member.php?u=5132229 # 13 | echo ############################################################################ 14 | echo. 15 | echo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 16 | echo + Before working, copy "system.transfer.list" and "system.new.dat" + 17 | echo + a folder place_for_system.new.dat_system.transfer.list_here + 18 | echo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 19 | echo. 20 | echo Select a task: 21 | echo ============== 22 | echo. 23 | echo 1) Unpacking "system.new.dat". 24 | echo 2) Exit. 25 | echo. 26 | set /p web=Type option: 27 | if "%web%"=="1" goto _imgextractor 28 | if "%web%"=="2" goto bye 29 | goto home 30 | 31 | :_imgextractor 32 | echo. 33 | echo Please wait, start conversion in "system.new.img"... 34 | echo. 35 | bin\sdat2img place_for_system.new.dat_system.transfer.list_here\system.transfer.list place_for_system.new.dat_system.transfer.list_here\system.new.dat extract_file_here\system.new.img 36 | echo. 37 | echo Please wait, unpacks "system.new.img"... 38 | bin\Imgextractor.exe extract_file_here\system.new.img -i 39 | del extract_file_here\system.new.img 40 | echo Done. Go to the folder "extract_file_here" 41 | pause 42 | goto home 43 | 44 | :bye 45 | exit -------------------------------------------------------------------------------- /brotli/brotli.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/brotli/brotli.exe -------------------------------------------------------------------------------- /brotli/br解包.cmd: -------------------------------------------------------------------------------- 1 | brotli.exe -d system.new.dat.br 2 | del system.new.dat.br -------------------------------------------------------------------------------- /sdat2img/cygwin1.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/sdat2img/cygwin1.dll -------------------------------------------------------------------------------- /sdat2img/cygz.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/upleung/Android10-system.img-unpack/6a929aed0c4dcac9f9ba90f5f0d84702fa645f66/sdat2img/cygz.dll -------------------------------------------------------------------------------- /sdat2img/dat解包.bat: -------------------------------------------------------------------------------- 1 | sdat2img.py system.transfer.list system.new.dat system.new.img 2 | del system.new.dat 3 | del system.transfer.list -------------------------------------------------------------------------------- /sdat2img/sdat2img.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #==================================================== 4 | # FILE: sdat2img.py 5 | # AUTHORS: xpirt - luxi78 - howellzhu 6 | # DATE: 2015-10-11 16:33:32 CST 7 | #==================================================== 8 | 9 | import sys, os 10 | 11 | try: 12 | TRANSFER_LIST_FILE = str(sys.argv[1]) 13 | NEW_DATA_FILE = str(sys.argv[2]) 14 | OUTPUT_IMAGE_FILE = str(sys.argv[3]) 15 | except IndexError: 16 | print ("\nsdat2img - usage is: \n\n sdat2img \n\n") 17 | print ("Visit xda thread for more information.\n") 18 | try: 19 | input = raw_input 20 | except NameError: pass 21 | input ("Press ENTER to exit...\n") 22 | sys.exit() 23 | 24 | BLOCK_SIZE = 4096 25 | 26 | def rangeset(src): 27 | src_set = src.split(',') 28 | num_set = [int(item) for item in src_set] 29 | if len(num_set) != num_set[0]+1: 30 | print ('Error on parsing following data to rangeset:\n%s' % src) 31 | sys.exit(1) 32 | 33 | return tuple ([ (num_set[i], num_set[i+1]) for i in range(1, len(num_set), 2) ]) 34 | 35 | def parse_transfer_list_file(path): 36 | trans_list = open(TRANSFER_LIST_FILE, 'r') 37 | version = int(trans_list.readline()) # 1st line = transfer list version 38 | new_blocks = int(trans_list.readline()) # 2nd line = total number of blocks 39 | 40 | # system.transfer.list: 41 | # - version 1: android-5.0.0_r1 42 | # - version 2: android-5.1.0_r1 43 | # - version 3: android-6.0.0_r1 44 | 45 | # skip next 2 lines. we don't need this stuff now 46 | if version >= 2: 47 | trans_list.readline() # 3rd line = stash entries needed simultaneously 48 | trans_list.readline() # 4th line = number of blocks that will be stashed 49 | 50 | commands = [] 51 | for line in trans_list: 52 | line = line.split(' ') # 5th & next lines should be only commands 53 | cmd = line[0] 54 | if cmd in ['erase', 'new', 'zero']: 55 | commands.append([cmd, rangeset(line[1])]) 56 | else: 57 | # skip lines starting with numbers, they're not commands anyway. 58 | if not cmd[0].isdigit(): 59 | print ('No valid command: %s.' % cmd) 60 | trans_list.close() 61 | sys.exit(1) 62 | 63 | trans_list.close() 64 | return version, new_blocks, commands 65 | 66 | def init_output_file_size(output_file_obj, commands): 67 | all_block_sets = [i for command in commands for i in command[1]] 68 | max_block_num = max(pair[1] for pair in all_block_sets) 69 | output_file_obj.seek(max_block_num*BLOCK_SIZE - 1) 70 | output_file_obj.write('\0'.encode('utf-8')) 71 | output_file_obj.flush() 72 | 73 | def main(argv): 74 | version, new_blocks, commands = parse_transfer_list_file(TRANSFER_LIST_FILE) 75 | output_img = open(OUTPUT_IMAGE_FILE, 'wb') 76 | init_output_file_size(output_img, commands) 77 | new_data_file = open(NEW_DATA_FILE, 'rb') 78 | 79 | for command in commands: 80 | if command[0] == 'new': 81 | for block in command[1]: 82 | begin = block[0] 83 | end = block[1] 84 | block_count = end - begin 85 | data = new_data_file.read(block_count*BLOCK_SIZE) 86 | print('Copying {} blocks into position {}...'.format(block_count, begin)) 87 | output_img.seek(begin*BLOCK_SIZE) 88 | output_img.write(data) 89 | else: 90 | print('Skipping command %s' % command[0]) 91 | 92 | output_img.close() 93 | new_data_file.close() 94 | print ('\nDone! Output image: %s' % os.path.realpath(output_img.name)) 95 | 96 | if __name__ == "__main__": 97 | main(sys.argv) 98 | --------------------------------------------------------------------------------