Repack Failed (7TProNR / HD1925) (4.14.190-perf+)

[AwaisKing]

hello, i've tried patching my (already patched) boot.img using APatch Manager, and kptools (both Windows and WSL)

my phone is OnePlus 7T Pro McLaren (HD1925) and kernel is Linux localhost 4.14.190-perf+ #1 SMP PREEMPT Mon May 13 05:22:39 EEST 2024 aarch64 Toybox, and i believe the kernel is in RAW format

this is the log i got from APatch Manager:

APatch Log

Screenshot

**************************** **************************** APatch Boot Image Patcher **************************** - Patching kernel + ./kptools -p -i kernel.ori -k kpimg -o kernel [?] kernel image with UNCOMPRESSED_IMG header [+] kernel image_size: 0x0348e271 [+] kernel uefi header: false [+] kernel load_offset: 0x00080000 [+] kernel kernel_size: 0x03864000 [+] kernel page_shift: 12 [+] patched kernel image ... [+] linux_banner 1: Linux version 4.14.190-perf+ (nobody@android-build) (Android (10087095, +pgo, +bolt, +lto, -mlgo, based on r487747c) clang version 17.0.2 (https://android.googlesource.com/toolchain/llvm-project d9f89f4d16663d5012e5c09495f3b30ece3d2362), LLD 17.0.2) #1 SMP PREEMPT Mon May 13 05:22:39 EEST 2024 [+] linux_banner offset: 0x198000f [+] kernel version major: 4, minor: 14, patch: 190 [+] kallsyms_token_table offset: 0x0223d000 [+] endian: little [+] kallsyms_token_index offset: 0x0223d400 [+] arm64 relocation kernel_va: 0xffffff8008080000 [+] arm64 relocation table range: [0x0287a418, 0x02c3a9e8), count: 0x0002803e [+] apply 0x0002803d relocation entries [+] kallsyms_markers range: [0x0223be00, 0x0223cfe0), count: 0x0000023b [+] approximate kallsyms_offsets range: [0x01fbe8f8, 0x0204d608) count: 0x00023b44 [+] kallsyms_names offset: 0x0204d900 [+] kallsyms_num_syms offset: 0x0204d800, value: 0x00023b42 [+] names table linux_banner index: 0x000118a4 [+] linux_banner index: 0 [+] kallsyms_offsets offset: 0x01fbe900 [+] pid_vnr: type: T, offset: 0x0006c168 [+] pid_vnr verfied sp_el0, insn: 0xd5384108 [+] layout kimg: 0x0,0x3052010, kpimg: 0x3053000,0x2c330, extra: 0x307f330,0x80, end: 0x307f3b0, start: 0x3864000 [+] kpimg version: d01 [+] kpimg compile time: 09:04:16 Apr 19 2026 [+] kpimg config: android, release [+] tcp_init_sock: type: T, offset: 0x015ea974 [+] no first pac instruction found [+] map_start: 0x15ea970, max_size: 0x800 [+] tcp_init_sock: type: T, offset: 0x015ea974 [+] Synced NOP modifications from kallsym_kimg to output file (offset: 0x15ea974, size: 0x1000) [+] kallsyms_lookup_name: type: T, offset: 0x0011791c [+] printk: type: T, offset: 0x000cee5c [+] memblock_reserve: type: T, offset: 0x001fffec [+] memblock_free: type: T, offset: 0x001fff58 [+] memblock_mark_nomap: type: T, offset: 0x002002b8 [?] no symbol: memblock_phys_alloc_try_nid [+] memblock_virt_alloc_try_nid: type: T, offset: 0x027a4b08 [+] memblock_alloc_try_nid: type: T, offset: 0x027a4430 [+] panic: type: T, offset: 0x0003fb8c [+] rest_init: type: t, offset: 0x017fad48 [+] kernel_init: type: t, offset: 0x017fae24 [?] no symbol: report_cfi_failure [?] no symbol: __cfi_slowpath_diag [?] no symbol: __cfi_slowpath [+] copy_process: type: t, offset: 0x0003c5c8 [+] avc_denied: type: t, offset: 0x0042aa10 [+] slow_avc_audit: type: T, offset: 0x00429b14 [+] input_handle_event: type: t, offset: 0x00ae5154 [+] root_key mode with empty superkey: root_superkey zeroed [+] paging_init: type: T, offset: 0x02788af0 [+] patch done: kernel + patch_rc=0 + set +x - Repacking boot image Segmentation fault - Successfully Patched! Write patched boot.img failed ****************************

---

and this is what i get on my PC (both native and WSL):

awais@AWAiS:<somePath>/apatch$ ./kptools-linux unpack boot.img
[+] Kernel size: 55108229,Header Version: 2, Offset: 4096
[+] Auto-detect compression method: 0
[+] Treating as Raw Kernel (or unknown format).
[+]  Saved raw kernel to kernel
awais@AWAiS:<somePath>/apatch$ mv kernel kernel-b
awais@AWAiS:<somePath>/apatch$ ./kptools-linux -p --image kernel-b --skey "<NUH-UH>"  --kpimg kpimg-android --out kernel
[?] kernel image with UNCOMPRESSED_IMG header
[+] kernel image_size: 0x0348e271
[+] kernel uefi header: false
[+] kernel load_offset: 0x00080000
[+] kernel kernel_size: 0x03864000
[+] kernel page_shift: 12
[+] patched kernel image ...
[+] linux_banner 1: Linux version 4.14.190-perf+ (nobody@android-build) (Android (10087095, +pgo, +bolt, +lto, -mlgo, based on r487747c) clang version 17.0.2 (https://android.googlesource.com/toolchain/llvm-project d9f89f4d16663d5012e5c09495f3b30ece3d2362), LLD 17.0.2) #1 SMP PREEMPT Mon May 13 05:22:39 EEST 2024
[+] linux_banner offset: 0x198000f
[+] kernel version major: 4, minor: 14, patch: 190
[+] kallsyms_token_table offset: 0x0223d000
[+] endian: little
[+] kallsyms_token_index offset: 0x0223d400
[+] arm64 relocation kernel_va: 0xffffff8008080000
[+] arm64 relocation table range: [0x0287a418, 0x02c3a9e8), count: 0x0002803e
[+] apply 0x0002803d relocation entries
[+] kallsyms_markers range: [0x0223be00, 0x0223cfe0), count: 0x0000023b
[+] approximate kallsyms_offsets range: [0x01fbe8f8, 0x0204d608) count: 0x00023b44
[+] kallsyms_names offset: 0x0204d900
[+] kallsyms_num_syms offset: 0x0204d800, value: 0x00023b42
[+] names table linux_banner index: 0x000118a4
[+] linux_banner index: 0
[+] kallsyms_offsets offset: 0x01fbe900
[+] pid_vnr: type: T, offset: 0x0006c168
[+] pid_vnr verfied sp_el0, insn: 0xd5384108
[+] layout kimg: 0x0,0x3052010, kpimg: 0x3053000,0x2c330, extra: 0x307f330,0x80, end: 0x307f3b0, start: 0x3864000
[+] kpimg version: d01
[+] kpimg compile time: 09:04:16 Apr 19 2026
[+] kpimg config: android, release
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] no first pac instruction found
[+] map_start: 0x15ea970, max_size: 0x800
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] Synced NOP modifications from kallsym_kimg to output file (offset: 0x15ea974, size: 0x1000)
[+] kallsyms_lookup_name: type: T, offset: 0x0011791c
[+] printk: type: T, offset: 0x000cee5c
[+] memblock_reserve: type: T, offset: 0x001fffec
[+] memblock_free: type: T, offset: 0x001fff58
[+] memblock_mark_nomap: type: T, offset: 0x002002b8
[?] no symbol: memblock_phys_alloc_try_nid
[+] memblock_virt_alloc_try_nid: type: T, offset: 0x027a4b08
[+] memblock_alloc_try_nid: type: T, offset: 0x027a4430
[+] panic: type: T, offset: 0x0003fb8c
[+] rest_init: type: t, offset: 0x017fad48
[+] kernel_init: type: t, offset: 0x017fae24
[?] no symbol: report_cfi_failure
[?] no symbol: __cfi_slowpath_diag
[?] no symbol: __cfi_slowpath
[+] copy_process: type: t, offset: 0x0003c5c8
[+] avc_denied: type: t, offset: 0x0042aa10
[+] slow_avc_audit: type: T, offset: 0x00429b14
[+] input_handle_event: type: t, offset: 0x00ae5154
[+] superkey: <NUH-UH>
[+] paging_init: type: T, offset: 0x02788af0
[+] patch done: kernel
awais@AWAiS:<somePath>/apatch$ ls
boot.img  kernel  kernel-b  kpimg-android  kptools-linux
awais@AWAiS:<somePath>/apatch$ rm bo^C
awais@AWAiS:<somePath>/apatch$ ./kptools-linux repack boot.img
[+]  Starting automatic repack...
[+] Header Version: 2, Page Size: 4096, fmt_size: 1712111
[+] Detected DTB appended to kernel. Size: 4255633
[+] Final kernel size after compression (if applied): 50852804 bytes
[+] Rest data size: 45547520 bytes, Actual used size: 5968552 bytes

[AwaisKing]

i tried reading my boot.img in a hex editor, here are some variables i found

header{
id[8] = 44 D6 B1 A2 37 C4 3B AA EB 7B CA B1 99 C4 C6 CA 1A A3 71 BC 00 00 00 00 00 00 00 00 00 00 00 00
unused[2] = 02 00 00 00 81 01 00 1C
}

and looking at the code bootimg.c#L893 and bootimg.c#L934, i figured it's probably crashing somewhere between sha1_init(&ctx); and tools_logi("second_size=%d,offset=%d\n",hdr.second_size, checksum_aligned+rest_data_offset);

because
uint32_t use_sha256 = is_sha256(hdr.id); → uint32_t use_sha256 = 0;
int len = use_sha256 ? SHA256_BLOCK_SIZE : SHA1_BLOCK_SIZE; → int len = SHA1_BLOCK_SIZE; → int len = 64;
if (use_sha256 != 1 || header_ver <= 3) {...} → if (0 != 1 || 2 <= 3) {...} → if (true || true) {...}

[AwaisKing]

some debugging info from gdb:

(gdb) run repack boot.img
Starting program: C:\Users\AWAiS\Desktop\release\release\apatch\kptools.exe repack boot.img
[New Thread 9248.0x380c]
[New Thread 9248.0x4024]
[New Thread 9248.0x1cd4]
[+]  Starting automatic repack...
[+] Header Version: 2, Page Size: 4096, fmt_size: 2626695
[+] Detected DTB appended to kernel. Size: 4255633
[+] Final kernel size after compression (if applied): 50852804 bytes
[+] Rest data size: 45547520 bytes, Actual used size: 6886056 bytes
[+]    [AWAiS_DEBUG] use_sha256: 0 -- len: 64
[+]    [AWAiS_DEBUG] sha1_init
[+]    [AWAiS_DEBUG] SHA1_CTX 1 -- final_k_buf: 85 -- hdr.kernel_size: 55108437
[+]       [AWAiS_DEBUG] start i =           64 -- len :     55108437
[+]       [AWAiS_DEBUG] next i =     50855616 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855680 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855744 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855808 -- data[i]:     55108437

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
65                              if (i >= 50855600) tools_logi("      [AWAiS_DEBUG] next i = %12d -- data[i]: %12d\n", i, len, data[i]);
(gdb) bt
#0  0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
#1  0x00007ff65fe40d30 in repack_bootimg (orig_boot_path=0xb03e00 "boot.img", new_kernel_path=0x7ff65fed8417 <__func__.2+2135> "kernel",
    out_boot_path=0x7ff65fed840a <__func__.2+2122> "new-boot.img") at bootimg.c:946
#2  0x00007ff65fe3547e in main (argc=3, argv=0xb03d40) at kptools.c:88
(gdb) bt
#0  0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
#1  0x00007ff65fe40d30 in repack_bootimg (orig_boot_path=0xb03e00 "boot.img", new_kernel_path=0x7ff65fed8417 <__func__.2+2135> "kernel",
    out_boot_path=0x7ff65fed840a <__func__.2+2122> "new-boot.img") at bootimg.c:946
#2  0x00007ff65fe3547e in main (argc=3, argv=0xb03d40) at kptools.c:88