How to patch AMLogic TV Boxes boot partition to enable Magisk to function properly.

Last Updated: 2021-08-17
Written by: effgee

These instructions are how to patch a boot image for Amlogic based boxes, specifically of the X96 type to enable Magisk to function properly. The instructions are generalized and may work for any Amlogic boxes.

I have done this procedure for:

  • X96 Max Plus q2, X96Max_Plus_Q2_20201209-1446.img firmware
  • X96 Air Extreme, CONCEPTUM rebrand 4/32 stock firmware (when mentioning "my edits" it is indicative for this particular firmware)

Both of these were accomplished using Magisk v.23

Pre-requisites

Before starting, you need:

  • The original boot.img from your firmware, or TWRP backup of the boot (not bootloader) partition.
  • Install Magisk Manager on the device.
  • Open Magisk manager. Click install. (Root not needed, you will have Magisk root after.)
  • You should have an option to use "Recovery Mode", select it.
  • Choose "Select and Patch a file". Feed it your original boot.img.
  • Magisk will put a "Magisk Patched" boot.img in your downloads.
  • The next hex editing steps are performed on the "Magisk Patched" boot.img

Hexeditor Settings
16 bytes per row (The usual for most editors)
That is 16 columns of XX.


Video 0:00 to 2:00

  • Open the Magisk modified boot.img in your hex editor.
  • Go to offset 00000B50
  • Get the values of the first 3 columns.
    • 0C 81 97 for this particular file.
  • Reverse their order,
    • 97 81 0C
  • Open up windows calculator and put it into programmer / hex mode.
  • With the calculator, add the reversed value,
    • 97 81 0C + 840 = 97 89 4C
  • In the hex editor. Go to the calculated position in the file (from beginning of the file) and step back 1 byte/column and get the address:
    • 97894B This is the END position.
  • Search in the file for 1F8B08, found at: 77BC & 9D1800
  • We want the first occurrence from the beginning of file
    • 77BC is our START position.

This information comes in handy later.


Video 2:02

Extract the kernel from the image

  • Open the boot.img in 7zip and extract it.
    • You will get an error about extra data beyond the payload you can safely ignore it as long as it extracts the file.
    • If 7zip refuses to extract the file, extract it using the Uniextract utility.
    • Uniextract will create a bunch of files, one of them named 'kernel.
    • Then use 7zip to extract it that 'kernel' file. You will probably get an error about payload data which can be safely ignored.
  • Name the extracted kernel file "k"
    • This is important as we are stripping the file name from the gzipped file during the following edit and the filename affects the lenghts of the bytes!
  • Load the "k" file into the hex editor.

Replacing skip_initramfs with want_initramfs in the kernel

  • Search for 736B69705F696E697472616D6673 and replace with 77616E745F696E697472616D6673 in the "k" file in hex.
    • This searches for skip_initramfs and replaces it with want_initramfs.

Recompress the kernel

  • Using cygwin or Linux for Windows subsystem or a linux box, recompress the kernel
    • gzip -9 k this should create a k.gz file. (Yes, the -9 is important.)

Zeroing out the filename from the compressed kernel

  • Load the newly created file k.gz into the hexeditor.
  • The very top row has some data that identifies the filename in the gz file. We must remove this information, and if you named the kernel anything but exactly 'k' before you gzipped it, these bytes will be different. Go back and do it again.
  • On the first row fill with zeros, positions 03 through 07 on first row.
  • On the same first row, select 0A and 0B & delete those bytes.
  • This finishes removing filename headers from the gzipped kernel. k.gz
  • Save the k.gz file.

Get length of k.gz (Compressed, modified kernel image)

  • Select all and copy the length. k.gz LENGTH 971182
  • Note down the length of the file we will use it a bit later.

Video 3:45


Video 3:46

Creation of the zim file (zImage)

This is where the video becomes a bit unclear and it appears there are extra unnecessary steps. I have tried to simplify it.

  • Go back to the boot.img loaded in the hex editor.
  • From the first segment, get your end position, 97894B
  • Go to that offset position and right below it there should be a couple rows of data, then a few (1 or 2) to many (10-20!) rows of only zeros.
  • What you want to do is select blocks from 840 to the last full row of all zeros.
    • In my file it is positions 840 TO 978FFF.
    • In the demo video it is 840 to 91D7FF.
    • Each boot.img will be different.
  • Copy those blocks and create a new file zim and paste them there.

Video 4:41


Video 4:42

Editing the zim file.

  • In the zim file you pasted the previously copied blocks into...
  • Search for 1F8B08
    • In my file and the demo video, it is FOUND at: 6F7C = KERN_START_POSITION
  • From the previously found length of the k.gz data: 971182
  • Using the KERN_START_POSITION (6F7C) as offset go to k.gz LENGTH (971182) amount of blocks forward.
    • This offset can be named POINTER_ONE, take note of it.
    • In the demo video the jumped to position is: 91CEDD = POINTER_ONE
    • In my file the jumped to position is: 9780FE = POINTER_ONE
  • From POINTER_ONE offset, zero it and any remaining bytes in that row.
  • From POINTER_ONE offset, go back one byte.
  • This will be the final position when we paste k.gz data into this file. Note it down
    • Demo file: Back one byte position = 91CDDC
    • My file: Back one byte position = 9780FD

Video 5:25

Updating POINTER_ONE record.
  • From POINTER_ONE row, go down 2 rows and look at the first 3 bytes.
  • Insert the reversed POINTER_ONE offset into those first three bytes.
    • EX: POINTER_ONE offset 91CEDD, reverse it to DDCD91
    • On my edit, it already matched so nothing to do here.

Video 5:39

Getting the second pointer
  • The second pointer is 4 steps back from POINTER_ONE offset.
    • Call this the POINTER_TWO offset. Write it down.
    • ex: POINTER_ONE offset =91CEDD, Go back 4 bytes & POINTER_TWO offset = 91CED9
    • Note down POINTER_TWO offset as well as reverse it
      • POINTER_TWO offset = 91CED9 then REVERSED = D9 CE 91

Video 5:49

Updating POINTER_TWO record.
  • Go to offset 300.
  • Edit offsets 30C, 30D, 30F to match REVERSED POINTER_TWO offset. ex. D9 CE 91
    • On my edit, it already matched so nothing to do here.

Video 6:17

Inserting k.gz into zim file
  • In zim file.
  • Select blocks from KERN_START_POSITION (6F7C) to POINTER_ONE offset, back 1 byte ex; 91CDDC
  • Delete the selection.
  • Go to k.gz file, ctrl+a and copy.
  • Back to zim file and paste the copied data from the position that you deleted ex. 6F7C.
  • Ensure that it inserts (not overwrites) and the row containing the POINTER_ONE record points to the exact end of the pasted data.
  • Save zim file if everything is ok.

Video 7:05

Inserting zim into boot.img file
  • In the zim file, select all and copy.
  • Go to boot.img file.
  • If the instructions were followed exactly, you will still have a selection of data used to copy and paste the inital zim file.
    • ex. Offsets 840 to 91D7FF
  • Paste the copied zim data into this selection, using OVERWRITE not insert.
    • The idea is the file from the edited zim data must fit exactly into the boot.img selection.
  • Save the boot.img somewhere, suggest to use a new file.

And that's it, its done.

  • Flash this file via TWRP to the boot partition.
  • If it doesn't work, watch the video again and read carefully the "Editing the zim file." and down instructions.

-effgee

Big thanks to Chela_vek (and anyone else involved) who figured out what was need to get Magisk running on these Amlogic boxes.

Edit

Pub: 17 Aug 2021 12:32 UTC

Views: 578