AndroidBootImage.bt

// int types

#define uint8_t unsigned char
#define uint32_t unsigned int
#define uint16_t unsigned short
#define uint64_t unsigned int64


// --------------------- avb ---------------------

//https://android.googlesource.com/platform/external/avb/+/master/libavb/avb_vbmeta_image.h
/* Size of the vbmeta image header. */
#define AVB_VBMETA_IMAGE_HEADER_SIZE 256
/* Magic for the vbmeta image header. */
#define AVB_MAGIC "AVB0"
#define AVB_MAGIC_LEN 4
/* Maximum size of the release string including the terminating NUL byte. */
#define AVB_RELEASE_STRING_SIZE 48
/* Flags for the vbmeta image.
 *
 * AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED: If this flag is set,
 * hashtree image verification will be disabled.
 *
 * AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED: If this flag is set,
 * verification will be disabled and descriptors will not be parsed.
 */
typedef enum {
  AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED = (1 << 0),
  AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED = (1 << 1)
} AvbVBMetaImageFlags;

/* Binary format for header of the vbmeta image.
 *
 * The vbmeta image consists of three blocks:
 *
 *  +-----------------------------------------+
 *  | Header data - fixed size                |
 *  +-----------------------------------------+
 *  | Authentication data - variable size     |
 *  +-----------------------------------------+
 *  | Auxiliary data - variable size          |
 *  +-----------------------------------------+
 *
 * The "Header data" block is described by this struct and is always
 * |AVB_VBMETA_IMAGE_HEADER_SIZE| bytes long.
 *
 * The "Authentication data" block is |authentication_data_block_size|
 * bytes long and contains the hash and signature used to authenticate
 * the vbmeta image. The type of the hash and signature is defined by
 * the |algorithm_type| field.
 *
 * The "Auxiliary data" is |auxiliary_data_block_size| bytes long and
 * contains the auxiliary data including the public key used to make
 * the signature and descriptors.
 *
 * The public key is at offset |public_key_offset| with size
 * |public_key_size| in this block. The size of the public key data is
 * defined by the |algorithm_type| field. The format of the public key
 * data is described in the |AvbRSAPublicKeyHeader| struct.
 *
 * The descriptors starts at |descriptors_offset| from the beginning
 * of the "Auxiliary Data" block and take up |descriptors_size|
 * bytes. Each descriptor is stored as a |AvbDescriptor| with tag and
 * number of bytes following. The number of descriptors can be
 * determined by walking this data until |descriptors_size| is
 * exhausted.
 *
 * The size of each of the "Authentication data" and "Auxiliary data"
 * blocks must be divisible by 64. This is to ensure proper alignment.
 *
 * Descriptors are free-form blocks stored in a part of the vbmeta
 * image subject to the same integrity checks as the rest of the
 * image. See the documentation for |AvbDescriptor| for well-known
 * descriptors. See avb_descriptor_foreach() for a convenience
 * function to iterate over descriptors.
 *
 * This struct is versioned, see the |required_libavb_version_major|
 * and |required_libavb_version_minor| fields. This represents the
 * minimum version of libavb required to verify the header and depends
 * on the features (e.g. algorithms, descriptors) used. Note that this
 * may be 1.0 even if generated by an avbtool from 1.4 but where no
 * features introduced after 1.0 has been used. See the "Versioning
 * and compatibility" section in the README.md file for more details.
 *
 * All fields are stored in network byte order when serialized. To
 * generate a copy with fields swapped to native byte order, use the
 * function avb_vbmeta_image_header_to_host_byte_order().
 *
 * Before reading and/or using any of this data, you MUST verify it
 * using avb_vbmeta_image_verify() and reject it unless it's signed by
 * a known good public key.
 */
struct AvbVBMetaImageHeader {
  BigEndian();
  /*   0: Four bytes equal to "AVB0" (AVB_MAGIC). */
  uint8_t magic[AVB_MAGIC_LEN];
  
  /*   4: The major version of libavb required for this header. */
  uint32_t required_libavb_version_major;
  /*   8: The minor version of libavb required for this header. */
  uint32_t required_libavb_version_minor;
  /*  12: The size of the signature block. */
  uint64_t authentication_data_block_size<format=hex>;
  /*  20: The size of the auxiliary data block. */
  uint64_t auxiliary_data_block_size<format=hex>;
  /*  28: The verification algorithm used, see |AvbAlgorithmType| enum. */
  uint32_t algorithm_type;
  /*  32: Offset into the "Authentication data" block of hash data. */
  uint64_t hash_offset;
  /*  40: Length of the hash data. */
  uint64_t hash_size<format=hex>;
  /*  48: Offset into the "Authentication data" block of signature data. */
  uint64_t signature_offset<format=hex>;
  /*  56: Length of the signature data. */
  uint64_t signature_size<format=hex>;
  /*  64: Offset into the "Auxiliary data" block of public key data. */
  uint64_t public_key_offset<format=hex>;
  /*  72: Length of the public key data. */
  uint64_t public_key_size<format=hex>;
  /*  80: Offset into the "Auxiliary data" block of public key metadata. */
  uint64_t public_key_metadata_offset<format=hex>;
  /*  88: Length of the public key metadata. Must be set to zero if there
   *  is no public key metadata.
   */
  uint64_t public_key_metadata_size<format=hex>;
  /*  96: Offset into the "Auxiliary data" block of descriptor data. */
  uint64_t descriptors_offset<format=hex>;
  /* 104: Length of descriptor data. */
  uint64_t descriptors_size<format=hex>;
  /* 112: The rollback index which can be used to prevent rollback to
   *  older versions.
   */
  uint64_t rollback_index;
  /* 120: Flags from the AvbVBMetaImageFlags enumeration. This must be
   * set to zero if the vbmeta image is not a top-level image.
   */
  uint32_t flags;
  /* 124: The location of the rollback index defined in this header.
   * Only valid for the main vbmeta. For chained partitions, the rollback
   * index location must be specified in the AvbChainPartitionDescriptor
   * and this value must be set to 0.
   */
  uint32_t rollback_index_location;
  /* 128: The release string from avbtool, e.g. "avbtool 1.0.0" or
   * "avbtool 1.0.0 xyz_board Git-234abde89". Is guaranteed to be NUL
   * terminated. Applications must not make assumptions about how this
   * string is formatted.
   */

  uint8_t release_string[AVB_RELEASE_STRING_SIZE];
  /* 176: Padding to ensure struct is size AVB_VBMETA_IMAGE_HEADER_SIZE
   * bytes. This must be set to zeroes.
   */
  uint8_t reserved[80];
  LittleEndian();
};





// https://android.googlesource.com/platform/external/avb/+/master/libavb/avb_footer.h

/* Magic for the footer. */
#define AVB_FOOTER_MAGIC "AVBf"
#define AVB_FOOTER_MAGIC_LEN 4
/* Size of the footer. */
#define AVB_FOOTER_SIZE 64
/* The current footer version used - keep in sync with avbtool. */
#define AVB_FOOTER_VERSION_MAJOR 1
#define AVB_FOOTER_VERSION_MINOR 0
/* The struct used as a footer used on partitions, used to find the
 * AvbVBMetaImageHeader struct. This struct is always stored at the
 * end of a partition.
 */
struct AvbFooter {
  BigEndian();
  /*   0: Four bytes equal to "AVBf" (AVB_FOOTER_MAGIC). */
  uint8_t magic[AVB_FOOTER_MAGIC_LEN];
  /*   4: The major version of the footer struct. */
  uint32_t version_major;
  /*   8: The minor version of the footer struct. */
  uint32_t version_minor;
  /*  12: The original size of the image on the partition. */
  uint64_t original_image_size<format=hex>;
  /*  20: The offset of the |AvbVBMetaImageHeader| struct. */
  uint64_t vbmeta_offset<format=hex>;
  /*  28: The size of the vbmeta block (header + auth + aux blocks). */
  uint64_t vbmeta_size<format=hex>;
  /*  36: Padding to ensure struct is size AVB_FOOTER_SIZE bytes. This
   * must be set to zeroes.
   */
  uint8_t reserved[28];
  LittleEndian();
};


/********************************************************************************************/

// bootimg macros

#define BOOT_MAGIC "ANDROID!"
#define BOOT_MAGIC_SIZE 8
#define BOOT_NAME_SIZE 16
#define BOOT_ARGS_SIZE 512
#define BOOT_EXTRA_ARGS_SIZE 1024

#define VENDOR_BOOT_MAGIC "VNDRBOOT"
#define VENDOR_BOOT_MAGIC_SIZE 8
#define VENDOR_BOOT_ARGS_SIZE 2048
#define VENDOR_BOOT_NAME_SIZE 16

#define VENDOR_RAMDISK_TYPE_NONE 0
#define VENDOR_RAMDISK_TYPE_PLATFORM 1
#define VENDOR_RAMDISK_TYPE_RECOVERY 2
#define VENDOR_RAMDISK_TYPE_DLKM 3
#define VENDOR_RAMDISK_NAME_SIZE 32
#define VENDOR_RAMDISK_TABLE_ENTRY_BOARD_ID_SIZE 16

/********************************************************************************************/

/* When a boot header is of version 0, the structure of boot image is as
 * follows:
 *
 * +-----------------+
 * | boot header     | 1 page
 * +-----------------+
 * | kernel          | n pages
 * +-----------------+
 * | ramdisk         | m pages
 * +-----------------+
 * | second stage    | o pages
 * +-----------------+
 *
 * n = (kernel_size + page_size - 1) / page_size
 * m = (ramdisk_size + page_size - 1) / page_size
 * o = (second_size + page_size - 1) / page_size
 *
 * 0. all entities are page_size aligned in flash
 * 1. kernel and ramdisk are required (size != 0)
 * 2. second is optional (second_size == 0 -> no second)
 * 3. load each element (kernel, ramdisk, second) at
 *    the specified physical address (kernel_addr, etc)
 * 4. prepare tags at tag_addr.  kernel_args[] is
 *    appended to the kernel commandline in the tags.
 * 5. r0 = 0, r1 = MACHINE_TYPE, r2 = tags_addr
 * 6. if second_size != 0: jump to second_addr
 *    else: jump to kernel_addr
 */

struct boot_img_hdr_v0 {
    // Must be BOOT_MAGIC.
    uint8_t magic[BOOT_MAGIC_SIZE]<bgcolor=cWhite>;

    uint32_t kernel_size<format=hex,bgcolor=cRed>; /* size in bytes */
    uint32_t kernel_addr<format=hex,bgcolor=cRed>; /* physical load addr */

    uint32_t ramdisk_size<format=hex,bgcolor=cGreen>; /* size in bytes */
    uint32_t ramdisk_addr<format=hex,bgcolor=cGreen>; /* physical load addr */

    uint32_t second_size<format=hex,bgcolor=cBlue>; /* size in bytes */
    uint32_t second_addr<format=hex,bgcolor=cBlue>; /* physical load addr */

    uint32_t tags_addr<format=hex,bgcolor=cAqua>; /* physical addr for kernel tags (if required) */
    uint32_t page_size<format=hex,bgcolor=cPurple>; /* flash page size we assume */

    // Version of the boot image header.
    uint32_t header_version<format=hex,bgcolor=cYellow>;

    // Operating system version and security patch level.
    // For version "A.B.C" and patch level "Y-M-D":
    //   (7 bits for each of A, B, C; 7 bits for (Y-2000), 4 bits for M)
    //   os_version = A[31:25] B[24:18] C[17:11] (Y-2000)[10:4] M[3:0]
    uint32_t os_version<bgcolor=cSilver>;

/*
#if __cplusplus
    void SetOsVersion(unsigned major, unsigned minor, unsigned patch) {
        os_version &= ((1 << 11) - 1);
        os_version |= (((major & 0x7f) << 25) | ((minor & 0x7f) << 18) | ((patch & 0x7f) << 11));
    }

    void SetOsPatchLevel(unsigned year, unsigned month) {
        os_version &= ~((1 << 11) - 1);
        os_version |= (((year - 2000) & 0x7f) << 4) | ((month & 0xf) << 0);
    }
#endif
*/

    uint8_t name[BOOT_NAME_SIZE]; /* asciiz product name */

    uint8_t cmdline[BOOT_ARGS_SIZE]<bgcolor=cLtBlue>; /* asciiz kernel commandline */

    uint32_t id[8]<bgcolor=cDkPurple>; /* timestamp / checksum / sha1 / etc */

    // Supplemental command line data; kept here to maintain
    // binary compatibility with older versions of mkbootimg.
    // Asciiz.
    uint8_t extra_cmdline[BOOT_EXTRA_ARGS_SIZE]<bgcolor=cLtPurple>;
};

struct boot_img_v0{
    boot_img_hdr_v0 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int n = (this.hdr.kernel_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int m = (this.hdr.ramdisk_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int o = (this.hdr.second_size + this.hdr.page_size - 1) / this.hdr.page_size;
    FSeek(this.hdr.page_size);
    uint8_t kernel[n*this.hdr.page_size]<optimize=false,bgcolor=cRed>;
    uint8_t ramdisk[m*this.hdr.page_size]<optimize=false,bgcolor=cGreen>;
    uint8_t second[o*this.hdr.page_size]<optimize=false,bgcolor=cBlue>;
};

/********************************************************************************************/


/* When a boot header is of version 1, the structure of boot image is as
 * follows:
 *
 * +---------------------+
 * | boot header         | 1 page
 * +---------------------+
 * | kernel              | n pages
 * +---------------------+
 * | ramdisk             | m pages
 * +---------------------+
 * | second stage        | o pages
 * +---------------------+
 * | recovery dtbo/acpio | p pages
 * +---------------------+
 *
 * n = (kernel_size + page_size - 1) / page_size
 * m = (ramdisk_size + page_size - 1) / page_size
 * o = (second_size + page_size - 1) / page_size
 * p = (recovery_dtbo_size + page_size - 1) / page_size
 *
 * 0. all entities are page_size aligned in flash
 * 1. kernel and ramdisk are required (size != 0)
 * 2. recovery_dtbo/recovery_acpio is required for recovery.img in non-A/B
 *    devices(recovery_dtbo_size != 0)
 * 3. second is optional (second_size == 0 -> no second)
 * 4. load each element (kernel, ramdisk, second) at
 *    the specified physical address (kernel_addr, etc)
 * 5. If booting to recovery mode in a non-A/B device, extract recovery
 *    dtbo/acpio and apply the correct set of overlays on the base device tree
 *    depending on the hardware/product revision.
 * 6. set up registers for kernel entry as required by your architecture
 * 7. if second_size != 0: jump to second_addr
 *    else: jump to kernel_addr
 */
struct boot_img_hdr_v1 {
    boot_img_hdr_v0 hdr_v0;

    //v1
    uint32_t recovery_dtbo_size<bgcolor=cYellow>;   /* size in bytes for recovery DTBO/ACPIO image */
    uint64_t recovery_dtbo_offset<bgcolor=cYellow>; /* offset to recovery dtbo/acpio in boot image */
    uint32_t header_size;
};

struct boot_img_v1{
    boot_img_hdr_v1 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int n = (this.hdr.hdr_v0.kernel_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int m = (this.hdr.hdr_v0.ramdisk_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int o = (this.hdr.hdr_v0.second_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int p = (this.hdr.recovery_dtbo_size + this.hdr.page_size - 1) / this.hdr.page_size;
    FSeek(this.hdr.page_size);
    uint8_t kernel[n*this.hdr.page_size]<optimize=false,bgcolor=cRed>;
    uint8_t ramdisk[m*this.hdr.page_size]<optimize=false,bgcolor=cGreen>;
    uint8_t second[o*this.hdr.page_size]<optimize=false,bgcolor=cBlue>;
    uint8_t dtbo_or_acpio[p*this.hdr.page_size]<optimize=false,bgcolor=cYellow>;
};

/********************************************************************************************/


/* When the boot image header has a version of 2, the structure of the boot
 * image is as follows:
 *
 * +---------------------+
 * | boot header         | 1 page
 * +---------------------+
 * | kernel              | n pages
 * +---------------------+
 * | ramdisk             | m pages
 * +---------------------+
 * | second stage        | o pages
 * +---------------------+
 * | recovery dtbo/acpio | p pages
 * +---------------------+
 * | dtb                 | q pages
 * +---------------------+

 * n = (kernel_size + page_size - 1) / page_size
 * m = (ramdisk_size + page_size - 1) / page_size
 * o = (second_size + page_size - 1) / page_size
 * p = (recovery_dtbo_size + page_size - 1) / page_size
 * q = (dtb_size + page_size - 1) / page_size
 *
 * 0. all entities are page_size aligned in flash
 * 1. kernel, ramdisk and DTB are required (size != 0)
 * 2. recovery_dtbo/recovery_acpio is required for recovery.img in non-A/B
 *    devices(recovery_dtbo_size != 0)
 * 3. second is optional (second_size == 0 -> no second)
 * 4. load each element (kernel, ramdisk, second, dtb) at
 *    the specified physical address (kernel_addr, etc)
 * 5. If booting to recovery mode in a non-A/B device, extract recovery
 *    dtbo/acpio and apply the correct set of overlays on the base device tree
 *    depending on the hardware/product revision.
 * 6. set up registers for kernel entry as required by your architecture
 * 7. if second_size != 0: jump to second_addr
 *    else: jump to kernel_addr
 */
struct boot_img_hdr_v2 {
    boot_img_hdr_v1 hdr_v1;

    //v2
    uint32_t dtb_size<bgcolor=cRed>; /* size in bytes for DTB image */
    uint64_t dtb_addr<bgcolor=cRed>; /* physical load address for DTB image */
};

struct boot_img_v2{
    boot_img_hdr_v2 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int n = (this.hdr.hdr_v1.hdr_v0.kernel_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int m = (this.hdr.hdr_v1.hdr_v0.ramdisk_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int o = (this.hdr.hdr_v1.hdr_v0.second_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int p = (this.hdr.hdr_v1.recovery_dtbo_size + this.hdr.page_size - 1) / this.hdr.page_size;
    local unsigned int q = (this.hdr.dtb_size + this.hdr.page_size - 1) / this.hdr.page_size;
    FSeek(this.hdr.page_size);
    uint8_t kernel[n*this.hdr.page_size]<optimize=false,bgcolor=cRed>;
    uint8_t ramdisk[m*this.hdr.page_size]<optimize=false,bgcolor=cGreen>;
    uint8_t second[o*this.hdr.page_size]<optimize=false,bgcolor=cBlue>;
    uint8_t dtbo_or_acpio[p*this.hdr.page_size]<optimize=false,bgcolor=cYellow>;
    uint8_t dtb[q*this.hdr.page_size]<optimize=false,bgcolor=cRed>;
};

/********************************************************************************************/


/* When the boot image header has a version of 3, the structure of the boot
 * image is as follows:
 *
 * +---------------------+
 * | boot header         | 4096 bytes
 * +---------------------+
 * | kernel              | m pages
 * +---------------------+
 * | ramdisk             | n pages
 * +---------------------+
 *
 * m = (kernel_size + 4096 - 1) / 4096
 * n = (ramdisk_size + 4096 - 1) / 4096
 *
 * Note that in version 3 of the boot image header, page size is fixed at 4096 bytes.
 *
 * The structure of the vendor boot image (introduced with version 3 and
 * required to be present when a v3 boot image is used) is as follows:
 *
 * +---------------------+
 * | vendor boot header  | o pages
 * +---------------------+
 * | vendor ramdisk      | p pages
 * +---------------------+
 * | dtb                 | q pages
 * +---------------------+

 * o = (2112 + page_size - 1) / page_size
 * p = (vendor_ramdisk_size + page_size - 1) / page_size
 * q = (dtb_size + page_size - 1) / page_size
 *
 * 0. all entities in the boot image are 4096-byte aligned in flash, all
 *    entities in the vendor boot image are page_size (determined by the vendor
 *    and specified in the vendor boot image header) aligned in flash
 * 1. kernel, ramdisk, vendor ramdisk, and DTB are required (size != 0)
 * 2. load the kernel and DTB at the specified physical address (kernel_addr,
 *    dtb_addr)
 * 3. load the vendor ramdisk at ramdisk_addr
 * 4. load the generic ramdisk immediately following the vendor ramdisk in
 *    memory
 * 5. set up registers for kernel entry as required by your architecture
 * 6. if the platform has a second stage bootloader jump to it (must be
 *    contained outside boot and vendor boot partitions), otherwise
 *    jump to kernel_addr
 */
struct boot_img_hdr_v3 {
    uint8_t magic[BOOT_MAGIC_SIZE]<bgcolor=cWhite>;

    uint32_t kernel_size<format=hex,bgcolor=cRed>; /* size in bytes */
    uint32_t ramdisk_size<format=hex,bgcolor=cGreen>; /* size in bytes */

    // Operating system version and security patch level.
    // For version "A.B.C" and patch level "Y-M-D":
    //   (7 bits for each of A, B, C; 7 bits for (Y-2000), 4 bits for M)
    //   os_version = A[31:25] B[24:18] C[17:11] (Y-2000)[10:4] M[3:0]
    uint32_t os_version<bgcolor=cSilver>;

    uint32_t header_size;

    uint32_t reserved[4]<bgcolor=cDkPurple>;

    // Version of the boot image header.
    uint32_t header_version<bgcolor=cLtBlue>;

    // Asciiz kernel commandline.
    uint8_t cmdline[BOOT_ARGS_SIZE + BOOT_EXTRA_ARGS_SIZE]<bgcolor=cLtPurple>;
};

struct boot_img_v3{
    boot_img_hdr_v3 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int m = (this.hdr.kernel_size + 4096 - 1) / 4096;
    local unsigned int n = (this.hdr.ramdisk_size + 4096 - 1) / 4096;
    FSeek(0x1000);
    uint8_t kernel[m*4096]<optimize=false,bgcolor=cRed>;
    uint8_t ramdisk[n*4096]<optimize=false,bgcolor=cGreen>;
};


struct vendor_boot_img_hdr_v3 {
    // Must be VENDOR_BOOT_MAGIC.
    uint8_t magic[VENDOR_BOOT_MAGIC_SIZE]<bgcolor=cWhite>;

    // Version of the vendor boot image header.
    uint32_t header_version<bgcolor=cRed>;

    uint32_t page_size; /* flash page size we assume */

    uint32_t kernel_addr<format=hex,bgcolor=cGreen>; /* physical load addr */
    uint32_t ramdisk_addr<format=hex,bgcolor=cRed>; /* physical load addr */

    uint32_t vendor_ramdisk_size; /* size in bytes */

    uint8_t cmdline[VENDOR_BOOT_ARGS_SIZE]<bgcolor=cLtPurple>; /* asciiz kernel commandline */

    uint32_t tags_addr<format=hex,bgcolor=cRed>; /* physical addr for kernel tags (if required) */
    uint8_t name[VENDOR_BOOT_NAME_SIZE]<bgcolor=cWhite>; /* asciiz product name */

    uint32_t header_size;

    uint32_t dtb_size; /* size in bytes for DTB image */
    uint64_t dtb_addr<format=hex,bgcolor=cGreen>; /* physical load address for DTB image */
};

struct vendor_boot_img_v3{
    vendor_boot_img_hdr_v3 hdr<optimize=false,bgcolor=cLtPurple>;
    local unsigned int o = (2112 + 4096 - 1) / 4096;
    local unsigned int p = (this.hdr.vendor_ramdisk_size + 4096 - 1) / 4096;
    local unsigned int q = (this.hdr.dtb_size + 4096 - 1) / 4096;
    FSeek(o*4096);
    uint8_t vendor_ramdisk[p*4096]<optimize=false,bgcolor=cRed>;
    uint8_t dtb[q*4096]<optimize=false,bgcolor=cGreen>;
};


/********************************************************************************************/


/* When the boot image header has a version of 4, the structure of the boot
 * image is as follows:
 *
 * +---------------------+
 * | boot header         | 4096 bytes
 * +---------------------+
 * | kernel              | m pages
 * +---------------------+
 * | ramdisk             | n pages
 * +---------------------+
 * | boot signature      | g pages
 * +---------------------+
 *
 * m = (kernel_size + 4096 - 1) / 4096
 * n = (ramdisk_size + 4096 - 1) / 4096
 * g = (signature_size + 4096 - 1) / 4096
 *
 * Note that in version 4 of the boot image header, page size is fixed at 4096
 * bytes.
 *
 * The structure of the vendor boot image version 4, which is required to be
 * present when a version 4 boot image is used, is as follows:
 *
 * +------------------------+
 * | vendor boot header     | o pages
 * +------------------------+
 * | vendor ramdisk section | p pages
 * +------------------------+
 * | dtb                    | q pages
 * +------------------------+
 * | vendor ramdisk table   | r pages
 * +------------------------+
 * | bootconfig             | s pages
 * +------------------------+
 *
 * o = (2128 + page_size - 1) / page_size
 * p = (vendor_ramdisk_size + page_size - 1) / page_size
 * q = (dtb_size + page_size - 1) / page_size
 * r = (vendor_ramdisk_table_size + page_size - 1) / page_size
 * s = (vendor_bootconfig_size + page_size - 1) / page_size
 *
 * Note that in version 4 of the vendor boot image, multiple vendor ramdisks can
 * be included in the vendor boot image. The bootloader can select a subset of
 * ramdisks to load at runtime. To help the bootloader select the ramdisks, each
 * ramdisk is tagged with a type tag and a set of hardware identifiers
 * describing the board, soc or platform that this ramdisk is intended for.
 *
 * The vendor ramdisk section is consist of multiple ramdisk images concatenated
 * one after another, and vendor_ramdisk_size is the size of the section, which
 * is the total size of all the ramdisks included in the vendor boot image.
 *
 * The vendor ramdisk table holds the size, offset, type, name and hardware
 * identifiers of each ramdisk. The type field denotes the type of its content.
 * The vendor ramdisk names are unique. The hardware identifiers are specified
 * in the board_id field in each table entry. The board_id field is consist of a
 * vector of unsigned integer words, and the encoding scheme is defined by the
 * hardware vendor.
 *
 * For the different type of ramdisks, there are:
 *    - VENDOR_RAMDISK_TYPE_NONE indicates the value is unspecified.
 *    - VENDOR_RAMDISK_TYPE_PLATFORM ramdisks contain platform specific bits, so
 *      the bootloader should always load these into memory.
 *    - VENDOR_RAMDISK_TYPE_RECOVERY ramdisks contain recovery resources, so
 *      the bootloader should load these when booting into recovery.
 *    - VENDOR_RAMDISK_TYPE_DLKM ramdisks contain dynamic loadable kernel
 *      modules.
 *
 * Version 4 of the vendor boot image also adds a bootconfig section to the end
 * of the image. This section contains Boot Configuration parameters known at
 * build time. The bootloader is responsible for placing this section directly
 * after the generic ramdisk, followed by the bootconfig trailer, before
 * entering the kernel.
 *
 * 0. all entities in the boot image are 4096-byte aligned in flash, all
 *    entities in the vendor boot image are page_size (determined by the vendor
 *    and specified in the vendor boot image header) aligned in flash
 * 1. kernel, ramdisk, and DTB are required (size != 0)
 * 2. load the kernel and DTB at the specified physical address (kernel_addr,
 *    dtb_addr)
 * 3. load the vendor ramdisks at ramdisk_addr
 * 4. load the generic ramdisk immediately following the vendor ramdisk in
 *    memory
 * 5. load the bootconfig immediately following the generic ramdisk. Add
 *    additional bootconfig parameters followed by the bootconfig trailer.
 * 6. set up registers for kernel entry as required by your architecture
 * 7. if the platform has a second stage bootloader jump to it (must be
 *    contained outside boot and vendor boot partitions), otherwise
 *    jump to kernel_addr
 */
struct boot_img_hdr_v4 {
    boot_img_hdr_v3 hdr_v3;

    //v4
    uint32_t signature_size<format=hex>; /* size in bytes */
};

struct vendor_boot_img_hdr_v4 {
    vendor_boot_img_hdr_v3 hdr_v3;

    //v4
    uint32_t vendor_ramdisk_table_size<bgcolor=cRed>; /* size in bytes for the vendor ramdisk table */
    uint32_t vendor_ramdisk_table_entry_num<bgcolor=cGreen>; /* number of entries in the vendor ramdisk table */
    uint32_t vendor_ramdisk_table_entry_size<bgcolor=cBlue>; /* size in bytes for a vendor ramdisk table entry */
    uint32_t bootconfig_size; /* size in bytes for the bootconfig section */
};

struct vendor_ramdisk_table_entry_v4 {
    uint32_t ramdisk_size<bgcolor=cRed>; /* size in bytes for the ramdisk image */
    uint32_t ramdisk_offset<bgcolor=cGreen>; /* offset to the ramdisk image in vendor ramdisk section */
    uint32_t ramdisk_type<bgcolor=cBlue>; /* type of the ramdisk */
    uint8_t ramdisk_name[VENDOR_RAMDISK_NAME_SIZE]<bgcolor=cYellow>; /* asciiz ramdisk name */

    // Hardware identifiers describing the board, soc or platform which this
    // ramdisk is intended to be loaded on.
    uint32_t board_id[VENDOR_RAMDISK_TABLE_ENTRY_BOARD_ID_SIZE]<bgcolor=cLtPurple>;
};

struct boot_img_v4{
    boot_img_hdr_v4 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int m = (this.hdr.hdr_v3.kernel_size + 4096 - 1) / 4096;
    local unsigned int n = (this.hdr.hdr_v3.ramdisk_size + 4096 - 1) / 4096;
    local unsigned int g = (this.hdr.signature_size + 4096 - 1) / 4096;
    FSeek(0x1000);
    Printf("kernel offset=0x%08X\n", FTell());
    uint8_t kernel[m*4096]<optimize=false,bgcolor=cRed>;
    Printf("ramdisk offset=0x%08X\n", FTell());
    uint8_t ramdisk[n*4096]<optimize=false,bgcolor=cGreen>;
    Printf("signature offset=0x%08X\n", FTell());
    uint8_t signature[g*4096]<optimize=false,bgcolor=cBlue>;

    local unsigned long offset = FTell();
    local string magic = ReadString(offset, AVB_MAGIC_LEN);
    if (magic == AVB_MAGIC){
        Printf("AvbVBMetaImage offset=0x%08X\n", FTell());
        AvbVBMetaImageHeader vbmeta_hdr;
    }

    offset = FileSize() - AVB_FOOTER_SIZE;
    FSeek(offset);
    magic = ReadString(offset, AVB_FOOTER_MAGIC_LEN);
    if (magic == AVB_FOOTER_MAGIC){
        Printf("AvbFooter offset=0x%08X\n", FTell());
        AvbFooter footer;
    }
};


struct vendor_boot_img_v4{
    vendor_boot_img_hdr_v4 hdr<optimize=false,bgcolor=cGray>;
    local unsigned int o = (2128 + 4096 - 1) / 4096;
    local unsigned int p = (this.hdr.hdr_v3.vendor_ramdisk_size + 4096 - 1) / 4096;
    local unsigned int q = (this.hdr.hdr_v3.dtb_size + 4096 - 1) / 4096;
    local unsigned int r = (this.hdr.vendor_ramdisk_table_size + 4096 - 1) / 4096;
    local unsigned int s = (this.hdr.bootconfig_size + 4096 - 1) / 4096;
    FSeek(o*4096);
    uint8_t vendor_ramdisk_section[p*4096]<optimize=false,bgcolor=cRed>;
    uint8_t dtb[q*4096]<optimize=false,bgcolor=cGreen>;
    vendor_ramdisk_table_entry_v4 vendor_ramdisk_table[this.hdr.vendor_ramdisk_table_entry_num];

    local unsigned long offset = (o+p+q+r) * 4096;
    FSeek(offset);
    uint8_t bootconfig[s*4096]<optimize=false,bgcolor=cBlue>;
};


/********************************************************************************************/


// --------------------- main ---------------------

local string magic = ReadString(0, 8);
if(magic == BOOT_MAGIC){
    local int version = ReadUInt(0x28);
    Printf("Android Boot Image v%d\n", version);
    FSeek(0);
    LittleEndian();
    switch(version){
        case 0:
            boot_img_v0 Image;
            break;
        case 1:
            boot_img_v1 Image;
            break;
        case 2:
            boot_img_v2 Image;
            break;
        case 3:
            boot_img_v3 Image;
            break;
        case 4:
            boot_img_v4 Image;
            break;
        default:
            Printf("Not implemented", version);
            break;
    }
}else if(magic == VENDOR_BOOT_MAGIC){
    local int version = ReadUInt(0x28);
    Print("Android Vendor Boot Image v%d\n", version);
    FSeek(0);
    LittleEndian();
    switch(version){
        case 3:
            vendor_boot_img_v3 Image;
            break;
        case 4:
            vendor_boot_img_v4 Image;
            break;
        default:
            Printf("Not implemented", version);
            break;
    }
}else{
    Print("Not Android Boot Image\n");
}