How to unpack and repack NB0 file

From Android Wiki

Revision as of 09:28, 31 January 2013

Unpack and Repack NB0 file

1. Download A688 Tools

 You can find the latest version A688 tools from here:
 http://snowwolf725.blogspot.com/2010/04/a688a60a88.html

2. The Java JRE is required, if you don't install the Java JRE, install it before you executing the command.

3. You can find out nb0-utils.jar in the A688_Tools/RomUnpackTools_Win folder.

4. Using the following command to unpack the NB0 file which you want to unpack.

 java -jar nb0-utils.jar unpack a60_280_rom_7003.nb0 a60

If you get following message, you need add "-Xmx512M" in your command.

 Exception in thread "main" java.lang.OutOfMemoryError: Java heap space

 java -Xmx512M -jar nb0-utils.jar unpack a60_280_rom_7003.nb0 a60

5. Using the following command to repack target directory into a NB0 file.

 java -jar nb0-utils.jar pack a60_280_rom_7003.nb0 a60

Some important files in the NB0 file

After you unpack the NB0 file, you will get a lot of files.

The most important file is mlf file, the file define what partition to be flashed.

For example, the content of F0X-1280-0-7003-A01.mlf is listed in the following:

 [Package Download Profile]
 PROFILE VER = 0.1
 MODEL = ADR
 PROJECT = F0X
 PLATFORM = Q1
 
 [Package Info]
 /*-----------------------------------------------------------------------------
   UPDATE_FLAG_NULL              = 0x00
   UPDATE_FLAG_QCSBL             = 0x01
   UPDATE_FLAG_OEMSBL            = 0x02
   UPDATE_FLAG_AMSS              = 0x04
   UPDATE_FLAG_CEFS              = 0x08
   UPDATE_FLAG_APPSBOOT          = 0x10
   UPDATE_FLAG_ANDROID_BOOT      = 0x100
   UPDATE_FLAG_ANDROID_SYSTEM    = 0x200
   UPDATE_FLAG_ANDROID_USER_DATA = 0x400
   UPDATE_FLAG_ANDROID_RECOVERY  = 0x800
   UPDATE_FLAG_ANDROID_SPLASH    = 0x1000
   UPDATE_FLAG_ANDROID_HIDDEN    = 0x2000
   UPDATE_FLAG_ANDROID_FTM       = 0x4000
 
   Modem: QCSBL + OEMSBL + AMSS +
   Host : APPSBOOT + ANDROID_BOOT + ANDROID_SYSTEM + ANDROID_RECOVERY +
          ANDROID_SPLASH + ANDROID_HIDDEN + ANDROID_FTM = 0x7B17
 -------------------------------------------------------------------------------*/
 FLAG = 0x7B17
 
 [Firmware File Name]
 FILENAME_FLASH_HEX         = "F0X-0-1280-NPRG7627.hex"
 FILENAME_FLASH_BIN         = "xxx.bin"
 FILENAME_PARTITION         = "F0X-0-1280-partition.mbn"
 FILENAME_QCSBLHDCFG        = "F0X-0-1280-qcsblhd_cfgdata.mbn"
 FILENAME_QCSBL             = "F0X-0-1280-qcsbl.mbn"
 FILENAME_OEMSBLHD          = "F0X-0-1280-oemsblhd.mbn"
 FILENAME_OEMSBL            = "F0X-0-1280-oemsbl.mbn"
 FILENAME_AMSSHD            = "F0X-0-1280-amsshd.mbn"
 FILENAME_AMSS              = "F0X-0-1280-amss.mbn"
 FILENAME_CEFS              = "cefs_modem.mbn"
 FILENAME_APPSBOOTHD        = "F0X-0-1280-appsboothd.mbn"
 FILENAME_APPSBOOT          = "F0X-0-1280-appsboot.mbn"
 FILENAME_ANDROID_BOOT      = "F0X-0-1280-7003-boot.img"
 FILENAME_ANDROID_SYSTEM    = "F0X-0-1280-7003-system.img"
 FILENAME_ANDROID_USER_DATA = "F0X-0-1280-7003-userdata.img"
 FILENAME_ANDROID_RECOVERY  = "F0X-0-1280-recovery.img"
 FILENAME_ANDROID_SPLASH    = "F0X-0-1280-7003-splash.img"
 FILENAME_ANDROID_HIDDEN    = "F0X-0-1280-7003-hidden.img"
 FILENAME_ANDROID_FTM       = "F0X-0-1280-ftm.img"
 
 [NV Item]
 QCN FILENAME  = "NV.xml"
 NV DEFINITION = "NVDefinition.xml"
 CUSTOM_NV     = "F0X_7003_NV.xml"
 
 [CEFS BACKUP FILE]
 FILE NUMBER = 0
 FILE NAME   = NULL

The "FLAG" porperty defines what partition to be flashed, and "Firmware File Name" section defines the partition images.

The "CUSTOM_NV" property define the NV Item update file, which defines what NV Items need to be updated in this update.

Other description of properties are listed in the following:

 FILENAME_FLASH_HEX         Qualconn HEX Image
 FILENAME_FLASH_BIN         ??
 FILENAME_PARTITION         Partition file(Defines partition size,type, etc)
 FILENAME_QCSBLHDCFG        QCSBL header file
 FILENAME_QCSBL             QC Secondary Bootloader  (Loading OEMSBL and AMSS, read/write nand procs)
 FILENAME_OEMSBLHD          OEMSBL header file
 FILENAME_OEMSBL            OEM Secondary Bootloader (Loads Hardwaredriver like LCD-Driver, Keypad-Driver, NAND Driver etc.)
 FILENAME_AMSSHD            AMSS header file
 FILENAME_AMSS              Advanced Mobile Subscriber Software(Applications and Driver by Licensee)
 FILENAME_CEFS              Compressed Embedded File System
 FILENAME_APPSBOOTHD        APPSBOOT header file
 FILENAME_APPSBOOT          Application Secondary Bootloader
 FILENAME_ANDROID_BOOT      Android bootloader
 FILENAME_ANDROID_SYSTEM    Android system
 FILENAME_ANDROID_USER_DATA Android user data
 FILENAME_ANDROID_RECOVERY  Android recovery
 FILENAME_ANDROID_SPLASH    Android SPLASH
 FILENAME_ANDROID_HIDDEN    Hidden Partition
 FILENAME_ANDROID_FTM       FTM Partition

Not Verify

 Flash File Header Format (oemsblhd.mbn)
 0x0 - 01 00 00 00 (0x1) - Magic Number
 0x4 - 01 00 00 00 (0x1) - Version Number
 0x8 - 50 00 (0x50) - Config Data Size
 0xA - 00 00 sbl source offset
 0xC - 00 C0 D9 02 (0x2D9C000) - sbl destination pointer
 0x10 - 0C EA 01 00 (0x1EA0C) - sbl size
 0x14 - EC E8 01 00 (0x1E8EC) - Code Size
 0x18 - EC A8 DB 02 (0x2DBA8EC) - Signature Pointer
 0x1C - 00 01 00 00 (0x100) - Signature Size
 0x20 - 00 00 00 00 (0x0) - Certificate Chain Pointer
 0x24 - 00 00 00 00 (0x0) - Certificate Chain Size
 
 Flash File Header Format (qcsblhd_cfgdata.mbn)
 0x0 - 34 10 D7 73 (0x73D71034) - qcsbl magic (to identify)
 0x4 - B5 EB F4 00 (0xF4EBB5) - qcsbl magic2 (to identify)
 0x8 - 08 04 00 00 (0x408 ) - Header File Size (this)
 0xC - 00 04 00 00 (0x400) - Header data size (checksum offset?)
 0x10 - 00 C0 D4 02 (0x2D4C000) - Load Address (Base)
 0x14 - 6C 4B 00 00 (0xB46C) - File Size (Size of qcsbl.mbn)
 0x18 - 6C 4A 00 00 (0xA46C) - Size to Check (signed size)
 0x1C - 6C 0A D5 02 (0x2D50A6C) - Signature Memory Address (after load)
 0x20 - 00 01 00 00 (0x100) - Signature Size
 0x24 - 00 00 00 00 (0x0) - Certificate Chain Pointer
 0x28 - 00 00 00 00 (0x0) - Cert Chain Size
 0x2C - 00 00 00 00 (0x0) - ?
 0x30 … - … - ?
 [0x400] - 00 00 00 00 02 B0 29 C8 - Checksum / 30-Bit