fastboot-oem-extractor 1.0.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- fastboot_oem_extractor-1.0.0/LICENSE +165 -0
- fastboot_oem_extractor-1.0.0/PKG-INFO +159 -0
- fastboot_oem_extractor-1.0.0/README.md +131 -0
- fastboot_oem_extractor-1.0.0/pyproject.toml +49 -0
- fastboot_oem_extractor-1.0.0/setup.cfg +4 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor/__init__.py +18 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor/__main__.py +17 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor/cli.py +72 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor/extract.py +209 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/PKG-INFO +159 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/SOURCES.txt +13 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/dependency_links.txt +1 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/entry_points.txt +2 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/requires.txt +4 -0
- fastboot_oem_extractor-1.0.0/src/fastboot_oem_extractor.egg-info/top_level.txt +1 -0
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
GNU LESSER GENERAL PUBLIC LICENSE
|
|
2
|
+
Version 3, 29 June 2007
|
|
3
|
+
|
|
4
|
+
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
|
5
|
+
Everyone is permitted to copy and distribute verbatim copies
|
|
6
|
+
of this license document, but changing it is not allowed.
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
This version of the GNU Lesser General Public License incorporates
|
|
10
|
+
the terms and conditions of version 3 of the GNU General Public
|
|
11
|
+
License, supplemented by the additional permissions listed below.
|
|
12
|
+
|
|
13
|
+
0. Additional Definitions.
|
|
14
|
+
|
|
15
|
+
As used herein, "this License" refers to version 3 of the GNU Lesser
|
|
16
|
+
General Public License, and the "GNU GPL" refers to version 3 of the GNU
|
|
17
|
+
General Public License.
|
|
18
|
+
|
|
19
|
+
"The Library" refers to a covered work governed by this License,
|
|
20
|
+
other than an Application or a Combined Work as defined below.
|
|
21
|
+
|
|
22
|
+
An "Application" is any work that makes use of an interface provided
|
|
23
|
+
by the Library, but which is not otherwise based on the Library.
|
|
24
|
+
Defining a subclass of a class defined by the Library is deemed a mode
|
|
25
|
+
of using an interface provided by the Library.
|
|
26
|
+
|
|
27
|
+
A "Combined Work" is a work produced by combining or linking an
|
|
28
|
+
Application with the Library. The particular version of the Library
|
|
29
|
+
with which the Combined Work was made is also called the "Linked
|
|
30
|
+
Version".
|
|
31
|
+
|
|
32
|
+
The "Minimal Corresponding Source" for a Combined Work means the
|
|
33
|
+
Corresponding Source for the Combined Work, excluding any source code
|
|
34
|
+
for portions of the Combined Work that, considered in isolation, are
|
|
35
|
+
based on the Application, and not on the Linked Version.
|
|
36
|
+
|
|
37
|
+
The "Corresponding Application Code" for a Combined Work means the
|
|
38
|
+
object code and/or source code for the Application, including any data
|
|
39
|
+
and utility programs needed for reproducing the Combined Work from the
|
|
40
|
+
Application, but excluding the System Libraries of the Combined Work.
|
|
41
|
+
|
|
42
|
+
1. Exception to Section 3 of the GNU GPL.
|
|
43
|
+
|
|
44
|
+
You may convey a covered work under sections 3 and 4 of this License
|
|
45
|
+
without being bound by section 3 of the GNU GPL.
|
|
46
|
+
|
|
47
|
+
2. Conveying Modified Versions.
|
|
48
|
+
|
|
49
|
+
If you modify a copy of the Library, and, in your modifications, a
|
|
50
|
+
facility refers to a function or data to be supplied by an Application
|
|
51
|
+
that uses the facility (other than as an argument passed when the
|
|
52
|
+
facility is invoked), then you may convey a copy of the modified
|
|
53
|
+
version:
|
|
54
|
+
|
|
55
|
+
a) under this License, provided that you make a good faith effort to
|
|
56
|
+
ensure that, in the event an Application does not supply the
|
|
57
|
+
function or data, the facility still operates, and performs
|
|
58
|
+
whatever part of its purpose remains meaningful, or
|
|
59
|
+
|
|
60
|
+
b) under the GNU GPL, with none of the additional permissions of
|
|
61
|
+
this License applicable to that copy.
|
|
62
|
+
|
|
63
|
+
3. Object Code Incorporating Material from Library Header Files.
|
|
64
|
+
|
|
65
|
+
The object code form of an Application may incorporate material from
|
|
66
|
+
a header file that is part of the Library. You may convey such object
|
|
67
|
+
code under terms of your choice, provided that, if the incorporated
|
|
68
|
+
material is not limited to numerical parameters, data structure
|
|
69
|
+
layouts and accessors, or small macros, inline functions and templates
|
|
70
|
+
(ten or fewer lines in length), you do both of the following:
|
|
71
|
+
|
|
72
|
+
a) Give prominent notice with each copy of the object code that the
|
|
73
|
+
Library is used in it and that the Library and its use are
|
|
74
|
+
covered by this License.
|
|
75
|
+
|
|
76
|
+
b) Accompany the object code with a copy of the GNU GPL and this license
|
|
77
|
+
document.
|
|
78
|
+
|
|
79
|
+
4. Combined Works.
|
|
80
|
+
|
|
81
|
+
You may convey a Combined Work under terms of your choice that,
|
|
82
|
+
taken together, effectively do not restrict modification of the
|
|
83
|
+
portions of the Library contained in the Combined Work and reverse
|
|
84
|
+
engineering for debugging such modifications, if you also do each of
|
|
85
|
+
the following:
|
|
86
|
+
|
|
87
|
+
a) Give prominent notice with each copy of the Combined Work that
|
|
88
|
+
the Library is used in it and that the Library and its use are
|
|
89
|
+
covered by this License.
|
|
90
|
+
|
|
91
|
+
b) Accompany the Combined Work with a copy of the GNU GPL and this license
|
|
92
|
+
document.
|
|
93
|
+
|
|
94
|
+
c) For a Combined Work that displays copyright notices during
|
|
95
|
+
execution, include the copyright notice for the Library among
|
|
96
|
+
these notices, as well as a reference directing the user to the
|
|
97
|
+
copies of the GNU GPL and this license document.
|
|
98
|
+
|
|
99
|
+
d) Do one of the following:
|
|
100
|
+
|
|
101
|
+
0) Convey the Minimal Corresponding Source under the terms of this
|
|
102
|
+
License, and the Corresponding Application Code in a form
|
|
103
|
+
suitable for, and under terms that permit, the user to
|
|
104
|
+
recombine or relink the Application with a modified version of
|
|
105
|
+
the Linked Version to produce a modified Combined Work, in the
|
|
106
|
+
manner specified by section 6 of the GNU GPL for conveying
|
|
107
|
+
Corresponding Source.
|
|
108
|
+
|
|
109
|
+
1) Use a suitable shared library mechanism for linking with the
|
|
110
|
+
Library. A suitable mechanism is one that (a) uses at run time
|
|
111
|
+
a copy of the Library already present on the user's computer
|
|
112
|
+
system, and (b) will operate properly with a modified version
|
|
113
|
+
of the Library that is interface-compatible with the Linked
|
|
114
|
+
Version.
|
|
115
|
+
|
|
116
|
+
e) Provide Installation Information, but only if you would otherwise
|
|
117
|
+
be required to provide such information under section 6 of the
|
|
118
|
+
GNU GPL, and only to the extent that such information is
|
|
119
|
+
necessary to install and execute a modified version of the
|
|
120
|
+
Combined Work produced by recombining or relinking the
|
|
121
|
+
Application with a modified version of the Linked Version. (If
|
|
122
|
+
you use option 4d0, the Installation Information must accompany
|
|
123
|
+
the Minimal Corresponding Source and Corresponding Application
|
|
124
|
+
Code. If you use option 4d1, you must provide the Installation
|
|
125
|
+
Information in the manner specified by section 6 of the GNU GPL
|
|
126
|
+
for conveying Corresponding Source.)
|
|
127
|
+
|
|
128
|
+
5. Combined Libraries.
|
|
129
|
+
|
|
130
|
+
You may place library facilities that are a work based on the
|
|
131
|
+
Library side by side in a single library together with other library
|
|
132
|
+
facilities that are not Applications and are not covered by this
|
|
133
|
+
License, and convey such a combined library under terms of your
|
|
134
|
+
choice, if you do both of the following:
|
|
135
|
+
|
|
136
|
+
a) Accompany the combined library with a copy of the same work based
|
|
137
|
+
on the Library, uncombined with any other library facilities,
|
|
138
|
+
conveyed under the terms of this License.
|
|
139
|
+
|
|
140
|
+
b) Give prominent notice with the combined library that part of it
|
|
141
|
+
is a work based on the Library, and explaining where to find the
|
|
142
|
+
accompanying uncombined form of the same work.
|
|
143
|
+
|
|
144
|
+
6. Revised Versions of the GNU Lesser General Public License.
|
|
145
|
+
|
|
146
|
+
The Free Software Foundation may publish revised and/or new versions
|
|
147
|
+
of the GNU Lesser General Public License from time to time. Such new
|
|
148
|
+
versions will be similar in spirit to the present version, but may
|
|
149
|
+
differ in detail to address new problems or concerns.
|
|
150
|
+
|
|
151
|
+
Each version is given a distinguishing version number. If the
|
|
152
|
+
Library as you received it specifies that a certain numbered version
|
|
153
|
+
of the GNU Lesser General Public License "or any later version"
|
|
154
|
+
applies to it, you have the option of following the terms and
|
|
155
|
+
conditions either of that published version or of any later version
|
|
156
|
+
published by the Free Software Foundation. If the Library as you
|
|
157
|
+
received it does not specify a version number of the GNU Lesser
|
|
158
|
+
General Public License, you may choose any version of the GNU Lesser
|
|
159
|
+
General Public License ever published by the Free Software Foundation.
|
|
160
|
+
|
|
161
|
+
If the Library as you received it specifies that a proxy can decide
|
|
162
|
+
whether future versions of the GNU Lesser General Public License shall
|
|
163
|
+
apply, that proxy's public statement of acceptance of any version is
|
|
164
|
+
permanent authorization for you to choose that version for the
|
|
165
|
+
Library.
|
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: fastboot-oem-extractor
|
|
3
|
+
Version: 1.0.0
|
|
4
|
+
Summary: Extract hidden "fastboot oem" commands from firmware blobs
|
|
5
|
+
Author-email: chkndrp <chkndrp@gmail.com>
|
|
6
|
+
License-Expression: LGPL-3.0-only
|
|
7
|
+
Project-URL: Repository, https://github.com/chkndrp/fastboot-oem-extractor
|
|
8
|
+
Project-URL: Issues, https://github.com/chkndrp/fastboot-oem-extractor/issues
|
|
9
|
+
Project-URL: Changelog, https://github.com/chkndrp/fastboot-oem-extractor/blob/master/CHANGELOG.md
|
|
10
|
+
Project-URL: Homepage, https://github.com/chkndrp/fastboot-oem-extractor/blob/master/README.md
|
|
11
|
+
Keywords: android,fastboot,oem,extractor,research,uefi,lk,abl,bootloader,cli,library
|
|
12
|
+
Classifier: Programming Language :: Python :: 3
|
|
13
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Intended Audience :: End Users/Desktop
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
18
|
+
Classifier: Topic :: Utilities
|
|
19
|
+
Classifier: Environment :: Console
|
|
20
|
+
Classifier: Typing :: Typed
|
|
21
|
+
Requires-Python: >=3.10
|
|
22
|
+
Description-Content-Type: text/markdown
|
|
23
|
+
License-File: LICENSE
|
|
24
|
+
Requires-Dist: uefi_firmware==1.16
|
|
25
|
+
Provides-Extra: dev
|
|
26
|
+
Requires-Dist: pylint>=4.1.3; extra == "dev"
|
|
27
|
+
Dynamic: license-file
|
|
28
|
+
|
|
29
|
+
# fastboot-oem-extractor
|
|
30
|
+
  
|
|
31
|
+
|
|
32
|
+
Extract hidden "fastboot oem" commands from firmware blobs
|
|
33
|
+
|
|
34
|
+
## Supported firmware
|
|
35
|
+
These firmware blobs will be accepted by this tool
|
|
36
|
+
- `ABL` (Qualcomm)
|
|
37
|
+
- `LK1st, LK2nd` (Qualcomm, Second BLs)
|
|
38
|
+
- `LK` (MediaTek)
|
|
39
|
+
- `FBPK` Containers (Google)
|
|
40
|
+
- `DHTB` Signed binaries (U-Boot)
|
|
41
|
+
- `ELF` Linux binaries
|
|
42
|
+
- Anything else containing UEFI PEs
|
|
43
|
+
|
|
44
|
+
This is an artificial barrier for when this tool is ran in a loop against firmware images
|
|
45
|
+
|
|
46
|
+
## Using as a CLI tool:
|
|
47
|
+
1. Installing:
|
|
48
|
+
```shell
|
|
49
|
+
# With PyPi (recommended)
|
|
50
|
+
pip install fasboot_oem_extractor
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
```shell
|
|
54
|
+
# From source/clone
|
|
55
|
+
pip install -r requirements.txt
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
2. Prepare your firmware images from the internet, or by pulling them off the device with `adb`
|
|
59
|
+
3. Run the installed CLI against the image
|
|
60
|
+
```shell
|
|
61
|
+
# PyPi
|
|
62
|
+
python -m fastboot_oem_extractor ./abl.elf
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
```shell
|
|
66
|
+
# Source/clone
|
|
67
|
+
python ./extractor.py ./abl.elf
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
4. Fetch the output
|
|
71
|
+
```shell
|
|
72
|
+
# Example output for Redmi Note 14 Pro+ 5G (amethyst)
|
|
73
|
+
|
|
74
|
+
(x) File contains common bootloader magic bytes
|
|
75
|
+
(x) Reading firmware file (first 10MB): abl.elf
|
|
76
|
+
(x) Found valid UEFI firmware structure at offset: 0x1000
|
|
77
|
+
(x) Extracting firmware...
|
|
78
|
+
(x) Found 1 UEFI portable executable(s)
|
|
79
|
+
(x) Matching 'oem *' ascii strings
|
|
80
|
+
|
|
81
|
+
fastboot oem allow-wipe-userdata
|
|
82
|
+
fastboot oem audio-framework
|
|
83
|
+
fastboot oem device-info
|
|
84
|
+
fastboot oem disable-charger-screen
|
|
85
|
+
fastboot oem dm-verity-enforcing
|
|
86
|
+
fastboot oem edl
|
|
87
|
+
fastboot oem enable-charger-screen
|
|
88
|
+
fastboot oem fbreason
|
|
89
|
+
fastboot oem getguid
|
|
90
|
+
fastboot oem hwid
|
|
91
|
+
fastboot oem lkmsg
|
|
92
|
+
fastboot oem lock
|
|
93
|
+
fastboot oem lpmsg
|
|
94
|
+
fastboot oem off-mode-charge
|
|
95
|
+
fastboot oem poweroff
|
|
96
|
+
fastboot oem ramdump fat
|
|
97
|
+
fastboot oem select-display-panel
|
|
98
|
+
fastboot oem set-gpu-preemption
|
|
99
|
+
fastboot oem set-hw-fence-value
|
|
100
|
+
fastboot oem uart-enable
|
|
101
|
+
fastboot oem uefilog
|
|
102
|
+
fastboot oem unlock
|
|
103
|
+
```
|
|
104
|
+
|
|
105
|
+
If your file is some sparse image that does not contain any UEFI PEs or common binary magic bytes,
|
|
106
|
+
you can force the string lookup via this command line option:
|
|
107
|
+
```shell
|
|
108
|
+
--force-string-lookup
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
### Using as a Python library
|
|
112
|
+
This project can also be used as a library for other tools that want to integrate this.
|
|
113
|
+
There is one public function:
|
|
114
|
+
|
|
115
|
+
```python
|
|
116
|
+
extract_commands(firmware_file, force_string_lookup=False) -> list[str] | None
|
|
117
|
+
```
|
|
118
|
+
|
|
119
|
+
- `firmware_file` (`str | pathlib.Path`): Path to the firmware image.
|
|
120
|
+
- `force_string_lookup` (`bool`): Force the oem command string lookup on raw images. Defaults to `False`.
|
|
121
|
+
- **Returns:**
|
|
122
|
+
- A sorted list of unique command strings when the format is recognized.
|
|
123
|
+
- An empty list if no commands are found.
|
|
124
|
+
- `None` if the format is unrecognized and `force_string_lookup` is `False`.
|
|
125
|
+
- **Raises:** `OSError` if the file cannot be read.
|
|
126
|
+
|
|
127
|
+
**Quick example:**
|
|
128
|
+
```python
|
|
129
|
+
# from pathlib import Path
|
|
130
|
+
from fastboot_oem_extractor import extract_commands
|
|
131
|
+
|
|
132
|
+
# commands = extract_commands(Path("./abl.elf"))
|
|
133
|
+
commands = extract_commands("./abl.elf")
|
|
134
|
+
|
|
135
|
+
if commands is None:
|
|
136
|
+
print("Unrecognized firmware format.")
|
|
137
|
+
elif commands:
|
|
138
|
+
print(commands)
|
|
139
|
+
# Example output: ['fastboot oem allow-wipe-userdata', ...]
|
|
140
|
+
else:
|
|
141
|
+
print("No OEM commands found.")
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
## Disclaimer:
|
|
145
|
+
Due to the nature of simply matching "oem" strings, the output may contain some invalid commands,
|
|
146
|
+
or commands that don't work after the device is sent out of factory. Keep this in mind
|
|
147
|
+
|
|
148
|
+
Also, some FBPK containers (e.g. `barbret` bootloader) are very difficult to extract
|
|
149
|
+
`oem` commands from, and may not work. Most work just fine though.
|
|
150
|
+
|
|
151
|
+
## Similar project
|
|
152
|
+
If you want to extract bootloader/charging pictures from a `imagefv` partition on your Qualcomm device,
|
|
153
|
+
use my other tool:
|
|
154
|
+
|
|
155
|
+
[chkndrp/imagefv-extractor](https://github.com/chkndrp/imagefv-extractor)
|
|
156
|
+
|
|
157
|
+
## Requirements
|
|
158
|
+
- Python 3.10 or newer
|
|
159
|
+
- Installed `uefi_firmware` pip package
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
# fastboot-oem-extractor
|
|
2
|
+
  
|
|
3
|
+
|
|
4
|
+
Extract hidden "fastboot oem" commands from firmware blobs
|
|
5
|
+
|
|
6
|
+
## Supported firmware
|
|
7
|
+
These firmware blobs will be accepted by this tool
|
|
8
|
+
- `ABL` (Qualcomm)
|
|
9
|
+
- `LK1st, LK2nd` (Qualcomm, Second BLs)
|
|
10
|
+
- `LK` (MediaTek)
|
|
11
|
+
- `FBPK` Containers (Google)
|
|
12
|
+
- `DHTB` Signed binaries (U-Boot)
|
|
13
|
+
- `ELF` Linux binaries
|
|
14
|
+
- Anything else containing UEFI PEs
|
|
15
|
+
|
|
16
|
+
This is an artificial barrier for when this tool is ran in a loop against firmware images
|
|
17
|
+
|
|
18
|
+
## Using as a CLI tool:
|
|
19
|
+
1. Installing:
|
|
20
|
+
```shell
|
|
21
|
+
# With PyPi (recommended)
|
|
22
|
+
pip install fasboot_oem_extractor
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
```shell
|
|
26
|
+
# From source/clone
|
|
27
|
+
pip install -r requirements.txt
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
2. Prepare your firmware images from the internet, or by pulling them off the device with `adb`
|
|
31
|
+
3. Run the installed CLI against the image
|
|
32
|
+
```shell
|
|
33
|
+
# PyPi
|
|
34
|
+
python -m fastboot_oem_extractor ./abl.elf
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
```shell
|
|
38
|
+
# Source/clone
|
|
39
|
+
python ./extractor.py ./abl.elf
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
4. Fetch the output
|
|
43
|
+
```shell
|
|
44
|
+
# Example output for Redmi Note 14 Pro+ 5G (amethyst)
|
|
45
|
+
|
|
46
|
+
(x) File contains common bootloader magic bytes
|
|
47
|
+
(x) Reading firmware file (first 10MB): abl.elf
|
|
48
|
+
(x) Found valid UEFI firmware structure at offset: 0x1000
|
|
49
|
+
(x) Extracting firmware...
|
|
50
|
+
(x) Found 1 UEFI portable executable(s)
|
|
51
|
+
(x) Matching 'oem *' ascii strings
|
|
52
|
+
|
|
53
|
+
fastboot oem allow-wipe-userdata
|
|
54
|
+
fastboot oem audio-framework
|
|
55
|
+
fastboot oem device-info
|
|
56
|
+
fastboot oem disable-charger-screen
|
|
57
|
+
fastboot oem dm-verity-enforcing
|
|
58
|
+
fastboot oem edl
|
|
59
|
+
fastboot oem enable-charger-screen
|
|
60
|
+
fastboot oem fbreason
|
|
61
|
+
fastboot oem getguid
|
|
62
|
+
fastboot oem hwid
|
|
63
|
+
fastboot oem lkmsg
|
|
64
|
+
fastboot oem lock
|
|
65
|
+
fastboot oem lpmsg
|
|
66
|
+
fastboot oem off-mode-charge
|
|
67
|
+
fastboot oem poweroff
|
|
68
|
+
fastboot oem ramdump fat
|
|
69
|
+
fastboot oem select-display-panel
|
|
70
|
+
fastboot oem set-gpu-preemption
|
|
71
|
+
fastboot oem set-hw-fence-value
|
|
72
|
+
fastboot oem uart-enable
|
|
73
|
+
fastboot oem uefilog
|
|
74
|
+
fastboot oem unlock
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
If your file is some sparse image that does not contain any UEFI PEs or common binary magic bytes,
|
|
78
|
+
you can force the string lookup via this command line option:
|
|
79
|
+
```shell
|
|
80
|
+
--force-string-lookup
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
### Using as a Python library
|
|
84
|
+
This project can also be used as a library for other tools that want to integrate this.
|
|
85
|
+
There is one public function:
|
|
86
|
+
|
|
87
|
+
```python
|
|
88
|
+
extract_commands(firmware_file, force_string_lookup=False) -> list[str] | None
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
- `firmware_file` (`str | pathlib.Path`): Path to the firmware image.
|
|
92
|
+
- `force_string_lookup` (`bool`): Force the oem command string lookup on raw images. Defaults to `False`.
|
|
93
|
+
- **Returns:**
|
|
94
|
+
- A sorted list of unique command strings when the format is recognized.
|
|
95
|
+
- An empty list if no commands are found.
|
|
96
|
+
- `None` if the format is unrecognized and `force_string_lookup` is `False`.
|
|
97
|
+
- **Raises:** `OSError` if the file cannot be read.
|
|
98
|
+
|
|
99
|
+
**Quick example:**
|
|
100
|
+
```python
|
|
101
|
+
# from pathlib import Path
|
|
102
|
+
from fastboot_oem_extractor import extract_commands
|
|
103
|
+
|
|
104
|
+
# commands = extract_commands(Path("./abl.elf"))
|
|
105
|
+
commands = extract_commands("./abl.elf")
|
|
106
|
+
|
|
107
|
+
if commands is None:
|
|
108
|
+
print("Unrecognized firmware format.")
|
|
109
|
+
elif commands:
|
|
110
|
+
print(commands)
|
|
111
|
+
# Example output: ['fastboot oem allow-wipe-userdata', ...]
|
|
112
|
+
else:
|
|
113
|
+
print("No OEM commands found.")
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
## Disclaimer:
|
|
117
|
+
Due to the nature of simply matching "oem" strings, the output may contain some invalid commands,
|
|
118
|
+
or commands that don't work after the device is sent out of factory. Keep this in mind
|
|
119
|
+
|
|
120
|
+
Also, some FBPK containers (e.g. `barbret` bootloader) are very difficult to extract
|
|
121
|
+
`oem` commands from, and may not work. Most work just fine though.
|
|
122
|
+
|
|
123
|
+
## Similar project
|
|
124
|
+
If you want to extract bootloader/charging pictures from a `imagefv` partition on your Qualcomm device,
|
|
125
|
+
use my other tool:
|
|
126
|
+
|
|
127
|
+
[chkndrp/imagefv-extractor](https://github.com/chkndrp/imagefv-extractor)
|
|
128
|
+
|
|
129
|
+
## Requirements
|
|
130
|
+
- Python 3.10 or newer
|
|
131
|
+
- Installed `uefi_firmware` pip package
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=77.0.0"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "fastboot-oem-extractor"
|
|
7
|
+
version = "1.0.0"
|
|
8
|
+
description = 'Extract hidden "fastboot oem" commands from firmware blobs'
|
|
9
|
+
authors = [{ name = "chkndrp", email = "chkndrp@gmail.com" }]
|
|
10
|
+
keywords = [
|
|
11
|
+
"android", "fastboot", "oem", "extractor", "research",
|
|
12
|
+
"uefi", "lk", "abl", "bootloader", "cli", "library"
|
|
13
|
+
]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Programming Language :: Python :: 3",
|
|
16
|
+
"Development Status :: 5 - Production/Stable",
|
|
17
|
+
"Intended Audience :: Developers",
|
|
18
|
+
"Intended Audience :: End Users/Desktop",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
"Topic :: Software Development :: Libraries :: Python Modules",
|
|
21
|
+
"Topic :: Utilities",
|
|
22
|
+
"Environment :: Console",
|
|
23
|
+
"Typing :: Typed"
|
|
24
|
+
]
|
|
25
|
+
dependencies = [
|
|
26
|
+
"uefi_firmware==1.16"
|
|
27
|
+
]
|
|
28
|
+
license = "LGPL-3.0-only"
|
|
29
|
+
readme = "README.md"
|
|
30
|
+
requires-python = ">=3.10"
|
|
31
|
+
|
|
32
|
+
[project.urls]
|
|
33
|
+
Repository = "https://github.com/chkndrp/fastboot-oem-extractor"
|
|
34
|
+
Issues = "https://github.com/chkndrp/fastboot-oem-extractor/issues"
|
|
35
|
+
Changelog = "https://github.com/chkndrp/fastboot-oem-extractor/blob/master/CHANGELOG.md"
|
|
36
|
+
Homepage = "https://github.com/chkndrp/fastboot-oem-extractor/blob/master/README.md"
|
|
37
|
+
|
|
38
|
+
[project.optional-dependencies]
|
|
39
|
+
dev = [
|
|
40
|
+
"pylint>=4.1.3",
|
|
41
|
+
]
|
|
42
|
+
|
|
43
|
+
[project.scripts]
|
|
44
|
+
fastboot-oem-extractor = "fastboot_oem_extractor.cli:main"
|
|
45
|
+
|
|
46
|
+
[tool.setuptools.packages.find]
|
|
47
|
+
include = ["fastboot_oem_extractor*"]
|
|
48
|
+
where = ["src"]
|
|
49
|
+
exclude = [".github"]
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
"""Python library to extract hidden 'fastboot oem' commands from firmware blobs"""
|
|
2
|
+
|
|
3
|
+
# Extract hidden "fastboot oem" commands from firmware blobs
|
|
4
|
+
# Copyright (C) 2026 chkndrp
|
|
5
|
+
#
|
|
6
|
+
# This library is free software; you can redistribute it and/or modify it
|
|
7
|
+
# under the terms of the GNU Lesser General Public License as published by
|
|
8
|
+
# the Free Software Foundation; either version 3 of the License, or
|
|
9
|
+
# (at your option) any later version.
|
|
10
|
+
#
|
|
11
|
+
# This library is distributed in the hope that it will be useful,
|
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
14
|
+
# GNU Lesser General Public License for more details.
|
|
15
|
+
|
|
16
|
+
from .extract import extract_commands
|
|
17
|
+
|
|
18
|
+
__all__ = ["extract_commands"]
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
# Extract hidden "fastboot oem" commands from firmware blobs
|
|
2
|
+
# Copyright (C) 2026 chkndrp
|
|
3
|
+
#
|
|
4
|
+
# This library is free software; you can redistribute it and/or modify it
|
|
5
|
+
# under the terms of the GNU Lesser General Public License as published by
|
|
6
|
+
# the Free Software Foundation; either version 3 of the License, or
|
|
7
|
+
# (at your option) any later version.
|
|
8
|
+
#
|
|
9
|
+
# This library is distributed in the hope that it will be useful,
|
|
10
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
11
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
12
|
+
# GNU Lesser General Public License for more details.
|
|
13
|
+
|
|
14
|
+
from .cli import main
|
|
15
|
+
|
|
16
|
+
if __name__ == "__main__":
|
|
17
|
+
raise SystemExit(main())
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
"""CLI interface."""
|
|
2
|
+
|
|
3
|
+
# Extract hidden "fastboot oem" commands from firmware blobs
|
|
4
|
+
# Copyright (C) 2026 chkndrp
|
|
5
|
+
#
|
|
6
|
+
# This library is free software; you can redistribute it and/or modify it
|
|
7
|
+
# under the terms of the GNU Lesser General Public License as published by
|
|
8
|
+
# the Free Software Foundation; either version 3 of the License, or
|
|
9
|
+
# (at your option) any later version.
|
|
10
|
+
#
|
|
11
|
+
# This library is distributed in the hope that it will be useful,
|
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
14
|
+
# GNU Lesser General Public License for more details.
|
|
15
|
+
|
|
16
|
+
import argparse
|
|
17
|
+
import logging
|
|
18
|
+
|
|
19
|
+
from collections.abc import Sequence
|
|
20
|
+
from pathlib import Path
|
|
21
|
+
from .extract import _scan_firmware
|
|
22
|
+
|
|
23
|
+
logger = logging.getLogger("fastboot-oem-extractor")
|
|
24
|
+
|
|
25
|
+
|
|
26
|
+
class _PrefixFormatter(logging.Formatter):
|
|
27
|
+
def format(self, record: logging.LogRecord) -> str:
|
|
28
|
+
return f"(x) {super().format(record)}"
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
def _configure_logging() -> None:
|
|
32
|
+
logger.setLevel(logging.INFO)
|
|
33
|
+
logger.propagate = False
|
|
34
|
+
|
|
35
|
+
if not logger.handlers:
|
|
36
|
+
handler = logging.StreamHandler()
|
|
37
|
+
handler.setFormatter(_PrefixFormatter("%(message)s"))
|
|
38
|
+
logger.addHandler(handler)
|
|
39
|
+
|
|
40
|
+
|
|
41
|
+
def main(argv: Sequence[str] | None = None) -> int:
|
|
42
|
+
"""CLI main entry"""
|
|
43
|
+
|
|
44
|
+
_configure_logging()
|
|
45
|
+
|
|
46
|
+
parser = argparse.ArgumentParser(
|
|
47
|
+
description='Extract hidden "fastboot oem" commands from firmware blobs'
|
|
48
|
+
)
|
|
49
|
+
parser.add_argument(
|
|
50
|
+
"file",
|
|
51
|
+
help="Firmware file to analyze"
|
|
52
|
+
)
|
|
53
|
+
parser.add_argument(
|
|
54
|
+
"-fsl", "--force-string-lookup",
|
|
55
|
+
help="Force string lookup on unsupported files",
|
|
56
|
+
action="store_true",
|
|
57
|
+
dest="fsl",
|
|
58
|
+
)
|
|
59
|
+
args = parser.parse_args(argv)
|
|
60
|
+
|
|
61
|
+
try:
|
|
62
|
+
commands, recognized = _scan_firmware(Path(args.file), args.fsl)
|
|
63
|
+
except OSError as error:
|
|
64
|
+
logger.error("Cannot read file (%s): %s", args.file, error)
|
|
65
|
+
return 1
|
|
66
|
+
|
|
67
|
+
if commands:
|
|
68
|
+
print("\n" + "\n".join(commands))
|
|
69
|
+
|
|
70
|
+
if recognized == 0:
|
|
71
|
+
return 1
|
|
72
|
+
return 0
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
"""Main entry"""
|
|
2
|
+
|
|
3
|
+
# Extract hidden "fastboot oem" commands from firmware blobs
|
|
4
|
+
# Copyright (C) 2026 chkndrp
|
|
5
|
+
#
|
|
6
|
+
# This library is free software; you can redistribute it and/or modify it
|
|
7
|
+
# under the terms of the GNU Lesser General Public License as published by
|
|
8
|
+
# the Free Software Foundation; either version 3 of the License, or
|
|
9
|
+
# (at your option) any later version.
|
|
10
|
+
#
|
|
11
|
+
# This library is distributed in the hope that it will be useful,
|
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
14
|
+
# GNU Lesser General Public License for more details.
|
|
15
|
+
|
|
16
|
+
import contextlib
|
|
17
|
+
import logging
|
|
18
|
+
import re
|
|
19
|
+
import tempfile
|
|
20
|
+
|
|
21
|
+
from pathlib import Path
|
|
22
|
+
from uefi_firmware import AutoParser
|
|
23
|
+
|
|
24
|
+
BL_MAGIC_PATTERNS = [
|
|
25
|
+
bytes.fromhex("4D 5A"), # Portable Executable (PE)
|
|
26
|
+
bytes.fromhex("88 16 88 58"), # Little Kernel (LK)
|
|
27
|
+
bytes.fromhex("46 42 50 4B"), # FBPK container
|
|
28
|
+
bytes.fromhex("44 48 54 42"), # DHTB signed binary
|
|
29
|
+
bytes.fromhex("7F 45 4C 46"), # ELF binary
|
|
30
|
+
bytes.fromhex("41 4E 44 52 4F 49 44 21"), # Second bootloaders
|
|
31
|
+
]
|
|
32
|
+
|
|
33
|
+
logger = logging.getLogger("fastboot-oem-extractor")
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
def _find_oem_commands(data: bytes, quiet: bool = False) -> list[str]:
|
|
37
|
+
"""Find and return OEM command strings in firmware data"""
|
|
38
|
+
|
|
39
|
+
strings = re.findall(rb"oem\s+([^\x00\n]+)", data, re.IGNORECASE)
|
|
40
|
+
commands: set[str] = set()
|
|
41
|
+
|
|
42
|
+
for raw_value in strings:
|
|
43
|
+
value = raw_value.decode("ascii", "ignore").strip()
|
|
44
|
+
command = f"fastboot oem {value}"
|
|
45
|
+
|
|
46
|
+
if not 2 <= len(f"oem {value}".split()) <= 5:
|
|
47
|
+
continue
|
|
48
|
+
if any(character in value for character in "<>/%"):
|
|
49
|
+
continue
|
|
50
|
+
|
|
51
|
+
commands.add(command)
|
|
52
|
+
if commands:
|
|
53
|
+
logger.info("Matching 'oem *' ascii strings")
|
|
54
|
+
elif not quiet:
|
|
55
|
+
logger.info("No fastboot oem commands found")
|
|
56
|
+
|
|
57
|
+
return sorted(commands)
|
|
58
|
+
|
|
59
|
+
|
|
60
|
+
def _extract_pe_files(parser: AutoParser) -> list[str]:
|
|
61
|
+
"""Extract firmware file and search for portable executables"""
|
|
62
|
+
|
|
63
|
+
commands: set[str] = set()
|
|
64
|
+
|
|
65
|
+
with tempfile.TemporaryDirectory() as tmpdir:
|
|
66
|
+
logger.info("Extracting firmware...")
|
|
67
|
+
|
|
68
|
+
with contextlib.redirect_stdout(None), contextlib.redirect_stderr(None):
|
|
69
|
+
parsed = parser.parse()
|
|
70
|
+
|
|
71
|
+
if parsed is not None:
|
|
72
|
+
parsed.dump(tmpdir)
|
|
73
|
+
|
|
74
|
+
pe_files = list(Path(tmpdir).rglob("*.pe"))
|
|
75
|
+
if not pe_files:
|
|
76
|
+
logger.info("No UEFI portable executables found")
|
|
77
|
+
return []
|
|
78
|
+
|
|
79
|
+
logger.info("Found %s UEFI portable executable(s)", len(pe_files))
|
|
80
|
+
for pe_file in pe_files:
|
|
81
|
+
commands.update(
|
|
82
|
+
_find_oem_commands(
|
|
83
|
+
pe_file.read_bytes(),
|
|
84
|
+
quiet=True
|
|
85
|
+
)
|
|
86
|
+
)
|
|
87
|
+
|
|
88
|
+
return sorted(commands)
|
|
89
|
+
|
|
90
|
+
|
|
91
|
+
def _check_uefi_structure(data: bytes) -> list[str] | None:
|
|
92
|
+
"""Search for UEFI firmware structure (first 10MB)"""
|
|
93
|
+
|
|
94
|
+
max_offsets = min(len(data) // 2048, 100)
|
|
95
|
+
|
|
96
|
+
for offset_index in range(max_offsets):
|
|
97
|
+
offset = offset_index * 2048
|
|
98
|
+
|
|
99
|
+
with contextlib.redirect_stdout(None), contextlib.redirect_stderr(None):
|
|
100
|
+
parser = AutoParser(
|
|
101
|
+
data[offset:],
|
|
102
|
+
search=False
|
|
103
|
+
)
|
|
104
|
+
|
|
105
|
+
if parser.type() != "unknown":
|
|
106
|
+
logger.info("Found valid UEFI firmware structure at offset: 0x%x", offset)
|
|
107
|
+
return _extract_pe_files(parser)
|
|
108
|
+
|
|
109
|
+
return None
|
|
110
|
+
|
|
111
|
+
|
|
112
|
+
def _extract_bootloader_pe_files(firmware_file: Path) -> list[str] | None:
|
|
113
|
+
"""Extract PE files from bootloader (first 10MB)"""
|
|
114
|
+
|
|
115
|
+
with firmware_file.open("rb") as firmware:
|
|
116
|
+
bootloader_data = firmware.read(10 * 1024 * 1024)
|
|
117
|
+
|
|
118
|
+
pe_offsets = [
|
|
119
|
+
offset
|
|
120
|
+
for offset in range(len(bootloader_data) - 1)
|
|
121
|
+
if bootloader_data[offset:offset + 2] == b"MZ"
|
|
122
|
+
]
|
|
123
|
+
|
|
124
|
+
if not pe_offsets:
|
|
125
|
+
return None
|
|
126
|
+
|
|
127
|
+
logger.info("Found %s embedded PE file(s)", len(pe_offsets))
|
|
128
|
+
commands: set[str] = set()
|
|
129
|
+
|
|
130
|
+
for index, offset in enumerate(pe_offsets):
|
|
131
|
+
end_offset = (
|
|
132
|
+
pe_offsets[index + 1]
|
|
133
|
+
if index + 1 < len(pe_offsets)
|
|
134
|
+
else len(bootloader_data)
|
|
135
|
+
)
|
|
136
|
+
|
|
137
|
+
commands.update(
|
|
138
|
+
_find_oem_commands(
|
|
139
|
+
bootloader_data[offset:end_offset],
|
|
140
|
+
quiet=True
|
|
141
|
+
)
|
|
142
|
+
)
|
|
143
|
+
|
|
144
|
+
return sorted(commands)
|
|
145
|
+
|
|
146
|
+
|
|
147
|
+
def _scan_firmware(firmware_file: Path, force_string_lookup: bool) -> tuple[list[str], bool]:
|
|
148
|
+
"""Scan a firmware file for fastboot OEM commands"""
|
|
149
|
+
|
|
150
|
+
if force_string_lookup:
|
|
151
|
+
return _find_oem_commands(firmware_file.read_bytes()), True
|
|
152
|
+
|
|
153
|
+
with firmware_file.open("rb") as firmware:
|
|
154
|
+
header = firmware.read(0x50)
|
|
155
|
+
|
|
156
|
+
if header.startswith(BL_MAGIC_PATTERNS[0]):
|
|
157
|
+
logger.info("File contains portable executable magic bytes")
|
|
158
|
+
|
|
159
|
+
commands = _extract_bootloader_pe_files(firmware_file)
|
|
160
|
+
if commands is not None:
|
|
161
|
+
return commands, True
|
|
162
|
+
elif any(header.startswith(pattern) for pattern in BL_MAGIC_PATTERNS[1:]):
|
|
163
|
+
logger.info("File contains common bootloader magic bytes")
|
|
164
|
+
|
|
165
|
+
commands = _find_oem_commands(
|
|
166
|
+
firmware_file.read_bytes(),
|
|
167
|
+
quiet=True
|
|
168
|
+
)
|
|
169
|
+
|
|
170
|
+
if commands:
|
|
171
|
+
return commands, True
|
|
172
|
+
|
|
173
|
+
logger.info("Reading firmware file (first 10MB): %s", firmware_file)
|
|
174
|
+
with firmware_file.open("rb") as firmware:
|
|
175
|
+
input_data = firmware.read(10 * 1024 * 1024)
|
|
176
|
+
|
|
177
|
+
commands = _check_uefi_structure(input_data)
|
|
178
|
+
if commands is not None:
|
|
179
|
+
return commands, True
|
|
180
|
+
|
|
181
|
+
logger.error("Could not recognize the provided firmware file")
|
|
182
|
+
return [], False
|
|
183
|
+
|
|
184
|
+
|
|
185
|
+
def extract_commands(firmware_file: str | Path, force_string_lookup: bool = False) -> list[str] | None:
|
|
186
|
+
"""
|
|
187
|
+
Extract unique 'fastboot oem' commands from a firmware file
|
|
188
|
+
|
|
189
|
+
:param firmware_file: Path to the firmware image.
|
|
190
|
+
:type firmware_file: str | pathlib.Path
|
|
191
|
+
|
|
192
|
+
:param force_string_lookup: Force the oem command string lookup on raw images.
|
|
193
|
+
:type force_string_lookup: bool
|
|
194
|
+
|
|
195
|
+
:returns: A sorted list of command strings when the format is
|
|
196
|
+
recognized; an empty list if no commands are found; or `None` if the format
|
|
197
|
+
is unrecognized and `force_string_lookup` is `False`.
|
|
198
|
+
:rtype: list[str] | None
|
|
199
|
+
:raises OSError: If the firmware file cannot be read.
|
|
200
|
+
"""
|
|
201
|
+
|
|
202
|
+
commands, recognized = _scan_firmware(
|
|
203
|
+
Path(firmware_file),
|
|
204
|
+
force_string_lookup
|
|
205
|
+
)
|
|
206
|
+
|
|
207
|
+
if recognized:
|
|
208
|
+
return commands
|
|
209
|
+
return None
|
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: fastboot-oem-extractor
|
|
3
|
+
Version: 1.0.0
|
|
4
|
+
Summary: Extract hidden "fastboot oem" commands from firmware blobs
|
|
5
|
+
Author-email: chkndrp <chkndrp@gmail.com>
|
|
6
|
+
License-Expression: LGPL-3.0-only
|
|
7
|
+
Project-URL: Repository, https://github.com/chkndrp/fastboot-oem-extractor
|
|
8
|
+
Project-URL: Issues, https://github.com/chkndrp/fastboot-oem-extractor/issues
|
|
9
|
+
Project-URL: Changelog, https://github.com/chkndrp/fastboot-oem-extractor/blob/master/CHANGELOG.md
|
|
10
|
+
Project-URL: Homepage, https://github.com/chkndrp/fastboot-oem-extractor/blob/master/README.md
|
|
11
|
+
Keywords: android,fastboot,oem,extractor,research,uefi,lk,abl,bootloader,cli,library
|
|
12
|
+
Classifier: Programming Language :: Python :: 3
|
|
13
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Intended Audience :: End Users/Desktop
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
18
|
+
Classifier: Topic :: Utilities
|
|
19
|
+
Classifier: Environment :: Console
|
|
20
|
+
Classifier: Typing :: Typed
|
|
21
|
+
Requires-Python: >=3.10
|
|
22
|
+
Description-Content-Type: text/markdown
|
|
23
|
+
License-File: LICENSE
|
|
24
|
+
Requires-Dist: uefi_firmware==1.16
|
|
25
|
+
Provides-Extra: dev
|
|
26
|
+
Requires-Dist: pylint>=4.1.3; extra == "dev"
|
|
27
|
+
Dynamic: license-file
|
|
28
|
+
|
|
29
|
+
# fastboot-oem-extractor
|
|
30
|
+
  
|
|
31
|
+
|
|
32
|
+
Extract hidden "fastboot oem" commands from firmware blobs
|
|
33
|
+
|
|
34
|
+
## Supported firmware
|
|
35
|
+
These firmware blobs will be accepted by this tool
|
|
36
|
+
- `ABL` (Qualcomm)
|
|
37
|
+
- `LK1st, LK2nd` (Qualcomm, Second BLs)
|
|
38
|
+
- `LK` (MediaTek)
|
|
39
|
+
- `FBPK` Containers (Google)
|
|
40
|
+
- `DHTB` Signed binaries (U-Boot)
|
|
41
|
+
- `ELF` Linux binaries
|
|
42
|
+
- Anything else containing UEFI PEs
|
|
43
|
+
|
|
44
|
+
This is an artificial barrier for when this tool is ran in a loop against firmware images
|
|
45
|
+
|
|
46
|
+
## Using as a CLI tool:
|
|
47
|
+
1. Installing:
|
|
48
|
+
```shell
|
|
49
|
+
# With PyPi (recommended)
|
|
50
|
+
pip install fasboot_oem_extractor
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
```shell
|
|
54
|
+
# From source/clone
|
|
55
|
+
pip install -r requirements.txt
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
2. Prepare your firmware images from the internet, or by pulling them off the device with `adb`
|
|
59
|
+
3. Run the installed CLI against the image
|
|
60
|
+
```shell
|
|
61
|
+
# PyPi
|
|
62
|
+
python -m fastboot_oem_extractor ./abl.elf
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
```shell
|
|
66
|
+
# Source/clone
|
|
67
|
+
python ./extractor.py ./abl.elf
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
4. Fetch the output
|
|
71
|
+
```shell
|
|
72
|
+
# Example output for Redmi Note 14 Pro+ 5G (amethyst)
|
|
73
|
+
|
|
74
|
+
(x) File contains common bootloader magic bytes
|
|
75
|
+
(x) Reading firmware file (first 10MB): abl.elf
|
|
76
|
+
(x) Found valid UEFI firmware structure at offset: 0x1000
|
|
77
|
+
(x) Extracting firmware...
|
|
78
|
+
(x) Found 1 UEFI portable executable(s)
|
|
79
|
+
(x) Matching 'oem *' ascii strings
|
|
80
|
+
|
|
81
|
+
fastboot oem allow-wipe-userdata
|
|
82
|
+
fastboot oem audio-framework
|
|
83
|
+
fastboot oem device-info
|
|
84
|
+
fastboot oem disable-charger-screen
|
|
85
|
+
fastboot oem dm-verity-enforcing
|
|
86
|
+
fastboot oem edl
|
|
87
|
+
fastboot oem enable-charger-screen
|
|
88
|
+
fastboot oem fbreason
|
|
89
|
+
fastboot oem getguid
|
|
90
|
+
fastboot oem hwid
|
|
91
|
+
fastboot oem lkmsg
|
|
92
|
+
fastboot oem lock
|
|
93
|
+
fastboot oem lpmsg
|
|
94
|
+
fastboot oem off-mode-charge
|
|
95
|
+
fastboot oem poweroff
|
|
96
|
+
fastboot oem ramdump fat
|
|
97
|
+
fastboot oem select-display-panel
|
|
98
|
+
fastboot oem set-gpu-preemption
|
|
99
|
+
fastboot oem set-hw-fence-value
|
|
100
|
+
fastboot oem uart-enable
|
|
101
|
+
fastboot oem uefilog
|
|
102
|
+
fastboot oem unlock
|
|
103
|
+
```
|
|
104
|
+
|
|
105
|
+
If your file is some sparse image that does not contain any UEFI PEs or common binary magic bytes,
|
|
106
|
+
you can force the string lookup via this command line option:
|
|
107
|
+
```shell
|
|
108
|
+
--force-string-lookup
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
### Using as a Python library
|
|
112
|
+
This project can also be used as a library for other tools that want to integrate this.
|
|
113
|
+
There is one public function:
|
|
114
|
+
|
|
115
|
+
```python
|
|
116
|
+
extract_commands(firmware_file, force_string_lookup=False) -> list[str] | None
|
|
117
|
+
```
|
|
118
|
+
|
|
119
|
+
- `firmware_file` (`str | pathlib.Path`): Path to the firmware image.
|
|
120
|
+
- `force_string_lookup` (`bool`): Force the oem command string lookup on raw images. Defaults to `False`.
|
|
121
|
+
- **Returns:**
|
|
122
|
+
- A sorted list of unique command strings when the format is recognized.
|
|
123
|
+
- An empty list if no commands are found.
|
|
124
|
+
- `None` if the format is unrecognized and `force_string_lookup` is `False`.
|
|
125
|
+
- **Raises:** `OSError` if the file cannot be read.
|
|
126
|
+
|
|
127
|
+
**Quick example:**
|
|
128
|
+
```python
|
|
129
|
+
# from pathlib import Path
|
|
130
|
+
from fastboot_oem_extractor import extract_commands
|
|
131
|
+
|
|
132
|
+
# commands = extract_commands(Path("./abl.elf"))
|
|
133
|
+
commands = extract_commands("./abl.elf")
|
|
134
|
+
|
|
135
|
+
if commands is None:
|
|
136
|
+
print("Unrecognized firmware format.")
|
|
137
|
+
elif commands:
|
|
138
|
+
print(commands)
|
|
139
|
+
# Example output: ['fastboot oem allow-wipe-userdata', ...]
|
|
140
|
+
else:
|
|
141
|
+
print("No OEM commands found.")
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
## Disclaimer:
|
|
145
|
+
Due to the nature of simply matching "oem" strings, the output may contain some invalid commands,
|
|
146
|
+
or commands that don't work after the device is sent out of factory. Keep this in mind
|
|
147
|
+
|
|
148
|
+
Also, some FBPK containers (e.g. `barbret` bootloader) are very difficult to extract
|
|
149
|
+
`oem` commands from, and may not work. Most work just fine though.
|
|
150
|
+
|
|
151
|
+
## Similar project
|
|
152
|
+
If you want to extract bootloader/charging pictures from a `imagefv` partition on your Qualcomm device,
|
|
153
|
+
use my other tool:
|
|
154
|
+
|
|
155
|
+
[chkndrp/imagefv-extractor](https://github.com/chkndrp/imagefv-extractor)
|
|
156
|
+
|
|
157
|
+
## Requirements
|
|
158
|
+
- Python 3.10 or newer
|
|
159
|
+
- Installed `uefi_firmware` pip package
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
LICENSE
|
|
2
|
+
README.md
|
|
3
|
+
pyproject.toml
|
|
4
|
+
src/fastboot_oem_extractor/__init__.py
|
|
5
|
+
src/fastboot_oem_extractor/__main__.py
|
|
6
|
+
src/fastboot_oem_extractor/cli.py
|
|
7
|
+
src/fastboot_oem_extractor/extract.py
|
|
8
|
+
src/fastboot_oem_extractor.egg-info/PKG-INFO
|
|
9
|
+
src/fastboot_oem_extractor.egg-info/SOURCES.txt
|
|
10
|
+
src/fastboot_oem_extractor.egg-info/dependency_links.txt
|
|
11
|
+
src/fastboot_oem_extractor.egg-info/entry_points.txt
|
|
12
|
+
src/fastboot_oem_extractor.egg-info/requires.txt
|
|
13
|
+
src/fastboot_oem_extractor.egg-info/top_level.txt
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
fastboot_oem_extractor
|