LiveSuit images

Overview
All sunxi devices use LiveSuit as a default flasher and updater for retail customer and PhoenixCard or PhoenixUSB for flashing when devices are manufactured. LiveSuit/Phoenix protocol and data are closed-source standrad used by many companies and devices. To decrypt/unpack firmware you need unpacker and 3 keys. These keys are same across all sunxi devices and can be different on other brands (SoChip, Rockchip and others). Keys are usually shipped with firmware as .key file.

Software

 * Linux
 * No tools available now, but there is a work going on about making tools from RedScorpio work on linux. This will be closed-source release, only binary will be shared.


 * Windows
 * RedScorpio tools
 * RedScorpio tools are two utilities: imagerepacker, which unpacks, decrypts and packs back firmwares and imgdecoder for SoChip images, that have slightly different layout.
 * Download: http://forum.xda-developers.com/showthread.php?p=28329544#post28329544
 * usage is:
 * unpack image and decrypt:

imgrepacker.exe image.img
 * repack image:

imgrepacker.exe image.img.dump
 * Here is standard output from imgrepacker.exe unpacking official LY-F1 firmware:

=
=============[ START ]========================== --- Firmware unpacking --- File "F1中性20120529.0.6.5-a721_v4.2.img"    was read BasePath.txt saved - image.cfg creating - image.cfg created - Files extracting - "out/sys_config.fex"           extracted "out/sys_config1.fex"          extracted "out/split_xxxx.fex"           extracted "out/bootloader.fex"           extracted bootloader.fex.iso             created "out/env.fex"          extracted env.fex.iso            created "out/boot.fex"         extracted boot.fex.iso           created "out/system.fex"               extracted system.fex.iso         created "out/recovery.fex"             extracted recovery.fex.iso               created "out/oem.fex"          extracted oem.fex.iso            created "out/diskfs.fex"               extracted diskfs.fex.iso         created "out/vbootloader.fex"          extracted "out/venv.fex"         extracted "out/vboot.fex"        extracted "out/vsystem.fex"              extracted "out/vrecovery.fex"            extracted "out/voem.fex"         extracted "out/boot0.bin"        decrypted "out/boot1.bin"        decrypted "eFex//usb//tools.fex"         extracted "eFex//usb//fes_1-1.fex"               extracted "eFex//usb//fes_1-2.fex"               extracted "eFex//usb//fes_2.fex"         extracted "eFex//usb//fes.fex"           extracted "eFex//usb//HW_scan.axf"               decrypted "eFex//usb//update_boot0.axf"          decrypted "eFex//usb//update_boot1.axf"          decrypted "eFex//usb//fet_restore.axf"           decrypted "eFex//usb//magic_cr_start.fex"        extracted "eFex//usb//magic_cr_end.fex"          extracted "eFex//usb//magic_de_start.fex"        extracted "eFex//usb//magic_de_end.fex"          extracted "eFex//usb//fed_nand.axf"              decrypted "eFex//card//cardtool.fex"             extracted "eFex//card//cardscript.fex"           extracted "out/card_boot0.fex"           extracted "out/card_boot1.fex"           extracted "out/mbr.fex"          extracted "out/dlinfo.fex"               extracted "eFex//usb//card_update_boot0.axf"             decrypted "eFex//usb//card_update_boot1.axf"             decrypted "eFex//usb//fed_card.axf"              decrypted "eFex//usb//card_HW_scan.axf"          decrypted - Filelist.txt creating - Filelist.txt created ==========================[ STOP ]==========================
 * How you can see, unpacker creates .fex files for partitions, sys_config and eFex, which is hardware flasher (you can see eFex ASCII logo if you connect UART to UART0 port).
 * List of extracted data is in Filelist.txt, this file will be read if you want to repack image back to firmware after modifying.


 * esxgx
 * Also known as unimg.exe. Unpacker/Packer from esxgx http://forum.xda-developers.com/member.php?u=4494128, shipped with AllWinner image package, SztupY A10 android kitchen http://forum.xda-developers.com/showthread.php?t=1490886 and other kitchens. Default used by XDA sunxi guys.
 * This is closed-source flasher without any documentation, this flasher creates weird file names like 12345678_1234567890script.fex and can crash on every wrong move, but you can use it if you just want to repack android for sunxi tablet.


 * The following text describes the result from unpacking an Android ICS image.
 * It is interpreted with the help from this thread:
 * http://www.slatedroid.com/topic/28942-50-to-the-first-person-to-figure-this-out/

The Vxxxxxxxx files are for verification purposes. Note that filenames contain spaces the notation is like: "    "

COMMON  	SYS_CONFIG000000 COMMON  	SYS_CONFIG100000

Text file used as a command bunch for LiveSuite. It tells the app how to flash, what to flash and where, and it configures the device too (screen size, ram info, cpu info, etc). SYS_CONFIG1 is the old one.

COMMON  	SPLIT_0000000000

??

RFSFAT16 	BOOTLOADER_00000.fex

FAT16 image containing the u-boot binary. Use MagicISO (or any other ISO managing app) to open. In Linux do: sudo mount -o loop -t vfat RFSFAT16_BOOTLOADER_00000.fex bootloader

RFSFAT16 	ENVIROMENT_00000

u-boot's boot parameters, DO NOT MODIFY

RFSFAT16 	BOOT_00000000000

Standard Android boot image (boot.img) (2K header,gzipped kernel, initrd gzipped cpio archive, optional second stage loader is not present) More to read here: http://forum.xda-developers.com/showthread.php?t=443994

RFSFAT16	SYSTEM_000000000.fex

Standard Android sparse ext4 image with the /system file structure.(system.img) Use simg2img to make it into an ext4 image that can be loop mounted!

RFSFAT16 	RECOVERY_0000000

Sparse ext4 containing a standard Android recovery image. Use simg2img to make it into an ext4 image that can be loop mounted!

RFSFAT16 	DISKFS_000000000

ext4 image containing the the initram (init.rc, default.prop, initlogo, etc), it is empty in this example.

BOOT    	BOOT0_0000000000 BOOT    	BOOT1_0000000000

These are bootloaders to be put in nand. Boot0 is the SPL - Second Program Loader (sun4i-spl.bin when uboot is built from source) Boot1 is the U-boot!

PXTOOLS 	xxxxxxxxxxxxxxxx

FES     		FES_1-1000000000 FES     		FES_1-2000000000 FES     		FES_200000000000 FES     		FES_000000000000 FET     		HW_SCAN_00000000 FET     		UPDATE_BOOT0_000 FET    		UPDATE_BOOT1_000 FET    		FET_RESTORE_0000 FET     		MAGIC_CRC_START_ FET     		MAGIC_CRC_EN_000 FET     		MAGIC_DE_START_0 FET     		MAGIC_DE_END_000 FED    		FED_NAND_0000000 FET     		CARD_UPDATE_BOT0 FET     		CARD_UPDATE_BOT1 FED     		CARD_FED_0000000 FET     		CARD_HW_SCAN_000

These are tools are NAND flashing utilities, checksums, hardware scanner, and other tools used during flashing.

12345678 	1234567890cardtl 12345678 	1234567890script 12345678 	1234567890boot_0 12345678 	1234567890boot_1 2345678 	1234567890___mbr 12345678 	1234567890dlinfo

These are bootloaders, config files, and tools for SDMMC flashing, if there's a device with SDMMC internal instead of NAND, these are used!