Just boot a patched lk.bin?

[pewterbrass]

Does anyone know how to just get mtkclient to boot an lk.bin extracted previously from the device (and manually patched)?
I want to patch something in my Samsung SM-A125F LK and see if it allows me to boot custom boot.img to get root in semi-tethered mode.

I've tried to figure it out by studying the python scripts, but it's not obvious how to avoid the functionality that patches the preloader to run as a server for mtkclient instead.

It would also work if I could be able to boot a manually patched preloader.bin, then I can get it to just load a patched lk partition without checking the signature.

Basically I want to be able to get mtkclient to just run dynamically loaded code without getting stuck in Download mode or charging mode or similar.

[pewterbrass]

Well, I almost got it working using mtk plstage and patching a missed argument in mtk_main.py, but unfortunately the "startpartition" command doesn't run since the preloader doesn't get the da server patches.

[DavidBuchanan314]

Did you make any progress with this? It's something I'm trying to figure out, too. (although on mtk6765)

[DavidBuchanan314]

A potential idea I have is to bundle together Preloader and LK into a single binary, and send it as a custom Preloader, with code patched into preloader to memcpy LK into place after DRAM has been initialised (rather than loading from emmc).

The question is whether there's enough room in SRAM for a whole copy of LK. Maybe?

[DavidBuchanan314]

Ok I figured it out. I built a custom DA image from scratch, which includes logic to patch LK and then continue the boot process like normal. My implementation involves manually found offsets for now, but I might evolve it into something more portable. Watch this space! https://github.com/DavidBuchanan314/rabbit_r1_boot_notes/blob/main/scripts/custom_da/main.c

My next mission is to turn LK patching into boot image patching (custom ramdisk cpio in particular)

[rassular]

Could this allow us to boot images over USB when the UFS/eMMC is absent or completely dead? Would be great to save some devices this way without have to use UART