How to rebuild a Samsung Galaxy S zImage

A friend of mine asked if I could fix his Galaxy S for him. After starting it up and poking around I discovered that the build in flash storage was dead. Since that storage shows up to the system as a SD card, and theres a space for an external SD card, I figured I’d just change some stuff in fstab and be done with it.

It’s a UNIX system, I know this. Right?

Not right.

Unfortunately Android doesn’t store it’s mounts in fstab. No, they’re hardcoded into the init scripts. So change the init scripts and be done with it.

Nope.

The init scripts are stored in the initrd, which is tacked onto the end of the kernel image in a proprietary Samsungy way. So no standard Android tools will extract it so I can modify it. Of course…

But there is still hope! Fortunately someone has already figured everything out and posted their tools online here.

Using this and the cross compiler found here (I had to modify the kernel repack utils to use this since it’s a different version than they were built for. If you’re getting this far that shouldn’t be a problem for you.) I was able to extract the initrd, modify it to change the device paths, and rebuild the kernel image. Once I had the rebuilt kernel image I flashed it to the phone, as I’ll go into below:

Downloading/installing the kernel

You’ll need a SD card with two MBR FAT32 partitions, the first one should fill most of the card, you can use it for general storage as you would a normal SD card, the second should be about 2-4GB big for the Android /data partition.

I uploaded the custom image I made so that nobody else has to go through this pain.

Download
Mirror

This kernel is for the XXJW4 firmwares, if you aren’t already running one you need to be on it for it to work. The exact firmware I’m running is available here “(mirror)”:http://terafile.co/268887f61345/XEU-I9000XXJW4-20120405163836.zip but any XXJW4 firmware should work. Google can help you find/install one.

I installed it with Heimdall with the following command:

heimdall flash --KERNEL zImage.new

From within the directory with the zImage.new file you downloaded above. You need to be in download mode (once again, google is your friend) for this obviously.

Once you reboot, your phone should come up like new, but now all storage is on the external SD card. Obviously, this card needs to remain in the phone at all times.

While this guide was tested on a Mushkin IO drive, it should work on any Indilinx Barefoot based SSD. Let me know your results in the comments. Note that you must have a drive that shows up as a “Yatapdong Barefoot ROM” when the factory diagnostic or “technological mode” jumper (right next to the SATA connector) is set or this most likely wont work for you.

1. Download the Indilinx MPTool from Here or Here and install it.
2. Set the factory diagnostic or “technological mode” jumper (right next to the SATA connector).
3. Set your SATA controller to IDE or Compatibly mode.
4. Boot into Windows and open up MPTool, if you’re running Vista, 7 or 8 you need to run it as an administrator.
5. Your drive should show up in the list of drives on the lower half, make sure it’s selected.
6. Set the Serial Number to random, you can change the Model Number if you don’t want it to show up as a SuperTalent SSD, doesn’t matter.
7. Go to the Flash tab and check Auto Detection.
8. Hit the Start button. It should pop up a black console window and run for a few minutes, spitting out a bunch of text. Sometimes it will fail right away (within the first 10-20 seconds), just hit start again and it should run.
9. It will tell you to remove the jumper. Remove the jumper, without disconnecting the drive.
10. It’ll sit there for a few more minutes, then the console window should disappear and it should say FINISH next to your drive. Congratulations, your drive should be working now and Windows should start detecting it. As a bonus, your drive is also running the newest firmware release for the Indilinx controller.

After doing this you won’t be able to upgrade or flash your drive using any of the Mushkin (or any other manufacturer) tools, only MPTool. However, since you’re at the last firmware version to be released for this controller, thats probably not a problem.

After some trial and error with URLs I figured out the download links for the Linux packages for 6.2.2 (The last version to work on older cards) you can find them below.

GE 6.2.2 64bit .deb for Debian/Ubuntu

GE 6.2.2 32bit .deb for Debian/Ubuntu

GE 6.2.2 64bit .rpm for Fedora/CentOS/RHEL

GE 6.2.2 32bit .rpm for Fedora/CentOS/RHEL

These should work fine on older video cards.

Older versions of Google Earth Pro can be downloaded from Here.

Right click on the Music folder on your old iDevice and click export and save the file somewhere, then click File -> Library -> Import Playlist and open the file you created earlier. You might need to make sure you select a local playlist before importing so it doesn’t import to your phone, but I’m not sure on that.

You can now sync your new playlist with your new phone and get all the songs you had on the old one.

Googling turned up nothing but the solution is dirt simple: Right click on iTunes and run as an administrator.

Also, if you have MacDrive installed you probably need to disable it or you’ll get a “The iPod can not be restored because it contains files that are in use by another application.” error.

Edit: Ok, running stock 4.2.1 everything works exactly the same as it did in all previous versions of Xcode 4. You just need to add armv6 as a target, use GDB instead of LLVM for debugging and set the deployment target to iOS 4.2 (For iPhone 3g, 3.1.3 for 2g). Armv6 works just peachy, it’s just not the default option anymore.

Those guides are great and I build off of them for mine. I’ve used both methods with older versions of Xcode with great success. But neither would work for me in newer versions of Xcode. Fortunately I found another way. An easier way. A way with debugging support. A better way :)

A way that works in Xcode 4.3.2 and possibly newer:

1. Obviously we’re gonna need a computer with Xcode and a Jailbroken iDevice.

2. On the computer you need to create a code signing certificate. Open Keychain Access, click the Keychain Access menu and open the Certificate Assistant -> Create a Certificate. Create a “Self Signed Root” “Code Signing” certificate named “iPhone Developer”.

3. On that jailbroken iDevice you’re going to need to install AppSync.

Installing AppSync is simple:
Add the source http://cydia.hackulo.us to your Cydia sources. Cydia will give you a warning, because pirates use AppSync. You aren’t going to be doing that I hope, ignore the warning.

Install AppSync for whatever iOS version you run from Cydia.

1. Open /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Info.plist
   in whatever editor you use and replace all occurrences of XCiPhoneOSCodeSignContext with XCCodeSignContext.

2. In your project in Xcode go to your Target settings -> Summary and scroll to the bottom. Enable Entitlements. Xcode should automatically create and Entitlements file. Add a new row named “get-task-allow” of the boolean type with a value of YES. Make sure this row is all the way left and not part of the keychain-access-groups array. You’ll have to do this on every project, but it’s not much.

3. Everything should be working now. You may need to use GDB as your debugger to get debugging working, this can be done in Project -> Edit Scheme.

I’m writing most of this from memory so comment if you have any problems along the way. Also I’ve only been able to test on iOS 3.1.3 devices so far, on account of that being all I have available.

EDIT: This should also work for Windows 7 and possibly 8 (Haven’t tried). You may need to boot with signature checking disabled.

Heres the kernel panic, for people googling this:

Sun Feb  8 20:09:21 2009 panic(cpu 0 caller 0x002232C6): “rtunref: bad refcnt 0 for rt=0x132fe690\\n”@/SourceCache/xnu/xnu-1228.9.59/bsd/net/route.c:460 Backtrace (CPU 0), Frame : Return Address (4 potential args on stack) 0x5b467dc8 : 0x12b4f3 (0x45b13c 0x5b467dfc 0x1335e4 0x0)  0x5b467e18 : 0x2232c6 (0x473df8 0x0 0x132fe690 0x1a336f)  0x5b467e38 : 0x2237ba (0x132fe690 0x1 0x0 0x0)  0x5b467e68 : 0x224a66 (0x132fe690 0x2 0x5b467e98 0x13b3ba4c)  0x5b467e88 : 0x273cfd (0x132fe690 0xffff 0x1 0x3aa793)  0x5b467eb8 : 0x24adb9 (0x13b3ba4c 0x6d76080 0xde 0x1a0420)  0x5b467f18 : 0x24ccba (0x13b3bb2c 0x2 0x1 0x24eb3f)  0x5b467f58 : 0x39befb (0x6d763a0 0x23ac6252 0x5b467f78 0x1a336f)  0x5b467f78 : 0x13eed2 (0x0 0x0 0x0 0xbfffedc0)  0x5b467fc8 : 0x1a017c (0x0 0x0 0x1a30b5 0x74ea2e8)  Backtrace terminated-invalid frame pointer 0   BSD process name corresponding to current thread: kernel\_task   Mac OS version: 9G55   Kernel version: Darwin Kernel Version 9.6.0: Mon Nov 24 17:37:00 PST 2008; root:xnu-1228.9.59~1/RELEASE\_I386 System model name: MacBookPro3,1 (Mac-F4238BC8)