Created
August 17, 2026 19:47
-
-
Save Skorpion96/09192bd3210570fba06635ca63121bbc to your computer and use it in GitHub Desktop.
Root my Galaxy porting steps 1 to 3 auto script (except the stuff requiring the device)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # This aims to automate some of the porting steps of root My Galaxy (the code and commands were taken from the original repo:https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/blob/main/docs/PORTING.md) | |
| read -p "put boot.img.lz4 in the same folder as this script and press [Enter]" | |
| cat > $(pwd)/step1.py<<'EOF' | |
| from pathlib import Path | |
| import lz4.frame | |
| import struct | |
| compressed = Path("boot.img.lz4").read_bytes() | |
| boot = lz4.frame.decompress(compressed) | |
| Path("boot.img").write_bytes(boot) | |
| kernel_size = struct.unpack_from("<I", boot, 0x08)[0] | |
| Path("kernel").write_bytes(boot[0x1000:0x1000 + kernel_size]) | |
| EOF | |
| python3 step1.py | |
| git clone --depth=1 --branch add-decompression-script https://github.com/marin-m/vmlinux-to-elf.git | |
| $(pwd)/vmlinux-to-elf/vmlinux_to_elf/main.py $(pwd)/kernel $(pwd)/vmlinux.elf > $(pwd)/kallsyms.txt 2>/dev/null | |
| llvm-nm --numeric-sort vmlinux.elf > vmlinux.nm | |
| cat > $(pwd)/step2.py<<'EOF2' | |
| from pathlib import Path | |
| import struct | |
| image = Path("kernel").read_bytes() | |
| prefix = b"\x9f\xeb\x01\x00" | |
| candidates = [] | |
| cursor = 0 | |
| while True: | |
| start = image.find(prefix, cursor) | |
| if start < 0: | |
| break | |
| cursor = start + 1 | |
| if start + 24 > len(image): | |
| continue | |
| header = struct.unpack_from("<HBBIIIII", image, start) | |
| magic, version, flags, header_len, type_off, type_len, str_off, str_len = header | |
| if magic != 0xEB9F or version != 1 or flags != 0 or header_len < 24: | |
| continue | |
| payload_len = max(type_off + type_len, str_off + str_len) | |
| end = start + header_len + payload_len | |
| string_start = start + header_len + str_off | |
| if end > len(image) or string_start >= end or image[string_start] != 0: | |
| continue | |
| candidates.append((start, end)) | |
| if len(candidates) != 1: | |
| raise SystemExit(f"expected one raw BTF blob, found: {candidates}") | |
| start, end = candidates[0] | |
| Path("vmlinux.btf").write_bytes(image[start:end]) | |
| print(f"raw BTF: [0x{start:x}, 0x{end:x}) ({end - start} bytes)") | |
| EOF2 | |
| delete_temp(){ | |
| rm -rf $(pwd)/step1.py | |
| rm -rf $(pwd)/step2.py | |
| rm -rf $(pwd)/vmlinux-to-elf | |
| } | |
| python3 step2.py | |
| if [ ! -e "$(pwd)/vmlinux.btf" ]; then | |
| echo "step 2 failed, your kernel misses BTF, your're out of luck" | |
| delete_temp | |
| exit 0 | |
| fi | |
| bpftool btf dump file vmlinux.btf format raw > vmlinux-btf.raw | |
| bpftool btf dump file vmlinux.btf format c > vmlinux-btf.h | |
| echo "continue from https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/blob/main/docs/PORTING.md#4-confirm-physical-load-addresses" | |
| delete_temp |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment