Skip to content

Instantly share code, notes, and snippets.

@Skorpion96
Created August 17, 2026 19:47
Show Gist options
  • Select an option

  • Save Skorpion96/09192bd3210570fba06635ca63121bbc to your computer and use it in GitHub Desktop.

Select an option

Save Skorpion96/09192bd3210570fba06635ca63121bbc to your computer and use it in GitHub Desktop.
Root my Galaxy porting steps 1 to 3 auto script (except the stuff requiring the device)
#!/bin/bash
# This aims to automate some of the porting steps of root My Galaxy (the code and commands were taken from the original repo:https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/blob/main/docs/PORTING.md)
read -p "put boot.img.lz4 in the same folder as this script and press [Enter]"
cat > $(pwd)/step1.py<<'EOF'
from pathlib import Path
import lz4.frame
import struct
compressed = Path("boot.img.lz4").read_bytes()
boot = lz4.frame.decompress(compressed)
Path("boot.img").write_bytes(boot)
kernel_size = struct.unpack_from("<I", boot, 0x08)[0]
Path("kernel").write_bytes(boot[0x1000:0x1000 + kernel_size])
EOF
python3 step1.py
git clone --depth=1 --branch add-decompression-script https://github.com/marin-m/vmlinux-to-elf.git
$(pwd)/vmlinux-to-elf/vmlinux_to_elf/main.py $(pwd)/kernel $(pwd)/vmlinux.elf > $(pwd)/kallsyms.txt 2>/dev/null
llvm-nm --numeric-sort vmlinux.elf > vmlinux.nm
cat > $(pwd)/step2.py<<'EOF2'
from pathlib import Path
import struct
image = Path("kernel").read_bytes()
prefix = b"\x9f\xeb\x01\x00"
candidates = []
cursor = 0
while True:
start = image.find(prefix, cursor)
if start < 0:
break
cursor = start + 1
if start + 24 > len(image):
continue
header = struct.unpack_from("<HBBIIIII", image, start)
magic, version, flags, header_len, type_off, type_len, str_off, str_len = header
if magic != 0xEB9F or version != 1 or flags != 0 or header_len < 24:
continue
payload_len = max(type_off + type_len, str_off + str_len)
end = start + header_len + payload_len
string_start = start + header_len + str_off
if end > len(image) or string_start >= end or image[string_start] != 0:
continue
candidates.append((start, end))
if len(candidates) != 1:
raise SystemExit(f"expected one raw BTF blob, found: {candidates}")
start, end = candidates[0]
Path("vmlinux.btf").write_bytes(image[start:end])
print(f"raw BTF: [0x{start:x}, 0x{end:x}) ({end - start} bytes)")
EOF2
delete_temp(){
rm -rf $(pwd)/step1.py
rm -rf $(pwd)/step2.py
rm -rf $(pwd)/vmlinux-to-elf
}
python3 step2.py
if [ ! -e "$(pwd)/vmlinux.btf" ]; then
echo "step 2 failed, your kernel misses BTF, your're out of luck"
delete_temp
exit 0
fi
bpftool btf dump file vmlinux.btf format raw > vmlinux-btf.raw
bpftool btf dump file vmlinux.btf format c > vmlinux-btf.h
echo "continue from https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/blob/main/docs/PORTING.md#4-confirm-physical-load-addresses"
delete_temp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment