下面我們來介紹NEXUS 5 工廠鏡像刷機教程.

一、下載官方最新Android SDK Platform-Tools刷機工具和工廠鏡像

Android SDK Platform-Tools刷機工具官方地址：https://developer.android.com/studio/releases/platform-tools.html
傳送門：
官方鏡像下載地址及教程：https://developers.google.com/android/images

SDK Platform-Tools 是 Android SDK 中的一部分，如果你下載了 Android SDK 的話，就沒必要再另外下載了。它包含adb, fastboot, and systrace等工具，能夠解鎖設備和刷入系統鏡像。
下載SDKPlatform-Tools 後解壓，將解析後的目錄路徑添加到環境變量PATH中，裏面的flash-all腳本會用到這個路徑

二、刷機過程

將下載的官方工廠鏡像解壓。我下載的是Nexus 5 android 4.4.4.r1 鏡像包，對應 hammerhead-ktu84p-factory-1f5f26b1.ZIP ,解壓後看到：

bootloadr:引導程序,用於加載操作系統
raidio-hammerhead.img:基帶固件
imge.zip：操作系統。
flash-base.sh:linux下使用，用於依次刷入bootloader、基帶固件，不刷操作系統。

//flash-base.sh
fastboot flash bootloader bootloader-hammerhead-hhz11k.img
fastboot reboot-bootloader
sleep 5
fastboot flash radio radio-hammerhead-m8974a-2.0.50.1.16.img
fastboot reboot-bootloader
sleep 5

flash-all.bat:windows下使用，依次刷入bootloader、基帶固件、操作系統。

//flash-all.bat
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-hammerhead-hhz11k.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash radio radio-hammerhead-m8974a-2.0.50.1.16.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot -w update image-hammerhead-ktu84p.zip

echo Press any key to exit...
pause >nul
exit

flash-all.sh:linux下使用，依次刷入bootloadr、基帶固件、操作系統。

//flash-all.sh
fastboot flash bootloader bootloader-hammerhead-hhz11k.img
fastboot reboot-bootloader
sleep 5
fastboot flash radio radio-hammerhead-m8974a-2.0.50.1.16.img
fastboot reboot-bootloader
sleep 5
fastboot -w update image-hammerhead-ktu84p.zip

我的是windows操作系統，後面會用到 fast-all.bat。
2. 用USB數據線將設備與電腦相連
3. 以 fast-boot 模式啓動手機。有下面兩種模式，我用的第一種。

    - 使用adb tools:在設備開機情況下，輸入下面的命令：

    adb reboot bootloader

    -  使用組合鍵：  重啓設備，然後立即安下組合鍵。Nexus 5的組合鍵是： 同時按住音量調高鍵和音量調低鍵，然後按住電源鍵

4. 解鎖bootloader .(如果bootloader 鎖定，是無法刷入鏡像的，解鎖會清除數據，務必解鎖前保存數據)

對於新款設備（2015 年及之後發佈的設備）：` $ fastboot flashing unlock`
對於老款設備（2014 年及之前發佈的設備）：` $ fastboot oem unlock`

5.在命令行下進入之前工廠包解壓的目錄，運行該目錄下的fast-all.bat腳本。會依次刷入刷入bootloader、基帶固件、操作系統。之間可能重啓2次進入bootloader。刷機成功後，設備會進入操作系統，腳本會提示退出。整個過程5分鐘不到，比各種刷機助手快多了。下面是刷機過程中bat腳本的提示

target reported max download size of 1073741824 bytes
sending 'bootloader' (2508 KB)...
OKAY [  0.281s]
writing 'bootloader'...
OKAY [  0.479s]
finished. total time: 0.767s
rebooting into bootloader...
OKAY [  0.004s]
finished. total time: 0.005s
sending 'radio' (45409 KB)...
OKAY [  1.610s]
writing 'radio'...
OKAY [  3.112s]
finished. total time: 4.724s
rebooting into bootloader...
OKAY [  0.002s]
finished. total time: 0.003s
archive does not contain 'boot.sig'
archive does not contain 'recovery.sig'
archive does not contain 'system.sig'
archive does not contain 'vendor.img'
Creating filesystem with parameters:
    Size: 29236371456
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 8192
    Inode size: 256
    Journal blocks: 32768
    Label:
    Blocks: 7137786
    Block groups: 218
    Reserved block group size: 1024
Created filesystem with 11/1785856 inodes and 156120/7137786 blocks
Creating filesystem with parameters:
    Size: 734003200
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 7472
    Inode size: 256
    Journal blocks: 2800
    Label:
    Blocks: 179200
    Block groups: 6
    Reserved block group size: 47
Created filesystem with 11/44832 inodes and 5813/179200 blocks
--------------------------------------------
Bootloader Version...: HHZ11k
Baseband Version.....: M8974A-2.0.50.1.16
Serial Number........: 03a784052519107e
--------------------------------------------
checking product...
OKAY [  0.100s]
checking version-bootloader...
OKAY [  0.099s]
checking version-baseband...
OKAY [  0.099s]
sending 'boot' (8700 KB)...
OKAY [  0.490s]
writing 'boot'...
OKAY [  0.741s]
sending 'recovery' (9284 KB)...
OKAY [  0.547s]
writing 'recovery'...
OKAY [  0.775s]
erasing 'system'...
OKAY [  1.031s]
sending 'system' (721400 KB)...
OKAY [ 22.799s]
writing 'system'...
OKAY [ 49.069s]
erasing 'userdata'...
OKAY [ 20.379s]
sending 'userdata' (139109 KB)...
OKAY [  4.565s]
writing 'userdata'...
OKAY [  9.342s]
erasing 'cache'...
OKAY [  0.596s]
sending 'cache' (13348 KB)...
OKAY [  0.627s]
writing 'cache'...
OKAY [  1.068s]
rebooting...

finished. total time: 112.843s
Press any key to exit...

6.。這時如果你想重新鎖定設備的話，可以再次進入fastboot 模式，執行fastboot flashing lock命令,老設備執行：fastboot oem lock命令

三、官方工廠鏡像刷機包目錄解析

下面是刷機包的目錄：

內核鏡像在哪裏呢？，內核鏡像在boot.img中，關於boot.img文件的文件格式，大家可以參看Android內核源碼 system/core/mkbootimg/目中 bootimg.h文件中的定義

#ifndef _BOOT_IMAGE_H_
#define _BOOT_IMAGE_H_

typedef struct boot_img_hdr boot_img_hdr;

#define BOOT_MAGIC "ANDROID!"
#define BOOT_MAGIC_SIZE 8
#define BOOT_NAME_SIZE 16
#define BOOT_ARGS_SIZE 512

struct boot_img_hdr
{
    unsigned char magic[BOOT_MAGIC_SIZE];

    unsigned kernel_size;  /* size in bytes */
    unsigned kernel_addr;  /* physical load addr */

    unsigned ramdisk_size; /* size in bytes */
    unsigned ramdisk_addr; /* physical load addr */

    unsigned second_size;  /* size in bytes */
    unsigned second_addr;  /* physical load addr */

    unsigned tags_addr;    /* physical addr for kernel tags */
    unsigned page_size;    /* flash page size we assume */
    unsigned unused[2];    /* future expansion: should be 0 */

    unsigned char name[BOOT_NAME_SIZE]; /* asciiz product name */

    unsigned char cmdline[BOOT_ARGS_SIZE];

    unsigned id[8]; /* timestamp / checksum / sha1 / etc */
};

/*
** +-----------------+ 
** | boot header     | 1 page
** +-----------------+
** | kernel          | n pages  
** +-----------------+
** | ramdisk         | m pages  
** +-----------------+
** | second stage    | o pages
** +-----------------+
**
** n = (kernel_size + page_size - 1) / page_size
** m = (ramdisk_size + page_size - 1) / page_size
** o = (second_size + page_size - 1) / page_size
**
** 0. all entities are page_size aligned in flash
** 1. kernel and ramdisk are required (size != 0)
** 2. second is optional (second_size == 0 -> no second)
** 3. load each element (kernel, ramdisk, second) at
**    the specified physical address (kernel_addr, etc)
** 4. prepare tags at tag_addr.  kernel_args[] is
**    appended to the kernel commandline in the tags.
** 5. r0 = 0, r1 = MACHINE_TYPE, r2 = tags_addr
** 6. if second_size != 0: jump to second_addr
**    else: jump to kernel_addr
*/

#if 0
typedef struct ptentry ptentry;

struct ptentry {
    char name[16];      /* asciiz partition name    */
    unsigned start;     /* starting block number    */
    unsigned length;    /* length in blocks         */
    unsigned flags;     /* set to zero              */
};

/* MSM Partition Table ATAG
**
** length: 2 + 7 * n
** atag:   0x4d534d70
**         <ptentry> x n
*/
#endif

#endif

倔強石頭

發佈了45 篇原創文章 · 獲贊 31 · 訪問量 12萬+

私信關注

NEXUS 5 工廠鏡像刷機教程及刷機包目錄解析

一、下載官方最新Android SDK Platform-Tools刷機工具和工廠鏡像

二、刷機過程

三、官方工廠鏡像刷機包目錄解析

使用neovim打造go ide(支持代碼跳轉, 代碼補全, 實時語法檢查)

挑戰程序設計競賽 2.3章習題 poj 3046 Ant Counting

Shell/Python中的用戶名獲取

二、Android系統源碼編譯及刷機實戰

密碼學之Padding

Xposed框架的檢測

Android Ptrace 注入

三、Android系統內核編譯及刷機實戰（修改反調試標誌位）

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結