Repack Failed (7TProNR / HD1925) (4.14.190-perf+)

hello, i've tried patching my (already patched) boot.img using APatch Manager, and kptools (both Windows and WSL)

my phone is OnePlus 7T Pro McLaren (HD1925) and kernel is Linux localhost 4.14.190-perf+ #1 SMP PREEMPT Mon May 13 05:22:39 EEST 2024 aarch64 Toybox, and i believe the kernel is in RAW format

this is the log i got from APatch Manager:

APatch Log

Screenshot

****************************
****************************
 APatch Boot Image Patcher
****************************
- Patching kernel
+ ./kptools -p -i kernel.ori -k kpimg -o kernel
[?] kernel image with UNCOMPRESSED_IMG header
[+] kernel image_size: 0x0348e271
[+] kernel uefi header: false
[+] kernel load_offset: 0x00080000
[+] kernel kernel_size: 0x03864000
[+] kernel page_shift: 12
[+] patched kernel image ...
[+] linux_banner 1: Linux version 4.14.190-perf+ (nobody@android-build) (Android
      (10087095, +pgo, +bolt, +lto, -mlgo, based on r487747c) clang version 17.0.2
      (https://android.googlesource.com/toolchain/llvm-project
      d9f89f4d16663d5012e5c09495f3b30ece3d2362), LLD 17.0.2) #1 SMP PREEMPT
      Mon May 13 05:22:39 EEST 2024
[+] linux_banner offset: 0x198000f
[+] kernel version major: 4, minor: 14, patch: 190
[+] kallsyms_token_table offset: 0x0223d000
[+] endian: little
[+] kallsyms_token_index offset: 0x0223d400
[+] arm64 relocation kernel_va: 0xffffff8008080000
[+] arm64 relocation table range: [0x0287a418, 0x02c3a9e8), count: 0x0002803e
[+] apply 0x0002803d relocation entries
[+] kallsyms_markers range: [0x0223be00, 0x0223cfe0), count: 0x0000023b
[+] approximate kallsyms_offsets range: [0x01fbe8f8, 0x0204d608) count: 0x00023b44
[+] kallsyms_names offset: 0x0204d900
[+] kallsyms_num_syms offset: 0x0204d800, value: 0x00023b42
[+] names table linux_banner index: 0x000118a4
[+] linux_banner index: 0
[+] kallsyms_offsets offset: 0x01fbe900
[+] pid_vnr: type: T, offset: 0x0006c168
[+] pid_vnr verfied sp_el0, insn: 0xd5384108
[+] layout kimg: 0x0,0x3052010, kpimg: 0x3053000,0x2c330, extra: 0x307f330,0x80,
      end: 0x307f3b0, start: 0x3864000
[+] kpimg version: d01
[+] kpimg compile time: 09:04:16 Apr 19 2026
[+] kpimg config: android, release
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] no first pac instruction found 
[+] map_start: 0x15ea970, max_size: 0x800
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] Synced NOP modifications from kallsym_kimg to output file (offset: 0x15ea974,
      size: 0x1000)
[+] kallsyms_lookup_name: type: T, offset: 0x0011791c
[+] printk: type: T, offset: 0x000cee5c
[+] memblock_reserve: type: T, offset: 0x001fffec
[+] memblock_free: type: T, offset: 0x001fff58
[+] memblock_mark_nomap: type: T, offset: 0x002002b8
[?] no symbol: memblock_phys_alloc_try_nid
[+] memblock_virt_alloc_try_nid: type: T, offset: 0x027a4b08
[+] memblock_alloc_try_nid: type: T, offset: 0x027a4430
[+] panic: type: T, offset: 0x0003fb8c
[+] rest_init: type: t, offset: 0x017fad48
[+] kernel_init: type: t, offset: 0x017fae24
[?] no symbol: report_cfi_failure
[?] no symbol: __cfi_slowpath_diag
[?] no symbol: __cfi_slowpath
[+] copy_process: type: t, offset: 0x0003c5c8
[+] avc_denied: type: t, offset: 0x0042aa10
[+] slow_avc_audit: type: T, offset: 0x00429b14
[+] input_handle_event: type: t, offset: 0x00ae5154
[+] root_key mode with empty superkey: root_superkey zeroed
[+] paging_init: type: T, offset: 0x02788af0
[+] patch done: kernel
+ patch_rc=0
+ set +x
- Repacking boot image
Segmentation fault
- Successfully Patched!
 Write patched boot.img failed
****************************

and this is what i get on my PC (both native and WSL):

awais@AWAiS:<somePath>/apatch$ ./kptools-linux unpack boot.img
[+] Kernel size: 55108229,Header Version: 2, Offset: 4096
[+] Auto-detect compression method: 0
[+] Treating as Raw Kernel (or unknown format).
[+]  Saved raw kernel to kernel
awais@AWAiS:<somePath>/apatch$ mv kernel kernel-b
awais@AWAiS:<somePath>/apatch$ ./kptools-linux -p --image kernel-b --skey "<NUH-UH>"  --kpimg kpimg-android --out kernel
[?] kernel image with UNCOMPRESSED_IMG header
[+] kernel image_size: 0x0348e271
[+] kernel uefi header: false
[+] kernel load_offset: 0x00080000
[+] kernel kernel_size: 0x03864000
[+] kernel page_shift: 12
[+] patched kernel image ...
[+] linux_banner 1: Linux version 4.14.190-perf+ (nobody@android-build) (Android (10087095, +pgo, +bolt, +lto, -mlgo, based on r487747c) clang version 17.0.2 (https://android.googlesource.com/toolchain/llvm-project d9f89f4d16663d5012e5c09495f3b30ece3d2362), LLD 17.0.2) #1 SMP PREEMPT Mon May 13 05:22:39 EEST 2024
[+] linux_banner offset: 0x198000f
[+] kernel version major: 4, minor: 14, patch: 190
[+] kallsyms_token_table offset: 0x0223d000
[+] endian: little
[+] kallsyms_token_index offset: 0x0223d400
[+] arm64 relocation kernel_va: 0xffffff8008080000
[+] arm64 relocation table range: [0x0287a418, 0x02c3a9e8), count: 0x0002803e
[+] apply 0x0002803d relocation entries
[+] kallsyms_markers range: [0x0223be00, 0x0223cfe0), count: 0x0000023b
[+] approximate kallsyms_offsets range: [0x01fbe8f8, 0x0204d608) count: 0x00023b44
[+] kallsyms_names offset: 0x0204d900
[+] kallsyms_num_syms offset: 0x0204d800, value: 0x00023b42
[+] names table linux_banner index: 0x000118a4
[+] linux_banner index: 0
[+] kallsyms_offsets offset: 0x01fbe900
[+] pid_vnr: type: T, offset: 0x0006c168
[+] pid_vnr verfied sp_el0, insn: 0xd5384108
[+] layout kimg: 0x0,0x3052010, kpimg: 0x3053000,0x2c330, extra: 0x307f330,0x80, end: 0x307f3b0, start: 0x3864000
[+] kpimg version: d01
[+] kpimg compile time: 09:04:16 Apr 19 2026
[+] kpimg config: android, release
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] no first pac instruction found
[+] map_start: 0x15ea970, max_size: 0x800
[+] tcp_init_sock: type: T, offset: 0x015ea974
[+] Synced NOP modifications from kallsym_kimg to output file (offset: 0x15ea974, size: 0x1000)
[+] kallsyms_lookup_name: type: T, offset: 0x0011791c
[+] printk: type: T, offset: 0x000cee5c
[+] memblock_reserve: type: T, offset: 0x001fffec
[+] memblock_free: type: T, offset: 0x001fff58
[+] memblock_mark_nomap: type: T, offset: 0x002002b8
[?] no symbol: memblock_phys_alloc_try_nid
[+] memblock_virt_alloc_try_nid: type: T, offset: 0x027a4b08
[+] memblock_alloc_try_nid: type: T, offset: 0x027a4430
[+] panic: type: T, offset: 0x0003fb8c
[+] rest_init: type: t, offset: 0x017fad48
[+] kernel_init: type: t, offset: 0x017fae24
[?] no symbol: report_cfi_failure
[?] no symbol: __cfi_slowpath_diag
[?] no symbol: __cfi_slowpath
[+] copy_process: type: t, offset: 0x0003c5c8
[+] avc_denied: type: t, offset: 0x0042aa10
[+] slow_avc_audit: type: T, offset: 0x00429b14
[+] input_handle_event: type: t, offset: 0x00ae5154
[+] superkey: <NUH-UH>
[+] paging_init: type: T, offset: 0x02788af0
[+] patch done: kernel
awais@AWAiS:<somePath>/apatch$ ls
boot.img  kernel  kernel-b  kpimg-android  kptools-linux
awais@AWAiS:<somePath>/apatch$ rm bo^C
awais@AWAiS:<somePath>/apatch$ ./kptools-linux repack boot.img
[+]  Starting automatic repack...
[+] Header Version: 2, Page Size: 4096, fmt_size: 1712111
[+] Detected DTB appended to kernel. Size: 4255633
[+] Final kernel size after compression (if applied): 50852804 bytes
[+] Rest data size: 45547520 bytes, Actual used size: 5968552 bytes

i tried reading my boot.img in a hex editor, here are some variables i found

header{
id[8] = 44 D6 B1 A2 37 C4 3B AA EB 7B CA B1 99 C4 C6 CA 1A A3 71 BC 00 00 00 00 00 00 00 00 00 00 00 00
unused[2] = 02 00 00 00 81 01 00 1C
}

and looking at the code bootimg.c#L893 and bootimg.c#L934, i figured it's probably crashing somewhere between sha1_init(&ctx); and tools_logi("second_size=%d,offset=%d\n",hdr.second_size, checksum_aligned+rest_data_offset);

because
uint32_t use_sha256 = is_sha256(hdr.id); → uint32_t use_sha256 = 0;
int len = use_sha256 ? SHA256_BLOCK_SIZE : SHA1_BLOCK_SIZE; → int len = SHA1_BLOCK_SIZE; → int len = 64;
if (use_sha256 != 1 || header_ver <= 3) {...} → if (0 != 1 || 2 <= 3) {...} → if (true || true) {...}

some debugging info from gdb:

(gdb) run repack boot.img
Starting program: C:\Users\AWAiS\Desktop\release\release\apatch\kptools.exe repack boot.img
[New Thread 9248.0x380c]
[New Thread 9248.0x4024]
[New Thread 9248.0x1cd4]
[+]  Starting automatic repack...
[+] Header Version: 2, Page Size: 4096, fmt_size: 2626695
[+] Detected DTB appended to kernel. Size: 4255633
[+] Final kernel size after compression (if applied): 50852804 bytes
[+] Rest data size: 45547520 bytes, Actual used size: 6886056 bytes
[+]    [AWAiS_DEBUG] use_sha256: 0 -- len: 64
[+]    [AWAiS_DEBUG] sha1_init
[+]    [AWAiS_DEBUG] SHA1_CTX 1 -- final_k_buf: 85 -- hdr.kernel_size: 55108437
[+]       [AWAiS_DEBUG] start i =           64 -- len :     55108437
[+]       [AWAiS_DEBUG] next i =     50855616 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855680 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855744 -- data[i]:     55108437
[+]       [AWAiS_DEBUG] next i =     50855808 -- data[i]:     55108437

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
65                              if (i >= 50855600) tools_logi("      [AWAiS_DEBUG] next i = %12d -- data[i]: %12d\n", i, len, data[i]);
(gdb) bt
#0  0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
#1  0x00007ff65fe40d30 in repack_bootimg (orig_boot_path=0xb03e00 "boot.img", new_kernel_path=0x7ff65fed8417 <__func__.2+2135> "kernel",
    out_boot_path=0x7ff65fed840a <__func__.2+2122> "new-boot.img") at bootimg.c:946
#2  0x00007ff65fe3547e in main (argc=3, argv=0xb03d40) at kptools.c:88
(gdb) bt
#0  0x00007ff65febbae4 in sha1_update (ctx=0x5ff180, data=0xf18040 "UNCOMPRESSED_IMG░≤\a\003", len=55108437) at lib/sha/sha1.c:65
#1  0x00007ff65fe40d30 in repack_bootimg (orig_boot_path=0xb03e00 "boot.img", new_kernel_path=0x7ff65fed8417 <__func__.2+2135> "kernel",
    out_boot_path=0x7ff65fed840a <__func__.2+2122> "new-boot.img") at bootimg.c:946
#2  0x00007ff65fe3547e in main (argc=3, argv=0xb03d40) at kptools.c:88

Navigation Menu

Repository navigation

Repack Failed (7TProNR / HD1925) (4.14.190-perf+) #260

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Repack Failed (7TProNR / HD1925) (4.14.190-perf+) #260

Description

Activity

AwaisKing commented on Apr 20, 2026

AwaisKing commented on Apr 20, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions