康佳电视led55k35u刷机（root康佳电视升级包LED37R5200PDF）

配 置：

电视型号：LED37R5200PDF，6a800c

升级包版本：v1.0.15

主芯片：Mstar， Cortex A9

虽然电视比较旧，但原理相通。

先解包MstarUpgrade.bin：

先下载解包工具mstar-bin-tool

命令：

unpack.py MstarUpgrade.bin

或

python unpack.py MstarUpgrade.bin

C:\tmp\mstar-bin-tool-master>python unpack.py MstarUpgrade.bin [i] Analizing header ... [i] Saving header script to unpacked\~header_script ... [i] Parsing script ... [i] Partition: recovery Offset: 4000 Size 5d0fec (5.82 MB) -> unpacked\recovery.img [i] Partition: boot Offset: a04000 Size 3834a2 (3.51 MB) -> unpacked\boot.img [i] Partition: system Offset: e04000 Size 6400000 (100.0 MB) append to unpacked\system.img [i] Partition: system Offset: 7204000 Size 6400000 (100.0 MB) append to unpacked\system.img [i] Partition: system Offset: d604000 Size 6400000 (100.0 MB) append to unpacked\system.img [i] Partition: system Offset: 13a04000 Size 6400000 (100.0 MB) append to unpacked\system.img [i] Partition: userdata Offset: 19e04000 Size 3aa082 (3.66 MB) -> unpacked\userdata.lzo [i] Unpacking LZO (Please be patient) unpacked\userdata.lzo -> unpacked\userdata.img [i] Partition: cache Offset: 1a1b4000 Size 13467b (1.2 MB) -> unpacked\cache.lzo [i] Unpacking LZO (Please be patient) unpacked\cache.lzo -> unpacked\cache.img [i] Partition: tvservice Offset: 1a2f4000 Size 5000000 (80.0 MB) -> unpacked\tvservice.img [i] Partition: tvcustomer Offset: 1f2f4000 Size 1000000 (16.0 MB) -> unpacked\tvcustomer.img [i] Partition: tvdatabase Offset: 202f4000 Size 800000 (8.0 MB) -> unpacked\tvdatabase.img [i] Partition: customercfg Offset: 20af4000 Size 800000 (8.0 MB) -> unpacked\customercfg.img [i] Parsing setenv MIU0_GROUP_SELMIU -> 0000:0000:0000:0000 [i] Parsing setenv MIU1_GROUP_SELMIU -> 4E00:0000:0000:0100 [i] Parsing setenv MS_MEM -> LX_MEM=0x9600000 EMAC_MEM=0x100000 DRAM_LEN=0x20000000 LX_MEM2=0x50E00000,0xD900000 LX_MEM3=0xB0000000,0x0000000 [i] Parsing setenv root -> root=/dev/ram rw rootwait [i] Parsing setenv bootargs -> console=ttyS0,115200 androidboot.console=ttyS0 $(ROOT) init=/init $(MS_MEM) [i] Parsing setenv MstarUpgrade_complete -> 1 [i] Parsing setenv upgrade_mode -> 0 [i] Parsing setenv db_table -> 0 [i] Parsing setenv verify -> n [i] Parsing setenv filesize -> 3834a2 [i] Parsing setenv bootcmd -> mmc read.p 0x45000000 boot 0x400000\; bootm 0x45000000 [i] Parsing setenv MstarUpgrade_complete -> 1

解包后的文件：

头部脚本（header_script）:

里面有升级的配置文件和一系列的mmc命令

自动读取、执行这些命令完成升级

（命令、原理在另一文章中说明 ）

mmc slc 0 1 mmc rmgpt mmc create misc 0x00080000 mmc create recovery 0x00A00000 mmc create boot 0x00400000 mmc create system 0x019000000 mmc create userdata 0x32000000 mmc create cache 0x12C00000 mmc create tvservice 0x05000000 mmc create tvcustomer 0x01000000 mmc create tvdatabase 0x00800000 mmc create customercfg 0x00800000 filepartload 50000000 MstarUpgrade.bin 4000 5d0fec mmc erase.p recovery mmc write.p 50000000 recovery 5d0fec 1 filepartload 50000000 MstarUpgrade.bin a04000 3834a2 mmc erase.p boot mmc write.p 50000000 boot 3834a2 1 mmc erase.p system filepartload 50000000 MstarUpgrade.bin e04000 6400000 mmc write.p.continue 50000000 system 0 6400000 1 filepartload 50000000 MstarUpgrade.bin 7204000 6400000 mmc write.p.continue 50000000 system 32000 6400000 1 filepartload 50000000 MstarUpgrade.bin d604000 6400000 mmc write.p.continue 50000000 system 64000 6400000 1 filepartload 50000000 MstarUpgrade.bin 13a04000 6400000 mmc write.p.continue 50000000 system 96000 6400000 1 filepartload 50000000 MstarUpgrade.bin 19e04000 3aa082 mmc erase.p userdata mmc unlzo 50000000 3aa082 userdata 1 filepartload 50000000 MstarUpgrade.bin 1a1b4000 13467b mmc erase.p cache mmc unlzo 50000000 13467b cache 1 filepartload 50000000 MstarUpgrade.bin 1a2f4000 5000000 mmc erase.p tvservice mmc write.p 50000000 tvservice 5000000 1 filepartload 50000000 MstarUpgrade.bin 1f2f4000 1000000 mmc erase.p tvcustomer mmc write.p 50000000 tvcustomer 1000000 1 filepartload 50000000 MstarUpgrade.bin 202f4000 800000 mmc erase.p tvdatabase mmc write.p 50000000 tvdatabase 800000 1 filepartload 50000000 MstarUpgrade.bin 20af4000 800000 mmc erase.p customercfg mmc write.p 50000000 customercfg 800000 1 setenv MIU0_GROUP_SELMIU 0000:0000:0000:0000 setenv MIU1_GROUP_SELMIU 4E00:0000:0000:0100 setenv MS_MEM LX_MEM=0x9600000 EMAC_MEM=0x100000 DRAM_LEN=0x20000000 LX_MEM2=0x50E00000,0xD900000 LX_MEM3=0xB0000000,0x0000000 setenv ROOT root=/dev/ram rw rootwait setenv bootargs console=ttyS0,115200 androidboot.console=ttyS0 $(ROOT) init=/init $(MS_MEM) setenv MstarUpgrade_complete 1 setenv upgrade_mode 0 setenv db_table 0 setenv verify n saveenv setenv filesize 3834a2 setenv bootcmd mmc read.p 0x45000000 boot 0x400000\; bootm 0x45000000 printenv setenv MstarUpgrade_complete 1 saveenv printenv % <-this is end of file symbol

这里主要对system.img进行修改、优化：

方法一：

用ROM助手打开system.img：

ROM编辑 - APK精简

这里列举出了系统内的所有app

勾选需要删除的

编辑权限：

1、在此可以修改文件或文件夹属性

2、添加新的文件或文件夹

此时可以将root用到的su(system/bin), superuser.apk(system/app)等文件放入相应的位置

点击“开始封装” ：自动产生一个新的system.img

如果是增加app时需要注意system分区的剩余空间，不能超出：

方法二：在linux系统（如ubuntu)中挂载后修改命令：sudo mount -rw -t ext4 system.img sys

biren@ubuntu:~/downloads/new$ mkdir -p sys biren@ubuntu:~/downloads/new$ sudo mount -rw -t ext4 system.img sys

查看system.img内容：

biren@ubuntu:~/downloads/new/sys$ ll total 60 drwxr-xr-x 13 root root 4096 Jan 1 1970 ./ drwxrwxr-x 4 biren biren 4096 Jun 9 20:41 ../ drwxr-xr-x 2 root root 4096 Dec 16 2012 app/ drwxr-xr-x 2 root 2000 4096 Dec 16 2012 bin/ -rw-r--r-- 1 root root 1979 Dec 16 2012 build.prop drwxr-xr-x 9 root root 4096 Dec 16 2012 etc/ drwxr-xr-x 2 root root 4096 Dec 16 2012 fonts/ drwxr-xr-x 2 root root 4096 Dec 16 2012 framework/ drwxr-xr-x 8 root root 8192 Dec 16 2012 lib/ drwxr-xr-x 3 root root 4096 Dec 16 2012 media/ drwxr-xr-x 3 root root 4096 Dec 16 2012 tts/ drwxr-xr-x 8 root root 4096 Dec 16 2012 usr/ drwxr-xr-x 3 root 2000 4096 Dec 16 2012 vendor/ drwxr-xr-x 2 root 2000 4096 Dec 16 2012 xbin/

修改。。。。。。退出挂载:

biren@ubuntu:~/downloads/new$ sudo umount sys

用新的system.img替换MstarUpgrade.bin中原来的位置：

查看头脚本（Header_script）：知道system.img在MstarUpgrade.bin的位置从e04000（含）到19e04000（不含）

用WinHex分别打开新的system.img及原MstarUpgrade.bin :复制system.img所有二进制数据：

光标定位到MstarUpgrade.bin的e04000地址处编辑 - 剪贴板数据 - 写入

保存数据。

更新到电视：

将MstarUpgrade.bin存入小于8G的U盘（fat32）根目录内按住控制器上的开关机键不放打开电视上的电源等电源指示灯一闪一闪表示正在写入数据。。。写完后自动重启。

,