HTC ruu 解密 工具编译 提取解密key 自行解密 流程记录

熟悉ruuveal的同学自然熟悉本文

编译ruuveal工具：

下载源码:
https://github.com/kmdm/ruuveal/

编译流程

1) sudo apt-get install libmcrypt-dev automake autoconf libtool libssl-dev

       没有安装libmcrypt-dev的话，会报错诸如"`AM_PATH_LIBMCRYPT' not found". 

2) bash autogen.sh

3) ./configure ; make

开始解密

1.以上完成之后，拷贝bruutveal和ruuveal到需要解密的ruu目录中，从*partial_2.zip中提取hboot*.img存同一目录，如下：

ENC.zip为重命名的待解密ruu*.zip

drwxrwxrwx 1 root root       4096  8月 13 17:55 .drwxrwxrwx 1 root root       4096  8月 13 17:19 ..-rwxrwxrwx 1 root root      71282  8月 13 17:49 bruutveal-rwxrwxrwx 1 root root 1033315456  6月 16 18:48 ENC.zip-rwxrwxrwx 1 root root    2096384  3月 19 16:54 hboot_signedbyaa.img-rwxrwxrwx 1 root root      71931  8月 13 17:49 ruuveal

2.获取解密key，名称可以自己重命名

kyle@Linux-dev:/mnt/hgfs/D/a5dug$ <strong>./bruutveal hboot_signedbyaa.img ENC.ZIP hboot_signedbyaa.bin</strong>bruutveal---------Large zip format detected containing 6 zipfile(s)SUCCESS!rcing key[loop 1]: 795820/2096384....Successful bruutveal run, key written to: hboot_signedbyaa.bin

3.解密

kyle@Linux-dev:/mnt/hgfs/D/a5dug$ <strong>./ruuveal -K hboot_signedbyaa.bin ENC.ZIP X1.zip</strong>ruuveal-------Large zip format detected containing 6 zipfile(s)Decrypted RUU (zip) written to: 01_X1.zipDecrypted RUU (zip) written to: 02_X1.zipDecrypted RUU (zip) written to: 03_X1.zipDecrypted RUU (zip) written to: 04_X1.zipDecrypted RUU (zip) written to: 05_X1.zipDecrypted RUU (zip) written to: 06_X1.zip

4.验证压缩文件俺

kyle@Linux-dev:/mnt/hgfs/D/a5dug$ <strong>unzip -t '*_X1.zip'</strong>Archive:  01_X1.zip    testing: android-info.txt         OK    testing: hboot_signedbyaa.img     OK    testing: radio.img                OK    testing: rcdata.img               OK    testing: splash1.nb0              OK    testing: tz.img                   OK    testing: rpm.img                  OK    testing: adsp.img                 OK    testing: pg2fs_spcustom.img       OK    testing: wcnss.img                OK    testing: ramdisk.img              OK    testing: sdi.img                  OK    testing: emmc_appsboot.mbn        OK    testing: persist.img              OK    testing: dt.img                   OK    testing: bootloader               OK    testing: sbl1-8928-1.img          OK    testing: sbl1-8628-1.img          OK    testing: sbl1-8926-1.img          OK    testing: sbl1-8228-1.img          OK    testing: recovery_signed.img      OKNo errors detected in compressed data of 01_X1.zip.Archive:  02_X1.zip    testing: system_1.img             OK    testing: android-info.txt         OK    testing: android-info-1.txt       OKNo errors detected in compressed data of 02_X1.zip.Archive:  03_X1.zip    testing: system_2.img             OK    testing: android-info.txt         OK    testing: android-info-2.txt       OKNo errors detected in compressed data of 03_X1.zip.Archive:  04_X1.zip    testing: system_3.img             OK    testing: android-info.txt         OK    testing: android-info-3.txt       OKNo errors detected in compressed data of 04_X1.zip.Archive:  05_X1.zip    testing: system_4.img             OK    testing: android-info.txt         OK    testing: android-info-4.txt       OKNo errors detected in compressed data of 05_X1.zip.Archive:  06_X1.zip    testing: android-info.txt         OK    testing: dzdata_8g.img            OK    testing: dzdata_8g.hdr            OK    testing: tp_HMX852XD.img          OK    testing: boot_signed.img          OKNo errors detected in compressed data of 06_X1.zip.6 archives were successfully processed.

5.解包到一个新目录中

kyle@Linux-dev:/mnt/hgfs/D/a5dug$ <strong>unzip -n '*_X1.zip' -d RUUDIR</strong>Archive:  01_X1.zip  inflating: RUUDIR/android-info.txt    inflating: RUUDIR/hboot_signedbyaa.img    inflating: RUUDIR/radio.img          inflating: RUUDIR/rcdata.img         inflating: RUUDIR/splash1.nb0        inflating: RUUDIR/tz.img             inflating: RUUDIR/rpm.img            inflating: RUUDIR/adsp.img           inflating: RUUDIR/pg2fs_spcustom.img    inflating: RUUDIR/wcnss.img          inflating: RUUDIR/ramdisk.img        inflating: RUUDIR/sdi.img            inflating: RUUDIR/emmc_appsboot.mbn    inflating: RUUDIR/persist.img        inflating: RUUDIR/dt.img             inflating: RUUDIR/bootloader         inflating: RUUDIR/sbl1-8928-1.img    inflating: RUUDIR/sbl1-8628-1.img    inflating: RUUDIR/sbl1-8926-1.img    inflating: RUUDIR/sbl1-8228-1.img    inflating: RUUDIR/recovery_signed.img  Archive:  02_X1.zip  inflating: RUUDIR/system_1.img       inflating: RUUDIR/android-info-1.txt  Archive:  03_X1.zip  inflating: RUUDIR/system_2.img       inflating: RUUDIR/android-info-2.txt  Archive:  04_X1.zip  inflating: RUUDIR/system_3.img       inflating: RUUDIR/android-info-3.txt  Archive:  05_X1.zip  inflating: RUUDIR/system_4.img       inflating: RUUDIR/android-info-4.txt  Archive:  06_X1.zip  inflating: RUUDIR/dzdata_8g.img      inflating: RUUDIR/dzdata_8g.hdr      inflating: RUUDIR/tp_HMX852XD.img    inflating: RUUDIR/boot_signed.img  6 archives were successfully processed.

6.合并system.img

kyle@Linux-dev:/mnt/hgfs/D/a5dug$ <strong>cd RUUDIR</strong>kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ <strong>ls -al</strong>总用量 8drwxrwxrwx 1 root root      4096  8月 13 18:12 .drwxrwxrwx 1 root root      4096  8月 13 18:09 ..-rwxrwxrwx 1 root root   9561088  3月 19 16:45 adsp.img-rwxrwxrwx 1 root root       161  3月 19 16:57 android-info-1.txt-rwxrwxrwx 1 root root       161  3月 19 16:57 android-info-2.txt-rwxrwxrwx 1 root root       161  3月 19 16:58 android-info-3.txt-rwxrwxrwx 1 root root       161  3月 19 16:58 android-info-4.txt-rwxrwxrwx 1 root root       105  3月 19 16:38 android-info.txt-rwxrwxrwx 1 root root    414512  3月 19 16:45 bootloader-rwxrwxrwx 1 root root   8204544  3月 19 16:54 boot_signed.img-rwxrwxrwx 1 root root    944128  3月 19 16:49 dt.img-rwxrwxrwx 1 root root      7152  3月 19 16:50 dzdata_8g.hdr-rwxrwxrwx 1 root root 195152880  3月 19 16:50 dzdata_8g.img-rwxrwxrwx 1 root root    414512  3月 19 16:38 emmc_appsboot.mbn-rwxrwxrwx 1 root root   2096384  3月 19 16:54 hboot_signedbyaa.img-rwxrwxrwx 1 root root   4333716  3月 19 16:48 persist.img-rwxrwxrwx 1 root root   2146304  3月 19 16:45 pg2fs_spcustom.img-rwxrwxrwx 1 root root  32445440  3月 19 16:36 radio.img-rwxrwxrwx 1 root root   1126792  3月 19 16:50 ramdisk.img-rwxrwxrwx 1 root root        99  3月 19 14:45 rcdata.img-rwxrwxrwx 1 root root  14086400  3月 19 16:54 recovery_signed.img-rwxrwxrwx 1 root root    157168  3月 19 16:45 rpm.img-rwxrwxrwx 1 root root    281542  3月 19 16:45 sbl1-8228-1.img-rwxrwxrwx 1 root root    281542  3月 19 16:45 sbl1-8628-1.img-rwxrwxrwx 1 root root    281542  3月 19 16:45 sbl1-8926-1.img-rwxrwxrwx 1 root root    281542  3月 19 16:45 sbl1-8928-1.img-rwxrwxrwx 1 root root     11553  3月 19 16:45 sdi.img-rwxrwxrwx 1 root root   1966080  3月 19 14:45 splash1.nb0<strong>-rwxrwxrwx 1 root root 838860800  3月 19 16:56 system_1.img-rwxrwxrwx 1 root root 838860800  3月 19 16:56 system_2.img-rwxrwxrwx 1 root root 838860800  3月 19 16:57 system_3.img-rwxrwxrwx 1 root root 167772160  3月 19 16:57 system_4.img</strong>-rwxrwxrwx 1 root root     32782  3月 19 16:45 tp_HMX852XD.img-rwxrwxrwx 1 root root    371494  3月 19 16:45 tz.img-rwxrwxrwx 1 root root   4559872  3月 19 16:45 wcnss.imgkyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ <strong>cat system_1.img system_2.img system_3.img system_4.img >system.img</strong>

7.检测下合并之后的system.img的大小是不是上面几个的和。

<span style="color:#454545;">kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ </span><strong style="color: rgb(69, 69, 69);">ls -al</strong><span style="color:#454545;">总用量 8drwxrwxrwx 1 root root       4096  8月 13 18:15 .drwxrwxrwx 1 root root       4096  8月 13 18:09 ..-rwxrwxrwx 1 root root    9561088  3月 19 16:45 adsp.img-rwxrwxrwx 1 root root        161  3月 19 16:57 android-info-1.txt-rwxrwxrwx 1 root root        161  3月 19 16:57 android-info-2.txt-rwxrwxrwx 1 root root        161  3月 19 16:58 android-info-3.txt-rwxrwxrwx 1 root root        161  3月 19 16:58 android-info-4.txt-rwxrwxrwx 1 root root        105  3月 19 16:38 android-info.txt-rwxrwxrwx 1 root root     414512  3月 19 16:45 bootloader-rwxrwxrwx 1 root root    8204544  3月 19 16:54 boot_signed.img-rwxrwxrwx 1 root root     944128  3月 19 16:49 dt.img-rwxrwxrwx 1 root root       7152  3月 19 16:50 dzdata_8g.hdr-rwxrwxrwx 1 root root  195152880  3月 19 16:50 dzdata_8g.img-rwxrwxrwx 1 root root     414512  3月 19 16:38 emmc_appsboot.mbn-rwxrwxrwx 1 root root    2096384  3月 19 16:54 hboot_signedbyaa.img-rwxrwxrwx 1 root root    4333716  3月 19 16:48 persist.img-rwxrwxrwx 1 root root    2146304  3月 19 16:45 pg2fs_spcustom.img-rwxrwxrwx 1 root root   32445440  3月 19 16:36 radio.img-rwxrwxrwx 1 root root    1126792  3月 19 16:50 ramdisk.img-rwxrwxrwx 1 root root         99  3月 19 14:45 rcdata.img-rwxrwxrwx 1 root root   14086400  3月 19 16:54 recovery_signed.img-rwxrwxrwx 1 root root     157168  3月 19 16:45 rpm.img-rwxrwxrwx 1 root root     281542  3月 19 16:45 sbl1-8228-1.img-rwxrwxrwx 1 root root     281542  3月 19 16:45 sbl1-8628-1.img-rwxrwxrwx 1 root root     281542  3月 19 16:45 sbl1-8926-1.img-rwxrwxrwx 1 root root     281542  3月 19 16:45 sbl1-8928-1.img-rwxrwxrwx 1 root root      11553  3月 19 16:45 sdi.img-rwxrwxrwx 1 root root    1966080  3月 19 14:45 splash1.nb0-rwxrwxrwx 1 root root  <strong>838860800</strong>  3月 19 16:56 system_1.img-rwxrwxrwx 1 root root  <strong>838860800</strong>  3月 19 16:56 system_2.img-rwxrwxrwx 1 root root  <strong>838860800</strong>  3月 19 16:57 system_3.img-rwxrwxrwx 1 root root  <strong>167772160</strong>  3月 19 16:57 system_4.img-rwxrwxrwx 1 root root </span><strong><span style="color:#cc0000;">2684354560</span></strong><span style="color:#454545;">  8月 13 18:15 system.img-rwxrwxrwx 1 root root      32782  3月 19 16:45 tp_HMX852XD.img-rwxrwxrwx 1 root root     371494  3月 19 16:45 tz.img-rwxrwxrwx 1 root root    4559872  3月 19 16:45 wcnss.imgkyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ </span><strong style="color: rgb(69, 69, 69);">echo  838860800+838860800+838860800+167772160 | bc</strong><span style="color:#454545;"></span><span style="color:#cc0000;"><strong>2684354560</strong></span><span style="color:#454545;">kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ </span>

剩下的操作步骤自己看吧。

kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ rm -v system_*.img已删除"system_1.img"已删除"system_2.img"已删除"system_3.img"已删除"system_4.img"kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ rm -v android-info-*.txt已删除"android-info-1.txt"已删除"android-info-2.txt"已删除"android-info-3.txt"已删除"android-info-4.txt"kyle@Linux-dev:/mnt/hgfs/D/a5dug/RUUDIR$ zip ruu.zip *  adding: adsp.img (deflated 50%)  adding: android-info.txt (deflated 6%)  adding: bootloader (deflated 59%)  adding: boot_signed.img (deflated 10%)  adding: dt.img (deflated 80%)  adding: dzdata_8g.hdr (deflated 81%)  adding: dzdata_8g.img (deflated 10%)  adding: emmc_appsboot.mbn (deflated 59%)  adding: hboot_signedbyaa.img (deflated 78%)  adding: persist.img (deflated 100%)  adding: pg2fs_spcustom.img (deflated 96%)  adding: radio.img (deflated 49%)  adding: ramdisk.img (deflated 0%)  adding: rcdata.img (deflated 16%)  adding: recovery_signed.img (deflated 6%)  adding: rpm.img (deflated 45%)  adding: sbl1-8228-1.img (deflated 38%)  adding: sbl1-8628-1.img (deflated 38%)  adding: sbl1-8926-1.img (deflated 38%)  adding: sbl1-8928-1.img (deflated 38%)  adding: sdi.img (deflated 36%)  adding: splash1.nb0 (deflated 99%)  adding: system.img (deflated 70%)  adding: tp_HMX852XD.img (deflated 54%)  adding: tz.img (deflated 54%)  adding: wcnss.img (deflated 62%)