Hi, why I have this error ?

Здравствуйте! Не получается распаковать прошивку usb https://yadi.sk/d/OFx67RZn-1ASVQ
Сделайте пожалуйста возможным это.

Hello sir plz tell me i have bin file of stb so plz how can decript rsa key and box key plz help me

Hi, thank you for this great library. I was trying to emulate mstar custom firmware on android emulator to no avail. I was able to unpack my mstarupgrade.bin file and I followed the method here: https://stackoverflow.com/questions/45778555/running-custom-android-rom-on-emulator to copy the unpacked files in my avd dir. But after cold booting my android emulator I got black screen with log:
Emulator: Critical: UpdateLayeredWindowIndirect failed for ptDst=(279, 128), size=(736x84), dirty=(736x84 0, 0) (A device attached to the system is not functioning.) ((null):0, (null))

If there is any other way to emulate this firmware on Windows please do advise.

Any help will be appreciated. Thanks!

Some of the KEY is not in the mboot file .And the must be very accurate. How to determine key bank offset?

I unpacked a BIN file. Some partition sessions have setenv command. How do I modify config file for it?

# File Partition: recovery
filepartload 0x20200000 $(UpgradeImage) 0x1c8000 0xe44250
mmc erase.p misc
mmc erase.p recovery
mmc write.p 0x20200000 recovery 0xE44250 1
filepartload 0x20200000 $(UpgradeImage) 0x100d000 0x220
store_secure_info recoverySign 0x20200000
setenv recoverycmd mmc read.p 0x24D00000 recovery 0x00F00000\; authenticateAN 0x24D00000\; bootm 0x24D00000
saveenv

Can you help me find the AES key in MBOOT?
I cannot find the Mstar.Key.Bank key value
MBOOT.zip

Hi,
I got a Mstar based TCL TV has a sparse_write command, which is not supported. I try to modify some lines in utils and unpack.py, I finally got the img file but, when I use simg2img tool to convert to raw file, then lots of content lost.

I totally not sure what happened? I've been search every website for the solution but lack of information and solution, can you help with me about this?
here is the script I got
~header_script.txt

here is the log info
[i] Analizing header ...
[i] Saving header script to unpacked~header_script ...
[i] Parsing script ...
[i] Partition: sboot Offset: 0x4000 Size 0x25400 (149.0 KB) -> unpacked\sboot.img
[i] Partition: MBOOT Offset: 0x2a000 Size 0x271e00 (2.44 MB) -> unpacked\MBOOT.img
[i] Partition: MBOOTBAK Offset: 0x29c000 Size 0x271e00 (2.44 MB) -> unpacked\MBOOTBAK.img
[i] Partition: boot Offset: 0x50e000 Size 0x109d800 (16.62 MB) -> unpacked\boot.img
[i] Parsing setenv bootcmd -> mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x25000000 boot 0x01800000; bootm 0x25000000
[i] Partition: recovery Offset: 0x15ac000 Size 0x1d89800 (29.54 MB) -> unpacked\recovery.img
[i] Parsing setenv recoverycmd -> mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x25000000 recovery 0x04400000; bootm 0x25000000
[i] Partition: cache Offset: 0x3336000 Size 0x48e094 (4.55 MB) append to unpacked\cache.img
[i] Partition: userdata Offset: 0x37c5000 Size 0x1800000 (24.0 MB) -> unpacked\userdata.img
[i] Partition: armfw Offset: 0x4fc5000 Size 0xe460 (57.09 KB) -> unpacked\armfw.img
[i] Partition: RTPM Offset: 0x4fd4000 Size 0x10000 (64.0 KB) -> unpacked\RTPM.img
[i] Partition: dtb Offset: 0x4fe4000 Size 0x3aff (14.75 KB) -> unpacked\dtb.img
[i] Partition: frc Offset: 0x4fe8000 Size 0x46010 (280.02 KB) -> unpacked\frc.img
[i] Partition: optee Offset: 0x502f000 Size 0x1e4ca0 (1.89 MB) -> unpacked\optee.img
[i] Partition: cm4 Offset: 0x5214000 Size 0x63181 (396.38 KB) -> unpacked\cm4.img
[i] Partition: tclconfig Offset: 0x5278000 Size 0x5000000 (80.0 MB) -> unpacked\tclconfig.img[i] Partition: vendor Offset: 0xa278000 Size 0x93d13f4 (147.82 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x1364a000 Size 0x95ff970 (150.0 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x1cc4a000 Size 0x908d6d0 (144.55 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x25cd8000 Size 0x9042628 (144.26 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x2ed1b000 Size 0x84da4fc (132.85 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x371f6000 Size 0x95fdfdc (149.99 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x407f4000 Size 0x8ece7c0 (142.81 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x496c3000 Size 0x9560340 (149.38 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x52c24000 Size 0x94b91c0 (148.72 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x5c0de000 Size 0x8ced4e4 (140.93 MB) append to unpacked\vendor.img
[i] Partition: vendor Offset: 0x64dcc000 Size 0x159c1e4 (21.61 MB) append to unpacked\vendor.img
[i] Partition: system Offset: 0x66369000 Size 0x8fbd514 (143.74 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x6f327000 Size 0x942e9e8 (148.18 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x78756000 Size 0x95e7b50 (149.91 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x81d3e000 Size 0x95d1d44 (149.82 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x8b310000 Size 0x95e74a4 (149.9 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x948f8000 Size 0x8b8aa8c (139.54 MB) append to unpacked\system.img
[i] Partition: system Offset: 0x9d483000 Size 0x1793604 (23.58 MB) append to unpacked\system.img
[i] Partition: data Offset: 0x9ec17000 Size 0x503b628 (80.23 MB) append to unpacked\data.img
[i] Partition: data Offset: 0xa3c53000 Size 0x8efebf8 (143.0 MB) append to unpacked\data.img
[i] Partition: data Offset: 0xacb52000 Size 0x91136e4 (145.08 MB) append to unpacked\data.img
[i] Parsing setenv bootargs -> console
[i] Parsing setenv bootargs -> console=ttyS0,115200 androidboot.console=ttyS0 root=/dev/ram rw rootwait init=/init CORE_DUMP_PATH=/var/core_dump.%e_%p.gz KDebug=1 delaylogo=true platform=mI tee_mode=optee str_ignore_wakelock pm_path=/tvconfig/config/PM.bin quiet loglevel=0
[i] Parsing setenv bootlogo_gopidx -> 2
[i] Parsing setenv bootlogo_buffer -> E_MMAP_ID_BOOTLOGO_BUFFER
[i] Parsing setenv OSD_BufferAddr -> E_MMAP_ID_JPD_WRITE_ADR
[i] Parsing setenv str_crc -> 2
[i] Parsing setenv db_table -> 0
[i] Parsing setenv verify -> n
[i] Parsing setenv sync_mmap -> 1
[i] Parsing setenv CONFIG_PATH -> /tvconfig/config
[i] Parsing setenv mboot_default_env -> 0
[i] Parsing setenv close_log -> yes
[i] Parsing setenv MstarUpgrade_complete -> 1
[i] Parsing setenv ENABLE_STR_FAIL_GO_DC -> 1
[i] Parsing setenv MstarUpgrade_complete -> 1
[i] Parsing setenv sync_mmap -> 1
[i] Parsing setenv db_table -> 0

Hi,

I would like to make some modifications on tvconfig.img file (changing boot logo image for example) but I could not succeed.
I uncompressed tvconfig.img file with 7-zip File Manager to get the different files and folders. Then after, I intended to compress the folder "tvconfig" to get an image file tvconfig.img using ImgBurn Tool but when I try the new firmware, the TV do not turn on (Black screen, No picture). I noticed that the size of the new file tvconfig.img (size ~8Mo) that I created by ImgBurn is way less the original tvconfig.img obtained after unpacking (size ~61 Mo).

Could any one help me ?
Is it a problem in tvconfig partition size ? or should I find another tool to create an *.img file from folder ? Or .... ?

Remark: Unpacking and packing (with original *.img files) are working fine for me.

I unpacked a sharp tv BIN file. I want to update systimg.img add root. How do I modify config file for it?
~header_script

#-------------USB Upgrade Bin Info----------------

Device : cv6a648_base

Build PATH : /home/niu_lj/fxc648

Build TIME : 2017-12-27 17:44:09

setenv limite_upgrade allow

File Partition: set_partition

mmc slc 0 1
mmc rmgpt
mmc create misc 0x00080000
mmc create factory 0x0C800000
mmc create recovery 0x01900000
mmc create boot 0x01400000
mmc create optee 0x00600000
mmc create armfw 0x00010000
mmc create RTPM 0x00040000
mmc create dtb 0x00100000
mmc create tvservice 0x0A000000
mmc create tvconfig 0x05000000
mmc create tvdatabase 0x00F00000
mmc create tvcustomer 0x05000000
mmc create system 0x51400000
mmc create cache 0x40000000
mmc create userdata 0x2E0000000

File Partition: factory

mmc erase.p factory
filepartload 0x20200000 $(UpgradeImage) 0x4000 0xaffab
mmc unlzo 0x20200000 0xAFFAB factory 1
filepartload 0x20200000 $(UpgradeImage) 0xb4000 0x3a9b7
mmc unlzo.cont 0x20200000 0x3A9B7 factory 1

File Partition: mboot

filepartload 0x20200000 $(UpgradeImage) 0xef000 0x13800
mmc write.boot 1 0x20200000 0 0x13800
filepartload 0x20200000 $(UpgradeImage) 0x103000 0x1bac00
mmc write.p 0x20200000 MBOOT 0x1BAC00

File Partition: recovery

filepartload 0x20200000 $(UpgradeImage) 0x2be000 0x11f1b09
mmc erase.p misc
mmc erase.p recovery
mmc write.p 0x20200000 recovery 0x11F1B09 1
setenv recoverycmd mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x24D00000 recovery 0x01900000; bootm 0x24D00000
saveenv

File Partition: boot

filepartload 0x20200000 $(UpgradeImage) 0x14b0000 0xe15d43
mmc erase.p boot
mmc write.p 0x20200000 boot 0xE15D43 1
setenv bootcmd mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x24D00000 boot 0x01400000; bootm 0x24D00000
saveenv

File Partition: optee

filepartload 0x20200000 $(UpgradeImage) 0x22c6000 0x18ded0
mmc erase.p optee
mmc write.p 0x20200000 optee 0x18DED0

File Partition: armfw

filepartload 0x20200000 $(UpgradeImage) 0x2454000 0xa270
mmc erase.p armfw
mmc write.p 0x20200000 armfw 0xA270

File Partition: RT_PM

filepartload 0x20200000 $(UpgradeImage) 0x245f000 0x10000
mmc erase.p RTPM
mmc write.p 0x20200000 RTPM 0x10000 1

File Partition: dtb

filepartload 0x20200000 $(UpgradeImage) 0x246f000 0xc7e
mmc erase.p dtb
mmc write.p 0x20200000 dtb 0xC7E 1

File Partition: tvservice

filepartload 0x20200000 $(UpgradeImage) 0x2470000 0x1dcc6db
mmc erase.p tvservice
mmc unlzo 0x20200000 0x1DCC6DB tvservice 1

File Partition: tvconfig

filepartload 0x20200000 $(UpgradeImage) 0x423d000 0x330109
mmc erase.p tvconfig
mmc unlzo 0x20200000 0x330109 tvconfig 1

File Partition: tvdatabase

filepartload 0x20200000 $(UpgradeImage) 0x456e000 0xf00000
mmc erase.p tvdatabase
mmc write.p 0x20200000 tvdatabase 0xF00000 1

File Partition: tvcustomer

filepartload 0x20200000 $(UpgradeImage) 0x546e000 0x2aefc9
mmc erase.p tvcustomer
mmc unlzo 0x20200000 0x2AEFC9 tvcustomer 1

File Partition: system

mmc erase.p system
filepartload 0x20200000 $(UpgradeImage) 0x571d000 0x4a945ed
mmc unlzo 0x20200000 0x4A945ED system 1
filepartload 0x20200000 $(UpgradeImage) 0xa1b2000 0x7948904
mmc unlzo.cont 0x20200000 0x7948904 system 1
filepartload 0x20200000 $(UpgradeImage) 0x11afb000 0x6c11d37
mmc unlzo.cont 0x20200000 0x6C11D37 system 1
filepartload 0x20200000 $(UpgradeImage) 0x1870d000 0x6220fa6
mmc unlzo.cont 0x20200000 0x6220FA6 system 1
filepartload 0x20200000 $(UpgradeImage) 0x1e92e000 0x542b03c
mmc unlzo.cont 0x20200000 0x542B03C system 1
filepartload 0x20200000 $(UpgradeImage) 0x23d5a000 0x565993d
mmc unlzo.cont 0x20200000 0x565993D system 1
filepartload 0x20200000 $(UpgradeImage) 0x293b4000 0x5afadd2
mmc unlzo.cont 0x20200000 0x5AFADD2 system 1
filepartload 0x20200000 $(UpgradeImage) 0x2eeaf000 0x29b3027
mmc unlzo.cont 0x20200000 0x29B3027 system 1
filepartload 0x20200000 $(UpgradeImage) 0x31863000 0x75336
mmc unlzo.cont 0x20200000 0x75336 system 1

File Partition: cache

filepartload 0x20200000 $(UpgradeImage) 0x318d9000 0x4b07a2
mmc erase.p cache
mmc unlzo 0x20200000 0x4B07A2 cache 1

File Partition: userdata

filepartload 0x20200000 $(UpgradeImage) 0x31d8a000 0x35f0182
mmc erase.p userdata
mmc unlzo 0x20200000 0x35F0182 userdata 1

File Partition: set_config

setenv power_key 0x1C
setenv ir_header_code0 0x00
setenv ir_header_code1 0xdf
setenv bootargs console
saveenv
setenv bootargs console=ttyS0,115200 androidboot.console=ttyS0 root=/dev/ram rw rootwait init=/init CORE_DUMP_PATH=/data/core_dump.%%p.gz KDebug=1 delaylogo=true androidboot.selinux=permissive security=selinux SDIO_CONFIG=1 tee_mode=optee str_ignore_wakelock loglevel=0
setenv bootlogo_gopidx 2
setenv bootlogo_buffer E_MMAP_ID_BOOTLOGO_BUFFER
setenv first_upgrade_factory 0
setenv str_crc 2
setenv music 0
setenv db_table 0
setenv verify n
setenv WDT_ENABLE 1
setenv WDT_TUMEOUT 20
setenv sync_mmap 1
saveenv
setenv CtvUpgrade_complete 1
setenv sync_mmap 1
setenv db_table 0
setenv u16CurPWMvalue N
setenv first_setup 1
setenv pre_modelname
setenv video_service IQIYI
setenv factory_burningmode 0
setenv dc_poweroff 0
saveenv
printenv
mmc erase.boot 2
% <- this is end of script symbol

bin file:https://cs.sharp.cn/cloud/public.php?service=files&t=8079a72c16417430e739219d1e4510d0&download
add SuperSU.apk system.img:https://drive.google.com/open?id=1FVBFW4abR8KnOnbneQ1F9S5iUcV080l7

Thank you !

https://www.virustotal.com/gui/file/a9560123a284e5b9c38eee849d7eee0f1ecf07a80249e122f283f7e5fa67fa87/detection

[i] Sparse: converting cache_sparse.* to cache.img
sh: binsparsesimg2img.exe: command not found
sh: del: command not found
[i] Sparse: converting system_sparse.* to system.img
sh: binsparsesimg2img.exe: command not found
sh: del: command not found
[i] Sparse: converting vendor_sparse.* to vendor.img
sh: binsparsesimg2img.exe: command not found
sh: del: command not found
[i] Sparse: converting userdata_sparse.* to userdata.img
sh: binsparsesimg2img.exe: command not found
sh: del: command not found

I have extracted system.img from V8-SCT05.bin(TCL 55V6), and repacked it to the .bin file after modified, but error occured when flashing it.
To locate the question, I have tried to only replace the sparse system.img files and modify the address and offset in header_script ,after all, recaculate two crc32s. But error still appeared when it comes to system.img in the flashimg process.
So I was wondering is there any verifying in system.img and how to manage it?

Hi ,

Thanks for the tool.

Can we get the boot logo and watermark within the bin file and can we change the same , if so can u tell how can i?

below error i am getting while unpack.

[i] Analizing header ... Traceback (most recent call last): File "C:\Users\10884\Downloads\mstar-bin-tool-master\mstar-bin-tool-master\unpack.py", line 44, in <module> headerScript = header[:offset].decode() UnicodeDecodeError: 'utf-8' codec can't decode byte 0xbe in position 4098: invalid start byte

Thanks

error
[i] Unpacking LZO (Please be patient) unpacked/system.lzo -> unpacked/system.img
sh: 1: bin/linux-x86/lzop: not found

in ubuntu lzop path - /usr/bin/lzop

please help me to solve

here are my header_script from xgimi Projector new z8x which use mstar6a848
这是我从极米new z8x固件中解出来的header_script，这个投影仪用的是mstar6a848方案

#-------------USB Upgrade Bin Info----------------
# Device : ironman
# Build PATH : /studio2/MSD848_CODE/android
# Build TIME : 2022-01-07 19:41:10
# Build TIME STAMP : 1641555670

# File Partition: set_partition
mmc slc 0 1
mmc rmgpt
mmc create misc 0x00080000
mmc create recovery 0x02000000
mmc create boot 0x01400000
mmc create optee 0x00600000
mmc create armfw 0x00010000
mmc create RTPM 0x00040000
mmc create dtb 0x00100000
mmc create frc 0x00100000
mmc create cm4 0x00080000
mmc create system 0x36B00000
mmc create cache 0x47E00000
mmc create vendor 0x49700000
mmc create tvservice 0x0B400000
mmc create tvconfig 0x01900000
mmc create tvdatabase 0x00800000
mmc create tvcustomer 0x01000000
mmc create tvcertificate 0x00800000
mmc create xgimidatabase 0x01400000
mmc create xgimiconfig 0x01900000
mmc create userdata MAX

# File Partition: mboot
filepartload 0x28A00000 $(UpgradeImage) 0x4000 0x24000
mmc write.boot 1 0x28A00000 0 0x24000
filepartload 0x28A00000 $(UpgradeImage) 0x28000 0x2e3200
mmc write.p 0x28A00000 MBOOT 0x2E3200

# File Partition: recovery
filepartload 0x28A00000 $(UpgradeImage) 0x30c000 0x179e000
mmc erase.p misc
mmc erase.p recovery
mmc write.p 0x28A00000 recovery 0x179E000 1
setenv recoverycmd mmc read.p 0x23000000 dtb 0x00100000\; mmc read.p 0x25000000 recovery 0x02000000\; bootm 0x25000000
saveenv

# File Partition: boot
filepartload 0x28A00000 $(UpgradeImage) 0x1aaa000 0x119a800
mmc erase.p boot
mmc write.p 0x28A00000 boot 0x119A800 1
setenv bootcmd mmc read.p 0x23000000 dtb 0x00100000\; mmc read.p 0x25000000 boot 0x01400000\; bootm 0x25000000
saveenv

# File Partition: optee
filepartload 0x28A00000 $(UpgradeImage) 0x2c45000 0x1e8830
mmc erase.p optee
mmc write.p 0x28A00000 optee 0x1E8830

# File Partition: armfw
filepartload 0x28A00000 $(UpgradeImage) 0x2e2e000 0xe460
mmc erase.p armfw
mmc write.p 0x28A00000 armfw 0xE460

# File Partition: RT_PM
filepartload 0x28A00000 $(UpgradeImage) 0x2e3d000 0x10000
mmc erase.p RTPM
mmc write.p 0x28A00000 RTPM 0x10000 1

# File Partition: dtb
filepartload 0x28A00000 $(UpgradeImage) 0x2e4d000 0x3972
mmc erase.p dtb
mmc write.p 0x28A00000 dtb 0x3972 1

# File Partition: frc
filepartload 0x28A00000 $(UpgradeImage) 0x2e51000 0x80010
mmc erase.p frc
mmc write.p 0x28A00000 frc 0x80010

# File Partition: cm4
filepartload 0x28A00000 $(UpgradeImage) 0x2ed2000 0x64348
mmc erase.p cm4
mmc write.p 0x28A00000 cm4 0x64348

# File Partition: system
mmc erase.p system
filepartload 0x28A00000 $(UpgradeImage) 0x2f37000 0x950ffb8
sparse_write mmc 0x28A00000 system $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0xc447000 0x951b618
sparse_write mmc 0x28A00000 system $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x15963000 0x837e3c4
sparse_write mmc 0x28A00000 system $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x1dce2000 0x93084e0
sparse_write mmc 0x28A00000 system $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x26feb000 0x95ff940
sparse_write mmc 0x28A00000 system $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x305eb000 0x3634654
sparse_write mmc 0x28A00000 system $(filesize)

# File Partition: cache
filepartload 0x28A00000 $(UpgradeImage) 0x33c20000 0x145e1f0
mmc erase.p cache
sparse_write mmc 0x28A00000 cache $(filesize)

# File Partition: vendor
mmc erase.p vendor
filepartload 0x28A00000 $(UpgradeImage) 0x3507f000 0x8a08030
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x3da88000 0x95ffbb0
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x47088000 0x949a6c4
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x50523000 0x9281964
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x597a5000 0x8d702d4
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x62516000 0x95041a8
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x6ba1b000 0x956637c
sparse_write mmc 0x28A00000 vendor $(filesize)
filepartload 0x28A00000 $(UpgradeImage) 0x74f82000 0x1850f4
sparse_write mmc 0x28A00000 vendor $(filesize)

# File Partition: tvservice
filepartload 0x28A00000 $(UpgradeImage) 0x75108000 0xb400000
mmc erase.p tvservice
mmc write.p 0x28A00000 tvservice 0xB400000 1

# File Partition: tvconfig
filepartload 0x28A00000 $(UpgradeImage) 0x80508000 0x1900000
mmc erase.p tvconfig
mmc write.p 0x28A00000 tvconfig 0x1900000 1

# File Partition: tvdatabase
filepartload 0x28A00000 $(UpgradeImage) 0x81e08000 0x800000
mmc erase.p tvdatabase
mmc write.p 0x28A00000 tvdatabase 0x800000 1

# File Partition: tvcustomer
filepartload 0x28A00000 $(UpgradeImage) 0x82608000 0x1000000
mmc erase.p tvcustomer
mmc write.p 0x28A00000 tvcustomer 0x1000000 1

# File Partition: tvcertificate
filepartload 0x28A00000 $(UpgradeImage) 0x83608000 0x800000
mmc erase.p tvcertificate
mmc write.p 0x28A00000 tvcertificate 0x800000 1

# File Partition: xgimidatabase
filepartload 0x28A00000 $(UpgradeImage) 0x83e08000 0x1400000
mmc erase.p xgimidatabase
mmc write.p 0x28A00000 xgimidatabase 0x1400000 1

# File Partition: xgimiconfig
filepartload 0x28A00000 $(UpgradeImage) 0x85208000 0x1900000
mmc erase.p xgimiconfig
mmc write.p 0x28A00000 xgimiconfig 0x1900000 1

# File Partition: userdata
filepartload 0x28A00000 $(UpgradeImage) 0x86b08000 0x168cea48
mmc erase.p userdata
sparse_write mmc 0x28A00000 userdata $(filesize)
recovery_wipe_partition data

# File Partition: set_config
setenv bootargs console
saveenv
setenv bootargs console=ttyS0,115200 androidboot.console=ttyS0 root=/dev/ram rw rootwait init=/init CORE_DUMP_PATH=/data/core_dump.%e_%p.gz KDebug=1 delaylogo=true androidboot.selinux=permissive security=selinux platform=sn tee_mode=optee str_ignore_wakelock pm_path=/tvconfig/config/PM.bin
setenv bootlogo_gopidx 2
setenv bootlogo_buffer E_MMAP_ID_BOOTLOGO_BUFFER
setenv OSD_BufferAddr E_MMAP_ID_JPD_WRITE_ADR
setenv str_crc 2
setenv db_table 0
setenv verify n
setenv sync_mmap 1
setenv CONFIG_PATH /tvconfig/config
setenv mboot_default_env 0
setenv xgimi_bootwizard_environment true
setenv mstar.xgimi.showError false
setenv xgimi_machine_mode 0
setenv factory_poweron_mode secondary
setenv reboot_value 1
setenv dlp_look
setenv dlp_mode              
setenv dlp_battery_mode_last 255
setenv custom_cur_r
setenv custom_cur_g
setenv custom_cur_b
setenv custom_cur_bp
setenv dlp_highlight_test_mode
setenv u8TRecitfy
setenv resolution 	0
setenv zoom_factor 	1
setenv shape_type  	0
setenv kst_ofs
setenv kst_ofs_backup
setenv boot_music_type 0
setenv xgimi_hdmidebug false
setenv jd_feed_id
setenv jd_localkey
setenv jd_access_key
setenv jd_aes_server_ip
setenv jd_server_ip
setenv jd_uid
setenv jd_secret
setenv jd_uuid
setenv xgimi_multi_model MS=S111,Z6B=F121,MP=Y111,Z6BX=F122,MPB=Y122,PS01=AC111,MH01=AA111,ZM01=N111,ZL01=F124
setenv XGIMI_DLP_ERR_COUNT
setenv XGIMI_DLP_ERR_TIMES
setenv XGIMI_DLP_MAX_CYCLE_TIMES
setenv XGIMI_DLP_FAILED_TIMES
setenv PowerOn_AK
setenv DOOR_MAX_STEP
setenv reset_all_env_to_default true
saveenv
setenv MstarUpgrade_complete 1
setenv sync_mmap 1
setenv db_table 0
saveenv
printenv
% <- this is end of script symbol

as you see， the script can not deal with "sparse_write" command,so some partitions use sparseimg like system,userdata will be ignored
如你所见，这个脚本不能处理"sparse_write"命令，所以，一些使用sparseimg 的分区解不出来，像system,userdata之类分区的就不行
我想到的一个办法是先把它们分别转成img，再按位或运算
One way I think of is to convert them into img, and then perform bitwise or operations

[i] Analizing header ...
[i] Saving header script to unpacked~header_script ...
[i] Parsing script ...

offset = header.find('\xff'.encode(encoding='iso-8859-1'))
if offset != -1:
	headerScript = header[:offset].decode()
	headerScriptFound = True

if not headerScriptFound:
	print ("[!] Could not find header script!")

unpacked with this info:

root@ubuntu1-telegraf:/avv/mstar-bin-tool# python3 unpack.py /avv/GIMI_MADISON_Z4AIR_WPM.bin 
[i] Analizing header ...
[i] Saving header script to unpacked/~header_script ...
[i] Parsing script ...
[i] Partition: recovery	Offset: 4000	Size 79f1f2 (7.62 MB) -> unpacked/recovery.img
[i] Partition: boot	Offset: 7a4000	Size 38d774 (3.55 MB) -> unpacked/boot.img
[i] Partition: system	Offset: b32000	Size 780c400 (120.05 MB) -> unpacked/system.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system.lzo -> unpacked/system.img
[i] Partition: system	Offset: 833f000	Size 88c9fe9 (136.79 MB) -> unpacked/system1.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system1.lzo -> unpacked/system1.img
[i]     unpacked/system1.img append to unpacked/system.img
[i] Partition: system	Offset: 10c09000	Size 6821824 (104.13 MB) -> unpacked/system2.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system2.lzo -> unpacked/system2.img
[i]     unpacked/system2.img append to unpacked/system.img
[i] Partition: system	Offset: 1742b000	Size 5298c0e (82.6 MB) -> unpacked/system3.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system3.lzo -> unpacked/system3.img
[i]     unpacked/system3.img append to unpacked/system.img
[i] Partition: userdata	Offset: 1c6c4000	Size 4afc5 (299.94 KB) -> unpacked/userdata.lzo
[i]     Unpacking LZO (Please be patient) unpacked/userdata.lzo -> unpacked/userdata.img
[i] Partition: cache	Offset: 1c70f000	Size d2dd (52.72 KB) -> unpacked/cache.lzo
[i]     Unpacking LZO (Please be patient) unpacked/cache.lzo -> unpacked/cache.img
[i] Partition: tvservice	Offset: 1c71d000	Size 3c00000 (60.0 MB) -> unpacked/tvservice.img
[i] Partition: tvconfig	Offset: 2031d000	Size a00000 (10.0 MB) -> unpacked/tvconfig.img
[i] Partition: tvdatabase	Offset: 20d1d000	Size 800000 (8.0 MB) -> unpacked/tvdatabase.img
[i] Partition: tvcustomer	Offset: 2151d000	Size 1000000 (16.0 MB) -> unpacked/tvcustomer.img
[i] Partition: RTPM	Offset: 2251d000	Size 10000 (64.0 KB) -> unpacked/RTPM.img
[i] Partition: sboot	Offset: 2252d000	Size 12800 (74.0 KB) -> unpacked/sboot.img
[i] Partition: MBOOT	Offset: 22540000	Size 14b7cc (1.29 MB) -> unpacked/MBOOT.img
[i] Partition: virtualsdcard	Offset: 2268c000	Size 5da1f01 (93.63 MB) -> unpacked/virtualsdcard.lzo
[i]     Unpacking LZO (Please be patient) unpacked/virtualsdcard.lzo -> unpacked/virtualsdcard.img
[i] Parsing setenv filesize -> 38d774
[i] Parsing setenv bootcmd -> mmc read.p 0x25000000 boot 0x00400000\; bootm 0x25000000
[i] Parsing setenv recoverycmd -> mmc read.p 0x25000000 recovery 0x00A00000\; bootm 0x25000000
[i] Parsing setenv MIU0_GROUP_PRIORITY -> 2:0:1:3
[i] Parsing setenv MIU1_GROUP_PRIORITY -> 1:2:3:0
[i] Parsing setenv MIU0_GROUP_SELMIU -> 1120:3000:3000:1ADE
[i] Parsing setenv MIU1_GROUP_SELMIU -> 4E40:0000:0000:0120
[i] Parsing setenv MS_MEM -> LX_MEM=0x1A200000 EMAC_MEM=0x40000 DRAM_LEN=0x40000000 LX_MEM2=0xA0000000,0x1A800000 cma_miu1=0xA0000000,0x10000000
[i] Parsing setenv KERNEL_PROTECT -> DRAM_SIZE1=0x20000000 DRAM_SIZE2=0x20000000
[i] Parsing setenv ROOT -> root=/dev/ram rw rootwait
[i] Parsing setenv bootargs -> console=ttyS0,115200 androidboot.console=ttyS0 $(ROOT) init=/init $(MS_MEM) CORE_DUMP_PATH=/data/core_dump.%%p.gz KDebug=1 delaylogo=true
[i] Parsing setenv ENV -> EMMC
[i] Parsing setenv str_crc -> 2
[i] Parsing setenv bootlogo_buffer -> E_MMAP_ID_CAMERA
[i] Parsing setenv bootlogo_gopidx -> 2
[i] Parsing setenv db_table -> 0
[i] Parsing setenv verify -> n
[i] Parsing setenv xgimi_bootwizard_environment -> true
[i] Parsing setenv MstarUpgrade_complete -> 1
root@ubuntu1-telegraf:/avv/mstar-bin-tool# ls

does my config file correct to pack all file back?
root@ubuntu1-telegraf:/avv/mstar-bin-tool/unpacked# cat ../configs/xgimi.ini

[Main]
FirmwareFileName=GIMI_MADISON_Z4AIR_WPM.bin
ProjectFolder=./unpacked
useHexValuesPrefix=true
 
SCRIPT_FIRMWARE_FILE_NAME=${FirmwareFileName}
DRAM_BUF_ADDR=20200000
MAGIC_FOOTER=12345678
HEADER_SIZE=16KB
USE_XGIMI_CRC2=True
 
[HeaderScript]
Prefix:
 
Suffix:
    setenv MstarUpgrade_complete 1
    setenv sync_mmap 1
    setenv db_table 0
    saveenv
    printenv
 
[part/system]
erase=True
imageFile=${Main:ProjectFolder}/system.img
type=partitionImage
lzo=True
chunkSize=150MB

[part/userdata]
erase=True
imageFile=${Main:ProjectFolder}/userdata.img
type=partitionImage
lzo=True
chunkSize=150MB

[part/cache]
erase=True
imageFile=${Main:ProjectFolder}/cache.img
type=partitionImage
lzo=True
chunkSize=150MB

[part/tvservice]
erase=True
imageFile=${Main:ProjectFolder}/tvservice.img
type=partitionImage

[part/tvconfig]
erase=True
imageFile=${Main:ProjectFolder}/tvconfig.img
type=partitionImage

[part/tvdatabase]
erase=True
imageFile=${Main:ProjectFolder}/tvdatabase.img
type=partitionImage

[part/tvcustomer]
erase=True
imageFile=${Main:ProjectFolder}/tvcustomer.img
type=partitionImage

[part/virtualsdcard]
erase=True
imageFile=${Main:ProjectFolder}/virtualsdcard.img
type=partitionImage
lzo=True
chunkSize=150MB

do I need put all setenv from unpack script to Suffix section in config file?
thanks.

Error unpacking:C
firmware link link

➜  python2 unpack.py /Users/kota/Downloads/V8-S68AT02-LF1V150.bin                                                                                                                               ruby-2.4.0 
[i] Analizing header ...
Traceback (most recent call last):
  File "unpack.py", line 41, in <module>
    offset = header.find('\xff'.encode(encoding='iso-8859-1'))
UnicodeDecodeError: 'ascii' codec can't decode byte 0xff in position 0: ordinal not in range(128)
kota@iMac—Kota ~/Downloads/mstar-bin-tool-master

➜  python3 unpack.py /Users/kota/Downloads/V8-S68AT02-LF1V150.bin                                                                                                                               ruby-2.4.0 
[i] Analizing header ...
[i] Saving header script to unpacked/~header_script ...
[i] Parsing script ...
[i] Partition: sboot	Offset: 0x4000	Size 0x13800 (78.0 KB) -> unpacked/sboot.img
[i] Partition: MBOOT	Offset: 0x18000	Size 0x183200 (1.51 MB) -> unpacked/MBOOT.img
[i] Partition: recovery	Offset: 0x19c000	Size 0x1643b40 (22.26 MB) -> unpacked/recovery.img
[i] Partition: boot	Offset: 0x17e1000	Size 0xd79f90 (13.48 MB) -> unpacked/boot.img
[i] Partition: tee	Offset: 0x255c000	Size 0x3012d0 (3.0 MB) -> unpacked/tee.img
[i] Partition: RTPM	Offset: 0x2860000	Size 0x10000 (64.0 KB) -> unpacked/RTPM.img
[i] Partition: dtb	Offset: 0x2870000	Size 0xa34 (2.55 KB) -> unpacked/dtb.img
[i] Partition: frc	Offset: 0x2871000	Size 0x71010 (452.02 KB) -> unpacked/frc.img
[i] Partition: tclconfig	Offset: 0x28e3000	Size 0x627083 (6.15 MB) -> unpacked/tclconfig.lzo
[i]     Unpacking LZO (Please be patient) unpacked/tclconfig.lzo -> unpacked/tclconfig.img
sh: bin/linux-x86/lzop: No such file or directory
[i] Partition: database	Offset: 0x2f0b000	Size 0x12e6b (75.6 KB) -> unpacked/database.lzo
[i]     Unpacking LZO (Please be patient) unpacked/database.lzo -> unpacked/database.img
sh: bin/linux-x86/lzop: No such file or directory
[i] Partition: tvos	Offset: 0x2f1e000	Size 0x48a7906 (72.65 MB) -> unpacked/tvos.lzo
[i]     Unpacking LZO (Please be patient) unpacked/tvos.lzo -> unpacked/tvos.img
sh: bin/linux-x86/lzop: No such file or directory
[i] Partition: system	Offset: 0x77c6000	Size 0x5e548fb (94.33 MB) -> unpacked/system.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system.lzo -> unpacked/system.img
sh: bin/linux-x86/lzop: No such file or directory
[i] Partition: system	Offset: 0xd61b000	Size 0x6b74615 (107.45 MB) -> unpacked/system1.lzo
[i]     Unpacking LZO (Please be patient) unpacked/system1.lzo -> unpacked/system1.img
sh: bin/linux-x86/lzop: No such file or directory
[i]     unpacked/system1.img append to unpacked/system.img
Traceback (most recent call last):
  File "unpack.py", line 132, in <module>
    utils.appendFile(outputChunkImgFile, outputImgFile)
  File "/Users/kota/Downloads/mstar-bin-tool-master/utils.py", line 80, in appendFile
    with open(src, 'rb') as f1:
FileNotFoundError: [Errno 2] No such file or directory: 'unpacked/system1.img'
kota@iMac—Kota ~/Downloads/mstar-bin-tool-master

127|shell@blueberry:/ # mount                                                  
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
tmpfs /mnt/usb tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/iso tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/samba tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /var tmpfs rw,relatime,mode=775,gid=1000 0 0
/dev/block/platform/mstar_mci.0/by-name/system /system ext4 rw,relatime,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/cache /cache ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,journal_checksum,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/userdata /data ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,journal_checksum,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/tvos /tvos ext4 ro,relatime,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/tclconfig /tclconfig ext4 ro,relatime,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/database /userdata ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,journal_checksum,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/mstar_mci.0/by-name/impdat /impdat ext4 ro,relatime,data=ordered 0 0
/dev/fuse /storage/sdcard0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
tmpfs /userdata/epg tmpfs rw,relatime,size=32768k,mode=777 0 0
/dev/block/vold/8:1 /mnt/usb/4476-9A02 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0000,dmask=0000,allow_utime=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0

[i] Processing partition
[i] Name: system
[i] Create: False
[i] Size: NOT_SET
[i] Erase: True
[i] Type: partitionImage
[i] Image: ./unpacked/system.img
[i] LZO: False
[i] SPARSE: True
[i] Memory Offset: NOT_SET
[i] Empty Skip: False
[i] Converting img to sparse ...
sh: binsparseimg2simg.exe: command not found
[i] Splitting sparse file...
Traceback (most recent call last):
File "/Users/alan/Desktop/Android_Tool/mstar-bin-tool-master/pack.py", line 193, in
chunks = utils.sparse_split(sparseFile, tmpDir, chunkSize)
File "/Users/alan/Desktop/Android_Tool/mstar-bin-tool-master/utils.py", line 85, in sparse_split
if os.path.getsize(file) < chunksize or chunksize == 0:
File "/usr/local/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/genericpath.py", line 50, in getsize
return os.stat(filename).st_size
FileNotFoundError: [Errno 2] No such file or directory: 'tmp/system.sparse'

By the pack tool ,the bin file i got is such small that seems umnormal
and it cant work out on my tv

any user of ChongHong Tv succeed in programming your own bin file????
长虹电视用户到底该何去何从...唉...

First of all thank you for all the work you do.
I am having problems running the unpack script with Python 3.8.1
I'm getting the error:

[i] Analizing header ...
Traceback (most recent call last):
  File "C:\Users\antho\Desktop\Firmware\mstar-bin-tool-master\unpack.py", line 44, in <module>
    headerScript = header[:offset].decode()
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xbf in position 9: invalid start byte

Cheers

https://www.mydigit.cn/forum.php?mod=viewthread&tid=103816
Here is the link that the man who used your code and make profit from it.

Does not support system.new.dat.br, vendor.new.dat.br , product.new.dat.br

TV model is Changhong 65A7U
Thank you

乐视超3X43(letv-X343)的bin打包配置文件给不能做一个，用你的mstar-bin-tool-master中的letv-x355pro-system.ini打包刷入时卡在开机界面，谢谢您的劳作。可以的话请把配置文件发个给我[email protected]

unbas@W4rM4ChiN3:~/Descargas/mstar-bin-tool-master$ python3.7 unpack.py ../XGIMI_H2_CN_v.1.12.36_FW-MOD_01/GIMI_XHAD01_XHC05_MAXIM_YN_WMP.bin
[i] Analizing header ...
[i] Saving header script to unpacked/~header_script ...
[i] Parsing script ...
[i] Partition: sboot Offset: 0x4000 Size 0x13800 (78.0 KB) -> unpacked/sboot.img
[i] Partition: MBOOT Offset: 0x18000 Size 0x294c00 (2.58 MB) -> unpacked/MBOOT.img
[i] Partition: recovery Offset: 0x2ad000 Size 0x19df858 (25.87 MB) -> unpacked/recovery.img
[i] Parsing setenv recoverycmd -> mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x25000000 recovery 0x01E00000; bootm 0x25000000
[i] Partition: boot Offset: 0x1c8d000 Size 0x12883f0 (18.53 MB) -> unpacked/boot.img
[i] Parsing setenv bootcmd -> mmc read.p 0x23000000 dtb 0x00100000; mmc read.p 0x25000000 boot 0x01400000; bootm 0x25000000
[i] Partition: optee Offset: 0x2f16000 Size 0x17b7f0 (1.48 MB) -> unpacked/optee.img
[i] Partition: armfw Offset: 0x3092000 Size 0xa270 (40.61 KB) -> unpacked/armfw.img
[i] Partition: RTPM Offset: 0x309d000 Size 0x10000 (64.0 KB) -> unpacked/RTPM.img
[i] Partition: dtb Offset: 0x30ad000 Size 0x11e7 (4.48 KB) -> unpacked/dtb.img
[i] Partition: frc Offset: 0x30af000 Size 0x8d010 (564.02 KB) -> unpacked/frc.img
[i] Partition: system Offset: 0x313d000 Size 0x50eedcc (80.93 MB) -> unpacked/system.lzo
[i] Unpacking LZO (Please be patient) unpacked/system.lzo -> unpacked/system.img
sh: 1: bin/linux-x86/lzop: not found
[i] Partition: system Offset: 0x822c000 Size 0x75ec3bf (117.92 MB) -> unpacked/system1.lzo
[i] Unpacking LZO (Please be patient) unpacked/system1.lzo -> unpacked/system1.img
sh: 1: bin/linux-x86/lzop: not found
[i] unpacked/system1.img append to unpacked/system.img
Traceback (most recent call last):
File "unpack.py", line 147, in
utils.appendFile(outputChunkImgFile, outputImgFile)
File "/home/unbas/Descargas/mstar-bin-tool-master/utils.py", line 83, in appendFile
with open(src, 'rb') as f1:
FileNotFoundError: [Errno 2] No such file or directory: 'unpacked/system1.img'