{"id":169,"date":"2021-02-02T21:57:58","date_gmt":"2021-02-03T05:57:58","guid":{"rendered":"http:\/\/junsun.net\/wordpress\/?p=169"},"modified":"2022-04-12T10:28:34","modified_gmt":"2022-04-12T17:28:34","slug":"build-flash-and-un-flash-aosp-image-on-pixel-phones","status":"publish","type":"post","link":"https:\/\/junsun.net\/wordpress\/2021\/02\/build-flash-and-un-flash-aosp-image-on-pixel-phones\/","title":{"rendered":"Build, Flash and Un-Flash AOSP Image on Pixel Phones"},"content":{"rendered":"\n<p>In this post we will go through a full cycle of building a custom AOSP image, flashing it on a Pixel phone, and then restoring to original stock image.  We will use Pixel 4 (codenamed as &#8220;flame&#8221;) as the device example.  We will walk through in a succinct manner without detailed explanations.<\/p>\n\n\n\n<h2>Prepare the Device<\/h2>\n\n\n\n<ul><li>Note the Android build number<ul><li>Click &#8220;Settings&#8221;\/&#8221;About Phone&#8221;.  <\/li><li>In my case it is &#8220;QQ3A.200805.001&#8221;<\/li><\/ul><\/li><li>Enable developer options<ul><li>click on &#8220;Build Number&#8221; row 7 times to enable developer options<\/li><\/ul><\/li><li>Enable &#8220;OEM unlocking&#8221;<ul><li>Toggle &#8220;Settings&#8221;\/&#8221;System&#8221;\/&#8221;Advanced&#8221;\/&#8221;Developer Options&#8221;\/&#8221;OEM unlocking&#8221; <\/li><\/ul><\/li><\/ul>\n\n\n\n<h2>Build AOSP Image<\/h2>\n\n\n\n<h3>Prepare the host<\/h3>\n\n\n\n<p>My host is Ubuntu 20.04.  Generally we are following <a href=\"https:\/\/source.android.com\/setup\/build\/initializing\">this guide from Google<\/a>.  Below is a quick gist.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z1-dev libgl1-mesa-dev libxml2-utils xsltproc unzip fontconfig\nsudo apt install python2    #repo needs python\nsudo usermod -aG plugdev $LOGNAME\napt-get install android-sdk-platform-tools-common   # install udev rules and adb<\/code><\/pre>\n\n\n\n<h3>Download AOSP source<\/h3>\n\n\n\n<p>Generally we are following <a href=\"https:\/\/source.android.com\/setup\/build\/downloading\">this guide from Google.<\/a>  Below are some specific steps.<\/p>\n\n\n\n<ul><li>Find exact branch\/tag that matches device current build.<ul><li>Go to the <a href=\"https:\/\/source.android.com\/setup\/start\/build-numbers\">Android build tag page<\/a><\/li><li>Search for the build number noted at the previous step<\/li><li>Find corresponding AOSP tag.  In my case, it is &#8220;android-10.0.0_r41&#8221;<\/li><\/ul><\/li><li>Check out this branch<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir android-10.0.0_r41-shallow\ncd android-10.0.0_r41-shallow\nrepo init --depth=1 -u https:\/\/android.googlesource.com\/platform\/manifest -b android-10.0.0_r41\nrepo sync  --force-sync --no-clone-bundle --no-tags -j$(nproc)<\/code><\/pre>\n\n\n\n<h3>Fetch Proprietary Binaries<\/h3>\n\n\n\n<ul><li>Go to <a href=\"https:\/\/developers.google.com\/android\/drivers\">Google proprietary binary page<\/a><\/li><li>Find the section corresponding to your device (Pixel 4 in my case) and the build number (&#8220;QQ3A.200805.001&#8221;)<\/li><li>Download tarballs from Google and Qualcomm<\/li><li>Untar them under the root directory of AOSP source tree<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ~\/work\/android\/android-10.0.0_r41-shallow\ntar xzf ~\/Downloads\/google_devices-flame-qq3a.200805.001-a7a5499d.tgz\ntar xzf ~\/Downloads\/qcom-flame-rp1a.200720.009-1157dde5.tgz\n.\/extract-google_devices-flame.sh\n.\/extract-qcom-flame.sh<\/code><\/pre>\n\n\n\n<h3>Build images<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>source build\/envsetup.sh\nlunch aosp_flame-userdebug\nm<\/code><\/pre>\n\n\n\n<p>Note &#8220;flame&#8221; is the codename for Pixel 4.  If you have a different device, you should use a different target.  See <a href=\"https:\/\/developers.google.com\/android\/images\">Pixel factory image page<\/a> for device codenames.<\/p>\n\n\n\n<p>Command &#8216;m&#8217; starts the build process, which can take very long.  My laptop has AMD Ryzen\u2122 7 Pro 4750U Processor (1.70 GHz, up to 4.10 GHz Max Boost, 8 Cores, 16 Threads, 8 MB Cache) and has a fast NVME SSD disk.  It takes about 2.5 hours to finish the build.<\/p>\n\n\n\n<h2>Flash AOSP Built Image<\/h2>\n\n\n\n<ul><li>On the phone, enable OEM unlocking and USB debugging<ul><li>Toggle &#8220;Settings&#8221;\/&#8221;System&#8221;\/&#8221;Advanced&#8221;\/&#8221;Developer options&#8221;\/&#8221;USB debugging&#8221;<\/li><li>Toggle &#8220;Settings&#8221;\/&#8221;System&#8221;\/&#8221;Advanced&#8221;\/&#8221;Developer options&#8221;\/&#8221;OEM unlocking&#8221;<\/li><\/ul><\/li><li>On the PC in the same terminal where you just build the AOSP image<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>adb devices             # it should show the phone device attached over ADB\nadb reboot bootloader   # reboot to fastboot\nfastboot devices        # it should show the phone device attached over ADB\nfastboot flashing unlock\nfastboot flashall -w<\/code><\/pre>\n\n\n\n<p>During &#8220;fastboot flashing unlock&#8221; step, you need to following instruction on the screen, press up\/down volume button to select &#8220;unlock bootloader&#8221;, and press power button to commit.<\/p>\n\n\n\n<p>If things go smoothly, phone will reboot a couple of times and eventually boots into the freshly built AOSP image with root access. <\/p>\n\n\n\n<h2>Restore to Stock ROM Image<\/h2>\n\n\n\n<p>After you played enough with the AOSP image, you may want to return to the original retail state.  Google has made it easy recently.<\/p>\n\n\n\n<ul><li>Open Chrome browser and go to &#8220;https:\/\/flash.android.com&#8221;<\/li><li>Allow browser to connect to the device<\/li><li>Go to <a href=\"https:\/\/developers.google.com\/android\/images#flame\">Pixel 4 factory image page<\/a> and find the desired build number to flash<ul><li>Just for fun, I&#8217;m selecting Android 11, build number RQ1A.210205.004.<\/li><\/ul><\/li><li>Select &#8220;Wipe device&#8221; and &#8220;Lock bootloader&#8221;<\/li><li>Click &#8220;Confirm&#8221; to start the process.  <\/li><\/ul>\n\n\n\n<h2>What If Things Go Wrong?<\/h2>\n\n\n\n<p>Things can go wrong when phone does not boot up anymore.  It can be due to build AOSP build, or something due to mismatch between AOSP image and baseban\/firmware version  (BTW, this is the reason why this guide asks you to download the same version of AOSP that matches existing build).<\/p>\n\n\n\n<ul><li>Go to <a href=\"https:\/\/developers.google.com\/android\/images#flame\">Pixel 4 factory image page<\/a> and download a version of your choice<\/li><li><a href=\"https:\/\/nerdschalk.com\/boot-google-pixel-pixel-xl-bootloader-fastboot-mode\/\">Power up phone and go to fastboot or bootloader mode<\/a><ul><li>Your phone may automatically go to this mode if AOSP image fails to boot up<\/li><\/ul><\/li><li>Untar the the image and flash from terminal<ul><li>Make using recent or latest fastboot program<\/li><\/ul><\/li><li>Go to the downloaded factory image directory, &#8220;.\/flash-all.sh&#8221;<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>unzip flame-qq3a.200805.001-factory-d93c74e6.zip\ncd flame-qq3a.200805.001\/\nfastboot devices   # make sure phone is connected\n.\/flash-all.sh \n<\/code><\/pre>\n\n\n\n<h2>(Bonus) How to Add a System Privileged App<\/h2>\n\n\n\n<p>Before Android 10, you simply re-mount \/system as rw and push apk into \/system\/priv-app\/<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adb root\nadb shell remount -orw,remount \/system\nadb push my-app.apk \/system\/priv-app\nadb reboot    # to complete the app installation<\/code><\/pre>\n\n\n\n<p>Since Android 10, \/system is mounted as root and cannot be re-mounted as rw.  Instead you will need to use &#8220;adb remount&#8221; to enable overlay FS for any modification.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adb root\nadb remount     # if this is first time, \"adb reboot\" to disable verity first\nadb push my-app.apk \/system\/priv-app\nadb reboot      # to complete the app installation<\/code><\/pre>\n\n\n\n<p>Often times you need to assign <a href=\"https:\/\/developer.android.com\/guide\/topics\/manifest\/permission-element\">PivilegedOrSystem level permissions<\/a> to system apps (which is why you want to install system app at the first place).  Starting from Android 8.1, you will need to explicitly <a href=\"https:\/\/source.android.com\/devices\/tech\/config\/perms-allowlist\">whitelist these permissions in system xml files<\/a>.<\/p>\n\n\n\n<p>For example, to give READ_PRIVILEGED_PHONE_STATE permission to a testing app, <code>net.junsun.idattestation<\/code>, you need to create the following file on phone, \/etc\/permissions\/priv-app\/privapp-permissions-idattestation.xml<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"utf-8\"?&gt;\n&lt;!--\nThis XML file declares which signature|privileged permissions should be granted to privileged\napplications that come with the platform\n--&gt;\n&lt;permissions&gt;\n    &lt;privapp-permissions package=\"net.junsun.idattestation\"&gt;\n        &lt;permission name=\"android.permission.READ_PRIVILEGED_PHONE_STATE\"\/&gt;\n    &lt;\/privapp-permissions&gt;\n&lt;\/permissions&gt;<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>In this post we will go through a full cycle of building a custom AOSP image, flashing it on a Pixel phone, and then restoring to original stock image. We will use Pixel 4 (codenamed as &#8220;flame&#8221;) as the device example. We will walk through in a succinct manner without detailed explanations. Prepare the Device &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/junsun.net\/wordpress\/2021\/02\/build-flash-and-un-flash-aosp-image-on-pixel-phones\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Build, Flash and Un-Flash AOSP Image on Pixel Phones&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":""},"categories":[3],"tags":[9,54,62,61],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/posts\/169"}],"collection":[{"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/comments?post=169"}],"version-history":[{"count":11,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/posts\/169\/revisions"}],"predecessor-version":[{"id":337,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/posts\/169\/revisions\/337"}],"wp:attachment":[{"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/media?parent=169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/categories?post=169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/junsun.net\/wordpress\/wp-json\/wp\/v2\/tags?post=169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}