Creating custom Android firmware based on stock: from parsing to assembly

⚠️ Attention: Modifying the firmware will void the device warranty and may lead to irreversible consequences. The process requires unlocking the bootloader, which is officially prohibited on some devices (for example Huawei or Sony Xperia). Before starting work, make sure that you have a backup copy of your data and access to EDL mode (emergency firmware) for your model.

It is also worth noting that the firmware assembly procedure can take from several hours to a day in depending on the power of your PC. To work you will need at least 16 GB of RAM i 100 GB of free space on an SSD drive. If your device runs on a processor Mediatekbe prepared for additional complications with drivers and tools like SP Flash Tool.

1. Preparation: tools and requirements

Before you begin modifying the firmware, you need to collect a complete set of tools and make sure that your device supports the required operations. The main components you will need:

• 🔧 A computer running Linux (recommended Ubuntu 22.04 LTS or Debian 11). Virtual machines running Windows through WSL2 may be unstable.
• 📱 Unlocked bootloader on the target device. For most brands, this requires official unlocking through the manufacturer's website (for example, Mi Unlock Tool for Xiaomi).
• 💾 Stock firmware in format .zip or .img for your model. Download only from official sources (for example, Samsung Firmware or Xiaomi Firmware Updater).
• 🛠️ Tool package:
  • Java JDK 11+ (for working with apktool)
  • Python 3.8+ (for automation scripts)
  • Git (for cloning repositories)
  • ADB & Fastboot (for interaction with the device)
  • 7-Zip or tar (for unpacking archives)

Special attention pay attention to version Java. Some tools (for example apktool) do not work correctly with Java 17+so you may need to install a specific version via sdkman or manually configure environment variables.

Also prepare backup the EFS partition (contains IMEI and serial numbers). To do this, in the Fastboot mode:

adb backup -f efs_backup.ab -apk -obb -shared -all -system

2. Extracting and analyzing stock firmware

Stock firmware is usually supplied in the form of archives with the extension .zip, .tar or .md5 (for Samsung). Your task is to extract partition images from them (boot.img, system.img, vendor.img etc.) for further modification.

For devices on Qualcomm Snapdragon use the utility payload_dumper (if the firmware is in the format payload.bin):

git clone https://github.com/vm03/payload_dumper
python payload_dumper.py payload.bin

This will split the firmware into separate files .img. For devices Mediatek you will need SP Flash Tool or MTK Client.

After extraction, check the integrity of the images using sha256sum:

sha256sum boot.img system.img

Compare the hashes with the official values (if they are provided by the manufacturer).

Unpacked the firmware archive|Obtained boot.img and system.img images|Checked integrity hashes|created an EFS backup copy|Connected the debugging cable-->

3. Decompilation and modification of system.img

The main work is being done with the partition system.img, which contains the Android kernel, system applications and frameworks. To modify it you will need:

1. Mount system.img as ext4section:

   sudo mount -o loop system.img /mnt/system

2. Use apktool to decompile APK files (for example, Settings.apk or Framework-res.apk):

   apktool d Framework-res.apk -o framework

3. Make changes to the decompiled files (for example, remove signature verification in AndroidManifest.xml or modify resources in res/values).
4. Rebuild the APK using apktool b and sign it using signapk.

Modification example: to remove pre-installed applications (bloatware), find them in the folder /mnt/system/priv-app/ or /mnt/system/app/ and delete the corresponding .apk and .odex files. However, be careful - deleting system services. (for example, TeleService.apk on Samsung) may disrupt the operation of telephony.

For devices with dynamic partitions (Android 10+) you will need to work with super.img, which contains several logical partitions. Use lpunpack And lpmake to unpack and reassemble it:

lpunpack super.img
Make changes to the unpacked images
lpmake --device-size=1073741824 --metadata-size=65536 --sparse --output=super_new.img system.img vendor.img product.img

4. Working with boot.img: kernel and ramdisk

File boot.img contains the Linux kernel and ramdisk — a temporary file system loaded into memory when the device starts. To modify it:

• 🔄 Parse boot.img using unpackbootimg (from the package android-bootimg-tools):

  unpackbootimg -i boot.img -o boot

  This will create a folder with files boot.img-zImage (kernel) and boot.img-ramdisk.gz (compressed ramdisk).

• 📂 Unpack the ramdisk:

  gzip -d boot.img-ramdisk.gz
  cpio -i -F boot.img-ramdisk

• ✏️ Make changes to the ramdisk files (for example, edit init.rc to disable the check dm-verity or add support Magisk).
• 🔙 Rebuild the ramdisk and boot.img:

  find . | cpio -H newc -o | gzip > new-ramdisk.gz
  repackbootimg -i boot.img -k boot.img-zImage -r new-ramdisk.gz -o new-boot.img

One of the most common modifications is disabling dm-verity (checking the integrity of the system section), which allows you to load modified firmware. To do this, in the file init.rc find the line:

verifyatboot

and replace it with:

#verifyatboot

or delete it completely.

⚠️ Attention: Disabling dm-verity reduces security device, as it allows you to download potentially malicious code. Use this modification only if you plan to further encrypt the partition /data using FDE or FBE.

5. data-i="162">After modifying all the necessary partitions, they need to be assembled back into a format suitable for flashing. The process depends on the type of device:

After modifying all the necessary partitions, they need to be assembled back into a format suitable for flashing. The process depends on the device type:

For devices with A/B-partitions (for example, Google Pixel or OnePlus) flash changes to both slots:

fastboot --set-active=a
fastboot flash boot new-boot.img
fastboot --set-active=b
fastboot flash boot new-boot.img

After flashing, you need to sign the modified partitions. To do this, use the utility avbtool (for devices with AVB 2.0):

avbtool add_hash_footer --partition_name system --partition_size $(wc -c < system.img | awk '{print $1}') --image system.img --algorithm SHA256_RSA2048 --key rsa_private.key --output system_signed.img

6. Testing and debugging

First launch of the modified one. firmware is the most critical stage. Even if the device has booted, check the following parameters:

• 📶 Cellular communications and Wi-Fi: Make sure that the IMEI is saved (check via *#06#), and the modem recognizes SIM cards.
• 🔋 Charging and battery: Check the charge level display and charging speed (on some devices after modification boot.img fast charging disappears).
• 🎵 Sound and multimedia: Test the speakers, microphone and video playback (especially with a codec H.265).
• 🔒 Security: If you disabled dm-veritycheck the operation of Magisk or other modules for root access.

For debugging, use the commands:

adb logcat | grep -i "error" # View errors in logs
adb shell dmesg | grep -i "fail" # Kernel errors

If the device boots, but interface artifacts or lags occur, the problem may be incompatibility of the modified ones .apkfiles with version Android Runtime (ART). In this case, try:

1. Clear the ART cache via adb shell pm clear-cache.
2. Rebuild the APK with a different level of optimization (for example, add a flag --use-aapt2 to apktool).
3. Return original files framework-res.apk and android.policy.jar.

7. Optimization and additional modifications

When the base firmware works stably, You can start fine tuning. Here are some popular optimizations:

• ⚡ Speed up animation: Change the values in framework-res.apk/res/values/integers.xml:

  <integer name="config_activityShortDur">100</integer>
  <integer name="config_activityDefaultDur">150</integer>

• 🗑️ Bloatware cleaning: Remove unnecessary system applications (for example, Browser2.apk to Samsung or MiBrowserGlobal.apk on Xiaomi), but leave critical services like TelephonyProvider.apk.
• 🔄 Scheduler settings kernels: For processors Qualcomm add to build.prop:

  debug.performance.tuning=1
  pm.deferred_launch=true

• 🔒 Adding Magisk: Patch boot.img via Magisk Manager to obtain root access without a trigger SafetyNet.

For devices with AMOLED screens you can optimize the color palette by editing files in /vendor/overlay. For example, for more saturated black colors, change the settings in DisplayColorMode.xml.

⚠️ Attention: Changing kernel parameters (for example, processor frequencies in /sys/devices/system/cpu) can lead to overheating or unstable operation. Always test such modifications with temperature logging enabled via adb shell cat /sys/class/thermal/thermal_zone*/temp.

8. Creating a flashable archive for distribution

If you want to share your firmware with other users, package it in flashable-zip, which can be flashed via TWRP or OrangeFox Recovery. The archive structure should include:

• META-INF/com/google/android/updater-script — a recovery script describing the firmware process.
• system.img, boot.img and other modified sections.
• vendor/ —if modified vendor.img.
• install/bin/ — auxiliary scripts (for example, to check the device model).

A simple example updater-script:

ui_print("Installing modified firmware...");
assert(getprop("ro.product.device") == "RMX1971" || abort("This firmware is only for Realme 6!"));

package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
package_extract_file("system.img", "/dev/block/bootdevice/by-name/system");

ui_print("The firmware is complete! Reboot...");
set_progress(1.0);

To automate the assembly of the archive, use the script on Bash:

#!/bin/bash
zip -r custom_rom.zip META-INF system.img boot.img vendor.img
signapk -w testkey.x509.pem testkey.pk8 custom_rom.zip custom_rom_signed.zip

Before distributing, test the archive on a clean installation (with a full wipe /data) and make sure that the firmware passes check SafetyNet (if this is important for your case).

FAQ: Frequently asked questions