从安卓/linux固件反编译出dtb和dts

1. 使用RKDevTool解出boot.img

2. 解压boot.img

找到上面的boot.img, 执行以下:

test@srvtest:~/rk3328_v11/kernel/scripts$ mkdir out && cd out
test@srvtest:~/rk3328_v11/kernel/scripts/out$ ../unpack_bootimg --boot_img ./boot.img
boot_magic: ANDROID!
kernel_size: 31528976
kernel load address: 0x10008000
ramdisk size: 837778
ramdisk load address: 0x11000000
second bootloader size: 115712
second bootloader load address: 0x10f00000
kernel tags load address: 0x10000100
page size: 2048
os version: 11.0.0
os patch level: 2021-06
boot image header version: 1
product name:
command line args: console=ttyFIQ0 androidboot.baseband=N/A androidboot.wificountrycode=CN androidboot.veritymode=enforcing androidboot.hardware=rk30board androidboot.console=ttyFIQ0 androidboot.verifiedbootstate=orange firmware_class.path=/vendor/etc/firmware init=/init rootwait ro loop.max_part=7 androidboot.selinux=permissive buildvariant=userdebug
additional command line args:
recovery dtbo size: 0
recovery dtbo offset: 0x0
boot header size: 1648

解压之后结果:

test@srvtest:~/rk3328_v11/kernel/scripts/out$ ls out/ -al
total 31736
drwxrwxr-x 2 test test     4096 May 31 13:02 .
drwxrwxr-x 3 test test     4096 May 31 11:35 ..
-rw-rw-r-- 1 test test 31528976 May 31 13:02 kernel
-rw-rw-r-- 1 test test   837778 May 31 13:02 ramdisk
-rw-rw-r-- 1 test test   115712 May 31 13:02 second

3.解压resource.img or second文件

指令:

u-boot/tools/resource_tool --unpack --image=second
u-boot/tools/resource_tool --unpack --image=resource.img --root=out

test@srvtest:~/rk3328_v11/kernel/scripts/out$ ../resource_tool --unpack --image=out/second                    
Dump header:
partition version:0.0
header size:1
index tbl:
        offset:1        entry size:1    entry num:3
Dump Index table:
entry(0):
        path:rk-kernel.dtb
        offset:4        size:77500
entry(1):
        path:logo.bmp
        offset:156      size:12936
entry(2):
        path:logo_kernel.bmp
        offset:182      size:22364
Unack out/second to out successed!

结果:

test@srvtest:~/rk3328_v11/kernel/scripts/out$ ls out/ -al
total 31852
drwxrwxr-x 2 test test     4096 May 31 13:03 .
drwxrwxr-x 3 test test     4096 May 31 11:35 ..
-rw-rw-r-- 1 test test 31528976 May 31 13:02 kernel
-rw-rw-r-- 1 test test    12936 May 31 13:03 logo.bmp
-rw-rw-r-- 1 test test    22364 May 31 13:03 logo_kernel.bmp
-rw-rw-r-- 1 test test   837778 May 31 13:02 ramdisk
-rw-rw-r-- 1 test test    77500 May 31 13:03 rk-kernel.dtb
-rw-rw-r-- 1 test test   115712 May 31 13:02 second

如上, rk-kernel.dtb已经解压出来了.

4.使用dtc反编译dtc

test@srvtest:~/rk3328_v11/kernel/scripts/out$ dtc -I dtb -O dts -o out/rk-kernel.dts out/rk-kernel.dtb                  
test@srvtest:~/rk3328_v11/kernel/scripts/out$ ls out/rk-kernel.dts
out/rk-kernel.dts

5. Done