Hovatek Forum DEVELOPMENT Android [Tool] Android IMG Unsign Tool
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


[Tool] Android IMG Unsign Tool

[Tool] Android IMG Unsign Tool

Pages (2): 1 2 Next
X3non
X3non
X3non
Recognized Contributor
22,062
01-03-2019, 05:09 PM
#1



We've created this tool to make it easy to unsign signed android firmware images e.g boot-sign, recovery-sign, system-sign.img. Including signed images not supported when trying to unsign using FBwintools

[Image: Android-IMG-unsign-tool.png]

Note
  • To unsign other files asides from boot, recovery, system and vendor, you can rename the file to system-sign.img and use the same technique used to unsign system-sign.img
  • Note that this tool isn't guaranteed to work on all signed images esp those from latest Unisoc (SPD) devices

Requirements

  • Signed image file (e.g boot-sign.img , recovery-sign.img e.t.c) (extracted from the signed firmware
  • Download Android IMG unsign tool by Team Hovatek from the link at the bottom of this post
  • Windows PC

How to unsign signed images using Team Hovatek's android IMG unsign tool


See the video tutorial below or at https://youtu.be/0NVWgVktJBM

  1. Extract the android IMG unsign tool zip
  2. Copy the signed image e.g boot-sign.img into the signed folder 
    • If you're trying to unsign system-sign.img or vendor-sign.img , you must also copy boot-sign.img into the signed folder
  3. Double-click IMG unsign tool.exe
  4. Click the unsign tab
  5. Click the option for the image you copied into the signed folder
  6. Wait while our tool unsigns the image file
  7. Once successful, you'll find the unsigned image in the unsigned folder. 

Downloads


Video Transcript
Quote:In this video tutorial, i'm going to be showing how to unsign image files using IMG unsign tool.
So i have here with me two different firmwares that have been signed.
This is for lenovo a1000.
Now the difference between this two images is that the two of them can not be unsigned using FBwintools.
We have a guide on how to use FBwintools but there's a new signature type that FBwintools can't unsign
So this image here can be unsigned using FBwintools. Lenovo A1000 can't
So lets try this now, we'll copy this
Now we're actually trying to see if FBwintools can unsign this image
So here you go, it says file boot-sign is not FB. So that means FBwintools can't unsign this image file
So lets go over to IMG unsign tool
Now to unsign a boot image you copy the boot image file into the signed folder then launch the tool
The first tab shows the instructions
Launch the tool, click the unsign tab then click boot or recovery
So since we copied a boot image file we'll click boot
Once it's done, you'll get boot image has been unsigned successfully, check the unsigned folder
Ok, so this is our unsigned boot image
Now lets confirm that this boot has actually been unsigned
To confirm, we'll need to extract using carliv image kitchen
So this is carliv image kitchen, now we're going to try and extract boot image which is the unsigned file and boot-sign which is the signed file so that we'll confirm that this has actually been unsigned
So we'll click boot, B for boot.
We'll try unsigning boot-sign first sorry, extracting boot-sign first
So here it gives us an error message it can't extract boot-sign
So lets go back and try boot image instead
Ok, so here we go. It has extracted boot.img, we can see it
So clearly unsigning worked
Now lets try unsigning a system signed image
Ok, so the instruction says copy boot-sign.img into the signed folder then copy system image or vendor image into the signed folder
So this lenovo A1000 the system.img is not signed so there's no need
Lets try unsigning from this
So, we're trying to unsign system and vendor but we also need to copy boot signed image
system and vendor
We're copying them into signed folder
Ok, so we'll click the unsigned tab then click system
So once that's done, you'll get the message system image has been unsigned successfully
We can now check the unsigned folder this is our unsigned system.img
Now lets try unsigning vendor image remember we've already copied vendor-sign into the signed folder
So we'll click on vendor. So that's it
Now lets try extracting these files to confirm that it has actually been unsigned
You can use any of your favourite system extracting tool
I'm going to be using MTK extractor
Ok, so let me launch the tool
so first, i'm going to try and extract system signed image to confirm that the image is actually signed
so you can see it says it's done but checking the extracted folder, it's empty. So that means it can't extract a signed system image
So lets now try and extract the unsigned image which is this
So Ok, it says it's done. We can now check the the system folder and here you go it was able to extract the unsigned image so that means unsigning was successful
Well, so that's how you unsign these files using IMG unsign tool
This post was last modified: 17-02-2020, 12:21 PM by X3non.
paeffiong
paeffiong
paeffiong
Senior Member
138
06-04-2019, 09:32 AM
#2
I have just finished using this tool to unsigned the recovery for tecno pop 2
paeffiong
paeffiong
paeffiong
Senior Member
138
06-04-2019, 09:34 AM
#3
Thanks for making life so simple for us in the Android world.
shankar1790
shankar1790
shankar1790
Senior Member
474
13-04-2019, 12:06 PM
#4
Well i don't know the process of unsigning method of this tool but it just give same system-sign.img in output unsign folder( system.img is still signed). i had read the instruction carefully and putted both boot and system sign img in Sign folder.

I have to Manually Removed its secure Flag in HXD editor
From OFFSET 400 TO OFFSET 1003F0 (QUITE HUGE)
  
The system-sign.img is of INFOCUS A2
X3non
X3non
X3non
Recognized Contributor
22,062
13-04-2019, 06:16 PM
#5



(13-04-2019, 12:06 PM)shankar1790 Well i don't know the process of unsigning method of this tool but it just give same system-sign.img in output unsign folder( system.img is still signed). i had read the instruction carefully and putted both boot and system sign img in Sign folder.

I have to Manually Removed its secure Flag in HXD editor
From OFFSET 400 TO OFFSET 1003F0 (QUITE HUGE)
  
The system-sign.img is of INFOCUS A2

like you mentioned 1003F0 is too large, even mtk sign header usually isnt as large as that
i believe the signature should be from 0 to 400
shankar1790
shankar1790
shankar1790
Senior Member
474
14-04-2019, 01:26 AM
#6
(13-04-2019, 06:16 PM)X3non
(13-04-2019, 12:06 PM)shankar1790 Well i don't know the process of unsigning method of this tool but it just give same system-sign.img in output unsign folder( system.img is still signed). i had read the instruction carefully and putted both boot and system sign img in Sign folder.

I have to Manually Removed its secure Flag in HXD editor
From OFFSET 400 TO OFFSET 1003F0 (QUITE HUGE)
  
The system-sign.img is of INFOCUS A2

like you mentioned 1003F0 is too large, even mtk sign header usually isnt as large as that
i believe the signature should be from 0 to 400
NO i don't think so because its start from 0 to 400(all are 00) the img is still signed because its started from 400 (sprd-secureflag). And multiple line of each secureflag one ended then other started till 1003F0.
I just searched block ** 80 00 00 80 ** and select and deleted all offsets beginning before 100400 to 400.
This post was last modified: 14-04-2019, 07:07 AM by shankar1790.
X3non
X3non
X3non
Recognized Contributor
22,062
14-04-2019, 10:53 PM
#7
(14-04-2019, 01:26 AM)shankar1790 NO i don't think so because its start from 0 to 400(all are 00) the img is still signed because its started from 400 (sprd-secureflag). And multiple line of each secureflag one ended then other started till 1003F0.
I just searched block ** 80 00 00 80 ** and select and deleted all offsets beginning before 100400 to 400.

can you post link to this rom?
shankar1790
shankar1790
shankar1790
Senior Member
474
15-04-2019, 03:43 AM
#8
(14-04-2019, 10:53 PM)X3non
(14-04-2019, 01:26 AM)shankar1790 NO i don't think so because its start from 0 to 400(all are 00) the img is still signed because its started from 400 (sprd-secureflag). And multiple line of each secureflag one ended then other started till 1003F0.
I just searched block ** 80 00 00 80 ** and select and deleted all offsets beginning before 100400 to 400.

can you post link to this rom?

https://drive.google.com/uc?id=1Wvq5tomA...t=download

One think i noticed its secure Flag not actually end with offset 1003f0 (its end before this offset ) but lots of zero after this offset till 1003f0 so i just assume -SORRY for uncomplet info.
Its start from qhsignheader 0 till offset 400 then secureflag started.
When i replaced or delete this (qhsignheader)hex value and put 0s the img get corrupted and assayed kitchen treat like it a apk  while  extraction and failed.
I mean i have to put this qhsignheader as it is (untouched) and deleted all offsets from 400 to 1003F0.
Thats all
EDIT- Assyased kitchen failed to extract system.img due to i just delete qhsignheader and maually put 0 (not fill option in hxd editor). I think this the cause behind img corruption.
Note- i noticed this type of multiple sign header are present in cpb format extracted firmware( i personely think)
I faced this issue on  firmware i download are in cpb formats like infocus a2, advan s5e 4gs.
This post was last modified: 22-04-2019, 04:55 AM by shankar1790.
X3non
X3non
X3non
Recognized Contributor
22,062
15-04-2019, 10:29 AM
#9
(15-04-2019, 03:43 AM)shankar1790 https://drive.google.com/uc?id=1Wvq5tomA...t=download

One think i noticed its secure Flag not actually end with offset 1003f0 (its end before this offset ) but lots of zero after this offset till 1003f0 so i just assume -SORRY for uncomplet info.
Its start from qhsignheader 0 till offset 400 then secureflag started.
When i replaced or delete this (qhsignheader)hex value and put 0s the img get corrupted and assayed kitchen treat like it a apk  while  extraction and failed.
I mean i have to put this qhsignheader as it is (untouched) and deleted all offsets from 400 to 1003F0.
Thats all

thanks, we'll be sure to check this out
painterkev
painterkev
painterkev
Newbie
4
16-04-2020, 06:19 PM
#10



I have boot-sign.img that I want to patch with Magisk. Should I unsign boot.img,using your tool,then patch with Magisk then have it re-signed and then flash with Sp Flash Tools? Or as I am only flashing boot image and unticking all other partitions will flash tool work on renamed(to boot.img) patched .IMG Thanks
Pages (2): 1 2 Next
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram