As usual, you can grab a copy on the googlecode download page

The major new functionality in this release is that baksmali now supports deodexing without the help of deodexerant! It also has a new “register info” feature, to show the register types in the disassembly, and numerous minor fixes/changes/enhancements/tweaks/(and probably bugs)

Deodexing

In order to deodex files now, you need to have the boot class path files available for baksmali to use. By default, it looks for the 5 main framework jars in the current directory. You can of course specify additional directories to search in, add additional boot class path files, or change which boot class path files are used altogether.

The DeodexInstructions page has more info on how to deodex with this version. But for a quick primer, you just need to have the 5 main framework files in the current directory (core.jar, ext.jar, framework.jar, android.policy.jar and services.jar), and then specify the -x option for baksmali. For example:

baksmali -x Calculator.odex -o Calculator

Register Info

Another bit of new functionality that can be very helpful is the new “register info” output for baksmali, which can be turned on with the -r parameter. It will analyze the registers and print some register type info before and after each instruction. There are several levels of register info output available, depending on exactly what you want to see. The default is to print the register type for any register that is used by the instruction.

Note that this functionality also requires that baksmali load the boot class path files – so they must be available. Here is an example of what the default register info looks like:

#v0=(Integer);v2=(Integer);
new-array v2, v0, [C
#v2=(Reference,[C);

The register types that are printed just before the instruction are the incoming register types, while the register types that are printed after the instruction show any changes to the registers caused by the instruction.

If you want to see all the register info, you can use -r ALL,FULLMERGE which looks something like this:

#v0=(Integer):merge{0x18:(Null),0x2c:(Integer)}
#v1=(Conflicted):merge{0x18:(Uninit),0x2c:(Integer)}
#v3=(Conflicted):merge{0x18:(Uninit),0x2c:(Char)}
#v2=(Reference,[C);p0=(Reference,Ljava/lang/String;);p1=(Reference,[B);p2=(Integer);p3=(Integer);p4=(Integer);
iget v2, p0, Ljava/lang/String;->count:I
#v0=(Integer);v1=(Conflicted);v2=(Integer);v3=(Conflicted);p0=(Reference,Ljava/lang/String;);p1=(Reference,[B);p2=(Integer);p3=(Integer);p4=(Integer);

Other changes

There are a few other miscellaneous changes as well. Make sure you take a look at the usage info for smali and baksmali. The short parameters for some of the options have changed. In particular some of the options that are mostly for debugging purposes were changed to an uppercase letter, and are now hidden by default. You can use -?? for both smali and baksmali to see the debug options.

baksmali also has a new -f parameter, which adds a comment with the code address before each instruction. This is useful when looking at the FULLMERGE register info, which shows the register info and code addresses for all “incoming” execution paths.

Things to come

With this release, I have added a robust code analyzer/verifier that can infer the register types and validate the instructions. I plan using this to add verification functionality in smali, so that it will optionally verify the code after assembling it. This will let you know there’s a problem with the assembled code without having to push the code to a device and have dalvik complain to you about the invalid code.

I also want to add some way to dump/serialize the results of loading the boot class path files for baksmali, so that it can load the information it needs from the dump file, instead of reading in all 5 boot class path files every time, which should help speed it up.

In the longer term, I would love to be able to debug code on a device at an assembly level. This is just something that is banging around in the back of my head for now.

This version has significant new functionality, and is much better able to handle the larger framework files that are floating around. There are a number of bug fixes as well.

As usual, you can grab the new versions from the googlecode download page

The changes for this version include:

• Added support for a new .locals directive, which can be used instead of the .registers directive, to specify the number of non-parameter registers in the method
• Added support for the --use-locals/-l option in baksmali, to use the .locals directive instead of the .registers directive
• Added support for the --sequential-labels/-q option in baksmali, which causes baksmali to create label names using a sequential numbering scheme, instead of basin it on the bytecode address
• Added support for automatically upgrading const-string to const-string/jumbo when needed and upgrading goto or goto/16 to goto/16 or goto/32 when needed
• Added support for the --no-fix-string-const/-c option in smali, to prevent automatically upgrading const-string instructions to const-string/jumbo
• Added support for the --no-fix-goto/-g option in smali, to prevent automatically upgrading goto and goto/16 instructions
• Added support for the --no-debug-info/-b option in baksmali, to prevent the output of any type of debugging info (.local, .line, .parameter, etc.)
• misc. bugfixes

The “softroot” that was released is simply an unsigned update file that copies a custom init.rc to the device that enables adb (only over wifi, for now). Unsigned update, you ask? Yes. The nook accepts unsigned updates. The structure of an update is fairly simple. Basically, it’s a .tar.gz file that contains at least 3 files: Firmware_Update/update.script, Firmware_Update/md5sums and Firmware_Update/sha1sums.

The update.script file is a script that is run by turboboot – a proprietary bootloader/recovery environment that is used in the nook. Documentation for turboboot can be found easily with $favorite_search_engine. The turboboot environment is a minimal linux+busybox environment. It allows you to run arbitrary system commands from the update.script, so you can really do just about anything you want in an update.

For the md5sums and sha1sums file, the only requirement is that running md5sum -c md5sums and sha1sum -c sha1sums from the Firmware_Update  directory will succeed. So you need to have at least 1 valid checksum in each file.

That’s basically it for the update. You can add whatever else the update needs of course. To run the update, place the .tar.gz file on the root of the external sdcard, named bravo_update.dat, power off the nook, and then after powering it back on, immediately press the page up/page down buttons. It should then check for the update file, unpack it, validate the md5sums and sha1sums files, and then run the update.

If you’ve already taken a look at the 1.1.0 or 1.1.1 update files that have been released recently, you’ve probably noticed that they aren’t just a plain .tar.gz, but they have what appears to be a signature header at the beginning of the file. As far as I can tell, when a new update is available, the nook system software will download the signed update to the 3rd partition of the internal sdcard, verify it and then strip off the signature header and place the plain .tar.gz in the root of the 2rd partition of the internal sdcard. It then sets a value in a specific place on the sdcard that tells turboboot to check the internal sdcard instead of the external sdcard for the update. And then when the nook reboots, turboboot finds the unsigned update file and applies it.

If you want to poke around in the 1.1.1 update, the file is available for download from Barnes and Noble’s Nook FAQ page. Once you download the update, you’ll need to strip off the signature header before extracting it:

tail -c +174 signed_bravo_update.dat > signed_bravo_update.tar.gz

Finally, a bit more about the nook’s start-up in general. The nook appears to boot directly from the sdcard. There is around 200mb of space at the end of the sdcard, past the end of the last partition, where various things are stored: bootloader, kernel, etc. These all appear to be stored at specific locations relative to the end of the sdcard.

The primary bootloader is stored at an offset relative to the end of the sdcard. For non-sdhc cards, this is at endofsd-9k. And there is additional bootloader code stored at endofsd-281k.

The kernel is stored at endofsd-4377k, and interestingly, the last full firmware update that was applied on the nook is stored at endofsd-135449k. And finally the kernel and ramdisk for the turboboot environment is stored at endofsd-139545k.

The ramdisk for the turboboot environment contains an interesting script named initboot.script that handles the update process. One of it’s features is that if the nook fails to successfully boot 3 times in a row, then it will perform a “fallback”, and will wipe out the OS partition and re-apply the full update that is stored in the ending area of the sdcard.

It was when I was first looking at the initboot.script file that I realized that the nook accepted unsigned updates. Once I realized that, I pinged fellow nookdev robbiet480 (because he has a nook, and I don’t yet :/) and after a few tries, was able to build an initial proof-of-concept update that he ran on his nook and proved that we could in fact get an unsigned update to run.

From there, the other nookdev members took it from the proof-of-concept that I did to the actual softroot that is available now. Great job guys!

Why should you get the new version you ask? Well, it’s been spiffified, of course. The new spiffiness includes:

• The label syntax has changed from “label:” to “:label”. This makes the lexer happy. And a happy lexer uses less memory and runs faster. Yay for happy lexers
• Added a -r/–rewrite-labels option for smali, which will rewrite the smali files you give it, changing any labels in the old format to the new format.
• deodexerant now opens the odex files as read-only, so you can run deodexerant directly on the odex files in /system, without having to remount, or copy them to /data.
• You can give baksmali an apk file now, so you don’t have to manually extract out the classes.dex file

And one final note: deodexerant will *not* work on 2.0 devices. Once the 2.0 source is released, I should be able to build a new deodexerant binary that will work on 2.0.

Update: There are now also wrapper scripts available for smali/baksmali, so you can call “baksmali …” instead of “java -jar baksmali.jar …”

Update 2: Now that the Eclair source is out, I’ve added a new build of deodexerant to the downloads page that works with 2.0

For the first time ever, with smali/baksmali 0.96, and some help from deodexerant, you can get rid of that optimized dex odor from your rom.

It slices! It dices! It turns odex files into .smali files, capable of being assembled into normal classes.dex files! And all for the low low price of $0.00. Can’t afford $0.00 right now? That’s ok! I guarantee I can get you low monthly payments of $0.00  for 12 months (offer good while supplies last)

Order now! Operators are standing by (they can also help with deodex instructions)

smali/baksmali v0.95 is out. The major change in this version is a re-implemented/optimized version of dexlib, as well as changes in smali/baksmali to work with the new dexlib. Also, I’ve optimized baksmali, so it should run much much quicker now (up to 4x quicker). smali should also be a bit quicker, but nothing you’ll probably notice.

As far as new functionality goes, baksmali will now output registers that are mapped to method parameters using a p<n> syntax, instead of the normal v<n> syntax. i.e. p0 is the first method parameter (or the “this” reference, for non-static methods). This makes it much less of a pain when you need to increase the number of registers in a method. Previously, you would have to go through and bump up the number for all of the parameter registers, but with the p<n> syntax, you won’t have to. If you don’t want this functionality, you can use the -p command line argument to turn it off.

The new versions can be found at the project download page

I sincerely appreciate all the kind words about my roms, and I want to again thank everyone who has donated.

If you’re looking for a new rom to try, I recommend cyanogen’s stable or experimental roms. He’s put a lot of work into them, and they have many more features than mine do/did.

Also, If anyone wants to grab my build environment and maintain a “JF-style” build on their own, go for it If you need any pointers on how to update the build environment as new official releases come out, feel free to ask (There really isn’t all that much involved in it).

For now, there are a few possible work arounds.

1. delete the otacerts.zip file manually. The file is at /system/etc/security/otacerts.zip  But keep in mind if you use this method your phone will continuously re-down the OTA and try to verify it, which is bad on your bandwidth usage and your battery life

2. Replace /system/build.prop on your phone with the one from the ADP1 version of JFv1.51

3. chmod 000 the OTA file in /cache (unconfirmed solution, but is likely to work)

Or you can ignore the popups for now, and wait for my new release based on the new update (CRC1). I promise to “disable” the OTA mechanisms in a better way than simply deleting otacerts.zip . I should be able to get something out soon (next few days)

In the meantime, even if you accidentally hit “accept” on the popup, it won’t be able to install the update when it gets into recovery, so you aren’t at risk of losing root access.

baksmali is the companion disassembler to smali, the dex assembler that I released recently. I’ve released a new version of smali as well, with a number of improvements/fixes. This is the v0.91 release of both tools.

As you might imagine, baksmali is able to disassemble a dex file into a set of text files, one for each class, containing the methods, field, annotations, debug info and dalvik bytecode for that class.

And then smali can munch on those text files and assemble them into shiny new classes.dex file, which you can repackage back into an apk/jar/zip file and throw on your android-based phone.

And most importantly, you can make magic happen when you make changes between the 2 steps.

Both tools are released as executable jar files. You can invoke them and get the usage information with

java -jar smali-0.91.jar
java -jar baksmali-0.91.jar

Unfortunately, the current incarnation of the tools are somewhat porcine. If you try to assemble/disassemble a large dex file and get an out-of-memory type error, try running with -Xmx512m, which increases the max java heap size to 512MB

java -Xmx512m -jar smali-0.91.jar [options]
java -Xmx512m -jar baksmali-0.91.jar [options]


The main project page for smali/baksmali is http://smali.googlecode.com