nexus 5x 刷机指北

内容整理自肉丝姐的安卓入门课
nexus 5x 刷机指北，其它手机类似

image.png
image.png

环境搭建

首先下载肉丝姐提供的kali系统
https://github.com/r0ysue/AndroidSecurityStudy/blob/master/FART/kali-linux-2019-4-vmware-amd64-zip.torrent

账号：root
密码：toor

修改时区

dpkg-reconfigure tzdata

选择Asia→Shanghai

安装软件

apt install xfonts-intl-chinese
apt install ttf-wqy-microhei
apt install tmux jnettop

下载Android Studio

wget https://redirector.gvt1.com/edgedl/android/studio/ide-zips/4.0.1.0/android-studio-ide-193.6626763-linux.tar.gz

解压并运行，一路默认即可，不要设置代理，最后会下载一些依赖sdk等
要是下载的慢，可以用手机流量开热点下载

添加adb

vim ~/.bashrc

PATH=$PATH:/root/Android/Sdk/platform-tools

source ~/.bashrc

安卓镜像

wget https://dl.google.com/dl/android/aosp/bullhead-opm1.171019.011-factory-3be6fd1c.zip

7z x bullhead-opm1.171019.011-factory-3be6fd1c.zip

开始刷机

关机状态同时按住“音量减”和“电源”直到手机开机，进入 bootloader
确保 adb 和 fastboot 存在, 将手机连接到虚拟机内，把那个不在询问勾上，确保手机连接的是虚拟机而不是物理机，否则虚拟机可能会卡死

确保手机已解锁，未解锁输入 fastboot oem unlock 解锁,

root@kali:~/Downloads# cd bullhead-opm1.171019.011/
root@kali:~/Downloads/bullhead-opm1.171019.011# ls
bootloader-bullhead-bhz31a.img  flash-all.sh   image-bullhead-opm1.171019.011.zip
flash-all.bat                   flash-base.sh  radio-bullhead-m8994f-2.6.40.4.04.img
root@kali:~/Downloads/bullhead-opm1.171019.011# ./flash-all.sh 
Sending 'bootloader' (4620 KB)                     OKAY [  0.625s]
Writing 'bootloader'                               OKAY [  0.182s]
Finished. Total time: 0.849s
Rebooting into bootloader                          OKAY [  0.010s]
Finished. Total time: 0.061s
Sending 'radio' (56630 KB)                         OKAY [  6.872s]
Writing 'radio'                                    OKAY [  0.974s]
Finished. Total time: 7.889s
Rebooting into bootloader                          OKAY [  0.013s]
Finished. Total time: 0.068s
--------------------------------------------
Bootloader Version...: BHZ31a
Baseband Version.....: M8994F-2.6.40.4.04
Serial Number........: 0215f2aa23abaee8
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product'                                 OKAY [  0.018s]
Checking 'version-bootloader'                      OKAY [  0.020s]
Checking 'version-baseband'                        OKAY [  0.020s]
extracting boot.img (11 MB) to disk... took 0.029s
archive does not contain 'boot.sig'
Sending 'boot' (11785 KB)                          OKAY [  1.439s]
Writing 'boot'                                     OKAY [  0.204s]
archive does not contain 'dtbo.img'
archive does not contain 'dt.img'
extracting recovery.img (17 MB) to disk... took 0.036s
archive does not contain 'recovery.sig'
Sending 'recovery' (17429 KB)                      OKAY [  2.083s]
Writing 'recovery'                                 OKAY [  0.323s]
archive does not contain 'vbmeta.img'
archive does not contain 'vbmeta_system.img'
archive does not contain 'vendor_boot.img'
archive does not contain 'super_empty.img'
archive does not contain 'odm.img'
archive does not contain 'product.img'
extracting system.img (1909 MB) to disk... took 15.022s
archive does not contain 'system.sig'
Sending sparse 'system' 1/4 (512608 KB)            OKAY [ 63.256s]
Writing 'system'                                   OKAY [  9.505s]
Sending sparse 'system' 2/4 (523962 KB)            OKAY [ 62.638s]
Writing 'system'                                   OKAY [  9.653s]
Sending sparse 'system' 3/4 (494953 KB)            OKAY [ 60.435s]
Writing 'system'                                   OKAY [  9.762s]
Sending sparse 'system' 4/4 (423449 KB)            OKAY [ 50.828s]
Writing 'system'                                   OKAY [  7.702s]
archive does not contain 'system_ext.img'
extracting vendor.img (185 MB) to disk... took 1.232s
archive does not contain 'vendor.sig'
Sending 'vendor' (190300 KB)                       OKAY [ 22.550s]
Writing 'vendor'                                   OKAY [  3.885s]
archive does not contain 'vendor_dlkm.img'
Erasing 'userdata'                                 OKAY [  0.522s]
mke2fs 1.45.4 (23-Sep-2019)
Creating filesystem with 2874363 4k blocks and 719488 inodes
Filesystem UUID: 7ee79fef-b58e-48fb-95d0-2b7e5f13fa9c
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done 

Sending 'userdata' (124 KB)                        OKAY [  0.111s]
Writing 'userdata'                                 OKAY [  0.018s]
Erasing 'cache'                                    OKAY [  0.082s]
mke2fs 1.45.4 (23-Sep-2019)
Creating filesystem with 24576 4k blocks and 24576 inodes

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (1024 blocks): done
Writing superblocks and filesystem accounting information: done

Sending 'cache' (44 KB)                            OKAY [  0.082s]
Writing 'cache'                                    OKAY [  0.014s]
Rebooting                                          OKAY [  0.020s]
Finished. Total time: 323.028s
root@kali:~/Downloads/bullhead-opm1.171019.011#

刷完了之后手机会自动重启, 刷机已经完成

TWRP

在物理机上下载，然后拖到虚拟机里面
https://eu.dl.twrp.me/bullhead/twrp-3.3.1-0-bullhead.img

手机再次进入 bootloader 模式

root@kali:~/Downloads# ls -al
total 1937804
drwxr-xr-x  4 root root       4096 Aug 30 16:11 .
drwxr-xr-x 20 root root       4096 Aug 30 15:31 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb reboot bootloader
root@kali:~/Downloads# fastboot flash recovery twrp-3.3.1-0-bullhead.img 
Sending 'recovery' (16321 KB)                      OKAY [  2.222s]
Writing 'recovery'                                 OKAY [  0.291s]
Finished. Total time: 2.559s
root@kali:~/Downloads#

按两下音量减进入 recovery 模式
下面的划动条划到最右边显示所有的选项

Magisk

root@kali:~/Downloads# wget https://github.com/topjohnwu/Magisk/releases/download/v20.4/Magisk-v20.4.zip

root@kali:~/Downloads# ls
android-studio                               bullhead-opm1.171019.011-factory-3be6fd1c.zip
android-studio-ide-193.6626763-linux.tar.gz  Magisk-v20.4.zip
bullhead-opm1.171019.011                     twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb push Magisk-v20.4.zip /sdcard/
adb: error: failed to get feature set: no devices/emulators found
root@kali:~/Downloads# adb push Magisk-v20.4.zip /sdcard/
Magisk-v20.4.zip: 1 file pushed, 0 skipped. 1.2 MB/s (5942417 bytes in 4.825s)

frida-server

root@kali:~/Downloads# wget https://github.com/frida/frida/releases/download/12.11.11/frida-server-12.11.11-android-arm64.xz
root@kali:~/Downloads# 7z x frida-server-12.11.11-android-arm64.xz 
root@kali:~/Downloads# ls -al
total 1996216
drwxr-xr-x  4 root root       4096 Aug 30 16:43 .
drwxr-xr-x 20 root root       4096 Aug 30 16:41 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rw-r--r--  1 root root   41023080 Aug 26 02:29 frida-server-12.11.11-android-arm64
-rw-r--r--  1 root root   12843976 Aug 26 02:29 frida-server-12.11.11-android-arm64.xz
-rwxrw-rw-  1 root root    5942417 Aug 30 16:24 Magisk-v20.4.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb root
adbd is already running as root
root@kali:~/Downloads# adb push frida-server-12.11.11-android-arm64 /data/local/tmp/
frida-server-12.11.11-android-arm64: 1 file pu... skipped. 0.7 MB/s (41023080 bytes in 58.544s)
root@kali:~/Downloads#

install

进入 bootloader, 进入 recovery 模式，
手机上点击 install， 找到 Magisk-v20.4.zip，
点击该文件，划到最右边安装，安装完成之后重启手机即可

完成

第二套

刷 Kali NetHunter

下载

wget https://images.kali.org/nethunter/nethunter-2020.3-bullhead-oreo-kalifs-full.zip
wget https://download.chainfire.eu/1220/SuperSU/SR5-SuperSU-v2.82-SR5-20171001224502.zip?retrieve_file=1

root@kali:~/Downloads# adb reboot bootloader
root@kali:~/Downloads# fastboot flash recovery twrp-3.3.1-0-bullhead.img
Sending 'recovery' (16321 KB)                      OKAY [  2.139s]
Writing 'recovery'                                 OKAY [  0.283s]
Finished. Total time: 2.465s
root@kali:~/Downloads# ls -al
total 3290304
drwxr-xr-x  4 root root       4096 Aug 30 17:51 .
drwxr-xr-x 20 root root       4096 Aug 30 16:41 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rw-r--r--  1 root root   41023080 Aug 26 02:29 frida-server-12.11.11-android-arm64
-rw-r--r--  1 root root   12843976 Aug 26 02:29 frida-server-12.11.11-android-arm64.xz
-rwxrw-rw-  1 root root    5942417 Aug 30 16:24 Magisk-v20.4.zip
-rwxrw-rw-  1 root root 1318256428 Aug 30 17:43 nethunter-2020.3-bullhead-oreo-kalifs-full.zip
-rw-r--r--  1 root root    6882992 Oct  2  2017 SR5-SuperSU-v2.82-SR5-20171001224502.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb push SR5-SuperSU-v2.82-SR5-20171001224502.zip /sdcard/SR5-SuperSU-v2.82-SR5-20171001224502.zip: 1 fil..., 0 skipped. 1.0 MB/s (6882992 bytes in 6.279s)
root@kali:~/Downloads# adb push nethunter-2020.3-bullhead-oreo-kalifs-full.zip /sdcard/
nethunter-2020.3-bullhead-oreo-kalifs-full.zip:...ipped. 0.7 MB/s (1318256428 bytes in 1883.874s)
root@kali:~/Downloads#

install

进入 bootloader, 进入 recovery 模式，
手机上点击 install， 找到 需要安装的模块，
点击该文件，划到最右边安装，安装完成之后重启手机即可

完成

©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 202,980评论 5赞 476
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 85,178评论 2赞 380
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 149,868评论 0赞 336
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 54,498评论 1赞 273
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 63,492评论 5赞 364
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 48,521评论 1赞 281
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 37,910评论 3赞 395
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 36,569评论 0赞 256
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 40,793评论 1赞 296
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 35,559评论 2赞 319
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 37,639评论 1赞 329
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 33,342评论 4赞 318
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 38,931评论 3赞 307
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 29,904评论 0赞 19
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 31,144评论 1赞 259
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 42,833评论 2赞 349
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 42,350评论 2赞 342