Flatten

Flatten is a Win32 utility for extracting executable code out of Android ELF files. It operates in two distinct modes for xbl and abl.

Usage: flatten elf [bin low high] /x extract code in abl /r replace code in abl /s dump abl command handler symbols /s dump abl command names /d debug /v verbose

XBL and Firehose Loader Files

Most ELF files have sections. Qualcomm files only have programs in the program table. Each is a chunk that will be mapped to memory. Some disassemblers can not handle these separate chunks. The point of flatten in this case is to convert the separate chunks to a contiguous binary file. First we look at what is in the file.

C:\>flatten xbl 64 bit ELF 14015000 - 1406a73c 2 1407a000 - 14081c64 4 14098000 - 140b2218 9 14699000 - 146ac180 12 146ae000 - 146b0e30 7 146b1000 - 146b1b64 8 85e35000 - 85e5ee10 13 85ea8000 - 85ea9909 14 9fc00000 - 9fdb5800 11 9fdb6000 - 9fdb7b28 1

Some of these programs are even embedded ELF files! But let's say that we are interested in the first six programs.

C:\>flatten xbl out 14015000 14700000

Now we have a single binary file with the load address of 14015000. We can dissasemble it.

ABL Files

ABL files have only three programs. The third program is an embedded UEFI file system. Inside this complicated structure is a single, contiguous code chunk with a load address of zero. We can extract this for analysis.

C:\>flatten /x /v abl code 32 bit ELF ZERO FSS2 IMG LZMA ZERO FSS2 ONES QCOM APP1 LL MZ PE Code

One of the most trivial usages is determining what fastboot commands are supported. flatten can (usually) extract this as either plain text or symbols for the command handlers.

C:\>flatten /s abl 00040c18 cmd_list 00026e08 CmdFlash 0002887c CmdErase 00025358 CmdSetActive ... C:\>flatten /c abl flash erase set_active ...

If Secure Boot is enabled, this is about the limit of usefullness.

In the rare case that you have a device without Secure Boot enabled you can extract the code, modify it and replace it.

C:\>flatten /x abl code -- modify your code -- C:\>flatten /r abl code C:\>qcomview /hw abl

Note that modifications to an abl will break the program hashes. Even if your device does not have Secure Boot you will have to fix the program hashes. Of course the signature and signing will remain broken, but this is not an issue.

Download the executable.