Cacher is the code snippet organizer for pro developers

保險起見，把所有必要檔案都 push 到 /data/local/tmp:

system/etc/recovery-resource.dat
boot.img
recovery/bin/install-recovery.sh
recovery/recovery-from-boot.p

接著 adb shell 切換到 /data/local/tmp，首先看一下 install-recovery.sh 的內容：

if ! applypatch -c EMMC:/dev/block/by-name/recovery:11956952:83a5dd9cab2246e73ecf9dffec6eef261bc40bf2; then
  applypatch -b /system/etc/recovery-resource.dat EMMC:/dev/block/by-name/boot:11940568:7c26793576dfff95aa2f88df7e5638126f2eb1c4 EMMC:/dev/block/by-name/recovery 83a5dd9cab2246e73ecf9dffec6eef261bc40bf2 11956952 7c26793576dfff95aa2f88df7e5638126f2eb1c4:/system/recovery-from-boot.p && log -t recovery "Installing new recovery image: succeeded" || log -t recovery "Installing new recovery image: failed"
else
  log -t recovery "Recovery image already installed"
fi

我們要看的只有 applypatch 那行，接下來把 boot & recovery & patch 帶換成我們推進去的檔案，可以得到這樣的指令：

applypatch -b recovery-resource.dat boot.img recovery.img 83a5dd9cab2246e73ecf9dffec6eef261bc40bf2 11956952 7c26793576dfff95aa2f88df7e5638126f2eb1c4:recovery-from-boot.p

直接執行，即可在 /data/local/tmp 目錄下取得 recovery.img