Android devices have a couple of partitions to store different data. The common ones are the recovery, boot, system, data and cache partitions.
Almost every device has it’s own unique layout even though they come from the same manufacturer. I have seen phones based on MTD (Memory Technology Device), EMMC (Embedded MultiMedia Card) and MMC (MultiMedia Card) devices.
For MTD and EMMC devices, the partition layout and the partition names can be retrieved by reading the /proc/mtd and /proc/emmc files. Below is a layout of the EMMC device (HTC Desire S) layout. MTD device layouts are similar. The name field for each partition gives us an indication of what each partition is being used for.
shell@android:/ # cat /proc/emmc dev: size erasesize name mmcblk0p17: 00040000 00000200 "misc" mmcblk0p21: 0087f400 00000200 "recovery" mmcblk0p22: 00400000 00000200 "boot" mmcblk0p25: 22dffe00 00000200 "system" mmcblk0p29: 002ffc00 00000200 "local" mmcblk0p27: 090ffe00 00000200 "cache" mmcblk0p26: 496ffe00 00000200 "userdata" mmcblk0p30: 014bfe00 00000200 "devlog" mmcblk0p31: 00040000 00000200 "pdata" mmcblk0p28: 09800000 00000200 "lib"
If the device is based on MMC, the partition layout can be retrieved from the /proc/partitions file. But based on the output below, we are unable to map a name for each partition as it was the case for MTD and EMMC devices.
shell@C6603:/ # cat /proc/partitions major minor #blocks name 7 0 12506 loop0 7 1 2111 loop1 179 0 15388672 mmcblk0 179 1 2048 mmcblk0p1 179 2 128 mmcblk0p2 179 3 256 mmcblk0p3 179 4 256 mmcblk0p4 179 5 512 mmcblk0p5 179 6 512 mmcblk0p6 179 7 512 mmcblk0p7 179 8 128 mmcblk0p8 179 9 256 mmcblk0p9 179 10 256 mmcblk0p10 179 11 512 mmcblk0p11 179 12 512 mmcblk0p12 179 13 512 mmcblk0p13 179 14 512 mmcblk0p14 179 15 512 mmcblk0p15 179 16 16384 mmcblk0p16 179 17 20480 mmcblk0p17 179 18 780 mmcblk0p18 179 19 780 mmcblk0p19 179 20 780 mmcblk0p20 179 21 5120 mmcblk0p21 179 22 8192 mmcblk0p22 179 23 16384 mmcblk0p23 179 24 2097152 mmcblk0p24 179 25 563200 mmcblk0p25 179 26 12527599 mmcblk0p26 179 32 31166976 mmcblk1 179 33 31162880 mmcblk1p1 254 0 12505 dm-0 254 1 2110 dm-1
To retrieve the so called names for the MMC device partitions, we will need to look under the /dev/ directory.
shell@C6603:/ $ ls -l /dev/block/platform/msm_sdcc.1/by-name/ lrwxrwxrwx root root 2014-02-09 11:27 FOTAKernel -> /dev/block/mmcblk0p23 lrwxrwxrwx root root 2014-02-09 11:27 LTALabel -> /dev/block/mmcblk0p16 lrwxrwxrwx root root 2014-02-09 11:27 TA -> /dev/block/mmcblk0p1 lrwxrwxrwx root root 2014-02-09 11:27 aboot -> /dev/block/mmcblk0p6 lrwxrwxrwx root root 2014-02-09 11:27 alt_aboot -> /dev/block/mmcblk0p12 lrwxrwxrwx root root 2014-02-09 11:27 alt_rpm -> /dev/block/mmcblk0p15 lrwxrwxrwx root root 2014-02-09 11:27 alt_s1sbl2 -> /dev/block/mmcblk0p10 lrwxrwxrwx root root 2014-02-09 11:27 alt_sbl1 -> /dev/block/mmcblk0p8 lrwxrwxrwx root root 2014-02-09 11:27 alt_sbl2 -> /dev/block/mmcblk0p9 lrwxrwxrwx root root 2014-02-09 11:27 alt_sbl3 -> /dev/block/mmcblk0p11 lrwxrwxrwx root root 2014-02-09 11:27 alt_tz -> /dev/block/mmcblk0p13 lrwxrwxrwx root root 2014-02-09 11:27 apps_log -> /dev/block/mmcblk0p22 lrwxrwxrwx root root 2014-02-09 11:27 boot -> /dev/block/mmcblk0p17 lrwxrwxrwx root root 2014-02-09 11:27 cache -> /dev/block/mmcblk0p25 lrwxrwxrwx root root 2014-02-09 11:27 m9kefs1 -> /dev/block/mmcblk0p18 lrwxrwxrwx root root 2014-02-09 11:27 m9kefs2 -> /dev/block/mmcblk0p19 lrwxrwxrwx root root 2014-02-09 11:27 m9kefs3 -> /dev/block/mmcblk0p20 lrwxrwxrwx root root 2014-02-09 11:27 ramdump -> /dev/block/mmcblk0p21 lrwxrwxrwx root root 2014-02-09 11:27 rpm -> /dev/block/mmcblk0p14 lrwxrwxrwx root root 2014-02-09 11:27 s1sbl2 -> /dev/block/mmcblk0p4 lrwxrwxrwx root root 2014-02-09 11:27 sbl1 -> /dev/block/mmcblk0p2 lrwxrwxrwx root root 2014-02-09 11:27 sbl2 -> /dev/block/mmcblk0p3 lrwxrwxrwx root root 2014-02-09 11:27 sbl3 -> /dev/block/mmcblk0p5 lrwxrwxrwx root root 2014-02-09 11:27 system -> /dev/block/mmcblk0p24 lrwxrwxrwx root root 2014-02-09 11:27 tz -> /dev/block/mmcblk0p7 lrwxrwxrwx root root 2014-02-09 11:27 userdata -> /dev/block/mmcblk0p26
We can now see that the mmcblk0p24 is actually the system partition. If your phone is rooted and if your ROM has the parted utility, you can use it to get the above information as well.
root@C6603:/ # parted /dev/block/mmcblk0 parted /dev/block/mmcblk0 GNU Parted 1.8.8.1.179-aef3 Using /dev/block/mmcblk0 Welcome to GNU Parted! Type 'help' to view a list of commands. (parted) print Model: MMC 016G93 (sd/mmc) Disk /dev/block/mmcblk0: 15.8GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 131kB 2228kB 2097kB TA 2 2228kB 2359kB 131kB sbl1 3 2359kB 2621kB 262kB sbl2 4 2621kB 2884kB 262kB s1sbl2 5 2884kB 3408kB 524kB sbl3 6 3408kB 3932kB 524kB aboot 7 3932kB 4456kB 524kB tz 8 4456kB 4588kB 131kB alt_sbl1 9 4588kB 4850kB 262kB alt_sbl2 10 4850kB 5112kB 262kB alt_s1sbl2 11 5112kB 5636kB 524kB alt_sbl3 12 5636kB 6160kB 524kB alt_aboot 13 6160kB 6685kB 524kB alt_tz 14 6685kB 7209kB 524kB rpm 15 7209kB 7733kB 524kB alt_rpm 16 8389kB 25.2MB 16.8MB ext4 LTALabel 17 25.2MB 46.1MB 21.0MB boot 18 46.1MB 46.9MB 799kB m9kefs1 19 48.2MB 49.0MB 799kB m9kefs2 20 50.3MB 51.1MB 799kB m9kefs3 21 51.1MB 56.4MB 5243kB ramdump 22 56.4MB 64.8MB 8389kB ext4 apps_log 23 64.8MB 81.5MB 16.8MB FOTAKernel 24 81.8MB 2229MB 2147MB ext4 system 25 2229MB 2806MB 577MB ext4 cache 26 2806MB 15.6GB 12.8GB ext4 userdata (parted)
Partition names like m9kefs1 and sbl1 may not tell us much about what is inside the partition, but it gives us some clue to move forward.
If you would like to explore the partition further, you may consider making a backup of the partition to your SD card using the dd command and then perform analysis on the dump.
Mohamed Ibrahim
ibrahim = { interested_in(unix, linux, android, open_source, reverse_engineering); coding(c, shell, php, python, java, javascript, nodejs, react); plays_on(xbox, ps4); linux_desktop_user(true); }
