手机文件系统分为不同的部分，可能如下，不同的系统顺序不同，
#cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 04380000 00020000 "system"
mtd4: 04380000 00020000 "cache"
mtd5: 04ac0000 00020000 "userdata"
我们主要涉及recovery和boot，在我们操作之前最好是备份他俩。
# cat /dev/mtd/mtd1 > /sdcard/mtd1.img
# cat /dev/mtd/mtd2 > /sdcard/mtd2.img
System存放/中挂载的所有文件，userdata中存放data目录中的数据，主要是你安装的apps及其文件。
我们最好把自己喜欢的update.zip发在sdcard的root目录中，以在弄乱boot分区后可以恢复。
有另外一个重要的文件 /system/recovery.img，他是mtd1的完全拷贝。每次关机他都会重新刷写mtd1一次，这代表你对recovery即/dev/mtd/mtd1的修改再重启后都无效。如果要改变mtd1，最好是插入image在 /system/recovery.img中，如果你升级系统没有替换 /system/recovery.img会很惨的。
Boot和recovery不是正常的文件系统，是android自定的格式，有一个2k的头，接着是gzipped的kernel和ramdisk，一个可选的second stage loader（少见）。定义在mkbootimg.h中。
+-----------------+
| boot header | 1 page
+-----------------+
| kernel | n pages
+-----------------+
| ramdisk | m pages
+-----------------+
| second stage | o pages
+-----------------+
n = (kernel_size + page_size - 1) / page_size
m = (ramdisk_size + page_size - 1) / page_size
o = (second_size + page_size - 1) / page_size
0. all entities are page_size aligned in flash
1. kernel and ramdisk are required (size != 0)
2. second is optional (second_size == 0 -> no second)
Ramdisk是一个小型文件系统包含用来初始化系统的核心文件，它包含关键的初始化进程，比如init.rc（可以设定系统范围的属性），下面是ramdisk中的一系列的文件。关于ramdisk的文档如下地址
./init.trout.rc
./default.prop
./proc
./dev
./init.rc
./init
./sys
./init.goldfish.rc
./sbin
./sbin/adbd
./system
./data
Recovery image还有额外的文件，包含recovery二进制程序及其支持文件（在home+power按下重启时运行），文件如下
./res
./res/images
./res/images/progress_bar_empty_left_round.bmp
./res/images/icon_firmware_install.bmp
./res/images/indeterminate3.bmp
./res/images/progress_bar_fill.bmp
./res/images/progress_bar_left_round.bmp
./res/images/icon_error.bmp
./res/images/indeterminate1.bmp
./res/images/progress_bar_empty_right_round.bmp
./res/images/icon_firmware_error.bmp
./res/images/progress_bar_right_round.bmp
./res/images/indeterminate4.bmp
./res/images/indeterminate5.bmp
./res/images/indeterminate6.bmp
./res/images/progress_bar_empty.bmp
./res/images/indeterminate2.bmp
./res/images/icon_unpacking.bmp
./res/images/icon_installing.bmp
./sbin/recovery
解压编辑和压缩镜像
镜像中有一串00接着1F 8B，0之前为kernel，1F 8B之后为ramdisk，我们可以编辑ramdisk，不过得先un gizp它，再un cpio它。我们可以用如下命令
gunzip -c ../your-ramdisk-file | cpio -i
之后在工作目录中会有所有的ramdisk的文件，我们可以编辑它。
为了重新创建ramdisk，我们的gzip和re cpio它，所有工作目录中的文件都将被加入ramdisk中。
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
最后我们可以组合内核，使用mkbootimg程序，命令如下
mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel your-kernel-file --ramdisk newramdisk.cpio.gz -o mynewimage.img
把image刷写到手机上：
如果有新的recovery image，直接插入手机中，重启。如果是boot，得使用adb如下。
adb push ./mynewimage.img /sdcard
得到root权限。使用如下两条命令：
# cat /dev/zero > /dev/mtd/mtd2
write: No space left on device [this is ok, you can ignore]
# flash_image boot /sdcard/mynewimage.img
Reboot
如果有错误，使用update.zip重新升级。
Alternative Method
Download split_bootimg.zip . This Zip file contains one Perl file, split_bootimg.pl, which reads the boot.img header (according to the bootimg.h of the Android source code) to extract the kernel and ramdisk. The script also outputs the kernel command line and board name (if specified).
(Note: Do not use a boot.img image extracted directly from /dev/mtd/mtd2. This image may become corrupted during the read process.)
The following example uses the boot.img from the full TC4-RC28 update:
% ./split_bootimg.pl boot.img
Page size: 2048 (0x00000800)
Kernel size: 1388548 (0x00153004)
Ramdisk size: 141518 (0x000228ce)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1
Writing boot.img-kernel ... complete.
Writing boot.img-ramdisk.gz ... complete.
Extract the ramdisk.
% mkdir ramdisk
% cd ramdisk
% gzip -dc ../boot.img-ramdisk.gz | cpio -i
% cd ..
Make any changes necessary (e.g., set ro.secure=0 in default.prop).
Recreate the cpio archive using the mkbootfs binary produced from building the Android source code (The cpio utility in OS X does not recognize the newc format, therefore mkbootfs is the best option for OS X users).
% mkbootfs ./ramdisk | gzip > ramdisk-new.gz
Recreate the image file using the mkbootimg binary produced from building the Android source code.
% mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img
For Nexus One : Add --base 0x20000000 to mkbootimg command-line.
(Note: the console=null command line option was introduced in the TC4-RC30 boot images to remove the root shell (TODO: add link))
Flashing your new image back onto the phone
You will probably only ever be flashing boot images directly to the phone, given the fact that /system/recovery.img automatically flashes the recovery device for you (as noted above). If you have created a new recovery image, just stick it in /system/recovery.img and reboot. If you are flashing a boot image, stick it on your phone via adb (a tool included in the Android SDK):
adb push ./mynewimage.img /sdcard
Then, open a shell to your phone via 'adb shell', get root, and do the following two commands to flash your new boot image:
# cat /dev/zero > /dev/mtd/mtd2
write: No space left on device [this is ok, you can ignore]
# flash_image boot /sdcard/mynewimage.img
Reboot.
If your phone starts all the way up, congratulations. If not, you did something wrong and you'll need to boot into recovery mode and apply your update.zip file (reboot while holding down home+power, when you get the recovery screen press alt+L and then alt+S).
Something fun to do with your new found power
If you place a file titled initlogo.rle in the root directory of your boot image, the phone will display this image upon boot (after the "G1" image and before the Android animation). In order to create this file, you need to create a 320x480 image in Photoshop or Gimp and save it as a "raw image" file. You then need to compress that image with the program to565. More details on thathere.
This is not the same thing as applying an update.zip
You will see other places on the forums that describe how to create customized update.zip files, as well as update.zip files that people are sharing. For example, there is a recent update.zip which is a modified version of rc30 (with the anti-root aspects disabled). The update.zip files include new boot images, recovery images, and typically replacements for the entire system/ directory as well as other updates. If you are creating a custom boot or recovery image, it is typically a good idea to start with the image distributed with the most recent update you have applied (flashing an image from an older release could have unintended consequences).
