Android MMC mmcblk Partition Layout

Android devices have a couple of partitions to store different data. The common ones are the recovery, boot, system, data and cache partitions.

Almost every device has it’s own unique layout even though they come from the same manufacturer. I have seen phones based on MTD (Memory Technology Device), EMMC (Embedded MultiMedia Card) and MMC (MultiMedia Card) devices.

For MTD and EMMC devices, the partition layout and the partition names can be retrieved by reading the /proc/mtd and /proc/emmc files. Below is a layout of the EMMC device (HTC Desire S) layout. MTD device layouts are similar. The name field for each partition gives us an indication of what each partition is being used for.

shell@android:/ # cat /proc/emmc
dev:        size     erasesize name
mmcblk0p17: 00040000 00000200 "misc"
mmcblk0p21: 0087f400 00000200 "recovery"
mmcblk0p22: 00400000 00000200 "boot"
mmcblk0p25: 22dffe00 00000200 "system"
mmcblk0p29: 002ffc00 00000200 "local"
mmcblk0p27: 090ffe00 00000200 "cache"
mmcblk0p26: 496ffe00 00000200 "userdata"
mmcblk0p30: 014bfe00 00000200 "devlog"
mmcblk0p31: 00040000 00000200 "pdata"
mmcblk0p28: 09800000 00000200 "lib"

If the device is based on MMC, the partition layout can be retrieved from the /proc/partitions file. But based on the output below, we are unable to map a name for each partition as it was the case for MTD and EMMC devices.

shell@C6603:/ # cat /proc/partitions
major minor  #blocks  name
   7        0      12506 loop0
   7        1       2111 loop1
 179        0   15388672 mmcblk0
 179        1       2048 mmcblk0p1
 179        2        128 mmcblk0p2
 179        3        256 mmcblk0p3
 179        4        256 mmcblk0p4
 179        5        512 mmcblk0p5
 179        6        512 mmcblk0p6
 179        7        512 mmcblk0p7
 179        8        128 mmcblk0p8
 179        9        256 mmcblk0p9
 179       10        256 mmcblk0p10
 179       11        512 mmcblk0p11
 179       12        512 mmcblk0p12
 179       13        512 mmcblk0p13
 179       14        512 mmcblk0p14
 179       15        512 mmcblk0p15
 179       16      16384 mmcblk0p16
 179       17      20480 mmcblk0p17
 179       18        780 mmcblk0p18
 179       19        780 mmcblk0p19
 179       20        780 mmcblk0p20
 179       21       5120 mmcblk0p21
 179       22       8192 mmcblk0p22
 179       23      16384 mmcblk0p23
 179       24    2097152 mmcblk0p24
 179       25     563200 mmcblk0p25
 179       26   12527599 mmcblk0p26
 179       32   31166976 mmcblk1
 179       33   31162880 mmcblk1p1
 254        0      12505 dm-0
 254        1       2110 dm-1

To retrieve the so called names for the MMC device partitions, we will need to look under the /dev/ directory.

shell@C6603:/ $ ls -l /dev/block/platform/msm_sdcc.1/by-name/
lrwxrwxrwx root     root              2014-02-09 11:27 FOTAKernel -> /dev/block/mmcblk0p23
lrwxrwxrwx root     root              2014-02-09 11:27 LTALabel -> /dev/block/mmcblk0p16
lrwxrwxrwx root     root              2014-02-09 11:27 TA -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              2014-02-09 11:27 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              2014-02-09 11:27 alt_aboot -> /dev/block/mmcblk0p12
lrwxrwxrwx root     root              2014-02-09 11:27 alt_rpm -> /dev/block/mmcblk0p15
lrwxrwxrwx root     root              2014-02-09 11:27 alt_s1sbl2 -> /dev/block/mmcblk0p10
lrwxrwxrwx root     root              2014-02-09 11:27 alt_sbl1 -> /dev/block/mmcblk0p8
lrwxrwxrwx root     root              2014-02-09 11:27 alt_sbl2 -> /dev/block/mmcblk0p9
lrwxrwxrwx root     root              2014-02-09 11:27 alt_sbl3 -> /dev/block/mmcblk0p11
lrwxrwxrwx root     root              2014-02-09 11:27 alt_tz -> /dev/block/mmcblk0p13
lrwxrwxrwx root     root              2014-02-09 11:27 apps_log -> /dev/block/mmcblk0p22
lrwxrwxrwx root     root              2014-02-09 11:27 boot -> /dev/block/mmcblk0p17
lrwxrwxrwx root     root              2014-02-09 11:27 cache -> /dev/block/mmcblk0p25
lrwxrwxrwx root     root              2014-02-09 11:27 m9kefs1 -> /dev/block/mmcblk0p18
lrwxrwxrwx root     root              2014-02-09 11:27 m9kefs2 -> /dev/block/mmcblk0p19
lrwxrwxrwx root     root              2014-02-09 11:27 m9kefs3 -> /dev/block/mmcblk0p20
lrwxrwxrwx root     root              2014-02-09 11:27 ramdump -> /dev/block/mmcblk0p21
lrwxrwxrwx root     root              2014-02-09 11:27 rpm -> /dev/block/mmcblk0p14
lrwxrwxrwx root     root              2014-02-09 11:27 s1sbl2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              2014-02-09 11:27 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              2014-02-09 11:27 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              2014-02-09 11:27 sbl3 -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              2014-02-09 11:27 system -> /dev/block/mmcblk0p24
lrwxrwxrwx root     root              2014-02-09 11:27 tz -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              2014-02-09 11:27 userdata -> /dev/block/mmcblk0p26

We can now see that the mmcblk0p24 is actually the system partition. If your phone is rooted and if your ROM has the parted utility, you can use it to get the above information as well.

root@C6603:/ # parted /dev/block/mmcblk0
parted /dev/block/mmcblk0
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk0
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
Model: MMC 016G93 (sd/mmc)
Disk /dev/block/mmcblk0: 15.8GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system  Name        Flags
 1      131kB   2228kB  2097kB               TA
 2      2228kB  2359kB  131kB                sbl1
 3      2359kB  2621kB  262kB                sbl2
 4      2621kB  2884kB  262kB                s1sbl2
 5      2884kB  3408kB  524kB                sbl3
 6      3408kB  3932kB  524kB                aboot
 7      3932kB  4456kB  524kB                tz
 8      4456kB  4588kB  131kB                alt_sbl1
 9      4588kB  4850kB  262kB                alt_sbl2
10      4850kB  5112kB  262kB                alt_s1sbl2
11      5112kB  5636kB  524kB                alt_sbl3
12      5636kB  6160kB  524kB                alt_aboot
13      6160kB  6685kB  524kB                alt_tz
14      6685kB  7209kB  524kB                rpm
15      7209kB  7733kB  524kB                alt_rpm
16      8389kB  25.2MB  16.8MB  ext4         LTALabel
17      25.2MB  46.1MB  21.0MB               boot
18      46.1MB  46.9MB  799kB                m9kefs1
19      48.2MB  49.0MB  799kB                m9kefs2
20      50.3MB  51.1MB  799kB                m9kefs3
21      51.1MB  56.4MB  5243kB               ramdump
22      56.4MB  64.8MB  8389kB  ext4         apps_log
23      64.8MB  81.5MB  16.8MB               FOTAKernel
24      81.8MB  2229MB  2147MB  ext4         system
25      2229MB  2806MB  577MB   ext4         cache
26      2806MB  15.6GB  12.8GB  ext4         userdata

(parted)

Partition names like m9kefs1 and sbl1 may not tell us much about what is inside the partition, but it gives us some clue to move forward.

If you would like to explore the partition further, you may consider making a backup of the partition to your SD card using the dd command and then perform analysis on the dump.

ibrahim = { interested_in(unix, linux, android, open_source, reverse_engineering); coding(c, shell, php, python, java, javascript, nodejs, react); plays_on(xbox, ps4); linux_desktop_user(true); }