202 replies to this topic

[ZeBadger]

I've been working on examining UPDATA.APP and have pretty much got most of the file format identified.

I've modified the original split_updata.pl to extract the correct filenames out every time (based on McSpoon's filenames) and also CRC check the extracted file.

Script is here EDIT: I have had to move it to here as my crazy new hosting tries to execute the perl script.
It needs this crc checking binary to be in the same directory (linux only, until I get time to convert the c code to perl)

Actions that I think need to be done...  anyone can help out here  

• Identify what the 2 byte Something2 is and how to calculate it... if that is even relevant (see my later posts)
• Identify what files are actually needed for an UPDATA.APP (the Huawei "time machine" one only had 6 files)
• Write code to repack the UPDATA.APP
  • Convert the CRC c code into Perl
  • Write Perl script to repack
  • Write a windows app to repack

I'm editing this post to be up-to-date, so some of the below posts might not make much sense!

Edited by ZeBadger, 10 October 2011 - 05:08 PM.

[Speckles]

So we know it's not a sum checksum, or a xor, and is unlikely to be crc16, and a few others  (Unless of course they are using weird start values or slightly modified. Manufacturers don't often do either.)

[ZeBadger]

Speckles, on Jun 16 2010, 21:49, said:

So we know it's not a sum checksum, or a xor, and is unlikely to be crc16, and a few others  (Unless of course they are using weird start values or slightly modified. Manufacturers don't often do either.)

Yes, I've been trying to hunt down checksum routines, but so far haven't found one that matches.

Here is my dump of just the header for the Image file that contains the T-Mobile logo.  Most of the actual image file is x00 except somewhere just above the middle... which is reflected in the checksum.  So we need a checksum that gets bigger the larger the file... unless it's just a checksum of every 4096 bytes.

+------+------------+-------------+--------------+
| File | Start Byte | Header Size |  Data Size   |
+------+------------+-------------+--------------+
| 025  |  139445312 |		 248 |	   307200 |
+------+------------+-------------+--------------+

RecordId  :  55 AA 5A A5									   U.Z.
HeaderSize:  F8 00 00 00									   ....
Always 1  :  01 00 00 00									   ....
HardwareID:  48 57 55 38 32 32 30 FF						   HWU8220.
File Seq  :  00 00 00 F2									   ....
File Size :  00 B0 04 00									   ....
File Date :  32 30 31 30 2E 30 34 2E 31 39 00 00 00 00 00 00   2010.04.19......
File Time :  31 34 2E 35 30 2E 35 30 00 00 00 00 00 00 00 00   14.50.50........
Input?	:  49 4E 50 55 54 00 00 00 00 00 00 00 00 00 00 00   INPUT...........
Blank?	:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
Something2:  D2 B7 00 10									   ....
Blank?	:  00 00											 ..
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 C3 28 C8 B2 B4 69   ...........(...i
Checksum  :  9A 1D 31 34 B7 11 38 A4 08 04 08 04 08 04 08 04   ..14..8.........
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04 08 04 08 04 08 04 08 04 08 04   ................
Checksum  :  08 04 08 04 08 04								 ......

Edited by ZeBadger, 16 June 2010 - 09:50 PM.

[Josh04]

Very well done

[ZeBadger]

Holy moley... I just downloaded this tool and I have found it is : CRC16 (X25)

I'll be writing a perl script to recompile the files first...  then a nice little windows tool eh?  


Edit : FCS 16 also matches.... maybe more... I'll have to investigate further, but should have something done in a few days.

Edited by ZeBadger, 16 June 2010 - 10:40 PM.

[Josh04]

Hurrah! We'll be able to flash the Huawei boot screen away

[rjm2k]

Josh04, on Jun 16 2010, 23:46, said:

Hurrah! We'll be able to flash the Huawei boot screen away

Can't we just use this to change the boot?  ....  (from http://source.androi...omization.html)

Boot Screen Customization
At startup, Android displays a splashscreen image while booting the device. Do the following if you wish to modify the default splash screen:

Create a 320x480 image, splashscreen.jpg in this example.
Using ImageMagick, convert your .jpg file to .r format:

convert screen.jpg screen.r
Use the rgb2565 application to convert the image to 565 format:

rgb2565 < screen.rgb > screen.565
Use fastboot to flash the image to the device:

fastboot flash splash1 screen.565

[ZeBadger]

rjm2k, on Jun 17 2010, 10:57, said:

Can't we just use this to change the boot?  ....  (from http://source.androi...omization.html)
fastboot flash splash1 screen.565

I tried this and it didn't work, although I think I might have put splash not splash1.

If I can get this to work we can install what we want without using superboot or the recovery app. USB would also not be required for those folk who broke theirs.

[Josh04]

We don't have a mapped splash partition. The only way to write to that memory is with an UPDATA.APP.

[myface]

thanks a lot

[Sh4d0w940]

If we could create updata.app files we would be safe for future, i.e. december update wich will flash over any future rom
Because time machine may not work on roms that aren't released yet and this probably will.
Warranty forever  

Sh4d0w940

[ZeBadger]

I'm going to release the Std 2.1 Hungarian ROM with the custom Recovery image built in at some point in the next few days... I might change the colour of the t-mobile logo too... so it's not pink!

Any other ideas?

[Speckles]

If your going all that way, why not remove the T-Mobile logo completely and use a MoDaCo logo for sheer coolness factor?

Of course, the first thing to do is ensure that a custom made updata actually works and doesn't brick your phone...

[ZeBadger]

Speckles, on Jun 17 2010, 22:28, said:

If your going all that way, why not remove the T-Mobile logo completely and use a MoDaCo logo for sheer coolness factor?

I'm just doing the image first... then the recovery image.  I think my "Something2" in the hex dump above is the checksum of the header... which wont change with the image mod.  Will check it out after I've got the image working.
Where can I get a cool MoDaCo one from?  Is there one somewhere?

Speckles, on Jun 17 2010, 22:28, said:

Of course, the first thing to do is ensure that a custom made updata actually works and doesn't brick your phone...

No pain no gain eh?  

Edited by ZeBadger, 17 June 2010 - 09:37 PM.

[ZeBadger]

Bugger.... 95% thru the update process then "Update Failed" ... not had much chance to check what I did wrong (bed time and I was copy and pasting huge chunks of binary data around... lol) but the blue boot screen worked so I can recover... Phew  

The CRC program (linux binary at the moment, will convert to perl when I get chance!) that I wrote is available here if anyone else wants experiment!  MAKE SURE that you test it works properly with files that you extract (compare the checksums to the ones in the header) I haven't done much testing on it yet.

Edit: Struggling to recover... take care!!  I'm sure this will work, but I need to get to bed :/  Looks like I'm sticking the sim in a spare phone!

I'm going to add a crc checker to the split program... then I can at least check my creations!

Edited by ZeBadger, 18 June 2010 - 12:16 PM.

[Josh04]

Did you have any luck?

[ZeBadger]

Josh04, on Jun 19 2010, 11:05, said:

Did you have any luck?

My phone is back alive without me having to use the above.  I've didn't had chance to play around last night due to the game and drinking a little too much.  Out tonight too, but I'll hopefully get a few hours.

I'm going to prioritise making the splitter check the checksums first and also work out what "Something2" is (I guess it's the crc of the header, but I've not had time to check yet).  I've also not very thoroughly checked my checksum binary works... but that will be automatically checked when I've done the checksum adding to the splitter.

Edited by ZeBadger, 19 June 2010 - 10:36 AM.

[ZeBadger]

I've added CRC checking to the script and also fixed a bug which meant it got stuck if there was null padding at the end of the file.
The CRC binary needs to be in the same dir.

My UPDATA.APP checked out okay... so that "Something2" must be my problem... will work on that at some point in the next few days!

Edited by ZeBadger, 19 June 2010 - 05:21 PM.

[DanWilson]

ZeBadger, on Jun 19 2010, 18:21, said:

I've added CRC checking to the script and also fixed a bug which meant it got stuck if there was null padding at the end of the file.
The CRC binary needs to be in the same dir.

My UPDATA.APP checked out okay... so that "Something2" must be my problem... will work on that at some point in the next few days!

Are you trying to make a tool to create an UPDATA.APP?
Damn I'd have fun with that, "DAN BE KING!" as every boot screen!

[ZeBadger]

DanWilson, on Jun 19 2010, 18:24, said:

Are you trying to make a tool to create an UPDATA.APP?

Yes, just working out how to do it first, nearly there I think!  I built my own, but it failed at about 95%... just those 2 bytes to work out probably... unfortunately got a BBQ to get to tonight, so wont be doing any more today.

Edited by ZeBadger, 19 June 2010 - 05:54 PM.