32 replies to this topic

[tcpaulh]

Editing cust.img https://docs.google....VRDIbxRGh4/edit

Editing/repacking stock rom .img files http://forum.xda-dev...d.php?t=1081239

Getting a bit OT here but interesting.

Edited by tcpaulh, 25 September 2012 - 08:53 PM.

[tcpaulh]

AMSSMBN.img 22,760,448 AMSS modem binary image
appsboothd.mbn 40 lk bootloader binary
boot.img 4,462,592 Kernel, ramdisk and boot config
boot_versions.txt 40 Encoded list of roms?
cust.img 41,943,040 Huawei custom settings eg toggles, boot animation, locale, language
file01.mbn 80 HD-file
file02.mbn 40 HD-file
file04.mbn 9,508 could be QCSBL_CFGDATA
file05.mbn 641,424 extracting / flashing / controlling program
file07.mbn 40 HD-File
file18.mbn 128 MD5_RSA
file20.mbn 40 HD-File
file21.mbn 38,962 ADSP ?
recovery.img 5,146,624 The recovery and update environment’s kernel and ramdisk. Similar to BOOT.
system.img 396,361,728 The OS partition, static and read-only.
unknown_file.0 405 OEMSBL_Version-List
unknown_file.1 24,576 Config-File (?)
unknown_file.10 20 AMSS-Version
unknown_file.2 145,844 qcsbl.mbn(?) Qualcomm Secondary Bootloader (?)
unknown_file.3 25 OEMSBL_Version
unknown_file.4 3,145,728 MODEM_ST1
unknown_file.5 3,145,728 MODEM_ST2
unknown_file.6 768,000 Boot-Splashlogo (RAW565 480x800)
unknown_file.7 3,864,000 Install-Pictures (Updateing 1/2, Installing 2/2, one RAW565, 480 width, 4025 height)
unknown_file.8 205,108 fastboot (?)
unknown_file.9 330 AMSS_Version_List
userdata.img 155,189,248 default /data/app applications?

Quote

MSM7x27A uses a multistage boot that is comprised of a Primary Boot Loader (PBL), Qualcomm secondary Boot Loader (QCSBL), and OEM Secondary Boot Loader (OEMSBL). The binary files corresponding to the multistage boot loaders, the associated headers, and the AMSS are placed in the build\ms\bin\<build_id> directory.
amss.mbn  AMSS modem binary image
amsshd.mbn  AMSS modem binary image header
qcsbl.mbn  Qualcomm secondary boot loader binary
qcsblhd_cfgdata.mbn  Qualcomm secondary boot loader header and config data binary
oemsbl.mbn  OEM secondary boot loader binary
oemsblhd.mbn  OEM secondary boot loader header binary
partition.mbn  Partition table binary
NPRG7627A.hex  QPST host downloader
The following .mbn files are intermediate files generated during the build process and will be inserted into the final AMSS image:
  amss_hash.mbn – Binary image containing hash information for verifying the integrity of AMSS images
  amss_hashhd.mbn – Header for the hash information image
The multi-image JNAND in the tools\mjnand directory is used to program these binary images into the NAND Flash.

Edited by tcpaulh, 25 September 2012 - 09:23 PM.

[da2401]

There's a lot of other stuff in other forums concerning creation of update.app, e.g. a huawei-Tool bin2app for a huawei tablet.
As long as the private rsa key isn't available/leaking, there is no chance creating a valid update.app.

Edited by da2401, 27 September 2012 - 09:49 AM.

[Dazzozo]

This thread is great and I love it

Does the install procedure actually check for a signature? I wouldn't be surprised if Huawei relied on security through obscurity.

[tcpaulh]

There are references to a limited number of secure machines at Huawei for building. Presumably due to RSA key.

Someone should try the repacking code to see where it's at.

Still hoping it will be possible to disable signatures

[tcpaulh]

Dazzozo, on 27 September 2012 - 10:13 AM, said:

This thread is great and I love it (deletesmiley)

Does the install procedure actually check for a signature? I wouldn't be surprised if Huawei relied on security through obscurity.

Because we're like a bunch of blind lesbians in a fish market?

I could figure out how to compile https://github.com/terrex/unupdatapp but not in the next couple of weeks. Going away :-)
Also not sure if anyone has tried bin2app

Edited by tcpaulh, 27 September 2012 - 11:23 AM.

[da2401]

I actually have bin2app.exe, but this one was for an old tablet. Neither the update.app contains a signature nor is the structure valid (the 0x55aa5aa5 is missing and other things).

I wrote a java program for extracting and crc-checking update.app, but the other way is still impossible.

[tcpaulh]

da2401, on 27 September 2012 - 01:54 PM, said:

I actually have bin2app.exe, but this one was for an old tablet. Neither the update.app contains a signature nor is the structure valid (the 0x55aa5aa5 is missing and other things).

I wrote a java program for extracting and crc-checking update.app, but the other way is still impossible.

Would be interesting to see your java app and possibly the bin2app in case someone can hack it

[unaszplodrmann]

tcpaulh, on 17 December 2012 - 09:10 PM, said:

Would be interesting to see your java app and possibly the bin2app in case someone can hack it

Hands up anyone who'd be willing to test a package created by just such a homebrew programme. Come on now, don't be shy; it won't trash the partition table... honest.

[Davidoff59]

well some Huawei updates have bricked some phones so maybe the b952 update could cause a few also if someone tested this, if u get what I mean.

[tcpaulh]

unaszplodrmann, on 17 December 2012 - 11:26 PM, said:

Hands up anyone who'd be willing to test a package created by just such a homebrew programme. Come on now, don't be shy; it won't trash the partition table... honest.

The java app in question was for extracting. I'm guessing you're having a bit of a laugh about volunteers for flashing a repacked update. Not sure though

I'd potentially be up for it after having a discussion with the coder.

UPDATE.APP is digitally signed with a private key only Huawei has.
What could probably be done, is patch osbl to ignore signature verification and save it to /dev/block/mmcblk0p3

.
Repacking shouldn't be a major hurdle though it wouldn't have a valid RSA key.

bin2app here :- http://people.freede...5/我的光盘/release/

Edited by tcpaulh, 18 December 2012 - 01:09 AM.

[unaszplodrmann]

tcpaulh, on 18 December 2012 - 01:03 AM, said:

I'm guessing you're having a bit of a laugh about volunteers for flashing a repacked update.

Aye. Ohh, I seee - bin2app is ostensibly a Huawei tool. No more risky than using any another vendor tool, like Odin for example...

[tcpaulh]

unaszplodrmann, on 18 December 2012 - 03:46 PM, said:

Aye. Ohh, I seee - bin2app is ostensibly a Huawei tool. No more risky than using any another vendor tool, like Odin for example...

Pretty much. At least they use it. Probably not that version though. Patching the os bootloader (mmcblk03 off the top of my head :eek: ?!?) so it doesn't require the RSA signature is perhaps the biggest hurdle.