Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is it not work with vendor_boot?? #218

Closed
chautruongthinh opened this issue Dec 10, 2023 · 15 comments
Closed

Is it not work with vendor_boot?? #218

chautruongthinh opened this issue Dec 10, 2023 · 15 comments

Comments

@chautruongthinh
Copy link

chautruongthinh commented Dec 10, 2023

I tried repach my OTA zip and get some errors!!

avbroot.exe ota patch --input IP151_ota120623.zip --key-avb avb.key --key-ota ota.key --cert-ota ota.crt --rootless
←[1m[] Replacing zip entry: META-INF/com/android/otacert←[0m
←[1m[
] Copying zip entry: care_map.pb←[0m
←[1m[] Patching zip entry: payload.bin←[0m
←[1m[
] Extracting from original payload: vbmeta←[0m
←[1m[] Extracting from original payload: vendor_boot←[0m
←[1m[
] Extracting from original payload: vbmeta_system←[0m
←[1m[*] Patching boot images: vendor_boot←[0m
Error: Failed to patch OTA zip

Caused by:
0: Failed to patch payload: payload.bin
1: Failed to patch boot image: vendor_boot
2: Validation error: No ramdisk contains "system/etc/security/otacerts.zip"

@chautruongthinh
Copy link
Author

@chenxiaolong Please help me check it!!!
My OTA file : link

@chenxiaolong
Copy link
Owner

Huh, the OTA file you linked puts system/etc/security/otacerts.zip inside of the boot image. Every other device I've seen puts it into vendor_boot or recovery.

I'll need to think about how to solve this. avbroot's current logic won't work.

@AgentOak
Copy link
Contributor

Going by the filename and installed apps in the ROM the device in question is a Viettel TV360. These devices seem to be used by a local TV provider in Vietnam only and as such it's very hard to find any information in english about it.

Is there even reason to believe they support the required custom root of trust (avb_custom_key partition), as explained in the README? It would (positively) surprise me given this is an Android TV box.

@chenxiaolong
Copy link
Owner

That's a really good point. If custom root of trust isn't supported, I probably won't add support for this OTA's weird setup for now.

@chautruongthinh Please try fastboot flash avb_custom_key avb.key first to determine if your device supports custom keys.

@chautruongthinh
Copy link
Author

That's a really good point. If custom root of trust isn't supported, I probably won't add support for this OTA's weird setup for now.

@chautruongthinh Please try fastboot flash avb_custom_key avb.key first to determine if your device supports custom keys.

It worked!!
E:\avbroot>fastboot flash avb_custom_key avb.key Sending 'avb_custom_key' (3 KB) OKAY [ 0.001s] Writing 'avb_custom_key' OKAY [ 0.001s] Finished. Total time: 0.013s

@chautruongthinh
Copy link
Author

chautruongthinh commented Dec 10, 2023

Going by the filename and installed apps in the ROM the device in question is a Viettel TV360. These devices seem to be used by a local TV provider in Vietnam only and as such it's very hard to find any information in english about it.

Is there even reason to believe they support the required custom root of trust (avb_custom_key partition), as explained in the README? It would (positively) surprise me given this is an Android TV box.

Yes!! It is Amlogic S905Y4 Android TV BOX (Viettel TV360 IP151N). It's lock every things but i found the way to unlock bootloader and i can flash custom firmware with fastboot and disable verification vbmeta.
But you can search Mecool KM7 because it's same hardware!

@AgentOak
Copy link
Contributor

Huh, the OTA file you linked puts system/etc/security/otacerts.zip inside of the boot image. Every other device I've seen puts it into vendor_boot or recovery.

Although I'm a little confused about this statement; sunfish (Pixel 4a) has neither vendor_boot nor recovery; system/etc/security/otacerts.zip is inside ramdisk.img.0 of boot partition, and avbroot successfully replaces it.

@chautruongthinh
Copy link
Author

chautruongthinh commented Dec 10, 2023

Huh, the OTA file you linked puts system/etc/security/otacerts.zip inside of the boot image. Every other device I've seen puts it into vendor_boot or recovery.

Although I'm a little confused about this statement; sunfish (Pixel 4a) has neither vendor_boot nor recovery; system/etc/security/otacerts.zip is inside ramdisk.img.0 of boot partition, and avbroot successfully replaces it.

Maybe avbroot extract boot.img first and found system/etc/security/otacerts.zip in it so avbroot successfully replaces it

@chenxiaolong
Copy link
Owner

Although I'm a little confused about this statement; sunfish (Pixel 4a) has neither vendor_boot nor recovery; system/etc/security/otacerts.zip is inside ramdisk.img.0 of boot partition, and avbroot successfully replaces it.

Whoops, you're right, I forgot about that. The way it works right now is that it looks for the first partition that exists in this list:

"@otacerts" => &["recovery", "vendor_boot", "boot"],

Because this OTA contains vendor_boot, avbroot never tries to look for otacerts.zip inside boot.

For now, I think I'll just add a new option, like --otacerts-partition boot, so that the user can override the autodetection.

chenxiaolong added a commit that referenced this issue Dec 10, 2023
AOSP primarily cares about `odm` and `odm_dlkm`, so update the logic to
check for that specifically. This fixes patching some OTAs that include
an unprotected OEM-specific `odm_ext` image.

Issue: #218

Signed-off-by: Andrew Gunnerson <[email protected]>
chenxiaolong added a commit that referenced this issue Dec 10, 2023
The autodetection logic for `@otacerts` is based on the presence of the
`recovery`, `vendor_boot`, and `boot` partitions (in that order). Some
devices have `vendor_boot`, but put `system/etc/security/otacerts.zip`
inside `boot`.

With the way things are written now, we don't have the ability to
inspect the actual partition images for the autodetection. It is based
on the name only. So, for now, we'll just allow the user to override the
autodetected partition similar to what we already do with the
`--boot-partition` option.

Issue: #218

Signed-off-by: Andrew Gunnerson <[email protected]>
chenxiaolong added a commit that referenced this issue Dec 10, 2023
The autodetection logic for `@otacerts` is based on the presence of the
`recovery`, `vendor_boot`, and `boot` partitions (in that order). Some
devices have `vendor_boot`, but put `system/etc/security/otacerts.zip`
inside `boot`.

With the way things are written now, we don't have the ability to
inspect the actual partition images for the autodetection. It is based
on the name only. So, for now, we'll just allow the user to override the
autodetected partition similar to what we already do with the
`--boot-partition` option.

Issue: #218

Signed-off-by: Andrew Gunnerson <[email protected]>
@chenxiaolong
Copy link
Owner

Please give #221 a try. A test build is available at the bottom of: https://github.com/chenxiaolong/avbroot/actions/runs/7160297544?pr=221

When running the avbroot ota patch command, add the --otacerts-partition boot option.

@chautruongthinh
Copy link
Author

chautruongthinh commented Dec 11, 2023

Please give #221 a try. A test build is available at the bottom of: https://github.com/chenxiaolong/avbroot/actions/runs/7160297544?pr=221

When running the avbroot ota patch command, add the --otacerts-partition boot option.

Yeah!! Thanks your support, it's worked fine
E:\avbroot>avbroot.exe ota patch --input E:\AHiem\151new.zip --key-avb avb.key --key-ota ota.key --cert-ota ota.crt --otacerts-partition boot --rootless -o IP151_ota120623_singed.zip
←[1m[] Replacing zip entry: META-INF/com/android/otacert←[0m
←[1m[
] Copying zip entry: care_map.pb←[0m
←[1m[] Patching zip entry: payload.bin←[0m
←[1m[
] Extracting from original payload: vbmeta_system←[0m
←[1m[] Extracting from original payload: boot←[0m
←[1m[
] Extracting from original payload: vbmeta←[0m
←[1m[] Patching boot images: boot←[0m
←[1m[
] Patching vbmeta images: vbmeta_system, vbmeta←[0m
←[1m[] Compressing replacement images: boot, vbmeta←[0m
←[1m[
] Generating new OTA payload←[0m
←[1m[] Patching zip entry: payload_properties.txt←[0m
←[1m[
] Generating new OTA metadata←[0m
←[1m[] Verifying metadata offsets←[0m
←[1m[
] Completed after 9.2s←[0m

But i cant verify it
avbroot>avbroot ota verify --input IP151_ota120623_singed.zip --cert-ota ota.crt --public-key-avb avb_pkmd.bin
←[1m[] Verifying whole-file signature←[0m
←[1m[
] Verifying payload←[0m
←[1m[] Extracting partition images to temporary directory←[0m
←[1m[
] Extracting from the payload: boot, bootloader, dtbo, odm, odm_ext, oem, product, system, system_ext, vbmeta, vbmeta_system, vendor, vendor_boot←[0m
←[1m[*] Checking ramdisk's otacerts.zip←[0m
Error: Ramdisk's otacerts.zip does not contain OTA certificate

chenxiaolong added a commit that referenced this issue Dec 11, 2023
The autodetection logic for `@otacerts` is based on the presence of the
`recovery`, `vendor_boot`, and `boot` partitions (in that order). Some
devices have `vendor_boot`, but put `system/etc/security/otacerts.zip`
inside `boot`.

With the way things are written now, we don't have the ability to
inspect the actual partition images for the autodetection. It is based
on the name only. So, for now, we'll just allow the user to override the
autodetected partition similar to what we already do with the
`--boot-partition` option.

Issue: #218

Signed-off-by: Andrew Gunnerson <[email protected]>
@chenxiaolong
Copy link
Owner

Ah oops. I need to add the --otacerts-partition option to avbroot ota verify too.

I've just updated #221. A new test build will be available at https://github.com/chenxiaolong/avbroot/actions/runs/7162948144?pr=221 once the build completes in a few minutes.

@chautruongthinh
Copy link
Author

It's worked fine
avbroot ota verify --input IP151_ota120623_singed.zip --cert-ota ota.crt --public-key-avb avb_pkmd.bin --otacerts-partition boot
←[1m[] Verifying whole-file signature←[0m
←[1m[
] Verifying payload←[0m
←[1m[] Extracting partition images to temporary directory←[0m
←[1m[
] Extracting from the payload: boot, bootloader, dtbo, odm, odm_ext, oem, product, system, system_ext, vbmeta, vbmeta_system, vendor, vendor_boot←[0m
←[1m[] Checking ramdisk's otacerts.zip←[0m
←[1m[
] Verifying AVB signatures←[0m
←[1m[] vbmeta has a signed vbmeta header←[0m
←[1m[
] vbmeta_system has a signed vbmeta header←[0m
←[1m[] oem has a signed vbmeta header←[0m
←[1m[
] Verifying hash descriptor for: dtbo←[0m
←[1m[] Verifying hash tree descriptor for: vendor←[0m
←[1m[
] Verifying hash descriptor for: vendor_boot←[0m
←[1m[] Verifying hash tree descriptor for: oem←[0m
←[1;31m[WARNING] Partition image does not exist: "dt.img"←[0m
←[1m[
] Verifying hash tree descriptor for: product←[0m
←[1m[] Verifying hash descriptor for: boot←[0m
←[1m[
] Verifying hash tree descriptor for: system←[0m
←[1m[] Verifying hash tree descriptor for: odm←[0m
←[1m[
] Verifying hash tree descriptor for: system_ext←[0m
←[1m[*] Signatures are all valid!←[0m

@chautruongthinh
Copy link
Author

AVB worked with me!!
dmesg | grep libfs_avb
[ 2.871579] init: [libfs_avb]Returning avb_handle with status: Success

dmesg

@chenxiaolong
Copy link
Owner

Great! I will merge #221 then. That change will be included in the next version of avbroot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants