Skip to content

Latest commit

 

History

History
51 lines (38 loc) · 2.67 KB

Readme.md

File metadata and controls

51 lines (38 loc) · 2.67 KB

Android OTA Firmware Analysis

The OTA file is a zip file with various files inside, the one file we care about is payload.bin. Payload.bin contains the filesystem images such as system.img and boot.img. The check_ota.py script unpacks an OTA file and runs FwAnalyzer on every filesystem image extracted from the OTA file.

FwAnalyzer Config

The OTA check script requires separate FwAnalyzer configuration files for each filesystem image that is extracted from the OTA file. The check_ota.py script expects a directory that contains FwAnalyzer config files with the same name as the filesystem image but the toml extensions. For example the config file for system.img needs to be named system.toml.

OTA images contain system.img, vendor.img, dsp.img, and boot.img. All images besides the boot.img are ext4 filesystems and therefore the config file needs to have FsType set to extfs. The boot.img will be unpacked to a directory (using the mkboot tool), therefore, the boot.toml file needs to have FsType set to dirfs.

Android Checks

The files android_user_build_checks.toml and android_user_build_checks_boot.toml are a collection of very simple checks for Android production builds (user builds). The config file can be included in custom FwAnalyzer config using the Include statement.

The android_properties.toml file is a collection of DataExtract statements that will extract Android properties from various parts of an Android firmware image.

Running check_ota.py

The OTA check fails if FwAnalyzer reports an Offender in any of the filesystem images. The reports generated by FwAnalyzer are written to IMAGENAME_out.json (e.g. system_out.json).

check_ota.py arguments:

  • --ota string : path to ota file
  • --report string : path to report file (will be overwritten)
  • --cfg-path string : path to directory containing fwanalyzer config files
  • --cfg-include-path string : path to directory containing fwanalyzer config include files
  • --fwanalyzer-bin string : path to fwanalyzer binary
  • --keep-unpacked : keep unpacked data
  • --targets string : filesystem targets (e.g.: system boot)

Example:

$ ls
 system.toml

$ check_ota.py -ota update-ota.zip -cfg-path . -cfg-include-path . --targets system

Required tools