Holger Hans Peter Freyther
bd82bb4fef
Add utility to build a delta file with a single insert
...
For hijacking build a complete delta for a single insert. Need to
externalize the parameters. It could work for multiple files too.
2016-12-18 12:30:26 +01:00
Holger Hans Peter Freyther
111d55b2c4
Add crashing example
...
bt
#0 0x000133f4 in RB_FileSystemUpdate ()
#1 0x0000bf60 in RB_ComponentDeltaOperation ()
#2 0x0000c574 in RB_ComponentDeltaUpdate ()
#3 0x0000cc08 in RB_DeltaTraverse ()
#4 0x0000ccc8 in RB_vRM_Update ()
│0x133c4 <RB_FileSystemUpdate+6864> b 0x12a1c <RB_FileSystemUpdate+4392> │
│0x133c8 <RB_FileSystemUpdate+6868> ldr r3, [pc, #-2616] ; 0x12998 <RB_FileSystemU│
│0x133cc <RB_FileSystemUpdate+6872> mov r0, r10 │
│0x133d0 <RB_FileSystemUpdate+6876> ldr r2, [r3, #1620 ] ; 0x654 │
│0x133d4 <RB_FileSystemUpdate+6880> ldr r3, [r5, #-20] ; 0xffffffec │
│0x133d8 <RB_FileSystemUpdate+6884> ldr r1, [pc, #-2648] ; 0x12988 <RB_FileSystemU│
│0x133dc <RB_FileSystemUpdate+6888> bic r3, r3, #-1073741824 ; 0xc0000000 │
│0x133e0 <RB_FileSystemUpdate+6892> cmp r3, r2 │
│0x133e4 <RB_FileSystemUpdate+6896> movcs r3, #0 │
│0x133e8 <RB_FileSystemUpdate+6900> movcc r3, #1 │
│0x133ec <RB_FileSystemUpdate+6904> bl 0x8e54 <RB_Trace> │
│0x133f0 <RB_FileSystemUpdate+6908> b 0x130a4 <RB_FileSystemUpdate+6064> │
>│0x133f4 <RB_FileSystemUpdate+6912> ldrb r2, [r3], #1
2016-12-17 19:15:24 +01:00
Holger Hans Peter Freyther
e680aea708
Further document the format and produce a rogue system update
...
* Truncate filesize to 20 bytes in hacked.toc (001b? IIRC)
* Add various 0x00 as well.. firsy 0x80... gets turned into the
compressed length but that fails.. needs to be bigger than 0x2000
to succeed.
* LZMA size and trailer overlap.. I was too lazy to add/deal with
padding so kept it short.. can be fixed...
* Modified path for /etc/rc2.d.. to extract new script
We seem lucky with file permissions.. that it is somehow executable
even if SetFileAttributes is not set...
2016-12-17 18:50:08 +01:00
Holger Hans Peter Freyther
45d7e599ec
Figure out where the first lzma data will start...
...
Not sure what is inside these other bits...offsets? lengths? crc?
who knows..
2016-12-13 11:58:50 +01:00
Holger Hans Peter Freyther
bcdfcb62a9
Add some notes for lzma..
2016-12-12 01:32:43 +01:00
Holger Hans Peter Freyther
e556417966
dissect: Print the header of the actual update format
2016-12-11 23:32:37 +01:00
Holger Hans Peter Freyther
edb07ccd98
start to dissect the update header itself..
2016-12-11 23:11:28 +01:00
Holger Hans Peter Freyther
c5b91afaa9
ec20: Alignment is just 16bit.. needed for userdata.diff handling
2016-12-11 22:54:15 +01:00
Holger Hans Peter Freyther
fbd4dad04f
update: First discovery of information about the file format..
2016-12-11 22:40:08 +01:00