Welcome to XDA

Search to go directly to your device's forum

Register an account

Unlock full posting privileges

Ask a question

No registration required
Post Reply

Root filesystem image.

OP zelch

8th December 2010, 11:08 AM   |  #1  
OP Member
Thanks Meter: 1
 
36 posts
Join Date:Joined: Nov 2010
Alright, so the root filesystem image is in /mnt/system/androidmerged.squashfs.secure

So do a temp root, copy to /mnt/storage, and then a adb pull gets it over.

The squashfs itself is offset by 256 bytes, so:

losetup -o 256 /dev/loop0 ./androidmerged.squashfs.secure

At this point, the FS can be mounted or unsquashfs can be used to extract it.

So, what's the first 256 bytes? The secure implies some type of signature, but what kind, and what else is in all those bytes?

I'm not feeling brave enough to try just grabbing the first 256 bytes and appending a modified squashfs image to it on my device just yet, but if others try please report back. (On both if it works, and if not what it takes to recover the unit.)
8th December 2010, 12:01 PM   |  #2  
chrulri's Avatar
Senior Member
Thanks Meter: 275
 
896 posts
Join Date:Joined: Dec 2010
Donate to Me
how big is it? can you upload it somewhere? (or would this be illegal?)

damm.. i need my 101!
8th December 2010, 05:35 PM   |  #3  
krohnjw's Avatar
Recognized Developer
Flag Plainfield
Thanks Meter: 530
 
1,980 posts
Join Date:Joined: Jul 2007
More
Quote:
Originally Posted by chulri

how big is it? can you upload it somewhere? (or would this be illegal?)

damm.. i need my 101!

75 MB - uploading now

Edit: And up: http://hotfile.com/dl/88050103/f99f3...fs.secure.html
Last edited by krohnjw; 8th December 2010 at 05:43 PM.
8th December 2010, 07:24 PM   |  #4  
chrulri's Avatar
Senior Member
Thanks Meter: 275
 
896 posts
Join Date:Joined: Dec 2010
Donate to Me
thx!
8th December 2010, 08:51 PM   |  #5  
chrulri's Avatar
Senior Member
Thanks Meter: 275
 
896 posts
Join Date:Joined: Dec 2010
Donate to Me
how would you replace the root fs image on the device?
Last edited by chrulri; 8th December 2010 at 09:16 PM.
8th December 2010, 09:27 PM   |  #6  
OP Member
Thanks Meter: 1
 
36 posts
Join Date:Joined: Nov 2010
Quote:
Originally Posted by chulri

how would you replace the root fs image on the device?

Connect via ADB, do a temproot, put the file in /mnt/storage, then copy it into /mnt/system overwriting the existing file. /mnt/storage is an ext3 filesystem mounted read/write, however I simply do not know if it will be possible to recover the unit if there is some kind of signature verification and we fail due to a modified image.

Again, someone braver then I should make this attempt and let us know how it goes.

The source did not give all that many hints, but I need to dig through in some more detail.
8th December 2010, 09:57 PM   |  #7  
krohnjw's Avatar
Recognized Developer
Flag Plainfield
Thanks Meter: 530
 
1,980 posts
Join Date:Joined: Jul 2007
More
Quote:
Originally Posted by zelch

Connect via ADB, do a temproot, put the file in /mnt/storage, then copy it into /mnt/system overwriting the existing file. /mnt/storage is an ext3 filesystem mounted read/write, however I simply do not know if it will be possible to recover the unit if there is some kind of signature verification and we fail due to a modified image.

Again, someone braver then I should make this attempt and let us know how it goes.

The source did not give all that many hints, but I need to dig through in some more detail.

If the unit will still boot to recovery could a full wipe and reinstall of the base AOS over USB get it back up and running?
8th December 2010, 10:12 PM   |  #8  
kenyu73's Avatar
Senior Member
Flag Upstate NY
Thanks Meter: 82
 
351 posts
Join Date:Joined: Mar 2010
More
Quote:
Originally Posted by krohnjw

If the unit will still boot to recovery could a full wipe and reinstall of the base AOS over USB get it back up and running?

Recovery shouldn't be part of the FS so at worst, you'd have to do a format/firmware install.
8th December 2010, 10:17 PM   |  #9  
L0$t$0ul's Avatar
Member
Thanks Meter: 6
 
48 posts
Join Date:Joined: Jun 2010
You can do a full system wipe/format from recovery. it's not in any damageable storage by us without flashing a new recovery image.

Interesting about the front 256 bytes. It must be a signature. Not sure what good rebuilding the squashfs will do as it'll still be read only but it's a start. We could at least update the system properly and install the appropriate apps. Maybe in make some of the system dirs symlinks to writable locations possibly.
8th December 2010, 10:32 PM   |  #10  
OP Member
Thanks Meter: 1
 
36 posts
Join Date:Joined: Nov 2010
Permroot, giving us a filesystem mounted RW and not no-suid.

Ideally, I'd like to have decent support for the internal storage being ext3 without nosuid, but first we need to be able to replace the root filesystem image.

Other notes..

Looking at the hexdumps, the 256 byte chunk does not contain the start of the md5, sha1, sha224, sha256, sha384, or sha512 checksums.

The most troubling option which comes to mind is that it is the right size for a RSA 2048 bit block, hopefully not.

Anyone have ideas on how to find the initramfs image that the bootloader is feeding the kernel?

For that matter, has anyone tried taking apart the OS update images?

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes