The Qualcomm XBL (SBL1) and Firehose loader images are packed somewhat reasonably.
They are ELF images (32 or 64 bit) with no sections but 3 or more programs:
That is to say:
So the XBL loads the next one, usually abl which is the Android bootloader which also implements the fastboot protocol.
Now we get a bit deep in the gumbo:
This is all (U)EFI compatibility so it has sworn fealty to Intel/Microsoft.
So, accepting all the idiocy of this, my question remains:
7-Zip can extract the structure of what is the #2 (i.e. the third) program:
The "program" itself starts with 16 bytes 0x00.
If I remove these 16 bytes then 7-Zip can't decypher the file.
The ultimate question is that while I can trivially reverse engineer the actual abl and modify it so that "orange state" doesn't wait 30 seconds when rebooting, how can I LZMA-ish pack the modified results so that it's acceptable?
LZMA normally has a 13 byte header. Why does this all start with nulls?
*Please note that although you can't hash the hash, you can Can the Can
They are ELF images (32 or 64 bit) with no sections but 3 or more programs:
Code:
E:\>elfview xbl /p
# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 960 000000 00000000 // this is the standard ELF header
1 null 6952 001000 9fdb6000 // this is the signing
2 load RX 350012 003000 14015000 // these are various things that actually get loaded
3 load RWZ 0 058740 14077000
4 load RW 31844 058740 1407a000
5 load RWZ 0 0603B0 14084800
6 load RWZ 0 0603B0 85e00000
7 load RX 11824 0603B0 146ae000
8 load RW 2916 0631E0 146b1000
9 load RWX 107032 063D50 14098000
10 load RWZ 0 07DF70 146b2000
11 load RWX 1792000 07DF70 9fc00000
12 load RX 78208 233770 14699000
13 load RX 171536 2468F0 85e35000
14 load RW 6409 270700 85ea8000
15 load RWZ 0 272010 85e97000
Code:
32 bit ELF file
Program table
Signing
Header
Hashes // one for each program, the 2nd is zeroes as you can't hash the hash!*
Signature
Certificate chain
Payload // multiple programsNow we get a bit deep in the gumbo:
Code:
E:\>elfview abl /p
# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 148 000000 00000000 // this is the standard ELF header
1 null 6536 001000 9fa22000 // this is the signing
2 load RWX 139264 003000 9fa00000
Code:
32 bit ELF file
Program table
Signing
Header
Hashes
Signature
Certificate chain
LZMA archive
MZ Windows executable
PE Portable executable
64 bit ARM codeSo, accepting all the idiocy of this, my question remains:
7-Zip can extract the structure of what is the #2 (i.e. the third) program:
Code:
C:\>7zip ablefi
Type = UEFIf
ERRORS:
Headers Error
Physical Size = 139264
Method = LZMA
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
D.... 9E21FD93
D.... 9E21FD93\EE4E5898
..... 0 9E21FD93\EE4E5898\0.raw
D.... 9E21FD93\EE4E5898\VOLUME
..... 20 9E21FD93\EE4E5898\VOLUME\FFFFFFFF
..... 376832 9E21FD93\EE4E5898\VOLUME\LinuxLoader.efi
------------------- ----- ------------ ------------ ------------------------
376852 139264 3 files, 3 folders
Errors: 1If I remove these 16 bytes then 7-Zip can't decypher the file.
The ultimate question is that while I can trivially reverse engineer the actual abl and modify it so that "orange state" doesn't wait 30 seconds when rebooting, how can I LZMA-ish pack the modified results so that it's acceptable?
LZMA normally has a 13 byte header. Why does this all start with nulls?
*Please note that although you can't hash the hash, you can Can the Can
