AB升级(5):payload结构解析

super1 · 发表于 2022-5-30 12:02

在进一步分析升级流程之前，我们先来看下AB升级情况下的OTA包的结构。
OTA包的结构

├── care_map.pb├── META-INF│ └── com│    └── android│          ├── metadata│          └── otacert├── payload.bin└── payload_properties.txt
payload_properties.txt
包含了payload的一些元信息，如文件的hash值，大小等。
FILE_HASH=clGjz1kJ/Toxcax0Ap8d2cCVupI1xoBBXgqOzNK+IeQ=FILE_SIZE=1345770359METADATA_HASH=EG0gbI1eQ5PCQhcOovjiP8zK1H14T6CL8znOwAnQRnE=METADATA_SIZE=98416
metadata
包含了待升级固件的信息，如版本号，编译的时间等
ota-property-files=payload_metadata.bin:1808:98683,payload.bin:1808:1345770359,payload_properties.txt:1345772225:155,care_map.pb:677:1084,metadata:69:561          ota-required-cache=0ota-streaming-property-files=payload.bin:1808:1345770359,payload_properties.txt:1345772225:155,care_map.pb:677:1084,metadata:69:561             ota-type=ABpost-build=xxxpost-build-incremental=1640652245post-sdk-level=30post-security-patch-level=2021-10-05post-timestamp=1640652162pre-device=dl36
payload.bin
包含待升级的镜像信息
payload.bin的结构

payload随着AB分区和update engine引入，其中payload的数据定义在
update_metadata.proto中，这个是protobuf格式的源文件。protobuf是Google推出的跨语言的序列化工具，可以将对象转换成字节流保存。

delta_update_file
delta_update_file这个结构体是payload.bin的数据结构，解结构体表述如下：
system/update_engine/update_metadata.protostruct delta_update_file {  char magic[4] = "CrAU";  uint64 file_format_version;  // payload major version  uint64 manifest_size;  // Size of protobuf DeltaArchiveManifest  // Only present if format_version >= 2:  uint32 metadata_signature_size;  // The DeltaArchiveManifest protobuf serialized, not compressed.  char manifest[manifest_size];  // The signature of the metadata (from the beginning of the payload up to  // this location, not including the signature itself). This is a serialized  // Signatures message.  char metadata_signature_message[metadata_signature_size];  // Data blobs for files, no specific format. The specific offset  // and length of each data blob is recorded in the DeltaArchiveManifest.  struct { char data[];  } blobs[];  // The signature of the entire payload, everything up to this location,  // except that metadata_signature_message is skipped to simplify signing  // process. These two are not signed:  uint64 payload_signatures_message_size;  // This is a serialized Signatures message.  char payload_signatures_message[payload_signatures_message_size];};
将结构体转化为图片分解后如下：

delta_update_file结构解析.png

这个图片能比较清晰的看到delta_update_file主要分为四个部分

Header
主要是文件格式以及后面的protobuf的长度，签名长度进行描述
protofuf
DeltaArchiveManifest这个结构代表的数据，是payload.bin转给你的核心数据，存储了分区的信息。
blob[]
对应于InstallOperation的数据，至于这个数据有多长，如何操作等信息都存放在DeltaArchiveManifest中
signature
存储包括元数据的签名和payload的签名

Manifest的数据结构
message DeltaArchiveManifest { // Only present in major version = 1. List of install operations for the // kernel and rootfs partitions. For major version = 2 see the |partitions| // field. repeated InstallOperation install_operations = 1; repeated InstallOperation kernel_install_operations = 2; // (At time of writing) usually 4096 optional uint32 block_size = 3 [default = 4096]; // If signatures are present, the offset into the blobs, generally // tacked onto the end of the file, and the length. We use an offset // rather than a bool to allow for more flexibility in future file formats. // If either is absent, it means signatures aren't supported in this // file. optional uint64 signatures_offset = 4; optional uint64 signatures_size = 5; // Only present in major version = 1. Partition metadata used to validate the // update. For major version = 2 see the |partitions| field. optional PartitionInfo old_kernel_info = 6; optional PartitionInfo new_kernel_info = 7; optional PartitionInfo old_rootfs_info = 8; optional PartitionInfo new_rootfs_info = 9; // old_image_info will only be present for delta images. optional ImageInfo old_image_info = 10; optional ImageInfo new_image_info = 11; // The minor version, also referred as "delta version", of the payload. // Minor version 0 is full payload, everything else is delta payload. optional uint32 minor_version = 12 [default = 0]; // Only present in major version >= 2. List of partitions that will be // updated, in the order they will be updated. This field replaces the // |install_operations|, |kernel_install_operations| and the // |{old,new}_{kernel,rootfs}_info| fields used in major version = 1. This // array can have more than two partitions if needed, and they are identified // by the partition name. repeated PartitionUpdate partitions = 13; // The maximum timestamp of the OS allowed to apply this payload. // Can be used to prevent downgrading the OS. optional int64 max_timestamp = 14; // Metadata related to all dynamic partitions. optional DynamicPartitionMetadata dynamic_partition_metadata = 15;}

payload数据结构

这里requried指定的成员一定存在；optional指定的成员属于可选项，有可能不存在；而repeated指示的成员我们可以看成是一个数组
payload.bin解压缩

payload.bin可以理解为压缩文件，可以通过https://github.com/vm03/payload_dumper中的脚本进行解压缩。

使用环境说明
1.需要使用Python3的环境执行
2.pip3 install bsdiff4
环境配置完之后，使用payload_dumper.py脚本执行
python3 payload_dumper.py -husage: payload_dumper.py [-h] [--out OUT] [--diff] [--old OLD] [--images IMAGES] payloadfileOTA payload dumperpositional arguments: payloadfile payload file nameoptional arguments: -h, --help show this help message and exit --out OUT output directory (defaul: output) --diff extract differential OTA, you need put original images to old dir --old OLD directory with original images for differential OTA (defaul: old) --images IMAGES images to extract (default: empty)
执行完之后
python3 payload_dumper.py '/work/update/payload.bin' Processing boot partition................DoneProcessing system partition................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DoneProcessing vendor partition...........................................................................................................................................................DoneProcessing preloader partition.DoneProcessing md1img partition............DoneProcessing md1dsp partition....DoneProcessing spmfw partition.DoneProcessing scp partition.DoneProcessing sspm partition.DoneProcessing gz partition.DoneProcessing lk partition.DoneProcessing dtbo partition.DoneProcessing tee partition.DoneProcessing vbmeta partition.DoneProcessing vbmeta_system partition.DoneProcessing vbmeta_vendor partition.DoneProcessing product partition................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Done
如果不指定参数，则默认在脚本当前目录下生产解压缩的文件
├── output│ ├── boot.img│ ├── dtbo.img│ ├── gz.img│ ├── lk.img│ ├── md1dsp.img│ ├── md1img.img│ ├── preloader.img│ ├── product.img│ ├── scp.img│ ├── spmfw.img│ ├── sspm.img│ ├── system.img│ ├── tee.img│ ├── vbmeta.img│ ├── vbmeta_system.img│ ├── vbmeta_vendor.img│ └── vendor.img├── payload_dumper.py参考链接

[1] https://www.cxyzjd.com/article/u011391629/100122248#OTA_Package_Format_107
[2] https://blog.csdn.net/guyongqiangx/article/details/82805813
[3] https://github.com/vm03/payload_dumper

		自动登录	找回密码
密码			立即注册

AB升级(5):payload结构解析

本帖子中包含更多资源