AB升级(5):payload结构解析
在进一步分析升级流程之前，我们先来看下AB升级情况下的OTA包的结构。OTA包的结构
├── care_map.pb├── META-INF│ └── com│ └── android│ ├── metadata│ └── otacert├── payload.bin└── payload_properties.txt
payload_properties.txt
包含了payload的一些元信息，如文件的hash值，大小等。
FILE_HASH=clGjz1kJ/Toxcax0Ap8d2cCVupI1xoBBXgqOzNK+IeQ=FILE_SIZE=1345770359METADATA_HASH=EG0gbI1eQ5PCQhcOovjiP8zK1H14T6CL8znOwAnQRnE=METADATA_SIZE=98416
metadata
包含了待升级固件的信息，如版本号，编译的时间等
ota-property-files=payload_metadata.bin:1808:98683,payload.bin:1808:1345770359,payload_properties.txt:1345772225:155,care_map.pb:677:1084,metadata:69:561 ota-required-cache=0ota-streaming-property-files=payload.bin:1808:1345770359,payload_properties.txt:1345772225:155,care_map.pb:677:1084,metadata:69:561 ota-type=ABpost-build=xxxpost-build-incremental=1640652245post-sdk-level=30post-security-patch-level=2021-10-05post-timestamp=1640652162pre-device=dl36
payload.bin
包含待升级的镜像信息
payload.bin的结构
payload随着AB分区和update engine引入，其中payload的数据定义在
update_metadata.proto中，这个是protobuf格式的源文件。protobuf是Google推出的跨语言的序列化工具，可以将对象转换成字节流保存。
delta_update_file
delta_update_file这个结构体是payload.bin的数据结构，解结构体表述如下：
system/update_engine/update_metadata.protostruct delta_update_file {char magic = "CrAU";uint64 file_format_version;// payload major versionuint64 manifest_size;// Size of protobuf DeltaArchiveManifest// Only present if format_version >= 2:uint32 metadata_signature_size;// The DeltaArchiveManifest protobuf serialized, not compressed.char manifest;// The signature of the metadata (from the beginning of the payload up to// this location, not including the signature itself). This is a serialized// Signatures message.char metadata_signature_message;// Data blobs for files, no specific format. The specific offset// and length of each data blob is recorded in the DeltaArchiveManifest.struct { char data[];} blobs[];// The signature of the entire payload, everything up to this location,// except that metadata_signature_message is skipped to simplify signing// process. These two are not signed:uint64 payload_signatures_message_size;// This is a serialized Signatures message.char payload_signatures_message;};
将结构体转化为图片分解后如下：
delta_update_file结构解析.png
这个图片能比较清晰的看到delta_update_file主要分为四个部分
[*]Header
主要是文件格式以及后面的protobuf的长度，签名长度进行描述
[*]protofuf
DeltaArchiveManifest这个结构代表的数据，是payload.bin转给你的核心数据，存储了分区的信息。
[*]blob[]
对应于InstallOperation的数据，至于这个数据有多长，如何操作等信息都存放在DeltaArchiveManifest中
[*]signature
存储包括元数据的签名和payload的签名
Manifest的数据结构
message DeltaArchiveManifest {// Only present in major version = 1. List of install operations for the// kernel and rootfs partitions. For major version = 2 see the |partitions|// field.repeated InstallOperation install_operations = 1;repeated InstallOperation kernel_install_operations = 2;// (At time of writing) usually 4096optional uint32 block_size = 3 ;// If signatures are present, the offset into the blobs, generally// tacked onto the end of the file, and the length. We use an offset// rather than a bool to allow for more flexibility in future file formats.// If either is absent, it means signatures aren't supported in this// file.optional uint64 signatures_offset = 4;optional uint64 signatures_size = 5;// Only present in major version = 1. Partition metadata used to validate the// update. For major version = 2 see the |partitions| field.optional PartitionInfo old_kernel_info = 6;optional PartitionInfo new_kernel_info = 7;optional PartitionInfo old_rootfs_info = 8;optional PartitionInfo new_rootfs_info = 9;// old_image_info will only be present for delta images.optional ImageInfo old_image_info = 10;optional ImageInfo new_image_info = 11;// The minor version, also referred as "delta version", of the payload.// Minor version 0 is full payload, everything else is delta payload.optional uint32 minor_version = 12 ;// Only present in major version >= 2. List of partitions that will be// updated, in the order they will be updated. This field replaces the// |install_operations|, |kernel_install_operations| and the// |{old,new}_{kernel,rootfs}_info| fields used in major version = 1. This// array can have more than two partitions if needed, and they are identified// by the partition name.repeated PartitionUpdate partitions = 13;// The maximum timestamp of the OS allowed to apply this payload.// Can be used to prevent downgrading the OS.optional int64 max_timestamp = 14;// Metadata related to all dynamic partitions.optional DynamicPartitionMetadata dynamic_partition_metadata = 15;}
payload数据结构
这里requried指定的成员一定存在；optional指定的成员属于可选项，有可能不存在；而repeated指示的成员我们可以看成是一个数组
payload.bin解压缩
payload.bin可以理解为压缩文件，可以通过https://github.com/vm03/payload_dumper中的脚本进行解压缩。
使用环境说明
1.需要使用Python3的环境执行
2.pip3 install bsdiff4
环境配置完之后，使用payload_dumper.py脚本执行
python3 payload_dumper.py -husage: payload_dumper.py [-h] [--out OUT] [--diff] [--old OLD] [--images IMAGES] payloadfileOTA payload dumperpositional arguments:payloadfile payload file nameoptional arguments:-h, --help show this help message and exit--out OUT output directory (defaul: output)--diff extract differential OTA, you need put original images to old dir--old OLD directory with original images for differential OTA (defaul: old)--images IMAGESimages to extract (default: empty)
执行完之后
python3 payload_dumper.py '/work/update/payload.bin' Processing boot partition................DoneProcessing system partition................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DoneProcessing vendor partition...........................................................................................................................................................DoneProcessing preloader partition.DoneProcessing md1img partition............DoneProcessing md1dsp partition....DoneProcessing spmfw partition.DoneProcessing scp partition.DoneProcessing sspm partition.DoneProcessing gz partition.DoneProcessing lk partition.DoneProcessing dtbo partition.DoneProcessing tee partition.DoneProcessing vbmeta partition.DoneProcessing vbmeta_system partition.DoneProcessing vbmeta_vendor partition.DoneProcessing product partition................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Done
如果不指定参数，则默认在脚本当前目录下生产解压缩的文件
├── output│ ├── boot.img│ ├── dtbo.img│ ├── gz.img│ ├── lk.img│ ├── md1dsp.img│ ├── md1img.img│ ├── preloader.img│ ├── product.img│ ├── scp.img│ ├── spmfw.img│ ├── sspm.img│ ├── system.img│ ├── tee.img│ ├── vbmeta.img│ ├── vbmeta_system.img│ ├── vbmeta_vendor.img│ └── vendor.img├── payload_dumper.py参考链接
https://www.cxyzjd.com/article/u011391629/100122248#OTA_Package_Format_107
https://blog.csdn.net/guyongqiangx/article/details/82805813
https://github.com/vm03/payload_dumper
页:
[1]