I am using CyanogenMod 13 on my Oneplus 3, and I wonder how the cmupdater obfuscates/encrypts downloaded system update images.

To illustrate what I mean:

When I download "cm-13.0-20160908-NIGHTLY-oneplus3.zip" manually on my PC, it has the same SHA1 checksum as stated on the website. When I look at it with a HEX editor, it has the usual ZIP file header (starts with "PK"). I can flash this file without any problem manually in TWRP.

When I download the same update via Cyanogenmod's update tool, a file "cm-13.0-20160908-NIGHTLY-oneplus3.zip" will be created in "/sdcard/cmupdater/" (which seems to be equal to "/data/media/0/cmupdater/" and "/storage/emulated/0/cmupdater/"), but it has a different SHA1 checksum than stated on the website. When I look at it with a HEX editor, it does NOT have the usual ZIP file header (does NOT start with "PK"). I cannot flash this with with TWRP (says "zip file corrupt"), but I CAN flash it when I select this file within the running Cyanogenmod session and select "update".

This is also valid for any other Cyanogenmod images, "cm-13.0-20160908-NIGHTLY-oneplus3.zip" is just an example.

How can I decrypt/unobfuscate the files in "/sdcard/cmupdater/", so that I get the original ZIP file? (Which can be flashed with TWRP)

Why I am asking this: I have a file "cm-13.0-20160731-NIGHTLY-oneplus3.zip" in "/sdcard/cmupdater/", which I would like to decrypt.

The original file is not available anymore at the CyanogenMod mirror, they don't store older releases (which is a very, very bad thing). All current nightly/snapshot CyanogenMod builds don't work reliably on my Oneplus 3.

  • Maybe these ZIPs are signed by Cyanogen or something like this... And: Does this happen to all ZIPs downloaded by CMUpdater? Maybe this ZIPs is just corrupt like TWRP says. – Timo Schwarzer Sep 13 '16 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.