I am using Android 8 for an embedded device, with Android Verified Boot 2.0 secured via HW-keys, and A/B OTA update (no streaming). I want to make sure that the software on the device is tightly secured; however, I'm having a hard time to trace the individual steps the update performs. One hint would be the metadata contained in the update
Unfortunately, there seems to be no documentation on the
payload.bin file format and its contents. Is there an official documentation for the file format? Or is there a crisp piece of code (e.g., build tools( that I haven't found out about yet?
The tools for "dumping"
payload.bin give me the contained images, but not the metadata.
What I'd like to understand is the following:
- Which parts of
payload.binare signed with which key?
- Are there parts that are not signed?
- Which additional verification elements are contained in
payload.bin, and how does the
update_engineuse them? For example: there are hashes to verify the target partitions following the installation
- For a differential update, there must be a means to ensure that the system on the device is exactly the one used as source for the update diff. Where are those hash-values?
- How about a full update - can the updater ensure that the update is installed only atop a specific version on the device?
I apologise if I have missed sources that answer these questions. The books about Android system programming I came across are outdated by now. Any pointers to relevant documentation beyond the basic Android docs would be highly appreciated.