1

I am trying to flash a customized update.zip on a pre-Kitkat device.

In the zip there are 2 files with SHA1 signatures of other files in the update. But they have different signatures for the same files.

Example:

META-INF/MANIFEST.MF:

Name: system/lib/libcustom_jni.so
SHA1-Digest: +PhV5XphkQTNTyM2TSRTeiaDlCA=

META-INF/CERT.SF:

Name: system/lib/libcustom_jni.so
SHA1-Digest: 7ooFhqk1oYWF5pmVuSAhF2pFVNw=

I can get the first one using:

sha1sum system/lib/libcustom_jni.so | cut -d\  -f1 | xxd -p -r | base64
+PhV5XphkQTNTyM2TSRTeiaDlCA=

How is the second one computed? The second file has a hash of the first file, so maybe the other hashes are salted with the first file or something?

From what i found in java doc the SHAs should be identical, except all SHAs are the version 1 in the original update.zip.

It seems hat the certificate used to sign the update was the android test one so it should work, but aborts instead.

3
  • This answers my question if it is true, need to test it: stackoverflow.com/a/9384919/1333247 Oct 27 '20 at 18:33
  • it seems you have more knowledge than me, kindly check my answer and feel free to correct (or post own answer) android.stackexchange.com/q/222262
    – alecxs
    Nov 10 '20 at 22:51
  • 1
    @alecxs Thanks, but i only really played with a single Android 4.2 device so far. That question is about Android 9, i think too many things have changed between them for me to be able to help. Nov 11 '20 at 7:58
2

Answered here as i wrote in the comment. The second hash is a SHA1 of the 3 lines in the manifest file.

I can obtain the second hash by running:

echo 'Name: system/lib/libcustom_jni.so\r\nSHA1-Digest: +PhV5XphkQTNTyM2TSRTeiaDlCA=\r\n\r' | sha1sum | cut -d\  -f1 | xxd -p -r | base64 
7ooFhqk1oYWF5pmVuSAhF2pFVNw=

The echo command adds the final \n so it must be removed from the command to not be duplicated.

Edit for posteriority:

The update.zip is then signed by SignApk using the -w argument, which makes it generate a ZIP comment, without which the installation fails. The comment consists of signed by SignApk string followed by a signature block. Code at Android SignApk source

This was the last piece of the puzzle that allowed me to create a custom update.zip for my Prestigio tablet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.