//------------------------------------------------ //--- 010 Editor v12.0 Binary Template // // File: AndroidVBMeta.bt // Authors: Bjoern Kerler // Version: 1.4 // Purpose: Android vbmeta partition template // Category: Operating System // File Mask: * // ID Bytes: 41 56 42 30 // History: // 1.4 2022-05-17 Bjoern Kerler: Fix incorrect size // 1.3 2022-02-01 Bjoern Kerler: Fix padding on chain-partitions // 1.2 2021-10-28 Bjoern Kerler: Fix auxdata parsing // 1.1 2021-10-02 Bjoern Kerler: Fix public key length // 1.0 2019-02-23 Bjoern Kerler: Added AVB v1.1 //------------------------------------------------ /* Change here to display less or more than 4 descriptors */ #define uint8_t unsigned char #define uint16_t unsigned short #define uint32_t unsigned int #define uint64_t unsigned int64 /* Size of the vbmeta image header. */ #define AVB_VBMETA_IMAGE_HEADER_SIZE 256 /* Magic for the vbmeta image header. */ #define AVB_MAGIC "AVB0" #define AVB_MAGIC_LEN 4 /* Maximum size of the release string including the terminating NUL byte. */ #define AVB_RELEASE_STRING_SIZE 48 /* Flags for the vbmeta image. * * AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED: If this flag is set, * hashtree image verification will be disabled. * * AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED: If this flag is set, * verification will be disabled and descriptors will not be parsed. */ typedef enum { AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED = (1 << 0), AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED = (1 << 1) } AvbVBMetaImageFlags; /* Binary format for header of the vbmeta image. * * The vbmeta image consists of three blocks: * * +-----------------------------------------+ * | Header data - fixed size | * +-----------------------------------------+ * | Authentication data - variable size | * +-----------------------------------------+ * | Auxiliary data - variable size | * +-----------------------------------------+ * * The "Header data" block is described by this struct and is always * |AVB_VBMETA_IMAGE_HEADER_SIZE| bytes long. * * The "Authentication data" block is |authentication_data_block_size| * bytes long and contains the hash and signature used to authenticate * the vbmeta image. The type of the hash and signature is defined by * the |algorithm_type| field. * * The "Auxiliary data" is |auxiliary_data_block_size| bytes long and * contains the auxiliary data including the public key used to make * the signature and descriptors. * * The public key is at offset |public_key_offset| with size * |public_key_size| in this block. The size of the public key data is * defined by the |algorithm_type| field. The format of the public key * data is described in the |AvbRSAPublicKeyHeader| struct. * * The descriptors starts at |descriptors_offset| from the beginning * of the "Auxiliary Data" block and take up |descriptors_size| * bytes. Each descriptor is stored as a |AvbDescriptor| with tag and * number of bytes following. The number of descriptors can be * determined by walking this data until |descriptors_size| is * exhausted. * * The size of each of the "Authentication data" and "Auxiliary data" * blocks must be divisible by 64. This is to ensure proper alignment. * * Descriptors are free-form blocks stored in a part of the vbmeta * image subject to the same integrity checks as the rest of the * image. See the documentation for |AvbDescriptor| for well-known * descriptors. See avb_descriptor_foreach() for a convenience * function to iterate over descriptors. * * This struct is versioned, see the |required_libavb_version_major| * and |required_libavb_version_minor| fields. This represents the * minimum version of libavb required to verify the header and depends * on the features (e.g. algorithms, descriptors) used. Note that this * may be 1.0 even if generated by an avbtool from 1.4 but where no * features introduced after 1.0 has been used. See the "Versioning * and compatibility" section in the README.md file for more details. * * All fields are stored in network byte order when serialized. To * generate a copy with fields swapped to native byte order, use the * function avb_vbmeta_image_header_to_host_byte_order(). * * Before reading and/or using any of this data, you MUST verify it * using avb_vbmeta_image_verify() and reject it unless it's signed by * a known good public key. */ typedef struct AvbVBMetaImageHeader { /* 0: Four bytes equal to "AVB0" (AVB_MAGIC). */ uint8_t magic[AVB_MAGIC_LEN]; /* 4: The major version of libavb required for this header. */ uint32_t required_libavb_version_major; /* 8: The minor version of libavb required for this header. */ uint32_t required_libavb_version_minor; /* 12: The size of the signature block. */ uint64_t authentication_data_block_size; /* 20: The size of the auxiliary data block. */ uint64_t auxiliary_data_block_size; /* 28: The verification algorithm used, see |AvbAlgorithmType| enum. */ uint32_t algorithm_type; /* 32: Offset into the "Authentication data" block of hash data. */ uint64_t hash_offset; /* 40: Length of the hash data. */ uint64_t hash_size; /* 48: Offset into the "Authentication data" block of signature data. */ uint64_t signature_offset; /* 56: Length of the signature data. */ uint64_t signature_size; /* 64: Offset into the "Auxiliary data" block of public key data. */ uint64_t public_key_offset; /* 72: Length of the public key data. */ uint64_t public_key_size; /* 80: Offset into the "Auxiliary data" block of public key metadata. */ uint64_t public_key_metadata_offset; /* 88: Length of the public key metadata. Must be set to zero if there * is no public key metadata. */ uint64_t public_key_metadata_size; /* 96: Offset into the "Auxiliary data" block of descriptor data. */ uint64_t descriptors_offset; /* 104: Length of descriptor data. */ uint64_t descriptors_size; /* 112: The rollback index which can be used to prevent rollback to * older versions. */ uint64_t rollback_index; /* 120: Flags from the AvbVBMetaImageFlags enumeration. This must be * set to zero if the vbmeta image is not a top-level image. */ AvbVBMetaImageFlags flags; /* 124: Reserved to ensure |release_string| start on a 16-byte * boundary. Must be set to zeroes. */ uint8_t reserved0[4]; /* 128: The release string from avbtool, e.g. "avbtool 1.0.0" or * "avbtool 1.0.0 xyz_board Git-234abde89". Is guaranteed to be NUL * terminated. Applications must not make assumptions about how this * string is formatted. */ uint8_t release_string[AVB_RELEASE_STRING_SIZE]; /* 176: Padding to ensure struct is size AVB_VBMETA_IMAGE_HEADER_SIZE * bytes. This must be set to zeroes. */ uint8_t reserved[80]; }AvbVBMetaImageHeader; /* The header for a serialized RSA public key. * * The size of the key is given by |key_num_bits|, for example 2048 * for a RSA-2048 key. By definition, a RSA public key is the pair (n, * e) where |n| is the modulus (which can be represented in * |key_num_bits| bits) and |e| is the public exponent. The exponent * is not stored since it's assumed to always be 65537. * * To optimize verification, the key block includes two precomputed * values, |n0inv| (fits in 32 bits) and |rr| and can always be * represented in |key_num_bits|. * The value |n0inv| is the value -1/n[0] (mod 2^32). The value |rr| * is (2^key_num_bits)^2 (mod n). * * Following this header is |key_num_bits| bits of |n|, then * |key_num_bits| bits of |rr|. Both values are stored with most * significant bit first. Each serialized number takes up * |key_num_bits|/8 bytes. * * All fields in this struct are stored in network byte order when * serialized. To generate a copy with fields swapped to native byte * order, use the function avb_rsa_public_key_header_validate_and_byteswap(). * * The avb_rsa_verify() function expects a key in this serialized * format. * * The 'avbtool extract_public_key' command can be used to generate a * serialized RSA public key. */ typedef struct AvbRSAPublicKeyHeader { uint32_t key_num_bits; uint32_t n0inv; } AvbRSAPublicKeyHeader; typedef struct publickey { AvbRSAPublicKeyHeader phdr; unsigned char modulus[phdr.key_num_bits/8]; } publickey; /* Well-known descriptor tags. * * AVB_DESCRIPTOR_TAG_PROPERTY: see |AvbPropertyDescriptor| struct. * AVB_DESCRIPTOR_TAG_HASHTREE: see |AvbHashtreeDescriptor| struct. * AVB_DESCRIPTOR_TAG_HASH: see |AvbHashDescriptor| struct. * AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE: see |AvbKernelCmdlineDescriptor| struct. * AVB_DESCRIPTOR_TAG_CHAIN_PARTITION: see |AvbChainPartitionDescriptor| struct. */ typedef enum { AVB_DESCRIPTOR_TAG_PROPERTY, AVB_DESCRIPTOR_TAG_HASHTREE, AVB_DESCRIPTOR_TAG_HASH, AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE, AVB_DESCRIPTOR_TAG_CHAIN_PARTITION, } AvbDescriptorTag; /* The header for a serialized descriptor. * * A descriptor always have two fields, a |tag| (denoting its type, * see the |AvbDescriptorTag| enumeration) and the size of the bytes * following, |num_bytes_following|. * * For padding, |num_bytes_following| is always a multiple of 8. */ typedef struct AvbDescriptor { uint64_t tag; uint64_t num_bytes_following; } AvbDescriptor; typedef struct AvbHashDescriptor { //AvbDescriptor parent_descriptor; uint64_t image_size; uint8_t hash_algorithm[32]; uint32_t partition_name_len; uint32_t salt_len; uint32_t digest_len; uint32_t flags; uint8_t reserved[60]; } AvbHashDescriptor; typedef struct AvbHashtreeDescriptor { //AvbDescriptor parent_descriptor; uint32_t dm_verity_version; uint64_t image_size; uint64_t tree_offset; uint64_t tree_size; uint32_t data_block_size; uint32_t hash_block_size; uint32_t fec_num_roots; uint64_t fec_offset; uint64_t fec_size; uint8_t hash_algorithm[32]; uint32_t partition_name_len; uint32_t salt_len; uint32_t root_digest_len; uint32_t flags; uint8_t reserved[60]; } AvbHashtreeDescriptor; typedef struct AvbPropertyDescriptor { //AvbDescriptor parent_descriptor; uint64_t key_num_bytes; uint64_t value_num_bytes; } AvbPropertyDescriptor; typedef struct AvbKernelCmdlineDescriptor { //AvbDescriptor parent_descriptor; uint32_t flags; uint32_t kernel_cmdline_length; } AvbKernelCmdlineDescriptor; typedef struct AvbChainPartitionDescriptor { //AvbDescriptor parent_descriptor; uint32_t rollback_index_location; uint32_t partition_name_len; uint32_t public_key_len; uint8_t reserved[64]; } AvbChainPartitionDescriptor; BigEndian(); FSeek(0); AvbVBMetaImageHeader hdr; FSeek(0x100); typedef struct authentication_data{ FSeek(0x100+hdr.hash_offset); unsigned char hash[hdr.hash_size]; FSeek(0x100+hdr.signature_offset); unsigned char signature[hdr.signature_size]; }; authentication_data authdata; FSeek(0x100+hdr.authentication_data_block_size); typedef struct descriptor_data { AvbDescriptor desc; local int64 pos=FTell()+desc.num_bytes_following; if (desc.tag==AVB_DESCRIPTOR_TAG_PROPERTY) { AvbPropertyDescriptor property; unsigned char key[property.key_num_bytes+1]; unsigned char value[property.value_num_bytes+1]; unsigned char padding[desc.num_bytes_following-(property.key_num_bytes+property.value_num_bytes+8+8+1+1)]; } else if (desc.tag==AVB_DESCRIPTOR_TAG_HASHTREE) { AvbHashtreeDescriptor hashtree; unsigned char partition_name[hashtree.partition_name_len]; unsigned char salt[hashtree.salt_len]; unsigned char root_digest[hashtree.root_digest_len]; unsigned char reserved[desc.num_bytes_following-0xA4-hashtree.partition_name_len-hashtree.salt_len-hashtree.root_digest_len]; } else if (desc.tag==AVB_DESCRIPTOR_TAG_HASH) { AvbHashDescriptor hash; unsigned char partition_name[hash.partition_name_len]; unsigned char salt[hash.salt_len]; unsigned char digest[hash.digest_len]; unsigned char reserved[desc.num_bytes_following-0x74-hash.partition_name_len-hash.salt_len-hash.digest_len]; } else if (desc.tag==AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE) { AvbKernelCmdlineDescriptor cmdlinedesc; unsigned char cmdline[cmdlinedesc.kernel_cmdline_length]; unsigned char reserved[desc.num_bytes_following-(cmdlinedesc.kernel_cmdline_length+8)]; } else if (desc.tag==AVB_DESCRIPTOR_TAG_CHAIN_PARTITION) { AvbChainPartitionDescriptor chainpartition; unsigned char partition_name[chainpartition.partition_name_len]; publickey public_key; local int padding=0; padding=chainpartition.public_key_len-(public_key.phdr.key_num_bits/8)-8; if (padding!=0) { unsigned char pubkey_extension[padding]; } if ((chainpartition.partition_name_len%4)!=0) { padding=4-(chainpartition.partition_name_len%4); unsigned char reserved[padding+4]; } } FSeek(pos); }; typedef struct auxiliary_data{ FSeek(0x100+hdr.authentication_data_block_size+hdr.descriptors_offset); while (FTell()<0x100+hdr.authentication_data_block_size+hdr.public_key_offset) { descriptor_data descriptors; } FSeek(0x100+hdr.authentication_data_block_size+hdr.public_key_offset); publickey public_key; FSeek(0x100+hdr.authentication_data_block_size+hdr.public_key_metadata_offset); unsigned char public_key_metadata[hdr.public_key_metadata_size]; }; auxiliary_data auxdata;