How to sign update.zip

Question

I'm currently trying to apply an update over the stock android recovery. I created the zip contents and my own keys for the android build but it failes with a signature verification error. I have now found this piece of code in the bootable/recovery/verifier.cpp

#define FOOTER_SIZE 6

if (fseek(f, -FOOTER_SIZE, SEEK_END) != 0) {
    LOGE("failed to seek in %s (%s)\n", path, strerror(errno));
    fclose(f);
    return VERIFY_FAILURE;
}

unsigned char footer[FOOTER_SIZE];
if (fread(footer, 1, FOOTER_SIZE, f) != FOOTER_SIZE) {
    LOGE("failed to read footer from %s (%s)\n", path, strerror(errno));
    fclose(f);
    return VERIFY_FAILURE;
}

if (footer[2] != 0xff || footer[3] != 0xff) {
    LOGE("failed check of footer bytes 2 & 3 match 0xff");
    fclose(f);
    return VERIFY_FAILURE;
}

Which expects the 4th and 3rd last byte in the zip to be 0xff. The verification failes at this point. If I open the zip with a HexEditor I can see that both bytes are not 0xff. If I open a zip from the /bootable/recovery/testdata/otasigned*.zip I can see that they are 0xff.

I signed the zip with following command: jdk1.6.0_35/bin/java -jar Android/prebuilts/sdk/tools/lib/signapk.jar Android/build/target/product/security/testkey.x509.pem Android/build/target/product/security/testkey.pk8 testupdate.zip update.zip wich adds some certificate data in the META-INF folder.

I couldn't find any information that theese bytes have to be oxff on the zip spec either.

What is going wrong here?

PS: Of course i could disable signature verification, but I want this feature (only working, not failing ;) )

Ok, now I know I forgot the -w parameter for SignApk.jar. But now it failes with: I:1 key(s) loaded from /res/keys Verifying update package... I:comment is 1691 bytes; signature 1673 bytes from end E:failed to verify whole-file signature But I use the testkey from /build/target/product/secutity wich is also used by the otapackage build rule and the zip build there gets verified correctly... Any explanation for this? — chuck258, Nov 22 '13 at 11:56

score 0 · Answer 1 · answered Dec 02 '15 at 01:58

0

Use -w option which make signapk sign the whole file

signapk -w $KEY_FILE.x509.pem $KEY_FILE.pk8 $UPDATE_ZIP $UPDATE_ZIP.signed

answered Dec 02 '15 at 01:58

Arun Murthy

61
1
2

score -1 · Answer 2 · answered Nov 21 '13 at 16:10

-1

You don't need to modify the code, just use toggle signature verification function from your recovery menu to disable the signature check, your update.zip will work

answered Nov 21 '13 at 16:10

marcozabo

174
8

As I mentioned I don't want to disable signature verifiaction, furthermore there is no menu item to disable it, it is the STOCK Recovery from google – chuck258 Nov 22 '13 at 08:13

How to sign update.zip

2 Answers2