Modifying Touch 2 updates

[willmav5000]

Hi Everyone,

Not sure if this is allowed here so feel free to delete it if necessary but here goes.

I've been working on making modifications to the update files, so far I've been able to make changes to the files and build an swdl.iso, the updates are aknowledged, pass validation and work up until the unit reboots to actually install the update.

This is from an official update.

The part in green is verified by the following commands:

inject -e -i /fs/usb0/swdl.iso -f /tmp/isodigest.sha256 -o 0 -s 64
isodigest -df /tmp/iso.digest /fs/usb0/swdl.iso
openssl dgst -sha256 -verify /etc/keys/swdl.pub -signature /tmp/isodigest.sha256 /tmp/iso.digest

If successful, you will get "Verified OK"; otherwise, you will get "Verification Failure."

The part in blue has to match the output created by hashFile:

hashFile sha256 /fs/usb0/swdl.iso /tmp/tmp.digest 32768

The part below is where the update starts to fail.

The blue and red parts are base64 encoded and passed to com.harman.service.samSecurity as json in the following format:

{
  "signType": "appUpdate",
  "signature": "base64 encoded value"
}

I can't seem to figure out how the part in red is generated, as the verification step then fails when verifyISO is run after the unit is reset, right before the updates are actually installed.

If anyone can help it would be much appreciated.

 

[davidif]

All Chinese to me I’m afraid although interested to know what the intended outcome is?

[willmav5000]

The end game would hopefully give us the ability to create our own updates with tweaks/mod and maybe some custom themes, possibly some extra apps too. I suppose it could be used to update the maps too, but that can already be achived with a little effort.

[willmav5000]

Just adding some updates.

I'm still trying to figure out how the parts in red are generated.

I've made some progress by modifying certain files and then rebuilding and signing the updates. I'm able run custom scripts before the update is started and can make some changes to the filesystem. For example, I have been able to enable Dbus, telnet, and increase the amount of information that is written to the logdump. There's also a flag to allow downgrading but I haven't tested that yet.

I wasn't able to find the root password, but there is a workaround. You can temporarily overwrite the shadow file and replace the password until the unit is rebooted.

If anyone is able to get an SPI dump that could also help out a little.