| android (267897) | android (275698) |
|---|---|
| 1 2#------------------------------------------------------------ | 1 2#------------------------------------------------------------ |
| 3# $File: android,v 1.4 2014/06/03 19:01:34 christos Exp $ | 3# $File: android,v 1.7 2014/11/10 05:08:23 christos Exp $ |
| 4# Various android related magic entries 5#------------------------------------------------------------ 6 7# Dalvik .dex format. http://retrodev.com/android/dexformat.html 8# From <mkf@google.com> "Mike Fleming" 9# Fixed to avoid regexec 17 errors on some dex files 10# From <diff@lookout.com> "Tim Strazzere" 110 string dex\n 12>0 regex dex\n[0-9]{2}\0 Dalvik dex file 13>4 string >000 version %s 140 string dey\n 15>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 16>4 string >000 version %s 17 | 4# Various android related magic entries 5#------------------------------------------------------------ 6 7# Dalvik .dex format. http://retrodev.com/android/dexformat.html 8# From <mkf@google.com> "Mike Fleming" 9# Fixed to avoid regexec 17 errors on some dex files 10# From <diff@lookout.com> "Tim Strazzere" 110 string dex\n 12>0 regex dex\n[0-9]{2}\0 Dalvik dex file 13>4 string >000 version %s 140 string dey\n 15>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 16>4 string >000 version %s 17 |
| 18# http://android.stackexchange.com/questions/23357/\ 19# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 20# 23608#23608 210 string ANDROID\040BACKUP\n Android Backup 22>15 string 1\n \b, version 1 23>17 string 0\n \b, uncompressed 24>17 string 1\n \b, compressed 25>19 string none\n \b, unencrypted 26>19 string AES-256\n \b, encrypted AES-256 27 | |
| 28# Android bootimg format 29# From https://android.googlesource.com/\ 30# platform/system/core/+/master/mkbootimg/bootimg.h 310 string ANDROID! Android bootimg | 18# Android bootimg format 19# From https://android.googlesource.com/\ 20# platform/system/core/+/master/mkbootimg/bootimg.h 210 string ANDROID! Android bootimg |
| 22>1024 string LOKI\01 \b, LOKI'd |
|
| 32>8 lelong >0 \b, kernel 33>>12 lelong >0 \b (0x%x) 34>16 lelong >0 \b, ramdisk 35>>20 lelong >0 \b (0x%x) 36>24 lelong >0 \b, second stage 37>>28 lelong >0 \b (0x%x) 38>36 lelong >0 \b, page size: %d 39>38 string >0 \b, name: %s 40>64 string >0 \b, cmdline (%s) | 23>8 lelong >0 \b, kernel 24>>12 lelong >0 \b (0x%x) 25>16 lelong >0 \b, ramdisk 26>>20 lelong >0 \b (0x%x) 27>24 lelong >0 \b, second stage 28>>28 lelong >0 \b (0x%x) 29>36 lelong >0 \b, page size: %d 30>38 string >0 \b, name: %s 31>64 string >0 \b, cmdline (%s) |
| 41# Dalvik .dex format. http://retrodev.com/android/dexformat.html 42# From <mkf@google.com> "Mike Fleming" 43# Fixed to avoid regexec 17 errors on some dex files 44# From <diff@lookout.com> "Tim Strazzere" 450 string dex\n 46>0 regex dex\n[0-9]{2}\0 Dalvik dex file 47>4 string >000 version %s 480 string dey\n 49>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 50>4 string >000 version %s | |
| 51 | 32 |
| 52# http://android.stackexchange.com/questions/23357/\ 53# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 54# 23608#23608 550 string ANDROID\040BACKUP\n Android Backup 56>15 string 1\n \b, version 1 57>17 string 0\n \b, uncompressed 58>17 string 1\n \b, compressed 59>19 string none\n \b, unencrypted 60>19 string AES-256\n \b, encrypted AES-256 61 62# Android bootimg format 63# From https://android.googlesource.com/\ 64# platform/system/core/+/master/mkbootimg/bootimg.h 650 string ANDROID! Android bootimg 66>8 lelong >0 \b, kernel 67>>12 lelong >0 \b (0x%x) 68>16 lelong >0 \b, ramdisk 69>>20 lelong >0 \b (0x%x) 70>24 lelong >0 \b, second stage 71>>28 lelong >0 \b (0x%x) 72>36 lelong >0 \b, page size: %d 73>38 string >0 \b, name: %s 74>64 string >0 \b, cmdline (%s) 75 | |
| 76# Android Backup archive 77# From: Ariel Shkedi 78# File extension: .ab 79# No mime-type defined 80# URL: https://github.com/android/platform_frameworks_base/blob/\ 81# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 82# android/server/BackupManagerService.java#L2367 83# After the header comes a tar file --- 9 unchanged lines hidden (view full) --- 93>>19 string none\n \b, Not-Encrypted 94# Commented out because they don't seem useful to print 95# (but they are part of the header - the tar file comes after them): 96#>>>&1 regex/1l .* \b, Password salt: %s 97#>>>>&1 regex/1l .* \b, Master salt: %s 98#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 99#>>>>>>&1 regex/1l .* \b, IV: %s 100#>>>>>>>&1 regex/1l .* \b, Key: %s | 33# Android Backup archive 34# From: Ariel Shkedi 35# File extension: .ab 36# No mime-type defined 37# URL: https://github.com/android/platform_frameworks_base/blob/\ 38# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 39# android/server/BackupManagerService.java#L2367 40# After the header comes a tar file --- 9 unchanged lines hidden (view full) --- 50>>19 string none\n \b, Not-Encrypted 51# Commented out because they don't seem useful to print 52# (but they are part of the header - the tar file comes after them): 53#>>>&1 regex/1l .* \b, Password salt: %s 54#>>>>&1 regex/1l .* \b, Master salt: %s 55#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 56#>>>>>>&1 regex/1l .* \b, IV: %s 57#>>>>>>>&1 regex/1l .* \b, Key: %s |
| 58 59# *.pit files by Joerg Jenderek 60# http://forum.xda-developers.com/showthread.php?p=9122369 61# http://forum.xda-developers.com/showthread.php?t=816449 62# Partition Information Table for Samsung's smartphone with Android 63# used by flash software Odin 640 ulelong 0x12349876 65# 1st pit entry marker 66>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 67# minimal 13 and maximal 18 PIT entries found 68>>4 ulelong <128 Partition Information Table for Samsung smartphone 69>>>4 ulelong x \b, %d entries 70# 1. pit entry 71>>>4 ulelong >0 \b; #1 72>>>0x01C use PIT-entry 73>>>4 ulelong >1 \b; #2 74>>>0x0A0 use PIT-entry 75>>>4 ulelong >2 \b; #3 76>>>0x124 use PIT-entry 77>>>4 ulelong >3 \b; #4 78>>>0x1A8 use PIT-entry 79>>>4 ulelong >4 \b; #5 80>>>0x22C use PIT-entry 81>>>4 ulelong >5 \b; #6 82>>>0x2B0 use PIT-entry 83>>>4 ulelong >6 \b; #7 84>>>0x334 use PIT-entry 85>>>4 ulelong >7 \b; #8 86>>>0x3B8 use PIT-entry 87>>>4 ulelong >8 \b; #9 88>>>0x43C use PIT-entry 89>>>4 ulelong >9 \b; #10 90>>>0x4C0 use PIT-entry 91>>>4 ulelong >10 \b; #11 92>>>0x544 use PIT-entry 93>>>4 ulelong >11 \b; #12 94>>>0x5C8 use PIT-entry 95>>>4 ulelong >12 \b; #13 96>>>>0x64C use PIT-entry 97# 14. pit entry 98>>>4 ulelong >13 \b; #14 99>>>>0x6D0 use PIT-entry 100>>>4 ulelong >14 \b; #15 101>>>0x754 use PIT-entry 102>>>4 ulelong >15 \b; #16 103>>>0x7D8 use PIT-entry 104>>>4 ulelong >16 \b; #17 105>>>0x85C use PIT-entry 106# 18. pit entry 107>>>4 ulelong >17 \b; #18 108>>>0x8E0 use PIT-entry 109 1100 name PIT-entry 111# garbage value implies end of pit entries 112>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 113# skip empty partition name 114>>0x24 ubyte !0 115# partition name 116>>>0x24 string >\0 %-.32s 117# flags 118>>>0x0C ulelong&0x00000002 2 \b+RW 119# partition ID: 120# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 121# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 122>>>0x08 ulelong x (0x%x) 123# filename 124>>>0x44 string >\0 "%-.64s" 125#>>>0x18 ulelong >0 126# blocksize in 512 byte units ? 127#>>>>0x18 ulelong x \b, %db 128# partition size in blocks ? 129#>>>>0x22 ulelong x \b*%d 130 131# Android bootimg format 132# From https://android.googlesource.com/\ 133# platform/system/core/+/master/libsparse/sparse_format.h 1340 lelong 0xed26ff3a Android sparse image 135>4 leshort x \b, version: %d 136>6 leshort x \b.%d 137>16 lelong x \b, Total of %d 138>12 lelong x \b %d-byte output blocks in 139>20 lelong x \b %d input chunks. |
|