1284194Sdelphij 2284194Sdelphij#------------------------------------------------------------ 3284194Sdelphij# $File: android,v 1.7 2014/11/10 05:08:23 christos Exp $ 4284194Sdelphij# Various android related magic entries 5284194Sdelphij#------------------------------------------------------------ 6284194Sdelphij 7284194Sdelphij# Dalvik .dex format. http://retrodev.com/android/dexformat.html 8284194Sdelphij# From <mkf@google.com> "Mike Fleming" 9284194Sdelphij# Fixed to avoid regexec 17 errors on some dex files 10284194Sdelphij# From <diff@lookout.com> "Tim Strazzere" 11284194Sdelphij0 string dex\n 12284194Sdelphij>0 regex dex\n[0-9]{2}\0 Dalvik dex file 13284194Sdelphij>4 string >000 version %s 14284194Sdelphij0 string dey\n 15284194Sdelphij>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 16284194Sdelphij>4 string >000 version %s 17284194Sdelphij 18284194Sdelphij# Android bootimg format 19284194Sdelphij# From https://android.googlesource.com/\ 20284194Sdelphij# platform/system/core/+/master/mkbootimg/bootimg.h 21284194Sdelphij0 string ANDROID! Android bootimg 22284194Sdelphij>1024 string LOKI\01 \b, LOKI'd 23284194Sdelphij>8 lelong >0 \b, kernel 24284194Sdelphij>>12 lelong >0 \b (0x%x) 25284194Sdelphij>16 lelong >0 \b, ramdisk 26284194Sdelphij>>20 lelong >0 \b (0x%x) 27284194Sdelphij>24 lelong >0 \b, second stage 28284194Sdelphij>>28 lelong >0 \b (0x%x) 29284194Sdelphij>36 lelong >0 \b, page size: %d 30284194Sdelphij>38 string >0 \b, name: %s 31284194Sdelphij>64 string >0 \b, cmdline (%s) 32284194Sdelphij 33284194Sdelphij# Android Backup archive 34284194Sdelphij# From: Ariel Shkedi 35284194Sdelphij# File extension: .ab 36284194Sdelphij# No mime-type defined 37284194Sdelphij# URL: https://github.com/android/platform_frameworks_base/blob/\ 38284194Sdelphij# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 39284194Sdelphij# android/server/BackupManagerService.java#L2367 40284194Sdelphij# After the header comes a tar file 41284194Sdelphij# If compressed, the entire tar file is compressed with JAVA deflate 42284194Sdelphij# 43284194Sdelphij# Include the version number hardcoded with the magic string to avoid 44284194Sdelphij# false positives 45284194Sdelphij0 string/b ANDROID\ BACKUP\n1\n Android Backup 46284194Sdelphij>17 string 0\n \b, Not-Compressed 47284194Sdelphij>17 string 1\n \b, Compressed 48284194Sdelphij# any string as long as it's not the word none (which is matched below) 49284194Sdelphij>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 50284194Sdelphij>>19 string none\n \b, Not-Encrypted 51284194Sdelphij# Commented out because they don't seem useful to print 52284194Sdelphij# (but they are part of the header - the tar file comes after them): 53284194Sdelphij#>>>&1 regex/1l .* \b, Password salt: %s 54284194Sdelphij#>>>>&1 regex/1l .* \b, Master salt: %s 55284194Sdelphij#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 56284194Sdelphij#>>>>>>&1 regex/1l .* \b, IV: %s 57284194Sdelphij#>>>>>>>&1 regex/1l .* \b, Key: %s 58284194Sdelphij 59284194Sdelphij# *.pit files by Joerg Jenderek 60284194Sdelphij# http://forum.xda-developers.com/showthread.php?p=9122369 61284194Sdelphij# http://forum.xda-developers.com/showthread.php?t=816449 62284194Sdelphij# Partition Information Table for Samsung's smartphone with Android 63284194Sdelphij# used by flash software Odin 64284194Sdelphij0 ulelong 0x12349876 65284194Sdelphij# 1st pit entry marker 66284194Sdelphij>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 67284194Sdelphij# minimal 13 and maximal 18 PIT entries found 68284194Sdelphij>>4 ulelong <128 Partition Information Table for Samsung smartphone 69284194Sdelphij>>>4 ulelong x \b, %d entries 70284194Sdelphij# 1. pit entry 71284194Sdelphij>>>4 ulelong >0 \b; #1 72284194Sdelphij>>>0x01C use PIT-entry 73284194Sdelphij>>>4 ulelong >1 \b; #2 74284194Sdelphij>>>0x0A0 use PIT-entry 75284194Sdelphij>>>4 ulelong >2 \b; #3 76284194Sdelphij>>>0x124 use PIT-entry 77284194Sdelphij>>>4 ulelong >3 \b; #4 78284194Sdelphij>>>0x1A8 use PIT-entry 79284194Sdelphij>>>4 ulelong >4 \b; #5 80284194Sdelphij>>>0x22C use PIT-entry 81284194Sdelphij>>>4 ulelong >5 \b; #6 82284194Sdelphij>>>0x2B0 use PIT-entry 83284194Sdelphij>>>4 ulelong >6 \b; #7 84284194Sdelphij>>>0x334 use PIT-entry 85284194Sdelphij>>>4 ulelong >7 \b; #8 86284194Sdelphij>>>0x3B8 use PIT-entry 87284194Sdelphij>>>4 ulelong >8 \b; #9 88284194Sdelphij>>>0x43C use PIT-entry 89284194Sdelphij>>>4 ulelong >9 \b; #10 90284194Sdelphij>>>0x4C0 use PIT-entry 91284194Sdelphij>>>4 ulelong >10 \b; #11 92284194Sdelphij>>>0x544 use PIT-entry 93284194Sdelphij>>>4 ulelong >11 \b; #12 94284194Sdelphij>>>0x5C8 use PIT-entry 95284194Sdelphij>>>4 ulelong >12 \b; #13 96284194Sdelphij>>>>0x64C use PIT-entry 97284194Sdelphij# 14. pit entry 98284194Sdelphij>>>4 ulelong >13 \b; #14 99284194Sdelphij>>>>0x6D0 use PIT-entry 100284194Sdelphij>>>4 ulelong >14 \b; #15 101284194Sdelphij>>>0x754 use PIT-entry 102284194Sdelphij>>>4 ulelong >15 \b; #16 103284194Sdelphij>>>0x7D8 use PIT-entry 104284194Sdelphij>>>4 ulelong >16 \b; #17 105284194Sdelphij>>>0x85C use PIT-entry 106284194Sdelphij# 18. pit entry 107284194Sdelphij>>>4 ulelong >17 \b; #18 108284194Sdelphij>>>0x8E0 use PIT-entry 109284194Sdelphij 110284194Sdelphij0 name PIT-entry 111284194Sdelphij# garbage value implies end of pit entries 112284194Sdelphij>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 113284194Sdelphij# skip empty partition name 114284194Sdelphij>>0x24 ubyte !0 115284194Sdelphij# partition name 116284194Sdelphij>>>0x24 string >\0 %-.32s 117284194Sdelphij# flags 118284194Sdelphij>>>0x0C ulelong&0x00000002 2 \b+RW 119284194Sdelphij# partition ID: 120284194Sdelphij# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 121284194Sdelphij# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 122284194Sdelphij>>>0x08 ulelong x (0x%x) 123284194Sdelphij# filename 124284194Sdelphij>>>0x44 string >\0 "%-.64s" 125284194Sdelphij#>>>0x18 ulelong >0 126284194Sdelphij# blocksize in 512 byte units ? 127284194Sdelphij#>>>>0x18 ulelong x \b, %db 128284194Sdelphij# partition size in blocks ? 129284194Sdelphij#>>>>0x22 ulelong x \b*%d 130284194Sdelphij 131284194Sdelphij# Android bootimg format 132284194Sdelphij# From https://android.googlesource.com/\ 133284194Sdelphij# platform/system/core/+/master/libsparse/sparse_format.h 134284194Sdelphij0 lelong 0xed26ff3a Android sparse image 135284194Sdelphij>4 leshort x \b, version: %d 136284194Sdelphij>6 leshort x \b.%d 137284194Sdelphij>16 lelong x \b, Total of %d 138284194Sdelphij>12 lelong x \b %d-byte output blocks in 139284194Sdelphij>20 lelong x \b %d input chunks. 140