MobileRead Forums - View Single Post - Block OTA by removing ota related binaries

jp12323 · 03-24-2021, 01:02 AM

I extracted the KO2 5.13.3 firmware update file and took a look in IDA at rootfs.img\usr\bin\otav3 file and found the function where they detect a non valid "update.bin.tmp.partial" file:
https://i.imgur.com/mHu1vzU.png
The first if just checks if it can lstat read the update file. The second if statement seems to be where it finds a "non regular file".

I think stat_buf.st_mode & 1 needs to equal 0 for the function to return 0 (aka success). But I don't linux well so idk if we can change the st_mode for our update file, I have 0 clue about vFAT and linux in general.

Also found the function that is in charge of deleting the file:
https://i.imgur.com/HxLh73S.png
If only we could pack a custom ota file, we could probably just nop parts of the function out. Altho idk what side effects there'd be, seems like a messy solution and can't xref the function to the calling function.

This info is prob useless, but just thought I'd post

03-24-2021, 01:02 AM	#42
jp12323 Member Posts: 15 Karma: 10 Join Date: Jul 2018 Device: Kindle Oasis 2 (Jailbroken)	I extracted the KO2 5.13.3 firmware update file and took a look in IDA at rootfs.img\usr\bin\otav3 file and found the function where they detect a non valid "update.bin.tmp.partial" file: https://i.imgur.com/mHu1vzU.png The first if just checks if it can lstat read the update file. The second if statement seems to be where it finds a "non regular file". I think stat_buf.st_mode & 1 needs to equal 0 for the function to return 0 (aka success). But I don't linux well so idk if we can change the st_mode for our update file, I have 0 clue about vFAT and linux in general. Also found the function that is in charge of deleting the file: https://i.imgur.com/HxLh73S.png If only we could pack a custom ota file, we could probably just nop parts of the function out. Altho idk what side effects there'd be, seems like a messy solution and can't xref the function to the calling function. This info is prob useless, but just thought I'd post