111 lines
3.6 KiB
Text
Executable file
111 lines
3.6 KiB
Text
Executable file
#------------------------------------------------------------------------------
|
|
# Various Android OEM non-standard boot image related magic entries
|
|
# osm0sis @ xda-developers
|
|
#------------------------------------------------------------------------------
|
|
|
|
# ASUS Blob Signature
|
|
0 string -SIGNED-BY-SIGNBLOB- BLOB signing
|
|
|
|
# Barnes & Noble Nook Signature
|
|
64 string Red\x20Loader NOOK signing (red loader)
|
|
64 string Green\x20Loader NOOK signing (green loader)
|
|
64 string Green\x20Recovery NOOK signing (green recovery)
|
|
64 string eMMC\x20boot.img+secondloader NOOK signing (emmc boot)
|
|
64 string eMMC\x20recovery.img+secondloader NOOK signing (emmc recovery)
|
|
48 string BauwksBoot NOOKTAB signing (bauwks)
|
|
|
|
# Google ChromeOS Signature
|
|
0 string CHROMEOS CHROMEOS signing
|
|
|
|
# Samsung/Spreadtrum DHTB Signature
|
|
0 string DHTB\x01\x00\x00 DHTB signing
|
|
|
|
# Sony SIN Packaging/Signature
|
|
0 string \x01\x00\x00\x00 SINv1 signing
|
|
0 string \x02\x00\x00\x00 SINv2 signing
|
|
0 string \x03SIN SINv3 signing
|
|
|
|
# Google Pixel/Nexus/AOSP Standard
|
|
# [test "x" as workaround to odd file/magic behavior not allowing search here]
|
|
0 string x
|
|
>0 search ANDROID! AOSP bootimg
|
|
>>36 string \x00\x00\x00\x02 \b, PXA variant (020)
|
|
>>36 string \x00\x00\x80\x02 \b, PXA variant (028)
|
|
>>36 string \x00\x00\x00\x03 \b, PXA variant (030)
|
|
>>96 search microloader
|
|
>>>1024 string ANDROID! \b, AMONET header
|
|
>>1024 string LOKI \b, LOKI header
|
|
>>>1028 string \x00 \b (boot)
|
|
>>>1028 string \x01 \b (recovery)
|
|
>>2048 search \x88\x16\x88\x58 \b, MTK headers
|
|
!:strength * 3
|
|
|
|
# Google Pixel/AOSP Vendor Standard
|
|
# [test "x" as workaround to odd file/magic behavior not allowing search here]
|
|
0 string x
|
|
>0 search VNDRBOOT AOSP_VNDR bootimg
|
|
!:strength * 3
|
|
|
|
# DENX U-Boot
|
|
0 string \x27\x05\x19\x56 U-Boot bootimg
|
|
|
|
# Intel OSIP
|
|
1000 search \xFC\xFA\xBC\x00 OSIP bootimg (headerless)
|
|
!:strength / 15
|
|
0 string $OS$\x00\x00\x01 OSIP bootimg
|
|
>52 string \x00\x00\x00\x00 \b, boot (signed)
|
|
>52 string \x01\x00\x00\x00 \b, boot (unsigned)
|
|
>52 string \x0C\x00\x00\x00 \b, recovery (signed)
|
|
>52 string \x0D\x00\x00\x00 \b, recovery (unsigned)
|
|
|
|
# Rockchip KRNL
|
|
0 string KRNL KRNL bootimg
|
|
|
|
# Sony ELF
|
|
0 string \x7FELF ELF
|
|
>5 string \x01\x01\x61 bootimg
|
|
>18 string \x28 (ARM
|
|
>18 string \x03 (x86_
|
|
>18 string \x08 (MIPS
|
|
>4 string \x01 \b)
|
|
>4 string \x02 \b64)
|
|
>0 search \x88\x16\x88\x58 \b, MTK headers
|
|
|
|
# MediaTek MTK
|
|
# [for detection after boot image has already been split]
|
|
0 search \x88\x16\x88\x58 MTK header
|
|
>0 search KERNEL \b, kernel type
|
|
>0 search ROOTFS \b, rootfs type
|
|
>0 search RECOVERY \b, recovery type
|
|
!:strength / 20
|
|
|
|
# Qualcomm Device Tree
|
|
# [for detection after boot image has already been split]
|
|
0 string QCDT QCDT header
|
|
!:strength / 20
|
|
|
|
# Google Android Verified Boot 1.0 Signature
|
|
# [for detection with the tail of the boot image]
|
|
0 search \x02\x01\x01\x30\x82 AVBv1 signing footer
|
|
>0 search /boot \b, boot type
|
|
>0 search /recovery \b, recovery type
|
|
!:strength / 20
|
|
|
|
# Google Android Verified Boot 2.0 Signature
|
|
# [for detection with the tail of the boot image]
|
|
# [test "x" as workaround to odd file/magic behavior not allowing search here]
|
|
0 string x
|
|
>0 search AVBf AVBv2 signing footer
|
|
!:strength / 20
|
|
|
|
# LG Bump
|
|
# [for detection with the tail of the boot image]
|
|
0 search \x41\xA9\xE4\x67\x74\x4D\x1D\x1B\xA4\x29\xF2\xEC\xEA\x65\x52\x79 Bump footer
|
|
!:strength / 20
|
|
|
|
# Samsung SEAndroid
|
|
# [for detection with the tail of the boot image]
|
|
# [test "x" as workaround to odd file/magic behavior not allowing search here]
|
|
0 string x
|
|
>0 search SEANDROIDENFORCE SEAndroid footer
|
|
!:strength / 20
|