[Android] BigCountry907:
OK Here is where I'm at.

The Main OTA is SIGNED.

That signature I can get around.

This allows me to modify the contents of the OTA.

This also allows me to write my own updater script.

I will make a new thread on how to fix the signature and make a update.zip that will pass the first level signature verification.

My primary purpose of creating the new Update.zip is to gain ability to flash the Hosd.img and the Radio.img.

No I do not have that functionality yet.

The other benefits are:

You can take the firmware.zip from a OTA and pack it into update.zip.

Provided you did not modify the firmware.zip it will successfully flash.

You can take the Zip_0.zip from a RUU rename it firmware.zip and pack it into update.zip.

Provided you did not modify the Zip_0.zip it will successfully flash.

Because of that we can say that the Firmware.zip and the RUU files are signed with the same key.

So in a nutshell I can pass the first level of security.

The main signature of the update.zip.

But as you said it hands over the firmware flash to the RUU which is actually the HOSD.

Now obviously this way we can utilize the updater binary / updater script to do things that we normally couldn't. Provided that what you do stays in the recovery and doesn't boot to the hosd " RUU".

So were through the front door to the porch . Just have to get through this inside door to the house.

The idea isn't to flash /system block by block. There are easy ways for us to flash that stuff.

TWRP.

I just need to find an open window on the porch to climb through, or a key under the rock left for emergencies. Really it comes down to 2 files.

Radio.img and hosd.img.

If I can find a way to Flash hosd.img were in.

Now as far as more signed files .....Yes there are more.

Like i said earlier

Boot.img

Recovery.img

Hosd.img

Radio.img

Are signed.

On a very interesting note !! The Lollipop RUU does not contain a boot.img

It contains the kernel / Ramdisk / DT.img

So that means the update utility RUU has the ability to pack the boot.img.

In order for the packed boot.img to run on a locked htc device it has to be signed.

The bootloader verifies the signature of the boot.img Right ?? (If the bootloader is locked)

Or does it only verify the signature of the boot.img kernel ??? (If the bootloader is locked)

The boot.img has to be signed.

In order to sign the boot.img you need the private and public key pair.

The same key pair would most definitely sign the Recovery.img / Radio.img / Hosd.img.

I am in the process of extracting the signatures from these files.

If I can locate the key pair I can test sign the files and compare to the original signature to verify.

That would take care of 2 out of 4 security features.

Which leaves encryption of the rom.zip (which you say is unnecessary so we don't need it)

And signing of the firmware.zip

I wonder if the firmware.zip is correctly encrypted if it will bypass the signature verification since it is encrypted.

I am about 99.99% positive that the cwkeys file that you will find in 2 places in the recovery ramdisk and one place in the ruu "hosd" ramdisk Is the public key that verifies the signature on the Firmware.zip.

Reboot to RUU means the ramdisk in the HOSD is loaded and the cwkeys in the hosd ramdisk verifies the firmware.img.

Catch 22 is to replace cwkeys I need to be able to flash the hosd.img with modified ramdisk.

If i was S-off I could test this, I won't have s-off until next week sometime.

But I am willing to bet if I use my same method of replacing the releasekey to replace the cwkeys I can re-sign the firmware.zip and get it to pass.

Thoughts Ideas any information you can add is appreciated.

I think if we work together we can find a way around this.