[Android Software/Hacking General [Developers Only]] erfanoabdi:
[IMG="OTA"]http://www.theandroidsoul.com/wp-content/uploads/2016/06/OTA-Updates.png[/IMG]​

most part of Introduction from taken sdat2img thread

if you want extract non OTA zip i suggest to use sdat2img tool

FOR AB OTA ZIPS USE THIS SCRIPT AND PAYLOAD EXTRACTOR​

in this tools i made block_image_update() function from android recovery to a binary to run on PC and patch system.img with DAT files on OTA package to update system.img by OTA

also we have apply_patch() function for patching boot.img and other files like firmwares

Introduction

You probably know already that starting from Android 5.x (Lollipop) compiled roms (aosp,cm,stock) are not compressed anymore the way they used to be on previous android versions. On previous versions all content inside /system folder that has to be extracted within our device was either uncompressed (simple /system folder inside our flashable zip) or compressed in a system.img file, which it is a ext4 compressed file; both of these, anyway, were readable and we could see all system files (app,framework, etc).

The problem comes in >=5.0 versions, this method is not used anymore. Why? Because roms started to be always larger, so it is necessary to compress them even more.

What does new Android zips (full roms, but also OTAs) contain?

New Android flashable zips are made this way:

boot.img (kernel)

file_contexts (selinux related)

META-INF (folder containing scripts)

system.new.dat (compressed /system partition)

system.patch.dat (for OTAs)

system.transfer.list (see explanation below)

and other patch files (.p only on OTA zip)​

What does updater-script contains then?

The updater-script uses a brand new function: block_image_update(), this method basically decompresses necessary files inside the device. Let's study it.

From google git source code, if we go inside the new file /bootable/recovery/updater/blockimg.c, we find at the end of it the registration of the function block_image_update() as the method BlockImageUpdateFn() which starts at line 254. Here finally we find all information we need to know about the decompression of the .dat file(s). First file we analyze is system.transfer.list which Google tells us:

But what each line means?:

all transfer commands is :

bsdiff

*erase

free

imgdiff

move

*new

stash

*zero

BlockImageUpdate is reading system.transfer.list and executing all commands

But BlockImageVerify doesn’t execute * commands, which not to make changes on system.img just verifying update can happen

original sdat2img tool only support "new" command

Ok, but how to Patch the system.img with OTA files?

All instructions are below. binaries are involved. Please read carefully step by step.

You can use/modify these files and/or include them in your work as long as

proper credits and a link to this thread

are given.

If you have questions or problems

write here ;)

Thanks

- [MENTION=5132229]xpirt[/MENTION] , for original sdat2img tool and useful thread

XDA:DevDB Information

IMG Patch Tools, sdat2img for OTA zips, Tool/Utility for all devices (see above for details)

Contributors

erfanoabdi

Source Code: https://github.com/erfanoabdi/imgpatchtools

Version Information

Status: Testing

Created 2017-07-21

Last Updated 2020-01-23