[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
[MENTION=4120742]munjeni[/MENTION], my yesterdays fota trials repeatedly failed the verification phase because I missed flashing adspso.sin file when downgrading back to 10.107 fw.

Indeed, the main android kernel from 'boot' partition does the verification phase. Before verification starts, the block mapped file contains the downloaded content.

If the verification is passed, it reboots to FOTAKernel.

There the 'fota-ua' opens the userdata partition and uses mmap() call to simply memory map all the block ranges from the map file. Because of this, the strace does not show any more any reads/writes to the update package file (block ranges).

It seems the block content is already changed when booting to FOTAKernel for the install phase, but still it seems like encrypted.

-- edit --

Here is the update package content as extracted from block ranges right before starting fota-ua for install (i.e. riht after rebooting from main kernel verification phase, before starting fota-ua in fotakernel):

xz1c-fota-to-47.2.A.11.228-input-for-fota-ua-install.zip

Bootloader log shows this:

Vendor(0x00000050)->Sony(0x6F656D46)
3, 3, Setting existing handle
Startup flags: [USB INSERTED] [HARD RESET]
Warmboot reason: [FOTA]
[ERROR @ sony_boot_config_parser.c:732]:
None or incorrect vbus_pulse configuration!
3, 3, Reset keys pressed but released before shutdown timer expired. Booting normally.
Service mode detected: [NONE]

The fotakernel is stated with: startup=0x00008004 warmboot=0x6f656d46

The misc partition still contains just the "bootonce-bootloader" string.

Logcat does not show much, just few following entries might be of interrest:

02-22 15:20:02.468 890 890 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x200
02-22 15:20:02.469 890 890 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
02-22 15:20:02.471 890 890 D QSEECOMAPI: QSEECom_dealloc_memory
02-22 15:20:02.472 890 890 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
--------- beginning of system
02-22 15:20:02.473 890 890 I libdevice_security_static_client: get_security_config.cpp:68 security configuration 1
02-22 15:20:02.477 890 890 I libdevice_security_static_client: verify_s1sin_signature.cpp:102 s1sin_signature_hashes verification is successful
...
02-22 15:35:04.301 797 797 I tad : MiscTA Unit 2405:
02-22 15:35:04.301 797 797 I tad : WRITTEN (Size 3)
02-22 15:35:04.311 797 797 I tad : Actual erase/write to flash done (count 1, time 36084904).
02-22 15:35:04.311 797 797 I tad : MiscTA: Write of unit 2405 completed - OK

After installing the package, there is following content in the cache 'recovery/fota/report' file.

Fota log
Start time: 2019-10-22 23:32:56 (Time in UTC)
Current time: 1971-02-22 15:35:04 (Time in UTC)
Status written for DA: 0x0
Uptime: 1716

Last log messages:
Info [292] Logging OK
Info [392] Current kernel id: 2
Info [1155] Found /cache/recovery/command
Info [1258] Command file for FOTA [--update_package=@/cache/recovery/block.map
--locale=en_GB]
Info [1329] Found locale_info[en_GB]
Info [1360] Package placed on 4
Info [1361] Package found [/cache/recovery/block.map]
Info [508] Charger Ok

=== Total memory info ===
Total physical memory: 3871436800 bytes
Total available physical memory: 3259170816 bytes
Configuration info at runtime:
The num of pages of physical memory: 945175
The num of currently available pages of physical memory: 795696
The num of processors configured: 8
The num of processors currently online (available): 2
Size of a page in bytes: 4096
Logging of resource usage measures:
Max resident set size ru_maxrss: 708 KB
Page reclaims ru_minflt: 206
Page faults ru_majflt: 0
Block input operations: 0
Block output operations: 0
===
Info [299] Power source is connected
WARN [582] Error at ui_start_animation
WARN [317] Battery is not charging. Something is wrong with power source, battery or the cord is unplugged
Info [578] Package OK
WARN [381] Error ui_remove at locale_image
Info [600] Security OK
Info [628] Skipping meta-info check
Info [132] Updater continues in 3 state
Info [596] Primary GPT ok, header crc:0xa5436e26, entries crc: 0xd02818f
Info [613] Secondary GPT ok, header crc:0x8d9d7cbb, entries crc: 0xd02818f
Info [596] Primary GPT ok, header crc:0x192fec7a, entries crc: 0x8b54b583
Info [613] Secondary GPT ok, header crc:0x3bbff83, entries crc: 0x8b54b583
Info [596] Primary GPT ok, header crc:0x6d53394c, entries crc: 0x55574a13
Info [613] Secondary GPT ok, header crc:0x458d2bd1, entries crc: 0x55574a13
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [596] Primary GPT ok, header crc:0xa5436e26, entries crc: 0xd02818f
Info [613] Secondary GPT ok, header crc:0x8d9d7cbb, entries crc: 0xd02818f
Info [596] Primary GPT ok, header crc:0x192fec7a, entries crc: 0x8b54b583
Info [613] Secondary GPT ok, header crc:0x3bbff83, entries crc: 0x8b54b583
Info [596] Primary GPT ok, header crc:0x6d53394c, entries crc: 0x55574a13
Info [613] Secondary GPT ok, header crc:0x458d2bd1, entries crc: 0x55574a13
Info [188] system partition : use start address from disk info instead of fsconfig
Info [191] system partition : start { 0xb2685000, size : 0x138800000 }
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [421] Starting operation 0
Info [517] Return value from RB_vRM_Update: 0x0
Info [518] End of operation 0
Info [596] Primary GPT ok, header crc:0xa5436e26, entries crc: 0xd02818f
Info [613] Secondary GPT ok, header crc:0x8d9d7cbb, entries crc: 0xd02818f
Info [596] Primary GPT ok, header crc:0x192fec7a, entries crc: 0x8b54b583
Info [613] Secondary GPT ok, header crc:0x3bbff83, entries crc: 0x8b54b583
Info [596] Primary GPT ok, header crc:0x6d53394c, entries crc: 0x55574a13
Info [613] Secondary GPT ok, header crc:0x458d2bd1, entries crc: 0x55574a13
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [188] system partition : use start address from disk info instead of fsconfig
Info [191] system partition : start { 0xb2685000, size : 0x138800000 }
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [232] LUN(fd=8) using: /dev/block/sda (size 31240192 kB)
Info [790] No pending partition changes, not updating partition tables
Info [790] No pending partition changes, not updating partition tables
Info [790] No pending partition changes, not updating partition tables
Info [657] Updater OK

=== Total memory info ===
Total physical memory: 3909185536 bytes
Total available physical memory: 3464617984 bytes
Configuration info at runtime:
The num of pages of physical memory: 954391
The num of currently available pages of physical memory: 845854
The num of processors configured: 8
The num of processors currently online (available): 2
Size of a page in bytes: 4096
Logging of resource usage measures:
Max resident set size ru_maxrss: 464852 KB
Page reclaims ru_minflt: 287894
Page faults ru_majflt: 5
Block input operations: 24066784
Block output operations: 24066784
===

=== Thermal info ===
therm(msm_therm): 32.7 => 38.4
===

Dump of internal data structures:

================================== ua_context ==================================
ua_ctx->last_result: 1 (RESULT_UA_OK)
ua_ctx->do_kernel_update: 0
ua_ctx->kid: 2 (KERNEL_FOTA)
ua_ctx->t_ctx.tm: 1 (NO_TEST)

ua_ctx->fota_ua_executable: 0x0
ua_ctx->fota_ua_executable_size: 0
ua_ctx->copy_crypt_key: 0
ua_ctx->use_ua_charger: 1

============================== ua_logging_context ==============================
l_ctx->result: 0
l_ctx->use_console: 1

============================== ua_package_context ==============================
p_ctx->package.data: 0x7141b99000
p_ctx->package.data_size: 420897111
p_ctx->package.signature: 0x715acfed57
p_ctx->package.fota_ua_executable: 0x0
p_ctx->package.fota_ua_executable_size: 0
p_ctx->package.meta_info calculated length: 1078
p_ctx->package.meta_info:
<?xml version='1.0' encoding='ISO-8859-1'?>
<metadata version="3.3">
<product>
<manufacturer>Sony</manufacturer>
<model>G8441</model>
<hwplatform>msm8998</hwplatform>
<security_state>HWC_Yoshino_Com_001</security_state></product>
<update>
<generation>
<version>1.1.39</version>
<date>2019-10-09T10:37:00Z</date>
<rb_version>11.2.0.4</rb_version>
<rb_ua_version>11.2.0.4</rb_ua_version>
</generation>
<source>
<software>
<revision>47.2.A.10.107</revision>
</software>
<customization>
<variant>1310-7123</variant>
<revision>R1C</revision>
</customization>
</source>
<target>
<software>
<revision>47.2.A.11.228</revision>
</software>
<customization>
<variant>1310-7123</variant>
<revision>R1C</revision>
</customization>
</target>
</update>
</metadata>
p_ctx->package.inc[0] = {
attributes: IA_IMAGE,
id: 0
address: 0x7141b991a4
}
p_ctx->package.inc[1] = {
attributes: IA_IMAGE,
id: 1
address: 0x7141c72638
}
p_ctx->package.inc[2] = {
attributes: IA_IMAGE, IA_OVERWRITE,
id: 2
address: 0x7141d381a2
}
p_ctx->package.inc[3] = {
attributes: IA_IMAGE, IA_OVERWRITE,
id: 3
address: 0x7141d38298
}
p_ctx->package.inc[4] = {
attributes: IA_IMAGE, IA_OVERWRITE,
id: 4
address: 0x7141d38394
}
p_ctx->package.inc[5] = {
attributes: IA_IMAGE, IA_OVERWRITE,
id: 5
address: 0x7141d38490
}
p_ctx->package.inc[6] = {
attributes: IA_IMAGE,
id: 7
address: 0x7141d51f79
}
p_ctx->package.inc[7] = {
attributes: IA_IMAGE,
id: 8
address: 0x7142812e48
}
p_ctx->package.inc[8] = {
attributes: IA_IMAGE,
id: 9
address: 0x7142812f39
}
p_ctx->package.inc[9] = {
attributes: IA_IMAGE,
id: 16
address: 0x714281305c
}
p_ctx->package.inc[10] = {
attributes: IA_IMAGE,
id: 17
address: 0x715a0dfc8b
}
p_ctx->package.inc[11] = {
attributes: IA_IMAGE,
id: 18
address: 0x715acfe46a
}
p_ctx->result: 1 (PACKAGE_OK)
p_ctx->block_map_file: 1

============================= ua_security_context ==============================
s_ctx->result: 1

============================== ua_updater_context ==============================
u_ctx->result: 1
u_ctx->ui_error: 0
u_ctx->redbend_init_error: 0
u_ctx->redbend_verify: 0
u_ctx->redbend_write: 0
u_ctx->redbend_post: 0
u_ctx->redbend_error_code: 0
u_ctx->file_error: 0
u_ctx->lbm_error: 0
u_ctx->boot_error: 0
u_ctx->boot_verify: 0
u_ctx->boot_write: 0
u_ctx->boot_post: 0
u_ctx->google_error: 0
u_ctx->kid: 2 (KERNEL_FOTA)
u_ctx->running.state: 4 (UPDATE_DONE)
u_ctx->running.increment: 12

=============================== ua_file_context ================================
f_ctx->update_available: 1
f_ctx->package_path: /cache/recovery/block.map
f_ctx->package_location: 4
f_ctx->command_file_fota: 1

===================================== jitc =====================================
f_ctx->clear_data: 0
f_ctx->miscta_file_import: 0

================================== ui_context ==================================
ui_ctx->initialized: 1
ui_ctx->state: 2 (UI_INSTALL)
ui_ctx->increment_progress: 100
ui_ctx->ui_disabled: 0
ui_ctx->increment_index: 11
ui_ctx->keep_display_teardown: 0
ui_ctx->kid: 2 (KERNEL_FOTA)
ui_ctx->locale_info: en_GB

============================== ua_memory_context ===============================
memory_ctx->total_memory: 3909185536
memory_ctx->avail_total_memory: 3464617984
memory_ctx->phys_pages: 954391
memory_ctx->avphys_pages: 845854
memory_ctx->nprocessors_conf: 8
memory_ctx->nprocessors_onln: 2
memory_ctx->page_size: 4096

And the 'recovery/fota/ua_status':

$ hexdump -C status
00000000 00 00 00 00 |....|
00000004

I've used following script to extract the fota package current content from block ranges:

#!/system/bin/sh

DIR="$1"

file_from_blockmap() {
OUTFILE="$1"
read BLKDEV
read SIZE BLKSIZE
read RANGES
for i in `seq 1 $RANGES`
do
read RL RR
dd if=${BLKDEV} bs=${BLKSIZE} skip=${RL} count=$((${RR} - ${RL})) 2>/dev/null
done | dd bs=${BLKSIZE} of=${OUTFILE} 2>/dev/null
}

if [ -d /cache/recovery ]; then
if [ -s /cache/recovery/block.map ]; then
cat /cache/recovery/block.map | file_from_blockmap ${DIR}/fota-blockfile.bin
fi
fi