[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I'm not saying to do the recovery.img mod.

I'm saying use that as a template to be able to sign our own boot and recovery images.

First

Generating custom signing keys

The following openssl commands generate all the keys we need. Execute them line-by-line rather than copying the whole block, as you will be asked for input.

# private key
openssl genrsa -f4 -out verifiedboot.pem 2048
openssl pkcs8 -in verifiedboot.pem -topk8 -outform DER -out verifiedboot.pk8 -nocrypt

# public key
openssl req -new -x509 -sha256 -key verifiedboot.pem -out verifiedboot.x509.pem
openssl x509 -outform DER -in verifiedboot.x509.pem -out verifiedboot.x509.der

Second

Signing the boot image

Using the BootSignature.jar file sign the boot image using the keys generated above

If we look in that fota.zip

the path is /fota/OTA/tools

We have a boot_signer.sh and BootSignature.jar

Looking in the boot signer script we see.

#! /bin/sh

# Start-up script for BootSigner

BOOTSIGNER_HOME=`dirname "$0"`

BOOTSIGNER_HOME=`dirname "$BOOTSIGNER_HOME"`

java -Xmx512M -jar "$BOOTSIGNER_HOME"/framework/BootSignature.jar "$@"

So to sign the boot image our command would be.

java -Xmx512M -jar BootSignature.jar /boot boot.img verifiedboot.pk8 verifiedboot.x509.der boot_signed.img

To check the signature

java -jar BootSignature.jar -verify boot_signed.img

Now if we had Samsungs .pk8 and samsungs .x509.der things would be easy.

The .x509.der we can get off the device its got to be in the ramdisk.

But the .pk8 is the private key and usually we can't get that.

The thing is maybe we can.

The variable "$@" has to be these keys and if the boot.img is getting signed on the device after a patch or update then its hiding somwhere. If we can find that we can sign our own boot.img and the device will say there samsung official.

The other option is where I was talking about what I did to the recovery image.

Some Where there is the KEY used to verify to boot.img signature.

In the case of the recovery and flashing update zips it it the /res/keys found in the ramdisk.

The /res/keys is a dumped form of the keypair made by using dumpkey.jar also found in the /fota/OTA/tools.

By running dumpkey.jar against our custom signing keys we get the form of the key used in /res/keys.

If the boot.img signature scheme used the same method all we need to know is where the equivalent /res/keys is at and replace it with ours.

It could very well be in the ramdisk.

For me to make this work what i need to know is where is the KEY that is used to verify the boot.img signature.

Or if we can get the "$@" variable output in the boot_signer script then we will have both keys.

I highly doubt but it could be possible there hard coded in the BootSignature.jar thats in the fota folder.

It would be helpful if I had a copy of any OTA Update that someone pulled off a device before they installed the update. Preferably a full update from one android version to the next like going from N to O

MY Questions are.

Anyone out there have a copy of a OTA Update?

Anyone know the location of the KEY used to verify the Boot signature?

Has anyone installed an update and seen the update package unpack / repack and sign the boot.img or any log refering to the verification of the boot signature.

If the update unpacked the boot then it had to sign it.

Hopefully you understand now what direction I am headed in with Auto-Key script.

All the code to manipulate the keys I have written in the akey.sh already.

If we can sign our own boot and recovery we don't need to unlock the bootloader.

My final question is

Is the Kernel signed also? Or since the DM-Verity days are they only relying on the boot.img signature.