[Android Q&A, Help & Troubleshooting] terence.tan:
Code Signing for Fun and Profit

To prevent tampering, all code in the firmware is signed by the vendor. If code is modified, the digital signature fails and things stop working.

The code can't be tampered with, since it is signed by a key in the Signing certificate

The Signing certificate can't be tampered with, since it is signed by a key in the Attestation CA certificate

The Attestation CA certificate can't be tampered with, since it is signed by a key in the Root CA Certificate

The Root CA certificate can't be tampered with, since a hash of it is written into the device's read-only memory

More info on the certificate chain hierarchy is available in the Qualcomm Secure Boot and Image Authentication Technical Overview, have a read.

The Signing, Attestation and Root certificates are included with each piece of signed code. So let's inspect it! For this I am using the firehose programmers courtesy of [MENTION=4222965]deadman96385[/MENTION] available at https://github.com/programmer-collection/alcatel/

From the PVG100 firehose programmer we get:

Subject: C = CN,
CN = Pepito Attestation Cert,
L = SHENZHEN,
O = TCLMOBILE,
ST = GUANGDONG,
OU = 01 0000000000000003 SW_ID,
OU = 02 0006B0E100420041 HW_ID,
OU = 04 0042 OEM_ID,
OU = 05 00000168 SW_SIZE,
OU = 06 0041 MODEL_ID,
OU = 07 0001 SHA256,
OU = 03 0000000000000002 DEBUG

And from the PVG100EU firehose programmer we get:

Subject: C = CN,
CN = PepitoVDF Attestation Cert,
L = CHENGDU,
O = TCLMOBILE,
ST = SICHUAN,
OU = 01 0000000000000003 SW_ID,
OU = 02 0006B0E100420046 HW_ID,
OU = 04 0042 OEM_ID,
OU = 05 00000168 SW_SIZE,
OU = 06 0046 MODEL_ID,
OU = 07 0001 SHA256,
OU = 03 0000000000000002 DEBUG

The above are from the Signing certificates but the Root CA certificates are similar. Note the differences: one is from Shenzhen and the other from Chengdu, different places in China...

Because the Root CA certificates are different, you cannot load one piece of code on the other device, otherwise the validation will fail. So I recommend you don't try loading a PVG100EU modem partition into a PVG100, for example.

If anyone is interested in exploring the certificate chains for themselves, here is how you can extract them:

First get copies of PEPITO.bin and Pepito_VDF_NPRG.bin, credit to [MENTION=4222965]deadman96385[/MENTION]

Extract the certificates (offsets manually found in a hex editor). Sample Linux code:

dd if=PEPITO.bin bs=1 skip=4712 count=1149 of=PEPITO.2-signing.der
dd if=PEPITO.bin bs=1 skip=5861 count=980 of=PEPITO.1-attestation.der
dd if=PEPITO.bin bs=1 skip=6841 count=937 of=PEPITO.0-root.der
dd if=Pepito_VDF_NPRG.bin bs=1 skip=4712 count=1146 of=Pepito_VDF_NPRG.2-signing.der
dd if=Pepito_VDF_NPRG.bin bs=1 skip=5858 count=976 of=Pepito_VDF_NPRG.1-attestation.der
dd if=Pepito_VDF_NPRG.bin bs=1 skip=6834 count=933 of=Pepito_VDF_NPRG.0-root.der

Extract the details of the certificates:

openssl x509 -in PEPITO.2-signing.der -inform der -text > PEPITO.txt
openssl x509 -in PEPITO.1-attestation.der -inform der -text >> PEPITO.txt
openssl x509 -in PEPITO.0-root.der -inform der -text >> PEPITO.txt
openssl x509 -in Pepito_VDF_NPRG.2-signing.der -inform der -text > Pepito_VDF_NPRG.txt
openssl x509 -in Pepito_VDF_NPRG.1-attestation.der -inform der -text >> Pepito_VDF_NPRG.txt
openssl x509 -in Pepito_VDF_NPRG.0-root.der -inform der -text >> Pepito_VDF_NPRG.txt

For everyone's convenience I have attached the results below. You can also use this technique on other code. For example I have checked the "sbl1" and "aboot" partitions of my own PVG100; they have the same Attestation CA and Root CA certificates as in the PVG100 firehose programmer. (So in theory they should work.)

Enjoy!