[Nubia Red Magic 6] numbawon:
I was looking at finding the of the OTA updates. I'm going to go through the whole process so I can make sure to get all the info out there. I I will include a TLDR at the end.

Ultimately I wanted proper method for getting the OTA files for whatever purpose, and I figured it would be helpful for the community.

To begin I plugged my phone into my PC for ADB.

adb logcat > ota.txt

this puts all the log information obviously into that ota.txt. From here you can use whatever method to parse the txt file as you with. I was using NP++ as my favorite. For search terms I was starting pretty basic and do a search for update.zip for instance.

06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 166: delete /data/data/cn.nubia.systemupdate/shared_prefs/vdmc.xml
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 172: deleteFile succeed.
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 166: delete /data/data/cn.nubia.systemupdate/files/dm_values
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 172: deleteFile succeed.
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 166: delete /data/ota_package/update.zip
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 808: itemName: DM_DELTA_TYPE itemValue:
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 808: itemName: DM_FIRST_DELTA_SIZE itemValue:
06-18 09:22:24.154 7444 7467 I FOTA : [u]a() | 808: itemName: DM_SECOND_DELTA_SIZE itemValue:

That got me some information right away. I quickly see that when it fails it deletes the file right away and where it stores it etc. It also shows me the process IDs and the name of the operation it's doing, so that let me do a search for the whole FOTA process. I took the term "7444 7467 I FOTA" as FOTA was found in a couple locations that were less helpful. From NP++ you can search all in this document, and it gives you a split pane view of all the lines that include the search term by clicking "Find All In Current Document". See below for reference.

View attachment 5353205

It then outputs the full FOTA process string in the lower panel.

View attachment 5353207

This allowed me to walk through the whole update process in an clean and logical way.

I did finally find the update file

06-18 09:22:23.449 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD0_SIZE value = 101874124
06-18 09:22:23.449 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD1_OBJECT_URI value = http://fota-dlusa.nubia.com/data/CN/ZTE/NX669J/2800/NX669J_412-415.up
06-18 09:22:23.449 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD2_TYPE value = Update Package
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD3_NAME value = NX669J_UNCommon_V4.15
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD4_VERSION value = 1.0
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD5_VENDOR value = ZTE
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD6_DESCRIPTION value =
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD7_INSTALL_NOTIFY_URI value = http://fotausa.nubia.com/zxmdmp/dlStatusDebugCallback?sid=NTc5MzZyNzM0fHxaVEV8fE5YNjY5Snx8MTYyNDAwMTM5Mnx8ODY3MTYwMDUwNDI2ODI4
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD8_NEXT_URL value =
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD9_INFO_URL value =
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD10_ICON_URI value =
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD11_INSTALL_PARAM value = eyJvYmplY3RIZWFkZXJEaWdlc3QiOiJGNkFBNDUwMTk2NkNDRkU4NURFMkY1QzU2RUQ2RERDMyIsIm9iamVjdENvbnRlbnREaWdlc3QiOiJDOUI3MjZDNjFBODY1NDZDNjMzRjkwNzkwRTUwNjc5MiIsIm9iamVjdERvd25sb2FkVmVyaWZ5VVJJIjoiaHR0cDovL2ZvdGF1c2EubnViaWEuY29tL3p4bWRtcC9kbFZlcmlmeT9zaWQ9TlRjNU16WnlOek0wZkh4YVZFVjhmRTVZTmpZNVNueDhNVFl5TkRBd01UTTVNbng4T0RZM01UWXdNRFV3TkRJMk9ESTQmZmlsZW5hbWU9L2RhdGEvQ04vWlRFL05YNjY5Si8yODAwL05YNjY5Sl80MTItNDE1LmRkIiwiY2xlYXJVc2VyRGF0YSI6MCwiaW1wb3J0YW50TGV2ZWwiOjN9
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DD_PACK_SIZE value = 101874124
06-18 09:22:23.450 7444 7467 I FOTA : [r]a() | 152: StateValues get key = DL_VERSION value = NX669J_UNCommon_V4.15
06-18 09:22:23.450 7444 7467 I FOTA : [PersistData]e() | 365: dlVersion = NX669J_UNCommon_V4.15

There were some strings that I wasn't sure what to do with yet but I have a file location.

http://fota-dlusa.nubia.com/data/CN/ZTE/NX669J/2800/NX669J_412-415.up

And we can download it. --- But what now?

I tried just renaming the file extension to .zip to see if that did anything. Doing so:

View attachment 5353227

Maybe it isn't a zip file.

Well I pulled it into NP++ to see if it had any useful information about how to deal with this file.

Here is the header:

ðy Øy ïïïï ïïïïPK
!:ã$æ‘Ð Ð
META-INF/com/android/metadataþÊ 5Ù ota-property-files=payload_metadata.bin:1648:559204,payload.bin:1648:101869023,payload_properties.txt:101870729:155,care_map.pb:836:765,metadata:69:720
ota-required-cache=0
ota-streaming-property-files=payload.bin:1648:101869023,payload_properties.txt:101870729:155,care_map.pb:836:765,metadata:69:720
ota-type=AB
post-build=nubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keys
post-build-incremental=nubia.20210429.050527
post-sdk-level=30
post-security-patch-level=2021-03-01
post-timestamp=1619643927
pre-build=nubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210327.193618:user/release-keys
pre-build-incremental=nubia.20210327.193618
pre-device=NX669J-UN
PK
!:™Ó3ý ý care_map.pb5Ù
‚
odm4,0,6,7,238ro.odm.build.fingerprint"Tnubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keys
¥
product&6,0,294915,294919,327681,327685,335421ro.product.build.fingerprint"Tnubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keys
•
system4,0,655372,655373,681380ro.system.build.fingerprint"Tnubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keys

system_ext4,0,131088,131092,158015ro.system_ext.build.fingerprint"Tnubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keys
•
vendor4,0,229410,229411,252646ro.vendor.build.fingerprint"Tnubia/NX669J-UN/NX669J-UN:11/RKQ1.201105.002/nubia.20210429.050527:user/release-keysPK

Well I can see raw text file names. So something is in there.

I decided to open the fine in 7zip. That can open anything. And odds are it can tell me a little more about how it's packaged.

So here is what I have.

View attachment 5353237

Well. According to the properties we have a zip file, and it's signed by SignAPK. We have the contents of that looks like our modern form of incremental updates. A payload.bin that has the individual differential .img files that make up the partitions that are getting updated.

At this point I'm working with this git to try to figure out how to extract the updates.

https://github.com/vm03/update_payload_extractor

I can extract the base OTA, but working through some things to get the incremental update done.

Sorry for the big dump.

:TLDR:

here is where the 4.15 update lives

You can extract the .up file (I also tested in with unzip on linux) with 7zip

we can unpack the updates with projects like this

/End of line