Article directory
For a long time, many people have expressed their desire to study the payload file of Android OTA to see what is in it, and want to do some research on it, but they feel that the payload file is very complicated, and they are finally discouraged.
A long time ago, in ancient times, to be exact, when Android 7.1 first introduced the A/B system, there were basically no tools for analyzing the A/B system and payload. I drew a payload.bin based on the update_metadata.proto file The file structure diagram is as follows (you can click on the picture to enlarge it):
Figure 1. Android 7.1 payload.bin file structure diagram
From Anroid 7.1 to today's Android 13 system, the update_metadata.proto file has changed several times, but the general structure remains the same.
Starting from the dynamic partition of Android 10(Q), a script named payload_info.py has been added to the update_engine code , which is specially used to parse the payload.bin file and display relevant information.
With this tool, I think you don't need to worry about the contents of the payload.bin file anymore.
For more information about the list and content of Android OTA upgrade related articles, please refer to "Android OTA Upgrade Series Column Guide"
If you have already subscribed to the paid column, please be sure to add me on WeChat, and I will pull you into the Q&A group of the corresponding column.
This article introduces its usage based on the payload_info.py tool on Android 11®.
1. Use of payload_info.py
1. Environment
The payload_info.py script is located in system/update_engine/scriptsthe directory . The content of the payload_info.py script is very simple. It is to view the information of the payload.bin file through the proto structure data of the payload.
The function of the payload_info.py script depends on some other scripts in this directory, so the easiest way is to operate directly in this directory, or export the script directory to the environment variable PATH.
export PATH=system/update_engine/scripts:$PATH
Even so, I usually recommend that you use it like this:
# 执行 build/envsetup.sh 设置代码编译相关的环境
$ source build/envsetup.sh
# 选择你感兴趣的编译配置，我这里直接用数字 46 指定，你也可以使用名称指定，如 'lunch aosp_arm64-eng'
$ lunch 46
# 把 payload_info.py 变量加入到 PATH 环境变量中
$ export PATH=system/update_engine/scripts:$PATH
After setting up the environment, you can use the payload_info.py tool.
2. Help information
$ payload_info.py --help
usage: payload_info.py [-h] [--list_ops] [--stats] [--signatures] payload_file
Show information about an update payload.
positional arguments:
payload_file The update payload file.
optional arguments:
-h, --help show this help message and exit
--list_ops List the install operations and their extents.
--stats Show information about overall input/output.
--signatures Show signatures stored in the payload.
As you can see from here, the options supported by payload_info.py are relatively intuitive and simple, and very easy to use.
2. View payload file information
Here, I look at the payload.bin file of a differential package in the out/update directory:
$ tree out/update
out/update
├── care_map.pb
├── META-INF
│ └── com
│ └── android
│ ├── metadata
│ └── otacert
├── payload.bin
└── payload_properties.txt
3 directories, 5 files
1. View without options
$ payload_info.py out/update/payload.bin
Payload version: 2
Manifest length: 53885
Number of partitions: 6
Number of "boot" ops: 67
Number of "system" ops: 790
Number of "vendor" ops: 42
Number of "dtbo" ops: 4
Number of "vbmeta" ops: 1
Number of "vendor_boot" ops: 23
Timestamp for boot:
Timestamp for system:
Timestamp for vendor:
Timestamp for dtbo:
Timestamp for vbmeta:
Timestamp for vendor_boot:
COW Size for boot: 0
COW Size for system: 0
COW Size for vendor: 0
COW Size for dtbo: 0
COW Size for vbmeta: 0
COW Size for vendor_boot: 0
Block size: 4096
Minor version: 7
It can be seen from here that there are 6 partitions operated in this payload.bin, namely boot, system, vendor, dtbo, vbmeta and vendor_boot. Each partition has its own install operations.
2. Use the stats option to view
$ payload_info.py --stats out/update/payload.bin
Payload version: 2
Manifest length: 53885
Number of partitions: 6
Number of "boot" ops: 67
Number of "system" ops: 790
Number of "vendor" ops: 42
Number of "dtbo" ops: 4
Number of "vbmeta" ops: 1
Number of "vendor_boot" ops: 23
Timestamp for boot:
Timestamp for system:
Timestamp for vendor:
Timestamp for dtbo:
Timestamp for vbmeta:
Timestamp for vendor_boot:
COW Size for boot: 0
COW Size for system: 0
COW Size for vendor: 0
COW Size for dtbo: 0
COW Size for vbmeta: 0
COW Size for vendor_boot: 0
Block size: 4096
Minor version: 7
Blocks read: 1059987
Blocks written: 354408
Seeks when writing: 100
The result of using the stats option is similar to that without the option, but there will be more parts related to the following IO operations:
Blocks read: 1059987
Blocks written: 354408
Seeks when writing: 100
3. Use the signagures option
As the name implies, the signatures option is used to view signature information:
$ payload_info.py --signatures out/update/payload.bin
Payload version: 2
Manifest length: 53885
Number of partitions: 6
Number of "boot" ops: 67
Number of "system" ops: 790
Number of "vendor" ops: 42
Number of "dtbo" ops: 4
Number of "vbmeta" ops: 1
Number of "vendor_boot" ops: 23
Timestamp for boot:
Timestamp for system:
Timestamp for vendor:
Timestamp for dtbo:
Timestamp for vbmeta:
Timestamp for vendor_boot:
COW Size for boot: 0
COW Size for system: 0
COW Size for vendor: 0
COW Size for dtbo: 0
COW Size for vbmeta: 0
COW Size for vendor_boot: 0
Block size: 4096
Minor version: 7
Metadata signatures blob: file_offset=53909 (267 bytes)
Metadata signatures: (1 entries)
version=None, hex_data: (256 bytes)
1a 53 e6 68 fb 26 26 bb c4 58 2f 1c fc a8 59 2d | .S.h.&&..X/...Y-
e9 e8 2a a5 f4 29 94 92 9d b8 0a 85 03 0f 90 35 | ..*..).........5
1f d7 a6 0f ba fc 9b ce f7 e4 d6 70 9b f8 b6 76 | ...........p...v
19 2c a8 6f bf f8 cc c9 48 51 4b 67 91 03 73 91 | .,.o....HQKg..s.
c4 cf 58 df 84 02 d6 d4 c4 6f 38 b7 70 ad ea 81 | ..X......o8.p...
e3 a5 36 1d f1 b7 49 2f b0 18 56 ba 5b 96 ee d5 | ..6...I/..V.[...
9f 30 1b 41 d7 36 9f b7 f3 d2 9d c5 57 c3 a8 93 | .0.A.6......W...
ca 3d ab 77 84 3b 4a 39 c5 05 c1 37 0a 99 6b 16 | .=.w.;J9...7..k.
db 5a 6e df a1 3a c1 6e 12 c4 47 76 88 19 28 6f | .Zn..:.n..Gv..(o
55 79 28 8f 86 ab 5e 5d 38 b6 14 a2 2d 80 93 e9 | Uy(...^]8...-...
07 11 50 f6 54 be a8 80 0c 14 40 36 15 37 85 e1 | ..P.T....[email protected]..
d8 74 4e ac 03 7b 43 66 3a c1 0b bc 07 7b 63 03 | .tN..{
Cf:....{
c.
bb e9 5d 2a 49 57 c5 3d 81 97 a2 83 87 01 0b 8c | ..]*IW.=........
bc 5c a2 b3 26 a1 8a 7d 42 25 14 7a 76 c6 01 54 | .\..&..}B%.zv..T
12 a5 0e f3 60 9e 3d 1c d8 fa c2 7c bc a8 f2 01 | ....`.=....|....
ee c0 3b 5a 3b ac a4 c6 89 09 c6 78 a0 9d 00 34 | ..;Z;......x...4
Payload signatures blob: blob_offset=9939442 (267 bytes)
Payload signatures: (1 entries)
version=None, hex_data: (256 bytes)
82 48 48 29 0d 04 9f 64 41 0e e2 bb da ad 14 eb | .HH)...dA.......
a2 43 fd 7b ff c5 bd 58 b7 c8 af 02 b7 48 eb 30 | .C.{
...X.....H.0
8a 56 c7 6f fb 31 2d 77 e1 37 bc c4 b5 c6 8b a9 | .V.o.1-w.7......
0e 79 73 8e 64 a9 10 63 8f c0 93 dd 2d da 0d 74 | .ys.d..c....-..t
d6 28 1c da d2 4d 8e 29 5b f7 08 9d 56 80 0b 7b | .(...M.)[...V..{
c8 ea 4e 8a 76 d9 ae 0d d3 1c 7d a7 8f d4 48 04 | ..N.v.....}...H.
f4 d0 e0 b7 37 d1 0a 1e 92 d0 14 bb 34 4a c5 e4 | ....7.......4J..
8b bf 8e 9d 1e a1 df 59 75 0a 77 10 0f bf 59 e5 | .......Yu.w...Y.
05 33 b6 48 65 03 ed 9f 73 62 34 34 ca 8f 2d 21 | .3.He...sb44..-!
cd d6 31 2f 22 93 69 9e fa 70 a1 9d 5b cf eb a3 | ..1/".i..p..[...
f9 b7 ca c1 67 45 52 c2 1a 64 ad 22 32 46 0a 56 | ....gER..d."2F.V
83 56 87 12 dc 71 55 08 0e 2b ec 92 ad 65 99 6e | .V...qU..+...e.n
bf d9 e0 ad dc 45 48 3a 08 91 b6 ed 44 c6 f6 dc | .....EH:....D...
c6 56 47 b7 d0 90 a6 63 c7 87 c8 51 2e 6c 79 16 | .VG....c...Q.ly.
c4 11 36 ff 93 da f3 00 2c bc 0c 7a cc d1 53 d4 | ..6.....,..z..S.
e6 d5 05 16 7b 23 ba 67 0c c5 40 6a ed 63 6c ff | ....{
#.g..@j.cl.
From the above output, you can see the metadata data in the payload.bin file and the signature content information of the entire payload file.
4. Use the list_ops option to view
Use list_opsthe option to view all the install operations and related extent information contained in payload.bin
$ payload_info.py --list_ops out/update/payload.bin
Payload version: 2
Manifest length: 53885
Number of partitions: 6
Number of "boot" ops: 67
Number of "system" ops: 790
Number of "vendor" ops: 42
Number of "dtbo" ops: 4
Number of "vbmeta" ops: 1
Number of "vendor_boot" ops: 23
Timestamp for boot:
Timestamp for system:
Timestamp for vendor:
Timestamp for dtbo:
Timestamp for vbmeta:
Timestamp for vendor_boot:
COW Size for boot: 0
COW Size for system: 0
COW Size for vendor: 0
COW Size for dtbo: 0
COW Size for vbmeta: 0
COW Size for vendor_boot: 0
Block size: 4096
Minor version: 7
boot install operations:
0: SOURCE_COPY
Source: 1 extent (512 blocks)
(0,512)
Destination: 1 extent (512 blocks)
(0,512)
...
65: ZERO
Destination: 1 extent (281 blocks)
(18150,281)
66: SOURCE_COPY
Source: 1 extent (1 block)
(18431,1)
Destination: 1 extent (1 block)
(18431,1)
system install operations:
0: BROTLI_BSDIFF
Data offset: 170
Data length: 1447872
Source: 16 extents (512 blocks)
(0,2) (3,1) (28,2) (32768,4) (65536,2) (65551,8) (85061,1) (98304,25)
(131072,23) (163840,25) (196608,23) (229376,25) (262144,23) (294912,15)
(302569,1) (303478,332)
Destination: 14 extents (512 blocks)
(0,2) (32768,2) (65551,8) (98304,2) (98308,21) (131074,21) (163840,2)
(163844,21) (196610,21) (229376,2) (229380,21) (262146,21) (294912,15)
(305874,353)
1: SOURCE_COPY
Source: 3 extents (23 blocks)
(2,1) (2,1) (4,21)
Destination: 1 extent (23 blocks)
(2,23)
2: BROTLI_BSDIFF
Data offset: 1448042
Data length: 81
Source: 1 extent (1 block)
(25,1)
Destination: 1 extent (1 block)
(25,1)
...
788: ZERO
Destination: 1 extent (75 blocks)
(308293,75)
789: REPLACE_BZ
Data offset: 9938147
Data length: 74
Destination: 1 extent (1 block)
(308368,1)
vendor install operations:
0: SOURCE_COPY
Source: 6 extents (512 blocks)
(0,15) (6,1) (16,33) (48,1) (48,1) (51,461)
Destination: 1 extent (512 blocks)
(0,512)
...
41: SOURCE_COPY
Source: 1 extent (1 block)
(19654,1)
Destination: 1 extent (1 block)
(19654,1)
dtbo install operations:
0: SOURCE_COPY
Source: 1 extent (1 block)
(0,1)
Destination: 1 extent (1 block)
(0,1)
1: BROTLI_BSDIFF
Data offset: 9938221
Data length: 182
Source: 2 extents (3 blocks)
(0,2) (255,1)
Destination: 1 extent (1 block)
(1,1)
2: ZERO
Destination: 1 extent (253 blocks)
(2,253)
3: SOURCE_COPY
Source: 1 extent (1 block)
(255,1)
Destination: 1 extent (1 block)
(255,1)
vbmeta install operations:
0: BROTLI_BSDIFF
Data offset: 9938403
Data length: 868
Source: 1 extent (1 block)
(0,1)
Destination: 1 extent (1 block)
(0,1)
vendor_boot install operations:
0: SOURCE_COPY
Source: 1 extent (512 blocks)
(0,512)
Destination: 1 extent (512 blocks)
(0,512)
...
21: ZERO
Destination: 1 extent (432 blocks)
(9807,432)
22: SOURCE_COPY
Source: 1 extent (1 block)
(10239,1)
Destination: 1 extent (1 block)
(10239,1)
The specific detailed operations and the corresponding extents are clear at a glance.
You can also perform further operations on the output of list_ops, such as performing classification statistics on various operations.
3. Other
So far, I have written about Android OTA upgrade related topics including:
- Basic introduction: "Android A/B System" series
- Core module: "Android Update Engine Analysis" series
- Dynamic Partitions: "Android Dynamic Partitions" series
- Virtual A/B: "Android Virtual A/B Partition" series
- Upgrade tools: "Android OTA related tools" series
For more information on these articles about Android OTA upgrades, please refer to "Introduction to Android OTA Upgrade Series Column Articles" .
If you have already subscribed to the dynamic partition and virtual partition paid column, please be sure to add me on WeChat, note the subscription account, and pull you into the "Dynamic Partition & Virtual Partition Column VIP Q&A Group". I will answer your questions about A/B systems, dynamic partitions, virtual partitions, various OTA upgrades and signatures at a convenient time.
In addition, I have an Android OTA upgrade discussion group, which now has 400+ friends, mainly discussing OTA upgrade topics for various devices such as mobile phones, car machines, TVs, set-top boxes, and tablets. If you are engaged in OTA upgrade work, welcome Join the group to communicate together, please indicate "Android OTA Discussion Group" when adding me on WeChat. This group is limited to Android OTA developers~
Reply "wx" in the backstage of the official account "Rocky Watching the World" to get personal WeChat.