search

TBT8A10 / adups-fota

Research of the tablet's OTA update system (ADUPS FOTA)
5 stars 2 forks source link

Possible Algorithm Update in APK - Inconsistent shakey / key generation #2

Closed suddenBook closed 2 months ago

suddenBook commented 2 months ago

Description

I noticed that the algorithm used in the APK of my GREE device for simulating OTA data packet requests seems to have been updated. When using the same parameters, each POST request now results in different shakey and key values. I suspect that a random offset might have been introduced into the encoding process.

Example

Here's an example of a successful POST request to https://fota5t.adups.com/otainter-5.0/fota5/detectSchedule.do.

[REDACTED]

With parameters used as below:

RO_FOTA_OEM = 'GREE8996_7.1'
RO_FOTA_DEVICE = 'G0335D'
RO_PRODUCT_LOCALE = 'en-US'
RO_OPERATOR_OPTR = ''
RO_FOTA_VERSION = 'HALO 2.1.6 J1'

Request for Investigation

As I'm not proficient in Java, I would greatly appreciate if you could investigate this change in the algorithm. I will attach the latest version of the APK for your reference.

com.adups.fota_5.22.zip

Thank you for your time and assistance in looking into this matter.

TBM13 commented 2 months ago

I've deleted the POST data since it contains sensitive info like the IMEI and MAC address.

As for the random offset, that's not new. My script generates the same request each time since it uses a static offset and not a random one. If you had issues it's likely because RO_PRODUCT_LOCALE should be zh according to the POST data you sent.