如何检查 android 图像（boot.img、system.img 等）是否已签名？

Question

I received an android image build from a source, how do I check for it's signature? I know we could check signature for an android app but facing some trouble with OS It's AOSP 10

Tried "BootSignature.jar" but throws error java -jar BootSignature.jar -verify boot.img

Answer 1

1. The android image is not sigend like an app. But it's protected by verified boot. See the offical document: https://source.android.google.cn/security/verifiedboot .

2. And the app in system.img or vendor.img are sigend by a set of keys. The standard Android build uses five keys(testkey, platform, shared, media,.networkstack), all of which reside in build/target/product/security . For example, /system/framework/framework-res.apk is sigend with platform keys. You can check the signature like you do to an app.

When you build the image from source, and use the android default testkeys set, the build's fingerprint will end with "test-keys", and if you use your private keys set, the fingerprint will end with "dev-keys".

And you can also sign an build, it will resigned the apps with new keys set, and update the verifiedboot's sum. And the fingerprint will ended with "release-keys".

3. And the OTA package(zip file) are signed like an app. Before updating, recovery will verify the zip's signature with the recovery/res/keys.