Capturing and inspecting OTA firmware updates

[ars18]

Capturing and inspecting OTA firmware updates

Dunno if this will help anyone, but today I captured an ota link to inspect firmware. Need usb debugging, but no root necessary. Linux: adb logcat | grep -i 'http' Windows: adb logcat | findstr /i http Go to system updates and search for update, press ctrl+c on the terminal when it starts downloading. Take your output and dump it into an ai agent, ask it to find the update link. Or, ya know, you could sift through it yourself. Should be able to download the firmware from that link. I was…

[Dev-in-the-BM_2.0]

@Capturing and inspecting OTA firmware updates

adb logcat | grep -i ‘http’ Windows: adb logcat | findstr /i http

I think I did, but will try again.

[Dev-in-the-BM_2.0]

@Capturing and inspecting OTA firmware updates

adb logcat | grep -i ‘http’

Nope, nothing comes up.

[ars18]

Tried pcapdroid?

Next best thing would be router level…

[Dev-in-the-BM_2.0]

@ars18

Tried pcapdroid?

Similar.
Used HTTP Toolkit.
Also uses a VPN to capture the phones traffic.

@ChatGPT

Yes, there are VPN-based MITM tools:

Easiest to Use (5 min setup)

PCAPdroid (recommended to start)

• Install from F-Droid or GitHub.
• Hit “Start Capture.”
• It’ll spin up its own VPN on the phone → no rooting, no PC setup.
• You instantly see all traffic endpoints (domains, IPs, ports).
• Can export .pcap and open in Wireshark later.
• Downsides: You’ll see the domains and request metadata, but HTTPS payloads are still encrypted unless you install its CA cert (and some apps won’t accept it).

---

More Powerful (but more work)

mitmproxy via VPN gateway to your PC

• Set up a VPN server on your laptop (e.g., WireGuard or OpenVPN).
• Phone connects to that VPN instead of Wi-Fi.
• All traffic tunnels through your laptop.
• mitmproxy intercepts it transparently.
• Pro: full decryption (if cert accepted), and you can script/analyze in mitmproxy.
• Con: setup time (probably an hour the first time you do it).

---

Middle Ground

HTTP Toolkit (httptoolkit.tech)

• Has a polished GUI and a companion Android app.
• Uses the same VPN trick, but without you needing to configure anything.
• Much easier than DIY mitmproxy VPN.
• Less customizable than raw mitmproxy.

---

If your immediate goal is just:

• “Which URL does my updater contact, and what request does it send?”
  PCAPdroid is by far the quickest win.

If you later want to actually modify or replay requests, then it’s worth leveling up to the VPN→mitmproxy path.

---

Want me to give you step-by-step to try PCAPdroid first, so you can start capturing in the next 10 minutes?

[Dev-in-the-BM_2.0]

@ars18

Next best thing would be router level…

How do I do that?

[Dev-in-the-BM_2.0]

@Dev-in-the-BM_2.0

Sonim’s updates are way more complicated than Kyoceras.

I did manage to get the domains:

• http://ota-filesite.oss-cn-hangzhou.aliyuncs.com
• https://ota-us.fihcloud.com
  
  

https://chatgpt.com/share/68a7908e-3fd4-8013-9a2e-42a3d263af54

[ars18]

Depends on the router. Would need to be able to view query logs.

Or you can set a custom DNS server and view them there.

[Dev-in-the-BM_2.0]

@ars18

Or you can set a custom DNS server and view them there.

But thats for domains.
I have that already.
I need URL’s, and what are the requests that the updater has to make.

[ars18]

If these are the servers:

@Dev-in-the-BM_2.0

I did manage to get the domains:

• http://ota-filesite.oss-cn-hangzhou.aliyuncs.com
• https://ota-us.fihcloud.com

Then the OTA zips would just be a path added to that url.

[Dev-in-the-BM_2.0]

Not according to ChatGPT, which analyzed the APK.

[Dev-in-the-BM_2.0]

It also analyzed the servers responses to a bunch of URL’s I tried.

[ars18]

Two things.

I skimmed through your ai convo, and just so you know, the Firehose will almost certainly not be in the update packages.

Aside from that, it doesn’t make sense to me that those are the update servers, but the otas are not on a path a of that url.

Also, how did you extract the APK without root?

[Dev-in-the-BM_2.0]

@ars18

Also, how did you extract the APK without root?

Whats the big deal?

How many apps do you want that can do that?

[ars18]

I dunno, I guess I’m just so used to having root.

Upload the APK?

[Dev-in-the-BM_2.0]

System update 11.0010.15.apk (610.8 KB)

[ars18]

Put on drive? Download doesn’t work

[Dev-in-the-BM_2.0]

System update 11.0010.15.apk

[ars18]

You are correct.

    <string name="config_fih_verify_referer">http://ota-filesite.oss-cn-hangzhou.aliyuncs.com</string>
    <string name="config_ota_server_url">https://ota-us.fihcloud.com/</string>

Second one is the OTA server

Weird one

[Dev-in-the-BM_2.0]

@ars18

You are correct.

Duh.