Skip to content

Latest commit

 

History

History
15 lines (8 loc) · 1.15 KB

README.md

File metadata and controls

15 lines (8 loc) · 1.15 KB
Raw

qdtar

A qdtar archive is a slightly modified tar archive, used to pack the root filesystem in the Qisda ES600 e-reader upgrades. The file name used for these archives is rootfs.img, even if it has nothing to do with a disk image.

This kind of file is formed by a header of 978 bytes, whose contents are completely ignored, prepended to a normal tar archive.

The executable found on the firmware zero-fills the header when creating a new archive. However, the archives found in official firmware upgrade packages used a different approach:

  • The first 970 bytes of the header were filled with a copy of the first 970 bytes of the tar file.
  • The next 8 bytes were used to store the magic number (QDTAR1.0).

I suspect that filling of the header with a copy of the first bytes of the tar file was only a mistake made by the developer of the packer application. Probably the original code shifts the data on a buffer by copying it to the new offset without taking care of zeroing the contents of the header. There is, however, anoher credible explanation: copying the first bytes of the tar archive will fool a normal decompression utility.