exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120308

[maxprasak]

Power on IDA and feed the decrypted exeDSP for it. Reverse engineering is the only way to make something usefull (except geting root and use comon linux features like nfs and samba mou nts et cetera.)

Thanks Juzis28 !

No problem to try it, but where I can get exeDSP from T-ECPDEUC ?? Or can I use this from T-ECPAKUC ... what is the difference (I know EU/US, but internally)?

[juzis]

Basically no significant differences on other series (b/c/d) between regional firmwares.

[maxprasak]

I can confirm, that ES firmware ECP..UC need another key to decrypt then previous firmwares.

Does anybody know if exeDSP contain decrypt key or not?

[arris69]

I can confirm, that ES firmware ECP..UC need another key to decrypt then previous firmwares.

Does anybody know if exeDSP contain decrypt key or not?

logically

1. yes
   or
2. exeDSP knows how to generate the key

[maxprasak]

Does anybody know if exeDSP contain decrypt key or not?

logically

1. yes
   or
2. exeDSP knows how to generate the key

Ok, so I will look to the code ...

BTW: Ufuf ... autoanalyzing of exeDSP in IDA takes more then 2 days

[bdpuk]

Here's the binwalk output if it's of use to anyone....

Code: Select all

DECIMAL      HEX          DESCRIPTION
-------------------------------------------------------------------------------------------------------
0            0x0          ELF 32-bit LSB executable, ARM, version 1 (SYSV)
242497       0x3B341      LZMA compressed data, properties: 0x5D, dictionary size: 1746862080 bytes, uncompressed size: 696713216 bytes
248693       0x3CB75      LZMA compressed data, properties: 0x5D, dictionary size: 1247936512 bytes, uncompressed size: 208470016 bytes
261781       0x3FE95      LZMA compressed data, properties: 0x5D, dictionary size: 769261568 bytes, uncompressed size: 760807424 bytes
276061       0x4365D      LZMA compressed data, properties: 0x5D, dictionary size: 6553600 bytes, uncompressed size: 319029248 bytes
278041       0x43E19      LZMA compressed data, properties: 0x5D, dictionary size: 747765760 bytes, uncompressed size: 304676864 bytes
293309       0x479BD      LZMA compressed data, properties: 0x5D, dictionary size: 958136320 bytes, uncompressed size: 472645632 bytes
546725       0x857A5      LZMA compressed data, properties: 0x5D, dictionary size: 1360855040 bytes, uncompressed size: 675414016 bytes
69490344     0x42456A8    Linux Journalled Flash filesystem, little endian
74410628     0x46F6A84    ZynOS header, header size: 48 bytes, load address 0x1E723147, rom image type: ROMIMG, uncompressed size: 692523802, compressed size: 86061376, uncompressed checksum: 0x147, compressed checksum: 0x1310, flags: 0x1, memory map table address: 0xC004610
78531528     0x4AE4BC8    PNG image, 825641293 x 1701670770, 121-bit
78533992     0x4AE5568    PNG image, 1667591796 x 1932480626, 111-bit
80365185     0x4CA4681    Linux kernel
80460824     0x4CBBC18    MPFS (Microchip) filesystem, version 116.97, 29810 file entries
81529074     0x4DC08F2    Linux Journalled Flash filesystem, little endian
83540340     0x4FAB974    LZMA compressed data, properties: 0x5D, dictionary size: 184549376 bytes, uncompressed size: 167772160 bytes
83972524     0x50151AC    Windows CE RTOS
83972563     0x50151D3    Windows CE RTOS
83982241     0x50177A1    Windows CE RTOS
83986671     0x50188EF    Windows CE RTOS
83994701     0x501A84D    Windows CE RTOS
83999615     0x501BB7F    Windows CE RTOS
84004008     0x501CCA8    Windows CE RTOS
84004017     0x501CCB1    Windows CE RTOS
84004432     0x501CE50    Windows CE RTOS
84776926     0x50D97DE    Linux Journalled Flash filesystem, little endian
85562136     0x5199318    LZMA compressed data, properties: 0x50, dictionary size: 8388608 bytes, uncompressed size: 562496512 bytes
85774592     0x51CD100    TIFF image data, little-endian
91856139     0x5799D0B    Linux Journalled Flash filesystem, big endian
94200260     0x59D61C4    Zip archive data,  v0.0
95926580     0x5B7B934    LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 201326592 bytes
97249724     0x5CBE9BC    Zip archive data,  v0.0
97544695     0x5D069F7    Windows CE RTOS
99294379     0x5EB1CAB    LZMA compressed data, properties: 0x5D, dictionary size: 2130706432 bytes, uncompressed size: 125 bytes
102646104    0x61E4158    YAFFS filesystem
102727268    0x61F7E64    YAFFS filesystem
105272833    0x6465601    Linux Journalled Flash filesystem, little endian
105294445    0x646AA6D    Linux Journalled Flash filesystem, little endian
105313443    0x646F4A3    Linux Journalled Flash filesystem, little endian
105512797    0x649FF5D    Linux Journalled Flash filesystem, little endian
105651771    0x64C1E3B    Linux Journalled Flash filesystem, little endian
105689482    0x64CB18A    Linux Journalled Flash filesystem, big endian
105692339    0x64CBCB3    Linux Journalled Flash filesystem, little endian
105813830    0x64E9746    Linux Journalled Flash filesystem, little endian
105881398    0x64F9F36    Linux Journalled Flash filesystem, big endian
105920819    0x6503933    Linux Journalled Flash filesystem, big endian
106019283    0x651B9D3    Linux Journalled Flash filesystem, little endian
106025910    0x651D3B6    Linux Journalled Flash filesystem, little endian
106172825    0x6541199    Linux Journalled Flash filesystem, big endian
106522715    0x659685B    Linux Journalled Flash filesystem, little endian
106573673    0x65A2F69    Linux Journalled Flash filesystem, big endian
106575630    0x65A370E    Linux Journalled Flash filesystem, big endian
106637792    0x65B29E0    Linux Journalled Flash filesystem, big endian
106691062    0x65BF9F6    Linux Journalled Flash filesystem, big endian
106744267    0x65CC9CB    Linux Journalled Flash filesystem, little endian
106787395    0x65D7243    Linux Journalled Flash filesystem, little endian
106891238    0x65F07E6    Linux Journalled Flash filesystem, big endian
106915990    0x65F6896    Linux Journalled Flash filesystem, big endian
106983423    0x6606FFF    Linux Journalled Flash filesystem, little endian
106997305    0x660A639    Linux Journalled Flash filesystem, big endian
107005109    0x660C4B5    Linux Journalled Flash filesystem, little endian
107014497    0x660E961    Linux Journalled Flash filesystem, little endian
107040420    0x6614EA4    Linux Journalled Flash filesystem, little endian
107189496    0x66394F8    Linux Journalled Flash filesystem, big endian
107274262    0x664E016    Linux Journalled Flash filesystem, little endian
107310870    0x6656F16    Linux Journalled Flash filesystem, big endian
107361428    0x6663494    Linux Journalled Flash filesystem, big endian
107396870    0x666BF06    Linux Journalled Flash filesystem, big endian
107410102    0x666F2B6    Linux Journalled Flash filesystem, little endian
107591395    0x669B6E3    Linux Journalled Flash filesystem, little endian
107660816    0x66AC610    Linux Journalled Flash filesystem, little endian
107766971    0x66C64BB    Linux Journalled Flash filesystem, little endian
107862536    0x66DDA08    Linux Journalled Flash filesystem, little endian
107967692    0x66F74CC    Linux Journalled Flash filesystem, big endian
107994009    0x66FDB99    Linux Journalled Flash filesystem, little endian
108016873    0x67034E9    Linux Journalled Flash filesystem, little endian
108036932    0x6708344    Linux Journalled Flash filesystem, little endian
108096478    0x6716BDE    Linux Journalled Flash filesystem, little endian
108107225    0x67195D9    Linux Journalled Flash filesystem, little endian
108126922    0x671E2CA    Linux Journalled Flash filesystem, big endian
108281019    0x6743CBB    Linux Journalled Flash filesystem, little endian
108536941    0x678246D    Linux Journalled Flash filesystem, big endian
108565218    0x67892E2    Linux Journalled Flash filesystem, big endian
108664912    0x67A1850    Linux Journalled Flash filesystem, big endian
108726700    0x67B09AC    Linux Journalled Flash filesystem, big endian
109849599    0x68C2BFF    Windows CE RTOS
109849612    0x68C2C0C    Windows CE RTOS
109901695    0x68CF77F    Windows CE RTOS
111615429    0x6A71DC5    Windows CE RTOS
111704220    0x6A8789C    Windows CE RTOS
111833324    0x6AA70EC    Windows CE RTOS
111836357    0x6AA7CC5    Windows CE RTOS
111867754    0x6AAF76A    Windows CE RTOS
112097495    0x6AE78D7    Windows CE RTOS
112277184    0x6B136C0    Windows CE RTOS
112834319    0x6B9B70F    Windows CE RTOS
113073599    0x6BD5DBF    Windows CE RTOS
113175919    0x6BEED6F    Windows CE RTOS
113185693    0x6BF139D    Windows CE RTOS
113185706    0x6BF13AA    Windows CE RTOS
113420226    0x6C2A7C2    Windows CE RTOS
113513021    0x6C4123D    Windows CE RTOS
113766651    0x6C7F0FB    Windows CE RTOS
113952935    0x6CAC8A7    Windows CE RTOS
113952946    0x6CAC8B2    Windows CE RTOS
114249020    0x6CF4D3C    Windows CE RTOS
114566578    0x6D425B2    Windows CE RTOS
114680620    0x6D5E32C    Windows CE RTOS
114730643    0x6D6A693    Windows CE RTOS
114737533    0x6D6C17D    Windows CE RTOS
115079597    0x6DBF9AD    Windows CE RTOS
115189169    0x6DDA5B1    Windows CE RTOS
116143141    0x6EC3425    Windows CE RTOS
116256463    0x6EDEECF    Windows CE RTOS
116433355    0x6F0A1CB    Windows CE RTOS
116438648    0x6F0B678    Windows CE RTOS
116643847    0x6F3D807    Windows CE RTOS
117382534    0x6FF1D86    Windows CE RTOS
117484899    0x700AD63    Windows CE RTOS
117635524    0x702F9C4    Windows CE RTOS
117806086    0x7059406    Windows CE RTOS
117884454    0x706C626    Windows CE RTOS
117893176    0x706E838    Windows CE RTOS
118030344    0x7090008    Windows CE RTOS
118424814    0x70F04EE    Windows CE RTOS
118498779    0x71025DB    Windows CE RTOS
118656640    0x7128E80    Windows CE RTOS
118819488    0x7150AA0    Windows CE RTOS
119630344    0x7216A08    ELF 32-bit LSB executable, ARM, version 1 (SYSV)

[arris69]

thnx, but binwalk is maybe usabel for unknown binary data/disk images, in case of exeDSP it's clear that's: ELF 32-bit LSB executable, ARM, version 1

Here's the binwalk output if it's of use to anyone....


DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 ELF 32-bit LSB executable, ARM, version 1 (SYSV)
...
119630344 0x7216A08 ELF 32-bit LSB executable, ARM, version 1 (SYSV)

[pcsne]

broken link T_T
one more upload plz

[E3V3A]

I need some help on how I can do the same thing for my T-MST10PDEUC-1027.1 FW?
I'd like to extract exeDSP and fire it up in IDA... Thanks.

[juzis]

no problem.
1. install python - use 2.7.3 version, don`t use 3..>
2. install pycrypto for python2.7 - use 32bit version, because x64 may give problems.
3. Download latest SamyGO patcher script from svn
4. extract your firmware
5. decrypt it using command...

Code: Select all

d:\firmware>c:\python27\python.exe SamyGO.py decrypt_all ./T-MST10PDEUC


keeping in mind python is installed to c:/python27 and you call cmd from your working dir (ex. d:/firmware). The extracted firmware dir is next to SamyGO.py.

Code: Select all

d:\firmware>c:\python27\python.exe SamyGO.py decrypt_all ./T-MST10PDEUC
SamyGO Firmware Patcher v0.34 (c) 2010-2011 Erdem U. Altinyurt

                   -=BIG FAT WARNING!=-
            You can brick your TV with this tool!
Authors accept no responsibility about ANY DAMAGE on your devices!
         project home: http://www.SamyGO.tv

Firmware:  T-MST10PDEUC v1027.1

AES Encrytped CI+ firmware detected.
Processing file rootfs.img.sec
...

6. open exe.img with 7zip and extract exeDSP or any other file you want. Or mount to loop image file under linux...

And here is extracted exeDSP... (download)

Code: Select all

# md5sum ./exeDSP
c879de16b6f872bfcae96717f62dea6c  ./exeDSP