Decrypting F Series Firmware Updates...

Here is information about customize your F series firmware.

robert
Posts: 8
Joined: Tue Oct 04, 2011 3:13 pm

Decrypting F Series Firmware Updates...

Post by robert »

Is there already a tool to decrypt the F series firmware update files?

If not, here is what I found out about the file format so far:

The "upgrade.msd" file format can be described with three structures:

Code: Select all

// define file section structure
typedef struct MSDSECTION
{
	unsigned long	Section;		// section number
	unsigned long	Offset;			// section file offset
	unsigned long	Length;			// section length
}	MSDSECTION,		*PMSDSECTION;

// define file header structure
typedef struct MSDHEADER
{
	unsigned char	Identifier[6];	// "MSDU10"
	unsigned long	Sections;		// number of sections
	MSDSECTION		Section[1];		// section structures
}	MSDHEADER,		*PMSDHEADER;

// define file header end structure
typedef struct MSDHEADEREND
{
	unsigned long	Zero;			// 0
	MSDSECTION		Salt;			// salt section
	unsigned char	Length;			// following name length
	unsigned char	Model[1];		// model name
}	MSDHEADEREND,	*PMSDHEADEREND;
The file begins with the MSDHEADER (starting with the identifier "MSDU10"), which contains a variable number of MSDSECTION and is followed by MSHEADEREND, which ends in the model name and is is followed by a 32-bit long of value 0, then by the "Salt" section, by all other sections and closes with a final 32-bit long of value 0.

E.g. for the F7/8 series firmware T-FXPDEUC-1106.0.exe's upgrade.msd, the parsed result is:

Code: Select all

Identifier MSDU10, 11 sections:
Section  1: Offset 0x0000063C-0x143FE6E3, 339730600 bytes
Section  2: Offset 0x143FE6E4-0x143FEAE3, 1024 bytes
Section  3: Offset 0x143FEAE4-0x1497DC8B, 5763496 bytes
Section  4: Offset 0x1497DC8C-0x1497E08B, 1024 bytes
Section  5: Offset 0x1497E08C-0x14D5B9B3, 4053288 bytes
Section  6: Offset 0x14D5B9B4-0x14D5BDB3, 1024 bytes
Section  7: Offset 0x14D5BDB4-0x14DB246B, 353976 bytes
Section  8: Offset 0x14DB246C-0x14DB286B, 1024 bytes
Section  9: Offset 0x14DB286C-0x14E32913, 524456 bytes
Section 10: Offset 0x14E32914-0x14E32D13, 1024 bytes
Section 11: Offset 0x14E32D14-0x2C2F8DBB, 390881448 bytes
Header end: Zero=0, Salt section:
Section  1: Offset 0x000000AC-0x0000063B, 1424 bytes
Model Name: T-FXPDEUC
The "Salt section" starts with the string "Salted__".

That's all I was able to figure out so far. No idea how to proceed from here...

BTW, this file format appears to the shared with the 2013 series Blu-Ray Players.
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: Decrypting F Series Firmware Updates...

Post by juusso »

Okey! thank you much for sharing info!

we have dumps of firmware, but no easy way to decrypt usb upgrade files.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
User avatar
nobody
Posts: 182
Joined: Sat Nov 12, 2011 1:45 am

Re: Decrypting F Series Firmware Updates...

Post by nobody »

grzechutrz
Posts: 10
Joined: Tue Jul 23, 2013 6:57 pm

Re: Decrypting F Series Firmware Updates...

Post by grzechutrz »

Hello
I have question. You send link for firmware t-fxpeuc-1106.0.exe but I think that model F need T-MST12DEUC... Could you explain?
BS
Gregory
User avatar
nobody
Posts: 182
Joined: Sat Nov 12, 2011 1:45 am

Re: Decrypting F Series Firmware Updates...

Post by nobody »

T-FXPDEUC-1106.0 is for XXF8000
User avatar
onsitbin
SamyGO Project Donor
Posts: 28
Joined: Fri May 24, 2013 8:17 pm

Decompilation firmware Samsung F Series

Post by onsitbin »

Target File: upgrade.msd decription Samsung F Series _2013 T-MST12DEUC 1102.1

Code: Select all

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
7645431   	0x74A8F7  	PC bitmap, Windows 3.x format, -1426686112 x -1780848518 x 35692
21011809  	0x1409D61 	PC bitmap, OS/2 1.x format, 26913 x 39359
48963602  	0x2EB2012 	Cisco IOS experimental microcode
175589034 	0xA7746AA 	MPFS (Microchip) filesystem, version 91.42, 17960 file entries
244118098 	0xE8CF252 	gzip compressed data, extra field, has comment, last modified: Wed Sep 27 06:55:40 2023
302140042 	0x12024A8A	IMG0 (VxWorks) header, size: 892865415
409411199 	0x18671E7F	ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 8711094, compressed size: 221038654, uncompressed checksum: 0x578B, compressed checksum: 0x26FC, flags: 0x2B, memory map table address: 0x71CE8319
512001487 	0x1E8485CF	ZBOOT firmware header, header size: 32 bytes, load address: 0x20023C6A, start address: 0x9E9C2044, checksum: 0xDD91E01D, version: 0x9E708698, image size: 67080880 bytes
549895813 	0x20C6BE85	gzip compressed data, ASCII, has CRC, last modified: Mon Jun  9 11:31:40 2031
565255349 	0x21B11CB5	XTF, Microsoft Xbox data
602408270 	0x23E8054E	Cisco IOS experimental microcode for ""
691493530 	0x29375A9A	gzip compressed data, has CRC, has comment, last modified: Mon May 29 10:01:41 2034


Scan Time:     2013-08-27 22:19:13
Signatures:    196
Target File:   upgrade.msd
MD5 Checksum:  359ca4ae2834e8de5253db14bdeeda86

Code: Select all

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
7645431   	0x74A8F7  	PC bitmap, Windows 3.x format, -1426686112 x -1780848518 x 35692
21011809  	0x1409D61 	PC bitmap, OS/2 1.x format, 26913 x 39359
48963602  	0x2EB2012 	Cisco IOS experimental microcode
175589034 	0xA7746AA 	MPFS (Microchip) filesystem, version 91.42, 17960 file entries
244118098 	0xE8CF252 	gzip compressed data, extra field, has comment, last modified: Wed Sep 27 06:55:40 2023
302140042 	0x12024A8A	IMG0 (VxWorks) header, size: 892865415
409411199 	0x18671E7F	ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 8711094, compressed size: 221038654, uncompressed checksum: 0x578B, compressed checksum: 0x26FC, flags: 0x2B, memory map table address: 0x71CE8319
512001487 	0x1E8485CF	ZBOOT firmware header, header size: 32 bytes, load address: 0x20023C6A, start address: 0x9E9C2044, checksum: 0xDD91E01D, version: 0x9E708698, image size: 67080880 bytes
549895813 	0x20C6BE85	gzip compressed data, ASCII, has CRC, last modified: Mon Jun  9 11:31:40 2031
565255349 	0x21B11CB5	XTF, Microsoft Xbox data
602408270 	0x23E8054E	Cisco IOS experimental microcode for ""
691493530 	0x29375A9A	gzip compressed data, has CRC, has comment, last modified: Mon May 29 10:01:41 2034
tanks
Onsitbin
The_Onsitbin
robert
Posts: 8
Joined: Tue Oct 04, 2011 3:13 pm

Re: Decompilation firmware Samsung F Series

Post by robert »

What tool did you use to decompile the upgrade.msd file?
Last edited by juusso on Tue Sep 03, 2013 6:40 am, edited 1 time in total.
Reason: topic merged
timoo
Posts: 119
Joined: Mon Aug 16, 2010 6:43 pm
Location: Czech Republic
Contact:

Re: Decompilation firmware Samsung F Series

Post by timoo »

robert wrote:What tool did you use to decompile the upgrade.msd file?
output of binwalk IMHO :)
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: Decrypting F Series Firmware Updates...

Post by juusso »

LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
MrKalach
SamyGO Project Donor
Posts: 33
Joined: Tue Aug 12, 2014 1:48 pm

Re: Decrypting F Series Firmware Updates...

Post by MrKalach »

Any news?
Samsung 55" LED-TV UE55F8005STXXE (SW: T-FXPDEUC-1118.0 == DATE: 2014-04-25 == MICOM: T-FOXDEUS2-1003 DTP-SDAL-FOXP-DEU023-1703)

SGS10+
developer
C/C++/Java

Post Reply

Return to “[F] Firmware”