Page 1 of 3
Decrypting F Series Firmware Updates...
Posted: Fri Jul 26, 2013 11:07 pm
by robert
Is there already a tool to decrypt the F series firmware update files?
If not, here is what I found out about the file format so far:
The "upgrade.msd" file format can be described with three structures:
Code: Select all
// define file section structure
typedef struct MSDSECTION
{
unsigned long Section; // section number
unsigned long Offset; // section file offset
unsigned long Length; // section length
} MSDSECTION, *PMSDSECTION;
// define file header structure
typedef struct MSDHEADER
{
unsigned char Identifier[6]; // "MSDU10"
unsigned long Sections; // number of sections
MSDSECTION Section[1]; // section structures
} MSDHEADER, *PMSDHEADER;
// define file header end structure
typedef struct MSDHEADEREND
{
unsigned long Zero; // 0
MSDSECTION Salt; // salt section
unsigned char Length; // following name length
unsigned char Model[1]; // model name
} MSDHEADEREND, *PMSDHEADEREND;
The file begins with the MSDHEADER (starting with the identifier "MSDU10"), which contains a variable number of MSDSECTION and is followed by MSHEADEREND, which ends in the model name and is is followed by a 32-bit long of value 0, then by the "Salt" section, by all other sections and closes with a final 32-bit long of value 0.
E.g. for the F7/8 series firmware T-FXPDEUC-1106.0.exe's upgrade.msd, the parsed result is:
Code: Select all
Identifier MSDU10, 11 sections:
Section 1: Offset 0x0000063C-0x143FE6E3, 339730600 bytes
Section 2: Offset 0x143FE6E4-0x143FEAE3, 1024 bytes
Section 3: Offset 0x143FEAE4-0x1497DC8B, 5763496 bytes
Section 4: Offset 0x1497DC8C-0x1497E08B, 1024 bytes
Section 5: Offset 0x1497E08C-0x14D5B9B3, 4053288 bytes
Section 6: Offset 0x14D5B9B4-0x14D5BDB3, 1024 bytes
Section 7: Offset 0x14D5BDB4-0x14DB246B, 353976 bytes
Section 8: Offset 0x14DB246C-0x14DB286B, 1024 bytes
Section 9: Offset 0x14DB286C-0x14E32913, 524456 bytes
Section 10: Offset 0x14E32914-0x14E32D13, 1024 bytes
Section 11: Offset 0x14E32D14-0x2C2F8DBB, 390881448 bytes
Header end: Zero=0, Salt section:
Section 1: Offset 0x000000AC-0x0000063B, 1424 bytes
Model Name: T-FXPDEUC
The "Salt section" starts with the string "Salted__".
That's all I was able to figure out so far. No idea how to proceed from here...
BTW, this file format appears to the shared with the 2013 series Blu-Ray Players.
Re: Decrypting F Series Firmware Updates...
Posted: Sat Jul 27, 2013 8:11 pm
by juusso
Okey! thank you much for sharing info!
we have dumps of firmware, but no easy way to decrypt usb upgrade files.
Re: Decrypting F Series Firmware Updates...
Posted: Mon Jul 29, 2013 12:49 am
by nobody
Re: Decrypting F Series Firmware Updates...
Posted: Tue Aug 13, 2013 9:02 pm
by grzechutrz
Hello
I have question. You send link for firmware t-fxpeuc-1106.0.exe but I think that model F need T-MST12DEUC... Could you explain?
BS
Gregory
Re: Decrypting F Series Firmware Updates...
Posted: Sun Aug 18, 2013 2:03 pm
by nobody
T-FXPDEUC-1106.0 is for XXF8000
Decompilation firmware Samsung F Series
Posted: Tue Aug 27, 2013 10:49 pm
by onsitbin
Target File: upgrade.msd decription Samsung F Series _2013 T-MST12DEUC 1102.1
Code: Select all
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
7645431 0x74A8F7 PC bitmap, Windows 3.x format, -1426686112 x -1780848518 x 35692
21011809 0x1409D61 PC bitmap, OS/2 1.x format, 26913 x 39359
48963602 0x2EB2012 Cisco IOS experimental microcode
175589034 0xA7746AA MPFS (Microchip) filesystem, version 91.42, 17960 file entries
244118098 0xE8CF252 gzip compressed data, extra field, has comment, last modified: Wed Sep 27 06:55:40 2023
302140042 0x12024A8A IMG0 (VxWorks) header, size: 892865415
409411199 0x18671E7F ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 8711094, compressed size: 221038654, uncompressed checksum: 0x578B, compressed checksum: 0x26FC, flags: 0x2B, memory map table address: 0x71CE8319
512001487 0x1E8485CF ZBOOT firmware header, header size: 32 bytes, load address: 0x20023C6A, start address: 0x9E9C2044, checksum: 0xDD91E01D, version: 0x9E708698, image size: 67080880 bytes
549895813 0x20C6BE85 gzip compressed data, ASCII, has CRC, last modified: Mon Jun 9 11:31:40 2031
565255349 0x21B11CB5 XTF, Microsoft Xbox data
602408270 0x23E8054E Cisco IOS experimental microcode for ""
691493530 0x29375A9A gzip compressed data, has CRC, has comment, last modified: Mon May 29 10:01:41 2034
Scan Time: 2013-08-27 22:19:13
Signatures: 196
Target File: upgrade.msd
MD5 Checksum: 359ca4ae2834e8de5253db14bdeeda86
Code: Select all
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
7645431 0x74A8F7 PC bitmap, Windows 3.x format, -1426686112 x -1780848518 x 35692
21011809 0x1409D61 PC bitmap, OS/2 1.x format, 26913 x 39359
48963602 0x2EB2012 Cisco IOS experimental microcode
175589034 0xA7746AA MPFS (Microchip) filesystem, version 91.42, 17960 file entries
244118098 0xE8CF252 gzip compressed data, extra field, has comment, last modified: Wed Sep 27 06:55:40 2023
302140042 0x12024A8A IMG0 (VxWorks) header, size: 892865415
409411199 0x18671E7F ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 8711094, compressed size: 221038654, uncompressed checksum: 0x578B, compressed checksum: 0x26FC, flags: 0x2B, memory map table address: 0x71CE8319
512001487 0x1E8485CF ZBOOT firmware header, header size: 32 bytes, load address: 0x20023C6A, start address: 0x9E9C2044, checksum: 0xDD91E01D, version: 0x9E708698, image size: 67080880 bytes
549895813 0x20C6BE85 gzip compressed data, ASCII, has CRC, last modified: Mon Jun 9 11:31:40 2031
565255349 0x21B11CB5 XTF, Microsoft Xbox data
602408270 0x23E8054E Cisco IOS experimental microcode for ""
691493530 0x29375A9A gzip compressed data, has CRC, has comment, last modified: Mon May 29 10:01:41 2034
tanks
Onsitbin
Re: Decompilation firmware Samsung F Series
Posted: Mon Sep 02, 2013 11:57 pm
by robert
What tool did you use to decompile the upgrade.msd file?
Re: Decompilation firmware Samsung F Series
Posted: Tue Oct 01, 2013 4:23 pm
by timoo
robert wrote:What tool did you use to decompile the upgrade.msd file?
output of binwalk IMHO
Re: Decrypting F Series Firmware Updates...
Posted: Wed Dec 11, 2013 6:24 pm
by juusso
Re: Decrypting F Series Firmware Updates...
Posted: Tue Aug 12, 2014 2:00 pm
by MrKalach
Any news?