Decrypting F Series Firmware Updates...
Posted: Fri Jul 26, 2013 11:07 pm
Is there already a tool to decrypt the F series firmware update files?
If not, here is what I found out about the file format so far:
The "upgrade.msd" file format can be described with three structures:
The file begins with the MSDHEADER (starting with the identifier "MSDU10"), which contains a variable number of MSDSECTION and is followed by MSHEADEREND, which ends in the model name and is is followed by a 32-bit long of value 0, then by the "Salt" section, by all other sections and closes with a final 32-bit long of value 0.
E.g. for the F7/8 series firmware T-FXPDEUC-1106.0.exe's upgrade.msd, the parsed result is:
The "Salt section" starts with the string "Salted__".
That's all I was able to figure out so far. No idea how to proceed from here...
BTW, this file format appears to the shared with the 2013 series Blu-Ray Players.
If not, here is what I found out about the file format so far:
The "upgrade.msd" file format can be described with three structures:
Code: Select all
// define file section structure
typedef struct MSDSECTION
{
unsigned long Section; // section number
unsigned long Offset; // section file offset
unsigned long Length; // section length
} MSDSECTION, *PMSDSECTION;
// define file header structure
typedef struct MSDHEADER
{
unsigned char Identifier[6]; // "MSDU10"
unsigned long Sections; // number of sections
MSDSECTION Section[1]; // section structures
} MSDHEADER, *PMSDHEADER;
// define file header end structure
typedef struct MSDHEADEREND
{
unsigned long Zero; // 0
MSDSECTION Salt; // salt section
unsigned char Length; // following name length
unsigned char Model[1]; // model name
} MSDHEADEREND, *PMSDHEADEREND;
E.g. for the F7/8 series firmware T-FXPDEUC-1106.0.exe's upgrade.msd, the parsed result is:
Code: Select all
Identifier MSDU10, 11 sections:
Section 1: Offset 0x0000063C-0x143FE6E3, 339730600 bytes
Section 2: Offset 0x143FE6E4-0x143FEAE3, 1024 bytes
Section 3: Offset 0x143FEAE4-0x1497DC8B, 5763496 bytes
Section 4: Offset 0x1497DC8C-0x1497E08B, 1024 bytes
Section 5: Offset 0x1497E08C-0x14D5B9B3, 4053288 bytes
Section 6: Offset 0x14D5B9B4-0x14D5BDB3, 1024 bytes
Section 7: Offset 0x14D5BDB4-0x14DB246B, 353976 bytes
Section 8: Offset 0x14DB246C-0x14DB286B, 1024 bytes
Section 9: Offset 0x14DB286C-0x14E32913, 524456 bytes
Section 10: Offset 0x14E32914-0x14E32D13, 1024 bytes
Section 11: Offset 0x14E32D14-0x2C2F8DBB, 390881448 bytes
Header end: Zero=0, Salt section:
Section 1: Offset 0x000000AC-0x0000063B, 1424 bytes
Model Name: T-FXPDEUC
That's all I was able to figure out so far. No idea how to proceed from here...
BTW, this file format appears to the shared with the 2013 series Blu-Ray Players.