USB capture of AM8251 firmware update

[floe]

I did a bit of experimentation with my AM8251-based HDMI streaming adapter, and captured a firmware update over USB using libpcap on a Windows VM. It's rather large (~100 MB), so I thought I'd ask first if anybody would be interested in looking at the dump file? I think it should be possible to reverse-engineer the ADFU protocol from that, or at least get a decent start... /cc @ao2

[ao2]

@floe thanks for keeping me in the loop, however I don't have any of such devices so I don't think I am going to do any serious work on that. I might take a peek just to see if there is anything familiar, but no promises.

[floe]

Well, I was thinking that maybe the AM7xxx series uses the same protocol, so it might still be useful for you. I'm also pretty sure that the USB dump contains a sequence where parts of the firmware are read from the device (to check version numbers), so that may offer an easy way to dump firmware from more than one different Actions Micro device. In any case, for anyone interested, here's the link to the PCAP file: http://floe.butterbrot.org/external/usb.pcap

[c3c]

Hey Florian,
There's a backup.zip in this repository that contains am7x libraries. You
have probably already come across it also, but the firmware dump tools
provided by the s1mp3 project may be helpful.
On Mar 24, 2015 8:34 PM, "Florian Echtler" notifications@github.com wrote:

Well, I was thinking that maybe the AM7xxx series uses the same protocol,
so it might still be useful for you. I'm also pretty sure that the USB dump
contains a sequence where parts of the firmware are read from the device
(to check version numbers), so that may offer an easy way to dump firmware
from more than one different Actions Micro device. In any case, for anyone
interested, here's the link to the PCAP file:
http://floe.butterbrot.org/external/usb.pcap

—
Reply to this email directly or view it on GitHub
#1 (comment).

[floe]

Yes, IIRC I checked the s1mp3 tools, but the endpoints of the ADFU mode on AM8251 don't match those expected by the s1mp3 protocol.

[ao2]

Ah, just for the records, the am7xxx USB projector I've got does not even use USB mass storage, so I don't think It can use the same SCSI protocol I see in the dump, some other am7xxx devices might tho.

When reversing the protocol of my projector I also looked at the disassembled windows binaries to get hints about the data formats, maybe this can be useful in your case too.

BTW I wonder if it'd be easier to handle this protocol at the SCSI level with the "sg" driver http://sg.danny.cz/sg/ and letting the USB Mass storage layer take care of the USB details (USBC, USBS, etc.), rather than talking USB directly with the device using libusb. The sg driver should allow custom SCSI commands, but I never tried.

Ciao,
Antonio

[floe]

That looks promising, although I'm not sure if the protocol is just accidentally decoded as SCSI. At least, none of the standard Linux SCSI drivers (including sg) bind to it, and the interface class is 0xFF...

[ao2]

I've seen that there are some other devices perform firmware updates over a SCSI-like protocol, but they are actually SCSI devices so I don't know how similar this is; anyway here is where I saw it:
https://github.com/scanlime/coastermelt/blob/master/doc/update-ts01-notes.txt

[floe]

Interesting, good find... maybe @scanlime would like to have a look at the present PCAP dump sometime?

[siliconhippy]

Hi guys !

Please look at the Comments thread where I was directed from, by the very clever and helpful author, Hauke 😁😁

https://projects.webvoss.de/2019/03/23/le-potato-media-center-german-iptv-re-revisited/?unapproved=213&moderation-hash=9524af25c6720bad11da0b67ad02aa77#comment-213

So:

1. Any update ? Apparently from XDA post, ezcast.com updated the ROM in Aug 2015, after declining to engage with Checkpoint !

2. I am looking to use a regular cheap IR TV remote control to control the incoming DLNA stream to the ezcast, from a media server like TVheadend, Plex, VLC which don't have native LIRC or remote control support.

Do you think the ezcast already has LIRC to which such a IR RC could directly input keystroke codes, or LIRC could be installed?

Any help with this using SSH or other access method I would greatly appreciate ! After all hacking is what advances the state of art 🐵🐵🐵

[gipi]

I looked at the update application and I can tell you that pretty much similar to what is described here with some commands added; I can tell you that the dump follows the USB mass storage bulk only transfer (a little explanation here).

There is also a project that is doing the same with a board with a similar processor here.

[siliconhippy]

Appreciate that. 😀Heard of Linaro.

[dreamlayers]

Firmware update files that are delivered via the EZUpdate.exe Windows application are easy to capture. First, install the associated drivers. Then edit EZUpdate.exe, replacing https://www.iezvu.com/upgrade/ota_rx.php with an http URL where you can have netcat listen. (You do not need a web server there.) Make sure to terminate the string with a null or match the string length, and not alter the length of the file. You will end up with something like this:

Content-Type: application/json; charset=utf-8
Content-Length: 215

{
        "version":      1,
        "vendor":       "sage_8268C_anycast-dongle_aimibo",
        "mac_address":  "authorshxj",
        "softap_ssid":  "000000-00000000",
        "firmware_version":     "20321144"
}

Then send it via cURL

curl -X POST -H "Content-type: application/json; charset=utf-8" -i https://www.iezvu.com/upgrade/ota_rx.php -d'{
        "version":      1,
        "vendor":       "sage_8268C_anycast-dongle_aimibo",
        "mac_address":  "authorshxj",
        "softap_ssid":  "000000-00000000",
        "firmware_version":     "20321144"
}'

...and take a look at the JSON response:

{"ota_conf_file":"http://cdn.iezcast.com/upgrade/sage_8268C_anycast-dongle_aimibo/official/20321145.conf","ota_fw_file":"http://cdn.iezcast.com/upgrade/sage_8268C_anycast-dongle_aimibo/official/20321145-0x75F8A7A5.gz","ota_enforce":false,"safety_ota_conf_file":"https://cdn.iezcast.com/upgrade/sage_8268C_anycast-dongle_aimibo/official/20321145.conf","safety_ota_fw_file":"https://cdn.iezcast.com/upgrade/sage_8268C_anycast-dongle_aimibo/official/20321145-0x75F8A7A5.gz"}

Note that there are 4 URLs, but they're duplicates, two http and two https. Also note that if you wanted the official upgrade program to install an altered firmware file, you could try redirecting it to your own web server. Though I'm not certain that it doesn't perform some signature checking, but I have no reason to suspect that it does check.

There is a tool that uses the update protocol at https://github.com/gipi/teardown/blob/master/MiraScreen/flash.py and a tool for extracting parts of the firmware at https://github.com/gipi/teardown/blob/master/MiraScreen/actions-firmware-extract.c, but they don't work perfectly. Note that the code in ROM is probably very limited, and that part of the process involves uploading code to make the RAM and flash usable. Those are pieces of the .gz firmware file. BTW. That file is not a simple gzip, but something much more complicated, with various parts, gzip compressed chunks, and possibly non-standard squashfs compressed via LZMA or xz.