Taking Things Apart

Mkay.

So : I've just been given 2 of the firmware files ( Thank-you Brian ), 1 EU, and 1 US.

So far, I can decode about 1/3 of the header, and extract the file components.

 Let's examine a file :

00000000 0001 0000 0F56 A300 3C3C 8A00 0700 0166 .....V..<<.....f

00000010 0001 0000 0100 0000 5632 3230 0000 0000 ........V220....

00000020 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000030 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000040 0000 0000 0000 0000 0000 0000 3036 3646 ............066F

00000050 0000 0000 0CC7 0000 5632 3230 0000 0000 ........V220....

00000060 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000070 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000080 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000090 0000 0000 0000 0000 0007 0000 4C44 4D00 ............LDM.

000000A0 0000 0000 0000 0000 0009 F800 4150 464D ............APFM

000000B0 0000 0000 0004 FC00 0000 5000 4150 4D00 ..........P.APM.

000000C0 0000 0000 0005 2400 0085 E800 4155 4D00 ......$.....AUM.

000000D0 0000 0000 0048 1800 0029 D800 464F 4E54 .....H...)..FONT

000000E0 0000 0000 005D 0400 0013 5000 4F53 4D00 .....]....P.OSM.

000000F0 0000 0000 0066 AC00 0023 2800 5652 4D00 .....f...#(.VRM.

00000100 0000 0000 0078 4000 0014 A000 0000 0000 .....x..........

00000110 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000120 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000130 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000140 0000 0000 0000 0000 0000 0000 0000 0000 ................

00000150 0100 20A4 0000 0000 0000 0000 0000 0000 .. .............

Ok - so, the first thing that strikes is the directory_entry records - these follow a fairly obvious structure :

typedef struct data_dir_entry{

DWORD magic;

DWORD unknown; // I did say _fairly_ obvious :P
DWORD offset;

DWORD length;

};

And the directory record is of this struct :

typedef struct data_dir {
word Count;

word unknown;
data_dir_entry entries[];
};

 All this is assumption based on a 3 second first impression.

Now lets find out where I'm wrong.  :)

So - the Magic fields we have are :

"LDM"

"APFM"

"APM"

"AUM"

etc.

etc.

etc.

Lets  look at the first entry - "LDM"

Given that this is an update, its reasonable to assume that the first section is the Loader/Update engine.

Ok - _I_ think its reasonable to assume.