Page 1 of 1

Analysis of Firmware Update CD

Posted: 09 Dec 2019, 07:59
by Go4IT
When i look into the Firmware Update-CD i find only these files to be of interest:

"system.elf" (~4 MB)
This is the operating system boot image, loaded by the bootloader. It contains an RTOS and builds the base of the whole HMI-System and will be executed by the OMAP.

"plattapp.bin" (~7 MB)
This seems to contain the main application, controlling everything what the radio does.

"navfx001.bin" (~ 5 MB)
I guess this is the navigation application itself, which will be run on top of the OMAP RTOS.

"fgs.dnl" (~5 MB)
This file contains the firmware for the FGS and will end in the Flash memory located on the graphicsboard. It is only loaded once and forwarded to the graphicsboard.

"radio.dnl" (~ 0,6 MB)
Contains the firmware for the radio-processor (V850). Only loaded once (on update) and program the RU.

Acronyms:
- "FGS" is the graphicsboard and could be an acronym for "Front-Graphics-System" or something like that
- "HMI" is shortcut for "Human-Machine-Interface" and in our case this is the OMAP-System on the mainboard
- "RU" radio unit processor (V850 based)

*.dnl files
Those files are targettet to other parts of the system than the HMI. They are only handled/forwarded from there because the update-application would be run on HMI.

Re: Analysis of Firmware Update CD

Posted: 20 Apr 2020, 17:14
by Shuher
Do you know by chance can I flash system.elf directly to flash from sector 1 or it is being extra processed before that? Maybe I can get my device back to life without looking for a donor for flash image.

I did apply binwalk utility to system.elf from update CD image I have and raw flash image from another similar device (Opel touch & connect) I found in the internet and it looks having similar patterns so I guess it may be flashed as is. But i'm just guessing.

Re: Analysis of Firmware Update CD

Posted: 20 Apr 2020, 21:17
by tomy75
Shuher Did you find any picture? I am interested in the startup picture

Re: Analysis of Firmware Update CD

Posted: 21 Apr 2020, 06:01
by Shuher
Binwalk only found couple of ELFs, FATX header and several JFFS headers in a row (I believe these are false positives though) along with linux kernel :) Didn't check yet whether it's true but I assume boot logo image should be in fgs.dnl as it was described in other topic here which did not dissect yet as well.

Here is the ISO file, please feel free to dig in if you would like to:

Re: Analysis of Firmware Update CD

Posted: 21 Apr 2020, 17:20
by Go4IT
"Somehow" it should be possible to build a complete firmware-flash from the CDs contents. It's all there, but what we not know is where to place the contents exactly. This is done during update-process. As i found out the '.dnl'-files are not full binary images, the more look like a tcpdump, a list of packages with overhead.

Re: Analysis of Firmware Update CD

Posted: 29 Jan 2021, 13:10
by cipicas
Regarding "navfx001.bin" (~ 5 MB)
"I guess this is the navigation application itself, which will be run on top of the OMAP RTOS."

if I change navfx001.bin from mca structure and upload to nx, will the maps load drom dvd or will search for sd address?
new directory is \cryptnav\data\data\map\ maps for mca/mfd (sd)
old directory is \cryptnav\data\map\ maps for nx (dvd)
just asking...

cheers

Re: Analysis of Firmware Update CD

Posted: 29 Jan 2021, 14:18
by sanndo
cipicas wrote: 29 Jan 2021, 13:10 just asking...
No, direct copy maps form mca to nx/fx will not work

Re: Analysis of Firmware Update CD

Posted: 29 Jan 2021, 20:27
by cipicas
I know, probably because navfx on mca firmware is loading \data\data\ and nx \data\
Question was if loading navfx001.bin from a mca firmware will load proper path or will require to load data from SD and not cd.
For the moment I don't have a available unit to test this and fx is not suitable for this.

cheers