decoding the updater file format
00000000: "ETEN"
00000004: 0000017f
1 : OS
2 : BL Bootloader
4 : UD USBDownloader
8 : KN Knight
10 : EB IPL
20 : Logo
40
80
100 : gsm
00000008: l=03962000 x1.dat osimage, every 512 bytes, 8 byte extra
-> x520.pl removes this, resulting in x1a.dat
00000000 bootsplash
00007e00 ? data + serial nrs ?
00008000 DCD 0x25 : 37 files, see xx1.pl
00008004: 00000386 ADATA.OVT
00008492: 000001c8 BLU.BT
00008762: 00003e50 CabExtracter.exe
0000c6ba: 00001650 CheckState.exe
0000de12: 00000437 default.htm
0000e351: 00003250 GainFileDetector.exe
000116a9: 00000548 oem.gif
00011cf9: 000005e2 oem.htm
000123e3: 0000f9e7 oem.tsk
00021ed2: 00002a62 oem.xml
00024a3c: 00002a30 oem.xml.bak
00027574: 00000a72 oem_logo.gif
000280ee: 0003ca38 PREI_AddRingtone.AllLan.CAB
00064c2e: 00013b4c PREI_AUDIO_PATCH.CAB
00078882: 00016852 PREI_BatteryMeter.CAB
0008f1dc: 0000ac04 PREI_BatteryPatch.CAB
00099ee8: 000b9fe4 PREI_BirthdayReminder.CAB
00153fd4: 0006cb6b PREI_BkupRsto.3.2.AllLan.CAB
001c0c47: 001b3681 PREI_CVC.CAB
003743d0: 001f0df2 PREI_EtMergeEx_ENG.CAB
005652ca: 002152ff PREI_EtPhone_ENG_Orange.CAB
0077a6d1: 0004e986 PREI_GPRSWIZARD.ENG.CAB
007c915f: 0002774f PREI_GPS_Viewer.CAB
007f09b6: 00058982 PREI_ImageWizard.mui.CAB
00849440: 0004c7cc PREI_Imk_Eng.cab
00895d14: 00026143 PREI_LocationSMS.CAB
008bbf5f: 0005bbb7 PREI_MDesk.CAB
00917c1e: 00078fa2 PREI_MultimediaManager.AllLan.CAB
00990cc8: 0003db6d PREI_SatelliteDataUpdate.1.0.AllLan.CAB
009ce93d: 000c9e04 PREI_ScreenKB_ENG.PPC2003_ARM.CAB
00a98849: 000320e5 PREI_SIMManager.mui.CAB
00acaa36: 00040a7f PREI_SkinChanger_ENG.CAB
00b0b5bd: 0003c9fa PREI_Skype_Setting_ENG.CAB
00b480bf: 0004e6e5 PREI_SpeedDial.CAB
00b968ac: 00050438 PREI_ZtQuickLink.2.0.AllLan.CAB
00be6dec: 000005c0 wwe.bat
00be74b4: 000005c5 wwe.bat.bak
00be7b81 empty, filled with 0xff
01400000 partition table
01400200 msflsh50 header
+08 : reserved block flag
+1c : nr of reserved blocks : 0xA0
01400400 1st compressed xip image
01520000 2nd compressed xip image
016c0000 IMGFS
033d4510 empty, filled with 0xff
03740000 empty fat32 image
0000000c: BL_size l=00004000 x2.dat BOOTER_X500_02_LB_01_03
00000010: UD_size l=00013800 x3.dat USBDL_X500_03_LB_01_18
00000014: KN_size l=0002d800 x4.dat KNIGHT_M700_05_LB_02_19
00000018: EB_size l=00020000 x5.dat IPL_X500_01_LB_01_04 ( xip format )
0000001c: 00007e00 ... not used
00000020: GSM1_size l=0001aec5 x6.dat
00000024: GSM2_size l=005c358d x7.dat quanta dsp code
00000028: 00000000
0000002c: 00000000
00000030: 00000000
00000034: 00000000
00000038: 000072d9 == 0F4723D0Ah : internal flag
0000003c: 000072d9
00000040: 00002a75
00000044: 00001910
00000048: 00003f01
0000004c: ffffffff
00000050: ffffffff
00000054: ffffffff
00000058: ffffffff
0000005c: 00000001 flashtype
1 : LargeBlock : 0x20000, 0x40, 0x800
0 : Small Block : 0x4000, 0x20, 0x200
00000060: ffffffff version
00000064: 00000000
00000068: 00000000
0000006c: 00000000
00000070: 00000000
the '8' bytes removed by x520.pl
01450200: 00000000 fffbfffd
016cc8a8: 00001395 fffbfffd 0x16CC8A8 = 0x1450200+0x208*0x01395
0171b200: 00001400 fffbffff 0x171B200 = 0x1491200+0x208*0x01400 = 0x1450200+0x208*(0x01400+0x200)
034a3b10: 0000fca2 fffbffff 0x34A3B10 = 0x1491200+0x208*0x0FCA2 = 0x1450200+0x208*(0x0FCA2+0x200)
0381d200: 00011600 fffbffff 0x381D200 = 0x14D2200+0x208*0x11600 = 0x1450200+0x208*(0x11600+0x400)
039452e0: 00011f1c fffbffff 0x39452E0 = 0x14D2200+0x208*0x11F1C = 0x1450200+0x208*(0x11F1C+0x400)
these offsets are the boundaries of the partitions:
0x200*(0x1450200-0x200)/0x208 = 0x1400000 partitiontable
0x200*(0x16CC8A8-0x200)/0x208 = 0x1672A00
0x200*(0x171B200-0x200)/0x208 = 0x16C0000 start of imgfs
0x200*(0x34A3B10-0x200)/0x208 = 0x33D4400
0x200*(0x381D200-0x200)/0x208 = 0x3740000 start of fat32 image
0x200*(0x39452E0-0x200)/0x208 = 0x3863800
I wrote several scripts to decode and reencode this format:
- x520.pl: splits a osimage520.dat in a osimage512.dat and osimage520.dat.8bytes
the osimage512.dat can be further analyzed using rdmsflsh.pl
- x512.pl: merges a osimage512.dat with a osimage520.dat.8bytes to reconstruct the osimage520.dat file.
- xx1.pl: extracts CAB files from the cab section of osimage512.dat
- xtemp.pl: splits a temp.dat file in several sections.
NOTE: this script is not finished yet