anthok / autel

autel extractor

by _anthok

Unpack firmware update packages for the Autel EVO.

An example of an unpacked firmware [EVO_FW_V1.4.9] can be found in the extracted_sample folder at the root of this repository.

Usage

python autel_extractor.py -f <firmware> -o <output_dir>

**Note:** The firmware package is nested, but the tool does not currently unpack the nested levels for you. You will need to rerun the tool and change the `-f` flag to point to your newly unpacked image.

You can tell if a file can be further unpacked by looking for <filetransfer> at the start of the file.

How it works

Below is the format for the EVO firmware update package.

An update package is segmented by using an XML like structure, but there is no ending tag. The " characters are not a typo, those are part of the structure. The highest level tag is a filetransfer and signifies the begging of a file entry. Next, a fileinfo will follow, this will include an 8 byte header, 0-4 are the field_size, 4-8 are currently unknown, 8-field_size will be the filename. The last component of the transfer is filecontent. Once again this will include an 8 byte header, 0-4 are the field_size, 4-8 are currently unknown. The remaining bytes, 8-field_size are the actual content of the file being transfered.

"<filetransfer>"

"<fileinfo>"
field_size: bytes 0-4, big endian
unknown: bytes 4-8, ??, crc/timestamp maybe
data: bytes 8-X, data

"<filecontent>"
field_size: bytes 0-4, big endian
unknown: bytes 4-8, ??, crc/timestamp maybe
data: bytes 8-X, data

autel's Issues

Unpacking component firmware

autel_extractor.py -f Model-C_FW_V2.6.22.bin
autel_extractor.py -f rc_player_Model-C_FW_V2.6.22.bin -o rc_player/
cd rc_player
tar xvf Model-C_RC_PLAYER_V3.0.13.0_20210118.upg
binwalk --signature fwimage.upg
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
80            0x50            ELF, 32-bit LSB MIPS64 shared object, MIPS, version 1 (SYSV)
59841         0xE9C1          Unix path: /opt/mipsel-linux-gnu-4.9.3/usr/mipsel-linux-gnu/sysroot/usr/include
104448        0x19800         gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
4259968       0x410080        CRC32 polynomial table, little endian
4264064       0x411080        CRC32 polynomial table, big endian
4488060       0x447B7C        CRC32 polynomial table, little endian
4669558       0x474076        Unix path: /usr/local/resource/key_tones/keytone1.wav
4669717       0x474115        Unix path: /usr/local/resource/key_tones/keytone1.wav
4670028       0x47424C        Unix path: /usr/local/resource/key_tones/keytone1.wav
4670718       0x4744FE        Unix path: /usr/local/resource/CALIBRIB.ttf
4675155       0x475653        Unix path: /sys/devices/platform/leds-gpio/leds/led_1
4675228       0x47569C        Unix path: /sys/devices/platform/leds-gpio/leds/led_2
4705280       0x47CC00        gzip compressed data, maximum compression, from Unix, last modified: 2021-01-18 05:59:15
6587904       0x648600        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
6592512       0x649800        Linux EXT filesystem, blocks count: 54474, image size: 55781376, rev 0.0, ext4 filesystem data, UUID=ba86ede3-50e6-4e8b-b5db-fd6a75b075b0

binwalk --extract fwimage.upg

I would guess its the EVO controller firmware.

Unpacking gt_Model firmware

Binwalk is unable to automagically unpack this one - yet it seems to provide signature analysis.

binwalk --signature Model-C_gt900_b18p20_V1.1.1.45_ModelC_20210209182538.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
26424         0x6738          uImage header, header size: 64 bytes, header CRC: 0x40F98746, created: 2018-01-06 13:19:48, image size: 277948 bytes, Data Address: 0x27EF0000, Entry Point: 0x27EF0000, data CRC: 0x7E747B41, OS: Firmware, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "ZX297520EVB"
237508        0x39FC4         CRC32 polynomial table, little endian
308532        0x4B534         uImage header, header size: 64 bytes, header CRC: 0x40F98746, created: 2018-01-06 13:19:48, image size: 277948 bytes, Data Address: 0x27EF0000, Entry Point: 0x27EF0000, data CRC: 0x7E747B41, OS: Firmware, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "ZX297520EVB"
519616        0x7EDC0         CRC32 polynomial table, little endian
594736        0x91330         uImage header, header size: 64 bytes, header CRC: 0xBED05A46, created: 2021-02-09 10:15:21, image size: 2811792 bytes, Data Address: 0x22008000, Entry Point: 0x22008000, data CRC: 0x32C5A353, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.4.110"
594800        0x91370         Linux kernel ARM boot executable zImage (little-endian)
613072        0x95AD0         gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
3406592       0x33FB00        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
15073485      0xE600CD        uImage header, header size: 64 bytes, header CRC: 0x72FA36C4, created: 1970-01-01 00:00:00, image size: 1161670 bytes, Data Address: 0x25780000, Entry Point: 0x25780000, data CRC: 0xCF521159, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpuphy_nopsm Image"
16235219      0xF7BAD3        uImage header, header size: 64 bytes, header CRC: 0x5746A3D, created: 1970-01-01 00:00:00, image size: 4770096 bytes, Data Address: 0x21800000, Entry Point: 0x21800000, data CRC: 0xA44267, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpups_nopsm Image"
16252447      0xF7FE1F        gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
21005379      0x1408443       uImage header, header size: 64 bytes, header CRC: 0x8B211F83, created: 1970-01-01 00:00:00, image size: 23388 bytes, Data Address: 0x1F0, Entry Point: 0x1F9, data CRC: 0xF0CCEBE7, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpurpm_nopsm Image"
21028531      0x140DEB3       YAFFS filesystem, little endian
23057075      0x15FD2B3       Certificate in DER format (x509 v3), header length: 4, sequence length: 14385

nvm

sry, stupid question

Unpacking at_Model firmware

Binwalk is unable to automagically unpack this one - yet it seems to provide signature analysis.

binwalk --signature Model-C_at900_b18p20_V1.1.1.45_ModelC_20210209181113.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
26424         0x6738          uImage header, header size: 64 bytes, header CRC: 0x40F98746, created: 2018-01-06 13:19:48, image size: 277948 bytes, Data Address: 0x27EF0000, Entry Point: 0x27EF0000, data CRC: 0x7E747B41, OS: Firmware, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "ZX297520EVB"
237508        0x39FC4         CRC32 polynomial table, little endian
308532        0x4B534         uImage header, header size: 64 bytes, header CRC: 0x40F98746, created: 2018-01-06 13:19:48, image size: 277948 bytes, Data Address: 0x27EF0000, Entry Point: 0x27EF0000, data CRC: 0x7E747B41, OS: Firmware, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "ZX297520EVB"
519616        0x7EDC0         CRC32 polynomial table, little endian
594736        0x91330         uImage header, header size: 64 bytes, header CRC: 0x4CCC597D, created: 2021-02-09 09:59:50, image size: 2713088 bytes, Data Address: 0x22008000, Entry Point: 0x22008000, data CRC: 0xAB9A6303, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.4.110"
594800        0x91370         Linux kernel ARM boot executable zImage (little-endian)
613072        0x95AD0         gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
3307888       0x327970        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
14843709      0xE27F3D        uImage header, header size: 64 bytes, header CRC: 0x72FA36C4, created: 1970-01-01 00:00:00, image size: 1161670 bytes, Data Address: 0x25780000, Entry Point: 0x25780000, data CRC: 0xCF521159, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpuphy_nopsm Image"
16005443      0xF43943        uImage header, header size: 64 bytes, header CRC: 0x5746A3D, created: 1970-01-01 00:00:00, image size: 4770096 bytes, Data Address: 0x21800000, Entry Point: 0x21800000, data CRC: 0xA44267, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpups_nopsm Image"
16022671      0xF47C8F        gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
20775603      0x13D02B3       uImage header, header size: 64 bytes, header CRC: 0x8B211F83, created: 1970-01-01 00:00:00, image size: 23388 bytes, Data Address: 0x1F0, Entry Point: 0x1F9, data CRC: 0xF0CCEBE7, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "evb_cpurpm_nopsm Image"
20798755      0x13D5D23       YAFFS filesystem, little endian
22827299      0x15C5123       Certificate in DER format (x509 v3), header length: 4, sequence length: 14385