Unarchive (maybe) firmware bin file

Soldato
Joined
30 Jan 2007
Posts
15,428
Location
PA, USA (Orig UK)
I want to take a look at the contents of a .bin file for my Seiki TV. Has anyone done this sort of thing and can either give me some advice?

I don't know if it's an archive file, or a straight binary file etc.

I am totally awful with Linux, but I assume that the firmware will turn out to be linux based.

Just looking at the raw binary (before it goes to a complete encoded mess)
# PreInit
dont_overwrite_init
dont_overwrite certificate

# Start auto_update.txt parsing
nand erase.chip

# File Partition: set_partition
dynpart edb64M-nand:0x40000(NPT),0x40000(KL_BP),0x700000(UBIRO),0xA00000(KL),0x300000(CTRL),0x300000(TBL),0x600000(tee),0x100000(RTPM),-(UBI) #set_partition
saveenv #set_partition
ubi part UBIRO #set_partition
setenv UBIRO #set_partition
saveenv #set_partition
ubi create certificate 0x500000 #set_partition
ubi part UBI #set_partition
setenv UBI #set_partition
saveenv #set_partition
ubi create RFS 0x900000 #set_partition
ubi create MSLIB 0x4C00000 #set_partition
ubi create CONFIG 0xA00000 #set_partition
ubi create customer 0x1300000 #set_partition
ubi create customerbackup 0xE00000 #set_partition
ubi create APP 0x7B00000 #set_partition
ubi create oad 0x7A00000 #set_partition
ubi create tee 0x600000 #set_partition
ubi create brickbackup 0x800000 #set_partition
ubi create brickreserve 0x400000 #set_partition
ubi create APPCACHE 0xC00000 #set_partition

# File Partition: kernel
filepartload 0x2D200000 $(UpgradeImage) 0x4000 0x60ee1f #kernel
mscompress7 d 0 0x2D200000 60ee1f 0x24000000 #kernel
crc32 0x24000000 0x6ac9c0 0x2D200000 #kernel
mw 0x2D200004 0x68B260BC 4 #kernel
cmp.b 0x2D200000 0x2D200004 4 #kernel
nand erase.part KL #kernel
nand write.e 0x24000000 KL $(filesize) #kernel
setenv LOAD_KERNEL nand read.e 0x205FFFC0 KL $(filesize)\; #kernel
setenv BOOT_KERNEL bootm 0x205FFFC0\; #kernel
saveenv #kernel
filepartload 0x2D200000 $(UpgradeImage) 0x614000 0x13b #kernel
mscompress7 d 0 0x2D200000 13b 0x24000000 #kernel
crc32 0x24000000 0x220 0x2D200000 #kernel
mw 0x2D200004 0x08E46A65 4 #kernel
cmp.b 0x2D200000 0x2D200004 4 #kernel
store_secure_info kernelSign 0x24000000 #kernel
filepartload 0x2D200000 $(UpgradeImage) 0x624000 0x13a #kernel
mscompress7 d 0 0x2D200000 13a 0x24000000 #kernel
crc32 0x24000000 0x220 0x2D200000 #kernel
mw 0x2D200004 0xBC0BA6C8 4 #kernel
cmp.b 0x2D200000 0x2D200004 4 #kernel
store_secure_info keySetSign 0x24000000 #kernel
filepartload 0x2D200000 $(UpgradeImage) 0x634000 0x1d #kernel
mscompress7 d 0 0x2D200000 1d 0x24000000 #kernel
crc32 0x24000000 0x524 0x2D200000 #kernel
mw 0x2D200004 0x1BF8E9FD 4 #kernel
cmp.b 0x2D200000 0x2D200004 4 #kernel
store_secure_info keySet 0x24000000 #kernel

# File Partition: mboot
filepartload 0x2D200000 $(UpgradeImage) 0x644000 0x2c2 #mboot
mscompress7 d 0 0x2D200000 2c2 0x24000000 #mboot
crc32 0x24000000 0x5600 0x2D200000 #mboot
mw 0x2D200004 0xDCC1A977 4 #mboot
cmp.b 0x2D200000 0x2D200004 4 #mboot
filepartload 0x2D210000 $(UpgradeImage) 0x654000 0x387 #mboot
mscompress7 d 0 0x2D210000 387 0x24010000 #mboot
crc32 0x24010000 0x2800 0x2D210000 #mboot
mw 0x2D210004 0x515DEEE1 4 #mboot
cmp.b 0x2D210000 0x2D210004 4 #mboot
filepartload 0x2D220000 $(UpgradeImage) 0x664000 0x81 #mboot
mscompress7 d 0 0x2D220000 81 0x24020000 #mboot
crc32 0x24020000 0x1800 0x2D220000 #mboot
mw 0x2D220004 0x4363F8CE 4 #mboot
cmp.b 0x2D220000 0x2D220004 4 #mboot
filepartload 0x2D230000 $(UpgradeImage) 0x674000 0x2c8 #mboot
mscompress7 d 0 0x2D230000 2c8 0x24030000 #mboot
crc32 0x24030000 0x3800 0x2D230000 #mboot
mw 0x2D230004 0xA200F6C8 4 #mboot
cmp.b 0x2D230000 0x2D230004 4 #mboot
filepartload 0x2D233800 $(UpgradeImage) 0x684000 0x9402b #mboot
mscompress7 d 0 0x2D233800 9402b 0x24033800 #mboot
crc32 0x24033800 0x1d0000 0x2D233800 #mboot
mw 0x2D233804 0x7199679A 4 #mboot
cmp.b 0x2D233800 0x2D233804 4 #mboot
ncishash 0x24000000 0x24010000 0x24020000 0x24030000 0x3800 0x24033800 $(filesize) #mboot

# File Partition: ROOTFS
filepartload 0x2D200000 $(UpgradeImage) 0x724000 0x3373fd #ROOTFS
mscompress7 d 0 0x2D200000 3373fd 0x24000000 #ROOTFS
crc32 0x24000000 0x782000 0x2D200000 #ROOTFS
mw 0x2D200004 0x8648E965 4 #ROOTFS
cmp.b 0x2D200000 0x2D200004 4 #ROOTFS
ubi part UBI #ROOTFS
ubi write 0x24000000 RFS 0x782000 0x782000 #ROOTFS
filepartload 0x2D200000 $(UpgradeImage) 0xa64000 0xe7f #ROOTFS
mscompress7 d 0 0x2D200000 e7f 0x24000000 #ROOTFS
crc32 0x24000000 0x1100 0x2D200000 #ROOTFS
mw 0x2D200004 0xE91D14E2 4 #ROOTFS
cmp.b 0x2D200000 0x2D200004 4 #ROOTFS
store_secure_info ROOTFSSign 0x24000000 #ROOTFS

# File Partition: mslib
filepartload 0x2D200000 $(UpgradeImage) 0xa74000 0x12cc518 #mslib
mscompress7 d 0 0x2D200000 12cc518 0x24000000 #mslib
crc32 0x24000000 0x1e00000 0x2D200000 #mslib
mw 0x2D200004 0x1968F1EE 4 #mslib
cmp.b 0x2D200000 0x2D200004 4 #mslib
ubi part UBI #mslib
ubi write 0x24000000 MSLIB 0x1e00000 0x41a2000 #mslib
filepartload 0x2D200000 $(UpgradeImage) 0x1d44000 0x14faeff #mslib
mscompress7 d 0 0x2D200000 14faeff 0x24000000 #mslib
crc32 0x24000000 0x1e00000 0x2D200000 #mslib
mw 0x2D200004 0xA6D26E89 4 #mslib
cmp.b 0x2D200000 0x2D200004 4 #mslib
ubi write_cont 0x24000000 MSLIB 0x1e00000 #mslib
filepartload 0x2D200000 $(UpgradeImage) 0x3244000 0x3569d2 #mslib
mscompress7 d 0 0x2D200000 3569d2 0x24000000 #mslib
crc32 0x24000000 0x5a2000 0x2D200000 #mslib
mw 0x2D200004 0xBBD54E24 4 #mslib
cmp.b 0x2D200000 0x2D200004 4 #mslib
ubi write_cont 0x24000000 MSLIB 0x5a2000 #mslib
filepartload 0x2D200000 $(UpgradeImage) 0x35a4000 0xe7c #mslib
mscompress7 d 0 0x2D200000 e7c 0x24000000 #mslib
crc32 0x24000000 0x1100 0x2D200000 #mslib
mw 0x2D200004 0xC3C53DC2 4 #mslib
cmp.b 0x2D200000 0x2D200004 4 #mslib
store_secure_info mslibSign 0x24000000 #mslib

# File Partition: applications
filepartload 0x2D200000 $(UpgradeImage) 0x35b4000 0x131aad2 #applications
mscompress7 d 0 0x2D200000 131aad2 0x24000000 #applications
crc32 0x24000000 0x1e00000 0x2D200000 #applications
mw 0x2D200004 0x3155AAB4 4 #applications
cmp.b 0x2D200000 0x2D200004 4 #applications
ubi part UBI #applications
ubi write 0x24000000 APP 0x1e00000 0x6bc6000 #applications
filepartload 0x2D200000 $(UpgradeImage) 0x48d4000 0x1b80859 #applications
mscompress7 d 0 0x2D200000 1b80859 0x24000000 #applications
crc32 0x24000000 0x1e00000 0x2D200000 #applications
mw 0x2D200004 0xB5C84736 4 #applications
cmp.b 0x2D200000 0x2D200004 4 #applications
ubi write_cont 0x24000000 APP 0x1e00000 #applications
filepartload 0x2D200000 $(UpgradeImage) 0x6464000 0x16a8106 #applications
mscompress7 d 0 0x2D200000 16a8106 0x24000000 #applications
crc32 0x24000000 0x1e00000 0x2D200000 #applications
mw 0x2D200004 0x59D5A985 4 #applications
cmp.b 0x2D200000 0x2D200004 4 #applications
ubi write_cont 0x24000000 APP 0x1e00000 #applications
filepartload 0x2D200000 $(UpgradeImage) 0x7b14000 0xab8c6e #applications
mscompress7 d 0 0x2D200000 ab8c6e 0x24000000 #applications
crc32 0x24000000 0x11c6000 0x2D200000 #applications
mw 0x2D200004 0xDBEBD78B 4 #applications
cmp.b 0x2D200000 0x2D200004 4 #applications
ubi write_cont 0x24000000 APP 0x11c6000 #applications
filepartload 0x2D200000 $(UpgradeImage) 0x85d4000 0xe7e #applications
mscompress7 d 0 0x2D200000 e7e 0x24000000 #applications
crc32 0x24000000 0x1100 0x2D200000 #applications
mw 0x2D200004 0x56F97C14 4 #applications
cmp.b 0x2D200000 0x2D200004 4 #applications
store_secure_info applicationsSign 0x24000000 #applications

# File Partition: config
filepartload 0x2D200000 $(UpgradeImage) 0x85e4000 0x16dc7a #config
mscompress7 d 0 0x2D200000 16dc7a 0x24000000 #config
crc32 0x24000000 0x592000 0x2D200000 #config
mw 0x2D200004 0x3AA18D68 4 #config
cmp.b 0x2D200000 0x2D200004 4 #config
ubi part UBI #config
ubi write 0x24000000 CONFIG 0xA00000 #config

# File Partition: customer
filepartload 0x2D200000 $(UpgradeImage) 0x8754000 0x41239a #customer
mscompress7 d 0 0x2D200000 41239a 0x24000000 #customer
crc32 0x24000000 0x87a000 0x2D200000 #customer
mw 0x2D200004 0x7E097947 4 #customer
cmp.b 0x2D200000 0x2D200004 4 #customer
ubi part UBI #customer
ubi write 0x24000000 customer 0x1300000 #customer
filepartload 0x2D200000 $(UpgradeImage) 0x8b74000 0x38b #customer
mscompress7 d 0 0x2D200000 38b 0x24000000 #customer
crc32 0x24000000 0x326000 0x2D200000 #customer
mw 0x2D200004 0xB308B81C 4 #customer
cmp.b 0x2D200000 0x2D200004 4 #customer
ubi part UBI #customer
ubi write 0x24000000 customerbackup 0x400000 #customer

# File Partition: RT_PM
filepartload 0x2D200000 $(UpgradeImage) 0x8b84000 0x28c4 #RT_PM
mscompress7 d 0 0x2D200000 28c4 0x24000000 #RT_PM
crc32 0x24000000 0x10000 0x2D200000 #RT_PM
mw 0x2D200004 0x99DE0E81 4 #RT_PM
cmp.b 0x2D200000 0x2D200004 4 #RT_PM
nand erase.part RTPM #RT_PM
nand write.e 0x24000000 RTPM $(filesize) #RT_PM

# File Partition: certificate
filepartload 0x2D200000 $(UpgradeImage) 0x8b94000 0x116b2 #certificate
mscompress7 d 0 0x2D200000 116b2 0x24000000 #certificate
crc32 0x24000000 0x326000 0x2D200000 #certificate
mw 0x2D200004 0x3A320EAF 4 #certificate
cmp.b 0x2D200000 0x2D200004 4 #certificate
ubi part UBIRO #certificate
ubi write 0x24000000 certificate 0x500000 #certificate

# File Partition: tee
filepartload 0x2D200000 $(UpgradeImage) 0x8bb4000 0x15ec67 #tee
mscompress7 d 0 0x2D200000 15ec67 0x24000000 #tee
crc32 0x24000000 0x389ef0 0x2D200000 #tee
mw 0x2D200004 0x2B21F99A 4 #tee
cmp.b 0x2D200000 0x2D200004 4 #tee
nand erase.part tee #tee
nand write.e 0x24000000 tee $(filesize) #tee
setenv LOAD_NUTTX nand read.e 0x5EF00000 tee $(filesize)\; #tee
setenv BOOT_NUTTX bootNuttx 0x1EF00000\; #tee
saveenv #tee
filepartload 0x2D200000 $(UpgradeImage) 0x8d14000 0x13c #tee
mscompress7 d 0 0x2D200000 13c 0x24000000 #tee
crc32 0x24000000 0x220 0x2D200000 #tee
mw 0x2D200004 0x8D614CD9 4 #tee
cmp.b 0x2D200000 0x2D200004 4 #tee
store_secure_info teeSign 0x24000000 #tee
filepartload 0x2D200000 $(UpgradeImage) 0x8d24000 0x20a #tee
mscompress7 d 0 0x2D200000 20a 0x24000000 #tee
crc32 0x24000000 0x7ac 0x2D200000 #tee
mw 0x2D200004 0x0EF940DB 4 #tee
cmp.b 0x2D200000 0x2D200004 4 #tee
store_nuttx_config NuttxConfig 0x24000000 #tee

# File Partition: brickbackup
filepartload 0x2D200000 $(UpgradeImage) 0x8d34000 0x4397d6 #brickbackup
mscompress7 d 0 0x2D200000 4397d6 0x24000000 #brickbackup
crc32 0x24000000 0x744000 0x2D200000 #brickbackup
mw 0x2D200004 0xB29340F6 4 #brickbackup
cmp.b 0x2D200000 0x2D200004 4 #brickbackup
ubi part UBI #brickbackup
ubi write 0x24000000 brickbackup 0x800000 #brickbackup

# File Partition: brickreserve
filepartload 0x2D200000 $(UpgradeImage) 0x9174000 0x3fb #brickreserve
mscompress7 d 0 0x2D200000 3fb 0x24000000 #brickreserve
crc32 0x24000000 0x326000 0x2D200000 #brickreserve
mw 0x2D200004 0x977F8252 4 #brickreserve
cmp.b 0x2D200000 0x2D200004 4 #brickreserve
ubi part UBI #brickreserve
ubi write 0x24000000 brickreserve 0x400000 #brickreserve

# File Partition: appcache
filepartload 0x29600000 $(UpgradeImage) 0x9184000 0x388 #appcache
mscompress7 d 0 0x29600000 388 0x20400000 #appcache
crc32 0x20400000 0x326000 0x29600000 #appcache
mw 0x29600004 0xE0369B1E 4 #appcache
cmp.b 0x29600000 0x29600004 4 #appcache
ubi part UBI #appcache
ubi write 0x20400000 APPCACHE 0xC00000 #appcache

# File Partition: set_config
setenv MS_RFS ubi.mtd=UBI ubi.mtd=UBIRO ubi.mtd=UBILD root=ubi0:RFS rootfstype=ubifs ro #set_config
setenv UBI_SPEED_UP ubispeedup=UBI #set_config
setenv DynMmapID E_MMAP_ID_BOOTLOGO_BUFFER #set_config
setenv bootlogo_buffer E_MMAP_ID_BOOTLOGO_BUFFER #set_config
setenv bootlogo_gopidx 1 #set_config
setenv BOOTLOGOARGS bootlogo_dfblayer=2 delaylogo=true CLOSE_BOOTLOGO #set_config
setenv bootargs console=ttyS0,115200 $(MS_RFS) $(mtdparts) $(UBI_SPEED_UP) $(BOOTLOGOARGS) #set_config
setenv bootcmd $(LOAD_KERNEL) $(LOAD_NUTTX) $(BOOT_NUTTX) \; $(BOOT_KERNEL) #set_config
setenv verify n #set_config
saveenv #set_config
setenv CtvUpgrade_complete 1
saveenv
printenv
reset
% <- this is end of script symbol
 
Last edited:
Man of Honour
Joined
13 Oct 2006
Posts
90,805
I'm no expert but that is probably a very open ended subject.

While it might be an archive it could be one of many data formats, or even something the specific manufacturer has dreamed up, that store the information to be flashed to the EEPROMs, etc. even if its just the footprint of an embedded Linux install potentially very complex to do anything useful with it.

EDIT: I'm guessing that is an android 4.2 install? assume the filepartload points to the location and length of the files within the binary lump - there might be tools to pull that apart but beyond my experience.

You could try converting it to an ISO but I'll be surprised if its that easy.
 
Last edited:
Soldato
OP
Joined
30 Jan 2007
Posts
15,428
Location
PA, USA (Orig UK)
I see lots of reference to people just saying the opened the archive etc. I've tried zip and xz, but no luck so far. I don't have linux installed yet to try out a 'File' command.

That bin file is intended to go on a USB stick for flashing.
 
Man of Honour
Joined
13 Oct 2006
Posts
90,805
Windows should still display "something" - there are all sorts of formats for .bin files though some requiring not easy to get hold of tools to extract if they can even be extracted in any useful way once packaged.
 
Soldato
OP
Joined
30 Jan 2007
Posts
15,428
Location
PA, USA (Orig UK)
What I wanted to do was compare the bin for the 42" screen I have against the 55" model, and see if the 55 firmware can be used on the 42. The reason being that a similar thing happened with a previous model from this manufacturer and doing so allowed 120hz at 1080p to be used.
 
Associate
Joined
29 Sep 2005
Posts
818
Location
St Neots / Dublin
If the bin file is intended as a recovery/fresh flash image then it may be a straight NAND flash image, intended to be written directly to raw flash.

If it is an upgrade file, then it may be a renamed archive format or simply some partition images concatenated together. The fact you are seeing raw ASCII strings makes me think it is the latter, or perhaps an uncompressed archive format like tar/ar/cpio.

If you have access to a UNIX (Linux/BSD/Mac OS/etc) machine then there are some standard tools like 'file', 'disktype' and 'gpart' (not gparted, but that might help too) that can help.

The ASCII strings you have look like U-boot bootloader commands to partition a flash device and write images into it. The commands refixed with 'ubi' refer to the UBIFS filesystem which is a Linux filesystem designed for flash.

If you have a hex editor, you could search the binary for a 16-byte UBIFS signature aligned to a 16-byte boundary with the following bytes :

Code:
55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 00

In ASCII, that'd start "UBI#". This would be the start of a UBIFS image, which you can mount and inspect like :
Code:
OFFSET=(byte offset of the UBIFS header)
SIZE=(size of the UBIFS image)

dd if=firmware.bin of=ubifs.bin skip=$OFFSET count=$SIZE bs=1

(If you don't know the size, leave out the "count=$SIZE")

modprobe nandsim cache_file=ubifs.bin first_id_byte=0xec second_id_byte=0xd3 third_id_byte=0x51 fourth_id_byte=0x95

modprobe ubi mtd=0

ubiattach /dev/ubi_ctrl -m 0

mkdir ubifs_mount

mount -t ubifs ubi0 ubifs_mount

At this point, the files in the image should be accessible at 'ubifs_mount'
 
Last edited:
Back
Top Bottom