OpenBox S9/S10 Firmware Tool 0.1 by MST

[slugworth]

I would love to see the motorized setup work properly and maybe even a signal beep function for aiming.

[slugworth]

Maincode was encrypted with XTEA algorithm using some key. After decryption, maincode could be depacked using LZMA.
Still have no clue how this could be done with OpenBox maincode...

I was wondering why the rs232 loader needs lzma.exe? Maybe it decrypts/decompresses before loading to receiver ram?

[slugworth]

there was mention of Dz ali firm dÉcrypter v4.0 on other sites,but no public release that I could find.
I think it's for the m3602 bootloader type receivers and not the smt 1.0.0 anyway.
I did ask if there will be support for openbox s10.
m3602 just uses 1 key to decrypt the entire main firmware I think.

[Smurf_nl]

I have some problems with the tool

When I open a firmware it takes ages to show, seems like I need to close the program several times

the program does not close at all?

on win 7 that is

[slugworth]

that usually happens with oddball firmware that doesn't match the original openbox type.
Same problem with winxp in that case,so it just isn't win 7

[slugworth]

if you are comfortable playing with a hex editor,you can chop out the userdb portion of your firmware once you are delighted with the settings to use on new firmware releases,instead of having to go through all the system settings from scratch.I save a dump by usb;selecting image file,hds2 dump.abs and system setting(in image).I then open the hds2 dump.abs in a hex editor and save from address 230000 to the end of the file.This is the chunk you will paste in new firmware.Open the new firmware .abs file and go to address 230000 and cut out that part to the end of the file.Paste your good chunk there.If done correctly when you load this edited firmware the receiver will start on the last sat/channel you were watching.The only caveat so far is the userdb must start in the same place on all the firmwares you patch.The ones I played with- the userdb started at address 22ff80.I have seen some that started at 23ff80 instead.The same trick doesn't work with image files saved via lan manager as the source file,the .abs must have the system info included.

[slugworth]

You can accomplish the same thing with the rs232 loader.
With the receiver off,run the loader but select data dump for the operate mode.
Hit connect and turn receiver on.On the next menu double click on userdb and next should show save as,pick a name like my.udf in the same folder as the loader.The loader will save the my.udf to pc.You can then load this file on the next firmware release with the rs232 loader,selecting userdb instead of all chunk.

[MST]

a chop from a polish ariva brand receiver site by poster flowswitch

I saw this post before. It still not helps me to find decrypt algorithm. All I know, that decrypt is more complicated compared to Ali 3329B/C families. Probably decrypt routine it's similar, but the main problem is how to get the key. I searched the net for Ali 3602 decrypt too without success. There are many tools for 3329B/C, but none for 3602 maincode.

[MST]

I have some problems with the tool

When I open a firmware it takes ages to show, seems like I need to close the program several times

the program does not close at all?

on win 7 that is

Can you point me to firmware file which you are trying to open in tool ?

[slugworth]

there was old firmware for a 3602 based receiver that only had a 2meg flash.
It seemed there was a lot more ascii readable in that bootloader section.

[Smurf_nl]

Can you point me to firmware file which you are trying to open in tool ?

Well allmost all firmware you can think of that has approx 4mb and abs, to check bootloader and so on..
Also found that the spanish tool finds more different blocks in the firmware.
could you make that too?

have plenty examples for you

[banbanban]

Thanx, let's try it.

[Unregistered]

I saw this post before. It still not helps me to find decrypt algorithm. All I know, that decrypt is more complicated compared to Ali 3329B/C families. Probably decrypt routine it's similar, but the main problem is how to get the key. I searched the net for Ali 3602 decrypt too without success. There are many tools for 3329B/C, but none for 3602 maincode.

There is a table of 0x 100 bytes of keys code in the firmware boot sector which will replace all the bytes of the encrypted maincode.


This table is different in each new firmware released.

[slugworth]

to me the bootloader looks either compressed or encrypted,or maybe just partially.

[MST]

Well allmost all firmware you can think of that has approx 4mb and abs, to check bootloader and so on..
Also found that the spanish tool finds more different blocks in the firmware.
could you make that too?

have plenty examples for you

So please upload somewhere firmware which you can't open usign my tool. I'll check it.

There are no other blocks in OpenBox firmware file. All are listed in my tool. What spanish tool are you using?

[MST]

There is a table of 0x 100 bytes of keys code in the firmware boot sector which will replace all the bytes of the encrypted maincode.


This table is different in each new firmware released.

Are you able to write detailed tutorial how decrypt maincode manually, and how to get these keys ?

[slugworth]

There are no other blocks in OpenBox firmware file. All are listed in my tool. What spanish tool are you using?

they have different names in other 3602 based firmware.

[Smurf_nl]

The spanish tool is called: Partes del firmware 1.0

it takes all abs files I tried. Interesting to see which blocks it finds.

[slugworth]

that program saves a txt file of what you see on the screen.
Maybe post that of the oddball firmware previously mentioned.

[Smurf_nl]

A200_20110830_V2.15B8_patch.abs (Ariva 200)

Encontrado en Bloque : 23010010
Offset : 0
Tamaño : 65536
Nom : HS11
Version : 35004-01047
Datos :20110509-162248


Encontrado en Bloque : 01FE0101
Offset : 65536
Tamaño : 2621440
Nom : maincode
Version : V2.15B8*
Datos :20110830-173114


Encontrado en Bloque : 02FD0100
Offset : 2686976
Tamaño : 65536
Nom : radioback
Version : 1.0.0
Datos :20110509-162256


Encontrado en Bloque : 02FD0200
Offset : 2752512
Tamaño : 65408
Nom : Ariva200
Version : 1.0.0
Datos :20110509-162256


Encontrado en Bloque : 08F70100
Offset : 2817920
Tamaño : 65664
Nom : seeback
Version : 1.0.0
Datos :20110830-172204


Encontrado en Bloque : 08F70101
Offset : 2883584
Tamaño : 65536
Nom : data1
Version : 1.0.0
Datos :20110830-172204


Encontrado en Bloque : 08F70102
Offset : 2949120
Tamaño : 65536
Nom : data2
Version : 1.0.0
Datos :20110830-172204


Encontrado en Bloque : 03FC0100
Offset : 3014656
Tamaño : 262016
Nom : defaultdb
Version : 1.0.0
Datos :20110526-200048


Encontrado en Bloque : 04FB0100
Offset : 3276672
Tamaño : 917632
Nom : userdb
Version : 1.0.0
Datos :20110830-173114

[Smurf_nl]

Galaxy(MCAS)_08Aor2011_317.abs

Encontrado en Bloque : 23010010
Offset : 0
Tamaño : 65536
Nom : Bootloader
Version : Ver 1.3
Datos :2011-04-01


Encontrado en Bloque : 01FE0101
Offset : 65536
Tamaño : 1179648
Nom : Maincode
Version : V3.1.7
Datos :2011-4-8


Encontrado en Bloque : 02FD0100
Offset : 1245184
Tamaño : 65536
Nom : background
Version : 1.0.0
Datos :2010-04-13


Encontrado en Bloque : 02FD0200
Offset : 1310720
Tamaño : 65536
Nom : RadioBG
Version : 1.0.0
Datos :2010-10-14


Encontrado en Bloque : 02FD0300
Offset : 1376256
Tamaño : 65536
Nom : BootLogo
Version : 1.0.0
Datos :2010-10-28


Encontrado en Bloque : 08F70100
Offset : 1441792
Tamaño : 65536
Nom : User Data
Version : 1.0.2
Datos :2011-04-08


Encontrado en Bloque : 03FC0100
Offset : 1507328
Tamaño : 130944
Nom : Sat&TP DB
Version : 1.1.1
Datos :2010-04-22


Encontrado en Bloque : 04FB0100
Offset : 1638272
Tamaño : 1835136
Nom : Ch Data
Version : 1.0.0
Datos :2011-4-8

[Smurf_nl]

So far I think I have seen 4 different bootloaders
so I guess 4 different teams working on lookalike boxes?

[MST]

I know this tool. Partes del firmware 1.0 is also known as:
- Extraction Linbox
- Scindeur
- Ariva Dekompresor

Please keep in mind, that my tool is dedicated to OpenBox S9/S10 only. It is not, and not will be compatible with all ALI 3602 chipset in future. So it will not support Ariva 100/200 firmware for example.
Also, please notice, that apps listed above have limited functionality compared to my tool. The can list blocks, and extract whole blocks only.
So if you have any problems with OpenBox S9/S10 firmware using my tool, please let me know. If you are using it with firmwares for other boxes - sorry, you are doing it at your own risk, and I won't help you.

[slugworth]

being able to change the userdb would be a nice feature.
I have to use the rs232 loader or edit manually with a hex editor.

[MST]

being able to change the userdb would be a nice feature.
I have to use the rs232 loader or edit manually with a hex editor.

Do you mean userdb export and import ability?