New firmware image type

[mrm3ss]

Found a new image type in the Speedport Plus firmware, it is identical to type 1 except that have some kind of hash at the end of file, the last 16bytes, also the key and IV seems to be calculated differently.

Any clue how to implement this type?

Here is the link to firmware in the question:

http://help.cosmote.gr/system/templates/selfservice/gnosis/files3/speedport_plus_323520.img

[Psychotropos]

Short of having a dump of the JFFS2 filesystem of the device itself, there's no sure-fire way of replicating the new container type.

If you have a version of the firmware from right before the format was changed (that is, assuming the device wasn't released with the new firmware format in place already), there might be a way to reverse the new firmware container going off that.

[edisionnano]

@mrm3ss I'm a bit late to the party but you can decrypt the image like that

import sys
import hashlib
from Crypto.Cipher import AES

ALPHABET = "26aejsw37bfktx48chmuy59dipvz"
SALT1 = b"83f323b7132703029da5f4a9daa72a60"
SALT2 = b"b7293e8150d1330c6c3d93f2fa81331b"
HEADER_SIZE = 0xA0

def md5(*parts: bytes) -> bytes:
    h = hashlib.md5()
    for p in parts:
        h.update(p)
    return h.digest()

def sercomm_hexdigest(digest: bytes) -> bytes:
    out = bytearray()
    for c in digest:
        c_hex = format(c, "02x").encode()
        if c_hex.startswith(b"0"):
            out += c_hex[1:]
            out += b"\x00"
        else:
            out += c_hex
    return bytes(out)

def permute(hex_bytes: bytes) -> bytes:
    out = bytearray(hex_bytes)
    for i in range(len(out)):
        out[i] = ord(ALPHABET[out[i] % 28])
    return bytes(out)

def unnullpad(b: bytes) -> bytes:
    return b.split(b"\x00")[0]

def parse_header(header: bytes):
    fw_version = unnullpad(header[0x20:0x40])
    iv32 = header[0x40:0x60]
    nullpad2 = header[0x60:0x80]
    filesize = int(unnullpad(header[0x80:0xA0]) or b"0")
    return {
        "fw_version": fw_version,
        "iv16": iv32[:16],
        "nullpad2": nullpad2,
        "filesize": filesize,
    }

def derive_key(fw_version: bytes, nullpad2: bytes) -> bytes:
    d1 = md5(nullpad2, fw_version)
    d2 = md5(SALT2, fw_version)
    d3 = md5(SALT1, fw_version)
    final = md5(d1, d2, d3)
    return permute(sercomm_hexdigest(final))

def decrypt_ota(data: bytes) -> bytes:
    fields = parse_header(data[:HEADER_SIZE])
    ciphertext = data[HEADER_SIZE:]
    key = derive_key(fields["fw_version"], fields["nullpad2"])
    cipher = AES.new(key, AES.MODE_CBC, fields["iv16"])
    plaintext = cipher.decrypt(ciphertext)
    if 0 < fields["filesize"] <= len(plaintext):
        plaintext = plaintext[: fields["filesize"]]
    return plaintext

def main():
    if len(sys.argv) != 3:
        sys.exit(1)
    in_path, out_prefix = sys.argv[1], sys.argv[2]
    data = open(in_path, "rb").read()
    plaintext = decrypt_ota(data)
    with open(out_prefix, "wb") as f:
        f.write(plaintext)

if __name__ == "__main__":
    main()

This is a new type that mixes 1 and 2. It has the same header as type 1 and derives the key almost like type 2. Instead of the key_factor we have another nullpad at a different offset (just like type 1), IV is at a different offset too.
Once decrypted, we can see that it's an ubifs

--------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
--------------------------------------------------------------------------------------------
288                                0x120                              UBI image, version: 
                                                                      1, image size: 
                                                                      19529728 bytes
--------------------------------------------------------------------------------------------

Analyzed 1 file for 85 file signatures (187 magic patterns) in 14.0 milliseconds

I was trying to decrypt vodafone h300s images but the same script worked with your speedport plus ota (they are very similar)