By nidal
I’m working on a windows program simulating an existing Unix program,
the program is a firmware downloader, it sends a binary firmware file through the serial port (rs232) to a Set-Top Box running under unix system too, as i’m a poor unix user and not a unix programmer i choosed the hardware way to see how the program sends the file, and i found the next :
(i analysed the communication in hexadecimal form – low level and i will write lines that i didn’t understood as hexadecimal, and commas are not part of data)
1- the Unix PC sends a sort of password and awaits a specefic answer from the STB:
0x18,0x67,0x00,0x16,$,”the file name”,$,00,86,9A,0C
2-the sending process starts :
a-the PC sends this line : 0x18,0x61,0x00,0x04,0x00,0x01,0xFD,0x22
b-this part is recursive and is the essential protocol’s way to send the file:
I-The PC send this line of 12 bytes: 0x17,0xC0,0x1D,0xC3,0x18,0x64,0x04,0x04,0x00,0x00,0x00,0x00
where (what i understood): the first 4 bytes are some checksum, the second are a command (because they are repetitively tge same) and the third 4-bytes refer to the actual position of the file you will see by the next how it incriments.
II-The STB answers with line of 12 bytes : 0x18,0x72,0x00,0x04,0x00,0x00,0x00,0x00,0x45,0x30,0x44,0xB2
same thing, the first 4-bytes is a command (maybe) the second 4 are the loaded size (you will see the incrimentation) and the 3rd is a checksum,
III- The PC sends a block of 1024 bytes of the file
So i think that those 3 steps are : I- the pc send current position of file, II- the card responds with currently loaded size or asks for data and III- the PC sends a block of 1 kbyte data from the file
IV- The PC sends again a line of actual position 0x7F,0xEE,0xB7,0x24,0x18,0x64,0x04,0x04,0x00,0x00,0x04,0x00
V- the STB responds with 0x18, 0x72 ,0x00 ,0x04 ,0x00 ,0x00 ,0x04 ,0x00 ,0x21 ,0x5C ,0x81 ,0xB6
VI– The PC sends the second 1 kb of data
and so on till the file transmission is finished,
why i think that its a checksum? : because i tried the process with 2 different firmwares, if i repeat the operation for the same firmware many times, i find the same commands/headers/checksums in the communication,
and if i change to other firmware i find different checksums, only the incremented blocks are the same.
samples of PC commands (step I- or IV-)
s0[12]={0x17,0xC0,0x1D,0xC3,0x18,0x64,0x04,0x04,0x00,0x00,0x00,0x00},
s1[12]={0x7F,0xEE,0xB7,0x24,0x18,0x64,0x04,0x04,0x00,0x00,0x04,0x00},
s2[12]={0xBB,0xFF,0xED,0xF0,0x18,0x64,0x04,0x04,0x00,0x00,0x08,0x00},
s3[12]={0xB3,0x10,0x2C,0x9B,0x18,0x64,0x04,0x04,0x00,0x00,0x0C,0x00},
s4[12]={0x60,0xD1,0xF3,0xE7,0x18,0x64,0x04,0x04,0x00,0x00,0x10,0x00},
s5[12]={0x01,0x72,0x41,0x18,0x18,0x64,0x04,0x04,0x00,0x00,0x14,0x00},…
samples of STB commands:
t0[12]={0x18, …read more
Source: FULL ARTICLE at The UNIX and Linux Forums
