editting firmware ".bin" file?

trilobite · 2021-03-11 01:05:22

I have gotten an old internet radio, this one:
https://www.amazon.com/Aluratek-AIRMM01 … B00192VWVY

I was able to flash the radio with a firmware I got for it with a USB, and it works. Basically they take lists of webcast stations and classifies them. I've listen to some pretty diverse stuff but some is non-functional.

The firmware file is a .bin file. I looks like a image file. Anyone know what to use to edit the file? It looks like matrix algebra from webpages. I have no idea what I'm getting into. But it'll keep me busy in addition. (Another pandemic insomnia project.)

Last edited by trilobite (2021-03-11 01:08:13)

twoion · 2021-03-11 19:57:11

Use binwalk to examine the blob. It'll tell you about the structure of the firmware image, and this in turn will give you hints how to extract things from it, possibly things that can be disassembled or unpacked.

DeepDayze · 2021-03-12 02:49:35

I suppose the radio stations are hard-coded in the firmware and unable to be changed, so this makes sense.

trilobite · 2021-03-15 18:47:52

Thanks! I like the calling it a "blob". There's no risk in playing with the firm ware I think, can always flash it back.

DeepDayze · 2021-03-15 19:05:33

trilobite wrote:

Thanks! I like the calling it a "blob". There's no risk in playing with the firm ware I think, can always flash it back.

If you can see the coded radio station strings in the blob bet you can carefully edit them to valid stations then. Note that the strings may be null terminated and be careful not to disturb the null bytes when editing.

Let us know how this goes.

Another command you can use to dump the strings within the blob is strings.

Last edited by DeepDayze (2021-03-15 19:07:45)

trilobite · 2021-03-15 22:32:38

I get the following:

$ binwalk -e -M ShrekW.BIN

Scan Time:     2021-03-15 21:35:06
Target File:   /home/trilobite/aluratek/ShrekW.BIN
MD5 Checksum:  638407b087be6282b2ae9713915b236a
Signatures:    386

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
168005        0x29045         XML document, version: "1.0"
169728        0x29700         XML document, version: "1.0"
174251        0x2A8AB         XML document, version: "1.0"
178129        0x2B7D1         XML document, version: "1.0"
527723        0x80D6B         HTML document header

$ binwalk -E ShrekW.BIN

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.829779)
28672         0x7000          Falling entropy edge (0.223081)
34816         0x8800          Rising entropy edge (0.952960)
36864         0x9000          Rising entropy edge (0.951714)
40960         0xA000          Falling entropy edge (0.562619)
373760        0x5B400         Rising entropy edge (0.950901)
478208        0x74C00         Falling entropy edge (0.809969)
529408        0x81400         Falling entropy edge (0.703562)
533504        0x82400         Falling entropy edge (0.745119)
566272        0x8A400         Rising entropy edge (0.980455)
569344        0x8B000         Falling entropy edge (0.760723)

I did
$ strings ShrekW.BIN &> shrek.txt

The output is first a bunch of random characters in lines 6 and 3 characters long,then a series of dashes ------- and fffffffff lines, followed by this:

Piano right
Copyright 
 1997 von Bernd Kr
'u8<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
	<specVersion>
		<major>1</major>
		<minor>0</minor>
	</specVersion>
	<device>
		<deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType>
		<friendlyName>Aluratek AIRMM01F</friendlyName>
		<manufacturer>Aluratek</manufacturer>
		<manufacturerURL>http://www.aluratek.com</manufacturerURL>
		<modelDescription>Internet Radio Alarm Clock w/built-in WiFi</modelDescription>
		<modelName>Internet Radio Alarm Clock w/built-in WiFi</modelName>
		<modelNumber>AIRMM01F</modelNumber>
		<UDN>uuid:00000000-0000-0000-0000-000000000000</UDN>
		<UPC>0000 000 00000</UPC>
		<serviceList>
			<service>
				<serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType>
				<serviceId>urn:upnp-org:serviceId:RenderingControlServiceID</serviceId>
				<SCPDURL>/RenderingControl/desc.xml</SCPDURL>
				<controlURL>/RenderingControl/ctrl</controlURL>
				<eventSubURL>/RenderingControl/evt</eventSubURL>
			</service>
			<service>
				<serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
				<serviceId>urn:upnp-org:serviceId:ConnectionManagerServiceID</serviceId>
				<SCPDURL>/ConnectionManager/desc.xml</SCPDURL>
				<controlURL>/ConnectionManager/ctrl</controlURL>
				<eventSubURL>/ConnectionManager/evt</eventSubURL>
			</service>

This repeats to give the radio instructions I guess. Then it repeats the random characters and ends. I see calls within the code re volume, setting memory stations, playing media from a computer through the radio. In the second section of random characters there's an occasional part of a word, like "ersion" and "microso" and almost IP numbers "5.188.23_4.120". No seeing stations.

I emailed the manufacturer and their support replied that it isn't supported any more. Expected. Not sure what next step is.

Last edited by trilobite (2021-03-15 22:33:40)

DeepDayze · 2021-03-16 13:27:08

Maybe search online for any people who have "hacked" this device and what they did?

Bummer that the firmware file search didn't turn up any useful info such as the stations. Perhaps the station info may been encoded somehow.

Last edited by DeepDayze (2021-03-16 13:28:03)

twoion · 2021-03-16 19:56:39

trilobite wrote:

I get the following:

$ binwalk -e -M ShrekW.BIN

Scan Time:     2021-03-15 21:35:06
Target File:   /home/trilobite/aluratek/ShrekW.BIN
MD5 Checksum:  638407b087be6282b2ae9713915b236a
Signatures:    386

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
168005        0x29045         XML document, version: "1.0"
169728        0x29700         XML document, version: "1.0"
174251        0x2A8AB         XML document, version: "1.0"
178129        0x2B7D1         XML document, version: "1.0"
527723        0x80D6B         HTML document header

$ binwalk -E ShrekW.BIN

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.829779)
28672         0x7000          Falling entropy edge (0.223081)
34816         0x8800          Rising entropy edge (0.952960)
36864         0x9000          Rising entropy edge (0.951714)
40960         0xA000          Falling entropy edge (0.562619)
373760        0x5B400         Rising entropy edge (0.950901)
478208        0x74C00         Falling entropy edge (0.809969)
529408        0x81400         Falling entropy edge (0.703562)
533504        0x82400         Falling entropy edge (0.745119)
566272        0x8A400         Rising entropy edge (0.980455)
569344        0x8B000         Falling entropy edge (0.760723)

I did
$ strings ShrekW.BIN &> shrek.txt

The output is first a bunch of random characters in lines 6 and 3 characters long,then a series of dashes ------- and fffffffff lines, followed by this:

Piano right
Copyright 
 1997 von Bernd Kr
'u8<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
	<specVersion>
		<major>1</major>
		<minor>0</minor>
	</specVersion>
	<device>
		<deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType>
		<friendlyName>Aluratek AIRMM01F</friendlyName>
		<manufacturer>Aluratek</manufacturer>
		<manufacturerURL>http://www.aluratek.com</manufacturerURL>
		<modelDescription>Internet Radio Alarm Clock w/built-in WiFi</modelDescription>
		<modelName>Internet Radio Alarm Clock w/built-in WiFi</modelName>
		<modelNumber>AIRMM01F</modelNumber>
		<UDN>uuid:00000000-0000-0000-0000-000000000000</UDN>
		<UPC>0000 000 00000</UPC>
		<serviceList>
			<service>
				<serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType>
				<serviceId>urn:upnp-org:serviceId:RenderingControlServiceID</serviceId>
				<SCPDURL>/RenderingControl/desc.xml</SCPDURL>
				<controlURL>/RenderingControl/ctrl</controlURL>
				<eventSubURL>/RenderingControl/evt</eventSubURL>
			</service>
			<service>
				<serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
				<serviceId>urn:upnp-org:serviceId:ConnectionManagerServiceID</serviceId>
				<SCPDURL>/ConnectionManager/desc.xml</SCPDURL>
				<controlURL>/ConnectionManager/ctrl</controlURL>
				<eventSubURL>/ConnectionManager/evt</eventSubURL>
			</service>

This repeats to give the radio instructions I guess. Then it repeats the random characters and ends. I see calls within the code re volume, setting memory stations, playing media from a computer through the radio. In the second section of random characters there's an occasional part of a word, like "ersion" and "microso" and almost IP numbers "5.188.23_4.120". No seeing stations.

I emailed the manufacturer and their support replied that it isn't supported any more. Expected. Not sure what next step is.

The XML is a universal plug and play interface description. It means, that if you're on the same network, a upnp client (or any http client) can query and/or send payloads to the HTTP endpoints defined for the listed services, the ConnectionManager and/or RenderingControl. you can try it with curl, for example, or a browser. Go to http://theipaddressoftheradio/<any of the endpoints listed above> and see what you find.

I wonder if this is even a complete firmware. One should try a disassembler. Can you upload the firmware e.g. to 0x0.st? BTW; the same radio seems to have been also sold as https://cdn.medion.com/downloads/anleit … 5651de.pdf in Germany.

trilobite · 2021-03-17 17:48:50

Trying to access the http brings up "can't connect".

Uploaded to 0x0.st, firmware is at

https://0x0.st/-Ned.BIN

Thanks for the other info re different brandname. There's a different firmware noted in those instructions: ShrekW_R102C7.zip Looking for that got me to see that it is also called Sagem. https://manualzz.com/doc/1490595/sagem-700-user-guide

I got no where with any online instructions for the radio firmware or hacking.

The info seems to indicate that the radio calls stations from aluratek.vtuner.com. I can put in the radio serial number and it wants an email login. I emailed the support, and they do not respond (yet?). Somewhere there is an email and password associated with this radio. Perhaps this is not a functioning site - "no support".

Last edited by trilobite (2021-03-17 17:59:57)

DeepDayze · 2021-03-17 18:11:31

trilobite wrote:

Trying to access the http brings up "can't connect".
Uploaded to 0x0.st, firmware is at
https://0x0.st/-Ned.BIN
Thanks for the other info re different brandname. There's a different firmware noted in those instructions: ShrekW_R102C7.zip Looking for that got me to see that it is also called Sagem. https://manualzz.com/doc/1490595/sagem-700-user-guide
I got no where with any online instructions for the radio firmware or hacking.
The info seems to indicate that the radio calls stations from aluratek.vtuner.com. I can put in the radio serial number and it wants an email login. I emailed the support, and they do not respond (yet?). Somewhere there is an email and password associated with this radio. Perhaps this is not a functioning site - "no support".

Is there any option to create an account after you enter the serial#? Think you might have to do that as part of activating the radio.

Took a look at the Aluratek vtuner site and while there is a signon, there's another box below where you enter the serial. This where you entered the serial?

Here's what I saw in the help about the ID#:

About the Internet Radio Alarm Clock  ID #


   The ID # is a unique name that identifies your device. It consists of a series of numbers and letters.
   The ID # is available by navigating the menus on your device.
   How to login:
 
1.	Retrieve your ID #
 	 
 		1. Navigate to the Internet Radio menu, and click the right arrow
2. Navigate to the Help menu, and click the right arrow
3. The second item listed is your ID#
 	 	 
 	 	 
2.	Login to the aluratek.vtuner.com Web site.
 	 
 		Enter your ID # in the 'Sign in with your ID #' area, then click the 'Go' button.

Last edited by DeepDayze (2021-03-17 18:13:11)

trilobite · 2021-03-17 18:21:37

Yes I did that with the serial and it wants and email sign-in after that. Obviously it was registered before. A 2 step login.

Which I don't have the email. So I emailed the support telling the story, no answer.

#1 2021-03-11 01:05:22

editting firmware ".bin" file?

#2 2021-03-11 19:57:11

Re: editting firmware ".bin" file?

#3 2021-03-12 02:49:35

Re: editting firmware ".bin" file?

#4 2021-03-15 18:47:52

Re: editting firmware ".bin" file?

#5 2021-03-15 19:05:33

Re: editting firmware ".bin" file?

#6 2021-03-15 22:32:38

Re: editting firmware ".bin" file?

#7 2021-03-16 13:27:08

Re: editting firmware ".bin" file?

#8 2021-03-16 19:56:39

Re: editting firmware ".bin" file?

#9 2021-03-17 17:48:50

Re: editting firmware ".bin" file?

#10 2021-03-17 18:11:31

Re: editting firmware ".bin" file?

#11 2021-03-17 18:21:37

Re: editting firmware ".bin" file?

Board footer