Denon Reverse Engineering Help

Signed Firmware Layout

Many of the newer inmusic devices have switched from using unsigned firmware updates to using signed firmware updates. This prevents modifications to the firmware updates unfortunately (although you can likely still modify the OS on the device and boot into the modifications). Whether it will boot using a modified rootfs is untested.

The new firmware layouts have some header information before 0xD00DFEED (the flattened device tree header magic value).

Header Values (prefix before 0xD00DFEED)

Device

Version

Header (Hex)

SCLIVE2

4.1.0

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 B8 00 00 00 38 03 00 00 60 00 00 00 04 00 0A 00 01 00 00 00 38 03 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4A 43 31 31 53 00 4A 50 31 31 53 00 4A 50 32 30 00 4A 50 32 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 64 65 6E 6F 6E 2D 31 00 00 00 07 D0 E4 15 1E 00 00 00 0C C0 E4 15 24 00 00 00 11 D0 E4 15 2A 00 00 00 12 D0 E4 15 2F 00 00 00 42 4F 4F 54 00 00 00 80 40 04 00 00 00 00 00 00 8C FD 08 00 00 00 00 00 00 00 00 00 01 00 00 00 E2 60 9F 12 7B 28 28 6F BD 53 9E F4 13 F9 CE 64 C3 79 0D 59 94 65 07 CC DA 24 AA 26 70 7B 3C F2 42 4F 4F 54 00 00 00 80 D0 01 09 00 00 00 00 00 24 E2 08 00 00 00 00 00 00 00 00 00 02 00 00 00 30 D1 45 19 9A 1A 86 88 B3 43 3A 67 2A 6A E7 29 6C AA 62 13 9F E1 7B 1B C5 4A D7 75 DE 16 06 5E 42 4F 4F 54 00 00 00 80 F8 E3 11 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 04 00 00 00 63 45 8F 6B 8C 86 BB B6 24 AB 61 83 FA FF 77 6F 5D AD B0 06 43 48 78 D5 2A 15 DF 1A A4 DC 82 29 42 4F 4F 54 00 00 00 80 68 CA 1A 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 08 00 00 00 CC 1D 34 F6 25 20 DF 77 41 C1 07 6D 87 6C 49 A4 92 5F 85 27 D0 DC 3C 22 AF 73 98 C8 33 9A 36 FC 50 41 52 54 01 00 00 80 D8 B0 23 00 00 00 00 00 90 14 00 00 00 00 00 00 34 00 00 00 01 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 80 68 C5 23 00 00 00 00 00 CC 14 00 00 00 00 00 00 34 00 00 00 0E 00 00 00 C7 69 CE C1 08 D8 86 6A 8F 9D 59 60 C5 9E E5 F1 A6 F3 61 00 AE DC 67 DE 5E A3 24 83 D9 62 85 17 50 41 52 54 01 00 00 80 38 DA 23 00 00 00 00 00 90 15 00 00 00 00 00 00 3B 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 80 C8 EF 23 00 00 00 00 00 80 15 00 00 00 00 00 00 3B 00 00 00 0E 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76 50 41 52 54 01 00 00 00 48 05 24 00 00 00 00 00 E0 40 55 00 00 00 00 00 48 00 00 00 00 00 00 00 62 3E 4E A6 27 DF 73 98 83 C1 34 D5 B3 E3 39 9D BA 07 6F F7 FE 12 2A AC BA EE FF 07 B2 DD 17 CA 50 41 52 54 01 00 00 00 28 46 79 00 00 00 00 00 10 5D 9E 09 00 00 00 00 4F 00 00 00 00 00 00 00 53 28 78 11 D0 6F BE 9A 92 E6 4F 97 C0 C8 18 3C 57 96 F5 D9 C6 3D 40 56 64 7F 9A 29 13 26 8D 28 56 00 00 00 00 00 00 00 C9 20 54 AE 05 3C EB 99 80 4F 69 6D 3B F9 BF CF 4E EC 38 97 00 31 BD 82 1B D6 56 84 4B 55 19 9B E1 47 67 7A 90 C8 0F 76 F2 B7 74 FD 3E 63 9E 3E D1 BD AF 1B AD 88 25 DA C5 FC 4B 90 24 FB DD 0D 0B 59 68 01 FC AE B0 46 8F 2F 33 4F 79 BE 44 62 8C 33 E0 80 07 DA 77 43 DA BB DA 1D 53 03 E9 0E F1 C4 84 49 D7 04 D2 9F EE 91 D3 C5 45 BE D3 F1 F5 D1 7B CC AF 61 ED 9C 2A EE FA 23 EE 94 4C 02 9B AA 82 57 B5 48 35 ED 81 26 34 B1 44 30 6E 48 EC A6 B1 48 0C D6 0F D7 70 95 93 A6 ED 4E F4 DB 38 26 A9 80 85 F5 76 2C 1A F6 26 33 AC 03 5A 34 65 45 71 3E 59 3A 9F D1 A1 63 8A 86 87 AE 64 56 85 44 97 8F 9E E5 1D 16 92 32 9F 0A B5 FA 84 1C D4 A0 31 E7 71 D6 B9 43 22 A0 9A 0A 74 78 F9 21 AB 15 24 2C 1C 10 05 BF 45 ED B9 4B 47 05 94 B2 1F 8E 71 17 FE 34 CB DB A0 54 83 A0 EA B6 86 3A

SCLIVE4

4.1.0

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 B8 00 00 00 38 03 00 00 60 00 00 00 04 00 0A 00 01 00 00 00 38 03 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4A 43 31 31 53 00 4A 50 31 31 53 00 4A 50 32 30 00 4A 50 32 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 64 65 6E 6F 6E 2D 31 00 00 00 07 D0 E4 15 1E 00 00 00 0C C0 E4 15 24 00 00 00 11 D0 E4 15 2A 00 00 00 12 D0 E4 15 2F 00 00 00 42 4F 4F 54 00 00 00 80 40 04 00 00 00 00 00 00 8C FD 08 00 00 00 00 00 00 00 00 00 01 00 00 00 E2 60 9F 12 7B 28 28 6F BD 53 9E F4 13 F9 CE 64 C3 79 0D 59 94 65 07 CC DA 24 AA 26 70 7B 3C F2 42 4F 4F 54 00 00 00 80 D0 01 09 00 00 00 00 00 24 E2 08 00 00 00 00 00 00 00 00 00 02 00 00 00 30 D1 45 19 9A 1A 86 88 B3 43 3A 67 2A 6A E7 29 6C AA 62 13 9F E1 7B 1B C5 4A D7 75 DE 16 06 5E 42 4F 4F 54 00 00 00 80 F8 E3 11 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 04 00 00 00 63 45 8F 6B 8C 86 BB B6 24 AB 61 83 FA FF 77 6F 5D AD B0 06 43 48 78 D5 2A 15 DF 1A A4 DC 82 29 42 4F 4F 54 00 00 00 80 68 CA 1A 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 08 00 00 00 CC 1D 34 F6 25 20 DF 77 41 C1 07 6D 87 6C 49 A4 92 5F 85 27 D0 DC 3C 22 AF 73 98 C8 33 9A 36 FC 50 41 52 54 01 00 00 80 D8 B0 23 00 00 00 00 00 90 14 00 00 00 00 00 00 34 00 00 00 01 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 80 68 C5 23 00 00 00 00 00 CC 14 00 00 00 00 00 00 34 00 00 00 0E 00 00 00 C7 69 CE C1 08 D8 86 6A 8F 9D 59 60 C5 9E E5 F1 A6 F3 61 00 AE DC 67 DE 5E A3 24 83 D9 62 85 17 50 41 52 54 01 00 00 80 38 DA 23 00 00 00 00 00 90 15 00 00 00 00 00 00 3B 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 80 C8 EF 23 00 00 00 00 00 80 15 00 00 00 00 00 00 3B 00 00 00 0E 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76 50 41 52 54 01 00 00 00 48 05 24 00 00 00 00 00 84 40 55 00 00 00 00 00 48 00 00 00 00 00 00 00 FA 95 55 13 84 CC 99 FC F7 8E 5E 28 AB CE 3C 38 1C C4 58 22 A4 86 10 4F 00 CF B9 C4 E1 BF AE 9E 50 41 52 54 01 00 00 00 D0 45 79 00 00 00 00 00 DC 4A 9E 09 00 00 00 00 4F 00 00 00 00 00 00 00 0E 4D 81 C4 DB 95 D9 33 1D EF F9 CD D0 02 97 7A F9 53 6B 57 F0 96 43 76 56 92 53 BC CF EF 8B 8C 56 00 00 00 00 00 00 00 BD C1 66 25 1D A3 FD C7 2D 8D 92 76 42 25 A3 FD C0 F7 F6 BB 20 0E 2F 59 3C 6F 22 3B E8 BF E3 08 84 E1 B7 6C 01 74 E3 29 73 8D CD C3 8C 26 ED 01 EA 68 FD 1E 4D 7F 78 40 B0 10 96 5F 2C F8 D9 71 90 D4 43 FF DB BA 91 C5 04 7E 8F C9 0A E1 AF 27 D8 1A A7 1F 43 3D F6 34 78 B3 01 FB 05 82 42 7C 56 DE 13 C3 95 2B D9 5A A5 5C 75 BF B9 AB 18 47 BB 9B 10 BB A7 C6 05 31 B2 C5 69 16 55 8B 12 E3 4A 98 A8 C2 8E 8B 8B C8 A9 2F DF 6A 8B B9 3A B5 D5 33 F5 B5 73 60 85 E3 BA CD 8C 94 A2 28 FB 2C 85 52 32 68 EB 0D 34 9F 43 CD 2E 44 52 2F 35 A9 1E E6 80 B1 26 98 0F F1 72 16 33 68 86 18 84 C9 88 12 3A 6A A0 79 17 E8 7E FD 76 86 C0 C9 A1 DA E9 26 3E 26 BA 71 8A 46 C5 CF 96 EF CD 6C 41 85 6C 61 81 22 E9 65 F3 FE 6A F0 2C 94 E7 C3 A2 C2 8D EE 71 C0 A1 9E DC 4F 15 7E 51 C5 F4 28 6D CD

MIXSTREAMPROGO

4.1.0

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 90 00 00 00 A0 00 00 00 20 02 00 00 58 00 00 00 02 00 06 00 01 00 00 00 20 02 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4E 48 30 38 53 00 4E 48 31 30 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 6E 75 6D 61 72 6B 2D 31 00 00 00 00 00 3F 30 E4 15 1E 00 00 00 59 20 E4 15 24 00 00 00 42 4F 4F 54 00 00 00 80 28 03 00 00 00 00 00 00 E8 E7 08 00 00 00 00 00 00 00 00 00 01 00 00 00 55 DB B9 C0 AD 79 38 F0 91 8F 55 20 78 FC BB 46 AA 40 EA F1 48 95 A2 6E 8F 88 6E 98 A4 D9 67 AD 42 4F 4F 54 00 00 00 80 10 EB 08 00 00 00 00 00 A8 E8 08 00 00 00 00 00 00 00 00 00 02 00 00 00 10 D3 3D AE 85 89 48 89 26 7C 2D DA EA A2 6D F3 EE C6 22 90 9B F1 BE 44 3B 11 88 9F F2 4A F6 56 50 41 52 54 01 00 00 00 B8 D3 11 00 00 00 00 00 90 14 00 00 00 00 00 00 29 00 00 00 00 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 00 48 E8 11 00 00 00 00 00 90 15 00 00 00 00 00 00 30 00 00 00 00 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 00 D8 FD 11 00 00 00 00 00 EC 2C 55 00 00 00 00 00 3D 00 00 00 00 00 00 00 EC 7E A9 C0 92 FF 0B A3 4E 1B 19 49 ED 05 35 A6 BC EB 73 06 8E EA 61 25 FD 32 54 4C 5D AE 5F AD 50 41 52 54 01 00 00 00 C8 2A 67 00 00 00 00 00 E8 DE 9D 09 00 00 00 00 44 00 00 00 00 00 00 00 DA 4A 38 06 BD B4 D6 EC 60 28 5B 26 55 0F AA 83 B6 8B 72 85 02 47 45 62 F4 CD F7 09 B0 9C 45 2A 4B 00 00 00 00 00 00 00 37 DC 03 25 2A C8 8C 3D 7D 46 73 EA 4D 5D EF E5 E8 5A 1F D8 6F 33 05 84 FC 0E 31 68 EB 18 1D F3 F9 B2 51 83 10 15 BB EF 58 4D 4B 03 13 13 7A BE B7 F3 7E FA C2 B1 60 6B 52 4C A5 BE 4B 41 23 3F 79 E3 3E 44 11 BA 3C C7 03 03 0A 59 06 21 96 6F 20 06 F5 8B CC C6 C0 B5 B8 9A 0B 8F 1B 8E E2 33 F6 AE 8D 92 36 C3 88 9E 2A 03 A2 A5 ED 86 53 BC 52 12 75 43 D0 BD 8B 30 9A 6C AA B1 72 B5 64 7D 89 78 BF 63 12 69 86 E7 C7 12 95 24 2E 7D B3 AE 72 1E A0 DC 76 D6 75 6B 63 A7 43 5C 99 29 D8 AF B0 37 52 9C AA D9 65 DD 72 08 7F 8A E3 5C FB 42 88 14 24 16 AD 76 92 ED EA 66 C9 E9 0A 31 91 6D D1 A4 6F 40 50 DF D2 EE EF C2 B7 EC 55 1A A1 C8 7F 3E 62 8F 05 10 3D 10 6A 29 82 3E 56 B3 AF 78 28 82 A0 DB E3 67 B9 63 6B 28 E4 A1 15 D7 BE 94 F1 BF 42 51 78 08 D4 49 62 18 0F D6 22 F6 6C C8

MIXSTREAMPROPLUS

4.1.0

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 90 00 00 00 A0 00 00 00 20 02 00 00 58 00 00 00 02 00 06 00 01 00 00 00 20 02 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4E 48 30 38 53 00 4E 48 31 30 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 6E 75 6D 61 72 6B 2D 31 00 00 00 00 00 3F 30 E4 15 1E 00 00 00 59 20 E4 15 24 00 00 00 42 4F 4F 54 00 00 00 80 28 03 00 00 00 00 00 00 E8 E7 08 00 00 00 00 00 00 00 00 00 01 00 00 00 55 DB B9 C0 AD 79 38 F0 91 8F 55 20 78 FC BB 46 AA 40 EA F1 48 95 A2 6E 8F 88 6E 98 A4 D9 67 AD 42 4F 4F 54 00 00 00 80 10 EB 08 00 00 00 00 00 A8 E8 08 00 00 00 00 00 00 00 00 00 02 00 00 00 10 D3 3D AE 85 89 48 89 26 7C 2D DA EA A2 6D F3 EE C6 22 90 9B F1 BE 44 3B 11 88 9F F2 4A F6 56 50 41 52 54 01 00 00 00 B8 D3 11 00 00 00 00 00 90 14 00 00 00 00 00 00 29 00 00 00 00 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 00 48 E8 11 00 00 00 00 00 90 15 00 00 00 00 00 00 30 00 00 00 00 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 00 D8 FD 11 00 00 00 00 00 C0 2C 55 00 00 00 00 00 3D 00 00 00 00 00 00 00 6B 0F AE D3 13 1C FD 39 6B 66 7C 01 FC 30 8D A1 52 1F 76 C8 32 A6 1D A2 31 5D 7E 20 14 8D AA 13 50 41 52 54 01 00 00 00 98 2A 67 00 00 00 00 00 58 F2 9D 09 00 00 00 00 44 00 00 00 00 00 00 00 52 38 31 87 1C C3 94 30 5E C6 29 6C C5 6B 55 C0 BC 52 98 D4 E5 77 D3 6A 77 81 FA D0 1E 8A F4 D6 4B 00 00 00 00 00 00 00 9A CF 53 D8 98 41 54 6B 1C 0D 5A F5 C8 C9 89 E5 82 98 41 C1 79 16 12 5F 18 E1 CC 94 80 30 0F E4 CB EC 32 A6 B0 F8 E1 03 4C 26 EB D2 7C B7 E7 66 C5 B6 26 2C E4 F3 BE 44 9E E8 C1 2E A7 C4 29 C0 92 96 D9 5B 49 B4 D9 6E 79 37 90 21 22 00 E0 D9 C6 FD E1 61 80 79 73 07 46 2A DA 4C 41 60 8B 86 1B 54 41 01 DC F8 18 18 6C 10 1A 2E 0E D6 D5 A2 CB B9 C8 5D 75 15 94 A7 EF DB 4A 0A BF 4A 0F D9 57 06 6D 67 B0 9E 8F 22 2C F2 04 30 18 24 9A 06 EA B2 49 48 D9 87 4A 13 FD 22 12 91 D6 FB 2C EF BF A9 43 AD C2 5C 40 62 C3 58 A6 AD A7 A3 D4 2B 96 EB 67 D0 55 E5 DB 2C 4B B8 16 82 DB 5F 76 59 16 75 02 28 8B 0D 7E 40 CB 45 A4 0F BB D8 71 49 27 51 1D 8B 95 25 12 79 07 1E E0 6C C0 47 64 8C 76 27 71 8B 3B 73 EB AC C6 9A 90 89 09 86 19 72 F6 EC 3A B0 9B BA 74 B2 F4 E0 64 D2 9A 22 82 08

HeadRush Core

3.2

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 A0 00 00 00 E0 01 00 00 60 00 00 00 01 00 05 00 02 00 00 00 E0 01 00 00 01 00 00 00 0A 00 00 00 00 53 4E 41 50 53 48 4F 54 00 48 56 30 31 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 48 56 30 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 74 65 73 74 2D 68 65 61 64 72 75 73 68 00 68 65 61 64 72 75 73 68 2D 31 00 00 00 00 19 30 63 07 1D 00 00 00 42 4F 4F 54 00 00 00 00 F0 03 00 00 00 00 00 00 94 D5 08 00 00 00 00 00 00 00 00 00 00 00 00 00 4D 37 5D 1C 89 FA A9 CD 97 79 15 B9 69 D8 B0 6B 18 87 59 ED 48 54 4A 1B BC 9D 7F 4F 82 57 FB D2 50 41 52 54 01 00 00 00 88 D9 08 00 00 00 00 00 18 21 04 00 00 00 00 00 22 00 00 00 00 00 00 00 E6 A6 F9 71 86 DB 8D 02 C2 47 39 CF 78 6D E6 5D 99 E4 11 B9 19 9A 16 84 A7 A8 80 A0 69 08 7A DD 50 41 52 54 01 00 00 00 A0 FA 0C 00 00 00 00 00 8C 28 04 00 00 00 00 00 29 00 00 00 00 00 00 00 B4 71 81 86 0A 3F 03 71 DF 5C AF CB 2C D1 28 54 4C 10 F4 F5 5B DE 32 26 B4 04 74 37 0E 14 EA 00 50 41 52 54 01 00 00 00 30 23 11 00 00 00 00 00 A4 6A 55 00 00 00 00 00 36 00 00 00 00 00 00 00 58 5E 62 E4 1E AB A4 43 41 CC F2 C1 53 FC E7 EA 9A 1B E6 C0 94 2D D8 A3 A8 03 DE A2 82 7E 43 5E 50 41 52 54 01 00 00 00 D8 8D 66 00 00 00 00 00 DC 49 3F 09 00 00 00 00 3D 00 00 00 00 00 00 00 12 5B E8 78 A6 8A 37 0C 89 0D C7 1D E5 47 E9 DE B7 78 6D 2F A6 DA 6C 1E 51 87 28 16 21 7F 5E E2 44 00 00 00 00 00 00 00 23 42 51 C7 4D 77 64 FA 9C D1 17 91 2A C6 B2 DE DB 32 2B D5 B0 9B 40 AD 6E 9F F8 B0 C5 A7 E9 A7 B9 9A AA B0 6E 0C 14 BB 78 02 FB F6 FD 87 9E 5E 4C 95 D0 D2 A0 30 D7 D6 05 CB 6D 04 E5 C4 CE C0 48 BC B7 DB 92 3B F6 92 66 23 D8 08 C0 FB AF 52 D0 93 EE 92 34 B1 A4 32 17 34 D6 9D 58 25 C8 17 C0 ED 20 C3 53 58 D1 D3 1D 06 B9 F0 F1 D7 9D C9 5C AB 74 C4 D1 8B 86 A1 00 EB 62 C6 19 13 C9 68 F0 D0 C1 3C 03 6A 60 37 F2 71 55 22 1A 15 88 CA 7A C2 9B 91 F6 E2 05 F4 41 5F CE D9 56 25 36 D7 AD 66 BE 8C DC 11 93 D6 16 24 2E 92 16 5D BB 0E F3 BC 10 4E 36 DE 27 29 53 B3 9D BB CB F3 92 EC 6E A7 D9 48 1A 01 71 FA B6 BB 14 99 89 B8 2C 81 98 C7 EE 44 85 26 48 46 46 1E CE C9 3F 80 DA A7 43 57 3A 46 DD 04 87 6B 42 72 13 A9 58 74 06 29 57 B0 CD E6 FA D1 D2 39 C3 6F DD 39 86 6D E6 F6 52 00 00 00 00 00 00 00 15 D6 83 91 23 9C 9E 21 A5 2D D8 9B C5 92 07 CF 2D 6C DC 65 50 9E 34 70 05 5F 9E E9 49 44 71 FF 02 E7 3F 88 ED B8 63 88 EF CF 17 79 04 39 8D 89 99 7D 6E 31 F4 02 2B FC 7D 3E 49 CA F9 58 E6 33 64 D1 B8 47 52 03 58 67 FF 24 A7 83 F0 D2 91 67 C2 D8 10 48 B8 91 FA AA 49 55 6F 54 9B 9D B2 33 A8 AF 27 A9 D0 B2 04 9E D9 E3 92 FD 28 F3 C3 86 7B F5 0F 29 75 56 75 89 0E 5C 6E 82 2A BB 46 52 9F 3A 81 99 A0 24 90 25 8F 86 36 0F D9 B2 F7 AD E4 73 B2 8A 6D E4 6B 1D 84 D6 BA CE 29 CE E9 19 79 CD C8 F2 03 01 06 56 F8 B1 63 23 2E 8F 98 E4 8C 58 C3 5A C9 41 67 DC 2D FB A8 21 6D 35 AB 75 40 F6 7E 17 E6 10 D3 76 22 C3 C7 AB 00 A5 21 A1 38 A6 AF 4F C0 1D 77 63 B7 98 C3 26 C3 11 9B 35 6B 5E D6 BE F0 35 9E 03 0A BE 3C 61 55 B9 B3 2F C2 B4 36 54 E1 7D 3E FF 94 D7 1B CB 2A EC 4A 63

HeadRush Prime

3.2

41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 A0 00 00 00 E0 01 00 00 60 00 00 00 01 00 05 00 02 00 00 00 E0 01 00 00 01 00 00 00 0A 00 00 00 00 53 4E 41 50 53 48 4F 54 00 48 47 30 36 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 48 47 30 36 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 74 65 73 74 2D 68 65 61 64 72 75 73 68 00 68 65 61 64 72 75 73 68 2D 31 00 00 00 00 1B 30 63 07 1D 00 00 00 42 4F 4F 54 00 00 00 00 F0 03 00 00 00 00 00 00 BC D5 08 00 00 00 00 00 00 00 00 00 00 00 00 00 37 C2 75 FC 74 8B 58 E0 A7 83 C3 7F 70 D8 E5 E4 CF 48 8F EA 8A 2E F3 80 03 DE EA D7 56 5B C7 0B 50 41 52 54 01 00 00 00 B0 D9 08 00 00 00 00 00 5C 21 04 00 00 00 00 00 22 00 00 00 00 00 00 00 E5 C0 2B BF 72 A7 47 79 5E BD ED ED FE AA C7 63 5B CC E9 BA 7D 59 B1 58 62 77 0C 83 DD 85 9B DB 50 41 52 54 01 00 00 00 10 FB 0C 00 00 00 00 00 60 28 04 00 00 00 00 00 29 00 00 00 00 00 00 00 CC 87 F9 19 AC 6F 04 17 DC 7F AA 8A 41 CA D0 29 EE 4E 5E 7C F4 0E EC D8 54 06 A4 C7 84 B1 4F C8 50 41 52 54 01 00 00 00 70 23 11 00 00 00 00 00 20 FE 5A 00 00 00 00 00 36 00 00 00 00 00 00 00 57 23 F5 34 71 DA 67 B1 FD DE 39 2F EE 1D 42 62 0B CC 44 9E A1 16 81 E2 A6 39 CF F2 4B 22 22 68 50 41 52 54 01 00 00 00 90 21 6C 00 00 00 00 00 F8 66 51 09 00 00 00 00 3D 00 00 00 00 00 00 00 CC 1B 1E AC 57 E1 44 FC 49 59 41 DB 00 B2 76 8D C4 69 2E 92 F4 2B C8 60 4B 6F 6B CC A8 E9 B4 CA 44 00 00 00 00 00 00 00 0B 49 0A 9D AB 98 E7 F1 30 74 23 79 4D EB F5 D3 DB D9 80 67 1B 4D 78 6F 1B EA 9A 8E D0 54 DE 7F 01 4E 38 8A 3C 27 67 C4 EB 49 EE EE 20 5A 7C 8D 1C 47 AB C3 53 94 48 50 2E 68 02 B0 09 7A C3 C0 D3 7F C3 DD 6B 42 4F EA 4E 3D 12 32 9B AA 6B CB 3F 47 F0 AB 48 2D 0E F0 E8 20 80 8A 94 41 6C F8 32 E9 F3 0A 82 15 B0 C1 70 A8 FE 65 95 C8 55 47 23 8A 79 B5 E9 D2 5C 46 53 BC 09 CC 88 AA 7C 2A 3D F2 D3 49 11 3F CC BD 36 70 14 B8 85 E5 AA 9E 49 A5 4A 00 16 FF 4C 25 CF 19 A6 F7 1A E9 7C A6 2F A5 0E 59 9C 9F CF 24 4F 01 4A 13 B3 06 A2 2E 22 35 B8 E2 92 46 5F 5B 51 AD 43 09 11 C0 37 BA A4 36 35 03 A1 65 D0 99 EB F6 76 C2 0B CD 43 19 8C C5 FD 8B 74 9C 62 96 61 6E 59 FE B5 22 2B 1E B9 0A FB B5 FA 43 CC 92 49 99 90 B4 8B F8 AB FF 00 37 C9 15 BF 6D FC 2B 5F 65 8C C6 24 38 7E FF 52 00 00 00 00 00 00 00 20 3D 58 F4 8B 42 83 81 58 B0 71 A2 0A 43 2B 64 2F DB 9D A6 65 93 8A 43 36 3D 25 F7 99 6C 11 71 7B 43 08 6C 70 B8 0C DD 3F 50 2E 5B 16 10 80 61 F3 4E D1 14 59 3D 97 36 37 0C ED 11 A7 D3 EB CE 17 A0 88 1D BD 53 37 3C 39 4D F2 8E E3 74 72 B9 F3 A8 2D 74 7C A3 25 FD DF 28 9E 09 0D 35 65 BB E3 F4 83 FF 1C 2A 0C FF 11 8B C5 CA 34 3E 1D C6 4C 3A 94 CF CF DB A6 4A 8C 56 8A 8D 26 7A DC BE 8A F1 50 BC AB ED C9 18 46 E8 E1 29 D6 64 E0 18 FD B1 C9 07 6B 52 E4 62 BC 52 B7 B6 C8 CE 6B 58 F7 41 AE D2 15 F4 A4 92 1B EF 10 58 4F 87 8E 46 E7 41 EC 0A 74 9C 44 10 81 55 DE DA BD 74 B9 0C A5 A5 3A 7C 5F 70 9D B9 FA 25 BE 21 CF 49 18 B3 48 F8 2C 35 A4 D8 83 A2 21 9D 2D 73 7B 48 0A BD E5 A7 25 97 43 B4 5D 80 65 20 30 20 7F 57 84 91 27 82 E5 9D 2F 04 44 EC B7 A0 61 7B B9 88 C5 7E

Header Value Descriptions

All of these start with the constant 41 5A 30 78 01, which decodes to AZ0x (the board model numbers that I've seen are AZ01 and AZ05).

Offset 0x39 up to the byte 0x00 contains the firmware version.

  • On Denon devices, I've seen 4.1.0, these likely have the software version for all updates.

  • On HeadRush devices, I've seen SNAPSHOT. This is likely their SVN's branch the build is produced from (not the software version).

Following the version (up to the next 0x00), we get the name of the update image:

  • HG06 upgrade image

  • HV01 upgrade image

  • EngineOS upgrade image

Following this, we get the model IDs of the devices this firmware update supports. This can be a number of strings (the number of these strings can be found at offset 0x24).

Partitions

Before retrieving the partitions, we need to look at a couple values at different offsets to determine the partition metadata layout in the firmware.

Offset

Description

0x18

The beginning address of the partitions

0x26

The number of partitions in the image

For example, PRIME4PLUS-3.1.0-Update.img contains:

Offset

Value

0x18

0xa8

0x26

0x09

This tells us that we need to go to 0xa8 to get the first partition's metadata. Partition's metadata is 0x40 in length, so we can read this into a buffer.

Since we know we have 9 partitions, we read this 9 times before we reach the end of all partitions' metadata.

Example partition metadata:

Partition

Metadata

1

42 4F 4F 54 00 00 00 80 F0 03 00 00 00 00 00 00 1C DC 08 00 00 00 00 00 00 00 00 00 01 00 00 00 3B 09 D8 3C C2 E1 4D 0F 1E 88 32 B8 EE E1 B9 24 23 49 D1 25 C7 6A 75 32 DB 1C E3 8D B3 1A 11 28

2

42 4F 4F 54 00 00 00 80 10 E0 08 00 00 00 00 00 34 C5 08 00 00 00 00 00 00 00 00 00 02 00 00 00 3F EE 62 5F F0 71 9F FA C0 3D 78 37 75 54 D9 5D 53 65 2D 34 C7 7C 90 92 2D F8 D6 37 5B 60 6C CC

3

42 4F 4F 54 00 00 00 80 48 A5 11 00 00 00 00 00 34 C5 08 00 00 00 00 00 00 00 00 00 04 00 00 00 A9 7F A5 37 05 8B 57 BA 06 92 8B 89 ED F9 BD 24 3B 13 05 BA 89 D0 A1 DC 70 28 F1 BD 06 AE DF 5D

4

50 41 52 54 01 00 00 80 80 6A 1A 00 00 00 00 00 B0 15 00 00 00 00 00 00 2E 00 00 00 01 00 00 00 51 7A F5 7F DF BE 27 76 8A B8 65 EE E2 A2 83 96 CB 0E 05 FA ED 11 CD 92 15 75 71 35 EF 7F 30 3A

5

50 41 52 54 01 00 00 80 30 80 1A 00 00 00 00 00 30 16 00 00 00 00 00 00 2E 00 00 00 06 00 00 00 04 E3 92 9C 06 72 E4 2A 13 41 4A D0 5C 37 53 1F 4F 7C 59 75 6D DC CD 20 91 EB 1E 4E 87 FE E4 02

6

50 41 52 54 01 00 00 80 60 96 1A 00 00 00 00 00 90 15 00 00 00 00 00 00 35 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36

7

50 41 52 54 01 00 00 80 F0 AB 1A 00 00 00 00 00 80 15 00 00 00 00 00 00 35 00 00 00 06 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76

8

50 41 52 54 01 00 00 00 70 C1 1A 00 00 00 00 00 38 EA 50 00 00 00 00 00 42 00 00 00 00 00 00 00 E6 0F D4 4F E6 84 4F 35 68 0D 93 2E 2A CB 32 62 F1 71 2F F4 24 94 78 62 D0 72 74 14 6E 4D AB 80

9

50 41 52 54 01 00 00 00 A8 AB 6B 00 00 00 00 00 F0 4C AA 0A 00 00 00 00 49 00 00 00 00 00 00 00 7D 28 81 86 29 42 A1 8D AD 50 21 39 C3 3C D8 4F 20 A0 D6 6B 1B 33 64 30 A0 33 9D 9F 37 CB 87 DA

The partition metadata that I have figured out the meaning of is as follows (offset is the offset from the beginning of the partition's metadata):

Offset

Description

0x0-0x3

BOOT or PART (probably whether this is a boot partition, or a normal one)

0x8-0xf

The address for the beginning of the partition table (in little endian)

0x10-0x17

The size of the partition data

0x18-0x1b

❔ Completely unknown

0x1c-0x1f

❔ Looks like it could be the partition number (partition # per U-Boot)

0x20-0x3f

❔ Likely the SHA256 of the partition data

Data

After removing the header from the file, dumpimage -l <image> on SCLIVE2-4.1.0-Update.img outputs:

FIT description: bootupd Created: Thu Sep 19 22:38:27 2024 Image 0 (idbloader) Description: idbloader Created: Thu Sep 19 22:38:27 2024 Type: Rockchip SD Boot Image Compression: uncompressed Data Size: 116736 Bytes = 114.00 KiB = 0.11 MiB Hash algo: sha256 Hash value: 583719bec0261b7d7e295aad48b6f90d9b105819a7573b449535d98ed572800e Image 1 (u-boot) Description: u-boot Created: Thu Sep 19 22:38:27 2024 Type: Kernel Image Compression: uncompressed Data Size: 470992 Bytes = 459.95 KiB = 0.45 MiB Architecture: ARM OS: U-Boot Load Address: unavailable Entry Point: unavailable Hash algo: sha256 Hash value: 21d7a7ca4d7732eea812aa871451c627d3070251c79a89997aecbe14ba9599a9 Default Configuration: 'config' Configuration 0 (config) Description: image Kernel: unavailable Sign algo: sha256,rsa2048:denon-1 Sign value: 95200a1436369735d87ddb3aa10c922a39921af1bede6232c8618248869d61f0fa85d8fd79582105f0ef42a508baf016aefd1445958d0ddc8591f5e00fa404c8b409c79edd3f42f8d38411a70a6a05a943a2da4a73a1789760d4a90ef46f67a54de571fe11a13aeb83b666a84f71ed4412f679942c6b247fb3aa1b140b79328050801850822cbe9753e77c53cedc425a624ef148e251e51cfe12043091c926bb460afbe9b4760f80eef2ef91db8b25672af5ba17fbf88b322fa5fcc1ef7fb0d33655964e7d3b1969bd79ea7b23debb326be6d12e2d0fcdaf04014f0f9b9114d547815c7a8fd636255e4ebd60f3876b9c6340fd2724a734c17429ec065a4b29d4 Timestamp: Thu Sep 19 22:38:27 2024

The rootfs can be extracted with binwalk -eM <image>. The rootfs will be in a subfolder in extractions somewhere.

Example locations:

Device

Firmware Version

rootfs path

SC Live 2

4.1.0

extractions/SCLIVE2-4.1.0-Update.img.extracted/794628/decompressed.bin.extracted/0/rootfs/

SC Live 4

4.1.0

extractions/PRIME4PLUS-4.1.0-Update.img.extracted/7945B0/decompressed.bin.extracted/0/rootfs/

HeadRush Core

3.2

extractions/core-3.2.img.extracted/668DD8/decompressed.bin.extracted/0/rootfs/

HeadRush Prime

3.2

extractions/prime-3.2.img.extracted/6C2190/decompressed.bin.extracted/0/rootfs/boot/

Prime 4 Plus

4.1.0

extractions/PRIME4PLUS-4.1.0-Update.img.extracted/7945B0/decompressed.bin.extracted/0/rootfs/

Prime Go +

4.1.0

extractions/PRIMEGOPLUS-4.1.0-Update.img.extracted/7945D0/decompressed.bin.extracted/0/rootfs/

Mixstream Pro Go

4.1.0

extractions/MIXSTREAMPROGO-4.1.0-Update.img.extracted/672AC8/decompressed.bin.extracted/0/rootfs/

Mixstream Pro +

4.1.0

extractions/MIXSTREAMPROPLUS-4.1.0-Update.img.extracted/672A98/decompressed.bin.extracted/0/rootfs/

Last modified: 18 November 2024