Signed Firmware Layout

Many of the newer inMusic devices have switched from using unsigned firmware updates to using signed firmware updates. This prevents modifications to the firmware updates unfortunately (although you can likely still modify the OS on the device and boot into the modifications). Whether it will boot using a modified rootfs is untested.

Extracting these images is a solved problem — every partition, rootfs included, can be pulled out directly (see Extracting). What remains blocked is rebuilding an installable update, because of the signature block described in Signature.

AZ0x is a standalone container format, not a header bolted onto a flattened device tree. 0xD00DFEED does appear inside these files, but as the payload of the BOOT partitions — each of which is its own FIT image. The rootfs is a separate, xz-compressed partition and is not reachable by parsing that device tree.

Header Values

Device	Version	Header (Hex)
SCLIVE2	`4.1.0`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 B8 00 00 00 38 03 00 00 60 00 00 00 04 00 0A 00 01 00 00 00 38 03 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4A 43 31 31 53 00 4A 50 31 31 53 00 4A 50 32 30 00 4A 50 32 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 64 65 6E 6F 6E 2D 31 00 00 00 07 D0 E4 15 1E 00 00 00 0C C0 E4 15 24 00 00 00 11 D0 E4 15 2A 00 00 00 12 D0 E4 15 2F 00 00 00 42 4F 4F 54 00 00 00 80 40 04 00 00 00 00 00 00 8C FD 08 00 00 00 00 00 00 00 00 00 01 00 00 00 E2 60 9F 12 7B 28 28 6F BD 53 9E F4 13 F9 CE 64 C3 79 0D 59 94 65 07 CC DA 24 AA 26 70 7B 3C F2 42 4F 4F 54 00 00 00 80 D0 01 09 00 00 00 00 00 24 E2 08 00 00 00 00 00 00 00 00 00 02 00 00 00 30 D1 45 19 9A 1A 86 88 B3 43 3A 67 2A 6A E7 29 6C AA 62 13 9F E1 7B 1B C5 4A D7 75 DE 16 06 5E 42 4F 4F 54 00 00 00 80 F8 E3 11 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 04 00 00 00 63 45 8F 6B 8C 86 BB B6 24 AB 61 83 FA FF 77 6F 5D AD B0 06 43 48 78 D5 2A 15 DF 1A A4 DC 82 29 42 4F 4F 54 00 00 00 80 68 CA 1A 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 08 00 00 00 CC 1D 34 F6 25 20 DF 77 41 C1 07 6D 87 6C 49 A4 92 5F 85 27 D0 DC 3C 22 AF 73 98 C8 33 9A 36 FC 50 41 52 54 01 00 00 80 D8 B0 23 00 00 00 00 00 90 14 00 00 00 00 00 00 34 00 00 00 01 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 80 68 C5 23 00 00 00 00 00 CC 14 00 00 00 00 00 00 34 00 00 00 0E 00 00 00 C7 69 CE C1 08 D8 86 6A 8F 9D 59 60 C5 9E E5 F1 A6 F3 61 00 AE DC 67 DE 5E A3 24 83 D9 62 85 17 50 41 52 54 01 00 00 80 38 DA 23 00 00 00 00 00 90 15 00 00 00 00 00 00 3B 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 80 C8 EF 23 00 00 00 00 00 80 15 00 00 00 00 00 00 3B 00 00 00 0E 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76 50 41 52 54 01 00 00 00 48 05 24 00 00 00 00 00 E0 40 55 00 00 00 00 00 48 00 00 00 00 00 00 00 62 3E 4E A6 27 DF 73 98 83 C1 34 D5 B3 E3 39 9D BA 07 6F F7 FE 12 2A AC BA EE FF 07 B2 DD 17 CA 50 41 52 54 01 00 00 00 28 46 79 00 00 00 00 00 10 5D 9E 09 00 00 00 00 4F 00 00 00 00 00 00 00 53 28 78 11 D0 6F BE 9A 92 E6 4F 97 C0 C8 18 3C 57 96 F5 D9 C6 3D 40 56 64 7F 9A 29 13 26 8D 28 56 00 00 00 00 00 00 00 C9 20 54 AE 05 3C EB 99 80 4F 69 6D 3B F9 BF CF 4E EC 38 97 00 31 BD 82 1B D6 56 84 4B 55 19 9B E1 47 67 7A 90 C8 0F 76 F2 B7 74 FD 3E 63 9E 3E D1 BD AF 1B AD 88 25 DA C5 FC 4B 90 24 FB DD 0D 0B 59 68 01 FC AE B0 46 8F 2F 33 4F 79 BE 44 62 8C 33 E0 80 07 DA 77 43 DA BB DA 1D 53 03 E9 0E F1 C4 84 49 D7 04 D2 9F EE 91 D3 C5 45 BE D3 F1 F5 D1 7B CC AF 61 ED 9C 2A EE FA 23 EE 94 4C 02 9B AA 82 57 B5 48 35 ED 81 26 34 B1 44 30 6E 48 EC A6 B1 48 0C D6 0F D7 70 95 93 A6 ED 4E F4 DB 38 26 A9 80 85 F5 76 2C 1A F6 26 33 AC 03 5A 34 65 45 71 3E 59 3A 9F D1 A1 63 8A 86 87 AE 64 56 85 44 97 8F 9E E5 1D 16 92 32 9F 0A B5 FA 84 1C D4 A0 31 E7 71 D6 B9 43 22 A0 9A 0A 74 78 F9 21 AB 15 24 2C 1C 10 05 BF 45 ED B9 4B 47 05 94 B2 1F 8E 71 17 FE 34 CB DB A0 54 83 A0 EA B6 86 3A
SCLIVE4	`4.1.0`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 B8 00 00 00 38 03 00 00 60 00 00 00 04 00 0A 00 01 00 00 00 38 03 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4A 43 31 31 53 00 4A 50 31 31 53 00 4A 50 32 30 00 4A 50 32 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 64 65 6E 6F 6E 2D 31 00 00 00 07 D0 E4 15 1E 00 00 00 0C C0 E4 15 24 00 00 00 11 D0 E4 15 2A 00 00 00 12 D0 E4 15 2F 00 00 00 42 4F 4F 54 00 00 00 80 40 04 00 00 00 00 00 00 8C FD 08 00 00 00 00 00 00 00 00 00 01 00 00 00 E2 60 9F 12 7B 28 28 6F BD 53 9E F4 13 F9 CE 64 C3 79 0D 59 94 65 07 CC DA 24 AA 26 70 7B 3C F2 42 4F 4F 54 00 00 00 80 D0 01 09 00 00 00 00 00 24 E2 08 00 00 00 00 00 00 00 00 00 02 00 00 00 30 D1 45 19 9A 1A 86 88 B3 43 3A 67 2A 6A E7 29 6C AA 62 13 9F E1 7B 1B C5 4A D7 75 DE 16 06 5E 42 4F 4F 54 00 00 00 80 F8 E3 11 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 04 00 00 00 63 45 8F 6B 8C 86 BB B6 24 AB 61 83 FA FF 77 6F 5D AD B0 06 43 48 78 D5 2A 15 DF 1A A4 DC 82 29 42 4F 4F 54 00 00 00 80 68 CA 1A 00 00 00 00 00 6C E6 08 00 00 00 00 00 00 00 00 00 08 00 00 00 CC 1D 34 F6 25 20 DF 77 41 C1 07 6D 87 6C 49 A4 92 5F 85 27 D0 DC 3C 22 AF 73 98 C8 33 9A 36 FC 50 41 52 54 01 00 00 80 D8 B0 23 00 00 00 00 00 90 14 00 00 00 00 00 00 34 00 00 00 01 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 80 68 C5 23 00 00 00 00 00 CC 14 00 00 00 00 00 00 34 00 00 00 0E 00 00 00 C7 69 CE C1 08 D8 86 6A 8F 9D 59 60 C5 9E E5 F1 A6 F3 61 00 AE DC 67 DE 5E A3 24 83 D9 62 85 17 50 41 52 54 01 00 00 80 38 DA 23 00 00 00 00 00 90 15 00 00 00 00 00 00 3B 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 80 C8 EF 23 00 00 00 00 00 80 15 00 00 00 00 00 00 3B 00 00 00 0E 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76 50 41 52 54 01 00 00 00 48 05 24 00 00 00 00 00 84 40 55 00 00 00 00 00 48 00 00 00 00 00 00 00 FA 95 55 13 84 CC 99 FC F7 8E 5E 28 AB CE 3C 38 1C C4 58 22 A4 86 10 4F 00 CF B9 C4 E1 BF AE 9E 50 41 52 54 01 00 00 00 D0 45 79 00 00 00 00 00 DC 4A 9E 09 00 00 00 00 4F 00 00 00 00 00 00 00 0E 4D 81 C4 DB 95 D9 33 1D EF F9 CD D0 02 97 7A F9 53 6B 57 F0 96 43 76 56 92 53 BC CF EF 8B 8C 56 00 00 00 00 00 00 00 BD C1 66 25 1D A3 FD C7 2D 8D 92 76 42 25 A3 FD C0 F7 F6 BB 20 0E 2F 59 3C 6F 22 3B E8 BF E3 08 84 E1 B7 6C 01 74 E3 29 73 8D CD C3 8C 26 ED 01 EA 68 FD 1E 4D 7F 78 40 B0 10 96 5F 2C F8 D9 71 90 D4 43 FF DB BA 91 C5 04 7E 8F C9 0A E1 AF 27 D8 1A A7 1F 43 3D F6 34 78 B3 01 FB 05 82 42 7C 56 DE 13 C3 95 2B D9 5A A5 5C 75 BF B9 AB 18 47 BB 9B 10 BB A7 C6 05 31 B2 C5 69 16 55 8B 12 E3 4A 98 A8 C2 8E 8B 8B C8 A9 2F DF 6A 8B B9 3A B5 D5 33 F5 B5 73 60 85 E3 BA CD 8C 94 A2 28 FB 2C 85 52 32 68 EB 0D 34 9F 43 CD 2E 44 52 2F 35 A9 1E E6 80 B1 26 98 0F F1 72 16 33 68 86 18 84 C9 88 12 3A 6A A0 79 17 E8 7E FD 76 86 C0 C9 A1 DA E9 26 3E 26 BA 71 8A 46 C5 CF 96 EF CD 6C 41 85 6C 61 81 22 E9 65 F3 FE 6A F0 2C 94 E7 C3 A2 C2 8D EE 71 C0 A1 9E DC 4F 15 7E 51 C5 F4 28 6D CD
MIXSTREAMPROGO	`4.1.0`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 90 00 00 00 A0 00 00 00 20 02 00 00 58 00 00 00 02 00 06 00 01 00 00 00 20 02 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4E 48 30 38 53 00 4E 48 31 30 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 6E 75 6D 61 72 6B 2D 31 00 00 00 00 00 3F 30 E4 15 1E 00 00 00 59 20 E4 15 24 00 00 00 42 4F 4F 54 00 00 00 80 28 03 00 00 00 00 00 00 E8 E7 08 00 00 00 00 00 00 00 00 00 01 00 00 00 55 DB B9 C0 AD 79 38 F0 91 8F 55 20 78 FC BB 46 AA 40 EA F1 48 95 A2 6E 8F 88 6E 98 A4 D9 67 AD 42 4F 4F 54 00 00 00 80 10 EB 08 00 00 00 00 00 A8 E8 08 00 00 00 00 00 00 00 00 00 02 00 00 00 10 D3 3D AE 85 89 48 89 26 7C 2D DA EA A2 6D F3 EE C6 22 90 9B F1 BE 44 3B 11 88 9F F2 4A F6 56 50 41 52 54 01 00 00 00 B8 D3 11 00 00 00 00 00 90 14 00 00 00 00 00 00 29 00 00 00 00 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 00 48 E8 11 00 00 00 00 00 90 15 00 00 00 00 00 00 30 00 00 00 00 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 00 D8 FD 11 00 00 00 00 00 EC 2C 55 00 00 00 00 00 3D 00 00 00 00 00 00 00 EC 7E A9 C0 92 FF 0B A3 4E 1B 19 49 ED 05 35 A6 BC EB 73 06 8E EA 61 25 FD 32 54 4C 5D AE 5F AD 50 41 52 54 01 00 00 00 C8 2A 67 00 00 00 00 00 E8 DE 9D 09 00 00 00 00 44 00 00 00 00 00 00 00 DA 4A 38 06 BD B4 D6 EC 60 28 5B 26 55 0F AA 83 B6 8B 72 85 02 47 45 62 F4 CD F7 09 B0 9C 45 2A 4B 00 00 00 00 00 00 00 37 DC 03 25 2A C8 8C 3D 7D 46 73 EA 4D 5D EF E5 E8 5A 1F D8 6F 33 05 84 FC 0E 31 68 EB 18 1D F3 F9 B2 51 83 10 15 BB EF 58 4D 4B 03 13 13 7A BE B7 F3 7E FA C2 B1 60 6B 52 4C A5 BE 4B 41 23 3F 79 E3 3E 44 11 BA 3C C7 03 03 0A 59 06 21 96 6F 20 06 F5 8B CC C6 C0 B5 B8 9A 0B 8F 1B 8E E2 33 F6 AE 8D 92 36 C3 88 9E 2A 03 A2 A5 ED 86 53 BC 52 12 75 43 D0 BD 8B 30 9A 6C AA B1 72 B5 64 7D 89 78 BF 63 12 69 86 E7 C7 12 95 24 2E 7D B3 AE 72 1E A0 DC 76 D6 75 6B 63 A7 43 5C 99 29 D8 AF B0 37 52 9C AA D9 65 DD 72 08 7F 8A E3 5C FB 42 88 14 24 16 AD 76 92 ED EA 66 C9 E9 0A 31 91 6D D1 A4 6F 40 50 DF D2 EE EF C2 B7 EC 55 1A A1 C8 7F 3E 62 8F 05 10 3D 10 6A 29 82 3E 56 B3 AF 78 28 82 A0 DB E3 67 B9 63 6B 28 E4 A1 15 D7 BE 94 F1 BF 42 51 78 08 D4 49 62 18 0F D6 22 F6 6C C8
MIXSTREAMPROPLUS	`4.1.0`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 90 00 00 00 A0 00 00 00 20 02 00 00 58 00 00 00 02 00 06 00 01 00 00 00 20 02 00 00 01 00 00 00 07 00 00 00 00 34 2E 31 2E 30 00 45 6E 67 69 6E 65 4F 53 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 4E 48 30 38 53 00 4E 48 31 30 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 6E 75 6D 61 72 6B 2D 31 00 00 00 00 00 3F 30 E4 15 1E 00 00 00 59 20 E4 15 24 00 00 00 42 4F 4F 54 00 00 00 80 28 03 00 00 00 00 00 00 E8 E7 08 00 00 00 00 00 00 00 00 00 01 00 00 00 55 DB B9 C0 AD 79 38 F0 91 8F 55 20 78 FC BB 46 AA 40 EA F1 48 95 A2 6E 8F 88 6E 98 A4 D9 67 AD 42 4F 4F 54 00 00 00 80 10 EB 08 00 00 00 00 00 A8 E8 08 00 00 00 00 00 00 00 00 00 02 00 00 00 10 D3 3D AE 85 89 48 89 26 7C 2D DA EA A2 6D F3 EE C6 22 90 9B F1 BE 44 3B 11 88 9F F2 4A F6 56 50 41 52 54 01 00 00 00 B8 D3 11 00 00 00 00 00 90 14 00 00 00 00 00 00 29 00 00 00 00 00 00 00 74 F3 C1 FA 67 FA 1C E4 63 A3 EF 86 59 19 39 15 93 20 D0 38 D6 0D CA D7 D2 02 72 E4 CA 59 07 AB 50 41 52 54 01 00 00 00 48 E8 11 00 00 00 00 00 90 15 00 00 00 00 00 00 30 00 00 00 00 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36 50 41 52 54 01 00 00 00 D8 FD 11 00 00 00 00 00 C0 2C 55 00 00 00 00 00 3D 00 00 00 00 00 00 00 6B 0F AE D3 13 1C FD 39 6B 66 7C 01 FC 30 8D A1 52 1F 76 C8 32 A6 1D A2 31 5D 7E 20 14 8D AA 13 50 41 52 54 01 00 00 00 98 2A 67 00 00 00 00 00 58 F2 9D 09 00 00 00 00 44 00 00 00 00 00 00 00 52 38 31 87 1C C3 94 30 5E C6 29 6C C5 6B 55 C0 BC 52 98 D4 E5 77 D3 6A 77 81 FA D0 1E 8A F4 D6 4B 00 00 00 00 00 00 00 9A CF 53 D8 98 41 54 6B 1C 0D 5A F5 C8 C9 89 E5 82 98 41 C1 79 16 12 5F 18 E1 CC 94 80 30 0F E4 CB EC 32 A6 B0 F8 E1 03 4C 26 EB D2 7C B7 E7 66 C5 B6 26 2C E4 F3 BE 44 9E E8 C1 2E A7 C4 29 C0 92 96 D9 5B 49 B4 D9 6E 79 37 90 21 22 00 E0 D9 C6 FD E1 61 80 79 73 07 46 2A DA 4C 41 60 8B 86 1B 54 41 01 DC F8 18 18 6C 10 1A 2E 0E D6 D5 A2 CB B9 C8 5D 75 15 94 A7 EF DB 4A 0A BF 4A 0F D9 57 06 6D 67 B0 9E 8F 22 2C F2 04 30 18 24 9A 06 EA B2 49 48 D9 87 4A 13 FD 22 12 91 D6 FB 2C EF BF A9 43 AD C2 5C 40 62 C3 58 A6 AD A7 A3 D4 2B 96 EB 67 D0 55 E5 DB 2C 4B B8 16 82 DB 5F 76 59 16 75 02 28 8B 0D 7E 40 CB 45 A4 0F BB D8 71 49 27 51 1D 8B 95 25 12 79 07 1E E0 6C C0 47 64 8C 76 27 71 8B 3B 73 EB AC C6 9A 90 89 09 86 19 72 F6 EC 3A B0 9B BA 74 B2 F4 E0 64 D2 9A 22 82 08
HeadRush Core	`3.2`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 A0 00 00 00 E0 01 00 00 60 00 00 00 01 00 05 00 02 00 00 00 E0 01 00 00 01 00 00 00 0A 00 00 00 00 53 4E 41 50 53 48 4F 54 00 48 56 30 31 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 48 56 30 31 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 74 65 73 74 2D 68 65 61 64 72 75 73 68 00 68 65 61 64 72 75 73 68 2D 31 00 00 00 00 19 30 63 07 1D 00 00 00 42 4F 4F 54 00 00 00 00 F0 03 00 00 00 00 00 00 94 D5 08 00 00 00 00 00 00 00 00 00 00 00 00 00 4D 37 5D 1C 89 FA A9 CD 97 79 15 B9 69 D8 B0 6B 18 87 59 ED 48 54 4A 1B BC 9D 7F 4F 82 57 FB D2 50 41 52 54 01 00 00 00 88 D9 08 00 00 00 00 00 18 21 04 00 00 00 00 00 22 00 00 00 00 00 00 00 E6 A6 F9 71 86 DB 8D 02 C2 47 39 CF 78 6D E6 5D 99 E4 11 B9 19 9A 16 84 A7 A8 80 A0 69 08 7A DD 50 41 52 54 01 00 00 00 A0 FA 0C 00 00 00 00 00 8C 28 04 00 00 00 00 00 29 00 00 00 00 00 00 00 B4 71 81 86 0A 3F 03 71 DF 5C AF CB 2C D1 28 54 4C 10 F4 F5 5B DE 32 26 B4 04 74 37 0E 14 EA 00 50 41 52 54 01 00 00 00 30 23 11 00 00 00 00 00 A4 6A 55 00 00 00 00 00 36 00 00 00 00 00 00 00 58 5E 62 E4 1E AB A4 43 41 CC F2 C1 53 FC E7 EA 9A 1B E6 C0 94 2D D8 A3 A8 03 DE A2 82 7E 43 5E 50 41 52 54 01 00 00 00 D8 8D 66 00 00 00 00 00 DC 49 3F 09 00 00 00 00 3D 00 00 00 00 00 00 00 12 5B E8 78 A6 8A 37 0C 89 0D C7 1D E5 47 E9 DE B7 78 6D 2F A6 DA 6C 1E 51 87 28 16 21 7F 5E E2 44 00 00 00 00 00 00 00 23 42 51 C7 4D 77 64 FA 9C D1 17 91 2A C6 B2 DE DB 32 2B D5 B0 9B 40 AD 6E 9F F8 B0 C5 A7 E9 A7 B9 9A AA B0 6E 0C 14 BB 78 02 FB F6 FD 87 9E 5E 4C 95 D0 D2 A0 30 D7 D6 05 CB 6D 04 E5 C4 CE C0 48 BC B7 DB 92 3B F6 92 66 23 D8 08 C0 FB AF 52 D0 93 EE 92 34 B1 A4 32 17 34 D6 9D 58 25 C8 17 C0 ED 20 C3 53 58 D1 D3 1D 06 B9 F0 F1 D7 9D C9 5C AB 74 C4 D1 8B 86 A1 00 EB 62 C6 19 13 C9 68 F0 D0 C1 3C 03 6A 60 37 F2 71 55 22 1A 15 88 CA 7A C2 9B 91 F6 E2 05 F4 41 5F CE D9 56 25 36 D7 AD 66 BE 8C DC 11 93 D6 16 24 2E 92 16 5D BB 0E F3 BC 10 4E 36 DE 27 29 53 B3 9D BB CB F3 92 EC 6E A7 D9 48 1A 01 71 FA B6 BB 14 99 89 B8 2C 81 98 C7 EE 44 85 26 48 46 46 1E CE C9 3F 80 DA A7 43 57 3A 46 DD 04 87 6B 42 72 13 A9 58 74 06 29 57 B0 CD E6 FA D1 D2 39 C3 6F DD 39 86 6D E6 F6 52 00 00 00 00 00 00 00 15 D6 83 91 23 9C 9E 21 A5 2D D8 9B C5 92 07 CF 2D 6C DC 65 50 9E 34 70 05 5F 9E E9 49 44 71 FF 02 E7 3F 88 ED B8 63 88 EF CF 17 79 04 39 8D 89 99 7D 6E 31 F4 02 2B FC 7D 3E 49 CA F9 58 E6 33 64 D1 B8 47 52 03 58 67 FF 24 A7 83 F0 D2 91 67 C2 D8 10 48 B8 91 FA AA 49 55 6F 54 9B 9D B2 33 A8 AF 27 A9 D0 B2 04 9E D9 E3 92 FD 28 F3 C3 86 7B F5 0F 29 75 56 75 89 0E 5C 6E 82 2A BB 46 52 9F 3A 81 99 A0 24 90 25 8F 86 36 0F D9 B2 F7 AD E4 73 B2 8A 6D E4 6B 1D 84 D6 BA CE 29 CE E9 19 79 CD C8 F2 03 01 06 56 F8 B1 63 23 2E 8F 98 E4 8C 58 C3 5A C9 41 67 DC 2D FB A8 21 6D 35 AB 75 40 F6 7E 17 E6 10 D3 76 22 C3 C7 AB 00 A5 21 A1 38 A6 AF 4F C0 1D 77 63 B7 98 C3 26 C3 11 9B 35 6B 5E D6 BE F0 35 9E 03 0A BE 3C 61 55 B9 B3 2F C2 B4 36 54 E1 7D 3E FF 94 D7 1B CB 2A EC 4A 63
HeadRush Prime	`3.2`	41 5A 30 78 01 00 00 00 00 00 00 00 38 00 00 00 38 00 00 00 98 00 00 00 A0 00 00 00 E0 01 00 00 60 00 00 00 01 00 05 00 02 00 00 00 E0 01 00 00 01 00 00 00 0A 00 00 00 00 53 4E 41 50 53 48 4F 54 00 48 47 30 36 20 75 70 67 72 61 64 65 20 69 6D 61 67 65 00 48 47 30 36 00 73 70 6C 61 73 68 00 75 70 64 61 74 65 73 70 6C 61 73 68 00 6B 65 72 6E 65 6C 00 72 6F 6F 74 66 73 00 74 65 73 74 2D 68 65 61 64 72 75 73 68 00 68 65 61 64 72 75 73 68 2D 31 00 00 00 00 1B 30 63 07 1D 00 00 00 42 4F 4F 54 00 00 00 00 F0 03 00 00 00 00 00 00 BC D5 08 00 00 00 00 00 00 00 00 00 00 00 00 00 37 C2 75 FC 74 8B 58 E0 A7 83 C3 7F 70 D8 E5 E4 CF 48 8F EA 8A 2E F3 80 03 DE EA D7 56 5B C7 0B 50 41 52 54 01 00 00 00 B0 D9 08 00 00 00 00 00 5C 21 04 00 00 00 00 00 22 00 00 00 00 00 00 00 E5 C0 2B BF 72 A7 47 79 5E BD ED ED FE AA C7 63 5B CC E9 BA 7D 59 B1 58 62 77 0C 83 DD 85 9B DB 50 41 52 54 01 00 00 00 10 FB 0C 00 00 00 00 00 60 28 04 00 00 00 00 00 29 00 00 00 00 00 00 00 CC 87 F9 19 AC 6F 04 17 DC 7F AA 8A 41 CA D0 29 EE 4E 5E 7C F4 0E EC D8 54 06 A4 C7 84 B1 4F C8 50 41 52 54 01 00 00 00 70 23 11 00 00 00 00 00 20 FE 5A 00 00 00 00 00 36 00 00 00 00 00 00 00 57 23 F5 34 71 DA 67 B1 FD DE 39 2F EE 1D 42 62 0B CC 44 9E A1 16 81 E2 A6 39 CF F2 4B 22 22 68 50 41 52 54 01 00 00 00 90 21 6C 00 00 00 00 00 F8 66 51 09 00 00 00 00 3D 00 00 00 00 00 00 00 CC 1B 1E AC 57 E1 44 FC 49 59 41 DB 00 B2 76 8D C4 69 2E 92 F4 2B C8 60 4B 6F 6B CC A8 E9 B4 CA 44 00 00 00 00 00 00 00 0B 49 0A 9D AB 98 E7 F1 30 74 23 79 4D EB F5 D3 DB D9 80 67 1B 4D 78 6F 1B EA 9A 8E D0 54 DE 7F 01 4E 38 8A 3C 27 67 C4 EB 49 EE EE 20 5A 7C 8D 1C 47 AB C3 53 94 48 50 2E 68 02 B0 09 7A C3 C0 D3 7F C3 DD 6B 42 4F EA 4E 3D 12 32 9B AA 6B CB 3F 47 F0 AB 48 2D 0E F0 E8 20 80 8A 94 41 6C F8 32 E9 F3 0A 82 15 B0 C1 70 A8 FE 65 95 C8 55 47 23 8A 79 B5 E9 D2 5C 46 53 BC 09 CC 88 AA 7C 2A 3D F2 D3 49 11 3F CC BD 36 70 14 B8 85 E5 AA 9E 49 A5 4A 00 16 FF 4C 25 CF 19 A6 F7 1A E9 7C A6 2F A5 0E 59 9C 9F CF 24 4F 01 4A 13 B3 06 A2 2E 22 35 B8 E2 92 46 5F 5B 51 AD 43 09 11 C0 37 BA A4 36 35 03 A1 65 D0 99 EB F6 76 C2 0B CD 43 19 8C C5 FD 8B 74 9C 62 96 61 6E 59 FE B5 22 2B 1E B9 0A FB B5 FA 43 CC 92 49 99 90 B4 8B F8 AB FF 00 37 C9 15 BF 6D FC 2B 5F 65 8C C6 24 38 7E FF 52 00 00 00 00 00 00 00 20 3D 58 F4 8B 42 83 81 58 B0 71 A2 0A 43 2B 64 2F DB 9D A6 65 93 8A 43 36 3D 25 F7 99 6C 11 71 7B 43 08 6C 70 B8 0C DD 3F 50 2E 5B 16 10 80 61 F3 4E D1 14 59 3D 97 36 37 0C ED 11 A7 D3 EB CE 17 A0 88 1D BD 53 37 3C 39 4D F2 8E E3 74 72 B9 F3 A8 2D 74 7C A3 25 FD DF 28 9E 09 0D 35 65 BB E3 F4 83 FF 1C 2A 0C FF 11 8B C5 CA 34 3E 1D C6 4C 3A 94 CF CF DB A6 4A 8C 56 8A 8D 26 7A DC BE 8A F1 50 BC AB ED C9 18 46 E8 E1 29 D6 64 E0 18 FD B1 C9 07 6B 52 E4 62 BC 52 B7 B6 C8 CE 6B 58 F7 41 AE D2 15 F4 A4 92 1B EF 10 58 4F 87 8E 46 E7 41 EC 0A 74 9C 44 10 81 55 DE DA BD 74 B9 0C A5 A5 3A 7C 5F 70 9D B9 FA 25 BE 21 CF 49 18 B3 48 F8 2C 35 A4 D8 83 A2 21 9D 2D 73 7B 48 0A BD E5 A7 25 97 43 B4 5D 80 65 20 30 20 7F 57 84 91 27 82 E5 9D 2F 04 44 EC B7 A0 61 7B B9 88 C5 7E

Header Value Descriptions

All of these start with 41 5A 30 78, which decodes to AZ0x. This is a fixed literal — it is identical across every AZ0x image I have checked, and the x is not a wildcard standing in for a board revision. The 01 00 00 00 that follows is a separate field: the container's format version, which so far is always 1.

The header is a fixed 0x38 bytes, immediately followed by a string table. Every string in the file — version, image name, device names, partition names — lives in that table and is referenced by an offset relative to its start. Offset 0 in the table is a NUL, meaning "no string".

Offset	Size	Description
`0x00`	4	Magic, `AZ0x`
`0x04`	4	Format version (always `1` so far)
`0x10`	4	String table offset (`0x38`)
`0x14`	4	Device table offset
`0x18`	4	Partition table offset
`0x1c`	4	Partition table end offset
`0x20`	4	String table size
`0x24`	2	Number of supported devices
`0x26`	2	Number of partitions
`0x34`	4	Offset (into the string table) of the update image name

Reading via these pointers is more robust than scanning for NULs sequentially, though both work in practice.

Offset 0x39 up to the byte 0x00 contains the firmware version. (This is the string table at 0x38, plus 1 to skip its leading NUL.)

On Denon devices, I've seen 4.1.0, these likely have the software version for all updates.
On HeadRush devices, I've seen SNAPSHOT. This is likely their SVN's branch the build is produced from (not the software version).

Following the version (up to the next 0x00), we get the name of the update image:

HG06 upgrade image
HV01 upgrade image
EngineOS upgrade image

Following this, we get the model IDs of the devices this firmware update supports. This can be a number of strings (the number of these strings can be found at offset 0x24).

There is also a device table at the offset stored in 0x14, holding one 8-byte entry per device: a u32 numeric device ID followed by a u32 offset of that device's name in the string table. This is where the numeric IDs come from:

Device	ID
`JC11S`	`0x15e4d007`
`JP11S`	`0x15e4c00c`
`JP20`	`0x15e4d011`
`JP21`	`0x15e4d012`
`NH08S`	`0x15e4303f`
`NH10`	`0x15e42059`
`HG06`	`0x0763301b`
`HV01`	`0x07633019`

The order of this table matters: a device's index here is its bit position in the partition device mask described below.

Partitions

Before retrieving the partitions, we need to look at a couple values at different offsets to determine the partition metadata layout in the firmware.

Offset	Description
`0x18`	The beginning address of the partitions
`0x26`	The number of partitions in the image

For example, PRIME4PLUS-3.1.0-Update.img contains:

Offset	Value
`0x18`	`0xa8`
`0x26`	`0x09`

This tells us that we need to go to 0xa8 to get the first partition's metadata. Partition's metadata is 0x40 in length, so we can read this into a buffer.

Since we know we have 9 partitions, we read this 9 times before we reach the end of all partitions' metadata.

Example partition metadata:

Partition	Metadata
1	`42 4F 4F 54 00 00 00 80 F0 03 00 00 00 00 00 00 1C DC 08 00 00 00 00 00 00 00 00 00 01 00 00 00 3B 09 D8 3C C2 E1 4D 0F 1E 88 32 B8 EE E1 B9 24 23 49 D1 25 C7 6A 75 32 DB 1C E3 8D B3 1A 11 28`
2	`42 4F 4F 54 00 00 00 80 10 E0 08 00 00 00 00 00 34 C5 08 00 00 00 00 00 00 00 00 00 02 00 00 00 3F EE 62 5F F0 71 9F FA C0 3D 78 37 75 54 D9 5D 53 65 2D 34 C7 7C 90 92 2D F8 D6 37 5B 60 6C CC`
3	`42 4F 4F 54 00 00 00 80 48 A5 11 00 00 00 00 00 34 C5 08 00 00 00 00 00 00 00 00 00 04 00 00 00 A9 7F A5 37 05 8B 57 BA 06 92 8B 89 ED F9 BD 24 3B 13 05 BA 89 D0 A1 DC 70 28 F1 BD 06 AE DF 5D`
4	`50 41 52 54 01 00 00 80 80 6A 1A 00 00 00 00 00 B0 15 00 00 00 00 00 00 2E 00 00 00 01 00 00 00 51 7A F5 7F DF BE 27 76 8A B8 65 EE E2 A2 83 96 CB 0E 05 FA ED 11 CD 92 15 75 71 35 EF 7F 30 3A`
5	`50 41 52 54 01 00 00 80 30 80 1A 00 00 00 00 00 30 16 00 00 00 00 00 00 2E 00 00 00 06 00 00 00 04 E3 92 9C 06 72 E4 2A 13 41 4A D0 5C 37 53 1F 4F 7C 59 75 6D DC CD 20 91 EB 1E 4E 87 FE E4 02`
6	`50 41 52 54 01 00 00 80 60 96 1A 00 00 00 00 00 90 15 00 00 00 00 00 00 35 00 00 00 01 00 00 00 4D 33 7D 66 3E DC 2A BC E1 BB E2 8F 69 BB 44 0F 4E 5E DD 32 73 49 8D 5D 7B 0C 52 89 F7 99 70 36`
7	`50 41 52 54 01 00 00 80 F0 AB 1A 00 00 00 00 00 80 15 00 00 00 00 00 00 35 00 00 00 06 00 00 00 5F 9B 86 EA A6 E8 79 4C 67 D5 AF 66 A6 63 09 56 3A 53 F7 B8 5D CB E2 3E CB EA CF BC AB E3 A9 76`
8	`50 41 52 54 01 00 00 00 70 C1 1A 00 00 00 00 00 38 EA 50 00 00 00 00 00 42 00 00 00 00 00 00 00 E6 0F D4 4F E6 84 4F 35 68 0D 93 2E 2A CB 32 62 F1 71 2F F4 24 94 78 62 D0 72 74 14 6E 4D AB 80`
9	`50 41 52 54 01 00 00 00 A8 AB 6B 00 00 00 00 00 F0 4C AA 0A 00 00 00 00 49 00 00 00 00 00 00 00 7D 28 81 86 29 42 A1 8D AD 50 21 39 C3 3C D8 4F 20 A0 D6 6B 1B 33 64 30 A0 33 9D 9F 37 CB 87 DA`

The partition metadata that I have figured out the meaning of is as follows (offset is the offset from the beginning of the partition's metadata):

Offset	Description
`0x0`-`0x3`	`BOOT`, `PART` or `PARR` — the partition kind. `PARR` is a recovery partition (e.g. AC50)
`0x8`-`0xf`	Offset of this partition's own data in the file (little endian)
`0x10`-`0x17`	The size of the partition data
`0x18`-`0x1b`	Offset of the partition's name in the string table (`0` = unnamed, as on `BOOT`)
`0x1c`-`0x1f`	Device bitmask — bit N is set for device N of the device table
`0x20`-`0x3f`	SHA-256 of the partition data — confirmed, verified byte-for-byte

Bytes 0x4-0x7 are a flags word, not a type enum — the marker at 0x0 already says what kind of partition this is. Across 1,375 partition entries only two bits are ever set:

Bit	Meaning
`0x00000001`	Payload is xz-compressed. Clear means stored raw
`0x80000000`	Entry is device-specific, i.e. the device mask at `0x1c` is non-zero

Every other bit was zero in every image checked.

The device mask

The value at 0x1c is a bitmask over the device table, not a partition number. The SCLIVE2 4.1.0 header above demonstrates this plainly. Its device table is JC11S, JP11S, JP20, JP21, and its entries carry:

Entry	Mask	Meaning
`BOOT` ×4	`0x01`, `0x02`, `0x04`, `0x08`	one bootloader per device
`splash`	`0x01`	`JC11S` only
`splash`	`0x0E`	`JP11S` + `JP20` + `JP21`
`kernel`, `rootfs`	`0x00`	shared by every device

A mask of 0x0E could not be a partition number — it is 0x02 | 0x04 | 0x08. This also means partition names are not unique: a multi-device image legitimately contains two partitions both called splash, separated only by mask. Any extractor has to disambiguate them or it will silently overwrite one with the other.

Compression

Compression is given by bit 0 of the flags word at 0x4. Sniffing the payload magic works equally well and agreed with the flag on all 1,375 entries checked, so either can be used:

Marker	Flag bit `0`	Payload	Count
`BOOT`	clear	Uncompressed FIT (`0xD00DFEED`)	424
`PART`	set	xz (`FD 37 7A 58 5A 00`)	904
`PART`	clear	Raw — only ever `splash`/`updatesplash`	30
`PARR`	set	xz	17

Note that a raw splash is not unusual enough to ignore: 30 of them appear across the collection, so an extractor that assumes every PART is xz will fail on those.

Signature

Between the end of the partition table (0x1c) and the first partition's data sits a signature block: a u64 length, followed by that many bytes of high-entropy data.

The length is variable — across 207 images it ranges from 59 to 104 bytes, most commonly 68, 86, 75 and 80. That variability is itself the clue: a fixed-size signature would be a constant length, whereas DER encoding of an ECDSA signature varies by a few bytes depending on how the two integers encode. Combined with being far too short for RSA-2048, this points to DER-encoded ECDSA rather than a raw fixed-width signature.

This is what actually blocks rebuilding an update. The partition table itself is trivial to regenerate, but without the vendor's signing key the device rejects the result, so my extraction utility refuses to repack AZ0x images rather than emit a file that cannot install. Note this signature is separate from the RSA verification found in the updater ramfs on 5.0.4, which is inactive because the shipped images carry no such signature and the ramfs ships no keys.

Extracting

The rootfs — and every other partition — can now be extracted directly:

python main.py -f <firmware.img> --ssh

Partitions land in firmwares/generated/ as <partition>_<firmware>.img, with per-device duplicates disambiguated (splash-jc11s, splash-jp11s-jp20-jp21). The extracted rootfs is a bare ext2/ext4 filesystem, so it mounts directly:

sudo mount -o loop ./firmwares/generated/rootfs_<firmware>.img ./firmwares/mnt

This has been validated across every AZ0x image I have (207 of them), plus the older FDT and AZ01 containers.

Data (legacy notes)

After removing the header from the file, dumpimage -l <image> on SCLIVE2-4.1.0-Update.img outputs:

FIT description: bootupd
Created:         Thu Sep 19 22:38:27 2024
 Image 0 (idbloader)
  Description:  idbloader
  Created:      Thu Sep 19 22:38:27 2024
  Type:         Rockchip SD Boot Image
  Compression:  uncompressed
  Data Size:    116736 Bytes = 114.00 KiB = 0.11 MiB
  Hash algo:    sha256
  Hash value:   583719bec0261b7d7e295aad48b6f90d9b105819a7573b449535d98ed572800e
 Image 1 (u-boot)
  Description:  u-boot
  Created:      Thu Sep 19 22:38:27 2024
  Type:         Kernel Image
  Compression:  uncompressed
  Data Size:    470992 Bytes = 459.95 KiB = 0.45 MiB
  Architecture: ARM
  OS:           U-Boot
  Load Address: unavailable
  Entry Point:  unavailable
  Hash algo:    sha256
  Hash value:   21d7a7ca4d7732eea812aa871451c627d3070251c79a89997aecbe14ba9599a9
 Default Configuration: 'config'
 Configuration 0 (config)
  Description:  image
  Kernel:       unavailable
  Sign algo:    sha256,rsa2048:denon-1
  Sign value:   95200a1436369735d87ddb3aa10c922a39921af1bede6232c8618248869d61f0fa85d8fd79582105f0ef42a508baf016aefd1445958d0ddc8591f5e00fa404c8b409c79edd3f42f8d38411a70a6a05a943a2da4a73a1789760d4a90ef46f67a54de571fe11a13aeb83b666a84f71ed4412f679942c6b247fb3aa1b140b79328050801850822cbe9753e77c53cedc425a624ef148e251e51cfe12043091c926bb460afbe9b4760f80eef2ef91db8b25672af5ba17fbf88b322fa5fcc1ef7fb0d33655964e7d3b1969bd79ea7b23debb326be6d12e2d0fcdaf04014f0f9b9114d547815c7a8fd636255e4ebd60f3876b9c6340fd2724a734c17429ec065a4b29d4
  Timestamp:    Thu Sep 19 22:38:27 2024

The rootfs can be extracted with binwalk -eM <image>. The rootfs will be in a subfolder in extractions somewhere.

Example locations:

Device	Firmware Version	rootfs path
SC Live 2	`4.1.0`	`extractions/SCLIVE2-4.1.0-Update.img.extracted/794628/decompressed.bin.extracted/0/rootfs/`
SC Live 4	`4.1.0`	`extractions/PRIME4PLUS-4.1.0-Update.img.extracted/7945B0/decompressed.bin.extracted/0/rootfs/`
HeadRush Core	`3.2`	`extractions/core-3.2.img.extracted/668DD8/decompressed.bin.extracted/0/rootfs/`
HeadRush Prime	`3.2`	`extractions/prime-3.2.img.extracted/6C2190/decompressed.bin.extracted/0/rootfs/boot/`
Prime 4 Plus	`4.1.0`	`extractions/PRIME4PLUS-4.1.0-Update.img.extracted/7945B0/decompressed.bin.extracted/0/rootfs/`
Prime Go +	`4.1.0`	`extractions/PRIMEGOPLUS-4.1.0-Update.img.extracted/7945D0/decompressed.bin.extracted/0/rootfs/`
Mixstream Pro Go	`4.1.0`	`extractions/MIXSTREAMPROGO-4.1.0-Update.img.extracted/672AC8/decompressed.bin.extracted/0/rootfs/`
Mixstream Pro +	`4.1.0`	`extractions/MIXSTREAMPROPLUS-4.1.0-Update.img.extracted/672A98/decompressed.bin.extracted/0/rootfs/`

13 August 2026