[{"data":1,"prerenderedAt":3130},["Reactive",2],{"kb-chapters":3,"kb-doc:/knowledge-base/reverse-engineering/oem-update-files/":169},[4,11,17,23,29,35,41,47,53,59,65,71,77,83,89,96,102,108,114,120,126,132,138,144,151,157,163],{"_path":5,"title":6,"description":7,"part":8,"_file":9,"chapterNumber":10},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols","7.knowledge-base/1.networks/1.introduction.md",1,{"_path":12,"title":13,"description":14,"part":8,"_file":15,"chapterNumber":16},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.","7.knowledge-base/1.networks/2.vehicle-documentation.md",2,{"_path":18,"title":19,"description":20,"part":8,"_file":21,"chapterNumber":22},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.","7.knowledge-base/1.networks/3.lin-bus.md",3,{"_path":24,"title":25,"description":26,"part":8,"_file":27,"chapterNumber":28},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.","7.knowledge-base/1.networks/4.controller-area-network.md",4,{"_path":30,"title":31,"description":32,"part":8,"_file":33,"chapterNumber":34},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.","7.knowledge-base/1.networks/5.secure-onboard-communication.md",5,{"_path":36,"title":37,"description":38,"part":8,"_file":39,"chapterNumber":40},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.","7.knowledge-base/1.networks/6.flexray.md",6,{"_path":42,"title":43,"description":44,"part":8,"_file":45,"chapterNumber":46},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.","7.knowledge-base/1.networks/7.automotive-ethernet.md",7,{"_path":48,"title":6,"description":49,"part":50,"_file":51,"chapterNumber":52},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols","7.knowledge-base/2.diagnostics/1.introduction.md",8,{"_path":54,"title":55,"description":56,"part":50,"_file":57,"chapterNumber":58},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.","7.knowledge-base/2.diagnostics/2.iso-tp.md",9,{"_path":60,"title":61,"description":62,"part":50,"_file":63,"chapterNumber":64},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.","7.knowledge-base/2.diagnostics/3.vw-tp20.md",10,{"_path":66,"title":67,"description":68,"part":50,"_file":69,"chapterNumber":70},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.","7.knowledge-base/2.diagnostics/4.obd-ii.md",11,{"_path":72,"title":73,"description":74,"part":50,"_file":75,"chapterNumber":76},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.","7.knowledge-base/2.diagnostics/6.uds.md",12,{"_path":78,"title":79,"description":80,"part":50,"_file":81,"chapterNumber":82},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.","7.knowledge-base/2.diagnostics/7.ccp.md",13,{"_path":84,"title":85,"description":86,"part":50,"_file":87,"chapterNumber":88},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.","7.knowledge-base/2.diagnostics/8.xcp.md",14,{"_path":90,"title":91,"description":92,"part":93,"_file":94,"chapterNumber":95},"/knowledge-base/reverse-engineering/ecu-flashing","ECU Flashing","How a control unit is reprogrammed over the wire with UDS, walked through step by step, why the sequence is staged the way it is, and how the SecurityAccess seed/key gate works, from weak proprietary LFSR ciphers to the Volkswagen SA2 script.","Reverse Engineering","7.knowledge-base/3.reverse-engineering/1.ecu-flashing.md",15,{"_path":97,"title":98,"description":99,"part":93,"_file":100,"chapterNumber":101},"/knowledge-base/reverse-engineering/oem-update-files","OEM Update Files","Where to find official ECU firmware, why OEMs ship it, and how the major manufacturer update container formats (VW FRF/ODX, Toyota CUW, Ford VBF, BMW psdzdata, Tesla BHX) are structured, decrypted, and unpacked.","7.knowledge-base/3.reverse-engineering/2.oem-update-files.md",16,{"_path":103,"title":6,"description":104,"part":105,"_file":106,"chapterNumber":107},"/knowledge-base/existing-research/introduction","Landmark papers from 2010 to 2016 that defined automotive security research and demonstrated the first complete remote exploit chain against a production vehicle.","Existing Research","7.knowledge-base/4.existing-research/1.introduction.md",17,{"_path":109,"title":110,"description":111,"part":105,"_file":112,"chapterNumber":113},"/knowledge-base/existing-research/engine-control-units","Engine Control Units","Public reverse-engineering work on engine ECUs, focusing on bri3d's documented exploit chains for the Volkswagen Group Simos 18 ECU and its Infineon TriCore TC1791 processor.","7.knowledge-base/4.existing-research/2.engine-control-units.md",18,{"_path":115,"title":116,"description":117,"part":105,"_file":118,"chapterNumber":119},"/knowledge-base/existing-research/ev-charging","EV Charging","Research covering two distinct attack surfaces introduced by electric vehicle charging, the HomePlug Green PHY powerline data layer used by the Combined Charging System, and the AC charger as a peer device with its own firmware and bidirectional communications.","7.knowledge-base/4.existing-research/3.ev-charging.md",19,{"_path":121,"title":122,"description":123,"part":105,"_file":124,"chapterNumber":125},"/knowledge-base/existing-research/fault-injection","Fault Injection","Published fault injection research relevant to automotive microcontrollers, covering voltage glitching, EMFI, debug access, and secure-boot bypasses on Renesas, Infineon, NXP/Freescale, and Tesla compute platforms.","7.knowledge-base/4.existing-research/4.fault-injection.md",20,{"_path":127,"title":128,"description":129,"part":105,"_file":130,"chapterNumber":131},"/knowledge-base/existing-research/infotainment-telematics","Infotainment & Telematics","Sixteen published research entries covering remote exploitation of infotainment and telematics systems across Tesla, BMW, Mercedes-Benz, Volkswagen Group, and Nissan vehicles, plus a cross-industry web API survey.","7.knowledge-base/4.existing-research/5.infotainment-telematics.md",21,{"_path":133,"title":134,"description":135,"part":105,"_file":136,"chapterNumber":137},"/knowledge-base/existing-research/sensors-and-radios","Other Wireless Attack Surfaces","Research covering wireless attack surfaces beyond the primary CAN and telematics interfaces, including tire pressure sensors and DAB radio receivers, both of which accept untrusted RF input and have historically performed no authentication or input validation.","7.knowledge-base/4.existing-research/6.sensors-and-radios.md",22,{"_path":139,"title":140,"description":141,"part":105,"_file":142,"chapterNumber":143},"/knowledge-base/existing-research/remote-keyless-entry","Remote Keyless Entry and Immobilisers","Research on cryptographic attacks against passive keyless entry systems, transponder-based immobilisers, rolling-code RKE, and the CAN-injection theft chain.","7.knowledge-base/4.existing-research/7.remote-keyless-entry.md",23,{"_path":145,"title":146,"description":147,"part":148,"_file":149,"chapterNumber":150},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools","7.knowledge-base/5.tools/1.can-adapters.md",24,{"_path":152,"title":153,"description":154,"part":148,"_file":155,"chapterNumber":156},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.","7.knowledge-base/5.tools/2.can-analysis.md",25,{"_path":158,"title":159,"description":160,"part":148,"_file":161,"chapterNumber":162},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.","7.knowledge-base/5.tools/3.scripting.md",26,{"_path":164,"title":165,"description":166,"part":148,"_file":167,"chapterNumber":168},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.","7.knowledge-base/5.tools/4.dbc-files.md",27,{"_path":97,"_dir":170,"_draft":171,"_partial":171,"_locale":172,"title":98,"description":99,"part":93,"references":173,"body":233,"_type":3126,"_id":3127,"_source":3128,"_file":100,"_extension":3129},"reverse-engineering",false,"",[174,179,185,191,196,201,206,211,218,223,228],{"id":175,"authors":176,"title":177,"url":178},"nhtsa-recalls","NHTSA","Recalls lookup and Technical Service Bulletins","https://www.nhtsa.gov/recalls",{"id":180,"authors":181,"title":182,"publisher":176,"year":183,"url":184},"nhtsa-20v213","Hyundai Motor America","Part 573 Safety Recall Report 20V-213, Remote Smart Parking Assist (RSPA) control logic",2020,"https://static.nhtsa.gov/odi/rcl/2020/RCRIT-20V213-9550.pdf",{"id":186,"authors":187,"title":188,"version":189,"url":190},"iso-22901-1","ISO","Road vehicles, Open diagnostic data exchange (ODX), Part 1: Data model specification","ISO 22901-1:2008","https://www.iso.org/standard/41207.html",{"id":192,"authors":193,"title":194,"url":195},"vw-flash","Brian Ledbetter (bri3d)","VW_Flash, flashing toolkit for VW AG ECUs, including FRF and ODX extraction","https://github.com/bri3d/VW_Flash",{"id":197,"authors":198,"title":199,"url":200},"liblzf","Marc Lehmann","liblzf, a very small, very fast data compression library (LZF)","https://oldhome.schmorp.de/marc/liblzf.html",{"id":202,"authors":203,"title":204,"url":205},"qvbf","smartgauges","qvbf, a VBF (Versatile Binary Format) viewer and editor","https://github.com/smartgauges/qvbf",{"id":207,"authors":208,"title":209,"url":210},"forscan","FORScan","FORScan, diagnostic and reprogramming software for Ford, Mazda, Lincoln, and Mercury vehicles","https://forscan.org/",{"id":212,"authors":213,"title":214,"publisher":215,"year":216,"url":217},"lzss","James A. Storer, Thomas G. Szymanski","Data compression via textual substitution (LZSS)","Journal of the ACM, Volume 29, Issue 4, pages 928 to 951",1982,"https://dl.acm.org/doi/10.1145/322344.322346",{"id":219,"authors":220,"title":221,"url":222},"ucl","Markus F.X.J. Oberhumer","UCL, a portable lossless data compression library (NRV family)","http://www.oberhumer.com/opensource/ucl/",{"id":224,"authors":225,"title":226,"url":227},"uclcli","Kjell Braden (afflux)","uclcli, command line compressor and decompressor for libucl (NRV) BMW flash data","https://github.com/afflux/uclcli",{"id":229,"authors":230,"title":231,"year":183,"url":232},"ptp-tesla","Pen Test Partners","Reverse engineering the Tesla firmware update process","https://www.pentestpartners.com/security-blog/reverse-engineering-the-tesla-firmware-update-process/",{"type":234,"children":235,"toc":3117},"root",[236,244,250,255,262,267,323,360,369,374,380,416,443,472,1309,1359,1365,1392,1397,1753,1766,1816,1822,1840,1861,1892,1926,1932,1948,1953,2249,2288,2294,2310,2330,2361,2394,2404,2695,2739,3075,3101,3107,3111],{"type":237,"tag":238,"props":239,"children":241},"element","h1",{"id":240},"oem-update-files",[242],{"type":243,"value":98},"text",{"type":237,"tag":245,"props":246,"children":247},"p",{},[248],{"type":243,"value":249},"Before you can reverse engineer an ECU you need its firmware. Reading it out over CAN (using UDS, XCP, etc), or reading it off the chip directly is one route, but is typically blocked by read-out protection or is relatively invasive. The other route is to let the manufacturer hand you the firmware: every time a dealer reflashes a control unit, the new image is shipped to the workshop as a file. Those files are the subject of this chapter.",{"type":237,"tag":245,"props":251,"children":252},{},[253],{"type":243,"value":254},"OEM update files are attractive because they are an official, complete copy of the exact code that runs on the ECU. They typically also contain the memory layout, the part numbers, and sometimes the security and signing scheme. The catch is that each manufacturer wraps that payload in its own container format, with its own compression and (increasingly) its own encryption. The rest of this chapter walks through why these files exist and how the major formats are put together.",{"type":237,"tag":256,"props":257,"children":259},"h2",{"id":258},"why-oems-ship-updates",[260],{"type":243,"value":261},"Why OEMs Ship Updates",{"type":237,"tag":245,"props":263,"children":264},{},[265],{"type":243,"value":266},"Software in a modern car is not finished when the vehicle leaves the factory. Manufacturers reflash ECUs in the field for many reasons:",{"type":237,"tag":268,"props":269,"children":270},"ul",{},[271,283,293,303,313],{"type":237,"tag":272,"props":273,"children":274},"li",{},[275,281],{"type":237,"tag":276,"props":277,"children":278},"strong",{},[279],{"type":243,"value":280},"Bug fixes",{"type":243,"value":282}," in control logic that surface only after vehicles are on the road.",{"type":237,"tag":272,"props":284,"children":285},{},[286,291],{"type":237,"tag":276,"props":287,"children":288},{},[289],{"type":243,"value":290},"Recall and emissions compliance",{"type":243,"value":292},", where a defect is corrected by reprogramming rather than replacing hardware.",{"type":237,"tag":272,"props":294,"children":295},{},[296,301],{"type":237,"tag":276,"props":297,"children":298},{},[299],{"type":243,"value":300},"Drivability and calibration improvements",{"type":243,"value":302},", such as shift quality, idle behavior, or fuel and spark maps.",{"type":237,"tag":272,"props":304,"children":305},{},[306,311],{"type":237,"tag":276,"props":307,"children":308},{},[309],{"type":243,"value":310},"Security patches",{"type":243,"value":312}," that close vulnerabilities in CAN, UDS, or telematics interfaces.",{"type":237,"tag":272,"props":314,"children":315},{},[316,321],{"type":237,"tag":276,"props":317,"children":318},{},[319],{"type":243,"value":320},"Feature changes",{"type":243,"value":322},", sometimes tied to a subscription or a later option purchase.",{"type":237,"tag":245,"props":324,"children":325},{},[326,328,333,335,340,342,346,348,353,355,358],{"type":243,"value":327},"Two document types make this visible to the public. A ",{"type":237,"tag":276,"props":329,"children":330},{},[331],{"type":243,"value":332},"Technical Service Bulletin (TSB)",{"type":243,"value":334}," is guidance the manufacturer sends to its dealer network describing a known condition and the prescribed fix. A ",{"type":237,"tag":276,"props":336,"children":337},{},[338],{"type":243,"value":339},"recall",{"type":243,"value":341}," is for safety-related defects and is overseen by a regulator (NHTSA in the United States), which requires the manufacturer to notify owners and remedy the problem for free ",{"type":237,"tag":343,"props":344,"children":345},"citation",{"id":175},[],{"type":243,"value":347},". More and more recalls are resolved by a software reflash instead of a parts swap, and NHTSA now flags recalls that are fixed over the air. Hyundai recall ",{"type":237,"tag":276,"props":349,"children":350},{},[351],{"type":243,"value":352},"20V-213",{"type":243,"value":354}," is a typical example ",{"type":237,"tag":343,"props":356,"children":357},{"id":180},[],{"type":243,"value":359},".",{"type":237,"tag":245,"props":361,"children":362},{},[363],{"type":237,"tag":364,"props":365,"children":368},"img",{"alt":366,"src":367},"Hyundai Technical Service Bulletin / recall campaign 20-01-019H, describing an ECU software update rather than a parts replacement.","/images/knowledge-base/reverse-engineering/tsb.png",[],{"type":237,"tag":245,"props":370,"children":371},{},[372],{"type":243,"value":373},"Updates and recalls are not the only reason these files exist. Manufacturers like Volkswagen and Ford reuse the same ECU hardware across many different models and model years, so a replacement part from the dealer is generic: before it will work in a given car it first has to be flashed with the matching firmware. As a result, flash files exist for almost every control unit as part of normal parts and service operations, whether or not a TSB or recall has ever been issued.",{"type":237,"tag":256,"props":375,"children":377},{"id":376},"bmw-swfl",[378],{"type":243,"value":379},"BMW (SWFL)",{"type":237,"tag":245,"props":381,"children":382},{},[383,385,390,392,397,399,406,408,414],{"type":243,"value":384},"BMW delivers the software for an individual control unit as a ",{"type":237,"tag":276,"props":386,"children":387},{},[388],{"type":243,"value":389},"SWFL",{"type":243,"value":391}," (\"software flash\") container, found inside ",{"type":237,"tag":276,"props":393,"children":394},{},[395],{"type":243,"value":396},"psdzdata",{"type":243,"value":398},", the large programming data pack used by ISTA and E-Sys. Each SWFL is a pair of files that share an identifier and a version suffix: an XML header (",{"type":237,"tag":400,"props":401,"children":403},"code",{"className":402},[],[404],{"type":243,"value":405},"swfl_\u003Cid>.xml.\u003Cversion>",{"type":243,"value":407},") and the flash data itself (",{"type":237,"tag":400,"props":409,"children":411},{"className":410},[],[412],{"type":243,"value":413},"swfl_\u003Cid>.bin.\u003Cversion>",{"type":243,"value":415},"), for example:",{"type":237,"tag":417,"props":418,"children":421},"pre",{"className":419,"code":420,"language":243,"meta":172,"style":172},"language-text shiki shiki-themes github-light github-dark","swfl_00005f9f.xml.142_011_020\nswfl_00005f9f.bin.142_011_020\n",[422],{"type":237,"tag":400,"props":423,"children":424},{"__ignoreMap":172},[425,435],{"type":237,"tag":426,"props":427,"children":429},"span",{"class":428,"line":10},"line",[430],{"type":237,"tag":426,"props":431,"children":432},{},[433],{"type":243,"value":434},"swfl_00005f9f.xml.142_011_020\n",{"type":237,"tag":426,"props":436,"children":437},{"class":428,"line":16},[438],{"type":237,"tag":426,"props":439,"children":440},{},[441],{"type":243,"value":442},"swfl_00005f9f.bin.142_011_020\n",{"type":237,"tag":245,"props":444,"children":445},{},[446,448,454,456,462,464,470],{"type":243,"value":447},"The XML is a ",{"type":237,"tag":400,"props":449,"children":451},{"className":450},[],[452],{"type":243,"value":453},"BINARY-HEADER",{"type":243,"value":455}," describing one ",{"type":237,"tag":400,"props":457,"children":459},{"className":458},[],[460],{"type":243,"value":461},"BINARY-FLASHBLOCK",{"type":243,"value":463},". It records the identifier and version, the signature scheme (here RSA-2048 over SHA-256), a CRC16 checksum, and one or more flash segments that map a source range inside the ",{"type":237,"tag":400,"props":465,"children":467},{"className":466},[],[468],{"type":243,"value":469},".bin",{"type":243,"value":471}," to a target address range in the ECU:",{"type":237,"tag":417,"props":473,"children":477},{"className":474,"code":475,"language":476,"meta":172,"style":172},"language-xml shiki shiki-themes github-light github-dark","\u003CBINARY-FLASHBLOCK>\n  \u003CSHORT-NAME>swfl_00005f9f\u003C/SHORT-NAME>\n  \u003CSDGS>\n    \u003CSDG>\n      \u003CSDG-CAPTION>\u003CSHORT-NAME>Ident\u003C/SHORT-NAME>\u003C/SDG-CAPTION>\n      \u003CSD SI=\"ProcessClass\">swfl\u003C/SD>\n      \u003CSD SI=\"Identifier\">00005f9f\u003C/SD>\n      \u003CSD SI=\"Version\">142_011_020\u003C/SD>\n    \u003C/SDG>\n    \u003CSDG>\n      \u003CSDG-CAPTION>\u003CSHORT-NAME>SignatureTable\u003C/SHORT-NAME>\u003C/SDG-CAPTION>\n      \u003CSD SI=\"SignatureStatus\">SIGNED\u003C/SD>\n      \u003CSD SI=\"SignatureKeyLength\">2048\u003C/SD>\n      \u003CSD SI=\"SignatureHashMode\">SHA256\u003C/SD>\n      \u003CSD SI=\"SignatureMode\">rsa\u003C/SD>\n    \u003C/SDG>\n    \u003CSDG>\n      \u003CSDG-CAPTION>\u003CSHORT-NAME>Checksum\u003C/SHORT-NAME>\u003C/SDG-CAPTION>\n      \u003CSD SI=\"Mode\">CRC16\u003C/SD>\n      \u003CSD SI=\"Value\">E04B\u003C/SD>\n    \u003C/SDG>\n  \u003C/SDGS>\n  \u003CFLASH-SEGMENTS>\n    \u003CFLASH-SEGMENT COMPRESSION-STATUS=\"UNCOMPRESSED\">\n      \u003CSOURCE-START-ADDRESS>0000000\u003C/SOURCE-START-ADDRESS>\n      \u003CSOURCE-END-ADDRESS>057FFD0\u003C/SOURCE-END-ADDRESS>\n      \u003CTARGET-START-ADDRESS>1000020\u003C/TARGET-START-ADDRESS>\n      \u003CTARGET-END-ADDRESS>157FFF0\u003C/TARGET-END-ADDRESS>\n    \u003C/FLASH-SEGMENT>\n  \u003C/FLASH-SEGMENTS>\n\u003C/BINARY-FLASHBLOCK>\n","xml",[478],{"type":237,"tag":400,"props":479,"children":480},{"__ignoreMap":172},[481,500,526,542,559,603,645,682,719,735,750,790,827,864,901,938,953,968,1008,1045,1082,1097,1113,1129,1159,1184,1209,1234,1260,1276,1292],{"type":237,"tag":426,"props":482,"children":483},{"class":428,"line":10},[484,490,495],{"type":237,"tag":426,"props":485,"children":487},{"style":486},"--shiki-default:#24292E;--shiki-dark:#E1E4E8",[488],{"type":243,"value":489},"\u003C",{"type":237,"tag":426,"props":491,"children":493},{"style":492},"--shiki-default:#22863A;--shiki-dark:#85E89D",[494],{"type":243,"value":461},{"type":237,"tag":426,"props":496,"children":497},{"style":486},[498],{"type":243,"value":499},">\n",{"type":237,"tag":426,"props":501,"children":502},{"class":428,"line":16},[503,508,513,518,522],{"type":237,"tag":426,"props":504,"children":505},{"style":486},[506],{"type":243,"value":507},"  \u003C",{"type":237,"tag":426,"props":509,"children":510},{"style":492},[511],{"type":243,"value":512},"SHORT-NAME",{"type":237,"tag":426,"props":514,"children":515},{"style":486},[516],{"type":243,"value":517},">swfl_00005f9f\u003C/",{"type":237,"tag":426,"props":519,"children":520},{"style":492},[521],{"type":243,"value":512},{"type":237,"tag":426,"props":523,"children":524},{"style":486},[525],{"type":243,"value":499},{"type":237,"tag":426,"props":527,"children":528},{"class":428,"line":22},[529,533,538],{"type":237,"tag":426,"props":530,"children":531},{"style":486},[532],{"type":243,"value":507},{"type":237,"tag":426,"props":534,"children":535},{"style":492},[536],{"type":243,"value":537},"SDGS",{"type":237,"tag":426,"props":539,"children":540},{"style":486},[541],{"type":243,"value":499},{"type":237,"tag":426,"props":543,"children":544},{"class":428,"line":28},[545,550,555],{"type":237,"tag":426,"props":546,"children":547},{"style":486},[548],{"type":243,"value":549},"    \u003C",{"type":237,"tag":426,"props":551,"children":552},{"style":492},[553],{"type":243,"value":554},"SDG",{"type":237,"tag":426,"props":556,"children":557},{"style":486},[558],{"type":243,"value":499},{"type":237,"tag":426,"props":560,"children":561},{"class":428,"line":34},[562,567,572,577,581,586,590,595,599],{"type":237,"tag":426,"props":563,"children":564},{"style":486},[565],{"type":243,"value":566},"      \u003C",{"type":237,"tag":426,"props":568,"children":569},{"style":492},[570],{"type":243,"value":571},"SDG-CAPTION",{"type":237,"tag":426,"props":573,"children":574},{"style":486},[575],{"type":243,"value":576},">\u003C",{"type":237,"tag":426,"props":578,"children":579},{"style":492},[580],{"type":243,"value":512},{"type":237,"tag":426,"props":582,"children":583},{"style":486},[584],{"type":243,"value":585},">Ident\u003C/",{"type":237,"tag":426,"props":587,"children":588},{"style":492},[589],{"type":243,"value":512},{"type":237,"tag":426,"props":591,"children":592},{"style":486},[593],{"type":243,"value":594},">\u003C/",{"type":237,"tag":426,"props":596,"children":597},{"style":492},[598],{"type":243,"value":571},{"type":237,"tag":426,"props":600,"children":601},{"style":486},[602],{"type":243,"value":499},{"type":237,"tag":426,"props":604,"children":605},{"class":428,"line":40},[606,610,615,621,626,632,637,641],{"type":237,"tag":426,"props":607,"children":608},{"style":486},[609],{"type":243,"value":566},{"type":237,"tag":426,"props":611,"children":612},{"style":492},[613],{"type":243,"value":614},"SD",{"type":237,"tag":426,"props":616,"children":618},{"style":617},"--shiki-default:#6F42C1;--shiki-dark:#B392F0",[619],{"type":243,"value":620}," SI",{"type":237,"tag":426,"props":622,"children":623},{"style":486},[624],{"type":243,"value":625},"=",{"type":237,"tag":426,"props":627,"children":629},{"style":628},"--shiki-default:#032F62;--shiki-dark:#9ECBFF",[630],{"type":243,"value":631},"\"ProcessClass\"",{"type":237,"tag":426,"props":633,"children":634},{"style":486},[635],{"type":243,"value":636},">swfl\u003C/",{"type":237,"tag":426,"props":638,"children":639},{"style":492},[640],{"type":243,"value":614},{"type":237,"tag":426,"props":642,"children":643},{"style":486},[644],{"type":243,"value":499},{"type":237,"tag":426,"props":646,"children":647},{"class":428,"line":46},[648,652,656,660,664,669,674,678],{"type":237,"tag":426,"props":649,"children":650},{"style":486},[651],{"type":243,"value":566},{"type":237,"tag":426,"props":653,"children":654},{"style":492},[655],{"type":243,"value":614},{"type":237,"tag":426,"props":657,"children":658},{"style":617},[659],{"type":243,"value":620},{"type":237,"tag":426,"props":661,"children":662},{"style":486},[663],{"type":243,"value":625},{"type":237,"tag":426,"props":665,"children":666},{"style":628},[667],{"type":243,"value":668},"\"Identifier\"",{"type":237,"tag":426,"props":670,"children":671},{"style":486},[672],{"type":243,"value":673},">00005f9f\u003C/",{"type":237,"tag":426,"props":675,"children":676},{"style":492},[677],{"type":243,"value":614},{"type":237,"tag":426,"props":679,"children":680},{"style":486},[681],{"type":243,"value":499},{"type":237,"tag":426,"props":683,"children":684},{"class":428,"line":52},[685,689,693,697,701,706,711,715],{"type":237,"tag":426,"props":686,"children":687},{"style":486},[688],{"type":243,"value":566},{"type":237,"tag":426,"props":690,"children":691},{"style":492},[692],{"type":243,"value":614},{"type":237,"tag":426,"props":694,"children":695},{"style":617},[696],{"type":243,"value":620},{"type":237,"tag":426,"props":698,"children":699},{"style":486},[700],{"type":243,"value":625},{"type":237,"tag":426,"props":702,"children":703},{"style":628},[704],{"type":243,"value":705},"\"Version\"",{"type":237,"tag":426,"props":707,"children":708},{"style":486},[709],{"type":243,"value":710},">142_011_020\u003C/",{"type":237,"tag":426,"props":712,"children":713},{"style":492},[714],{"type":243,"value":614},{"type":237,"tag":426,"props":716,"children":717},{"style":486},[718],{"type":243,"value":499},{"type":237,"tag":426,"props":720,"children":721},{"class":428,"line":58},[722,727,731],{"type":237,"tag":426,"props":723,"children":724},{"style":486},[725],{"type":243,"value":726},"    \u003C/",{"type":237,"tag":426,"props":728,"children":729},{"style":492},[730],{"type":243,"value":554},{"type":237,"tag":426,"props":732,"children":733},{"style":486},[734],{"type":243,"value":499},{"type":237,"tag":426,"props":736,"children":737},{"class":428,"line":64},[738,742,746],{"type":237,"tag":426,"props":739,"children":740},{"style":486},[741],{"type":243,"value":549},{"type":237,"tag":426,"props":743,"children":744},{"style":492},[745],{"type":243,"value":554},{"type":237,"tag":426,"props":747,"children":748},{"style":486},[749],{"type":243,"value":499},{"type":237,"tag":426,"props":751,"children":752},{"class":428,"line":70},[753,757,761,765,769,774,778,782,786],{"type":237,"tag":426,"props":754,"children":755},{"style":486},[756],{"type":243,"value":566},{"type":237,"tag":426,"props":758,"children":759},{"style":492},[760],{"type":243,"value":571},{"type":237,"tag":426,"props":762,"children":763},{"style":486},[764],{"type":243,"value":576},{"type":237,"tag":426,"props":766,"children":767},{"style":492},[768],{"type":243,"value":512},{"type":237,"tag":426,"props":770,"children":771},{"style":486},[772],{"type":243,"value":773},">SignatureTable\u003C/",{"type":237,"tag":426,"props":775,"children":776},{"style":492},[777],{"type":243,"value":512},{"type":237,"tag":426,"props":779,"children":780},{"style":486},[781],{"type":243,"value":594},{"type":237,"tag":426,"props":783,"children":784},{"style":492},[785],{"type":243,"value":571},{"type":237,"tag":426,"props":787,"children":788},{"style":486},[789],{"type":243,"value":499},{"type":237,"tag":426,"props":791,"children":792},{"class":428,"line":76},[793,797,801,805,809,814,819,823],{"type":237,"tag":426,"props":794,"children":795},{"style":486},[796],{"type":243,"value":566},{"type":237,"tag":426,"props":798,"children":799},{"style":492},[800],{"type":243,"value":614},{"type":237,"tag":426,"props":802,"children":803},{"style":617},[804],{"type":243,"value":620},{"type":237,"tag":426,"props":806,"children":807},{"style":486},[808],{"type":243,"value":625},{"type":237,"tag":426,"props":810,"children":811},{"style":628},[812],{"type":243,"value":813},"\"SignatureStatus\"",{"type":237,"tag":426,"props":815,"children":816},{"style":486},[817],{"type":243,"value":818},">SIGNED\u003C/",{"type":237,"tag":426,"props":820,"children":821},{"style":492},[822],{"type":243,"value":614},{"type":237,"tag":426,"props":824,"children":825},{"style":486},[826],{"type":243,"value":499},{"type":237,"tag":426,"props":828,"children":829},{"class":428,"line":82},[830,834,838,842,846,851,856,860],{"type":237,"tag":426,"props":831,"children":832},{"style":486},[833],{"type":243,"value":566},{"type":237,"tag":426,"props":835,"children":836},{"style":492},[837],{"type":243,"value":614},{"type":237,"tag":426,"props":839,"children":840},{"style":617},[841],{"type":243,"value":620},{"type":237,"tag":426,"props":843,"children":844},{"style":486},[845],{"type":243,"value":625},{"type":237,"tag":426,"props":847,"children":848},{"style":628},[849],{"type":243,"value":850},"\"SignatureKeyLength\"",{"type":237,"tag":426,"props":852,"children":853},{"style":486},[854],{"type":243,"value":855},">2048\u003C/",{"type":237,"tag":426,"props":857,"children":858},{"style":492},[859],{"type":243,"value":614},{"type":237,"tag":426,"props":861,"children":862},{"style":486},[863],{"type":243,"value":499},{"type":237,"tag":426,"props":865,"children":866},{"class":428,"line":88},[867,871,875,879,883,888,893,897],{"type":237,"tag":426,"props":868,"children":869},{"style":486},[870],{"type":243,"value":566},{"type":237,"tag":426,"props":872,"children":873},{"style":492},[874],{"type":243,"value":614},{"type":237,"tag":426,"props":876,"children":877},{"style":617},[878],{"type":243,"value":620},{"type":237,"tag":426,"props":880,"children":881},{"style":486},[882],{"type":243,"value":625},{"type":237,"tag":426,"props":884,"children":885},{"style":628},[886],{"type":243,"value":887},"\"SignatureHashMode\"",{"type":237,"tag":426,"props":889,"children":890},{"style":486},[891],{"type":243,"value":892},">SHA256\u003C/",{"type":237,"tag":426,"props":894,"children":895},{"style":492},[896],{"type":243,"value":614},{"type":237,"tag":426,"props":898,"children":899},{"style":486},[900],{"type":243,"value":499},{"type":237,"tag":426,"props":902,"children":903},{"class":428,"line":95},[904,908,912,916,920,925,930,934],{"type":237,"tag":426,"props":905,"children":906},{"style":486},[907],{"type":243,"value":566},{"type":237,"tag":426,"props":909,"children":910},{"style":492},[911],{"type":243,"value":614},{"type":237,"tag":426,"props":913,"children":914},{"style":617},[915],{"type":243,"value":620},{"type":237,"tag":426,"props":917,"children":918},{"style":486},[919],{"type":243,"value":625},{"type":237,"tag":426,"props":921,"children":922},{"style":628},[923],{"type":243,"value":924},"\"SignatureMode\"",{"type":237,"tag":426,"props":926,"children":927},{"style":486},[928],{"type":243,"value":929},">rsa\u003C/",{"type":237,"tag":426,"props":931,"children":932},{"style":492},[933],{"type":243,"value":614},{"type":237,"tag":426,"props":935,"children":936},{"style":486},[937],{"type":243,"value":499},{"type":237,"tag":426,"props":939,"children":940},{"class":428,"line":101},[941,945,949],{"type":237,"tag":426,"props":942,"children":943},{"style":486},[944],{"type":243,"value":726},{"type":237,"tag":426,"props":946,"children":947},{"style":492},[948],{"type":243,"value":554},{"type":237,"tag":426,"props":950,"children":951},{"style":486},[952],{"type":243,"value":499},{"type":237,"tag":426,"props":954,"children":955},{"class":428,"line":107},[956,960,964],{"type":237,"tag":426,"props":957,"children":958},{"style":486},[959],{"type":243,"value":549},{"type":237,"tag":426,"props":961,"children":962},{"style":492},[963],{"type":243,"value":554},{"type":237,"tag":426,"props":965,"children":966},{"style":486},[967],{"type":243,"value":499},{"type":237,"tag":426,"props":969,"children":970},{"class":428,"line":113},[971,975,979,983,987,992,996,1000,1004],{"type":237,"tag":426,"props":972,"children":973},{"style":486},[974],{"type":243,"value":566},{"type":237,"tag":426,"props":976,"children":977},{"style":492},[978],{"type":243,"value":571},{"type":237,"tag":426,"props":980,"children":981},{"style":486},[982],{"type":243,"value":576},{"type":237,"tag":426,"props":984,"children":985},{"style":492},[986],{"type":243,"value":512},{"type":237,"tag":426,"props":988,"children":989},{"style":486},[990],{"type":243,"value":991},">Checksum\u003C/",{"type":237,"tag":426,"props":993,"children":994},{"style":492},[995],{"type":243,"value":512},{"type":237,"tag":426,"props":997,"children":998},{"style":486},[999],{"type":243,"value":594},{"type":237,"tag":426,"props":1001,"children":1002},{"style":492},[1003],{"type":243,"value":571},{"type":237,"tag":426,"props":1005,"children":1006},{"style":486},[1007],{"type":243,"value":499},{"type":237,"tag":426,"props":1009,"children":1010},{"class":428,"line":119},[1011,1015,1019,1023,1027,1032,1037,1041],{"type":237,"tag":426,"props":1012,"children":1013},{"style":486},[1014],{"type":243,"value":566},{"type":237,"tag":426,"props":1016,"children":1017},{"style":492},[1018],{"type":243,"value":614},{"type":237,"tag":426,"props":1020,"children":1021},{"style":617},[1022],{"type":243,"value":620},{"type":237,"tag":426,"props":1024,"children":1025},{"style":486},[1026],{"type":243,"value":625},{"type":237,"tag":426,"props":1028,"children":1029},{"style":628},[1030],{"type":243,"value":1031},"\"Mode\"",{"type":237,"tag":426,"props":1033,"children":1034},{"style":486},[1035],{"type":243,"value":1036},">CRC16\u003C/",{"type":237,"tag":426,"props":1038,"children":1039},{"style":492},[1040],{"type":243,"value":614},{"type":237,"tag":426,"props":1042,"children":1043},{"style":486},[1044],{"type":243,"value":499},{"type":237,"tag":426,"props":1046,"children":1047},{"class":428,"line":125},[1048,1052,1056,1060,1064,1069,1074,1078],{"type":237,"tag":426,"props":1049,"children":1050},{"style":486},[1051],{"type":243,"value":566},{"type":237,"tag":426,"props":1053,"children":1054},{"style":492},[1055],{"type":243,"value":614},{"type":237,"tag":426,"props":1057,"children":1058},{"style":617},[1059],{"type":243,"value":620},{"type":237,"tag":426,"props":1061,"children":1062},{"style":486},[1063],{"type":243,"value":625},{"type":237,"tag":426,"props":1065,"children":1066},{"style":628},[1067],{"type":243,"value":1068},"\"Value\"",{"type":237,"tag":426,"props":1070,"children":1071},{"style":486},[1072],{"type":243,"value":1073},">E04B\u003C/",{"type":237,"tag":426,"props":1075,"children":1076},{"style":492},[1077],{"type":243,"value":614},{"type":237,"tag":426,"props":1079,"children":1080},{"style":486},[1081],{"type":243,"value":499},{"type":237,"tag":426,"props":1083,"children":1084},{"class":428,"line":131},[1085,1089,1093],{"type":237,"tag":426,"props":1086,"children":1087},{"style":486},[1088],{"type":243,"value":726},{"type":237,"tag":426,"props":1090,"children":1091},{"style":492},[1092],{"type":243,"value":554},{"type":237,"tag":426,"props":1094,"children":1095},{"style":486},[1096],{"type":243,"value":499},{"type":237,"tag":426,"props":1098,"children":1099},{"class":428,"line":137},[1100,1105,1109],{"type":237,"tag":426,"props":1101,"children":1102},{"style":486},[1103],{"type":243,"value":1104},"  \u003C/",{"type":237,"tag":426,"props":1106,"children":1107},{"style":492},[1108],{"type":243,"value":537},{"type":237,"tag":426,"props":1110,"children":1111},{"style":486},[1112],{"type":243,"value":499},{"type":237,"tag":426,"props":1114,"children":1115},{"class":428,"line":143},[1116,1120,1125],{"type":237,"tag":426,"props":1117,"children":1118},{"style":486},[1119],{"type":243,"value":507},{"type":237,"tag":426,"props":1121,"children":1122},{"style":492},[1123],{"type":243,"value":1124},"FLASH-SEGMENTS",{"type":237,"tag":426,"props":1126,"children":1127},{"style":486},[1128],{"type":243,"value":499},{"type":237,"tag":426,"props":1130,"children":1131},{"class":428,"line":150},[1132,1136,1141,1146,1150,1155],{"type":237,"tag":426,"props":1133,"children":1134},{"style":486},[1135],{"type":243,"value":549},{"type":237,"tag":426,"props":1137,"children":1138},{"style":492},[1139],{"type":243,"value":1140},"FLASH-SEGMENT",{"type":237,"tag":426,"props":1142,"children":1143},{"style":617},[1144],{"type":243,"value":1145}," COMPRESSION-STATUS",{"type":237,"tag":426,"props":1147,"children":1148},{"style":486},[1149],{"type":243,"value":625},{"type":237,"tag":426,"props":1151,"children":1152},{"style":628},[1153],{"type":243,"value":1154},"\"UNCOMPRESSED\"",{"type":237,"tag":426,"props":1156,"children":1157},{"style":486},[1158],{"type":243,"value":499},{"type":237,"tag":426,"props":1160,"children":1161},{"class":428,"line":156},[1162,1166,1171,1176,1180],{"type":237,"tag":426,"props":1163,"children":1164},{"style":486},[1165],{"type":243,"value":566},{"type":237,"tag":426,"props":1167,"children":1168},{"style":492},[1169],{"type":243,"value":1170},"SOURCE-START-ADDRESS",{"type":237,"tag":426,"props":1172,"children":1173},{"style":486},[1174],{"type":243,"value":1175},">0000000\u003C/",{"type":237,"tag":426,"props":1177,"children":1178},{"style":492},[1179],{"type":243,"value":1170},{"type":237,"tag":426,"props":1181,"children":1182},{"style":486},[1183],{"type":243,"value":499},{"type":237,"tag":426,"props":1185,"children":1186},{"class":428,"line":162},[1187,1191,1196,1201,1205],{"type":237,"tag":426,"props":1188,"children":1189},{"style":486},[1190],{"type":243,"value":566},{"type":237,"tag":426,"props":1192,"children":1193},{"style":492},[1194],{"type":243,"value":1195},"SOURCE-END-ADDRESS",{"type":237,"tag":426,"props":1197,"children":1198},{"style":486},[1199],{"type":243,"value":1200},">057FFD0\u003C/",{"type":237,"tag":426,"props":1202,"children":1203},{"style":492},[1204],{"type":243,"value":1195},{"type":237,"tag":426,"props":1206,"children":1207},{"style":486},[1208],{"type":243,"value":499},{"type":237,"tag":426,"props":1210,"children":1211},{"class":428,"line":168},[1212,1216,1221,1226,1230],{"type":237,"tag":426,"props":1213,"children":1214},{"style":486},[1215],{"type":243,"value":566},{"type":237,"tag":426,"props":1217,"children":1218},{"style":492},[1219],{"type":243,"value":1220},"TARGET-START-ADDRESS",{"type":237,"tag":426,"props":1222,"children":1223},{"style":486},[1224],{"type":243,"value":1225},">1000020\u003C/",{"type":237,"tag":426,"props":1227,"children":1228},{"style":492},[1229],{"type":243,"value":1220},{"type":237,"tag":426,"props":1231,"children":1232},{"style":486},[1233],{"type":243,"value":499},{"type":237,"tag":426,"props":1235,"children":1237},{"class":428,"line":1236},28,[1238,1242,1247,1252,1256],{"type":237,"tag":426,"props":1239,"children":1240},{"style":486},[1241],{"type":243,"value":566},{"type":237,"tag":426,"props":1243,"children":1244},{"style":492},[1245],{"type":243,"value":1246},"TARGET-END-ADDRESS",{"type":237,"tag":426,"props":1248,"children":1249},{"style":486},[1250],{"type":243,"value":1251},">157FFF0\u003C/",{"type":237,"tag":426,"props":1253,"children":1254},{"style":492},[1255],{"type":243,"value":1246},{"type":237,"tag":426,"props":1257,"children":1258},{"style":486},[1259],{"type":243,"value":499},{"type":237,"tag":426,"props":1261,"children":1263},{"class":428,"line":1262},29,[1264,1268,1272],{"type":237,"tag":426,"props":1265,"children":1266},{"style":486},[1267],{"type":243,"value":726},{"type":237,"tag":426,"props":1269,"children":1270},{"style":492},[1271],{"type":243,"value":1140},{"type":237,"tag":426,"props":1273,"children":1274},{"style":486},[1275],{"type":243,"value":499},{"type":237,"tag":426,"props":1277,"children":1279},{"class":428,"line":1278},30,[1280,1284,1288],{"type":237,"tag":426,"props":1281,"children":1282},{"style":486},[1283],{"type":243,"value":1104},{"type":237,"tag":426,"props":1285,"children":1286},{"style":492},[1287],{"type":243,"value":1124},{"type":237,"tag":426,"props":1289,"children":1290},{"style":486},[1291],{"type":243,"value":499},{"type":237,"tag":426,"props":1293,"children":1295},{"class":428,"line":1294},31,[1296,1301,1305],{"type":237,"tag":426,"props":1297,"children":1298},{"style":486},[1299],{"type":243,"value":1300},"\u003C/",{"type":237,"tag":426,"props":1302,"children":1303},{"style":492},[1304],{"type":243,"value":461},{"type":237,"tag":426,"props":1306,"children":1307},{"style":486},[1308],{"type":243,"value":499},{"type":237,"tag":245,"props":1310,"children":1311},{},[1312,1314,1319,1321,1327,1329,1334,1336,1339,1341,1346,1348,1352,1354,1357],{"type":243,"value":1313},"The matching ",{"type":237,"tag":400,"props":1315,"children":1317},{"className":1316},[],[1318],{"type":243,"value":469},{"type":243,"value":1320}," holds the raw flash data for those segments. The ",{"type":237,"tag":400,"props":1322,"children":1324},{"className":1323},[],[1325],{"type":243,"value":1326},"COMPRESSION-STATUS",{"type":243,"value":1328}," attribute on each segment says whether that segment is compressed. When it is, BMW uses ",{"type":237,"tag":276,"props":1330,"children":1331},{},[1332],{"type":243,"value":1333},"NRV",{"type":243,"value":1335},", part of Markus Oberhumer's family of LZO-derived algorithms (the same author behind LZO and UPX) ",{"type":237,"tag":343,"props":1337,"children":1338},{"id":219},[],{"type":243,"value":1340},". The open-source ",{"type":237,"tag":276,"props":1342,"children":1343},{},[1344],{"type":243,"value":1345},"UCL",{"type":243,"value":1347}," library implements a compatible subset, and the practical tool is ",{"type":237,"tag":276,"props":1349,"children":1350},{},[1351],{"type":243,"value":224},{"type":243,"value":1353}," ",{"type":237,"tag":343,"props":1355,"children":1356},{"id":224},[],{"type":243,"value":1358},", which decompresses and recompresses the NRV data so the underlying image can be analyzed.",{"type":237,"tag":256,"props":1360,"children":1362},{"id":1361},"ford-vbf",[1363],{"type":243,"value":1364},"Ford (VBF)",{"type":237,"tag":245,"props":1366,"children":1367},{},[1368,1370,1375,1377,1386,1388,1391],{"type":243,"value":1369},"Ford (along with Volvo and Mazda) uses the ",{"type":237,"tag":276,"props":1371,"children":1372},{},[1373],{"type":243,"value":1374},"Versatile Binary Format",{"type":243,"value":1376},", ",{"type":237,"tag":276,"props":1378,"children":1379},{},[1380],{"type":237,"tag":400,"props":1381,"children":1383},{"className":1382},[],[1384],{"type":243,"value":1385},".vbf",{"type":243,"value":1387},". Files are obtained through Ford's FDRS dealer tool, or located and flashed with the third-party FORScan ",{"type":237,"tag":343,"props":1389,"children":1390},{"id":207},[],{"type":243,"value":359},{"type":237,"tag":245,"props":1393,"children":1394},{},[1395],{"type":243,"value":1396},"A VBF is the friendliest of the bunch: it starts with a plain ASCII header block, followed by the binary data blocks. The header records the software part number, the target ECU address, which memory ranges to erase, and the integrity and signing fields:",{"type":237,"tag":417,"props":1398,"children":1402},{"className":1399,"code":1400,"language":1401,"meta":172,"style":172},"language-c shiki shiki-themes github-light github-dark","vbf_version = 3.1;\n\nheader {\n    // This file was created by Hexview V1.12.02\n    description = {\"Ford Software\", \"Unsigned\"};\n    sw_part_number = \"ML3V-14D003-BD\";\n    sw_part_type = EXE;\n    data_format_identifier = 0x00;\n    ecu_address = 0x730;\n    frame_format = CAN_STANDARD;\n    erase = { { 0x10040000, 0x180000 } };\n    verification_structure_address = { 0x101BFD00 };\n    public_key_hash = \"5502BDA5815BC952...\";\n    file_checksum = 0x8DF103F0;\n    sw_signature = {\"28D6B7AAF86B72F0...\"};\n}\n","c",[1403],{"type":237,"tag":400,"props":1404,"children":1405},{"__ignoreMap":172},[1406,1430,1439,1447,1456,1492,1513,1530,1556,1581,1598,1643,1674,1695,1720,1745],{"type":237,"tag":426,"props":1407,"children":1408},{"class":428,"line":10},[1409,1414,1419,1425],{"type":237,"tag":426,"props":1410,"children":1411},{"style":486},[1412],{"type":243,"value":1413},"vbf_version ",{"type":237,"tag":426,"props":1415,"children":1417},{"style":1416},"--shiki-default:#D73A49;--shiki-dark:#F97583",[1418],{"type":243,"value":625},{"type":237,"tag":426,"props":1420,"children":1422},{"style":1421},"--shiki-default:#005CC5;--shiki-dark:#79B8FF",[1423],{"type":243,"value":1424}," 3.1",{"type":237,"tag":426,"props":1426,"children":1427},{"style":486},[1428],{"type":243,"value":1429},";\n",{"type":237,"tag":426,"props":1431,"children":1432},{"class":428,"line":16},[1433],{"type":237,"tag":426,"props":1434,"children":1436},{"emptyLinePlaceholder":1435},true,[1437],{"type":243,"value":1438},"\n",{"type":237,"tag":426,"props":1440,"children":1441},{"class":428,"line":22},[1442],{"type":237,"tag":426,"props":1443,"children":1444},{"style":486},[1445],{"type":243,"value":1446},"header {\n",{"type":237,"tag":426,"props":1448,"children":1449},{"class":428,"line":28},[1450],{"type":237,"tag":426,"props":1451,"children":1453},{"style":1452},"--shiki-default:#6A737D;--shiki-dark:#6A737D",[1454],{"type":243,"value":1455},"    // This file was created by Hexview V1.12.02\n",{"type":237,"tag":426,"props":1457,"children":1458},{"class":428,"line":34},[1459,1464,1468,1473,1478,1482,1487],{"type":237,"tag":426,"props":1460,"children":1461},{"style":486},[1462],{"type":243,"value":1463},"    description ",{"type":237,"tag":426,"props":1465,"children":1466},{"style":1416},[1467],{"type":243,"value":625},{"type":237,"tag":426,"props":1469,"children":1470},{"style":486},[1471],{"type":243,"value":1472}," {",{"type":237,"tag":426,"props":1474,"children":1475},{"style":628},[1476],{"type":243,"value":1477},"\"Ford Software\"",{"type":237,"tag":426,"props":1479,"children":1480},{"style":486},[1481],{"type":243,"value":1376},{"type":237,"tag":426,"props":1483,"children":1484},{"style":628},[1485],{"type":243,"value":1486},"\"Unsigned\"",{"type":237,"tag":426,"props":1488,"children":1489},{"style":486},[1490],{"type":243,"value":1491},"};\n",{"type":237,"tag":426,"props":1493,"children":1494},{"class":428,"line":40},[1495,1500,1504,1509],{"type":237,"tag":426,"props":1496,"children":1497},{"style":486},[1498],{"type":243,"value":1499},"    sw_part_number ",{"type":237,"tag":426,"props":1501,"children":1502},{"style":1416},[1503],{"type":243,"value":625},{"type":237,"tag":426,"props":1505,"children":1506},{"style":628},[1507],{"type":243,"value":1508}," \"ML3V-14D003-BD\"",{"type":237,"tag":426,"props":1510,"children":1511},{"style":486},[1512],{"type":243,"value":1429},{"type":237,"tag":426,"props":1514,"children":1515},{"class":428,"line":46},[1516,1521,1525],{"type":237,"tag":426,"props":1517,"children":1518},{"style":486},[1519],{"type":243,"value":1520},"    sw_part_type ",{"type":237,"tag":426,"props":1522,"children":1523},{"style":1416},[1524],{"type":243,"value":625},{"type":237,"tag":426,"props":1526,"children":1527},{"style":486},[1528],{"type":243,"value":1529}," EXE;\n",{"type":237,"tag":426,"props":1531,"children":1532},{"class":428,"line":52},[1533,1538,1542,1547,1552],{"type":237,"tag":426,"props":1534,"children":1535},{"style":486},[1536],{"type":243,"value":1537},"    data_format_identifier ",{"type":237,"tag":426,"props":1539,"children":1540},{"style":1416},[1541],{"type":243,"value":625},{"type":237,"tag":426,"props":1543,"children":1544},{"style":1416},[1545],{"type":243,"value":1546}," 0x",{"type":237,"tag":426,"props":1548,"children":1549},{"style":1421},[1550],{"type":243,"value":1551},"00",{"type":237,"tag":426,"props":1553,"children":1554},{"style":486},[1555],{"type":243,"value":1429},{"type":237,"tag":426,"props":1557,"children":1558},{"class":428,"line":58},[1559,1564,1568,1572,1577],{"type":237,"tag":426,"props":1560,"children":1561},{"style":486},[1562],{"type":243,"value":1563},"    ecu_address ",{"type":237,"tag":426,"props":1565,"children":1566},{"style":1416},[1567],{"type":243,"value":625},{"type":237,"tag":426,"props":1569,"children":1570},{"style":1416},[1571],{"type":243,"value":1546},{"type":237,"tag":426,"props":1573,"children":1574},{"style":1421},[1575],{"type":243,"value":1576},"730",{"type":237,"tag":426,"props":1578,"children":1579},{"style":486},[1580],{"type":243,"value":1429},{"type":237,"tag":426,"props":1582,"children":1583},{"class":428,"line":64},[1584,1589,1593],{"type":237,"tag":426,"props":1585,"children":1586},{"style":486},[1587],{"type":243,"value":1588},"    frame_format ",{"type":237,"tag":426,"props":1590,"children":1591},{"style":1416},[1592],{"type":243,"value":625},{"type":237,"tag":426,"props":1594,"children":1595},{"style":486},[1596],{"type":243,"value":1597}," CAN_STANDARD;\n",{"type":237,"tag":426,"props":1599,"children":1600},{"class":428,"line":70},[1601,1606,1610,1615,1620,1625,1629,1633,1638],{"type":237,"tag":426,"props":1602,"children":1603},{"style":486},[1604],{"type":243,"value":1605},"    erase ",{"type":237,"tag":426,"props":1607,"children":1608},{"style":1416},[1609],{"type":243,"value":625},{"type":237,"tag":426,"props":1611,"children":1612},{"style":486},[1613],{"type":243,"value":1614}," { { ",{"type":237,"tag":426,"props":1616,"children":1617},{"style":1416},[1618],{"type":243,"value":1619},"0x",{"type":237,"tag":426,"props":1621,"children":1622},{"style":1421},[1623],{"type":243,"value":1624},"10040000",{"type":237,"tag":426,"props":1626,"children":1627},{"style":486},[1628],{"type":243,"value":1376},{"type":237,"tag":426,"props":1630,"children":1631},{"style":1416},[1632],{"type":243,"value":1619},{"type":237,"tag":426,"props":1634,"children":1635},{"style":1421},[1636],{"type":243,"value":1637},"180000",{"type":237,"tag":426,"props":1639,"children":1640},{"style":486},[1641],{"type":243,"value":1642}," } };\n",{"type":237,"tag":426,"props":1644,"children":1645},{"class":428,"line":76},[1646,1651,1655,1660,1664,1669],{"type":237,"tag":426,"props":1647,"children":1648},{"style":486},[1649],{"type":243,"value":1650},"    verification_structure_address ",{"type":237,"tag":426,"props":1652,"children":1653},{"style":1416},[1654],{"type":243,"value":625},{"type":237,"tag":426,"props":1656,"children":1657},{"style":486},[1658],{"type":243,"value":1659}," { ",{"type":237,"tag":426,"props":1661,"children":1662},{"style":1416},[1663],{"type":243,"value":1619},{"type":237,"tag":426,"props":1665,"children":1666},{"style":1421},[1667],{"type":243,"value":1668},"101BFD00",{"type":237,"tag":426,"props":1670,"children":1671},{"style":486},[1672],{"type":243,"value":1673}," };\n",{"type":237,"tag":426,"props":1675,"children":1676},{"class":428,"line":82},[1677,1682,1686,1691],{"type":237,"tag":426,"props":1678,"children":1679},{"style":486},[1680],{"type":243,"value":1681},"    public_key_hash ",{"type":237,"tag":426,"props":1683,"children":1684},{"style":1416},[1685],{"type":243,"value":625},{"type":237,"tag":426,"props":1687,"children":1688},{"style":628},[1689],{"type":243,"value":1690}," \"5502BDA5815BC952...\"",{"type":237,"tag":426,"props":1692,"children":1693},{"style":486},[1694],{"type":243,"value":1429},{"type":237,"tag":426,"props":1696,"children":1697},{"class":428,"line":88},[1698,1703,1707,1711,1716],{"type":237,"tag":426,"props":1699,"children":1700},{"style":486},[1701],{"type":243,"value":1702},"    file_checksum ",{"type":237,"tag":426,"props":1704,"children":1705},{"style":1416},[1706],{"type":243,"value":625},{"type":237,"tag":426,"props":1708,"children":1709},{"style":1416},[1710],{"type":243,"value":1546},{"type":237,"tag":426,"props":1712,"children":1713},{"style":1421},[1714],{"type":243,"value":1715},"8DF103F0",{"type":237,"tag":426,"props":1717,"children":1718},{"style":486},[1719],{"type":243,"value":1429},{"type":237,"tag":426,"props":1721,"children":1722},{"class":428,"line":95},[1723,1728,1732,1736,1741],{"type":237,"tag":426,"props":1724,"children":1725},{"style":486},[1726],{"type":243,"value":1727},"    sw_signature ",{"type":237,"tag":426,"props":1729,"children":1730},{"style":1416},[1731],{"type":243,"value":625},{"type":237,"tag":426,"props":1733,"children":1734},{"style":486},[1735],{"type":243,"value":1472},{"type":237,"tag":426,"props":1737,"children":1738},{"style":628},[1739],{"type":243,"value":1740},"\"28D6B7AAF86B72F0...\"",{"type":237,"tag":426,"props":1742,"children":1743},{"style":486},[1744],{"type":243,"value":1491},{"type":237,"tag":426,"props":1746,"children":1747},{"class":428,"line":101},[1748],{"type":237,"tag":426,"props":1749,"children":1750},{"style":486},[1751],{"type":243,"value":1752},"}\n",{"type":237,"tag":245,"props":1754,"children":1755},{},[1756,1758,1764],{"type":243,"value":1757},"After the closing brace of the header come the data blocks. Each block is a fixed little structure: a 4-byte big-endian start address, a 4-byte big-endian length, the data itself, and a 2-byte CRC-16/CCITT over the (uncompressed) data. The header's ",{"type":237,"tag":400,"props":1759,"children":1761},{"className":1760},[],[1762],{"type":243,"value":1763},"file_checksum",{"type":243,"value":1765}," is a CRC-32 over the whole binary section.",{"type":237,"tag":245,"props":1767,"children":1768},{},[1769,1771,1777,1779,1785,1787,1793,1795,1800,1802,1805,1807,1811,1812,1815],{"type":243,"value":1770},"The ",{"type":237,"tag":400,"props":1772,"children":1774},{"className":1773},[],[1775],{"type":243,"value":1776},"data_format_identifier",{"type":243,"value":1778}," selects how the block data is encoded. ",{"type":237,"tag":400,"props":1780,"children":1782},{"className":1781},[],[1783],{"type":243,"value":1784},"0x00",{"type":243,"value":1786}," is raw; ",{"type":237,"tag":400,"props":1788,"children":1790},{"className":1789},[],[1791],{"type":243,"value":1792},"0x10",{"type":243,"value":1794}," means the block is ",{"type":237,"tag":276,"props":1796,"children":1797},{},[1798],{"type":243,"value":1799},"LZSS",{"type":243,"value":1801}," compressed (Lempel-Ziv-Storer-Szymanski, an LZ77 variant that drops back-references shorter than the break-even length) ",{"type":237,"tag":343,"props":1803,"children":1804},{"id":212},[],{"type":243,"value":1806},". A convenient tool for viewing and editing all of this, including the LZSS layer, is ",{"type":237,"tag":276,"props":1808,"children":1809},{},[1810],{"type":243,"value":202},{"type":243,"value":1353},{"type":237,"tag":343,"props":1813,"children":1814},{"id":202},[],{"type":243,"value":359},{"type":237,"tag":256,"props":1817,"children":1819},{"id":1818},"tesla-bhx",[1820],{"type":243,"value":1821},"Tesla (BHX)",{"type":237,"tag":245,"props":1823,"children":1824},{},[1825,1827,1830,1832,1838],{"type":243,"value":1826},"Tesla does not sell flash files through a dealer portal the way the legacy OEMs do. Instead, full and incremental updates are delivered over the air: the car opens a VPN tunnel to Tesla's servers, fetches an encrypted firmware blob over plain HTTP, and is given the decryption key over the secure channel. Pen Test Partners' write-up is a good reference for how the whole update pipeline fits together ",{"type":237,"tag":343,"props":1828,"children":1829},{"id":229},[],{"type":243,"value":1831},". Individual ECU images (",{"type":237,"tag":400,"props":1833,"children":1835},{"className":1834},[],[1836],{"type":243,"value":1837},".bhx",{"type":243,"value":1839}," files) can be recovered from a dumped infotainment (MCU) image.",{"type":237,"tag":245,"props":1841,"children":1842},{},[1843,1845,1851,1853,1859],{"type":243,"value":1844},"The module images use a small chunked container. It opens with a ",{"type":237,"tag":400,"props":1846,"children":1848},{"className":1847},[],[1849],{"type":243,"value":1850},"GHDR",{"type":243,"value":1852}," (\"global header\") record and one or more ",{"type":237,"tag":400,"props":1854,"children":1856},{"className":1855},[],[1857],{"type":243,"value":1858},"SHDR",{"type":243,"value":1860}," (\"segment header\") records, each carrying an id, a start address, and a length as big-endian 32-bit values, followed by the raw firmware:",{"type":237,"tag":417,"props":1862,"children":1864},{"className":419,"code":1863,"language":243,"meta":172,"style":172},"00000000: 4748 4452 0000 0001 000f 89a4 5348 4452  GHDR........SHDR\n00000010: 0000 0001 00fe 0000 000f 89a4 c0de cafe  ................\n00000020: 00a5 0001 00fe 1000 0000 0000 ffff ffff  ................\n",[1865],{"type":237,"tag":400,"props":1866,"children":1867},{"__ignoreMap":172},[1868,1876,1884],{"type":237,"tag":426,"props":1869,"children":1870},{"class":428,"line":10},[1871],{"type":237,"tag":426,"props":1872,"children":1873},{},[1874],{"type":243,"value":1875},"00000000: 4748 4452 0000 0001 000f 89a4 5348 4452  GHDR........SHDR\n",{"type":237,"tag":426,"props":1877,"children":1878},{"class":428,"line":16},[1879],{"type":237,"tag":426,"props":1880,"children":1881},{},[1882],{"type":243,"value":1883},"00000010: 0000 0001 00fe 0000 000f 89a4 c0de cafe  ................\n",{"type":237,"tag":426,"props":1885,"children":1886},{"class":428,"line":22},[1887],{"type":237,"tag":426,"props":1888,"children":1889},{},[1890],{"type":243,"value":1891},"00000020: 00a5 0001 00fe 1000 0000 0000 ffff ffff  ................\n",{"type":237,"tag":245,"props":1893,"children":1894},{},[1895,1897,1902,1904,1910,1912,1918,1920,1925],{"type":243,"value":1896},"Here the ",{"type":237,"tag":400,"props":1898,"children":1900},{"className":1899},[],[1901],{"type":243,"value":1858},{"type":243,"value":1903}," record gives a start address of ",{"type":237,"tag":400,"props":1905,"children":1907},{"className":1906},[],[1908],{"type":243,"value":1909},"0x00FE0000",{"type":243,"value":1911},", and a four-byte ",{"type":237,"tag":400,"props":1913,"children":1915},{"className":1914},[],[1916],{"type":243,"value":1917},"0xC0DECAFE",{"type":243,"value":1919}," word follows before the firmware itself begins. Carving out the data after the headers gives a flat binary that loads into a disassembler at the address from the ",{"type":237,"tag":400,"props":1921,"children":1923},{"className":1922},[],[1924],{"type":243,"value":1858},{"type":243,"value":359},{"type":237,"tag":256,"props":1927,"children":1929},{"id":1928},"toyota-cuw",[1930],{"type":243,"value":1931},"Toyota (CUW)",{"type":237,"tag":245,"props":1933,"children":1934},{},[1935,1937,1946],{"type":243,"value":1936},"Toyota, Lexus, and Scion calibration updates are ",{"type":237,"tag":276,"props":1938,"children":1939},{},[1940],{"type":237,"tag":400,"props":1941,"children":1943},{"className":1942},[],[1944],{"type":243,"value":1945},".cuw",{"type":243,"value":1947}," files (\"Calibration Update Wizard\"), downloaded from the TIS portal and applied by the Calibration Update Wizard inside Techstream.",{"type":237,"tag":245,"props":1949,"children":1950},{},[1951],{"type":243,"value":1952},"A CUW is refreshingly simple to inspect: it is a plain-text, INI-style file that opens in any editor. A header describes the vehicle and the target ECUs, including the seed/key material used for the UDS security access during programming, and the firmware itself is embedded further down. Long key fields are truncated below:",{"type":237,"tag":417,"props":1954,"children":1958},{"className":1955,"code":1956,"language":1957,"meta":172,"style":172},"language-ini shiki shiki-themes github-light github-dark","[Format]\nVersion=103\n[Vehicle]\nDateOfIssue=2020-02-05\nVehicleType=AXAH54L\nEngineType=A25A-FXS\nVehicleName=RAV4\nModelYear=19\n[Node01]\nDiagID=07A1\nECUAuthKey=3542354838...\nServiceAuthKey=45323A3739...\n[CPU11]\nCPUImageName=8965B0R02300.xx\nNewCID=8965B0R02300\nCompressionAlgorithm=40\nSeedKey=3538483935...\nNonce=30323445493...\n[CPUImage11]\nNumberOfAreaSettings=2\n01_StartAddress=10008000\n01_Length=00008000\n02_StartAddress=10028000\n02_Length=001D8000\n","ini",[1959],{"type":237,"tag":400,"props":1960,"children":1961},{"__ignoreMap":172},[1962,1970,1983,1991,2004,2017,2030,2043,2056,2064,2077,2090,2103,2111,2124,2137,2150,2163,2176,2184,2197,2210,2223,2236],{"type":237,"tag":426,"props":1963,"children":1964},{"class":428,"line":10},[1965],{"type":237,"tag":426,"props":1966,"children":1967},{"style":617},[1968],{"type":243,"value":1969},"[Format]\n",{"type":237,"tag":426,"props":1971,"children":1972},{"class":428,"line":16},[1973,1978],{"type":237,"tag":426,"props":1974,"children":1975},{"style":1416},[1976],{"type":243,"value":1977},"Version",{"type":237,"tag":426,"props":1979,"children":1980},{"style":486},[1981],{"type":243,"value":1982},"=103\n",{"type":237,"tag":426,"props":1984,"children":1985},{"class":428,"line":22},[1986],{"type":237,"tag":426,"props":1987,"children":1988},{"style":617},[1989],{"type":243,"value":1990},"[Vehicle]\n",{"type":237,"tag":426,"props":1992,"children":1993},{"class":428,"line":28},[1994,1999],{"type":237,"tag":426,"props":1995,"children":1996},{"style":1416},[1997],{"type":243,"value":1998},"DateOfIssue",{"type":237,"tag":426,"props":2000,"children":2001},{"style":486},[2002],{"type":243,"value":2003},"=2020-02-05\n",{"type":237,"tag":426,"props":2005,"children":2006},{"class":428,"line":34},[2007,2012],{"type":237,"tag":426,"props":2008,"children":2009},{"style":1416},[2010],{"type":243,"value":2011},"VehicleType",{"type":237,"tag":426,"props":2013,"children":2014},{"style":486},[2015],{"type":243,"value":2016},"=AXAH54L\n",{"type":237,"tag":426,"props":2018,"children":2019},{"class":428,"line":40},[2020,2025],{"type":237,"tag":426,"props":2021,"children":2022},{"style":1416},[2023],{"type":243,"value":2024},"EngineType",{"type":237,"tag":426,"props":2026,"children":2027},{"style":486},[2028],{"type":243,"value":2029},"=A25A-FXS\n",{"type":237,"tag":426,"props":2031,"children":2032},{"class":428,"line":46},[2033,2038],{"type":237,"tag":426,"props":2034,"children":2035},{"style":1416},[2036],{"type":243,"value":2037},"VehicleName",{"type":237,"tag":426,"props":2039,"children":2040},{"style":486},[2041],{"type":243,"value":2042},"=RAV4\n",{"type":237,"tag":426,"props":2044,"children":2045},{"class":428,"line":52},[2046,2051],{"type":237,"tag":426,"props":2047,"children":2048},{"style":1416},[2049],{"type":243,"value":2050},"ModelYear",{"type":237,"tag":426,"props":2052,"children":2053},{"style":486},[2054],{"type":243,"value":2055},"=19\n",{"type":237,"tag":426,"props":2057,"children":2058},{"class":428,"line":58},[2059],{"type":237,"tag":426,"props":2060,"children":2061},{"style":617},[2062],{"type":243,"value":2063},"[Node01]\n",{"type":237,"tag":426,"props":2065,"children":2066},{"class":428,"line":64},[2067,2072],{"type":237,"tag":426,"props":2068,"children":2069},{"style":1416},[2070],{"type":243,"value":2071},"DiagID",{"type":237,"tag":426,"props":2073,"children":2074},{"style":486},[2075],{"type":243,"value":2076},"=07A1\n",{"type":237,"tag":426,"props":2078,"children":2079},{"class":428,"line":70},[2080,2085],{"type":237,"tag":426,"props":2081,"children":2082},{"style":1416},[2083],{"type":243,"value":2084},"ECUAuthKey",{"type":237,"tag":426,"props":2086,"children":2087},{"style":486},[2088],{"type":243,"value":2089},"=3542354838...\n",{"type":237,"tag":426,"props":2091,"children":2092},{"class":428,"line":76},[2093,2098],{"type":237,"tag":426,"props":2094,"children":2095},{"style":1416},[2096],{"type":243,"value":2097},"ServiceAuthKey",{"type":237,"tag":426,"props":2099,"children":2100},{"style":486},[2101],{"type":243,"value":2102},"=45323A3739...\n",{"type":237,"tag":426,"props":2104,"children":2105},{"class":428,"line":82},[2106],{"type":237,"tag":426,"props":2107,"children":2108},{"style":617},[2109],{"type":243,"value":2110},"[CPU11]\n",{"type":237,"tag":426,"props":2112,"children":2113},{"class":428,"line":88},[2114,2119],{"type":237,"tag":426,"props":2115,"children":2116},{"style":1416},[2117],{"type":243,"value":2118},"CPUImageName",{"type":237,"tag":426,"props":2120,"children":2121},{"style":486},[2122],{"type":243,"value":2123},"=8965B0R02300.xx\n",{"type":237,"tag":426,"props":2125,"children":2126},{"class":428,"line":95},[2127,2132],{"type":237,"tag":426,"props":2128,"children":2129},{"style":1416},[2130],{"type":243,"value":2131},"NewCID",{"type":237,"tag":426,"props":2133,"children":2134},{"style":486},[2135],{"type":243,"value":2136},"=8965B0R02300\n",{"type":237,"tag":426,"props":2138,"children":2139},{"class":428,"line":101},[2140,2145],{"type":237,"tag":426,"props":2141,"children":2142},{"style":1416},[2143],{"type":243,"value":2144},"CompressionAlgorithm",{"type":237,"tag":426,"props":2146,"children":2147},{"style":486},[2148],{"type":243,"value":2149},"=40\n",{"type":237,"tag":426,"props":2151,"children":2152},{"class":428,"line":107},[2153,2158],{"type":237,"tag":426,"props":2154,"children":2155},{"style":1416},[2156],{"type":243,"value":2157},"SeedKey",{"type":237,"tag":426,"props":2159,"children":2160},{"style":486},[2161],{"type":243,"value":2162},"=3538483935...\n",{"type":237,"tag":426,"props":2164,"children":2165},{"class":428,"line":113},[2166,2171],{"type":237,"tag":426,"props":2167,"children":2168},{"style":1416},[2169],{"type":243,"value":2170},"Nonce",{"type":237,"tag":426,"props":2172,"children":2173},{"style":486},[2174],{"type":243,"value":2175},"=30323445493...\n",{"type":237,"tag":426,"props":2177,"children":2178},{"class":428,"line":119},[2179],{"type":237,"tag":426,"props":2180,"children":2181},{"style":617},[2182],{"type":243,"value":2183},"[CPUImage11]\n",{"type":237,"tag":426,"props":2185,"children":2186},{"class":428,"line":125},[2187,2192],{"type":237,"tag":426,"props":2188,"children":2189},{"style":1416},[2190],{"type":243,"value":2191},"NumberOfAreaSettings",{"type":237,"tag":426,"props":2193,"children":2194},{"style":486},[2195],{"type":243,"value":2196},"=2\n",{"type":237,"tag":426,"props":2198,"children":2199},{"class":428,"line":131},[2200,2205],{"type":237,"tag":426,"props":2201,"children":2202},{"style":1416},[2203],{"type":243,"value":2204},"01_StartAddress",{"type":237,"tag":426,"props":2206,"children":2207},{"style":486},[2208],{"type":243,"value":2209},"=10008000\n",{"type":237,"tag":426,"props":2211,"children":2212},{"class":428,"line":137},[2213,2218],{"type":237,"tag":426,"props":2214,"children":2215},{"style":1416},[2216],{"type":243,"value":2217},"01_Length",{"type":237,"tag":426,"props":2219,"children":2220},{"style":486},[2221],{"type":243,"value":2222},"=00008000\n",{"type":237,"tag":426,"props":2224,"children":2225},{"class":428,"line":143},[2226,2231],{"type":237,"tag":426,"props":2227,"children":2228},{"style":1416},[2229],{"type":243,"value":2230},"02_StartAddress",{"type":237,"tag":426,"props":2232,"children":2233},{"style":486},[2234],{"type":243,"value":2235},"=10028000\n",{"type":237,"tag":426,"props":2237,"children":2238},{"class":428,"line":150},[2239,2244],{"type":237,"tag":426,"props":2240,"children":2241},{"style":1416},[2242],{"type":243,"value":2243},"02_Length",{"type":237,"tag":426,"props":2245,"children":2246},{"style":486},[2247],{"type":243,"value":2248},"=001D8000\n",{"type":237,"tag":245,"props":2250,"children":2251},{},[2252,2254,2260,2262,2267,2269,2274,2276,2279,2281,2286],{"type":243,"value":2253},"The payload under each ",{"type":237,"tag":400,"props":2255,"children":2257},{"className":2256},[],[2258],{"type":243,"value":2259},"[CPUImageNN]",{"type":243,"value":2261}," section is ",{"type":237,"tag":276,"props":2263,"children":2264},{},[2265],{"type":243,"value":2266},"Motorola S-record (SREC)",{"type":243,"value":2268}," data. Some CUW files compress the S-record payload with ",{"type":237,"tag":276,"props":2270,"children":2271},{},[2272],{"type":243,"value":2273},"LZF",{"type":243,"value":2275}," (Marc Lehmann's liblzf, a tiny and very fast LZ77 variant) ",{"type":237,"tag":343,"props":2277,"children":2278},{"id":197},[],{"type":243,"value":2280},", which has to be inflated first; the ",{"type":237,"tag":400,"props":2282,"children":2284},{"className":2283},[],[2285],{"type":243,"value":2144},{"type":243,"value":2287}," field in the header indicates this. On newer ECUs the image is encrypted, so a raw SREC-to-binary conversion only yields ciphertext.",{"type":237,"tag":256,"props":2289,"children":2291},{"id":2290},"volkswagen-group-frf-odx",[2292],{"type":243,"value":2293},"Volkswagen Group (FRF / ODX)",{"type":237,"tag":245,"props":2295,"children":2296},{},[2297,2299,2308],{"type":243,"value":2298},"VW, Audi, Škoda, SEAT, and the rest of the VAG brands distribute flash data (\"flashdaten\") as ",{"type":237,"tag":276,"props":2300,"children":2301},{},[2302],{"type":237,"tag":400,"props":2303,"children":2305},{"className":2304},[],[2306],{"type":243,"value":2307},".frf",{"type":243,"value":2309}," files, downloaded through ODIS or the erWin portal.",{"type":237,"tag":245,"props":2311,"children":2312},{},[2313,2315,2320,2322,2328],{"type":243,"value":2314},"An FRF is a thin obfuscation wrapper around a ZIP archive. The whole file is run through a custom byte-wise stream cipher, and the decrypted result is an ordinary ZIP containing an ",{"type":237,"tag":276,"props":2316,"children":2317},{},[2318],{"type":243,"value":2319},"ODX-F",{"type":243,"value":2321}," flash container (or an ",{"type":237,"tag":400,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":243,"value":2327},"SGO",{"type":243,"value":2329}," binary). Because the wrapper is a stream cipher over a ZIP, the first bytes of a raw FRF look like pure noise:",{"type":237,"tag":417,"props":2331,"children":2333},{"className":419,"code":2332,"language":243,"meta":172,"style":172},"00000000: 0a9c 927c 51a5 e1b5 61a3 8c5e c910 5375  ...|Q...a..^..Su\n00000010: e30d 39f6 5916 a529 e1e5 9705 93e8 a903  ..9.Y..)........\n00000020: 48c6 3e6e b0cf d6e8 c1c3 e792 c518 4e2d  H.>n..........N-\n",[2334],{"type":237,"tag":400,"props":2335,"children":2336},{"__ignoreMap":172},[2337,2345,2353],{"type":237,"tag":426,"props":2338,"children":2339},{"class":428,"line":10},[2340],{"type":237,"tag":426,"props":2341,"children":2342},{},[2343],{"type":243,"value":2344},"00000000: 0a9c 927c 51a5 e1b5 61a3 8c5e c910 5375  ...|Q...a..^..Su\n",{"type":237,"tag":426,"props":2346,"children":2347},{"class":428,"line":16},[2348],{"type":237,"tag":426,"props":2349,"children":2350},{},[2351],{"type":243,"value":2352},"00000010: e30d 39f6 5916 a529 e1e5 9705 93e8 a903  ..9.Y..)........\n",{"type":237,"tag":426,"props":2354,"children":2355},{"class":428,"line":22},[2356],{"type":237,"tag":426,"props":2357,"children":2358},{},[2359],{"type":243,"value":2360},"00000020: 48c6 3e6e b0cf d6e8 c1c3 e792 c518 4e2d  H.>n..........N-\n",{"type":237,"tag":245,"props":2362,"children":2363},{},[2364,2366,2371,2373,2376,2378,2384,2386,2392],{"type":243,"value":2365},"The cleanest way to unpack one is Brian Ledbetter's ",{"type":237,"tag":276,"props":2367,"children":2368},{},[2369],{"type":243,"value":2370},"VW_Flash",{"type":243,"value":2372}," toolkit ",{"type":237,"tag":343,"props":2374,"children":2375},{"id":192},[],{"type":243,"value":2377},". Its ",{"type":237,"tag":400,"props":2379,"children":2381},{"className":2380},[],[2382],{"type":243,"value":2383},"frf/decryptfrf.py",{"type":243,"value":2385}," reverses the stream cipher and extracts the ZIP, and ",{"type":237,"tag":400,"props":2387,"children":2389},{"className":2388},[],[2390],{"type":243,"value":2391},"extractodx.py",{"type":243,"value":2393}," goes one level deeper to produce a flashable binary from the ODX flash blocks:",{"type":237,"tag":245,"props":2395,"children":2396},{},[2397,2399,2402],{"type":243,"value":2398},"Inside the ZIP is the ODX flash file. ODX (Open Diagnostic data eXchange) is an ASAM and ISO standard, XML-based, that describes ECU diagnostic and flash data ",{"type":237,"tag":343,"props":2400,"children":2401},{"id":186},[],{"type":243,"value":2403},". The flash flavor (often called ODX-F) is human readable and self-documenting. The top of the container identifies the part and the tool that built it:",{"type":237,"tag":417,"props":2405,"children":2407},{"className":474,"code":2406,"language":476,"meta":172,"style":172},"\u003CODX MODEL-VERSION=\"2.0.1\" ...>\n  \u003CFLASH ID=\"FL_3Q0907530AA5366_S\">\n    \u003CSHORT-NAME>FL_3Q0907530AA5366_S\u003C/SHORT-NAME>\n    \u003CLONG-NAME>3Q0 907 530AA 5366 _S\u003C/LONG-NAME>\n    \u003CADMIN-DATA>\n      \u003CDOC-REVISIONS>\n        \u003CDOC-REVISION>\n          \u003CREVISION-LABEL>5366\u003C/REVISION-LABEL>\n          \u003CSTATE>NEW\u003C/STATE>\n          \u003CDATE>2018-06-29T09:44:42\u003C/DATE>\n          \u003CTOOL>EB tresos Flashbuilder V2.1.6\u003C/TOOL>\n        \u003C/DOC-REVISION>\n      ...\n",[2408],{"type":237,"tag":400,"props":2409,"children":2410},{"__ignoreMap":172},[2411,2442,2472,2496,2521,2537,2553,2570,2596,2621,2646,2671,2687],{"type":237,"tag":426,"props":2412,"children":2413},{"class":428,"line":10},[2414,2418,2423,2428,2432,2437],{"type":237,"tag":426,"props":2415,"children":2416},{"style":486},[2417],{"type":243,"value":489},{"type":237,"tag":426,"props":2419,"children":2420},{"style":492},[2421],{"type":243,"value":2422},"ODX",{"type":237,"tag":426,"props":2424,"children":2425},{"style":617},[2426],{"type":243,"value":2427}," MODEL-VERSION",{"type":237,"tag":426,"props":2429,"children":2430},{"style":486},[2431],{"type":243,"value":625},{"type":237,"tag":426,"props":2433,"children":2434},{"style":628},[2435],{"type":243,"value":2436},"\"2.0.1\"",{"type":237,"tag":426,"props":2438,"children":2439},{"style":486},[2440],{"type":243,"value":2441}," ...>\n",{"type":237,"tag":426,"props":2443,"children":2444},{"class":428,"line":16},[2445,2449,2454,2459,2463,2468],{"type":237,"tag":426,"props":2446,"children":2447},{"style":486},[2448],{"type":243,"value":507},{"type":237,"tag":426,"props":2450,"children":2451},{"style":492},[2452],{"type":243,"value":2453},"FLASH",{"type":237,"tag":426,"props":2455,"children":2456},{"style":617},[2457],{"type":243,"value":2458}," ID",{"type":237,"tag":426,"props":2460,"children":2461},{"style":486},[2462],{"type":243,"value":625},{"type":237,"tag":426,"props":2464,"children":2465},{"style":628},[2466],{"type":243,"value":2467},"\"FL_3Q0907530AA5366_S\"",{"type":237,"tag":426,"props":2469,"children":2470},{"style":486},[2471],{"type":243,"value":499},{"type":237,"tag":426,"props":2473,"children":2474},{"class":428,"line":22},[2475,2479,2483,2488,2492],{"type":237,"tag":426,"props":2476,"children":2477},{"style":486},[2478],{"type":243,"value":549},{"type":237,"tag":426,"props":2480,"children":2481},{"style":492},[2482],{"type":243,"value":512},{"type":237,"tag":426,"props":2484,"children":2485},{"style":486},[2486],{"type":243,"value":2487},">FL_3Q0907530AA5366_S\u003C/",{"type":237,"tag":426,"props":2489,"children":2490},{"style":492},[2491],{"type":243,"value":512},{"type":237,"tag":426,"props":2493,"children":2494},{"style":486},[2495],{"type":243,"value":499},{"type":237,"tag":426,"props":2497,"children":2498},{"class":428,"line":28},[2499,2503,2508,2513,2517],{"type":237,"tag":426,"props":2500,"children":2501},{"style":486},[2502],{"type":243,"value":549},{"type":237,"tag":426,"props":2504,"children":2505},{"style":492},[2506],{"type":243,"value":2507},"LONG-NAME",{"type":237,"tag":426,"props":2509,"children":2510},{"style":486},[2511],{"type":243,"value":2512},">3Q0 907 530AA 5366 _S\u003C/",{"type":237,"tag":426,"props":2514,"children":2515},{"style":492},[2516],{"type":243,"value":2507},{"type":237,"tag":426,"props":2518,"children":2519},{"style":486},[2520],{"type":243,"value":499},{"type":237,"tag":426,"props":2522,"children":2523},{"class":428,"line":34},[2524,2528,2533],{"type":237,"tag":426,"props":2525,"children":2526},{"style":486},[2527],{"type":243,"value":549},{"type":237,"tag":426,"props":2529,"children":2530},{"style":492},[2531],{"type":243,"value":2532},"ADMIN-DATA",{"type":237,"tag":426,"props":2534,"children":2535},{"style":486},[2536],{"type":243,"value":499},{"type":237,"tag":426,"props":2538,"children":2539},{"class":428,"line":40},[2540,2544,2549],{"type":237,"tag":426,"props":2541,"children":2542},{"style":486},[2543],{"type":243,"value":566},{"type":237,"tag":426,"props":2545,"children":2546},{"style":492},[2547],{"type":243,"value":2548},"DOC-REVISIONS",{"type":237,"tag":426,"props":2550,"children":2551},{"style":486},[2552],{"type":243,"value":499},{"type":237,"tag":426,"props":2554,"children":2555},{"class":428,"line":46},[2556,2561,2566],{"type":237,"tag":426,"props":2557,"children":2558},{"style":486},[2559],{"type":243,"value":2560},"        \u003C",{"type":237,"tag":426,"props":2562,"children":2563},{"style":492},[2564],{"type":243,"value":2565},"DOC-REVISION",{"type":237,"tag":426,"props":2567,"children":2568},{"style":486},[2569],{"type":243,"value":499},{"type":237,"tag":426,"props":2571,"children":2572},{"class":428,"line":52},[2573,2578,2583,2588,2592],{"type":237,"tag":426,"props":2574,"children":2575},{"style":486},[2576],{"type":243,"value":2577},"          \u003C",{"type":237,"tag":426,"props":2579,"children":2580},{"style":492},[2581],{"type":243,"value":2582},"REVISION-LABEL",{"type":237,"tag":426,"props":2584,"children":2585},{"style":486},[2586],{"type":243,"value":2587},">5366\u003C/",{"type":237,"tag":426,"props":2589,"children":2590},{"style":492},[2591],{"type":243,"value":2582},{"type":237,"tag":426,"props":2593,"children":2594},{"style":486},[2595],{"type":243,"value":499},{"type":237,"tag":426,"props":2597,"children":2598},{"class":428,"line":58},[2599,2603,2608,2613,2617],{"type":237,"tag":426,"props":2600,"children":2601},{"style":486},[2602],{"type":243,"value":2577},{"type":237,"tag":426,"props":2604,"children":2605},{"style":492},[2606],{"type":243,"value":2607},"STATE",{"type":237,"tag":426,"props":2609,"children":2610},{"style":486},[2611],{"type":243,"value":2612},">NEW\u003C/",{"type":237,"tag":426,"props":2614,"children":2615},{"style":492},[2616],{"type":243,"value":2607},{"type":237,"tag":426,"props":2618,"children":2619},{"style":486},[2620],{"type":243,"value":499},{"type":237,"tag":426,"props":2622,"children":2623},{"class":428,"line":64},[2624,2628,2633,2638,2642],{"type":237,"tag":426,"props":2625,"children":2626},{"style":486},[2627],{"type":243,"value":2577},{"type":237,"tag":426,"props":2629,"children":2630},{"style":492},[2631],{"type":243,"value":2632},"DATE",{"type":237,"tag":426,"props":2634,"children":2635},{"style":486},[2636],{"type":243,"value":2637},">2018-06-29T09:44:42\u003C/",{"type":237,"tag":426,"props":2639,"children":2640},{"style":492},[2641],{"type":243,"value":2632},{"type":237,"tag":426,"props":2643,"children":2644},{"style":486},[2645],{"type":243,"value":499},{"type":237,"tag":426,"props":2647,"children":2648},{"class":428,"line":70},[2649,2653,2658,2663,2667],{"type":237,"tag":426,"props":2650,"children":2651},{"style":486},[2652],{"type":243,"value":2577},{"type":237,"tag":426,"props":2654,"children":2655},{"style":492},[2656],{"type":243,"value":2657},"TOOL",{"type":237,"tag":426,"props":2659,"children":2660},{"style":486},[2661],{"type":243,"value":2662},">EB tresos Flashbuilder V2.1.6\u003C/",{"type":237,"tag":426,"props":2664,"children":2665},{"style":492},[2666],{"type":243,"value":2657},{"type":237,"tag":426,"props":2668,"children":2669},{"style":486},[2670],{"type":243,"value":499},{"type":237,"tag":426,"props":2672,"children":2673},{"class":428,"line":76},[2674,2679,2683],{"type":237,"tag":426,"props":2675,"children":2676},{"style":486},[2677],{"type":243,"value":2678},"        \u003C/",{"type":237,"tag":426,"props":2680,"children":2681},{"style":492},[2682],{"type":243,"value":2565},{"type":237,"tag":426,"props":2684,"children":2685},{"style":486},[2686],{"type":243,"value":499},{"type":237,"tag":426,"props":2688,"children":2689},{"class":428,"line":82},[2690],{"type":237,"tag":426,"props":2691,"children":2692},{"style":486},[2693],{"type":243,"value":2694},"      ...\n",{"type":237,"tag":245,"props":2696,"children":2697},{},[2698,2700,2706,2708,2714,2716,2722,2724,2730,2731,2737],{"type":243,"value":2699},"Further down, a ",{"type":237,"tag":400,"props":2701,"children":2703},{"className":2702},[],[2704],{"type":243,"value":2705},"SESSION",{"type":243,"value":2707}," lists the spare-part numbers the image is valid for (",{"type":237,"tag":400,"props":2709,"children":2711},{"className":2710},[],[2712],{"type":243,"value":2713},"EXPECTED-IDENT",{"type":243,"value":2715},"), and the actual memory image is described by ",{"type":237,"tag":400,"props":2717,"children":2719},{"className":2718},[],[2720],{"type":243,"value":2721},"DATABLOCK",{"type":243,"value":2723}," / ",{"type":237,"tag":400,"props":2725,"children":2727},{"className":2726},[],[2728],{"type":243,"value":2729},"SEGMENT",{"type":243,"value":2723},{"type":237,"tag":400,"props":2732,"children":2734},{"className":2733},[],[2735],{"type":243,"value":2736},"FLASHDATA",{"type":243,"value":2738}," elements. Each segment carries its start address and size, and each flash data block records how it is encoded and (if needed) compressed:",{"type":237,"tag":417,"props":2740,"children":2742},{"className":474,"code":2741,"language":476,"meta":172,"style":172},"\u003CDATABLOCK ID=\"...DB_0DATA\" TYPE=\"DATA\">\n  \u003CSEGMENTS>\n    \u003CSEGMENT ID=\"...SEG_0DATA\">\n      \u003CSOURCE-START-ADDRESS>...\u003C/SOURCE-START-ADDRESS>\n      \u003CUNCOMPRESSED-SIZE>...\u003C/UNCOMPRESSED-SIZE>\n    \u003C/SEGMENT>\n  \u003C/SEGMENTS>\n\u003C/DATABLOCK>\n\u003CFLASHDATA ID=\"...FD_0DATA\" xsi:type=\"INTERN-FLASHDATA\">\n  \u003CDATAFORMAT SELECTION=\"BINARY\"/>\n  \u003CENCRYPT-COMPRESS-METHOD TYPE=\"A_BYTEFIELD\">00\u003C/ENCRYPT-COMPRESS-METHOD>\n  \u003CDATA>...\u003C/DATA>\n\u003C/FLASHDATA>\n",[2743],{"type":237,"tag":400,"props":2744,"children":2745},{"__ignoreMap":172},[2746,2788,2804,2832,2856,2880,2895,2910,2925,2967,2998,3036,3060],{"type":237,"tag":426,"props":2747,"children":2748},{"class":428,"line":10},[2749,2753,2757,2761,2765,2770,2775,2779,2784],{"type":237,"tag":426,"props":2750,"children":2751},{"style":486},[2752],{"type":243,"value":489},{"type":237,"tag":426,"props":2754,"children":2755},{"style":492},[2756],{"type":243,"value":2721},{"type":237,"tag":426,"props":2758,"children":2759},{"style":617},[2760],{"type":243,"value":2458},{"type":237,"tag":426,"props":2762,"children":2763},{"style":486},[2764],{"type":243,"value":625},{"type":237,"tag":426,"props":2766,"children":2767},{"style":628},[2768],{"type":243,"value":2769},"\"...DB_0DATA\"",{"type":237,"tag":426,"props":2771,"children":2772},{"style":617},[2773],{"type":243,"value":2774}," TYPE",{"type":237,"tag":426,"props":2776,"children":2777},{"style":486},[2778],{"type":243,"value":625},{"type":237,"tag":426,"props":2780,"children":2781},{"style":628},[2782],{"type":243,"value":2783},"\"DATA\"",{"type":237,"tag":426,"props":2785,"children":2786},{"style":486},[2787],{"type":243,"value":499},{"type":237,"tag":426,"props":2789,"children":2790},{"class":428,"line":16},[2791,2795,2800],{"type":237,"tag":426,"props":2792,"children":2793},{"style":486},[2794],{"type":243,"value":507},{"type":237,"tag":426,"props":2796,"children":2797},{"style":492},[2798],{"type":243,"value":2799},"SEGMENTS",{"type":237,"tag":426,"props":2801,"children":2802},{"style":486},[2803],{"type":243,"value":499},{"type":237,"tag":426,"props":2805,"children":2806},{"class":428,"line":22},[2807,2811,2815,2819,2823,2828],{"type":237,"tag":426,"props":2808,"children":2809},{"style":486},[2810],{"type":243,"value":549},{"type":237,"tag":426,"props":2812,"children":2813},{"style":492},[2814],{"type":243,"value":2729},{"type":237,"tag":426,"props":2816,"children":2817},{"style":617},[2818],{"type":243,"value":2458},{"type":237,"tag":426,"props":2820,"children":2821},{"style":486},[2822],{"type":243,"value":625},{"type":237,"tag":426,"props":2824,"children":2825},{"style":628},[2826],{"type":243,"value":2827},"\"...SEG_0DATA\"",{"type":237,"tag":426,"props":2829,"children":2830},{"style":486},[2831],{"type":243,"value":499},{"type":237,"tag":426,"props":2833,"children":2834},{"class":428,"line":28},[2835,2839,2843,2848,2852],{"type":237,"tag":426,"props":2836,"children":2837},{"style":486},[2838],{"type":243,"value":566},{"type":237,"tag":426,"props":2840,"children":2841},{"style":492},[2842],{"type":243,"value":1170},{"type":237,"tag":426,"props":2844,"children":2845},{"style":486},[2846],{"type":243,"value":2847},">...\u003C/",{"type":237,"tag":426,"props":2849,"children":2850},{"style":492},[2851],{"type":243,"value":1170},{"type":237,"tag":426,"props":2853,"children":2854},{"style":486},[2855],{"type":243,"value":499},{"type":237,"tag":426,"props":2857,"children":2858},{"class":428,"line":34},[2859,2863,2868,2872,2876],{"type":237,"tag":426,"props":2860,"children":2861},{"style":486},[2862],{"type":243,"value":566},{"type":237,"tag":426,"props":2864,"children":2865},{"style":492},[2866],{"type":243,"value":2867},"UNCOMPRESSED-SIZE",{"type":237,"tag":426,"props":2869,"children":2870},{"style":486},[2871],{"type":243,"value":2847},{"type":237,"tag":426,"props":2873,"children":2874},{"style":492},[2875],{"type":243,"value":2867},{"type":237,"tag":426,"props":2877,"children":2878},{"style":486},[2879],{"type":243,"value":499},{"type":237,"tag":426,"props":2881,"children":2882},{"class":428,"line":40},[2883,2887,2891],{"type":237,"tag":426,"props":2884,"children":2885},{"style":486},[2886],{"type":243,"value":726},{"type":237,"tag":426,"props":2888,"children":2889},{"style":492},[2890],{"type":243,"value":2729},{"type":237,"tag":426,"props":2892,"children":2893},{"style":486},[2894],{"type":243,"value":499},{"type":237,"tag":426,"props":2896,"children":2897},{"class":428,"line":46},[2898,2902,2906],{"type":237,"tag":426,"props":2899,"children":2900},{"style":486},[2901],{"type":243,"value":1104},{"type":237,"tag":426,"props":2903,"children":2904},{"style":492},[2905],{"type":243,"value":2799},{"type":237,"tag":426,"props":2907,"children":2908},{"style":486},[2909],{"type":243,"value":499},{"type":237,"tag":426,"props":2911,"children":2912},{"class":428,"line":52},[2913,2917,2921],{"type":237,"tag":426,"props":2914,"children":2915},{"style":486},[2916],{"type":243,"value":1300},{"type":237,"tag":426,"props":2918,"children":2919},{"style":492},[2920],{"type":243,"value":2721},{"type":237,"tag":426,"props":2922,"children":2923},{"style":486},[2924],{"type":243,"value":499},{"type":237,"tag":426,"props":2926,"children":2927},{"class":428,"line":58},[2928,2932,2936,2940,2944,2949,2954,2958,2963],{"type":237,"tag":426,"props":2929,"children":2930},{"style":486},[2931],{"type":243,"value":489},{"type":237,"tag":426,"props":2933,"children":2934},{"style":492},[2935],{"type":243,"value":2736},{"type":237,"tag":426,"props":2937,"children":2938},{"style":617},[2939],{"type":243,"value":2458},{"type":237,"tag":426,"props":2941,"children":2942},{"style":486},[2943],{"type":243,"value":625},{"type":237,"tag":426,"props":2945,"children":2946},{"style":628},[2947],{"type":243,"value":2948},"\"...FD_0DATA\"",{"type":237,"tag":426,"props":2950,"children":2951},{"style":617},[2952],{"type":243,"value":2953}," xsi:type",{"type":237,"tag":426,"props":2955,"children":2956},{"style":486},[2957],{"type":243,"value":625},{"type":237,"tag":426,"props":2959,"children":2960},{"style":628},[2961],{"type":243,"value":2962},"\"INTERN-FLASHDATA\"",{"type":237,"tag":426,"props":2964,"children":2965},{"style":486},[2966],{"type":243,"value":499},{"type":237,"tag":426,"props":2968,"children":2969},{"class":428,"line":64},[2970,2974,2979,2984,2988,2993],{"type":237,"tag":426,"props":2971,"children":2972},{"style":486},[2973],{"type":243,"value":507},{"type":237,"tag":426,"props":2975,"children":2976},{"style":492},[2977],{"type":243,"value":2978},"DATAFORMAT",{"type":237,"tag":426,"props":2980,"children":2981},{"style":617},[2982],{"type":243,"value":2983}," SELECTION",{"type":237,"tag":426,"props":2985,"children":2986},{"style":486},[2987],{"type":243,"value":625},{"type":237,"tag":426,"props":2989,"children":2990},{"style":628},[2991],{"type":243,"value":2992},"\"BINARY\"",{"type":237,"tag":426,"props":2994,"children":2995},{"style":486},[2996],{"type":243,"value":2997},"/>\n",{"type":237,"tag":426,"props":2999,"children":3000},{"class":428,"line":70},[3001,3005,3010,3014,3018,3023,3028,3032],{"type":237,"tag":426,"props":3002,"children":3003},{"style":486},[3004],{"type":243,"value":507},{"type":237,"tag":426,"props":3006,"children":3007},{"style":492},[3008],{"type":243,"value":3009},"ENCRYPT-COMPRESS-METHOD",{"type":237,"tag":426,"props":3011,"children":3012},{"style":617},[3013],{"type":243,"value":2774},{"type":237,"tag":426,"props":3015,"children":3016},{"style":486},[3017],{"type":243,"value":625},{"type":237,"tag":426,"props":3019,"children":3020},{"style":628},[3021],{"type":243,"value":3022},"\"A_BYTEFIELD\"",{"type":237,"tag":426,"props":3024,"children":3025},{"style":486},[3026],{"type":243,"value":3027},">00\u003C/",{"type":237,"tag":426,"props":3029,"children":3030},{"style":492},[3031],{"type":243,"value":3009},{"type":237,"tag":426,"props":3033,"children":3034},{"style":486},[3035],{"type":243,"value":499},{"type":237,"tag":426,"props":3037,"children":3038},{"class":428,"line":76},[3039,3043,3048,3052,3056],{"type":237,"tag":426,"props":3040,"children":3041},{"style":486},[3042],{"type":243,"value":507},{"type":237,"tag":426,"props":3044,"children":3045},{"style":492},[3046],{"type":243,"value":3047},"DATA",{"type":237,"tag":426,"props":3049,"children":3050},{"style":486},[3051],{"type":243,"value":2847},{"type":237,"tag":426,"props":3053,"children":3054},{"style":492},[3055],{"type":243,"value":3047},{"type":237,"tag":426,"props":3057,"children":3058},{"style":486},[3059],{"type":243,"value":499},{"type":237,"tag":426,"props":3061,"children":3062},{"class":428,"line":82},[3063,3067,3071],{"type":237,"tag":426,"props":3064,"children":3065},{"style":486},[3066],{"type":243,"value":1300},{"type":237,"tag":426,"props":3068,"children":3069},{"style":492},[3070],{"type":243,"value":2736},{"type":237,"tag":426,"props":3072,"children":3073},{"style":486},[3074],{"type":243,"value":499},{"type":237,"tag":245,"props":3076,"children":3077},{},[3078,3079,3084,3086,3092,3094,3099],{"type":243,"value":1770},{"type":237,"tag":400,"props":3080,"children":3082},{"className":3081},[],[3083],{"type":243,"value":3009},{"type":243,"value":3085}," byte is what tells the tool whether the embedded ",{"type":237,"tag":400,"props":3087,"children":3089},{"className":3088},[],[3090],{"type":243,"value":3091},"\u003CDATA>",{"type":243,"value":3093}," is plain, compressed, or encrypted, which is exactly the part ",{"type":237,"tag":400,"props":3095,"children":3097},{"className":3096},[],[3098],{"type":243,"value":2391},{"type":243,"value":3100}," knows how to undo.",{"type":237,"tag":256,"props":3102,"children":3104},{"id":3103},"references",[3105],{"type":243,"value":3106},"References",{"type":237,"tag":3108,"props":3109,"children":3110},"chapter-references",{},[],{"type":237,"tag":3112,"props":3113,"children":3114},"style",{},[3115],{"type":243,"value":3116},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":172,"searchDepth":16,"depth":16,"links":3118},[3119,3120,3121,3122,3123,3124,3125],{"id":258,"depth":16,"text":261},{"id":376,"depth":16,"text":379},{"id":1361,"depth":16,"text":1364},{"id":1818,"depth":16,"text":1821},{"id":1928,"depth":16,"text":1931},{"id":2290,"depth":16,"text":2293},{"id":3103,"depth":16,"text":3106},"markdown","content:7.knowledge-base:3.reverse-engineering:2.oem-update-files.md","content","md",1779543672131]