This repo will centralize few item founds on forums regarding SMEG firmware.
Thanks to @DarkSino and @pixx for their notes on SMEG inner mecanics. Thanks to @MWyann that developped a RaspberryPi USB key that acts as a connected key from PSA.
Rather than trying to understand vxWorks that seems to act similarly to a kernel in linux, I digged into the upgrade process which sets everything at it's right place. Thus it offers the perfect opportunity to understand how the SMEG works. Cherry on the cake, the upgrade binary is in ELF format, and consequently analysis will be far more easy !
Thanks to a first pass on upgrade proccess, now I'm able to analyze efficiently the vxWorks.bin
Thanks to the new GHIDRA SRE tool, I'll now be able to share my disassembly work on vxWorks and upgrade process. Feel free to contribute
GHIDRA archives are located in ghidra subdirectory.
- SMEG+ Firmware Analysis
- Switch to GHIDRA SRE
Create an RPi Zero0W hotspot for longer remote acess to shell
+ two mass storage luns (one for music, and another for automtic ZAR and Maps download from car)- vxWorks disassembly
parse and process embedded Symbol tableparse all stringsdefine shell commands structures- find the correct r2 (TOC) value.
LOOKING for a PowerPC expert to understand
Work on License file for maps updateidentify format and location- Test License file
- List all USB devices supported : VID/PID + class (EEM/MS/any other)
- List all internal commands (WIP)
test vxWorks commands-> UPDATE of command list- Dig on 3333 port server (GPS related)
- Dig on 20000 port server
- Find U-Boot location + dump ?
- Finish upgrade process analysis
Thanks to analysis of Upgrade process, it appears that any map upgrade that needs and Activation key to be typed on SMEG unit, can be skipped if the key is stored in a specific file.
Just create a text file SMEG_PLUS_UPG/DATA/Licence
with the 16 char of the key.
No CRC files are required on this License file.
Tested and approved.
-> version
VxWorks (for Freescale MPC5121E ADS (Rev 0.1)) version 6.7.
Kernel: WIND version 2.12.
Made on May 26 2017, 13:23:36.
Boot line:
usb(0,0)host:vxWorks h=192.168.10.2 e=192.168.10.1 u=5121 pw=5121 f=0x0 tn=DB600
Board reference on WindRiver
https://marketplace.windriver.com/index.php?bsp&on=details&bsp=6901
MCU reference on NXP
https://www.nxp.com/products/processors-and-microcontrollers/power-architecture-processors/mpc5xxx-55xx-32-bit-mcus/mobilegt-51xx-52xx/32-bit-power-architecture-microcontrollers:MPC5121e
Opened SMEG Unit (for physical UART connection)
Based on TFFS (True Flash File System).
vxWorks creates the following parts :
Type | Device Name | Usage | Contents |
---|---|---|---|
7 | /romfs | Internal NAND | Debug binaries for audio & scheduler.bin |
3 | /ram | RAM | Contains config files, but not readable from telnet |
3 | /sdhc:0 | Internal µSD | Cartographie GPS + Cheat Codes x3 + TTS |
3 | /sdhc:1 | Internal µSD | User Guide |
3 | /bd0 | USB Mass Storage | |
3 | /SYSTEM | Internal NAND ? | |
3 | /SYSTEM_DATA | Internal NAND ? | |
3 | /SYSTEM_TMP_DATA | Internal NAND ? | |
3 | /USER_DATA | Internal NAND ? | |
3 | /USER_DATA_BACKUP | Internal NAND ? | |
3 | /EXTENDED_PARTITION |
Offset | Binary | Comments |
---|---|---|
0x00010000 | ELF files | Dedicated space to load ELF files |
0x00200000 | vxWorks.bin | |
0x01000000 | f_BigQuick.bin@0x801 | Nav Binary is located in f_BigQuick.bin. The later embeds for ZLIB part. The first is the Nav binary. It can be extracted with binwalk |
SMEG relies on U-Boot and vxWorks softwares.
To Fill : U-Boot version
This software part is stored in NAND Flash out of any filesystem at location 0x????????
For updates, this binary is located in "TBD", with a filename u-boot-nand.bin
This section details the Upgrade process for SMEG+ FW, based on upgrade.out
located in the root of archive
(dedicated page)
This section details the Upgrade process for MAPS / ZAR, based on UpgPlugin.out
located in the root of archive
the upgrade process seems to be managed by the following function :
_DWORD C_UPGRADE::UpgradeTask(C_UPGRADE *__hidden this)
As a summary, the upgrade procedure is made of many steps, no details to share so far.
However, at some point in the time, the following steps applies :
CheckCompatibilityTask();
- which initialize callback in plugin instanceCheckPresenceOfDRMOnMedia(this);
- Check if DRM id available on SD
It verifies of the following file existsSMEG_PLUS_UPG/DATA/Licence
CheckDRMMedia(this);
- check DRM content and validity if DRM available on SD- and finally starts the upgrade.
- https://www.forum-peugeot.com/Forum/threads/rooter-le-smeg.9541
- https://github.com/Mwyann/psakey
- https://www.vxdev.com/docs/vx55man/vxworks/ref/rtnIndex.htm
- https://groups.google.com/forum/#!topic/comp.os.vxworks/njEArmJWxzU
- https://ghidra-sre.org/