Apple provides firmware updates for their Airport products through 'Airport Utility'. Firmware files can be downloaded with the help of ~/Library/Application\ Support/Apple/AirPort/Firmware/version.xml which contains all products and their available firmware versions:
...
<dict>
<key>location</key>
<string>http://apsu.apple.com/data/115/041-9815.20130814.1Rver/7.6.4.basebinary</string>
<key>newest</key>
<true/>
<key>productID</key>
<string>115</string>
<key>sizeInBytes</key>
<integer>5674968</integer>
<key>sourceVersion</key>
<string>76400.10</string>
<key>version</key>
<string>7.6.4</string>
</dict>
<dict>
<key>location</key>
<string>http://apsu.apple.com/data/115/041-9696.20130207.Ch5g6/7.6.3.basebinary</string>
<key>productID</key>
<string>115</string>
<key>sizeInBytes</key>
<integer>5674344</integer>
<key>sourceVersion</key>
<string>76300.7</string>
<key>version</key>
<string>7.6.3</string>
</dict>
<dict>
<key>location</key>
<string>http://apsu.apple.com/data/115/041-0311.20130207.aaWs/7.6.2.basebinary</string>
<key>productID</key>
<string>115</string>
<key>sizeInBytes</key>
<integer>5627396</integer>
<key>sourceVersion</key>
<string>76200.16</string>
<key>version</key>
<string>7.6.2</string>
</dict>
...
For the Airport Express (model A1392, productID 115, see WikiDevi, Teardown by Rogue Amoeba) there are 3 firmware versions: 7.6.2, 7.6.3 and 7.6.4 (current).
I downloaded all 3 versions and used binwalk (v1.2.2-1) on them. They seem to be encrypted:
$ binwalk -H 7.6.3.basebinary
DECIMAL HEX HEURISTIC ANALYSIS
-------------------------------------------------------------------------------------------------------------------
0 0x0 High entropy data, best guess: encrypted, size: 5673944, 0 low entropy blocks
Examining different firmware files revealed their common structure.
Offset 0-D: static string APPLE-FIRMWARE
Offset E: static hex 00
Offset F: firmware format version (?) (8 bit signed) hex 2D => format 45 (7.5.x firmwares have format version 44, 7.7.x firmwares have format version 46)
Offset 10-12: static hex 00 00 00
Offset 13: product ID (8 bit signed) hex 73 => product ID 115
Offset 14: Firmware Major Version (8 bit signed) hex 07 => major version 7 (aka 7.x)
Offset 15: Firmware Minor Version (8 bit signed) hex 63 => minor version 63 (aka x.63)
Offset 16-1F: checksum or size for following part?
Offset 20-2D: static string APPLE-FIRMWARE
Offset 2E: static hex 00
Offset 2F: firmware format version (?) (8 bit signed) hex 2D => format 45 (7.5.x firmwares have format version 44, 7.7.x firmwares have format version 46)
Offset 30-32: static hex 00 00 00
Offset 33: product ID (8 bit signed) hex 73 => product ID 115
Offset 34: Firmware Major Version (8 bit signed) hex 07 => major version 7 (aka 7.x)
Offset 35: Firmware Minor Version (8 bit signed) hex 63 => minor version 63 (aka x.63)
Offset 36-3F: checksum or size for following part?
Offset 40-12F: boot code? 344FE72ADE3CC2202D6A221A3B67B6075B0F13CA37F5DCCAE5ED626BAE0B4655E618766D703B5190CCD578BCF06D6C9ECD97265B962F49478BE1E9FDE8160E5CCDC09B0C975A3D271D988791258ACC6E679A1556F01C2100DDD0B35E8DA388119C35AC8765DB5DC6AAD6E3D7232D47B4EFA97B32AEF6FF77EDB43946103187342DF68BE88D6B005DAF7CC212777C4FA7FEFD3FD299088EE73EC6FAB1596A92835E4E2450750D9AB5F86780464E341CBFE61E7B8F224285CB3D47D3891AD614B1ABD04DB3DACE7622B22355752F29FF7C5492635F9B99F966759DA4070F23B1D20E197F72BDAFA2B36B567C8E756147A2
Do you have any idea on how to go forward?
What kind of encryption could have been used? Apple seems to use AES for Iphone and AppleTV firmware.