1

Context: Taking my first stab at reverse engineering, I am trying to install firmware intended for a machine sold in a different region (EAS) to my machine (US). I believe Brother sells the same machine (hardware) but firmware differs by region. Apparently there are some sort of verification mechanisms that prevents me from installing firmware not intended for this machine, and I want to figure out how to overcome this.

Now looking at the firmwares, I have believe that byte 0x38 0x39 0x3a 0x3b is denoting which machine can install this firmware, as these 4 bytes remained the same in an older version firmware. And byte 0x00 to 0x03 seems to be some sort of checksum, and 0x04 to 0x07 is the same sequence stored in reverse order, but I cannot figure out what that checksum is, how it is generated, or why it is stored again in reverse order.

EAS Firmware MCBNE0A107.upf (https://support.brother.com/g/b/downloadtop.aspx?c=as_ot&lang=en&prod=hf_inovnv180eas)

00000000: b495 7116 1671 95b4 436f 7079 7269 6768  ..q..q..Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b02 0507 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6b00 6600 ffff  ..........k.f...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................

US Firmware MCBNM0A107.upf (https://support.brother.com/g/b/downloadtop.aspx?c=us&lang=en&prod=hf_lb5000eus)

00000000: a941 51d6 d651 41a9 436f 7079 7269 6768  .AQ..QA.Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b01 0900 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6b00 6600 ffff  ..........k.f...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................

US Firmware (Old Version) MCBNM0A106.upf

00000000: 1a61 ab83 83ab 611a 436f 7079 7269 6768  .a....a.Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b01 0900 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6a00 6500 ffff  ..........j.e...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................

I tried setting the first 8 bytes to 00 and doing CRC32 on the entire firmware, but it didn't seem to match. Again I am clueless on how a firmware is generally written or how a checksum is generated. Any hints would be appreciated!

And I don't know if I need to temper with the remaining sections of the firmware.

//content list?
00000100: 626f 6f74 5f52 656c 6561 7365 2e62 6c00  boot_Release.bl.
00000110: 0100 0000 87b4 49f9 0000 0084 0000 0200  ......I.........
00000120: 7570 6730 2e70 7267 0000 0000 0000 0000  upg0.prg........
00000130: 0200 0000 65c9 ad0f 0000 0684 0000 0800  ....e...........
00000140: 7570 6730 2e64 6174 0000 0000 0000 0000  upg0.dat........
00000150: 0300 0000 9659 c760 0000 0e84 f842 0100  .....Y.`.....B..
00000160: 7570 6731 2e70 7267 0000 0000 0000 0000  upg1.prg........
00000170: 0200 0000 4919 e011 0000 1084 0000 0800  ....I...........
00000180: 7570 6731 2e64 6174 0000 0000 0000 0000  upg1.dat........
00000190: 0300 0000 9659 c760 0000 1884 f842 0100  .....Y.`.....B..
000001a0: 6d61 696e 2e70 7267 0000 0000 0000 0000  main.prg........
000001b0: 0700 0000 2e84 1dab 0000 0000 00c2 0200  ................
000001c0: 7061 6e65 6c2e 7072 6700 0000 0000 0000  panel.prg.......
000001d0: 0600 0000 d26e 5bd4 0000 1a84 e4bc 2200  .....n[.......".
000001e0: 4d32 436f 6d44 6174 612e 6461 7400 0000  M2ComData.dat...
000001f0: 0800 0000 06ab 8518 0000 8084 ac56 5300  .............VS.
00000200: 666f 6e74 4461 7461 4352 4f4d 2e64 6100  fontDataCROM.da.
00000210: 0500 0000 1094 9227 0000 a085 0000 4400  .......'......D.
00000220: 416c 6c5f 4461 7461 5f43 4d42 5f4e 4500  All_Data_CMB_NE.
00000230: 0900 0000 2182 1978 0000 fe84 0001 0000  ....!..x........
00000240: 7044 6174 5f43 4e45 4d30 2e64 6174 0000  pDat_CNEM0.dat..
00000250: 0a00 0000 fe65 727b 0000 0085 58a2 2d00  .....er{....X.-.
00000260: 1000 ffff 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
...
// start of executable?
00000750: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000760: 0000 0011 0000 0013 0000 d025 0000 d825  ...........%...%
00000770: 0000 f025 3c08 3141 4088 6000 0000 0000  ...%<.1A@.`.....
00000780: 0000 0000 4080 6800 0000 0000 0000 0000  [email protected].........
00000790: 4008 8000 3c09 7000 0109 4024 3c09 00c0  @...<.p...@$<...
000007a0: 3529 8003 0109 4025 4088 8000 0000 0000  5)....@%@.......
000007b0: 0000 0000 0000 0000 3c0a bd51 8d4a 0000  ........<..Q.J..
000007c0: 3c0b 0010 014b 5024 3c0b 0010 114b 0007  <....KP$<....K..

From a teardown video on Youtube the machine has a ETON ET866 E213441 motherboard if that means anything.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.