Tektronix firmware XOR puzzle

Question

As a means of learning about packing firmware and for fun I am trying to unpack the latest firmware for an entry level Tektronix Function generator firmware attached

I have read the forum and installed a REMnux VM. I have also used the XOR Cracker site.

I have convinced myself the file is XORed and not encrypted using binvis image attached

The sites and the tools all concur as to probable XOR patterns, 94 94 90 a1 91 89 91 92 being the most likely.

I have also studied the excellent information available on Malwarebytes

However, saving all combinations of XORed file I am unable to find and meaningful strings nor get binwalk to make any sense of the saved file.

Am I missing something? Can anybody suggest any other strategy to yield the un-xored file?

Answer 1

It is just addition/subtraction (mod 256).

#!/usr/bin/python3
# These key bytes are the two's complement of the hex sequence mentioned in the question.
# The string appears twice in the decrypted blob, which makes me think it's what is used.
key = [ord(n) for n in "llp_owon"]

with open("AFG1022_V1.2.4.tfb", "rb") as infile:
  data = infile.read()
outdata=bytearray()
for n in range(0, len(data)):
  outdata.append((data[n]+key[n%len(key)])&0xff)
with open("decrypted.bin", "wb") as outfile:
  outfile.write(outdata)

Edit: Some extra information:

// all uint32_t values are little endian
struct section {
  uint32_t valid; // 0x00000001 if present, 0x00000000 if not
  uint32_t offset; // offset to beginning of this payload in this file
  uint32_t length; // length of this payload
  uint32_t crc32; // crc32 of the payload described by this section
};


// This is the header at the start of the firmware file
struct firmware_header {
  uint32_t crc32; // crc32 of file_contents[4:]
  uint8_t version[16]; // version string
  uint8_t package_type[12]; // package type string ("UpgradePack")
  section s[8]; // the payloads, see above for the structure
  uint8_t model[40]]; // hardware model
};

// Each section index accesses a specific path
const char *section_paths[8] = {
  "/flash/boot/fp",
  "/flash/boot/tx",
  "/flash/boot/bmp",  // splashscreen bitmap
  "/flash/boot/hz",
  "/flash/boot/os",   // load at address 0x00000000, ARM
  "/flash/boot/bios",
  "/flash/boot/menu",
  "/flash/boot/help",
};