1

Why I want to decrypt:

Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS.

Problems I met:

The macOS BT firmware loader needs .hex file. However, I have no idea how this .sfi file is encrypted and I have to extract the filesystem.

What I have done:

To be honest, I am still in alpha stage. I try to make sense how linux deal with the firmware by studying firmware_class.c. Really need some guide here.

readable output by strings -n 10 shows:

Copyright (c) 1
996-2011 Express
 Logic Inc. * Th
readX ARC600/Met
aWare Version G5
 SN: 3306-09
Processing
#######*******11111118888888???????FFFFFFFMMMMMMMTTTTTTT[[[[[[[bbbbbbbiiiiiiipqr
ssssssszzzzzzz
Starved Poll Normal
oll Starved
BE Poll Normal
BE Poll Resync BE
BE Poll Resync GT
BE Poll Data Idle
BE Poll Data Data
BE Poll Data No Data
GT Poll Normal
GT Poll Resync
(*AB238<)+4567C
Lmp Rsp Pending
?0H6A<Z:S(l.e$~"w
pSC_Thread
pHCI_Thread
pLLC_Thread
pLC_Thread
pSP_Thread
pLEC_Thread
  %(*.1499AEI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
  !!""##$$%%&&''(())**++,,--..//011223344556778899:;;<<==>??@@ABBCCDEEFFGHHIJJKKLMMNOOPQQRSSTUUVWWXYYZ[[\]^^_``abccdeffghiijkllmnoopqr
Fsstuvwwxyz{||}~
System Timer Thread
../../Sources/Infra/Src/fsmI
../../Sources/Hal/Src/UartRx.c
../../Sources/Ltec/Src/LtecCtrl.c
../../Sources/Ltec/Src/LtecPm.c

and hexdump makes no sense to me

Also there's no luck by running binwalk:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
528028        0x80E9C         Copyright string: "Copyright (c) 1"

Source:

ibt-12-16.sfi

ibt-12-16.ddc

Additional Details:

ibt-12-16.ddc & ibt-12-16.sfi are loaded in L578 in btintel.c

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.