I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question would be, normally do DFU files include the full device firmware or just a portion of it and the device knows how to update the specific portion?

Assuming for now that the file contains the full firmware, does anyone know anything about firmware images for CSR Bluetooth SOC's? I know that the speaker is using a CSR SOC because the DFU starts with CSR-dfu2.

Opening the DFU file in Audacity and playing it, we can see that it contains all the sound effects the speaker plays as well as some sections of static that I assume are code: firmware in Audacity

I am fairly confident that these sections are code/data because they contains strings like tts/0.raw and tts/1.raw. However, there is a null byte in between each character of the strings which suggests that they are UTF-16 strings. Does anyone know of an embedded filesystem that uses UTF-16 filenames?

Unfortunately binwalk does not provide any useful information. However, I found what I believe to be the full JBL Flip 4 firmware image image and binwalk reveals several sections:

0             0x0             CSR (XAP2) DFU firmware update header
1380          0x564           CSR Bluecore firmware segment
1931310       0x1D782E        YAFFS filesystem, big endian

Does anyone have any experience with CSR or JBL firmware and could provide guidance or a suggestion of how to extract code from the DFU? Thank you.


This is a BlueCore02 Device Firmware Upgrade File. I could not find a specification, but the BlueCore01 specification contains more or less the same fields (with a few differences)

| improve this answer | |
  • If anyone can give a hint where to find the second version of the specification: I would really appreciate it. – Johannes Mittendorfer Dec 31 '19 at 8:43
  • What a life saver! I'll let you know if I find the BlueCore02 specs. – genghiskhan Jan 2 at 17:59
  • I've found the following URL on web archive: web.archive.org/web/20041022135603/http://www.csrsupport.com/… that looks like it has more recent BlueCore DFU specs however it requires a CSR login. I'm not sure if it'd even work if someone had a valid email/password but it'd be worth a shot. – genghiskhan Jan 2 at 20:23
  • I tried but wasn't successful. Looks like it is not available any more... – Johannes Mittendorfer Jan 19 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.