CSR DFU File Format

Question

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question would be, normally do DFU files include the full device firmware or just a portion of it and the device knows how to update the specific portion?

Assuming for now that the file contains the full firmware, does anyone know anything about firmware images for CSR Bluetooth SOC's? I know that the speaker is using a CSR SOC because the DFU starts with CSR-dfu2.

Opening the DFU file in Audacity and playing it, we can see that it contains all the sound effects the speaker plays as well as some sections of static that I assume are code:

I am fairly confident that these sections are code/data because they contains strings like tts/0.raw and tts/1.raw. However, there is a null byte in between each character of the strings which suggests that they are UTF-16 strings. Does anyone know of an embedded filesystem that uses UTF-16 filenames?

Unfortunately binwalk does not provide any useful information. However, I found what I believe to be the full JBL Flip 4 firmware image image and binwalk reveals several sections:

0             0x0             CSR (XAP2) DFU firmware update header
1380          0x564           CSR Bluecore firmware segment
1931310       0x1D782E        YAFFS filesystem, big endian

Does anyone have any experience with CSR or JBL firmware and could provide guidance or a suggestion of how to extract code from the DFU? Thank you.

Answer 1

This is a BlueCore02 Device Firmware Upgrade File. I could not find a specification, but the BlueCore01 specification contains more or less the same fields (with a few differences)

Answer 2

I've found this project https://github.com/lorf/csr-spi-ftdi, along with info:

BlueCore 2 chips (such as BC212015) are not supported in BlueSuite 2.4 and above

what means they are intentionally try to enforce developers to use more high level tools . Above github tool should help you identify exact chip without disassembling physical device. I've checked the one above and found here: https://www.chipfind.net/datasheet/csr/bc212015.htm The datasheet gives some meaningful info - it describes Bluecore2 virtual machine, and also mentions CSR’s BlueLab, Casira and MicroSira development kits which may be good direction for documentation search:

This version of the stack firmware requires no host processor. All software layers, including application software, run on the internal RISC processor in a protected user software execution environment known as a Virtual Machine (VM).

The user may write custom application code to run on the BlueCore VM using BlueLabTM software development kit (SDK) supplied with the BlueLab and Casira development kits, available separately from CSR. This code will then execute alongside the main BlueCore firmware. The user is able to make calls to the BlueCore firmware for various operations.

The execution environment is structured so the user application does not adversely affect the main software routines, thus ensuring that the Bluetooth stack software component does not need re-qualification when the application is changed. Using the VM and the BlueLab SDK the user is able to develop applications such as a cordless headset or other profiles without the requirement of a host controller. BlueLab is supplied with example code including a full implementation of the headset profile.

It looks like it will be hard do reverse code without understanding the architecture first:

Virtual Machine (VM). The firmware provides the VM environment in which to run >application-specific code. Although the VM is mainly used with BlueLab and “RFCOMM builds” >>(alternative firmware builds providing L2CAP, SDP and RFCOMM), the VM can be used with this build to perform >simple tasks such as flashing LED’s via the chip’s PIO port.

Also it mentions VM Application software is stored on external flash so depending what you are looking for that may be worth checking.

Answer 3

I've written an 010 Editor parser for the CSR DFU file format, available here. Hopefully it will be of help.