2

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall.

This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the markings "D78F1165 1205EM406 MALAYSIA" which led me to to believe its the μPD78F1165 from NEC / Renesas, at least the pin configuration matches in the datasheet and schematics. Interestingly, the hardware manual shows that this chip has internal ROM but in this home theater it’s connected to an external EEPROM chip (ST M24C16, 16-Kbit).The update file is exactly 2KB in size so it matches the EEPROMs size.

The file has a wired structure. It has some headers and the data is duplicated for some reason. entropy analysis

It has some strings

...
0000c000  4c 6f 61 64 65 72 46 57  24 20 20 20 20 20 20 20  |LoaderFW$       |
0000c010  4d 41 49 4e 00 16 80 00  00 00 00 00 00 09 30 00  |MAIN..........0.|
0000c020  50 4f 57 43 00 01 00 00  02 00 00 00 00 00 04 00  |POWC............|
0000c030  46 41 54 42 00 01 10 00  01 0f e0 00 00 00 20 00  |FATB.......... .|
0000c040  50 41 52 4d 00 01 50 00  02 00 00 00 00 00 20 00  |PARM..P....... .|
0000c050  42 4f 4f 54 00 00 00 00  00 00 00 00 00 00 10 00  |BOOT............|
0000c060  53 48 49 46 00 1f b0 00  04 00 00 00 00 00 10 00  |SHIF............|
0000c070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
...
00010000  05 80 00 31 1f 00 00 00  4d 54 4b 20 38 35 35 30  |...1....MTK 8550|
00010010  4a 56 30 33 39 30 20 20  20 20 20 20 38 35 35 30  |JV0390      8550|
00010020  30 33 39 30 04 30 9f e5  03 30 8f e0 13 ff 2f e1  |0390.0...0..../.|
...
0008b410  06 06 41 62 6e 6f 72 6d  61 6c 20 74 65 72 6d 69  |..Abnormal termi|
0008b420  6e 61 74 69 6f 6e 00 00  00 41 72 69 74 68 6d 65  |nation...Arithme|
0008b430  74 69 63 20 65 78 63 65  70 74 69 6f 6e 3a 20 00  |tic exception: .|
0008b440  49 6c 6c 65 67 61 6c 20  69 6e 73 74 72 75 63 74  |Illegal instruct|
0008b450  69 6f 6e 00 00 00 00 49  6e 74 65 72 72 75 70 74  |ion....Interrupt|
0008b460  20 72 65 63 65 69 76 65  64 00 00 00 00 00 49 6c  | received.....Il|
0008b470  6c 65 67 61 6c 20 61 64  64 72 65 73 73 00 00 00  |legal address...|
0008b480  00 00 00 00 00 54 65 72  6d 69 6e 61 74 69 6f 6e  |.....Termination|
0008b490  20 72 65 71 75 65 73 74  00 00 00 00 53 74 61 63  | request....Stac|
0008b4a0  6b 20 6f 76 65 72 66 6c  6f 77 00 00 00 00 00 00  |k overflow......|
0008b4b0  00 00 00 52 65 64 69 72  65 63 74 3a 20 63 61 6e  |...Redirect: can|
0008b4c0  27 74 20 6f 70 65 6e 3a  20 00 4f 75 74 20 6f 66  |'t open: .Out of|
0008b4d0  20 68 65 61 70 20 6d 65  6d 6f 72 79 00 00 00 00  | heap memory....|
0008b4e0  00 55 73 65 72 2d 64 65  66 69 6e 65 64 20 73 69  |.User-defined si|
0008b4f0  67 6e 61 6c 20 31 00 00  55 73 65 72 2d 64 65 66  |gnal 1..User-def|
0008b500  69 6e 65 64 20 73 69 67  6e 61 6c 20 32 00 00 50  |ined signal 2..P|
0008b510  75 72 65 20 76 69 72 74  75 61 6c 20 66 6e 20 63  |ure virtual fn c|
0008b520  61 6c 6c 65 64 00 43 2b  2b 20 6c 69 62 72 61 72  |alled.C++ librar|
0008b530  79 20 65 78 63 65 70 74  69 6f 6e 00 00 4f 75 74  |y exception..Out|
0008b540  20 6f 66 20 68 65 61 70  00 00 00 00 00 00 00 00  | of heap........|
...

and an "end of file/segment"? marks

...
000ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|
...
001ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|
00200000

Per this answer, I tried loading it to Cubesuite+ (v2.2.0) with various offsets and it never worked. It will error either “bad instructions” or “illegal file type”.

I tried running Binwalk to check the architecture and this is what it shows:

$ binwalk -B Downloads/H12IM2S.ROM 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

$ binwalk -Y Downloads/H12IM2S.ROM 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions

binwalk -Y --verbose Downloads/H12IM2S.ROM 

Scan Time:     2019-11-18 23:22:29
Target File:   /home/Downloads/H12IM2S.ROM
MD5 Checksum:  73ec6a79d66112a7580f5dc7d0213594

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions
64662         0xFC96          movs r0, r0
64664         0xFC98          movs r0, r0
64666         0xFC9A          movs r0, r0
64668         0xFC9C          movs r0, r0
64670         0xFC9E          movs r0, r0
64672         0xFCA0          movs r0, r0
64674         0xFCA2          movs r0, r0
64676         0xFCA4          movs r0, r0
64678         0xFCA6          movs r0, r0
64680         0xFCA8          movs r0, r0
64682         0xFCAA          movs r0, r0
64684         0xFCAC          movs r0, r0
...

There's also a MediaTek MT8580 SoC on the board which handles the USB port and Ethernet, so maybe it makes sense to have some ARM instructions in the update file?

Where do I go from here? Should I remove the EPROM chip and try to dumb it’s content or is there a way to get the firmware from this update file?

PS, I’m mostly interested in the firmware of this controller because it’s blocking Multichannel PCM audio from any HDMI input except from other LG Blu-ray players. I.e. it will only play stereo PCM from any pc or PlayStation and other devices that I tested but it will perfectly play 5.1 PCM if it comes from another LG Player. Checked with the main service provider here in Germany and this is by design as a copyright protection. Unbelievable!

  • A couple of observations - (1) the update file is 2MB, not 2KB. (2) the arm thumb instructions shown have encoding 0x0000. So these specific ones may be false positives. (3) However, there are genuine arm32 instructions in the file at various offsets. e.g 0x00007C00 (which is definitely an arm32 vector table) and after the strings around 0x00084600. – Ian Cook Nov 20 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.