0

I am trying to RE the update file for a Denon AVR for fun and to see if I can figure out how to access the device's webserver which otherwise returns HTTP 403, and how to enable Pandora on my EU version (it's stripped from anything but the US version which appears to be identical hardware.)

The update file is on Denon's servers: http://assets.denon.com/documentmaster/us/AVR-X2400H_USB_Update_May_2019.zip

The service manual is here: https://www.manualslib.com/manual/1479093/Denon-Avr-X2400h.html

In the service manual, I was able to see that the chip where the OS is likely running is a Renesas R5F564MJCDFC (page 11). Service manual: https://www.renesas.com/us/en/document/dst/rx64m-group-datasheet

This CPU uses the RXv2 instruction set, which is detailed here: https://www.renesas.com/eu/en/document/man/rx-family-rxv2-instruction-set-architecture-users-manual-software?language=en?language=en (instructions are detailed starting p57, and their opcodes are listed starting p210)

When portscanning the AVR with nmap -A -T4 myavr:

Starting Nmap 7.80 ( https://nmap.org ) at 2021-04-27 01:18 CEST
Nmap scan report for myavr (xxx.xxx.xxx.xxx)
Host is up (0.87s latency).
rDNS record for xxx.xxx.xxx.xxx: myavr.lan
Not shown: 996 closed ports
PORT     STATE SERVICE VERSION
23/tcp   open  telnet?
80/tcp   open  http    TomTom httpd
|_http-title: Site doesn't have a title (text/plain).
111/tcp  open  rpcbind 2 (RPC #100000)
8080/tcp open  http    TomTom httpd
|_http-title: Site doesn't have a title (text/plain).

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 182.72 seconds

It missed another telnet server which I know runs on port 1255.

The telnet server on port 23 is used to control most of the AVR's functions (detailed here: http://assets.denon.com/_layouts/15/xlviewer.aspx?id=/DocumentMaster/us/AVR-X6400H_X4400H_X3400H_X2400H_X1400H_S930H_S730H_PROTOCOL_V01.xlsx)

The telnet server on port 1255 is for HEOS command and control, documented here: https://www.denon.com/-/media/files/documentmaster/denonna/heos_cli_protocolspecification-version.pdf

The webservers on ports 80 and 8080 both return HTTP 403, and the headers are very scarce:

$ curl -v myavr:80
*   Trying xxx.xxx.xxx.xxx:80...
* TCP_NODELAY set
* Connected to myavr (xxx.xxx.xxx.xxx) port 80 (#0)
> GET / HTTP/1.1
> Host: myavr
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Content-Type: text/plain
< Connection: close
<
Error 403: Forbidden
* Closing connection 0
Access Forbidden

$ curl -v myavr:8080
*   Trying xxx.xxx.xxx.xxx:8080...
* TCP_NODELAY set
* Connected to myavr (xxx.xxx.xxx.xxx) port 8080 (#0)
> GET / HTTP/1.1
> Host: myavr:8080
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Content-Type: text/plain
< Connection: close
<
Error 403: Forbidden
* Closing connection 0
Access Forbidden

I don't know how nmap is able to tell that it's a TomTom httpd from that, nor could I find any information about a webserver with that name.

About the firmware update, it has two components. One is the HEOS software, and one is the "rest" of the software. Using binwalk, this is what I'm getting:

$ binwalk AVR-X2400HALL_0014.update.forced

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             gzip compressed data, maximum compression, has original file name: "firmware.tar", from FAT filesystem (MS-DOS, OS/2, NT), last modified: 2019-04-04 20:48:17


$ binwalk heos_40.prod.update

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
10112         0x2780          gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.uboot-rw.gzip", last modified: 2019-04-20 16:31:13
373399        0x5B297         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.ssb.gzip", last modified: 2019-04-20 16:31:13
459334        0x70246         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.p_sbi.gzip", last modified: 2019-04-20 16:31:13
527628        0x80D0C         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.m0patch.gzip", last modified: 2019-04-20 16:31:13
534280        0x82708         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.c_sbi_1.gzip", last modified: 2019-04-20 16:31:13
602576        0x931D0         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.c_sbi_0.gzip", last modified: 2019-04-20 16:31:13
670872        0xA3C98         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.boot1.gzip", last modified: 2019-04-20 16:31:13
739166        0xB475E         gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.rootfs.gzip", last modified: 2019-04-20 16:31:13
21462526      0x1477DFE       MySQL ISAM compressed data file Version 1
64483457      0x3D7F081       gzip compressed data, maximum compression, has original file name: "heos_40.prod.partition.kernel.gzip", last modified: 2019-04-20 16:31:19

When I extract AVR-X2400HALL_0014.update.forced with binwalk -e, I get a few .bin files and an XML file:

total 78M
4.0K drwxrwxr-x 2 me me 4.0K Apr 27 00:58 .
4.0K drwxrwxr-x 5 me me 4.0K Apr 25 21:36 ..
512K -rwxrwxr-x 1 me me 510K Apr 25 21:36 APLD.bin
7.1M -rwxrwxr-x 1 me me 7.1M Apr 25 21:36 DSP.bin
8.0K -rwxrwxr-x 1 me me 5.1K Apr 25 21:36 enc_update.xml
 27M -rw-rw-r-- 1 me me  27M Apr 25 21:36 firmware.tar
 14M -rw-rw-r-- 1 me me  14M Apr 25 21:36 firmware.tar.gz
 17M -rwxrwxr-x 1 me me  16M Apr 25 21:36 GUI.bin
3.0M -rwxrwxr-x 1 me me 3.0M Apr 25 21:36 MAIN.bin

The .bin files all seem to be encrypted, because strings doesn't find anything. I wanted to check how strong the encryption was, maybe it's only a byte substitution. So I tried zipping MAN.bin to see how well it would compress, and I got 2.3MB. So it's not completely random data. I then plotted the entropy on MAIN.bin and this is what I got: entropy plot

The top 15 most common bytes are:

0xeb
0xcf
0x6a
0x49
0x44
0x7b
0xb8
0x78
0x1d
0xd3
0x24
0x2b
0xff
0xe0
0xc2

Looking at the FirmInfo.xml, it does list start and end locations for the various bin files. The one for MAIN.bin is said to start at 0xFFD00000 and end at 0xFFFF7FFF, which matches the data on p68 of the CPU datasheet for a 3MB chip. But I don't know what these address mean, because looking at the other entries, the APLD and DSP both start at 0x0.

Looking at the .bin files with hd, all of the data is garbage except that all files start with host (except GUI.bin). Even the enc_update.xml file is binary and starts with host. I'm not sure what's going on there.

The FirmUpdate.xml has a 1 in encryption for all .bin files except GUI.bin.

The FirmUpdate.xml file also has 4 entries referring to a password:

            <product_pwd id="1">fQRr2hVW</product_pwd>
            <product_pwd id="2">AqwuuGFm</product_pwd>
            <product_pwd id="3">3DT3dN7K</product_pwd>
            <product_pwd id="4">69mag5E5</product_pwd>

I fail to understand why there are 4 passwords, they seem to refer to each of the .bin files (they have ids 1-4 later in the XML) but the encryption flag in the FirmUpdate.xml shows that only 3 of the files are encrypted. In any case, I don't know what to do with this password for the other allegedly encrypted files.

Over in the HEOS update files, extracting with binwalk -e yields a bunch of partition images:

total 1.1G
4.0K drwxrwxr-x 3 me me 4.0K Apr 27 00:12 .
4.0K drwxrwxr-x 5 me me 4.0K Apr 25 21:36 ..
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.boot1.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.boot1.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.c_sbi_0.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.c_sbi_0.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.c_sbi_1.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.c_sbi_1.gzip.gz
2.5M -rw-rw-r-- 1 me me 2.5M Apr 25 17:31 heos_40.prod.partition.kernel.gzip
2.5M -rw-rw-r-- 1 me me 2.5M Apr 25 17:31 heos_40.prod.partition.kernel.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.m0patch.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.m0patch.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.p_sbi.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.p_sbi.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.rootfs.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.rootfs.gzip.gz
 70M -rw-rw-r-- 1 me me  70M Apr 25 17:31 heos_40.prod.partition.ssb.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.ssb.gzip.gz
 71M -rw-rw-r-- 1 me me  71M Apr 25 17:31 heos_40.prod.partition.uboot-rw.gzip
 64M -rw-rw-r-- 1 me me  64M Apr 25 17:31 heos_40.prod.partition.uboot-rw.gzip.gz

The HEOS update partitions contain UBIfs images:

$ file _heos_40.prod.update.extracted/heos_40.prod.partition.rootfs.gzip
_heos_40.prod.update.extracted/heos_40.prod.partition.rootfs.gzip: UBI image, version 1

I can extract the UBIfs image with ubireader_extract_images heos_40.prod.partition.rootfs.gzip. Listing the files in there with python ubidump.py -l img-234959470_vol-rootfs.ubifs shows many symlinks to busybox and other promising files in /etc.

But I think they're encrypted because whenever I try to extract the files (either with ubidump or ubi_reader), I'm getting this error: decompress Warn: LZO Error: Compressed data violation -6.

This is the first time I'm attempting to RE anything, and I don't know where to go from here as it feels I've bitten more than I can chew. Any ideas/suggestions?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.