Monochrome image replacement within firmware

Question

Hopefully I can find someone who can help me with this.

I have become fascinated with electronic cigarettes and one of the more popular regulated chips for sale tout's its ability to change logos.

The chip is the YiHi E-Cigcar. The firmware for the chip can be found http://www.yihiecigar.com/download_info/Upgrade-Software-for-SX350-50w-ONLY_OldBoot_YH_Logo_60W_20140813-Screen-flip_V2-4-d59228.html

I've downloaded a YouTube publisher's software the "changes" the logo, however, after decompiling his .NET application, I'm not convinced this wouldn't brick my chip. https://www.youtube.com/watch?v=kTy0AKTYzrg

I've written an application that reads the entire string in as hex, and converts to binary (assuming the firmware was unencrypted, and I could find an index of part of the image I'm looking for), but no luck.

I'm not convinced that this firmware isn't packed in some way, but I haven't the slightest idea on how to go about finding it.

If anyone could give some advice or has any idea on how to unpack / search for the logo's another way this would be fantastic.

Not that this is a need, it keeps me up at night because, I'm just one of those people who can't leave a problem unsolved... probably like a lot of you reading this.

Anyone who's up for the challenge it would be much appreciated.

Answer 1

Compile this program (rename your file to out1.SXI, or change the file name in the program):

#include <stdio.h>

int main(int argc, char **argv) {
    char buf[256];
    int i, j;
    FILE *fp;
    int pos=0;              // file position
    int bpr=0;              // bits / bytes per row
    int blockno=0;          // 6 blocks * 8 bits = 48 rows
    if (argc>=2)
            bpr=atoi(argv[1]);
    if (bpr==0)
            bpr=64;
    if (argc>=3) {
            pos=strtol(argv[2], NULL, 0);
    }

    if ((fp=fopen("out1.SXI", "rb"))==NULL) {
            perror("out1.SXI");
            exit(1);
    }
    fseek(fp, pos, 0);
    while(fread(buf, bpr, 1, fp)) {
            if (blockno++%6==0)
                    printf("%06x\n", pos);
            for (j=128; j>0; j>>=1) {
                    for (i=0; i<bpr; i++) {
                            if (buf[i]&j)
                                    putchar('X');
                            else
                                    putchar(' ');
                    }
                    putchar('|');
                    putchar('\n');
            }
            pos+=bpr;
    }
}

then run it as

$ xdump 64 0x83D4 | less
$ xdump 64 0x10FC8 | less 

I'm pretty sure these are images, though i can't make sense of them; but maybe you can if you compare them to what the device shows if you flash the firmware.

Also, this assumes the display has a 64x48 pixel resolution like the one in the movie; you might want to take a picture through a magnifying glass to check they haven't changed the resolution. Although 64x48 is what my program assumes as well when it generates these images.

Of course, the file you get when you unpack the .rar seems to be much larger than the file in the movie, if the offsets shown are byte offsets. Possibly, the firmware consists of two part, one factory part (which is the firmware you can download) and a OEM/vendor part that has the images (which you can't download, but which is used in the movie), with the firmware upgrader deciding which one to overwrite depending on the file format/contents.