From d825a9339fd535305fae9d89b3c89fc893b66590 Mon Sep 17 00:00:00 2001 From: theubusu <80545678+theubusu@users.noreply.github.com> Date: Fri, 20 Feb 2026 20:10:03 +0100 Subject: [PATCH] funai_upg: add support for decryption + keys & add funai_upg_phl extractor for them --- README.md | 6 ++- src/formats.rs | 6 +++ src/formats/funai_upg/funai_des.rs | 52 +++++++++++++++++++ src/formats/funai_upg/include.rs | 14 +++++ src/formats/funai_upg/mod.rs | 54 +++++++++++++------ src/formats/funai_upg_phl/include.rs | 16 ++++++ src/formats/funai_upg_phl/mod.rs | 78 ++++++++++++++++++++++++++++ src/keys.rs | 12 +++++ 8 files changed, 221 insertions(+), 17 deletions(-) create mode 100644 src/formats/funai_upg/funai_des.rs create mode 100644 src/formats/funai_upg_phl/include.rs create mode 100644 src/formats/funai_upg_phl/mod.rs diff --git a/README.md b/README.md index cc4a821..b151d1d 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,11 @@ Options: ## Funai UPG **Used in:** Some Funai TVs -**Notes:** Decryption is not yet supported. +**Notes:** **Depends on keys** - see keys.rs. + +## Funai UPG PHL +**Used in:** Funai & Funai-made Philips TVs (USA market) +**Notes:** **Depends on keys** - see keys.rs (most common keys should be included). ## INVINCIBLE_IMAGE **Used in:** LG Broadcom-based Blu-Ray players diff --git a/src/formats.rs b/src/formats.rs index 5d88d44..f1674e2 100644 --- a/src/formats.rs +++ b/src/formats.rs @@ -20,6 +20,7 @@ pub mod roku; pub mod sony_bdp; pub mod rvp; pub mod funai_upg; +pub mod funai_upg_phl; pub mod pana_dvd; pub mod android_ota_payload; pub mod bdl; @@ -110,6 +111,11 @@ pub fn get_registry() -> Vec { detector_func: crate::formats::funai_upg::is_funai_upg_file, extractor_func: crate::formats::funai_upg::extract_funai_upg, }, + Format { + name: "funai_upg_phl", + detector_func: crate::formats::funai_upg_phl::is_funai_upg_phl_file, + extractor_func: crate::formats::funai_upg_phl::extract_funai_upg_phl, + }, Format { name: "pana_dvd", detector_func: crate::formats::pana_dvd::is_pana_dvd_file, diff --git a/src/formats/funai_upg/funai_des.rs b/src/formats/funai_upg/funai_des.rs new file mode 100644 index 0000000..d01af96 --- /dev/null +++ b/src/formats/funai_upg/funai_des.rs @@ -0,0 +1,52 @@ + +const SBOX: [u32; 160] = [ + 0x07, 0x0d, 0x0e, 0x03, 0x00, 0x06, 0x09, 0x0a, 0x01, 0x02, 0x08, 0x05, 0x0b, 0x0c, 0x04, 0x0f, + 0x0d, 0x08, 0x0b, 0x05, 0x06, 0x0f, 0x00, 0x03, 0x04, 0x07, 0x02, 0x0c, 0x01, 0x0a, 0x0e, 0x09, + 0x0a, 0x06, 0x09, 0x00, 0x0c, 0x0b, 0x07, 0x0d, 0x0f, 0x01, 0x03, 0x0e, 0x05, 0x02, 0x08, 0x04, + 0x03, 0x0f, 0x00, 0x06, 0x0a, 0x01, 0x0d, 0x08, 0x09, 0x04, 0x05, 0x0b, 0x0c, 0x07, 0x02, 0x0e, + 0x02, 0x0c, 0x04, 0x01, 0x07, 0x0a, 0x0b, 0x06, 0x08, 0x05, 0x03, 0x0f, 0x0d, 0x00, 0x0e, 0x09, + 0x0e, 0x0b, 0x02, 0x0c, 0x04, 0x07, 0x0d, 0x01, 0x05, 0x00, 0x0f, 0x0a, 0x03, 0x09, 0x08, 0x06, + 0x04, 0x02, 0x01, 0x0b, 0x0a, 0x0d, 0x07, 0x08, 0x0f, 0x09, 0x0c, 0x05, 0x06, 0x03, 0x00, 0x0e, + 0x0b, 0x08, 0x0c, 0x07, 0x01, 0x0e, 0x02, 0x0d, 0x06, 0x0f, 0x00, 0x09, 0x0a, 0x04, 0x05, 0x03, + + 0x10, 0x07, 0x14, 0x15, 0x1d, 0x0c, 0x1c, 0x11, 0x01, 0x0f, 0x17, 0x1a, 0x05, 0x12, 0x1f, 0x0a, + 0x02, 0x08, 0x18, 0x0e, 0x00, 0x1b, 0x03, 0x09, 0x13, 0x0d, 0x1e, 0x06, 0x16, 0x0b, 0x04, 0x19, +]; + +#[inline(always)] +fn des_function(mut state: u32, key: u32) -> u32 { + state ^= key; + + let mut block_state = 0u32; + + for i in 0..8 { + let offset = (state & 0xF) as usize + i * 16; + state >>= 4; + block_state = (SBOX[offset] << 28) | (block_state >> 4); + } + + let mut out = 0u32; + for i in 0..32 { + out = (out | ((block_state >> SBOX[128 + i]) & 1)) << 1; + } + + out +} + +pub fn funai_des_decrypt(input: &[u8], key: u32) -> Vec { + assert!(input.len() % 8 == 0); + let mut buf = input.to_vec(); + + for chunk in buf.chunks_exact_mut(8) { + let in1 = u32::from_le_bytes(chunk[0..4].try_into().unwrap()); + let in2 = u32::from_le_bytes(chunk[4..8].try_into().unwrap()); + + let out2 = des_function(in2, key) ^ in1; + let out1 = in2; + + chunk[0..4].copy_from_slice(&out1.to_le_bytes()); + chunk[4..8].copy_from_slice(&out2.to_le_bytes()); + } + + buf +} \ No newline at end of file diff --git a/src/formats/funai_upg/include.rs b/src/formats/funai_upg/include.rs index b449e8e..be596b3 100644 --- a/src/formats/funai_upg/include.rs +++ b/src/formats/funai_upg/include.rs @@ -13,4 +13,18 @@ pub struct Entry { pub entry_size: u32, _unk_flag: u8, pub encryption_flag: u8, +} + +//based on this check in firmware: [A-Z][A-Z][A-Z]-[0-1][A-Z][A-Z][A-Z]_\\x\\x\\x_\\x\\0\\0 +//the check needs to be this extensive since the cipher is so weak and keys can be similar, leading to correct looking string even with incorrect key. +pub fn is_valid_ver_string(bytes: &[u8]) -> bool { + bytes.iter().all(|&b| { + matches!(b, + b'A'..=b'Z' | + b'0'..=b'9' | + b'-' | + b'_' | + b'\x00' + ) + }) } \ No newline at end of file diff --git a/src/formats/funai_upg/mod.rs b/src/formats/funai_upg/mod.rs index a3df579..1e5d691 100644 --- a/src/formats/funai_upg/mod.rs +++ b/src/formats/funai_upg/mod.rs @@ -1,4 +1,5 @@ -mod include; +pub mod include; +pub mod funai_des; use std::any::Any; use crate::AppContext; @@ -9,11 +10,14 @@ use binrw::BinReaderExt; use crate::utils::common; use include::*; +use crate::keys; +use funai_des::funai_des_decrypt; pub fn is_funai_upg_file(app_ctx: &AppContext) -> Result>, Box> { let file = match app_ctx.file() {Some(f) => f, None => return Ok(None)}; - let header = common::read_file(&file, 0, 6)?; - if header == b"UPG\x00\x00\x00" { + let header = common::read_file(&file, 0, 8)?; + let entry_count = u16::from_le_bytes(header[6..8].try_into()?); + if header[..6] == *b"UPG\x00\x00\x00" && entry_count > 0 { Ok(Some(Box::new(()))) } else { Ok(None) @@ -24,33 +28,51 @@ pub fn extract_funai_upg(app_ctx: &AppContext, _ctx: Box) -> Result<(), let mut file = app_ctx.file().ok_or("Extractor expected file")?; let header: Header = file.read_le()?; - println!("File info:\nFile size: {}\nEntry count: {}", header.file_size, header.entry_count); + let mut key: Option = None; + println!("File info:\nFile size: {}\nEntry count: {}", header.file_size, header.entry_count); + for i in 0..header.entry_count { let entry: Entry = file.read_le()?; - println!("\n({}/{}) - Type: {}, Size: {}", i + 1, header.entry_count, entry.entry_type, entry.entry_size); - - let data = common::read_exact(&mut file, entry.entry_size as usize - 0x46)?; //size has the flags + crc32 + hash + + let mut data = common::read_exact(&mut file, entry.entry_size as usize - 0x46)?; //size has the flags + crc32 + hash let _crc32 = common::read_exact(&mut file, 4)?; //crc32 includes the entry header and hash let _hash = common::read_exact(&mut file, 64)?; //hash is only used on encrypted entries + //find key using descriptor entry + if entry.entry_type == 0 && entry.encryption_flag == 1 && key.is_none() { + for key_hex in keys::FUNAI_UPG { + let key_bytes = hex::decode(key_hex)?; + let key_u32 = u32::from_le_bytes(key_bytes.as_slice().try_into()?); + let decrypted = funai_des_decrypt(&data, key_u32); + + if is_valid_ver_string(&decrypted) { + println!("Matched key: {}\nFirmware info: {}", + key_hex, common::string_from_bytes(&decrypted)); + key = Some(key_u32); + break + } + } + } + + println!("\n({}/{}) - Type: {}, Size: {}", i + 1, header.entry_count, entry.entry_type, entry.entry_size); + if entry.encryption_flag == 1 { - //not supported yet - println!("- Warning: Cannot decrypt entry, saving encrypted data!"); + if let Some(key_u32) = key { + println!("- Decrypting..."); + data = funai_des_decrypt(&data, key_u32); + } else { + println!("- Warning! Failed to find decryption key, saving encrypted data") + } } - if entry.encryption_flag == 0 && entry.entry_type == 0 { - let entry_string = common::string_from_bytes(&data); - println!("Descriptor entry info:\n{}", entry_string); - } - - let output_path = Path::new(&app_ctx.output_dir).join(format!("{}_{}.bin", i + 1, entry.entry_type)); + let output_path = Path::new(&app_ctx.output_dir).join(format!("{}.bin", entry.entry_type)); fs::create_dir_all(&app_ctx.output_dir)?; let mut out_file = OpenOptions::new().write(true).create(true).open(output_path)?; out_file.write_all(&data)?; - println!("- Saved file!"); + println!("-- Saved file!"); } Ok(()) diff --git a/src/formats/funai_upg_phl/include.rs b/src/formats/funai_upg_phl/include.rs new file mode 100644 index 0000000..b17a8f2 --- /dev/null +++ b/src/formats/funai_upg_phl/include.rs @@ -0,0 +1,16 @@ +use binrw::BinRead; + +#[derive(BinRead)] +pub struct Header { + _magic_bytes: [u8; 6], + pub entries: [BodyHeader; 8], + _unk: u16, + _data_checksum: u32, + _unk2: u32, +} + +#[derive(BinRead)] +pub struct BodyHeader { + pub body_type: u16, + pub size: u32, +} \ No newline at end of file diff --git a/src/formats/funai_upg_phl/mod.rs b/src/formats/funai_upg_phl/mod.rs new file mode 100644 index 0000000..e2a335d --- /dev/null +++ b/src/formats/funai_upg_phl/mod.rs @@ -0,0 +1,78 @@ +mod include; +use std::any::Any; +use crate::AppContext; + +use std::path::Path; +use std::fs::{self, OpenOptions}; +use std::io::Write; +use binrw::BinReaderExt; + +use crate::utils::common; +use crate::keys; +use crate::formats::funai_upg::funai_des::funai_des_decrypt; +use crate::formats::funai_upg::include::is_valid_ver_string; +use include::*; + +pub fn is_funai_upg_phl_file(app_ctx: &AppContext) -> Result>, Box> { + let file = match app_ctx.file() {Some(f) => f, None => return Ok(None)}; + let header = common::read_file(&file, 0, 8)?; + + //assume 2 extra zeros since first "body" (not my name for it btw) is always Type 0 + if header == b"UPG\x00\x00\x00\x00\x00"{ + Ok(Some(Box::new(()))) + } else { + Ok(None) + } +} + +pub fn extract_funai_upg_phl(app_ctx: &AppContext, _ctx: Box) -> Result<(), Box> { + let mut file = app_ctx.file().ok_or("Extractor expected file")?; + + let header: Header = file.read_le()?; + let mut key: Option = None; + + for (i, entry) in header.entries.iter().enumerate() { + if entry.body_type == 0xFFFF && entry.size == 0 { + continue + } + + let mut data = common::read_exact(&mut file, entry.size as usize)?; + + //find key using descriptor entry + if entry.body_type == 0 && key.is_none() { + for key_hex in keys::FUNAI_UPG { + let key_bytes = hex::decode(key_hex)?; + let key_u32 = u32::from_le_bytes(key_bytes.as_slice().try_into()?); + let decrypted = funai_des_decrypt(&data, key_u32); + + if is_valid_ver_string(&decrypted[..16]) { + println!("Matched key: {}\nFirmware info: {}\nFirmware date: {}", + key_hex, common::string_from_bytes(&decrypted[..16]), common::string_from_bytes(&decrypted[16..])); + key = Some(key_u32); + break + } + } + } + + println!("\n#{} - Type: {}, Size: {}", i + 1, entry.body_type, entry.size); + + if let Some(key_u32) = key { + println!("- Decrypting..."); + data = funai_des_decrypt(&data, key_u32); + + } else { + println!("- Warning! Failed to find decryption key, saving encrypted data") + } + + let output_path = Path::new(&app_ctx.output_dir).join(format!("{}.bin", entry.body_type)); + + fs::create_dir_all(&app_ctx.output_dir)?; + let mut out_file = OpenOptions::new().write(true).create(true).open(output_path)?; + out_file.write_all(&data)?; + + println!("-- Saved file!"); + + } + + Ok(()) +} \ No newline at end of file diff --git a/src/keys.rs b/src/keys.rs index ce950ab..e3485b7 100644 --- a/src/keys.rs +++ b/src/keys.rs @@ -96,6 +96,18 @@ pub static MTK_PKG_CUST: &[(&str, &str, &str)] = &[ ("07A30C2E4AAE4849EC3DD2301C381868", "BC1443A0D17AAB2DB1EA0302EF280717", "Philips Android"), //worked on TPM171E(2017), TPM191E(2019), TPM211E(2021) ]; +//Funai UPG keys +pub static FUNAI_UPG: &[&str] = &[ + ("696B6A75"), //FNI-0CF, FNI-0BF + ("312E3149"), //PHL-0AA, PHL-0CA + ("6D6B6161"), //PHL-0AB + ("34624848"), //PHL-0BA, PHL-0DA + ("386A376D"), //PHL-0CCX + ("77303131"), //PHL-0CEX + ("75303231"), //PHL-0CFX + ("68353031"), //PHL-0SDX +]; + //EPK keys //github.com/openlgtv/epk2extract pub static EPK: &[(&str, &str)] = &[