funai_upg: add support for decryption + keys & add funai_upg_phl extractor for them

README.md

@@ -48,7 +48,11 @@ Options:
 
 ## Funai UPG   
 **Used in:** Some Funai TVs  
-**Notes:** Decryption is not yet supported.    
+**Notes:** **Depends on keys** - see keys.rs.    
+
+## Funai UPG PHL   
+**Used in:** Funai & Funai-made Philips TVs (USA market)  
+**Notes:** **Depends on keys** - see keys.rs (most common keys should be included).    
 
 ## INVINCIBLE_IMAGE   
 **Used in:** LG Broadcom-based Blu-Ray players  

src/formats.rs

@@ -20,6 +20,7 @@ pub mod roku;
 pub mod sony_bdp;
 pub mod rvp;
 pub mod funai_upg;
+pub mod funai_upg_phl;
 pub mod pana_dvd;
 pub mod android_ota_payload;
 pub mod bdl;
@@ -110,6 +111,11 @@ pub fn get_registry() -> Vec<Format> {
             detector_func: crate::formats::funai_upg::is_funai_upg_file,
             extractor_func: crate::formats::funai_upg::extract_funai_upg,
         },
+        Format {
+            name: "funai_upg_phl",
+            detector_func: crate::formats::funai_upg_phl::is_funai_upg_phl_file,
+            extractor_func: crate::formats::funai_upg_phl::extract_funai_upg_phl,
+        },
         Format {
             name: "pana_dvd",
             detector_func: crate::formats::pana_dvd::is_pana_dvd_file,

src/formats/funai_upg/funai_des.rs

@@ -0,0 +1,52 @@
+
+const SBOX: [u32; 160] = [
+    0x07, 0x0d, 0x0e, 0x03, 0x00, 0x06, 0x09, 0x0a, 0x01, 0x02, 0x08, 0x05, 0x0b, 0x0c, 0x04, 0x0f,
+	0x0d, 0x08, 0x0b, 0x05, 0x06, 0x0f, 0x00, 0x03, 0x04, 0x07, 0x02, 0x0c, 0x01, 0x0a, 0x0e, 0x09,
+	0x0a, 0x06, 0x09, 0x00, 0x0c, 0x0b, 0x07, 0x0d, 0x0f, 0x01, 0x03, 0x0e, 0x05, 0x02, 0x08, 0x04,
+	0x03, 0x0f, 0x00, 0x06, 0x0a, 0x01, 0x0d, 0x08, 0x09, 0x04, 0x05, 0x0b, 0x0c, 0x07, 0x02, 0x0e,
+	0x02, 0x0c, 0x04, 0x01, 0x07, 0x0a, 0x0b, 0x06, 0x08, 0x05, 0x03, 0x0f, 0x0d, 0x00, 0x0e, 0x09,
+	0x0e, 0x0b, 0x02, 0x0c, 0x04, 0x07, 0x0d, 0x01, 0x05, 0x00, 0x0f, 0x0a, 0x03, 0x09, 0x08, 0x06,
+	0x04, 0x02, 0x01, 0x0b, 0x0a, 0x0d, 0x07, 0x08, 0x0f, 0x09, 0x0c, 0x05, 0x06, 0x03, 0x00, 0x0e,
+    0x0b, 0x08, 0x0c, 0x07, 0x01, 0x0e, 0x02, 0x0d, 0x06, 0x0f, 0x00, 0x09, 0x0a, 0x04, 0x05, 0x03,
+
+	0x10, 0x07, 0x14, 0x15, 0x1d, 0x0c, 0x1c, 0x11, 0x01, 0x0f, 0x17, 0x1a, 0x05, 0x12, 0x1f, 0x0a,
+	0x02, 0x08, 0x18, 0x0e, 0x00, 0x1b, 0x03, 0x09, 0x13, 0x0d, 0x1e, 0x06, 0x16, 0x0b, 0x04, 0x19,
+];
+
+#[inline(always)]
+fn des_function(mut state: u32, key: u32) -> u32 {
+    state ^= key;
+
+    let mut block_state = 0u32;
+
+    for i in 0..8 {
+        let offset = (state & 0xF) as usize + i * 16;
+        state >>= 4;
+        block_state = (SBOX[offset] << 28) | (block_state >> 4);
+    }
+
+    let mut out = 0u32;
+    for i in 0..32 {
+        out = (out | ((block_state >> SBOX[128 + i]) & 1)) << 1;
+    }
+
+    out
+}
+
+pub fn funai_des_decrypt(input: &[u8], key: u32) -> Vec<u8> {
+    assert!(input.len() % 8 == 0);
+    let mut buf = input.to_vec();
+
+    for chunk in buf.chunks_exact_mut(8) {
+        let in1 = u32::from_le_bytes(chunk[0..4].try_into().unwrap());
+        let in2 = u32::from_le_bytes(chunk[4..8].try_into().unwrap());
+
+        let out2 = des_function(in2, key) ^ in1;
+        let out1 = in2;
+
+        chunk[0..4].copy_from_slice(&out1.to_le_bytes());
+        chunk[4..8].copy_from_slice(&out2.to_le_bytes());
+    }
+
+    buf
+}

src/formats/funai_upg/include.rs

@@ -14,3 +14,17 @@ pub struct Entry {
     _unk_flag: u8,
     pub encryption_flag: u8,
 }
+
+//based on this check in firmware: [A-Z][A-Z][A-Z]-[0-1][A-Z][A-Z][A-Z]_\\x\\x\\x_\\x\\0\\0
+//the check needs to be this extensive since the cipher is so weak and keys can be similar, leading to correct looking string even with incorrect key.
+pub fn is_valid_ver_string(bytes: &[u8]) -> bool {
+    bytes.iter().all(|&b| {
+        matches!(b,
+            b'A'..=b'Z' |
+            b'0'..=b'9' |
+            b'-' | 
+            b'_' |
+            b'\x00'
+        )
+    })
+}

src/formats/funai_upg/mod.rs

@@ -1,4 +1,5 @@
-mod include;
+pub mod include;
+pub mod funai_des;
 use std::any::Any;
 use crate::AppContext;
 
@@ -9,11 +10,14 @@ use binrw::BinReaderExt;
 
 use crate::utils::common;
 use include::*;
+use crate::keys;
+use funai_des::funai_des_decrypt;
 
 pub fn is_funai_upg_file(app_ctx: &AppContext) -> Result<Option<Box<dyn Any>>, Box<dyn std::error::Error>> {
     let file = match app_ctx.file() {Some(f) => f, None => return Ok(None)};
-    let header = common::read_file(&file, 0, 6)?;
-    if header == b"UPG\x00\x00\x00" {
+    let header = common::read_file(&file, 0, 8)?;
+    let entry_count = u16::from_le_bytes(header[6..8].try_into()?);
+    if header[..6] == *b"UPG\x00\x00\x00" && entry_count > 0 {
         Ok(Some(Box::new(())))
     } else {
         Ok(None)
@@ -24,33 +28,51 @@ pub fn extract_funai_upg(app_ctx: &AppContext, _ctx: Box<dyn Any>) -> Result<(),
     let mut file = app_ctx.file().ok_or("Extractor expected file")?;
 
     let header: Header = file.read_le()?;
+    let mut key: Option<u32> = None;
+
     println!("File info:\nFile size: {}\nEntry count: {}", header.file_size, header.entry_count);
     
     for i in 0..header.entry_count {
         let entry: Entry = file.read_le()?;
-        println!("\n({}/{}) - Type: {}, Size: {}", i + 1, header.entry_count, entry.entry_type, entry.entry_size);
         
-        let data = common::read_exact(&mut file, entry.entry_size as usize - 0x46)?; //size has the flags + crc32 + hash
+        let mut data = common::read_exact(&mut file, entry.entry_size as usize - 0x46)?; //size has the flags + crc32 + hash
         let _crc32 = common::read_exact(&mut file, 4)?; //crc32 includes the entry header and hash
         let _hash = common::read_exact(&mut file, 64)?; //hash is only used on encrypted entries
 
+        //find key using descriptor entry
+        if entry.entry_type == 0 && entry.encryption_flag == 1 && key.is_none() {
+            for key_hex in keys::FUNAI_UPG {
+                let key_bytes = hex::decode(key_hex)?;
+                let key_u32 = u32::from_le_bytes(key_bytes.as_slice().try_into()?);
+                let decrypted = funai_des_decrypt(&data, key_u32);
+
+                if is_valid_ver_string(&decrypted) {
+                    println!("Matched key: {}\nFirmware info: {}", 
+                            key_hex, common::string_from_bytes(&decrypted));
+                    key = Some(key_u32);
+                    break
+                }
+            }
+        }
+
+        println!("\n({}/{}) - Type: {}, Size: {}", i + 1, header.entry_count, entry.entry_type, entry.entry_size);
+
         if entry.encryption_flag == 1 {
-            //not supported yet
-            println!("- Warning: Cannot decrypt entry, saving encrypted data!");
+            if let Some(key_u32) = key {
+                println!("- Decrypting...");
+                data = funai_des_decrypt(&data, key_u32);
+            } else {
+                println!("- Warning! Failed to find decryption key, saving encrypted data")
+            }
         }
 
-        if entry.encryption_flag == 0 && entry.entry_type == 0 {
-            let entry_string = common::string_from_bytes(&data);
-            println!("Descriptor entry info:\n{}", entry_string);
-        }
-
-        let output_path = Path::new(&app_ctx.output_dir).join(format!("{}_{}.bin", i + 1, entry.entry_type));
+        let output_path = Path::new(&app_ctx.output_dir).join(format!("{}.bin", entry.entry_type));
 
         fs::create_dir_all(&app_ctx.output_dir)?;
         let mut out_file = OpenOptions::new().write(true).create(true).open(output_path)?;
         out_file.write_all(&data)?;
 
-        println!("- Saved file!");
+        println!("-- Saved file!");
     }
     
     Ok(())

src/formats/funai_upg_phl/include.rs

@@ -0,0 +1,16 @@
+use binrw::BinRead;
+
+#[derive(BinRead)]
+pub struct Header {
+    _magic_bytes: [u8; 6],
+    pub entries: [BodyHeader; 8],
+    _unk: u16,
+    _data_checksum: u32,
+    _unk2: u32,
+}
+
+#[derive(BinRead)]
+pub struct BodyHeader {
+    pub body_type: u16,
+    pub size: u32,
+}

src/formats/funai_upg_phl/mod.rs

@@ -0,0 +1,78 @@
+mod include;
+use std::any::Any;
+use crate::AppContext;
+
+use std::path::Path;
+use std::fs::{self, OpenOptions};
+use std::io::Write;
+use binrw::BinReaderExt;
+
+use crate::utils::common;
+use crate::keys;
+use crate::formats::funai_upg::funai_des::funai_des_decrypt;
+use crate::formats::funai_upg::include::is_valid_ver_string;
+use include::*;
+
+pub fn is_funai_upg_phl_file(app_ctx: &AppContext) -> Result<Option<Box<dyn Any>>, Box<dyn std::error::Error>> {
+    let file = match app_ctx.file() {Some(f) => f, None => return Ok(None)};
+    let header = common::read_file(&file, 0, 8)?;
+
+    //assume 2 extra zeros since first "body" (not my name for it btw) is always Type 0
+    if header == b"UPG\x00\x00\x00\x00\x00"{
+        Ok(Some(Box::new(())))
+    } else {
+        Ok(None)
+    }
+}
+
+pub fn extract_funai_upg_phl(app_ctx: &AppContext, _ctx: Box<dyn Any>) -> Result<(), Box<dyn std::error::Error>> {
+    let mut file = app_ctx.file().ok_or("Extractor expected file")?;
+
+    let header: Header = file.read_le()?;
+    let mut key: Option<u32> = None;
+
+    for (i, entry) in header.entries.iter().enumerate() {
+        if entry.body_type == 0xFFFF && entry.size == 0 {
+            continue
+        }
+
+        let mut data = common::read_exact(&mut file, entry.size as usize)?;
+
+        //find key using descriptor entry
+        if entry.body_type == 0 && key.is_none() {
+            for key_hex in keys::FUNAI_UPG {
+                let key_bytes = hex::decode(key_hex)?;
+                let key_u32 = u32::from_le_bytes(key_bytes.as_slice().try_into()?);
+                let decrypted = funai_des_decrypt(&data, key_u32);
+
+                if is_valid_ver_string(&decrypted[..16]) {
+                    println!("Matched key: {}\nFirmware info: {}\nFirmware date: {}", 
+                            key_hex, common::string_from_bytes(&decrypted[..16]), common::string_from_bytes(&decrypted[16..]));
+                    key = Some(key_u32);
+                    break
+                }
+            }
+        }
+
+        println!("\n#{} - Type: {}, Size: {}", i + 1, entry.body_type, entry.size);
+
+        if let Some(key_u32) = key {
+            println!("- Decrypting...");
+            data = funai_des_decrypt(&data, key_u32);
+
+        } else {
+            println!("- Warning! Failed to find decryption key, saving encrypted data")
+        }
+
+        let output_path = Path::new(&app_ctx.output_dir).join(format!("{}.bin", entry.body_type));
+
+        fs::create_dir_all(&app_ctx.output_dir)?;
+        let mut out_file = OpenOptions::new().write(true).create(true).open(output_path)?;
+        out_file.write_all(&data)?;
+
+        println!("-- Saved file!");
+
+    }
+
+    Ok(())
+}

src/keys.rs

@@ -96,6 +96,18 @@ pub static MTK_PKG_CUST: &[(&str, &str, &str)] = &[
     ("07A30C2E4AAE4849EC3DD2301C381868", "BC1443A0D17AAB2DB1EA0302EF280717", "Philips Android"), //worked on TPM171E(2017), TPM191E(2019), TPM211E(2021)
 ];
 
+//Funai UPG keys
+pub static FUNAI_UPG: &[&str] = &[
+    ("696B6A75"), //FNI-0CF, FNI-0BF
+    ("312E3149"), //PHL-0AA, PHL-0CA
+    ("6D6B6161"), //PHL-0AB
+    ("34624848"), //PHL-0BA, PHL-0DA
+    ("386A376D"), //PHL-0CCX
+    ("77303131"), //PHL-0CEX
+    ("75303231"), //PHL-0CFX
+    ("68353031"), //PHL-0SDX
+];
+
 //EPK keys
 //github.com/openlgtv/epk2extract
 pub static EPK: &[(&str, &str)] = &[