So, as I mentioned in the last post, there were some large sections in the bin files that require further investigation. The output of the parsebin script shows these sections. The most interesting to me is the large CMbT section. Lets look at s14v101.bin first. from parsebin:

*****************************************************

CMbT:

*****************************************************

Num	Hex Length	Dec Length	Hex Position	Dec Position

0:	0x00000040		64	0x000001d8	472

1:	0x00000040		64	0x00048b54	297812

2:	0x00000044		68	0x00048bbc	297916

3:	0x0025b318		2470680	0x00048c30	298032

4:	0x0000004c		76	0x002a3fe0	2768864

5:	0x000000f4		244	0x002a402c	2768940

Hm. that 4th CMbT section is the one I want. Using parsebin to dump this section to its own file:

./parsebin.pl -p CMbT -d 298032 s14v101.bin

This will generate a file called “s14v101.bin-CMbT-298032.” Lets open this. The section starts off like this (plane text):

CMbT....L.......(...ColorspaceTestText......Colorspace is sRGB-Enhanced!....FBIN.........O®±....dn..BINSL
.... ÿ.... ...,..8+.Õ 

Woa. Whats that? We see a couple possible tags. There is that FBIN tag. then BINSL? Hm. FBIN=Firmware Bin?? I have the suspicion that there is a header associated with the original CMbT section, then there is an embedded file, an “FBIN” file. Searching this file for BINS and I get several hits.  Letsuse parsebin to break this up too. First thing first though, lets remove everything before “FBIN” and save this as its own file. I’ll call this file s14v101.fbin.

Categories: SD14 Firmware Hacking