TransWikia.com

unpacking Download.img firmware for alcatel mw40

Reverse Engineering Asked by coolirc on September 1, 2021

Hello i’m trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9×07) firmware but it seems i can’t do it with 7zip or mount the img file . someone already extracted the file which will give partition images like this :

appsboot_fastboot.mbn
appsboot.mbn
b.vhd
config.xml
custom_info.xml
efs.mbn
ENPRG9x07.mbn
jrdresource.ubi
mdm9607-boot.img
mdm9607-sysfs.ubi
NON-HLOS.ubi
NPRG9x07.mbn
partition.mbn
rpm.mbn
sbl1.mbn
tz.mbn

under linux the format of the file is :

file Download.img 
Download.img: dBase III DBT, version number 0, next free block index 65545, 1st item "D34306"

anyone can show how to unpack this file to get the list of mentioned files above
thanks for help , i’m trying to learn how.
file link Download.img

One Answer

The file format consists of a file table starting at 0xC8 with each entry being:

  • char filename[48]
  • uint32_t position
  • uint32_t size

Where position indicates the position in the archive and size the archived file's size.

Run code.py Download.img to extract the files and place them into Download.img.out/:

from __future__ import print_function
import os
import sys
import struct

if len(sys.argv) <= 1:
    print('usage: {} file'.format(sys.argv[0]))
    exit(1)

path = '{}.out/'.format(sys.argv[1])

if not os.path.exists(path):
    os.makedirs(path)

with open(sys.argv[1], 'rb') as f:
    i = 0
    while True:
        f.seek(0xC8 + i*0x50)
        name = f.read(0x48).decode('ascii').split('x00')[0]
        if (len(name) == 0): break
        if struct.calcsize('II') == 0x08:
            v = struct.unpack('II', f.read(0x08))
        elif struct.calcsize('LL') == 0x08:
            v = struct.unpack('LL', f.read(0x08))
        else:
            print("Unsupported platform")
            exit(1)
        f.seek(v[0])
        out = open('{}{}'.format((path, name), 'wb'))
        out.write(f.read(v[1]))
        out.close()
        i += 1
    f.close()

Correct answer by user29082 on September 1, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP