Image tool doesn't work with MPC 3 beta

[fudini]

It looks like 3 beta no longer can be extracted with mpcimg script:

---------------------------------------------------------------------
AKAI MPC/FORCE IMAGE TOOL - V1.2
https://github.com/TheKikGen/MPC-LiveXplore
(c) The KikGen labs.

NB : the dtc utility must be acessible from the current path !
---------------------------------------------------------------------

Akai image [mpc-3.4.0.92BETA-update.img] details :

Found properties : [] 

hash value           : 

Done !

Just running fdtget gives:

Error at '/': FDT_ERR_BADMAGIC

[simonvpe]

You can attempt my custom script. It extracts the rootfs from the MPC 3.4-beta3 image, enables sshd, and installs an ssh key. Tested an working on MacOS (including flashing my MPC Key 37 with fastboot).

If you use linux you might need some adaptions.

#!/usr/bin/env bash

set -o errexit -o nounset

readonly image="${1:-mpc-3.4-beta3.img}"
readonly ssh_key="${2:-$HOME/.ssh/id_rsa.pub}"    # not sure ed25519 is supported
readonly workdir=${workdir:-}                     # set to a directory if you want to keep tmp files around after running
readonly rootfs_image="${image/.img/.rootfs.img}"
readonly tmp="$(mktemp -d)"

trap 'rm -rf "$tmp"' EXIT

if [[ ! -f "$ssh_key" ]]; then
  printf "ssh key %s not found\n" "$ssh_key" >&2
  exit 1
fi

if [[ ! -f "$image" ]]; then
  printf "image %s not found\n" "$image" >&2
  exit 1
fi

if [[ "$(uname -a)" == "Darwin" ]]; then
  command -v binwalk >/dev/null || brew install binwalk
  command -v fuse-ext2 >/dev/null || brew install fuse-ext2
else
  command -v binwalk >/dev/null || { printf 'binwalk not found\n' >&2; exit 1; }
fi

sudo echo # ask for password upfront

binwalk --extract --count=1 --directory "${workdir:-$tmp}" "$image"

mv "${workdir:-$tmp}"/**/154 "${rootfs_image}"

mkdir -p "${workdir:-$tmp}/rootfs"

if [[ "$(uname -s)" == "Darwin" ]]; then
  fuse-ext2 -orw+ "${rootfs_image}" "${workdir:-$tmp}/rootfs"
  trap 'diskutil unmount "${workdir:-$tmp}/rootfs"; rm -rf "$tmp"' EXIT
else
  sudo mount -o loop,rw "${rootfs_image}" "$tmp/rootfs"
  trap 'sudo umount "${workdir:-$tmp}/rootfs"; rm -rf "$tmp"' EXIT
fi

#
# INSTALL STUFF HERE
#
sudo ln -s "/usr/lib/systemd/system/sshd.service" "${workdir:-$tmp}/rootfs/etc/systemd/system/multi-user.target.wants/sshd.service" # linux maybe needs -f flag?
cat "$ssh_key" | sudo tee -a "${workdir:-$tmp}/rootfs/root/.ssh/authorized_keys"

[fudini]

@simonvpe thanks for the script, I will definitely test it later!

[simonvpe]

Just a note to the maintainers of this project:

The rootfs is no longer contained in a dtb (or there's possibly some other content before the dtb). In the 3.4beta3 image there's first a chunk of 0x154 bytes, then the rootfs xz compressed. So if the maintainers of this project want to use my script I recommend to instead of using binwalk ord fdtget to scan the image for the first xz header to find the start offset, then parse out the length, then use dd to extract the rootfs.xz. Binwalk is quite a hefty dependency and I simply wanted something quick and dirty to get ssh up, to try and troubleshoot my audio interface problems.

Another possibly important piece of information is that I used the image bundled inside of the MacOS installer app. While unlikely, it's possible that the images are put together differently depending on how they are bundled with their installers.

They have also switched from using buildroot to yocto scarthgap. In large everything is pretty much the same on the rootfs except some of the auxillary scripts/services are now C++ applications so more difficult to analyze what they are doing, and a bunch of libs and tools are missing, such as the alsa utilities. Even though Akai/Inmusic must comply to GPL source code requests I have little hopes they would actually comply knowing how infamously bad their customer support is, but it would be pretty simple and neat to create a Yocto toolchain for the MPC.

[DeathCamel58]

I just thought I'd chime in here about the signed firmware images. I've put up a good bit of documentation on my reverse engineering site for the inMusic devices including how to read the new header to find the partitions in the signed firmware images. I hope someone here finds this useful.

https://deathcamel58.github.io/denon-reverse-engineering/signed-firmware-layout.html