search

cweiske / frontier-silicon-firmwares

Frontier silicon internet radio firmware binaries
48 stars 27 forks source link
binary firmware-image frontier-silicon internet-radio

readme

Frontier Silicon firmware binaries

A list of internet radio devices using Frontier Smart chipsets, binary firmware files and information about flashing those firmwares.

Blog post: https://cweiske.de/tagebuch/frontier-firmware-dl.htm

Related links

Known radios

Venice 6

Venice 6.2

Venice 6.5

Venice 6.6 (?)

FS2027

FS2028

FS2052

Venice X

FS2415

Minuet

Name Parts:

Very old models:

Initial list of names taken from http://iradioforum.net/forum/index.php?topic=2099.msg18986#msg18986

The Venice modules run a MEOS operating system on a Imagination Technologies META processor.

Flashing the firmware

Firmware preparation: .sap.bin creation

None of the flashing methods described here work with the .isu.bin firmware files from this repository.

The .isu.bin file cannot be used as firmware update - some bytes need to be stripped off the beginning.

FS2026

One user reports that the first bytes up to 0x7B must be removed from the ir-mmi-FS2026-0500-0653.2.11.19.EX70719-1B2.isu.bin to get a valid .sap.bin update file.

The .sap.bin update file thus begins with

05 00 10 00 10 A8 0A 00 00 B0 0A 00 06 02 1F 2B

Another user reported that for a FS2026-0500-0277, the first bytes up to 0xE9 had to be removed.

FS2340

Removing the first bytes up to 0x7B works here, too.

The generated .sap.bin file then begins with ir-cui-FS2340, which in hex is

69 72 2D 63 75 69 2D 46 53 32 33 34 30

Web interface

Some radios (e.g. FS2026-0500-0487) have a firmware upload form on their web interface.

At least the FS2026-0500-0487 wants a firmware file with a .sap.bin instead of a .isu.bin file extension. When renaming the .isu.bin to .sap.bin and uploading it, an error will be shown:

FILE CHECK FAILED

Uploading a prepared .sap.bin file (see above) will probably work.

dfu-util

Some users have reported that connecting the radio to the PC via a special USB-A-to-USB-A male-to-male cable puts the device in the "Device firmware upgrade" mode.

The PC lists the radio as following USB device then:

10a4:b784 Frontier Silicon Test DFU device

dfu-util can then be used to upload the firmware.

DFU mode available on:

DFU mode not available on:

At first, the .isu.bin must be converted to a .sap.bin update file - see above.

Steps to flash new firmware:

  1. Radio must show "Waiting for PC wizard"
  2. Connect radio to PC via USB
  3. Check that the radio is found with dfu-util -l
  4. Upload firmware to radio: dfu-util -d 10a4:bf8d -U myfirmware.sap.bin

FS2340: Recover "Waiting for PC wizard" using dfu-util

A user reported success in repairing a non-working radio using dfu-util. The radio was not booting normally and just showed "Waiting for PC wizard".

  1. Attach radio via regular USB cable 
    dfu-util -l
Found DFU: [10a4:c2aa] ver=0000, devnum=1, cfg=1, intf=0, path="0-1", alt=0, name="UNKNOWN", serial="00000001"
  2. Load firmware from radio: dfu-util -U radio_firmware.bin
  3. Identify radio firmware version by opening radio_firmware.bin in a hex editor. In this case the radio binary started with the string "ir-cui-FS2340-0000-0170_V4.5.7.e518da-1A10.bin"
  4. Download firmware from frontier silicon servers based on the instructions in this repository
  5. Convert downloaded .isu.bin to a .sap.bin update file - see above section "Firmware preparation". In this case all bytes before the "ir-cui..." string have been removed.
  6. Upload firmware to radio: dfu-util -D ir-cui-FS2340-0000-0170_V4.5.7.e518da-1A10.sap.bin

After turning the radio off and on again, it booted correctly.

Chip flashing

A user reports that he downloaded the firmware from his non-working radio by using a "CH341A programmer with soic-8 clip":

You must pull off venice module from the radio. When connecting the clip to flash you can read and flash the AT45D321 memory. It does not need to be desoldered from board, only clip must be connected.

Then he found the same start block in the firmware update file and copied all bytes from there on in the non-working firmware bin that was downloaded from the flash chip.

The "merged" binary was then flashed onto the chip, and the radio worked again.

Firmware information

FS2026 firmware is LZO compressed.

FS2026 updates

Known firmware versions are listed in known-versions.txt.

FS2026 Update check

Example URL:

https://update.wifiradiofrontier.com/FindUpdate.aspx?mac=0022616C4223&customisation=ir-mmi-FS2026-0500-0084&version=2.11.16.EX69632-2A9

Answer:

<?xml version="1.0" encoding="UTF-8" ?>
<updates>
  <software customisation="ir-mmi-FS2026-0500-0084"
            version="2.11.16.EX69632-2A10">
    <copyright>Copyright 2018 Frontier Silicon Ltd</copyright>
    <download>http://update.wifiradiofrontier.com/Update.aspx?c=ir-mmi-FS2026-0500-0084&amp;m=0022616C4223&amp;v=2.11.16.EX69632-2A9&amp;t=Cust-File&amp;n=2.11.16.EX69632-2A10&amp;f=/updates/ir-mmi-FS2026-0500-0084.2.11.16.EX69632-2A10.isu.bin</download>
    <mandatory>false</mandatory>
    <md5>849c5926e51a1e8cc651606f45a6ff3f</md5>
    <product>Internet Radio</product>
    <size>2428339</size>
    <summary>MP Candidate</summary>
    <vendor>Frontier Silicon</vendor>
  </software>
</updates>

FS2026: Download URL

All parameters except f are optional http://update.wifiradiofrontier.com/Update.aspx?f=/updates/ir-mmi-FS2026-0500-0084.2.11.16.EX69632-2A10.isu.bin

FS2026: Update script

Run update.py to automatically check for updates of existing firmware files.

FS2340

It seems that Frontier Silicon changed download URI and firmware format for FS2340 devices.

Another difference is that the firmware is encrypted. After the enco line some unknown binary content is following. Most likely the key to decrypt the firmware is placed inside the device during production.

FS2340: Update check

New update URL:

https://update.wifiradiofrontier.com/sr/FindUpdate.aspx?mac=123&customisation=ir-cui-FS2340-0000-0061&version=V4.2.10.4ad838-1B18

and reply is

<?xml version="1.0" encoding="UTF-8" ?>
<updates>
  <software customisation="ir-cui-FS2340-0000-0061"
            version="V4.5.6.9526d3-2A1">
    <copyright>Copyright 2020 Frontier Silicon Ltd</copyright>
    <download>https://update.wifiradiofrontier.com/sr/Update.aspx?c=ir-cui-FS2340-0000-0061&amp;m=123&amp;v=V4.2.10.4ad838-1B18&amp;t=Cust-Dir&amp;n=V4.5.6.9526d3-2A1&amp;f=/srupdates/ir-cui-FS2340-0000-0061/ir-cui-FS2340-0000-0061_V4.5.6.9526d3-2A1.isu.bin</download>
    <mandatory>false</mandatory>
    <md5>d47c2e61efcef905ec8bb1c258e4fb9a</md5>
    <product>Internet Radio</product>
    <size>3244413</size>
    <summary>Copyright 2007,2008,2009 Frontier Silicon Ltd</summary>
    <vendor>Frontier Silicon</vendor>
  </software>
</updates>

FS2340: Download URL

All parameters except f seem to be optional:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/ir-cui-FS2340-0000-0061/ir-cui-FS2340-0000-0061_V4.5.6.9526d3-2A1.isu.bin

This way its also possible to construct url for devices without actual update, e.g. for the Hama DIT2006BT Radio:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/ir-cui-FS2340-0000-0025/ir-cui-FS2340-0000-0025_V4.5.10.46f70b-1A13.isu.bin

General structure of the download URL:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/<CUSTOMIZATION>/<CUSTOMIZATION>_V<VERSION>.isu.bin

or alternatively:

https://nuv-isu-cdn.azureedge.net/srupdates/srupdates/<CUSTOMIZATION>/<CUSTOMIZATION>_V<VERSION>.isu.bin

FS5332: Download URL

Example:

https://nuv-isu-cdn.azureedge.net/nsupdates/nsupdates/ns-mmi-FS5332-0000-0082/ns-mmi-FS5332-0000-0082_1.7.8-18.ota.bin