[bogdantogo]

Hello all,


I would like to share with you a tool I developed to parse and extract BMW SWE firmware files.

It works with SWFL, BTLD, FLSL files from the psdzdata/swe/.
Maybe some of you had a look over the swfl_0000uuuu.bin.uuu_uuu_uuu files and saw that some of them use a compression method. It can also be confirmed by checking the corresponding swfl_0000uuuu.xml.uuu_uuu_uuu that some segments are marked as <FLASH-SEGMENT COMPRESSION-STATUS="COMPRESSED"> and some are <FLASH-SEGMENT COMPRESSION-STATUS="UNCOMPRESSED">.
BMW is actually using NRV algorithm for the compressed sections.

I created a Python script to parse the .xml, extract binary blocks from corresponding .bin and call the unucl extractor app which is the open source implementation of the NRV compression algorithm and reassemble the final binary.

I have included in the archive 2 builds of the UCL extractor, for x64 Linux and Windows.

Windows CMD or Linux terminal usage example:
python extract.py -i swfl_00004a5a.bin.010_006_040 -x swfl_00004a5a.xml.010_006_040

! Python is required to be installed on your machine !


Have Fun!

[juantg93]

I have tried it on a professional nbt unit, and I have not been able to get it to work. I don't know if I've done something wrong. I attach a log.

[bogdantogo]

In your case the file after '-x' parameter needs to be the xml, not the same .bin you passed on the '-i' parameter.
The required command in your case:
python extract.py -i swfl_00001280.bin.003_013_001 -x swfl_00001280.xml.003_013_001

P.S '-x' and '-o' parameters are optional, only '-i' is mandatory. If you don't set them the script will automatically fill the xml file and generate swfl_00001280.bin.003_013_001.extracted

Just make sure that you have the .xml in the same location where the .bin is stored

[juantg93]

In your case the file after '-x' parameter needs to be the xml, not the same .bin you passed on the '-i' parameter.
The required command in your case:
python extract.py  -i swfl_00001280.bin.003_013_001 -x swfl_00001280.xml.003_013_001

P.S '-x' and '-o' parameters are optional, only '-i' is mandatory. If you don't set them the script will automatically fill the xml file and generate swfl_00001280.bin.003_013_001.extracted

Just make sure that you have the .xml in the same location where the .bin is stored

Sorry. It was a silly mistake on my part.


Now a file named ''swfl_00001280.bin.003_013_001.extracted'' has been generated.

With this file how can I see what is inside?

[rocdeng]

In your case the file after '-x' parameter needs to be the xml, not the same .bin you passed on the '-i' parameter.
The required command in your case:
python extract.py  -i swfl_00001280.bin.003_013_001 -x swfl_00001280.xml.003_013_001

P.S '-x' and '-o' parameters are optional, only '-i' is mandatory. If you don't set them the script will automatically fill the xml file and generate swfl_00001280.bin.003_013_001.extracted

Just make sure that you have the .xml in the same location where the .bin is stored

Sorry. It was a silly mistake on my part.


Now a file named ''swfl_00001280.bin.003_013_001.extracted'' has been generated.

With this file how can I see what is inside?

Even after extracting, it's still a binary file, you could use bin file viewer like Winhex to view it. But you can only see binary data, you can only figure out what the data meaning by your self, because no one will disclosure the data structure.

[____ANGEL___]

very usefull for fixing things when they goes wrong.

[zero9]

With this file how can I see what is inside?

You dont need this tool

[juantg93]

With this file how can I see what is inside?

You dont need this tool

I know. at first i thought it was to extract files like the nbt unpacker. This is a good tool for whoever needs it.

[bogdantogo]

Unfortunately this tool is not an NBT extractor or some other task specific tool. It is generic and works on all SWE NRV compressed FW files.

It is useful for cases when BTLD or other SW component gets corrupted and is needed to correct the FW through JTAG or other Flash write method. Take care that in some cases besides the FW stored in SWE files there are also some adjustment or production data blocks so it really depends from case to case.

It is also useful to reverse engineer stuff and after it was extracted with this tool to pass the binary data through analysis tools like binwalk.
For example I extracted the JAVA app running on ATM2 and the root password seed & hash with binwalk after swfl_00004a54.bin and swfl_00004a55.bin were extracted using this tool.

@jutantg93 the swfl_00001280.bin file is not even compressed. If you look in swfl_00001280.xml it is composed of 2 sections but both have <FLASH-SEGMENT COMPRESSION-STATUS="UNCOMPRESSED">. So in this particular case swfl_00001280.bin.003_013_001 will be identical with swfl_00001280.bin.003_013_001.extracted

[megalo84]

Hello all,


I would like to share with you a tool I developed to parse and extract BMW SWE firmware files.

It works with SWFL, BTLD, FLSL files from the psdzdata/swe/.
Maybe some of you had a look over the swfl_0000uuuu.bin.uuu_uuu_uuu files and saw that some of them use a compression method. It can also be confirmed by checking the corresponding swfl_0000uuuu.xml.uuu_uuu_uuu that some segments are marked as <FLASH-SEGMENT COMPRESSION-STATUS="COMPRESSED"> and some are <FLASH-SEGMENT COMPRESSION-STATUS="UNCOMPRESSED">.
BMW is actually using NRV algorithm for the compressed sections.

I created a Python script to parse the .xml, extract binary blocks from corresponding .bin and call the unucl extractor app which is the open source implementation of the NRV compression algorithm and reassemble the final binary.

I have included in the archive 2 builds of the UCL extractor, for x64 Linux and Windows.

Windows CMD or Linux terminal usage example:
python extract.py -i swfl_00004a5a.bin.010_006_040 -x swfl_00004a5a.xml.010_006_040

! Python is required to be installed on your machine !


Have Fun!

Thanks!

exist a command that allows you to compress the extracted file again?