Header

Each file begin with a header containing crucial information about the firmware.

offset	length	description
0x00	0x10	signature
0x10	0x4	firmware size (in bytes)
0x14	0x4	block size (unsure) (in bytes)
0x18	0x1	version encoding
0x19	0x1	unk1
0x1a	0x10	second signature

The block size is always 512. The first signature is the same for all versions of the firmware files.

signature	11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 75

The second signature and unknown field depends on the version which is encoding as follows.

encoding	version	unk1	second signature
0x0d	1	0xd0	76 5c 50 94 69 b0 a7 03 10 f1 7e db 88 90 86 9d
0x0e	1	0xd0	92 22 7a 77 08 67 ae 06 16 06 b8 65 a6 42 f7 52
0xfd	2
0x7e	3	0xe1	3f ad f8 b0 2e af 67 49 b9 85 5f 63 4e 5e 8e 2e

Common

Checksum

In several places the firmware files use a xor-based checksum. This section describes the algorithm used.

void pamaury_xor_it(uint8_t *buf, int size, uint8_t t[20])
{
    memset(t, 0, sizeof(t));

    for(int i = 0; i < size; i++)
        t[i % 20] ^= buf[i];
    for(int i = 0; i < 20; i++)
        t[i] = ~t[i];
}

Version 3

The version 3 (encoded as 0x7e) differs significantly from previous versions.

Header Extra

The header contains a few extra fields described as follows.

offset	length	description
0x1ee	0x1	block address (in lower 4 bits)
0x1fe	0x1	block address (in lower 4 bits)

The first field indicates the block address (minus 2) of a 1024 bytes block. The sum of first and the second fields indicates the block address (minus 5) of a 512 bytes block.