Sony NW-A30 Series

---

Overview

This is the page for the Sony NW-A30 series (NW-A35, NW-A36, NW-A37).

Analysis

Sony has changed a lot of things. For starters this player is based on the MT8590 instead of the Emma Mobile CPU. More importantly, Sony has changed something in the encryption of its firmwares. The firmware still starts with the MD5 sum of the rest but:

• the KAS is now 60 byte long (still hex) compared to 32 byte previously
• it is obviously obtained differently: previous KAS were obtained by running DES-ECB on [Key,Sig] with the key "ed295076" but the 60-bytes decrypts to some garbage using DES-ECB
• a brute-force search for the hex keys with DES-ECB yields no result

This suggest that Sony may have moved to some other encryption scheme but it is not clear which one (60-byte is quite unusual). If it is the case, we do not know if this is the raw key or if the real key is derived from the KAS using some encryption like on previous generations.

Service manual

See SonyNW.

-- AmauryPouly - 19 Sep 2017