Sony NW/NWZ series: unpacking and repacking UPG

---

This tool allows one pack and unpack firmware upgrades for Sony players that run linux. Codenames in the following table correspond to the SonyNW page
Note: Android devices (NWZ-ZX1, NW-ZX2 etc...) are not supported!
If your player is not in this list, help us.
If the list below says "No (never)" it means your device cannot be supported because this feature is not supported by your device.

Series	codename	Status	Comment
NWZ-A10	nwz-a10	Works
NW-A20	nw-a20	Works
NW-A30	nw-a30	Works
NW-A40	nw-a40	Works
NW-A50	nw-a50	Works
NWZ-A810	nwz-a810	Works
NWZ-A840	nwz-a840	Works
NWZ-A850	nwz-a850	Works
NWZ-A860	nwz-a860	Works
NWZ-E360		No (IMX)
NWZ-E370		No (iMX)
NWZ-E380		No (IMX)
NWZ-E390		No (never)
NWZ-E440		No (IMX)
NWZ-E450	nwz-e450	Works
NWZ-E460	nwz-e460	Works
NWZ-E470	nwz-e470	Works
NWZ-E580	nwz-e580	Works
NW-WM1A	nw-wm1a	Works
NW-WM1Z	nw-wm1z	Works
NW-ZX1		No (never)
NW-ZX2		No (never)
NW-ZX100	nw-zx100	Works
NW-ZX300	nw-zx300	Works
NW-ZX300A	nw-zx300	Works
NWZ-S750	nwz-s750	Works
NWZ-W270		No (never)
DMP-Z1	dmp-z1	Works

The IMX entries use a native port and described at ImxInstall. They use a completely different firmware format (SbFileFormat)

Getting the tool

You can either download a prebuilt tool or build it from source.

Architecture	Link	Build date	Commit
Linux (64-bit)	upgtool_64-v3	11/10/2020	fcdfeb2
Windows (32-bit/64-bit)	upgtool-v3.exe	11/10/2020	fcdfeb2

• Alternatively, you can also run ./make_release X to build both linux and windows version, this is how releases for this tool are done.

Reporting an unsupporting device to developers

In order for a new device to be supported, it's "Key and Signature" (KAS) needs to be known. The KAS can be obtained from the device using the scsitool, available at SonyNWDestTool.

• Download the scsitool at SonyNWDestTool (follow the instruction there on how to buid/download/use it)
• Connect your Sony device
• Ask for the KAS using the following commands (depending on whether to use windows or linux):

       scsitool-nwz-vX.exe H: get_dnk_nvp kas
       scsitool-nwz_64-vX /dev/sdX get_dnk_nvp kas
       

• This will print the KAS, for example this the output of the NW-A35

  Model: NW-A35
  Series: NW-A30 Series
  kas (node 11,key and signature):
   63 34 30 64 39 31 65 37 65 66 66 66 33 65 33 61 c40d91e7efff3e3a
   61 35 63 38 38 33 31 64 64 38 35 35 32 36 66 65 a5c8831dd85526fe
   34 39 37 32 30 38 36 32 38 33 34 31 39 63 38 63 4972086283419c8c
   64 38 66 61 33 62 37 64 63 64 33 39             d8fa3b7dcd39
      

• Email to me (AmauryPouly) or you can edit directly utils/nwztools/upgtool/upg.c and add an entry for your device and recompile upgtool. Here is an example for the device NW-A35

      { "nw-a30", true, "c40d91e7efff3e3aa5c8831dd85526fe4972086283419c8cd8fa3b7dcd39dee4" },
      

How to get UPG files

Sony typically distributes firmware upgrades in the format of an executable file (EXE).

For most older models, tools like cabextract or unshield (Linux) or 7-Zip (Windows) can extract files from the executable. The UPG file is typically located either in the root directory or in the subdirectory Data/Device.

For some recent models (NW-A50, NW-WM1 etc), it won't be possible to extract the UPG file directly from the executable. In this case, you need to run the executable and it will extract the UPG file to a temporary directory, usually C:\Users\[User_Name]\AppData\Local\Temp\SPackTool\[random_directory_name]\Package\Data\Device

What are UPG files

Firmware upgrades are distributed in the UPG file format. There are two versions of this format, but the only visible difference (for developers) is the length of the KAS (16 bytes for recent devices, 8 bytes for older ones) and the MD5 file for newer models (see below). A UPG file is just an encrypted firmware archive. There can be any numbers of files but some are specials:

• the first file is bash (actually busybox-sh) script that the device will run on a firmware upgrade
• on newer models (with long KAS), the second file contains the MD5 hash of compressed file

Files are numbered start from 0, so the first file has index 0, the second file 1, and so on. A typical firmware upgrade will contains

• the upgrade script
• the MD5 file
• (optional)a bootloader update
• kernel update
• older devices: a tar containing files to upgrade on the root filesystem
• newer devices: a (compressed) partition image of the root filesystem
• newer devices: secure firmware/DRM upgrades

Note that whatever the content of the archive, all the upgrade is actually done by the script. Therefore, it is entirely possible to craft firmware upgrades that do nothing, or just run a file and modify nothing, and so on. It is also possible to take a firmware upgrade, keep the script and only modify the root image, this allows to create MODs very easily.

Upgrade script

It is not important to understand how the upgrade script works, however reading it is useful because it contains two important pieces of information

• which entries correspond to what
• which entries are compressed

The script will typically extract files as follows:

ORDER_KERNEL_ROOTFS=2
ORDER_SYSTEM=6
...
COMMON_KERNEL_PARTITION=/emmc@bootimg
SYSTEM_PARTITION=/emmc@android
...
fwpup -f /contents/$_UPDATE_FN_.UPG -$ORDER_KERNEL_ROOTFS $COMMON_KERNEL_PARTITION
...
fwpup -z -f /contents/$_UPDATE_FN_.UPG -$ORDER_SYSTEM $SYSTEM_PARTITION

We can see that the script uses fwpup to unpack the files. the "-X" gives the index (-1 is index 1 for instance), the "-z" means the entry is compressed. There is some magic going on for compressed files where the upgrade script will extract the MD5 from the second entry. This is not important to know as long as you do not touch the script.

Unpacking files

Unpacking files is very easy: here is how to extract all files to a subdirectory

mkdir output_dir
upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG

This will unpack files and creates files 0.bin, 1.bin and so on. If you know a file is compressed, you can ask the tool to uncompress it for you and (optionally) check its MD5 file against the second file. For this you need to know the index and the name used in the MD5 file. For instance, if 1.bin contains

838860800 3b53977f89c3e1d768388ae2cf51a2b7 system.img

and you known the system partition has index 5, then you can run instead

upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG -z 6,system.img

It is possible to uncompressed several files by passing multiples -z options. If the MD5 file is missing or you do not want to check the MD5 (or you working with older devices that do not have MD5 files), just pass the index to -z as follows;

upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG -z 6

Note: at the moment, upgtool will always extract all files at one, it does not support extracting just one file, although support for that could be added.

Packing files

Packing files is very similar to unpacking them, but there is a slightly subtlety with compressed files. If you do not want to compressed files, then simply give the tool the list of files, in the order you want. So the first file will have index 0, and so on. Here is an example to repack a file unpacked above:

upgtool -c out.upg -m nw-a30 tmp/*.bin

or if you are working on windows:

upgtool -c out.upg -m nw-a30 tmp/0.bin tmp/1.bin tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin

Packing files that are compressed is slightly more involved (on newer) models because of the MD5 files. You have two options:

• recommended: let the tool generate the MD5 file for you
• not recommended: generate the MD5 file yourself and give it to the tool

Let the tool generate the MD5 file

It is really recommended to the let tool do this for you. In this case, you will still need to pass an empty file for index 1 (the second file). Then add for each compressed entry a switch of the form -z index,name. The index is the index of the file to compress and the name is the one that will appear in the MD5 file. For instance, we can repack the compressed system file of above as follows:

touch empty.txt # create an empty file
upgtool -c out.upg -m nw-a30  -z 6,system.img tmp/0.bin empty.txt tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin

Generate the MD5 by hand

First generate the MD5 (or keep it untouched if you are not modifying anything). Then repack the file, specify files to compress using -z index but no name.

upgtool -c out.upg -m nw-a30  -z 6 tmp/0.bin tmp/1.bin tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin