release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > SonyNWUPGTool

Sony NW/NWZ series: unpacking and repacking UPG


This tool allows one pack and unpack firmware upgrades for Sony players that run linux. Codenames in the following table correspond to the SonyNW page
Note: Android devices (NWZ-ZX1, NW-ZX2 etc...) are not supported!
If your player is not in this list, help us.
If the list below says "No (never)" it means your device cannot be supported because this feature is not supported by your device.

Series codename Status Comment
NWZ-A10 nwz-a10 DONE Works  
NW-A20 nw-a20 DONE Works  
NW-A30 nw-a30 DONE Works  
NW-A40 nw-a40 DONE Works  
NW-A50 nw-a50 DONE Works  
NWZ-A810 nwz-a810 DONE Works  
NWZ-A840 nwz-a840 DONE Works  
NWZ-A850 nwz-a850 DONE Works  
NWZ-A860 nwz-a860 DONE Works  
NWZ-E360   choice-no No (IMX)  
NWZ-E370   choice-no No (iMX)  
NWZ-E380   choice-no No (IMX)  
NWZ-E390   choice-no No (never)  
NWZ-E440   choice-no No (IMX)  
NWZ-E450 nwz-e450 DONE Works  
NWZ-E460 nwz-e460 DONE Works  
NWZ-E470 nwz-e470 DONE Works  
NWZ-E580 nwz-e580 DONE Works  
NW-WM1A nw-wm1a DONE Works  
NW-WM1Z nw-wm1z DONE Works  
NW-ZX1   choice-no No (never)  
NW-ZX2   choice-no No (never)  
NW-ZX100 nw-zx100 DONE Works  
NW-ZX300 nw-zx300 DONE Works  
NW-ZX300A nw-zx300 DONE Works  
NWZ-S750 nwz-s750 DONE Works  
NWZ-W270   choice-no No (never)  
DMP-Z1 dmp-z1 DONE Works  

The IMX entries use a native port and described at ImxInstall. They use a completely different firmware format (SbFileFormat)

Getting the tool

You can either download a prebuilt tool or build it from source.

Architecture Link Build date Commit
Linux (64-bit) upgtool_64-v3 11/10/2020 fcdfeb2
Windows (32-bit/64-bit) upgtool-v3.exe 11/10/2020 fcdfeb2
You can build the tool from source on Linux, you can also cross-compile from Linux to Windows. You can build it on windows but it will required a POSIX environment like MSYS or Cygwin.
  • First you need to get a copy of the repository, see UsingGit.
  • Change to utils/nwztools/upgtool
  • If you are building for the same architecture, run make
  • If you are cross-compiling, run make PREFIX=i686-w64-minw32 Of course, replace the prefix by whatever prefix your windows toolchain is using
  • Alternatively, you can also run ./make_release X to build both linux and windows version, this is how releases for this tool are done.

Reporting an unsupporting device to developers

In order for a new device to be supported, it's "Key and Signature" (KAS) needs to be known. The KAS can be obtained from the device using the scsitool, available at SonyNWDestTool.
  • Download the scsitool at SonyNWDestTool (follow the instruction there on how to buid/download/use it)
  • Connect your Sony device
  • Ask for the KAS using the following commands (depending on whether to use windows or linux):
         scsitool-nwz-vX.exe H: get_dnk_nvp kas
         scsitool-nwz_64-vX /dev/sdX get_dnk_nvp kas
         
  • This will print the KAS, for example this the output of the NW-A35
    Model: NW-A35
    Series: NW-A30 Series
    kas (node 11,key and signature):
     63 34 30 64 39 31 65 37 65 66 66 66 33 65 33 61 c40d91e7efff3e3a
     61 35 63 38 38 33 31 64 64 38 35 35 32 36 66 65 a5c8831dd85526fe
     34 39 37 32 30 38 36 32 38 33 34 31 39 63 38 63 4972086283419c8c
     64 38 66 61 33 62 37 64 63 64 33 39             d8fa3b7dcd39
        
  • Email to me (AmauryPouly) or you can edit directly utils/nwztools/upgtool/upg.c and add an entry for your device and recompile upgtool. Here is an example for the device NW-A35
        { "nw-a30", true, "c40d91e7efff3e3aa5c8831dd85526fe4972086283419c8cd8fa3b7dcd39dee4" },
        

How to get UPG files

Sony typically distributes firmware upgrades in the format of an executable file (EXE).

For most older models, tools like cabextract or unshield (Linux) or 7-Zip (Windows) can extract files from the executable. The UPG file is typically located either in the root directory or in the subdirectory Data/Device.

For some recent models (NW-A50, NW-WM1 etc), it won't be possible to extract the UPG file directly from the executable. In this case, you need to run the executable and it will extract the UPG file to a temporary directory, usually C:\Users\[User_Name]\AppData\Local\Temp\SPackTool\[random_directory_name]\Package\Data\Device

What are UPG files

Firmware upgrades are distributed in the UPG file format. There are two versions of this format, but the only visible difference (for developers) is the length of the KAS (16 bytes for recent devices, 8 bytes for older ones) and the MD5 file for newer models (see below). A UPG file is just an encrypted firmware archive. There can be any numbers of files but some are specials:
  • the first file is bash (actually busybox-sh) script that the device will run on a firmware upgrade
  • on newer models (with long KAS), the second file contains the MD5 hash of compressed file
Files are numbered start from 0, so the first file has index 0, the second file 1, and so on. A typical firmware upgrade will contains
  • the upgrade script
  • the MD5 file
  • (optional)a bootloader update
  • kernel update
  • older devices: a tar containing files to upgrade on the root filesystem
  • newer devices: a (compressed) partition image of the root filesystem
  • newer devices: secure firmware/DRM upgrades

Note that whatever the content of the archive, all the upgrade is actually done by the script. Therefore, it is entirely possible to craft firmware upgrades that do nothing, or just run a file and modify nothing, and so on. It is also possible to take a firmware upgrade, keep the script and only modify the root image, this allows to create MODs very easily.

Upgrade script

It is not important to understand how the upgrade script works, however reading it is useful because it contains two important pieces of information
  • which entries correspond to what
  • which entries are compressed
The script will typically extract files as follows:
ORDER_KERNEL_ROOTFS=2
ORDER_SYSTEM=6
...
COMMON_KERNEL_PARTITION=/emmc@bootimg
SYSTEM_PARTITION=/emmc@android
...
fwpup -f /contents/$_UPDATE_FN_.UPG -$ORDER_KERNEL_ROOTFS $COMMON_KERNEL_PARTITION
...
fwpup -z -f /contents/$_UPDATE_FN_.UPG -$ORDER_SYSTEM $SYSTEM_PARTITION
We can see that the script uses fwpup to unpack the files. the "-X" gives the index (-1 is index 1 for instance), the "-z" means the entry is compressed. There is some magic going on for compressed files where the upgrade script will extract the MD5 from the second entry. This is not important to know as long as you do not touch the script.

Unpacking files

Unpacking files is very easy: here is how to extract all files to a subdirectory
mkdir output_dir
upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG
This will unpack files and creates files 0.bin, 1.bin and so on. If you know a file is compressed, you can ask the tool to uncompress it for you and (optionally) check its MD5 file against the second file. For this you need to know the index and the name used in the MD5 file. For instance, if 1.bin contains
838860800 3b53977f89c3e1d768388ae2cf51a2b7 system.img
and you known the system partition has index 5, then you can run instead
upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG -z 6,system.img
It is possible to uncompressed several files by passing multiples -z options. If the MD5 file is missing or you do not want to check the MD5 (or you working with older devices that do not have MD5 files), just pass the index to -z as follows;
upgtool -e -m nw-a30 -o output_prefix/ NW_WM_FW.UPG -z 6
Note: at the moment, upgtool will always extract all files at one, it does not support extracting just one file, although support for that could be added.

Packing files

Packing files is very similar to unpacking them, but there is a slightly subtlety with compressed files. If you do not want to compressed files, then simply give the tool the list of files, in the order you want. So the first file will have index 0, and so on. Here is an example to repack a file unpacked above:
upgtool -c out.upg -m nw-a30 tmp/*.bin
or if you are working on windows:
upgtool -c out.upg -m nw-a30 tmp/0.bin tmp/1.bin tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin

Packing files that are compressed is slightly more involved (on newer) models because of the MD5 files. You have two options:
  • recommended: let the tool generate the MD5 file for you
  • not recommended: generate the MD5 file yourself and give it to the tool

Let the tool generate the MD5 file

It is really recommended to the let tool do this for you. In this case, you will still need to pass an empty file for index 1 (the second file). Then add for each compressed entry a switch of the form -z index,name. The index is the index of the file to compress and the name is the one that will appear in the MD5 file. For instance, we can repack the compressed system file of above as follows:
touch empty.txt # create an empty file
upgtool -c out.upg -m nw-a30  -z 6,system.img tmp/0.bin empty.txt tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin

Generate the MD5 by hand

First generate the MD5 (or keep it untouched if you are not modifying anything). Then repack the file, specify files to compress using -z index but no name.
upgtool -c out.upg -m nw-a30  -z 6 tmp/0.bin tmp/1.bin tmp/2.bin tmp/3bin tmp/4.bin tmp/5.bin tmp/6.bin tmp/7.bin tmp/8.bin
I Attachment Action Size Date Who Comment
upgtool-v3.exeexe upgtool-v3.exe manage 555.4 K 11 Oct 2020 - 13:28 AmauryPouly  
upgtool_64-v3EXT upgtool_64-v3 manage 515.4 K 11 Oct 2020 - 13:28 AmauryPouly  
r2 - 11 Oct 2020 - 16:44:56 - LudovicJacques

Copyright © by the contributing authors.