HDD GURU FORUMS
http://forum.hddguru.com/

Bluetooth speaker flash dump
http://forum.hddguru.com/viewtopic.php?f=10&t=42712		 Page 1 of 1
Author:  spiel [ September 12th, 2022, 9:00 ]
Post subject:  Bluetooth speaker flash dump
Hi,
I've dumped the Flash of a Bluetooth system I have in my car. I'd like to replace some of the default sounds, so I run binwalk - but there's no known files in the dump. However I can see bytes RIFFWAVE at a certain location, and when extracting the data from said location to the end, I end up with a file containing all sounds that the system has (I think). I can also see the string LAME3.93 repeated many times; my understanding is that it points to MP3 format used.

My questions are:
- How can I detect file format and names of sound files in the dump?
- How can I replace them?

The dump is attached; had to change extension to txt.

Thanks

Attachments:
wefatech_spi_flash.txt [2 MiB]
Downloaded 358 times
Author:  fzabkar [ September 12th, 2022, 15:04 ]
Post subject:  Re: Bluetooth speaker flash dump
There is a table of sound clips at offset 0x100000.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B

000FFFFC              4D 56 55 42 89 DB 00 00      MVUB‰Û..
00100008  53 4E 55 4D 30 FD 0B 10 00 68 0A 00  SNUM0ý...h..
          ^^ -----------                                      <-- name of sound #1 = NUM0
number of sound clips = 0x53 (83 dec)

00100014  00 59 59 44 4B 65 16 10 00 D6 1F 00  .YYDKe...Ö..
00100020  00 -----------                                      <-- name of sound #2 = YYDK

Code:
          name     offset   size      name
          -------- -------- --------  ----
00000000  4E554D30 FD0B1000 680A0000  NUM0ý...h...
0000000C  5959444B 65161000 D61F0000  YYDKe...Ö...
00000018  59594742 3B361000 001E0000  YYGB;6......
00000024  5959515A 3B541000 3E2A0000  YYQZ;T..>*..
00000030  58594D4C 797E1000 0F210000  XYMLy~...!..
0000003C  44515848 889F1000 1F240000  DQXHˆŸ...$..
00000048  51425848 A7C31000 BC240000  QBXH§Ã..¼$..
00000054  4B534C59 63E81000 AC210000  KSLYcè..¬!..
00000060  4C594243 0F0A1100 AC210000  LYBC....¬!..
0000006C  4C594246 BB2B1100 D61F0000  LYBF»+..Ö...
00000078  53434C59 914B1100 E6220000  SCLY‘K..æ"..
00000084  59505352 776E1100 0F210000  YPSRwn...!..
00000090  59504246 868F1100 49220000  YPBF†...I"..
0000009C  43204246 CFB11100 C61C0000  C BFϱ..Æ...
000000A8  53594D53 95CE1100 E6220000  SYMS•Î..æ"..
000000B4  53205953 7BF11100 001E0000  S YS{ñ......
000000C0  58205953 7B0F1200 9C1E0000  X YS{...œ...
000000CC  5A202054 172E1200 E0170000  Z  T....à...
000000D8  5420205A F7451200 E0170000  T  Z÷E..à...
000000E4  4858544A D75D1200 59250000  HXTJ×]..Y%..
000000F0  48584144 30831200 631D0000  HXAD0ƒ..c...
000000FC  48584445 93A01200 001E0000  HXDE“ ......
00000108  5953544A 93BE1200 82230000  YSTJ“¾..‚#..
00000114  59534144 15E21200 2A1C0000  YSAD.â..*...
00000120  59534445 3FFE1200 2A1C0000  YSDE?þ..*...
0000012C  4759544A 691A1300 49220000  GYTJi...I"..
00000138  47594144 B23C1300 531A0000  GYAD²<..S...
00000144  47594445 05571300 F01A0000  GYDE.W..ð...
00000150  4459544A F5711300 0F210000  DYTJõq...!..
0000015C  44594144 04931300 1A190000  DYAD.“......
00000168  44594445 1EAC1300 B7190000  DYDE.¬..·...
00000174  4854444B D5C51300 E6220000  HTDKÕÅ..æ"..
00000180  48544742 BBE81300 0F210000  HTGB»è...!..
0000018C  5A204459 CA091400 F01A0000  Z DYÊ...ð...
00000198  43202044 BA241400 A7160000  C  Dº$..§...
000001A4  42544D53 613B1400 0F210000  BTMSa;...!..
000001B0  42544C4A 705C1400 0F210000  BTLJp\...!..
000001BC  4254444B 7F7D1400 73200000  BTDK.}..s ..
000001C8  4449414E F29D1400 4E0F0000  DIANò...N...
000001D4  5A574D53 40AD1400 AC210000  ZWMS@...¬!..
000001E0  59574D53 ECCE1400 73200000  YWMSìÎ..s ..
000001EC  53504F50 5FEF1400 531A0000  SPOP_ï..S...
000001F8  5350434C B2091500 001E0000  SPCL².......
00000204  434F4353 B2271500 2A3A0000  COCS²'..*:..
00000210  4E584644 DC611500 C61C0000  NXFDÜa..Æ...
0000021C  52455031 A27E1500 2A1C0000  REP1¢~..*...
00000228  5250414C CC9A1500 7D180000  RPALÌš..}...
00000234  53545245 49B31500 391F0000  STREI³..9...
00000240  53415245 82D21500 8D1B0000  SARE‚Ò......
0000024C  5245504C 0FEE1500 1F240000  REPL.î...$..
00000258  44455245 2E121600 001E0000  DERE........
00000264  4C494E45 2E301600 D1140000  LINE.0..Ñ...
00000270  55445042 FF441600 E6220000  UDPBÿD..æ"..
0000027C  43445042 E5671600 0F210000  CDPBåg...!..
00000288  52444D44 F4881600 8D1B0000  RDMDôˆ......
00000294  5052534F 81A41600 001E0000  PRSO.¤......
000002A0  4E45534E 81C21600 531A0000  NESN.Â..S...
000002AC  50415553 D4DC1600 3E0C0000  PAUSÔÜ..>...
000002B8  53544F50 12E91600 B10E0000  STOP.é..±...
000002C4  45435245 C3F71600 D61F0000  ECREÃ÷..Ö...
000002D0  4543504C 99171700 F01A0000  ECPL™...ð...
000002DC  45435244 89321700 C61C0000  ECRD‰2..Æ...
000002E8  444C5245 4F4F1700 49220000  DLREOO..I"..
000002F4  444C504C 98711700 F01A0000  DLPL˜q..ð...
00000300  444C5244 888C1700 001E0000  DLRDˆŒ......
0000030C  54525245 88AA1700 E6220000  TRREˆª..æ"..
00000318  5452504C 6ECD1700 2A1C0000  TRPLnÍ..*...
00000324  54525244 98E91700 9C1E0000  TRRD˜é..œ...
00000330  42415245 34081800 73200000  BARE4...s ..
0000033C  4241504C A7281800 B7190000  BAPL§(..·...
00000348  42415244 5E421800 631D0000  BARD^B..c...
00000354  4D494F50 C15F1800 9C1E0000  MIOPÁ_..œ...
00000360  4D49434C 5D7E1800 E6220000  MICL]~..æ"..
0000036C  53554241 43A11800 1A190000  SUBAC¡......
00000378  4D454E55 5DBA1800 780D0000  MENU]º..x...
00000384  42544D44 D5C71800 391F0000  BTMDÕÇ..9...
00000390  4254434E 0EE71800 1F240000  BTCN.ç...$..
0000039C  4254444E 2D0B1900 3E2A0000  BTDN-...>*..
000003A8  504F4954 6B351900 88100000  POITk5..ˆ...
000003B4  434E4D44 F3451900 C61C0000  CNMDóE..Æ...
000003C0  454E4D44 B9621900 2A1C0000  ENMD¹b..*...
000003CC  4D524E47 E37E1900 4A0E0100  MRNGã~..J...
000003D8  50484F4E 2D8D1A00 E3CD0000  PHON-...ãÍ..

All numbers are little-endian (hexadecimal). If you need me to write a tool to extract the sound clips, let me know.
Author:  fzabkar [ September 12th, 2022, 15:19 ]
Post subject:  Re: Bluetooth speaker flash dump
(This is a better forum to post this type of question:
https://www.eevblog.com/forum/embedded-computing/)


There is another table at offset 0x75B34.

Code:
          number   name                   name
          -------- -----------------      --------
00000000  00000000 4E554D30 5A45524F  ....NUM0ZERO
0000000C  01000000 4E554D31 4F4E4520  ....NUM1ONE
00000018  02000000 4E554D32 54574F20  ....NUM2TWO
00000024  03000000 4E554D33 54485245  ....NUM3THRE
00000030  04000000 4E554D34 464F5552  ....NUM4FOUR
0000003C  05000000 4E554D35 46495645  ....NUM5FIVE
00000048  06000000 4E554D36 53495820  ....NUM6SIX
00000054  07000000 4E554D37 5345564E  ....NUM7SEVN
00000060  08000000 4E554D38 45494754  ....NUM8EIGT
0000006C  09000000 4E554D39 4E494E45  ....NUM9NINE
00000078  0A000000 4A494135 504C5335  ....JIA5PLS5
00000084  0B000000 5959444B 53504F50  ....YYDKSPOP
00000090  0C000000 59594742 5350434C  ....YYGBSPCL
0000009C  0D000000 5959515A 434F4353  ....YYQZCOCS
000000A8  0E000000 58594D4C 4E584644  ....XYMLNXFD
000000B4  0F000000 44515848 52455031  ....DQXHREP1
000000C0  10000000 51425848 5250414C  ....QBXHRPAL
000000CC  11000000 4B534C59 53545245  ....KSLYSTRE
000000D8  12000000 4C594243 53415245  ....LYBCSARE
000000E4  13000000 4C594246 5245504C  ....LYBFREPL
000000F0  14000000 53434C59 44455245  ....SCLYDERE
000000FC  15000000 59505352 4C494E45  ....YPSRLINE
00000108  16000000 59504246 55445042  ....YPBFUDPB
00000114  17000000 43204246 43445042  ....C BFCDPB
00000120  18000000 53594D53 52444D44  ....SYMSRDMD
0000012C  19000000 53205953 5052534F  ....S YSPRSO
00000138  1A000000 58205953 4E45534E  ....X YSNESN
00000144  1B000000 5A202054 50415553  ....Z  TPAUS
00000150  1C000000 5420205A 53544F50  ....T  ZSTOP
0000015C  1D000000 4858544A 45435245  ....HXTJECRE
00000168  1E000000 48584144 4543504C  ....HXADECPL
00000174  1F000000 48584445 45435244  ....HXDEECRD
00000180  20000000 5953544A 444C5245   ...YSTJDLRE
0000018C  21000000 59534144 444C504C  !...YSADDLPL
00000198  22000000 59534445 444C5244  "...YSDEDLRD
000001A4  23000000 4759544A 54525245  #...GYTJTRRE
000001B0  24000000 47594144 5452504C  $...GYADTRPL
000001BC  25000000 47594445 54525244  %...GYDETRRD
000001C8  26000000 4459544A 42415245  &...DYTJBARE
000001D4  27000000 44594144 4241504C  '...DYADBAPL
000001E0  28000000 44594445 42415244  (...DYDEBARD
000001EC  29000000 4854444B 4D494F50  )...HTDKMIOP
000001F8  2A000000 48544742 4D49434C  *...HTGBMICL
00000204  2B000000 45515A52 464C4154  +...EQZRFLAT
00000210  2E000000 45514744 434C4153  ....EQGDCLAS
0000021C  2D000000 45514C58 504F5020  -...EQLXPOP
00000228  2C000000 45515947 524F434B  ,...EQYGROCK
00000234  30000000 45514A53 4A415A5A  0...EQJSJAZZ
00000240  2F000000 45515248 534F4654  /...EQRHSOFT
0000024C  31000000 5A204459 53554241  1...Z DYSUBA
00000258  32000000 43202044 4D454E55  2...C  DMENU
00000264  33000000 42544D53 42544D44  3...BTMSBTMD
00000270  34000000 42544C4A 4254434E  4...BTLJBTCN
0000027C  35000000 4254444B 4254444E  5...BTDKBTDN
00000288  36000000 4449414E 504F4954  6...DIANPOIT
00000294  37000000 5A574D53 454E4D44  7...ZWMSENMD
000002A0  38000000 534B4D53 55414D44  8...SKMSUAMD
000002AC  39000000 59582054 41524D44  9...YX TARMD
000002B8  3A000000 42202046 504C4159  :...B  FPLAY
000002C4  3B000000 4B20204A 46202046  ;...K  JF  F
000002D0  3C000000 4B202054 46202042  <...K  TF  B
000002DC  3D000000 5A48485A 4D20485A  =...ZHHZM HZ
000002E8  3E000000 4D4C5848 52504644  >...MLXHRPFD
000002F4  3F000000 4C4C4246 494E5452  ?...LLBFINTR
00000300  40000000 534A4246 52414E44  @...SJBFRAND
0000030C  41000000 5A445354 41545343  A...ZDSTATSC
00000318  42000000 53594454 50525354  B...SYDTPRST
00000324  43000000 58594454 4E585354  C...XYDTNXST
00000330  44000000 5949474A 50574F46  D...YIGJPWOF
0000033C  45000000 4754594C 4755564C  E...GTYLGUVL
00000348  46000000 53535A48 53454152  F...SSZHSEAR
00000354  47000000 4A59444B 4D554F4E  G...JYDKMUON
00000360  48000000 4A594742 4D554F46  H...JYGBMUOF
0000036C  49000000 4854594C 4D49564C  I...HTYLMIVL
00000378  4A000000 5A48594C 4D41564C  J...ZHYLMAVL
00000384  4B000000 48544D4B 4D4D4F50  K...HTMKMMOP
00000390  4C000000 48544D47 4D4D434C  L...HTMGMMCL
0000039C  4D000000 4854594B 4D464F50  M...HTYKMFOP
000003A8  4E000000 48545947 4D46434C  N...HTYGMFCL
000003B4  4F000000 4420204B 4F50454E  O...D  KOPEN
000003C0  50000000 47202042 434C4F53  P...G  BCLOS
000003CC  51000000 444C4449 4C505752  Q...DLDILPWR
000003D8  52000000 5A5A4344 43484147  R...ZZCDCHAG
000003E4  53000000 444C594D 46554C4C  S...DLYMFULL
000003F0  54000000 44445044 57545041  T...DDPDWTPA
000003FC  55000000 53204849 5420454E  U...S HIT EN
00000408  56000000 42204149 48445244  V...B AIHDRD
00000414  57000000 48544352 4D43494E  W...HTCRMCIN
00000420  58000000 48544243 4D434F55  X...HTBCMCOU
0000042C  59000000 57555348 46494654  Y...WUSHFIFT
00000438  5A000000 59494241 4F484444  Z...YIBAOHDD
00000444  5B000000 59425753 4F484646  [...YBWSOHFF
00000450  5C000000 4C424149 54484444  \...LBAITHDD
0000045C  5D000000 4D524E47 4D524E47  ]...MRNGMRNG
00000468  5E000000 50484F4E 50484F4E  ^...PHONPHON
Author:  fzabkar [ September 12th, 2022, 16:13 ]
Post subject:  Re: Bluetooth speaker flash dump
fzabkar wrote:
There is another table at offset 0x75B34.

Code:
          number   name                   name
          -------- -----------------      --------
00000078  0A000000 4A494135 504C5335  ....JIA5PLS5  <-- first 4 characters is name of Chinese language sound clip (JIA5), last four is English equivalent (PLS5)
00000084  0B000000 5959444B 53504F50  ....YYDKSPOP
00000090  0C000000 59594742 5350434C  ....YYGBSPCL
Author:  fzabkar [ September 13th, 2022, 2:11 ]
Post subject:  Re: Bluetooth speaker flash dump
Attached are your sound clips.

The ClipList.txt file contains the Name, Offset, Size and Header information for each file. All but the last two files are LAME file types, while the last two files are MP3s. All files are playable with the VLC media player.

When you are adding your own sound clip, paste it into the free area at the end of the flash, then amend the offset and size dwords in the table so that they point to the new file. Hopefully there is no checksum. If there is a checksum, the firmware will probably throw a fatal error and refuse to load.

Attachments:
SoundClips.7z [526.77 KiB]
Downloaded 325 times
Author:  spiel [ September 13th, 2022, 9:51 ]
Post subject:  Re: Bluetooth speaker flash dump
Hey fzabkar, that's an awesome job! I was able to figure out the table at 0x100000 as I found it by eyeballing the binary really hard for a long time. Could you share some info on how did you find the table, and general advise on the process?

Your suggestion for adding the new file in the empty space and then adjusting the offset in the table is great. Honestly what I was going to do is completely replace one of the sound files, but by doing what you're suggesting I can try adding a longer/shorter audio file.

Many thanks again
Author:  fzabkar [ September 13th, 2022, 11:52 ]
Post subject:  Re: Bluetooth speaker flash dump
spiel wrote:
I was able to figure out the table at 0x100000 as I found it by eyeballing the binary ...

That's basically what I did. I always look for patterns in the data.

BTW, does your device have a graphical interface?

You might like to try different audio formats if LAME proves to be a challenge. I suspect that the firmware may recognise additional codecs and file types.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000A700  4D 50 33 5F 44 45 43 4F 44 45 52 00 49 C7 02 00  MP3_DECODER.IÇ..
0000A710  5D C8 02 00 A1 CA 02 00 A5 CA 02 00 BB CA 02 00  ]È..¡Ê..¥Ê..»Ê..
0000A720  57 4D 41 5F 44 45 43 4F 44 45 52 00 19 D7 02 00  WMA_DECODER..×..
0000A730  1B D7 02 00 4B D8 02 00 4F D8 02 00 61 D8 02 00  .×..KØ..OØ..aØ..
0000A740  53 42 43 5F 44 45 43 4F 44 45 52 00 B9 DA 02 00  SBC_DECODER.¹Ú..
0000A750  BB DA 02 00 FD DC 02 00 01 DD 02 00 13 DD 02 00  »Ú..ýÜ...Ý...Ý..
0000A760  57 41 56 5F 44 45 43 4F 44 45 52 00 9F F1 02 00  WAV_DECODER.Ÿñ..
0000A770  0F F2 02 00 39 F3 02 00 3D F3 02 00 4F F3 02 00  .ò..9ó..=ó..Oó..
0000A780  46 4C 41 43 5F 44 45 43 4F 44 45 52 00 00 00 00  FLAC_DECODER....
0000A790  F7 F8 02 00 87 F5 02 00 AF FA 02 00 B3 FA 02 00  ÷ø..‡õ..¯ú..³ú..
0000A7A0  C5 FA 02 00 41 41 43 5F 44 45 43 4F 44 45 52 00  Åú..AAC_DECODER.
0000A7B0  B5 FC 02 00 B7 FC 02 00 11 01 03 00 15 01 03 00  µü..·ü..........
0000A7C0  27 01 03 00 41 49 46 5F 44 45 43 4F 44 45 52     '...AIF_DECODER
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/