This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" focusable="false" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 24 24" class="iconify mr-1" data-icon="mdi:arrow-left" style="vertical-align: -0.125em; transform: rotate(360deg);"><path d="M20 11v2H8l5.5 5.5l-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5L8 11h12z" fill="currentColor"></path></svg>====== TP-Link Switch Image Format ====== This page is WiP and details the TP-Link image format header as found in various Realtek-based switches. * The whole file is DES CBC encrypted - IV and Key are known * There is a 512 Byte header, the structure is known * The header MD5 sum matches if the last 128 bytes of the decrypted image are omitted or zeroed * There are about 8000 bytes of data at the end of the image that are not part of any partition; that's a lot of zeros, the product ID, 200 bytes of base64 data (maybe an RSA signature?) ===== Decoding the image file ===== IV and Key can be extracted from the U-Boot source at common/DesDecode.c. There are the two variables: <code>unsigned char des_key[] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07 }; </code> <code> unsigned char des_iv[] = { 0xf5,0x10,0x10,0x73,0x6e,0xfb,0xab,0xb2 }; </code> With this knowledge, we can use openssl to decode the image: <code>openssl enc -d -des-cbc -in encrypted.bin -out decrypted.bin -nosalt -nopad -p -iv f51010736efbabb2 -K 0001020304050607</code> Note: this may require [[https://wiki.openssl.org/index.php/OpenSSL_3.0#Providers|legacy providers]] to be enabled for recent version of openssl ===== Image Format ===== The image itself contains a 512 byte header. The structure can also be found in the U-Boot source code at include/tplink/flashAppFsImage.h: <code> #define MD5_CHECKSUM_OFFSET 0 #define MD5_DIGEST_LEN 16 #define FLASH_PRODUCT_LENGTH 16 #define TP_IMAGE_NAME_SIZE 200 #define TP_IMAGE_HEADER_SIZE 512 #define FL_SIZE_LEN 16 /* "0x100000" */ #define FL_VER_LEN 16 /* "0x10000" */ typedef struct { char md5[MD5_DIGEST_LEN]; unsigned char productId[FLASH_PRODUCT_LENGTH]; char imagename[TP_IMAGE_NAME_SIZE]; UINT32 usrImageSize; UINT32 uImageSize; UINT32 bootromSize; UINT32 compressMethod; char flBootSize[FL_SIZE_LEN]; char flKernelOffset[FL_SIZE_LEN]; char flKernelSize[FL_SIZE_LEN]; char flUsrImg1Offset[FL_SIZE_LEN]; char flUsrImg1Size[FL_SIZE_LEN]; char flUsrImg2Offset[FL_SIZE_LEN]; char flUsrImg2Size[FL_SIZE_LEN]; char flUsrAppOffset[FL_SIZE_LEN]; char flUsrAppSize[FL_SIZE_LEN]; char flVer[FL_VER_LEN]; }_TP_IMAGE_HEADER; </code> ===== MD5 Sum ===== In the T2500G-10TS GPL archive, the common/flashAppFsImage.c has a (commented out) section on MD5 and checksum calculation. The header MD5 sum matches, given the following: * The header MD5 sum needs to be zeroed (=salt) * The last 128 bytes of the image, an RSA signature, need to be truncated. The RSA signature contained in the last 128, signs the 16 MD5 checksum bytes. The public key of the certificate is contained in the aforementioned source file as a BASE64 string. ===== Embedded RSA Key ===== There is an embedded RSA public key towards the end of the image. Upon decoding, the string "RSA1" pops up, it is most likely an RSA Public Key Blob. Its purpose is yet unknown, but: * All firmware version for the T1600G-52PS have the same key * The latest firmware versions for the T1500G-10MPS and the T2500G-10TS have the same key (others not checked)