Philips QFU Chassis "UpgradeAll.upg"-file

[Wiebotje]

Dear members,

does anybody have the "UpgradeAll.upg"-file that is used in the factory to flash Philips QFU-chassis based TV's?

[Maalobs]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

Have you looked here for historical upgrades to your specific chassis or model:
https://toengel.net/philipsblog/firmware-archiv/

[William1967]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

The UpgradeAll.upg file is part of the so called ONE ZIP Software, this is the latest version.

[Maalobs]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

In the "processNVM_QF1EU_6.0.0.15.txt" file it says at the bottom:

processNVM_QF1EU_6.0.0.1 (1/12/2011 )
--------------------------------------
1) Initial NVM created, with default values and processNVM option codes
2) also based on [B]2k12_NVM layout_ Fusion.xls[/B]

You wouldn't happen to have the final version of that XLS-file, would you?
It sounds like it would explain the layout of the NVM, possibly with default values and annotations for each offset.

[William1967]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

Sorry, not available. When you program the eeprom with the procesNVM file the tv will start in a standard mode, the options must be aligned after that.

[Maalobs]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

I see, thanks.

[Wiebotje]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

Thank you very much William! I can do some experiments with this file. You also have by accident the UpgradeAll.upg for the 1.2 chassis?

[William1967]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

Yes I do.

[Maalobs]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

If the purpose of this "ONE Zip Software" to restore the TV to factory software and settings; I assume that you already need a working system on the TV then, so the system can decrypt and unpack the UPG-file?

The contents of the posted files are pretty obfuscated:

$ binwalk FullUpgrade_QF2EU_0.173.61.0.upg

DECIMAL    HEXADECIMAL   DESCRIPTION
--------------------------------------------------------------------------------
78098987    0x4A7B22B    lrzip compressed data
93089990    0x58C70C6    Cisco IOS microcode, for "$"

$ binwalk FullUpgrade_QF1EU_0.150.91.0.upg

DECIMAL    HEXADECIMAL   DESCRIPTION
--------------------------------------------------------------------------------
8609320      0x835E28    MySQL MISAM compressed data file Version 5
52186359    0x31C4CF7    Uncompressed Adobe Flash SWF file, Version 78, File size (header included) 36942997
52258934    0x31D6876    gzip compressed data, ASCII, has 9802 bytes of extra data, last modified: 1990-05-04 02:21:15 (bogus date)
122133394   0x7479B92    MySQL MISAM index file Version 4
126758296   0x78E2D98    Cisco IOS microcode, for """
153233067   0x92226AB    MySQL ISAM compressed data file Version 4

$

There was a several years long discussion thread in the comments section of this blog about the Philips UPG-files, and how they used to be cleartext and then got encrypted, and the crypto key got hidden better and better in consecutive releases, until no one in the thread was able to find it anymore:
https://web.archive.org/web/20160421...ilips-pfl9703/

Do you know of a way to extract the key or of otherwise unpacking the UPG-files, so that the NAND/eMMC and whatever else is included, can be manually flashed to the chips on a TV where they got worn-out and had to be replaced by empty chips?

[William1967]

Re: Philips QFU Chassis "UpgradeAll.upg"-file

The keys are not in that software, only Philips can align those with a special tool. How it's done is not known. An empty eeprom for the CPU NVM can be used, upload the software with a programmer and the tv will start up with, the options etc must be aligned after that.