Non Exynos Samsung Images (Qualcomm)

Non-Exynos Samsung Images

Warning

Please be aware that Samsung releases Exynos and Qualcomm based devices at the same time, with the same model name but different device identifiers. Please make sure you downloaded Exynos based firmware for processing it with this module.

How to validate if a modem.bin is a Non-Exynos one

Occasionally you will encounter modem.bin images with the following structure. They cannot be loaded with this loader and will show up as simple binary if dragged into IDA.

xxd modem.bin | head
00000000: eb3c 904d 5344 4f53 352e 3000 1004 0100  .<.MSDOS5.0.....
00000010: 0200 0200 00f8 0b00 3f00 ff00 0000 0000  ........?.......
00000020: 005e 0100 8000 294e 61bc 004e 4f20 4e41  .^....)Na..NO NA
00000030: 4d45 2020 2020 4641 5431 3620 2020 33c9  ME    FAT16   3.
00000040: 8ed1 bcf0 7b8e d9b8 0020 8ec0 fcbd 007c  ....{.... .....|
00000050: 384e 247d 248b c199 e83c 0172 1c83 eb3a  8N$}$....<.r...:
00000060: 66a1 1c7c 2666 3b07 268a 57fc 7506 80ca  f..|&f;.&.W.u...
00000070: 0288 5602 80c3 1073 eb33 c98a 4610 98f7  ..V....s.3..F...
00000080: 6616 0346 1c13 561e 0346 0e13 d18b 7611  f..F..V..F....v.
00000090: 6089 46fc 8956 feb8 2000 f7e6 8b5e 0b03  `.F..V.. ....^..

Checking these with fdisk will give some weird stats:

sudo fdisk -l modem.bin
Disk modem.bin: 176.68 MiB, 185266688 bytes, 361849 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6f20736b

Device     Boot      Start        End    Sectors   Size Id Type
modem.bin1       778135908 1919645538 1141509631 544.3G 72 unknown
modem.bin2       168689522 2104717761 1936028240 923.2G 65 Novell Netware 386
modem.bin3      1869881465 3805909656 1936028192 923.2G 79 unknown
modem.bin4               0 3637226495 3637226496   1.7T  d unknown

You can mound these modem images easily on loopback for examination:

mkdir image
mount -o loop ./modem.bin ./image/

Further examination will reveal typical Qualcomm firmware structure.

$ ls image/*
fw_ipa_gsi_5.5_h.elf  ipa_fws.b02  ipa_fws.mdt  modem.b01  modem.b04  modem.b07  modem.b10  modem.b13  modem.b16  modem.b19  modem.b23  modem.b26  modem.b30  modem.b33  modem.b37      modem_dtb.b01  modem_oem
ipa_fws.b00           ipa_fws.b03  lanai        modem.b02  modem.b05  modem.b08  modem.b11  modem.b14  modem.b17  modem.b21  modem.b24  modem.b28  modem.b31  modem.b34  modem.mdt      modem_dtb.b02  modem_pr
ipa_fws.b01           ipa_fws.b04  modem.b00    modem.b03  modem.b06  modem.b09  modem.b12  modem.b15  modem.b18  modem.b22  modem.b25  modem.b29  modem.b32  modem.b35  modem_dtb.b00  modem_dtb.mdt  modemr.jsn