AOS2 file format

From ArchosDocs

Jump to: navigation, search


The AOS2 file format has been reverse engineered from avos.

An .aos update file can be validated by any of 5 keys. The key to use is determined by the first 4 bytes in the SIGN block:

  • SIG0 is the RelMPK key.
  • SIG1 is the DevMPK key.
  • SIG2 is the PlugMPK key.
  • SIG3 is the HDDMPK key.
  • SIG4 is the GAMESPMK key.

The validation is done by decrypting the last 128 bytes in the SIGN block. The first 16 bytes of the decrypted data is an md5 checksum. If the decrypted checksum matches the actual checksum of the file (from 132 bytes to end of file) the file is deemed to be valid.

See the keystore page for details about the RSA keys and the AES key.

Note that some blocks have a fixed size, and others are variable. The Block size column is sometimes the maximum size a block can be, and not the actual size of a block. Offsets are specified by reference to the maximum block size.

Block Block size (bytes) Offset Size (bytes) Value/Description
Header 4 0 4 Always 0x414F5332 (AOS2)
SIGN 136 4 4 Ranges between 0x53494730 and 0x53494734 (SIG0 to SIG4).
8 4 Size of the SIGN block. This field is not used, avos assumes this block is always 132 bytes long.
12 128 RSA-encrypted md5 checksum.
CIPH 28 140 4 Always 0x43495048 (CIPH). If this block is omitted, no decryption is performed.
144 4 Size of the CIPH block. This field is not used, avos assumes this block is always 28 bytes long.
148 4 Should be 0xBF959, otherwise no decryption is performed.
152 16 Initialization vector for the AES key that will decrypt the rest of the file.
UNIT 40 168 4 Always 0x554E4954 (UNIT).
172 4 Size of the UNIT block.
176 16 Product Name, must match the value returned by SysInfo_GetProductName().
192 14 Optional Product Key, if first byte is non-null then this field must match the return value of SYSINFO_GetPK().
VERS 20 208 4 Always 0x56455253 (VERS).
212 4 Size of the VERS block.
216 4 Major version number.
220 4 Minor version number.
224 4 Build version number.
TIME 12+... 228 4 Always 0x54494d45 (TIME).
232 4 Size of the TIME block.
236 4 Always the number of remaining blocks in the file (after this block).
240 ... An array of 32-bit words, each element in the array represent the time allocation, in seconds, for each remaining block in the file to be acted upon. The number of real elements in this array is the number of remaining blocks in the file (the value of the previous line). The size of the array itself seems to always be 100 elements, the remaining unused elements are zeroed.

The aos-tools project

A toolchain to deal with .aos files.

Related details are on the aos-tools page

The archutil tool

Archutil is a tool that will allow you to work with .aos files.

To build, make sure you have libssl-dev installed and then type make in the sources' directory.

An updated version is available with the A5IT keys:

Personal tools