AOS2 file format
The AOS2 file format has been reverse engineered from avos.
An .aos update file can be validated by any of 5 keys. The key to use is determined by the first 4 bytes in the SIGN block:
- SIG0 is the RelMPK key.
- SIG1 is the DevMPK key.
- SIG2 is the PlugMPK key.
- SIG3 is the HDDMPK key.
- SIG4 is the GAMESPMK key.
The validation is done by decrypting the last 128 bytes in the SIGN block. The first 16 bytes of the decrypted data is an md5 checksum. If the decrypted checksum matches the actual checksum of the file (from 132 bytes to end of file) the file is deemed to be valid.
See the keystore page for details about the RSA keys and the AES key.
Note that some blocks have a fixed size, and others are variable. The Block size column is sometimes the maximum size a block can be, and not the actual size of a block. Offsets are specified by reference to the maximum block size.
|Block||Block size (bytes)||Offset||Size (bytes)||Value/Description|
|Header||4||0||4||Always 0x414F5332 (AOS2)|
|SIGN||136||4||4||Ranges between 0x53494730 and 0x53494734 (SIG0 to SIG4).|
|8||4||Size of the SIGN block. This field is not used, avos assumes this block is always 132 bytes long.|
|12||128||RSA-encrypted md5 checksum.|
|CIPH||28||140||4||Always 0x43495048 (CIPH). If this block is omitted, no decryption is performed.|
|144||4||Size of the CIPH block. This field is not used, avos assumes this block is always 28 bytes long.|
|148||4||Should be 0xBF959, otherwise no decryption is performed.|
|152||16||Initialization vector for the AES key that will decrypt the rest of the file.|
|UNIT||40||168||4||Always 0x554E4954 (UNIT).|
|172||4||Size of the UNIT block.|
|176||16||Product Name, must match the value returned by SysInfo_GetProductName().|
|192||14||Optional Product Key, if first byte is non-null then this field must match the return value of SYSINFO_GetPK().|
|VERS||20||208||4||Always 0x56455253 (VERS).|
|212||4||Size of the VERS block.|
|216||4||Major version number.|
|220||4||Minor version number.|
|224||4||Build version number.|
|TIME||12+...||228||4||Always 0x54494d45 (TIME).|
|232||4||Size of the TIME block.|
|236||4||Always the number of remaining blocks in the file (after this block).|
|240||...||An array of 32-bit words, each element in the array represent the time allocation, in seconds, for each remaining block in the file to be acted upon. The number of real elements in this array is the number of remaining blocks in the file (the value of the previous line). The size of the array itself seems to always be 100 elements, the remaining unused elements are zeroed.|
The aos-tools project
A toolchain to deal with .aos files.
- Link: http://code.google.com/p/aos-tools/
- Author: EiNSTeiN_
- License: GPLv2
Related details are on the aos-tools page
The archutil tool
Archutil is a tool that will allow you to work with .aos files.
- Download link
- Author: CheBuzz
- License: GPLv3
- Forum thread: http://forum.archosfans.com/viewtopic.php?f=34&t=26526
To build, make sure you have libssl-dev installed and then type make in the sources' directory.
An updated version is available with the A5IT keys: http://strazzere.com/blog/?p=311