The Wing boots it’s bootloader from the SPI Flash chip on board.
This SPI Flash chip can be dumped via the uboot console.
It contains a bootloader which loads the `.wingfw` file on the emmc and “decrypts” (in reality md5 derivation is used) it and boots it.
GitHub - niklasarnitz/behringer-wing-firmware-exploration · GitHub (Disclaimer: The Readme is written by ai, the code by me. I was too lazy to bring my unstructed notes in a structured format so i let ai do it)
The next step would be to further analyze the bootloader to find out how to decrypt the .wingfw file to gain access to device tree files.
summershrimp (GH) has successfully implemented a decryptor for the .wingfw firmware file.
1 Like
I’m now working on getting uboot to boot from inside a wingfw file - so using the original wing bootloader.
1 Like
chris
7
Great news. In a couple of days I will publish the new video about OpenX32. Maybe we will get a bit more attention here…