mbirth / gcd-parser Goto Github PK

GarminDevice.xml

    <Model>
        <PartNumber>006-B3466-00</PartNumber>
        <SoftwareVersion>1440</SoftwareVersion>
        <Description>Instinct Solar Tactical</Description>
    </Model>

I am not sure if you guys still needed this data but here it is.

Hi,
I have found a use case of this cool parser, to downgrade the firmware of vivoactive 3 (tested with my own device). The idea is to repack a 'higher' version of the firmware from the version you want to downgrade, and fraud the device that you've put a newer firmware into it.

For example, If the current version of your device is 7.50, you want to roll back to 7.30.

1. Download the 7.30 GCD file from the garmin website. The link can be fetched from get_updates.py.
2. Use gcddump.py to dump the file.
3. Edit the rcp file, input a higher version(e.g 0x02f8), and mark it as reset.

   # Reset/Downgrade flag
   0x000b = 0x01
   # Firmware version
   0x100d = 0x02f8
   

4. Use gcdcompile.py to recompile the firmware.
5. Rename the new firmware to GUPDATE.gcd and put it to /GARMIN folder.
6. Unplug the watch, let it downgrade automatically.

WARNING: Use at your own risk. DO NOT roll back to 6.x when your firmware is 7.x. Please don't ask me how I knew. I've bricked my device by doing this. 🤣 🤣 🤣

P.S. Does anyone know how to un-brick Vivoactive 3? It stuck at the screen of blue triangle. Plug it to the PC but nothing happens.

I used gcdstruct.py to extract the various sections of a GUPDATE.GCD file for my watch (Forerunner 245 Music). The binary for TLV Type 0x02bd is between 7MB and 8MB. Looking at the file a bit, it seems that the first 0x1fd000 bytes (including padding) are a binary that would sit in flash, which makes sense as the internal flash is 2MB. However, that leaves a question of what the structure of the rest of the file is. Running binsum.py finds a valid sha1sum near the end of the file, but that is only one small portion of what remains.
Do you know anything else about the structure of the rest of TLV Type 0x02bd? Or would I be better off following up with the Alex W. mentioned in binsum.py (I assume this is them?)

GarminDevice.xml

	<Model>
		<PartNumber>
			006-B3126-00
		</PartNumber>
		<SoftwareVersion>
			1440
		</SoftwareVersion>
		<Description>
			Instinct
		</Description>
	</Model>

the dumping result doesn't have loader section
original fw can be downloaded from:
https://download.garmin.com/software/Fenix5SAPAC_GCDfile__2500.gcd

https://www8.garmin.com/support/download_details.jsp?id=4749 this is the software for the garmin fishing sonars suite. It is a little bit unusual since it contains a lot of subfiles in an update folder. The main update appears to be for all the various devices, but I found it quite hard to map any of those files to device ids.

These devices don't use the 006-B* profile but many different categories:
https://www8.garmin.com/support/ch.jsp?product=010-01864-00 for example

I'm not sure if support for those, or a way to find the mapping would be possible... but I'm open to suggestions and happy to suggest
some code for that:)

Hi!
I found a discussion about converting a 601 to 701 where you suggested to look for a translation function which checks if the desired language is installed and then locates the array of strings and selects PTR_sLanguage + stringId.
Could you tell me more on how to locate this function? I'm a little bit lost at the moment so I will appreciate any help. We can communicate via e-mail if you prefer (gerne auch in deutscher Sprache ;-).

Thank you in advance

A small contribution, thanks for sharing your great work.

The Fenix 6 series and a few other Garmin devices that use the Sony CXD5603GF chipset for GPS have an alternate SKU (your table is blank)

006-B3107-01

"GPS Software, Fenix 6 Series WW"

Note that ends in -01 and is slightly different than the listing for Forerunner 945, ending in -00 , 006-B3107-00

I believe Garmin calls it GPS Chipset Type S1 (3107) but the -00 is only up to v2.90 while -01 is up to 5.50

I am not sure what the difference is, they have international versions of these watches and APAC firmwares that have additional support for the Chinese GPS BeiDou and then the MARQ Aviator that has US WAAS GPS support while other models do not?

Also researching how to create CPE.BIN on demand for the Sony chipsets (equal to MediaTek EPO.BIN)

(old) https://www8.garmin.com/support/download_details.jsp?id=14841

Here is a Fenix 5X flashed with a Descent Mk1 firmware:

Click the image for the video!

If you have any more ideas contact me...

Hello, is it what you're looking for ? :

    <Model>
        <PartNumber>006-B2769-00</PartNumber>
        <SoftwareVersion>350</SoftwareVersion>
        <Description>Foretrex 601</Description>
    </Model>

Wanted to thank you for sharing this awhile back, I wrote some messy php for myself based on your code/method.

I noticed you updated the device list last month but I don't see Fenix 7 or Epix 2 in there?

Note they are also releasing the Forerunner 955 and 255 on June 1st 2022

But of course no telling when those part numbers will be searchable.

By the way I noticed they use a similar url for their software distribution, would be interesting to see update history on things like Express, etc.

"omt.garmin .com/Rce/ProtobufApi/ApplicationService/GetApplicationUpdate"

(space inserted to break domain on purpose from linking)

gcdstruct output:

`Opening .\SW_INVNTRY.GCD
#000: TLV Type 0001 at 0x8, 1 Byte - Checksum rectifier
#1: TLV Type 0002 at 0xd, 21 Bytes - Padding
#2: TLV Type 0003 at 0x26, 9 Bytes - Part number?
#3: TLV Type 0005 at 0x33, 55 Bytes - Copyright notice
#4: TLV Type 0001 at 0x6e, 1 Byte - Checksum rectifier
#5: TLV Type 0002 at 0x73, 3977 Bytes - Padding
#6: TLV Type 0001 at 0x1000, 1 Byte - Checksum rectifier
#7: TLV Type 0006 at 0x1005, 10 Bytes - Block Type 7 format definition

• Field list: 000b 000a 100a 2015 5003
  #8: TLV Type 0007 at 0x1013, 8 Bytes - Binary descriptor
• Field 1 (000b): Reset/Downgrade flag: 0x0001 / 1
• Field 2 (000a): XOR flag/value: 0x0000 / 0
• Field 3 (100a): Block type: 0x0401 / 1025
• Field 4 (2015): Binary length: 3043 Bytes
  Traceback (most recent call last):
  File ".\gcdstruct.py", line 28, in
  gcd.print_struct()
  File "D:\Work\other\Garmin\gcd-parser\grmn\gcd.py", line 90, in print_struct
  print("#{:03d}: {}".format(i, tlv))
  File "D:\Work\other\Garmin\gcd-parser\grmn\tlv.py", line 407, in str
  txt += "\n - Unknown header format (0x{:04x} / 0x{:04x})".format(hdr1, hdr2)
  NameError: name 'hdr1' is not defined`

GCD file is attached
SW_INVNTRY.zip

Hi, do not hesitate to contact me if you want the original GarminDevice file :-)

model ..

partnumber 006-B3282-00
-
softwareversion 440
-
description Forerunner 45S
-

id3341194188

006-B4071-00
703
Instinct 2 Solar

Thailand purchased

hi, we got garmin watches, that have as name tactix delta, but SKU is same as Fenix 6X Pro
this is snip from garmindevice.xml

    <Model>
        <PartNumber>006-B3291-00</PartNumber>
        <SoftwareVersion>2300</SoftwareVersion>
        <Description>tactix Delta</Description>
    </Model>

Let me share GarminDevice.xml from fenix 7S Sapphire Solar

GarminDevice.txt

006-B3943-10

diff --git a/grmn/devices.py b/grmn/devices.py
index c1b51fe..8c9f61c 100644
--- a/grmn/devices.py
+++ b/grmn/devices.py
@@ -1232,6 +1232,7 @@ DEVICES = {
     3914: "Forerunner 245 redesign",
     3927: "Approach G12",
     3934: "Approach S42",
+    3943: "EPIX (Gen 2)",
     3946: "SW, LTDM20, System Code, AOER",
     3949: "venu 2S ASIA",
     3950: "venu 2 ASIA",

./gcdstruct.py --verbose vivosmart4_480.gcd
Opening vivosmart4_480.gcd
#000: TLV Type 0001 at 0x8, 1 Byte - Checksum rectifier
#1: TLV Type 0002 at 0xd, 21 Bytes - Padding
#2: TLV Type 0003 at 0x26, 9 Bytes - Part number?
#3: TLV Type 0005 at 0x33, 55 Bytes - Copyright notice
#4: TLV Type 0001 at 0x6e, 1 Byte - Checksum rectifier
#5: TLV Type 0002 at 0x73, 3977 Bytes - Padding
#6: TLV Type 0001 at 0x1000, 1 Byte - Checksum rectifier
#7: TLV Type 0006 at 0x1005, 14 Bytes - Block Type 7 format definition

• Field list: 000b 000a 100a 2015 1009 100d 5003
  Traceback (most recent call last):
  File "/Users/admincr/Garmin_Firmware/gcd-parser/vivosmart4_test/../gcdstruct.py", line 26, in
  gcd.print_struct_full()
  File "/Users/admincr/Garmin_Firmware/gcd-parser/grmn/gcd.py", line 104, in print_struct_full
  print("#{:03d}: {}".format(i, tlv))
  File "/Users/admincr/Garmin_Firmware/gcd-parser/grmn/tlv.py", line 323, in str
  txt += "\n - Field {:d} ({:04x}): {:>20}: 0x{:04x} / {:d} ({})".format(i+1, fid, fdesc, v, v, devices.get_name(v, 0, RED + "Unknown device" + RESET))
  File "/Users/admincr/Garmin_Firmware/gcd-parser/grmn/devices.py", line 17, in get_name
  if subid.isnumeric():
  AttributeError: 'int' object has no attribute 'isnumeric'

Is any tactix able to be loaded on Fenix 5? If so, could someone help me out.

When fixing #13, I've also noticed something strange: The Vector firmware has a TLV6 and TLV7 block with no actual binary data (Field 2015 - Binary length = 0). Since the actual binary data is absent, the two blocks aren't dumped to the rcp file. The struct looks like this:

Opening Vector3_380.gcd
#000: TLV Type 0001 at 0x8, 1 Byte - Checksum rectifier
#001: TLV Type 0005 at 0xd, 55 Bytes - Copyright notice
#002: TLV Type 0001 at 0x48, 1 Byte - Checksum rectifier
#003: TLV Type 0003 at 0x4d, 2 Bytes - Part number?
#004: TLV Type 0001 at 0x53, 1 Byte - Checksum rectifier
#005: TLV Type 0006 at 0x58, 14 Bytes - Block Type 7 format definition
  - Field list: 1009 100a 2015 2017 2018 2019 5003
#006: TLV Type 0007 at 0x6a, 20 Bytes - Binary descriptor
  - Field 1 (1009):         Device hw_id: 0x0ae3 / 2787 (Vector 3)
  - Field 2 (100a):           Block type: 0x07d0 / 2000
  - Field 3 (2015):        Binary length: 0 Bytes   <---- Zero length = no binary block following?
  - Field 4 (2017):           Field 2017: 0x2ada0 / 175520
  - Field 5 (2018):           Field 2018: 0xb998 / 47512
  - Field 6 (2019):           Field 2019: 0x3a6d0 / 239312
~~~~~~~~~~~ BINARY BLOCK MISSING HERE ~~~~~~~~~~~~~
#007: TLV Type 0001 at 0x82, 1 Byte - Checksum rectifier
#008: TLV Type 0006 at 0x87, 28 Bytes - Block Type 7 format definition
  - Field list: 4007 0020 100a 000c 100d 100e 100f 1010 1011 1012 1013 2015 201a 5003
#009: TLV Type 0007 at 0xa7, 57 Bytes - Binary descriptor

When dumping, the TLV6 and TLV7 are tied to the actual binary data. Since there is none, they're not written to the RCP file. This needs to be refactored so compiling yields the original file.

<Model>
  <PartNumber>006-B1613-00</PartNumber>
  <SoftwareVersion>400</SoftwareVersion>
  <Description>nüvi 52</Description>
</Model>

I've got a dump of the onboard 2GB eMMc flash chip ( KLM2G1HE3F-B001) if it's helpful

<Model>
  <PartNumber>006-B3725-00</PartNumber>
  <SoftwareVersion>320</SoftwareVersion>
  <Description>GPSMAP 65s</Description>
</Model>

Thank you for your work.

Model>
PartNumber>006-B2700-00
SoftwareVersion>810
Description>vívoactive 3
/Model>

Id>3978018694

$ ./get_updates.py 006-B3943-10
$ wget http://download.garmin.com/software/EPIX_Gen2__720.gsp
$ unzip EPIX_Gen2__720.gsp
Archive: EPIX_Gen2__720.gsp
extracting: package.xml
inflating: manifest.xml
extracting: bundle.gsp
$ ./gcdstruct.py bundle.gsp

Opening bundle.gsp
Traceback (most recent call last):
  File "./gcdstruct.py", line 23, in <module>
    gcd = Gcd(FILE)
  File "gcd-parser/grmn/gcd.py", line 33, in __init__
    self.load()
  File "gcd-parser/grmn/gcd.py", line 43, in load
    raise ParseException(RED + "Signature mismatch ({}, should be {})!".format(repr(sig) + RESET, repr(GCD_SIG)))
grmn.gcd.ParseException: Signature mismatch (b'\x85u\xc0\x96\x99\xf6\xa5\x9c', should be b'GARMINd\x00')!

I just recently found this project and saw no other way to contact the author.
I already compiled a lot of file format info that might be helpful here: https://www.memotech.franken.de/FileFormats. Relevant is the *.GCD and *.RGN format description, and the list of SKU numbers in the Garmin firmware file (*.BIN) description.

I was trying to extract a .rgn file obtained from
http://download.garmin.com/software/fenix3_tactixBravo_quatix3_940.rgn
by ./gcddump.py fenix3_tactixBravo_quatix3_940.rgn fenix3 which gives me the error

~/src/gcd-parser:λ ./gcddump.py fenix3_tactixBravo_quatix3_940.rgn fenix3
Opening fenix3_tactixBravo_quatix3_940.rgn
Traceback (most recent call last):
  File "./gcddump.py", line 19, in <module>
    gcd = Gcd(FILE)
  File "/home/c/src/gcd-parser/grmn/gcd.py", line 33, in __init__
    self.load()
  File "/home/c/src/gcd-parser/grmn/gcd.py", line 43, in load
    raise ParseException(RED + "Signature mismatch ({}, should be {})!".format(repr(sig) + RESET, repr(GCD_SIG)))
grmn.gcd.ParseException: Signature mismatch (b'KpGrd\x00\x02\x00', should be b'GARMINd\x00')!

Disabling signature checking gives me another error

~/src/gcd-parser/:λ ./gcddump.py fenix3_tactixBravo_quatix3_940.rgn fenix3
Opening fenix3_tactixBravo_quatix3_940.rgn
WARNING: File truncated. End marker not reached yet. (pos=2093176)
Dumping to fenix3.rcp

Any thoughts?