Frontier Silicon firmware download

Hardware chip and firmware of my TechniSat DigitRadio 580 are from Frontier Smart (formerly Frontier Silicon).

Since TechniSat support did not comply with my request for API documentation, I have to analyze the radio's firmware to find out all possible API calls myself. (There is some documentation, but it's incomplete.)

Firmware update process​

Most of the Frontier Silicon radios do not have a "update firmware" form in their web interface - only a "Firmware update" menu item that checks if there is a new firmware, downloads it to the radio itself and installs it. This makes it hard to obtain the firmware files for analysis.

When sniffing the HTTP traffic with mitmproxy, I found that the radio requested the following URL:

http://update.wifiradiofrontier.com/FindUpdate.aspx?mac=0022616C4223&customisation=ir-mmi-FS2026-0500-0286&version=2.11.12.EX65933-1A22

The server responds with a HTTP status code 404 if there is no update available, and with an XML file if there is one:

<?xml version="1.0" encoding="UTF-8" ?>
<updates>
  <software customisation="ir-mmi-FS2026-0500-0052"
            version="2.11.12.EX65933-4RC2">
    <copyright>Copyright 2016 Frontier Silicon Ltd</copyright>
    <download>http://update.wifiradiofrontier.com/Update.aspx?c=ir-mmi-FS2026-0500-0052&amp;m=1122334455&amp;v=2.6.17.EX53300-2RC3&amp;t=Cust-File&amp;n=2.11.12.EX65933-4RC2&amp;f=/updates/ir-mmi-FS2026-0500-0052.2.11.12.EX65933-4RC2.isu.bin</download>
    <mandatory>false</mandatory>
    <md5>0d514a1238c5b3aaf19d4ed1e6736a52</md5>
    <product>Internet Radio</product>
    <size>2259478</size>
    <summary>MP Candidate</summary>
    <vendor>Frontier Silicon</vendor>
  </software>
</updates>

The download URL leads directly to the firmware file. The URL used to fetch the XML above was:

http://update.wifiradiofrontier.com/FindUpdate.aspx?mac=1122334455&customisation=ir-mmi-FS2026-0500-0052&version=2.6.17.EX53300-2RC3

Downloading firmware​

It turned out that the download URL does not need the c, m, v, t and n GET parameters - the only relevant one is f that specifies the file to download.

The Internet Radio Forum has a post with known firmware version numbers written by Dogmatix, which proved to be very useful.

I found that the firmware versions need to be adjusted a bit to be downloaded: Replace _V with a dot .:

- ir-mmi-FS2026-0500-0286_V2.11.12.EX65933-1A22
+ ir-mmi-FS2026-0500-0286.2.11.12.EX65933-1A22

Now it was possible to download most of the firmware files from Frontier Silicon's servers. The files can be found in github.com/cweiske/frontier-silicon-firmwares , in case you want to analyze yourself.