How the MS450H downloads new firmware

Hello,
here is what I have found listening to the communication my player had with the LG server:

The player asks for a new version by connecting to server aswnus.lge.com port 80 (i.e. standard http connection) with the following request:

Code:

POST /servlet/CheckFEInfoCmd.fec HTTP/1.0
User-Agent: Wget/1.11.4
Accept: */*
Host: aswnus.lge.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 365

PFJFUVVFU1Q+CjxQUk9EVUNUX0lEPlAwMDc8L1BST0RVQ1RfSUQ+CjxNT0RFTF9OTT5NUzQwMEQ8
L01PREVMX05NPgo8RldfVFlQRT5NYWluPC9GV19UWVBFPgo8SU1BR0VfUkVWPjwvSU1BR0VfUkVW
Pgo8SU1BR0VfVkVSPjA5MDcyOEE8L0lNQUdFX1ZFUj4KPEtFUk5FTF9WRVI+PC9LRVJORUxfVkVS
Pgo8Uk9PVEZTX1ZFUj48L1JPT1RGU19WRVI+CjxERVZJQ0VfSUQ+MDwvREVWSUNFX0lEPgo8SUdO
T1JFX0RJU0FCTEU+TjwvSUdOT1JFX0RJU0FCTEU+CjwvUkVRVUVTVD4K

The unencoded request body is:

Code:

<REQUEST>
<PRODUCT_ID>P007</PRODUCT_ID>
<MODEL_NM>MS400D</MODEL_NM>
<FW_TYPE>Main</FW_TYPE>
<IMAGE_REV></IMAGE_REV>
<IMAGE_VER>090728A</IMAGE_VER>
<KERNEL_VER></KERNEL_VER>
<ROOTFS_VER></ROOTFS_VER>
<DEVICE_ID>0</DEVICE_ID>
<IGNORE_DISABLE>N</IGNORE_DISABLE>
</REQUEST>

Notes:
1. The Content-Length is calculated based on the encoded body length
2. The body is sent base64 encoded
3. The IMAGE_VER data is the current firmware version of the player
4. My player is the MS450H, which is internally marked as MS400D as can be seen from the request. I cannot tell whether it is the same for LG MS400H (and the product ID too), this would have to be confirmed by a MS400H owner who would do the same as me.

The answer from the server is:

Code:

HTTP/1.1 200 OK
Server: Sun-ONE-Web-Server/6.1
Date: Mon, 28 Dec 2009 14:23:33 GMT
Content-length: 584
Content-type: text/html;charset=UTF-8
Connection: close

PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48UkVTUE9OU0U+PFJFUV9JRD4w
MDAwMDAwMDAwMDAyMjExMTQ0NDwvUkVRX0lEPjxSRVNVTFRfQ0Q+OTAwPC9SRVNVTFRfQ0Q+PE1T
Rz5TdWNjZXNzPC9NU0c+PElNQUdFX1VSTD5odHRwOi8vYXN3bnVzLmxnZS5jb20vc2VydmxldC9E
b3dubG9hZEltYWdlQ21kLmlkbjwvSU1BR0VfVVJMPjxVUERBVEVfQ05UPjE8L1VQREFURV9DTlQ+
PElNQUdFX1NJWkU+MTgxNTU1MzY8L0lNQUdFX1NJWkU+PElNQUdFX0RJUj4vZGF0YTQvYXN3bnVz
L2FwcGxpY2F0aW9ucy9HQlBTL0dCUFNfRU5WL3VwbG9hZC9zd251LzIwMDkxMjwvSU1BR0VfRElS
PjxJTUFHRV9OQU1FPjIwMDkxMjEwMDE0MjM5MzY1LmltZzwvSU1BR0VfTkFNRT48SU1BR0VfVkVS
PjA5MTIwOUM8L0lNQUdFX1ZFUj48L1JFU1BPTlNFPg==

The unencoded body is:

Code:

<?xml version="1.0" encoding="utf-8"?><RESPONSE><REQ_ID>00000000000022111444</REQ_ID><RESULT_CD>900</RESULT_CD><MSG>Success</MSG><IMAGE_URL>http://aswnus.lge.com/servlet/DownloadImageCmd.idn</IMAGE_URL><UPDATE_CNT>1</UPDATE_CNT><IMAGE_SIZE>18155536</IMAGE_SIZE><IMAGE_DIR>/data4/aswnus/applications/GBPS/GBPS_ENV/upload/swnu/200912</IMAGE_DIR><IMAGE_NAME>20091210014239365.img</IMAGE_NAME><IMAGE_VER>091209C</IMAGE_VER></RESPONSE>

Notes:
1. The Content-Length (in the header) is calculated based on the encoded request length
2. The body is sent base64 encoded
3. The body does not have any line ends (but that is no error, just "it is so")

Based on this answer, the player asks for the firmware by issuing the following request (after the user agrees to download the new firmware), again from aswnus.lge.com, port 80:
HEADER:

Code:

POST /servlet/DownloadImageCmd.idn HTTP/1.0
User-Agent: Wget/1.11.4
Accept: */*
Host: aswnus.lge.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 369

BODY (unencoded):

Code:

<REQUEST>
<PRODUCT_ID>P007</PRODUCT_ID>
<REQ_ID>00000000000022111444</REQ_ID>
<MODEL_NM>MS400D</MODEL_NM>
<FW_TYPE>Main</FW_TYPE>
<IMAGE_DIR>/data4/aswnus/applications/GBPS/GBPS_ENV/upload/swnu/200912</IMAGE_DIR>
<IMAGE_NAME>20091210014239365.img</IMAGE_NAME>
</REQUEST>

Again, the body is base64 encoded (I send it in plain text for convenience) and the Content-Length is calculated based on that.

The answer from the server is:

Code:

HTTP/1.1 200 OK
Server: Sun-ONE-Web-Server/6.1
Date: Mon, 28 Dec 2009 14:27:33 GMT
Content-length: 18155536
Content-type: application/octect-stream; charset=ISO-8859-1
Pragma: no-cache;
Expires: -1;
Content-Disposition: attachment;filename=20091210014239365.img;
Content-Transfer-Encoding: binary;
Connection: close

(now comes the firmware image in binary)

So, anyone can test whether new firmware is available, and download it even without the player ...

With best regards,

DavidO

PS Thanks for this great forum! I hope you don't mind using English (use google automatic translation if needed - I do it here because I don't speak French)

Hi,

Thanks for this useful information.

Hope that someone could use it to download firmware without LG

Seb@stien