The saga continues .... (also check out UniPwn: https://github.com/Bin4ry/UniPwn)
A Python tool for decrypting and encrypting Unitree UPK firmware update files
UniTEABag is a utility designed to work with Unitree robot firmware UPK files. It can decrypt existing UPK packages to extract their contents, as well as create new UPK files from tar archives or folders.
Unitree chose to implement and of firmware update file format, called UPK.
UPK files contain:
- Header (UTPK)
- Package metadata
- Encrypted payload with TEA encryption
- MD5 signature
- payload
Structure is like follows:
hdr = data[0:0+4]
isPackage = data[5]
time = data[8:8+8]
size = data[16:16+8]
utfiletype = data[24]
seed = data[28:28+4]
sign1 = data[32:32+8]
sign2 = data[40:40+8]
(md5 = sign1 + sign2)
pkg_name = data[48:48+64]
payload = data[112:]
payload_hdr = payload[0:0+4]
payload_data = payload[4:]
The tool uses TEA (Tiny Encryption Algorithm) with custom key generation:
- Key derivation using seed values and constants
- Two encryption versions are supported, depending on robot model generation
The Unitree implementation uses several magic constants, hardcoded into the ota binary:
UT_CODEKEY_CONST1 = 0x6e35ba0cUT_CODEKEY_CONST2_VERSION1 = 0x65748392UT_CODEKEY_CONST2_VERSION2 = 0x9a8b7c6e
TEA is used to encrypt/decrypt the data, the key for the TEA is generated by a seed, this seed is then ssved into the UPK package. A Key can then be derived with this seed and the hardcoded constants.
The 'CODEKEY' constant and the KDF are different for different generations of robots.
With the help of this constants, the seed and on of the KDF functions a key is generated.
The constants are hardcoded in the ota binary of the robot, as TEA is a symmetric algo we can not only decrypt and decompress but also:
encrypt our very own valid Unitree firmware packages.
The robot is not able to determine if the firmware was created by Unitree or by ourselves.
- Decrypt UPK files: Extract contents of encrypted Unitree firmware packages
- Encrypt UPK files: Create new UPK packages from folders or tar archives
- Deep processing: Process nested UPK files at once
- Key version support: Handles both encryption key versions used in Unitree firmware
https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.0.20.0-1697620155759.upk https://unitree-firmware.oss-accelerate.aliyuncs.com/firmware/release/package_1.0.21.9-1700230258299.upk
https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.2.21_GO2_Edu_Max_Pro_1730188258661.upk https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.7.2_GO2_Edu_1747828185797.upk https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.8.999_GO2_Air_1759213812822.upk https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.9.102_GO2_Edu_Max_Pro_X_1760083457690.upk https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk
https://firmware-cdn.unitree.com/firmware/package_1.2.0.15_G1_Air_Edu_Pre-Edu_1732786334697-1732786575247.upk https://firmware-cdn.unitree.com/firmware/release/package_1.3.0.11_G1_Air_Edu_Pre-Edu_1736157715212.upk
https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.4.4.0_G1_Edu%2B_1759136091462.upk https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.4.5.0_G1_Edu%2B_1759976671033.upk
https://firmware-cdn.unitree.com/firmware/g1@motor_module_c_1.0.0.6-1729775070488.upk
While this tool can build valid Unitree Firmware UPK files it does not offer a way to server them to the robot. Unitree send the firmware links to the robots via mqtt.
There is currently no public way to deliver a self-crafted firmware package to the robot.
A prior misconfiguration of mqtt ACL which would have allowed for easy firmware devliery is fixed by now. Other Unitree bugs are kept private for now. This tool should however enable more people to conduct security research of this robots by allowing access to the decrypted firmware packages.
Enjoy Teabagging Unitree with this tool :)
This tool is for educational and research purposes only. Use responsibly and ensure you have proper authorization to work with firmware files. Due to previous frustations in the responsible disclosure process with Unitree this vulnerability was released without informing the manufacturer. The manufacturer showed in previous conversations that they have no interest in talking to me by removing me from the email chain several times.
Created by Bin4ry greetings to h0stile, todb, AHA!, Darknavy, theroboverse and all friends