Recipe File Format

Recipe files are found in firmware of the C1 modem under rcpi tag inside a FTAB file.

These contain a list of hashes of some firmware components (similarly to Image 4 manifest files) and something that resembles instructions on how to combine them when flashing the modem.

Structure

The files start with a 54 byte header followed by tagged entries. The header structure is as follows (all integers are little-endian):

u32    unknown;          // = 0
u8[10] version_string;   // "0.01"
u8[40] filename_string;  // "Sinope_HWID_v592.csv"

Both version_string and filename_string are padded with zeroes to their sizes.

Next follows a list of tagged entries. Each entry starts with the following header:

u32 type;
u32 count;

The size of the following entry data and the interpretation of the count field depend on the entry kind.

The following entry types are currently known (names are arbitrary until the purpose of entries is understood better):

1. Hashes entry
2. Lists entry
3. Mappings entry
4. Tuples entry

Hashes entry

Hashes entry has entry type 1. It's a list of 4CC tags and corresponding SHA-384 hashes. 4CC tags mostly correspond to entries in the same FTAB file that contains the recipe, but some may be missing. Body of a hashes entry contains count times the following structure:

u8[4]  tag;        // 4CC tag (e.g. 'l1c2')
u8[48] digest[48]; // SHA-384 digest

Lists entry

Lists entry has entry type 2. It's a list of following structures:

u32 unknown0;
u32 unknown1; // = 0
u32 length;
u8[length] tags_list;

unknown0 is clearly an identifier for some configuration, tags_list is a string containing 7 concatenated 4CC tags corresponding to images in the FTAB file.

An example of a dumped lists entry (commas added for readability):

0x00 0x00 CAR2,ARC1,GNS1,R104,R204,RP03,CR03
0x1f 0x00 CAR2,ARC2,GNS1,R112,R203,RP11,CR11
0x26 0x00 CAR2,ARC2,GNS1,R118,R203,RP17,CR17
0x30 0x00 CAR3,ARC2,GNS1,R125,R203,RP24,CR24
0x2c 0x00 CAR3,ARC2,GNS1,R123,R203,RP22,CR22
0x3c 0x00 CAR3,ARC2,GNS1,R129,R203,RP28,CR28
0x3d 0x00 CAR3,ARC2,GNS1,R130,R203,RP29,CR29
0x41 0x00 CAR3,ARC2,GNS1,R134,R203,RP33,CR33
0x42 0x00 CAR3,ARC2,GNS1,R135,R203,RP34,CR34
0x24 0x00 CAR2,ARC2,GNS1,R112,R203,RP11,CR11
0x25 0x00 CAR2,ARC2,GNS1,R112,R203,RP11,CR11

Mappings entry

Mappings entry has entry type 3. This entry is a two-level table mapping a short string and an integer identifier to a 4CC tag. Each row in the table is structured as follows:

u8[4] key;         // zero-padded string
u32   pairs_count;
struct {
  u32 image_id;    // integer image type ID
  u8[4] tag_4cc;   // image 4CC tag in FTAB
}[pairs_count] pairs;

An example of dumped mapping entries:

0B => {
  0 => rkos
  1 => l1cs
  2 => cdpu
  3 => cdpd
  7 => cdph
}
0C => {
  0 => rkos
  1 => l1cs
  2 => cdpu
  3 => cdpd
  7 => cdph
}

Tuples entry

Tuples entry has entry type 3. This entry maps a 4CC tag of an image in the FTAB file to a 4CC tag that likely identifies the place where the hash of the image lives. The second tag is either IM4M (meaning an Image 4 manifest that is likely attached to the FTAB file) or rcpi meaning that the hash is to be found in a hashes entry inside the recipe file itself.

The structure is as follows:

u8[4] image_tag;
u8[4] digest_location_tag;