Encrypted Hilink Uimage Firmware Header Direct

1. Introduction Huawei’s HiLink protocol powers millions of routers, LTE dongles, and IoT gateways. While standard U-Boot images (UImages) use a well-documented header structure ( struct image_header ), recent HiLink firmware variants employ an encrypted header layer —a deliberate obfuscation to prevent third-party firmware modifications, analysis, and repacking.

Example decrypted header (hexdump):

Check for HiLink markers:

strings u-boot.bin | grep -i "aes" Look for key arrays in rodata section.

cipher = AES.new(key, AES.MODE_CBC, iv) dec_header = cipher.decrypt(enc_header) encrypted hilink uimage firmware header

magic = struct.unpack(">I", dec_header[0:4])[0] if magic == 0x27051956: print("Decryption successful") with open("dec_header.bin", "wb") as out: out.write(dec_header) The encrypted HiLink UImage header is a modest but effective speed bump against casual analysis. For a determined reverse engineer, it adds a few hours of work—identifying the key source, decrypting, and repacking. However, modern per-device keys and additional signature checks make widespread third-party firmware creation impractical.

If you’ve ever run binwalk on a HiLink firmware update (e.g., from an E3372, B310, or AR series router) and seen only high entropy data with no recognizable UImage magic ( 0x27051956 ), you’ve likely encountered this encrypted header. from an E3372

# Extract first 64+ bytes of encrypted header (adjust count) dd if=firmware.bin of=enc_header.bin bs=1 count=4096 openssl enc -aes-128-cbc -d -K $KEY -iv $IV -in enc_header.bin -out dec_header.bin Verify magic hexdump -C dec_header.bin | head -1 Should see 56 19 05 27

This article explains what it is, how it works, and practical methods to decrypt and analyze it. A normal, unencrypted UImage header (64 bytes) looks like this: how it works