HPE LTO Firmware Parser and Reconstruction Tool

A Python tool for parsing, extracting, and reconstructing HPE LTO tape drive firmware files.

Features

• Parse firmware structure and extract metadata
• Extract all components including:
  • Device Tree Blobs (DTBs)
  • Linux kernel (PowerPC ELF)
  • Root filesystem (CPIO archive)
  • Compressed data sections
• Reconstruct firmware bit-for-bit from extracted parts
• Validate firmware integrity with checksums
• Generate comprehensive documentation in JSON and Markdown

Installation

pip install -e .

Usage

Show Firmware Information

firmware-tool info LTO_30750_SAS_S2T1_MSL.frm

Parse Firmware

Parse firmware and generate a JSON structure map:

firmware-tool parse LTO_30750_SAS_S2T1_MSL.frm

Extract All Components

Extract all firmware components to a directory:

firmware-tool extract LTO_30750_SAS_S2T1_MSL.frm -o extracted/

This creates:

extracted/
├── firmware.json          # Complete structure map
├── firmware.md            # Human-readable documentation
├── regions/               # All firmware regions as binary files
│   ├── 00_header.bin
│   ├── 01_section_table_1.bin
│   ├── ...
├── decompressed/          # Decompressed components
│   ├── kernel.elf
│   ├── rootfs.cpio
│   ├── rootfs_files/      # Extracted filesystem (274 files)
│   └── ...
└── metadata/
    ├── regions.csv
    ├── checksums.txt
    └── signature.bin

Reconstruct Firmware

Rebuild firmware from extracted parts:

firmware-tool reconstruct extracted/ -o reconstructed.frm

Verify against original:

firmware-tool reconstruct extracted/ -o reconstructed.frm --verify LTO_30750_SAS_S2T1_MSL.frm

Firmware Structure

Header (0x000 - 0x440)

• Magic: de ad be ef
• Version string
• Device identification (HPE Ultrium 8-SCSI)
• Firmware version (S2T1)

Section Tables

Two section tables describe memory layout:

• Table 1 at 0x440: Primary sections
• Table 2 at 0x636690: Additional sections

Sections include: fcod, text, roda, vmal, vmli, ramf, pcod, data, kmem, bss, stac, ocmd

Components

1. DTB #1 (0x3E88) - Device Tree Blob, 3,541 bytes
2. DTB #2 (0x13950) - Device Tree Blob, 2,301 bytes
3. Kernel (0x14440) - gzip compressed PowerPC ELF, ~1.6 MB compressed, ~3.6 MB uncompressed
4. Rootfs (0x1A3998) - XZ compressed CPIO archive, 274 files, ~4.8 MB compressed, ~14 MB uncompressed
5. LZMA data (0x6367E7) - LZMA compressed, 512 bytes uncompressed

Architecture

hpe_lto_firmware/
├── core/
│   ├── parser.py          # Firmware structure parser
│   ├── extractor.py       # Component extraction
│   ├── reconstructor.py   # Firmware reconstruction
│   └── validator.py       # Integrity validation
├── models/
│   ├── firmware.py        # FirmwareMap data model
│   ├── header.py          # Header structures
│   ├── section_table.py   # Section table structures
│   └── component.py       # Region and component models
├── utils/
│   ├── binary.py          # Binary parsing utilities
│   └── hashing.py         # Checksum calculation
└── cli.py                 # Command-line interface

Verification

The tool ensures bit-for-bit accurate reconstruction:

# Extract
firmware-tool extract LTO_30750_SAS_S2T1_MSL.frm -o extracted/

# Reconstruct
firmware-tool reconstruct extracted/ -o reconstructed.frm --verify LTO_30750_SAS_S2T1_MSL.frm

# Manual verification
sha256sum LTO_30750_SAS_S2T1_MSL.frm reconstructed.frm
diff LTO_30750_SAS_S2T1_MSL.frm reconstructed.frm  # Should be identical

License

MIT License