bose-qc45-firmware

KO | EN

gitlite — search

#python #hacktoberfest #llm #golang #android #machine-learning #rust #deep-learning #macos #nodejs #java #awesome-list #security #ios

bose-qc45-firmware

(★ 25)

No description available.

bose-qc45-firmware Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## Disclaimer
- !! After confirmation, although downgrade the firmware, the issue is not fixed !!
- Downgrading is not an officially supported action from Bose
- By following this manual, you need to take all responsibilities for bricking your own device.
- Currently this method is only tested on Windows

## TL;DR
There are 2 parts need to be executed:
- Part 1: Enable `Update Now` action on `btu.bose.com`
- Part 2: Override firmware file and update

### Part 1: Enable `Update Now` action
- Run `Bose Updater` then go to `btu.bose.com` , continue procedure till Update page
- Open console ( By right click -> Inspect -> choose `console` tab )
- Run below scripts
```js
// Enable `Advanced Mode` without pressing button
window.dispatchEvent(new Event('advancedmode_triggered'))

// Append the option to version dropdown list
document.getElementById('smartdevice_targetfirmware').appendChild(new Option('4.0.4-4360+de6a887', '4.0.4-4360+de6a887'));
```
## Part 2: Override firmware and update
- Download desired firmware from this repository
- Setup python-venv as you might want, and install dependencies
```bash
pip3 install -r requirements.txt
```

- Run script to detect the firmware file name downloaded by `Bose Updater` and overwrite it with our specified file in endless loop. If the firmware path is not specified in the command line arg, then `firmware/duran_encrypted_prod_1.0.3-ee3f55e.bin` is used by default (from current working dir)

```bash
py ./main.py firmware/duran_encrypted_prod_1.0.3-ee3f55e.bin
```
- After script is started, go to website and press `Update Now`
- Update procedure will be carried on, and finally at 99%, status will be `Failed` with a warning shown (Don't panic! It's expected behavior)
- After that, stop the script using `Ctrl + C`. It will not work again for a second time if not relaunched
- <i>You're done. The downgrading process is completed.</i>
- Don't forget to uninstall `Bose Music` app from mobile device, or the firmware will be updated back automatically

## Background story
### 1. Why downgrading
- Bose has a long history of breaking their products by the firmware that they claimed "We've tested carefully by experts before rolling out to users".
- The current popular error with firmware ver `4.0.4-4360+de6a887` is
  - Power-on is inconsistent
  - Cannot play music via bluetooth
- There are various posts reporting this issue, but Bose never officially acknowledge.
https://www.reddit.com/r/bose/comments/1bkpbzj/update_messed_up_my_qc_45/
https://www.reddit.com/r/bose/comments/1bpkk68/no_sound_from_qc45_after_update/
https://www.reddit.com/r/bose/comments/1ccar8r/qc_45_stopped_working_after_software_update/
https://www.reddit.com/r/bose/comments/1c1zp69/qc45_no_sound/

### 2. Why need this manual
- There are some other great works from communitiy for variety of Bose devices:
https://github.com/bosefirmware/ced
https://github.com/bosefirmware/bose-dfu
- `bose-dfu` tool only gives support for devices whose firmware is in `dfu/xvu` format.
- Unfortunatelly, Bose NC700 and Bose QC45 is not one of them, they consume `bin` firmware.
- Moreover, with recent latest updates of `btu` website and `Bose Updater` application, the most popular method (cheating `Bose Updater` to fetch older firmware versions) is not working anymore.
- So the only possible method is to let `Bose Updater` download what it's allowed to download (latest firmware), then override firmware file with older firmware before `Bose Updater` trying to transfer firmware to device.
```
# Failed result when trying to pass older version instead of latest one to BoseUpdater
6/28/2024 19:39:53.729,  Info,       Device version is 4.0.4.4360+de6a887
6/28/2024 19:39:53.729,  Info,       Device original version is 4.0.4-4360+de6a887
6/28/2024 19:40:08.245,  Info,       Update: Waiting for extended challenge -> Idle
6/28/2024 19:45:23.169,  Info,       Beginning update to version 3.5.0-3809+623f836
6/28/2024 19:45:23.213,  Info,       Update: Idle -> Downloading firmware
6/28/2024 19:45:24.219,  Info,       DOWNLOADING_FIRMWARE - DONE
6/28/2024 19:45:24.219,  Info,       Reset Update
6/28/2024 19:45:25.277,  Info,       Update: Downloading firmware -> Get device state
6/28/2024 19:45:26.295,  Info,       Update: Get device state -> Synchronize get
6/28/2024 19:45:27.317,  Info,       Update: Synchronize get -> Init start
6/28/2024 19:45:28.308,  Error,      Exception caught:
6/28/2024 19:45:28.308,  Error,      Dumping crash to C:\Users\zmp\AppData\Local\Temp\BoseUpdater_20240628_194528.dmp
```

### 3. Steps

#### Firmware download
- Base on the latest firmware information, and previous firmware versions on the internet, I was able to download version `4.0.4` and `3.5.0`
```
<INDEX REVISION="01.00.00">
    <DEVICE ID="0x4039" PRODUCTNAME="Quietcomfort 45" USE_CLOUD="3">
        <HARDWARE REVISION="01.00.00">
            <RELEASE HTTPHOST="downloads.bose.com" LANGUAGES="en-us,es-mx,de,it,fr,zh-cn,nl,ja,pt-br,ru,pl" REVISION="4.0.4-4360+de6a887" URLPATH="/ced/duran/">
                <IMAGE CRC="0xBC4BFF13" FILENAME="duran_encrypted_prod_4.0.4-de6a887.bin" LENGTH="6075980" NOFORCE="1" REVISION="4.0.4-4360+de6a887" SUBID="0"/>
            </RELEASE>
        </HARDWARE>
    </DEVICE>
</INDEX>
```
- Production Code of Bose QC45 is `duran`
- The link to download firmware will have this format `https://downloads.bose.com/ced/duran/duran_encrypted_prod_<version>-<commit hash>.bin`
- If you guys can help me download older firmwares, please create PR

#### Modify Bose btu website
If your Bose QC45 is on latest firmware already, Bose doesn't even allow you to select the latest version
This is written in their website source code
```
n.device.getAvailableVersions(function(e, t) {
    for (var r = device_targetfirmware.options.length, i = r - 1; i >= 0; i--)
        device_targetfirmware.remove(i);
    t.reverse();
}
```
- Not being able to select version to update, means update action can't be done.
- Hence, we need at least 1 option, which is the latest version of firmware.
- Be notice that, if there is newer firmware version than 4.0.4, then `4.0.4-4360+de6a887` in `Option` html tag needs to be replaced with name of newer firmware version.

#### Python script
- Everytime `Bose Updater` downloads a firmware, it will rename firmware `bin` file to `Bose Updater.<nanoid>` , and save it to `C:\Users\<username>\AppData\Local\Temp`
- I've confirmed by checking hex content, basically `Bose Updater.<nanoid>` is a renamed version without any modification applied
- `Bose Updater` will follow these steps
  - Download firmware
  - Boot device to flash mode
  - Transfer firmware to device
```
# Logs located at C:\Users\<username>\AppData\Local\Temp\BoseUpdater.log
6/28/2024 13:16:13.988,  Info,       Device version is 4.0.4.4360+de6a887
6/28/2024 13:16:28.017,  Info,       Device original version is 4.0.4-4360+de6a887  # Current version = 4.0.4
6/29/2024 13:16:48.869,  Info,       Update: Waiting for extended challenge -> Idle
6/29/2024 13:17:00.261,  Info,       Beginning update to version 4.0.4-4360+de6a887
6/29/2024 13:17:00.308,  Info,       Update: Idle -> Downloading firmware
6/29/2024 13:17:03.189,  Info,       Done downloading (result 0) (time 2)
6/29/2024 13:17:03.366,  Info,       DOWNLOADING_FIRMWARE - DONE                    # File will be overwritten automatically by main.py
6/29/2024 13:17:03.366,  Info,       Reset Update
6/29/2024 13:17:08.384,  Info,       Update: Downloading firmware -> Waiting for firmware update reset completion response
6/29/2024 13:17:12.386,  Info,       Update: Waiting for firmware update reset completion response -> Get device state
6/29/2024 13:17:13.398,  Info,       Update: Get device state -> Synchronize get
6/29/2024 13:17:14.416,  Info,       Update: Synchronize get -> Init start
6/29/2024 13:17:15.443,  Info,       Update: Init start -> Get device state
6/29/2024 13:17:16.471,  Info,       Downloading firmware to the device...
6/29/2024 13:17:16.471,  Info,       Update: Get device state -> Data transfer
6/29/2024 13:17:16.474,  Info,       Transferring firmware to device...
6/29/2024 13:22:10.730,  Info,       Update: Data transfer -> Empty data transfer
6/29/2024 13:22:11.767,  Info,       Update: Empty data transfer -> Validate
6/29/2024 13:22:12.811,  Info,       Update: Validate -> Waiting for validation confirmation
6/29/2024 13:22:13.816,  Info,       Update: Waiting for validation confirmation -> Run DFU
6/29/2024 13:22:14.864,  Info,       Update: Run DFU -> Waiting for reset
6/29/2024 13:22:15.638,  Info,       Update: Waiting for reset -> Waiting for reset completion.
6/29/2024 13:22:19.039,  Info,       Update: Waiting for reset completion. -> Waiting for final confirmation.
6/29/2024 13:22:20.036,  Info,       Update: Waiting for final confirmation. -> Waiting for device components
6/29/2024 13:22:35.374,  Error,      Expecting version to be 4.0.4, read 3.5.0
> 6/29/2024 13:22:35.374,  Info,       Update failed                                  # here it's failed because BoseUpdater expects 4.0.4 instead of 3.5.0
6/29/2024 13:22:35.374,  Info,       Update: Waiting for device components -> Error state
6/29/2024 13:22:45.718,  Info,       Device version is 3.5.0.3809+623f836
6/29/2024 13:22:45.718,  Info,       Device original version is 3.5.0-3809+623f836  # Device is now downgraded to 3.5.0
6/29/2024 13:22:59.476,  Info,       Update: Waiting for extended challenge -> Idle
```
- So, the idea is to replace firmware file with desired firmware after file is completely downloaded, and before it's transferred to device.
- Python script would do:
  - Detect if new firmware file is downloaded
  - Wait until it's fully downloaded, override with desired firmware

*To be honest, I tried several methods to detect if firmware is completely downloaded, but it's hard to know, so from experience, I set delay time to 3.5s from when the file is originally created.*

#### Why update is failed
- The final step `Bose Updater` does after updating is to compare the original version `dtu.bose.com` sent to it, with device's current version
- Since those versions are different (we sent the latest version to it), result of updating will be failed
- But after you click `Try Again` on warning popup, new page will show and tell you that `There's an update available for your product!`, which means your device is running on older firmware
```
6/29/2024 13:22:35.374,  Error,      Expecting version to be 4.0.4, read 3.5.0
6/29/2024 13:22:35.374,  Info,       Update failed                                  # here it's failed because BoseUpdater expects 4.0.4 instead of 3.5.0
```

### Some notes
- I'm not an expert in reverse-engineering and embeded-engineering, so I can't write a tool like `bose-dfu`
- However the good thing is we still use default `Bose Updater`, which avoids risks when transferring firmware to device
- If you like my work, you can by me a coffee

### Useful resources
- Thanks @bosefirmware (https://github.com/bosefirmware) to give me hope and ideas about downgrading firmware.
- Thanks @sunzj and his great manual (https://github.com/sunzj/Way_of_Downgrade_BOSE_QC35ii) that gave me idea about overriding firmware file.

bose-qc45-firmware

bose-qc45-firmware Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

bose-qc45-firmware

bose-qc45-firmware Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README