philips-tv-speicher-voll/patches/phase7/PHILIPS-UPDATE-FORMAT.md

Phase 7E – Philips update format

Local artifact search

No official Philips/TPVision firmware package, payload.bin, system image or .upg was found in the workspace. The only ZIPs are diagnostic/Codex bundles and a bugreport attachment. Therefore no vendor package was reverse-engineered or reconstructed, and no third-party image was used.

Format accepted by the installed Settings path

The current TPM191E_R Settings DEX proves a ZIP-compatible .upg outer container with at least:

autorun*.upg                    (ZIP opened with java.util.zip.ZipFile)
├─ payload.bin                  (A/B OTA payload)
├─ payload_properties.txt       (hash/size/signature properties for UpdateEngine)
└─ META-INF/updateinfo/upg.xml  (TPVision product/version metadata)

UpdateParser.parse(File) locates the payload entry and calculates its URL, byte offset and compressed size. UpdateUtils.installUpdate passes those plus the property lines to UpdateEngine.applyPayload. This is consistent with an Android A/B payload embedded in a vendor wrapper.

upg.xml parsing references these tags:

• productid
• softwareversion
• buildid, buildtype
• dateofthebuild, timeofthebuild
• tagofsource, typeofupg, creator, description
• sourceswver

The USB scanner filters the filename with [aA]utorun.*.upg and compares product/version data against ro.odm.tpv.product.id=TPM191E_R and ro.odm.tpvision.product.swver.

Verification boundary

Confirmed:

• UpdateEngine receives payload_properties.txt and the binary payload.
• Locked/green verified boot protects booting the resulting slot.
• Device-side OTA and APK signing use different certificates.

Unknown until an official package is available:

• outer ZIP comment/JAR signature/custom signature or checksum;
• payload manifest contents, partition list and payload signing certificate;
• whether full and incremental packages differ in additional entries;
• precise anti-rollback/source-version enforcement;
• AVB public keys/descriptors shipped inside the package;
• vendor container padding/alignment and any post-payload footer.

Absence of RecoverySystem.verifyPackage in the inspected Settings code must not be interpreted as permission to omit signatures. UpdateEngine performs its own payload verification and the final images must pass AVB.

Official file required for completion

Obtain directly from Philips/TPVision an unmodified full USB recovery/update file named autorun*.upg for 43PUS7394/12, platform TPM191E_R, preferably the exact current TPM191E_R.211.000.103.000 or a newer explicitly compatible release. A full recovery image is preferable to an incremental OTA because it allows offline structure comparison and independent restoration. Record the vendor URL and SHA-256 before analysis.

No reconstructed container should be offered to the television without the OEM payload/AVB signatures and a proven recovery path.