Frontier Silicon firmware binaries

A list of internet radio devices using Frontier Smart chipsets, binary firmware files and information about flashing those firmwares.

Blog post: https://cweiske.de/tagebuch/frontier-firmware-dl.htm

Related links

• Firmware Analysis: https://matrixeditor.github.io/fsapi-tools/firmware-analysis.html
• Frontier Smart api + tools: https://github.com/MatrixEditor/fsapi-tools
• Radio API documentation: https://github.com/flammy/fsapi/blob/master/FSAPI.md
• Alternative radio server API implementation: https://github.com/KIMB-technologies/Radio-API

Known radios

Venice 6

• ? arts.ven6-jupiter6.1: Tevion IWR 294 (2009)

Venice 6.2

• FS2026-0200-0048: Roberts Stream 83i
• FS2026-0200-0052: Revival iStream
• FS2026-0200-0059: Muvid IR 615
• FS2026-0200-0097: Hama IR100
• FS2026-0200-0143: Noxon iRadio 300
• FS2026-0200-0201: Block CVR100
• FS2026-0200-0233: Sansui WLD700L mini-hifi
• FS2026-0200-0273: Peaq PDR300
• FS2026-0200-0328: Sangean DDR-62
• FS2026-0200-0329: Lenco IR-2002

Venice 6.5

• FS2026-0500-0015: Pinell Supersound II
• FS2026-0500-0020: Renkforce IR-1600
• FS2026-0500-0027: Medion Life P85023 (MD 86891)
• FS2026-0500-0034: TechniSat DigitRadio 450
• FS2026-0500-0037: Roberts iStream Revival 2
• FS2026-0500-0039: Revo Super Connect
• FS2026-0500-0041: Roberts Stream 93i
• FS2026-0500-0047: Medion Life E85006 (MD 86185)
• FS2026-0500-0050: Medion Life P85040 (MD 86988)
• FS2026-0500-0052: Technisat DigitRadio 580
• FS2026-0500-0058: Soundmaster IR3000DAB
• FS2026-0500-0067: Hama DIR3100
• FS2026-0500-0069: ???
• FS2026-0500-0072: Noxon iRadio 410
• FS2026-0500-0074: Peaq PDR 210
• FS2026-0500-0077: Hama DIR3000 v2
• FS2026-0500-0080: Sangean WFR-28C
• FS2026-0500-0082: Sangean WFR-29C
• FS2026-0500-0084: Hama IR110
• FS2026-0500-0092: Grundig Cosmopolit 4
• FS2026-0500-0094: Ruack R2 Mk3
• FS2026-0500-0095: Dual Radiostation IR 6S
• FS2026-0500-0097: Medion Life P85035
• FS2026-0500-0104: Hama IR320
• FS2026-0500-0106: Silvercrest SIRD 14A2
• FS2026-0500-0115: Hama HiFi Tuner DIT2000
• FS2026-0500-0127: Noxon Nova M
• FS2026-0500-0138: Sangean WFR-28
• FS2026-0500-0142: Medion Life P85044 (MD87180)
• FS2026-0500-0144: Roberts Stream 10
• FS2026-0500-0150: SilverCrest SIRD 14
• FS2026-0500-0162: Revo Pixis RX
• FS2026-0500-0178: Philips AE800
• FS2026-0500-0191: Digitradio 110IR7
• FS2026-0500-0212: Auna Connect 150
• FS2026-0500-0213: Tiny Audio M7+
• FS2026-0500-0214: Denver IR100
• FS2026-0500-0224: Auna KR-200 [2015]
• FS2026-0500-0228: Goodmans Heritage Connect
• FS2026-0500-0234: Peaq PDR350BT
• FS2026-0500-0237: Roberts Stream 104
• FS2026-0500-0240: TechniSat DigitRadio 520
• FS2026-0500-0246: Roberts Radio SB1 Soundbar
• FS2026-0500-0259: Silvercrest SMRS30A1
• FS2026-0500-0260: Silvercrest SMRS35A1
• FS2026-0500-0265: Silvercrest SIRD 14C1
• FS2026-0500-0267: Roberts R100
• FS2026-0500-0277: Medion P85111 (MD 87295) [2015]
• FS2026-0500-0285: Noxon dRadio 110
• FS2026-0500-0286: Technisat DigitRadio 580
• FS2026-0500-0298: Evoke F3
• FS2026-0500-0308: Pure Evoke C-F6
• FS2026-0500-0309: Technisat DigitRadio 600
• FS2026-0500-0310: Hama HiFi Tuner DIT2010
• FS2026-0500-0328: Blaupunkt IRD 30
• FS2026-0500-0364: Roberts RS1
• FS2026-0500-0373: Hama DIR3100
• FS2026-0500-0379: Medion P85105 (MD 87505) [2016]
• FS2026-0500-0388: Silvercrest SIRD 14C2
• FS2026-0500-0407: Hama DIT2000M
• FS2026-0500-0408: Hama DIT1000MBT
• FS2026-0500-0442: Auna Connect CD
• FS2026-0500-0445: Technisat DigitRadio 140
• FS2026-0500-0452: ALDI LIFE IWR 271
• FS2026-0500-0461: NUMAN One 2.1
• FS2026-0500-0477: Medion P85105 (MD 87505)
• FS2026-0500-0485: Silvercrest SMRS30A1
• FS2026-0500-0487: Silvercrest SMRS18A1
• FS2026-0500-0489: Como Audio AMICO
• FS2026-0500-0496: LeMega3+
• FS2026-0500-0499: Albrecht DR 890 CD Internetradio
• FS2026-0500-0517: Silvercrest SIRD 14 C3
• FS2026-0500-0522: Hama DIR3100MS
• FS2026-0500-0528: Hama IR350
• FS2026-0500-0549: Medion MD 87805
• FS2026-0500-0577: Medion MD 87990
• FS2026-0500-0601: Medion P85111 (MD 87295) [2017]
• FS2026-0500-0612: ALDI LIFE IWR 282
• FS2026-0500-0630: Auna Harvard
• FS2026-0500-0631: VR-Radio ZX-1680-675
• FS2026-0500-0643: Ruark Audio MRx
• FS2026-0500-0653: Technisat 120IR
• FS2026-0500-0659: Sonoro STREAM SO-410, Firmware v2.x [2018] (manual)
• FS2026-0500-0723: HAMA DIR3605MSBT
• FS2026-0500-0724: HAMA DIR3505MSCBT [2019]
• FS2026-0500-0710: Medion MD 87805
• FS2026-0500-0770: PEAQ PDR261BT-B [2019]
• FS2026-0500-0772: Technisat DigitRadio 630
• FS2026-0500-0783: Teufel Radio 3sixty [2020?]
• FS2026-0500-0789: Sonoro Stream S0-410 [2020]
• FS2026-0500-0795: Sonoro Prestige
• FS2026-0500-0802: Technisat DigitRadio 631
• FS2026-0500-0805: Medion P85289 (MD 88289)
• FS2026-0500-0841: Kathrein DAB+ 10 tower

Venice 6.6 (?)

• FS2026-0600-0002: Hama IT900MBT [2019] (manual)

FS2027

• FS2027-0000-0358: Philips AE9011/02

FS2028

• FS2028-0000-0016: Revo Axis
• FS2028-0000-0032: ALDI MD 86250
• FS2028-0100-0002: Albrecht DR 333

FS2052

• FS2052-0000-0297: John Lewis Spectrum DAB Radio
• FS2052-0000-0639: Roberts SportsDAB 5

Venice X

• FS2340-0000-0025: Hama DIT2006BT
• FS2340-0000-0061: Blaupunkt Napoli (IRD 400)
• FS2340-0000-0082: KENWOOD CR-ST100S-W [2021]
• FS2340-0000-0087: Grundig DTR7000
• FS2340-0000-0093: Philips TAR8805 [2020]
• FS2340-0000-0106: Hama DIR355BT
• FS2340-0000-0117: Philips TAM8905 [2020]
• FS2340-0000-0127: Medion Life P85003 (MD 85008)
• FS2340-0000-0129: Hama DIR150BT
• FS2340-0000-0134: Philips TAM6805/10
• FS2340-0000-0142: Grundig DSB 980 [2020]
• FS2340-0000-0146: Grundig DTR 6000 X [2020]
• FS2340-0000-0147: Grundig DTR 5000 X (GIR1120) [2020-03]
• FS2340-0000-0158: Karcher DAB 7000i
• FS2340-0000-0170: LeMega IR4
• FS2340-0000-0176: Pinell Supersound 101
• FS2340-0000-0177: Hama DIR3300SBT [2019]
• FS2340-0000-0194: Kenwood M-7000S-B [2021]
• FS2340-0000-0195: Kenwood M-9000S-B
• FS2340-0000-0286: JVC RA-E981B [2021]
• FS2340-0000-0301: Hama DIR3300SBT
• FS2340-0000-0303: Teufel Radio 3sixty [2020, color display]
• FS2340-0000-0329: Sonoro STREAM SO-411, Firmware v4.x [2022] (manual)
• FS2340-0000-0344: Technisat VIOLA 710 CD IR
• FS2340-0000-0358: John Lewis Cello
• FS2340-0000-0373: Medion Life P85444 2.1 (MD89295) [2022]
• FS2340-0000-0374: Medion MD89289 [2022]
• FS2340-0000-0407: Kenwood CR-ST700SCD

FS2415

• FS2415-0000-0374: LeMega PR1
• FS2415-0000-0692: Silvercrest 3W D4

Minuet

• FS5332-0000-0007: JBL Playlist 150
• FS5332-0000-0024: Blaupunkt MR 50 BK
• FS5332-0000-0044: Marshall Woburn MultiRoom [2017]
• FS5332-0000-0082: Blaupunkt MR 100
• FS5332-0000-0093: HK Enchant 1300
• FS5332-0000-0119: Blaupunkt PVA 100
• FS5332-0000-0128: Marshall Stanmore Speaker

Name Parts:

• FS2026: Venice 6 module
  • 0200: Venice 6.2
  • 0500: Venice 6.5 (Product brief)
• FS2027: ?
• FS2028: ?
• FS2052: ?
• FS2340: Venice X module (brochure)
• FS2415: ?
• FS5332: Minuet module (Product brief, copy)

Very old models:

• arts.ven6-jupiter6: Venice 6 module, FS1020G Chorus2 SoC (Product brief)

Initial list of names taken from http://iradioforum.net/forum/index.php?topic=2099.msg18986#msg18986

The Venice modules run a MEOS operating system on a Imagination Technologies META processor.

Flashing the firmware

Firmware preparation: .sap.bin creation

None of the flashing methods described here work with the .isu.bin firmware files from this repository.

The .isu.bin file cannot be used as firmware update - some bytes need to be stripped off the beginning.

FS2026

One user reports that the first bytes up to 0x7B must be removed from the ir-mmi-FS2026-0500-0653.2.11.19.EX70719-1B2.isu.bin to get a valid .sap.bin update file.

The .sap.bin update file thus begins with

05 00 10 00 10 A8 0A 00 00 B0 0A 00 06 02 1F 2B

Another user reported that for a FS2026-0500-0277, the first bytes up to 0xE9 had to be removed.

FS2340

Removing the first bytes up to 0x7B works here, too.

The generated .sap.bin file then begins with ir-cui-FS2340, which in hex is

69 72 2D 63 75 69 2D 46 53 32 33 34 30

Web interface

Some radios (e.g. FS2026-0500-0487) have a firmware upload form on their web interface.

At least the FS2026-0500-0487 wants a firmware file with a .sap.bin instead of a .isu.bin file extension. When renaming the .isu.bin to .sap.bin and uploading it, an error will be shown:

FILE CHECK FAILED

Uploading a prepared .sap.bin file (see above) will probably work.

dfu-util

Some users have reported that connecting the radio to the PC via a special USB-A-to-USB-A male-to-male cable puts the device in the "Device firmware upgrade" mode.

The PC lists the radio as following USB device then:

10a4:b784 Frontier Silicon Test DFU device

dfu-util can then be used to upload the firmware.

DFU mode available on:

• FS2026-0500-0388
• FS2026-0500-0653
• FS2340-0000-0170

DFU mode not available on:

• FS2026-0500-0286

At first, the .isu.bin must be converted to a .sap.bin update file - see above.

Steps to flash new firmware:

1. Radio must show "Waiting for PC wizard"
2. Connect radio to PC via USB
3. Check that the radio is found with dfu-util -l
4. Upload firmware to radio: dfu-util -d 10a4:bf8d -U myfirmware.sap.bin

FS2340: Recover "Waiting for PC wizard" using dfu-util

A user reported success in repairing a non-working radio using dfu-util. The radio was not booting normally and just showed "Waiting for PC wizard".

1. Attach radio via regular USB cable

dfu-util -l
Found DFU: [10a4:c2aa] ver=0000, devnum=1, cfg=1, intf=0, path="0-1", alt=0, name="UNKNOWN", serial="00000001"

2. Load firmware from radio: dfu-util -U radio_firmware.bin
3. Identify radio firmware version by opening radio_firmware.bin in a hex editor. In this case the radio binary started with the string "ir-cui-FS2340-0000-0170_V4.5.7.e518da-1A10.bin"
4. Download firmware from frontier silicon servers based on the instructions in this repository
5. Convert downloaded .isu.bin to a .sap.bin update file - see above section "Firmware preparation". In this case all bytes before the "ir-cui..." string have been removed.
6. Upload firmware to radio: dfu-util -D ir-cui-FS2340-0000-0170_V4.5.7.e518da-1A10.sap.bin

After turning the radio off and on again, it booted correctly.

Chip flashing

A user reports that he downloaded the firmware from his non-working radio by using a "CH341A programmer with soic-8 clip":

You must pull off venice module from the radio. When connecting the clip to flash you can read and flash the AT45D321 memory. It does not need to be desoldered from board, only clip must be connected.

Then he found the same start block in the firmware update file and copied all bytes from there on in the non-working firmware bin that was downloaded from the flash chip.

The "merged" binary was then flashed onto the chip, and the radio worked again.

Firmware information

FS2026 firmware is LZO compressed.

FS2026 updates

Known firmware versions are listed in known-versions.txt.

FS2026 Update check

Example URL:

https://update.wifiradiofrontier.com/FindUpdate.aspx?mac=0022616C4223&customisation=ir-mmi-FS2026-0500-0084&version=2.11.16.EX69632-2A9

Answer:

<?xml version="1.0" encoding="UTF-8" ?>
<updates>
  <software customisation="ir-mmi-FS2026-0500-0084"
            version="2.11.16.EX69632-2A10">
    <copyright>Copyright 2018 Frontier Silicon Ltd</copyright>
    <download>http://update.wifiradiofrontier.com/Update.aspx?c=ir-mmi-FS2026-0500-0084&amp;m=0022616C4223&amp;v=2.11.16.EX69632-2A9&amp;t=Cust-File&amp;n=2.11.16.EX69632-2A10&amp;f=/updates/ir-mmi-FS2026-0500-0084.2.11.16.EX69632-2A10.isu.bin</download>
    <mandatory>false</mandatory>
    <md5>849c5926e51a1e8cc651606f45a6ff3f</md5>
    <product>Internet Radio</product>
    <size>2428339</size>
    <summary>MP Candidate</summary>
    <vendor>Frontier Silicon</vendor>
  </software>
</updates>

FS2026: Download URL

All parameters except f are optional http://update.wifiradiofrontier.com/Update.aspx?f=/updates/ir-mmi-FS2026-0500-0084.2.11.16.EX69632-2A10.isu.bin

FS2026: Update script

Run update.py to automatically check for updates of existing firmware files.

FS2340

It seems that Frontier Silicon changed download URI and firmware format for FS2340 devices.

Another difference is that the firmware is encrypted. After the enco line some unknown binary content is following. Most likely the key to decrypt the firmware is placed inside the device during production.

FS2340: Update check

New update URL:

https://update.wifiradiofrontier.com/sr/FindUpdate.aspx?mac=123&customisation=ir-cui-FS2340-0000-0061&version=V4.2.10.4ad838-1B18

and reply is

<?xml version="1.0" encoding="UTF-8" ?>
<updates>
  <software customisation="ir-cui-FS2340-0000-0061"
            version="V4.5.6.9526d3-2A1">
    <copyright>Copyright 2020 Frontier Silicon Ltd</copyright>
    <download>https://update.wifiradiofrontier.com/sr/Update.aspx?c=ir-cui-FS2340-0000-0061&amp;m=123&amp;v=V4.2.10.4ad838-1B18&amp;t=Cust-Dir&amp;n=V4.5.6.9526d3-2A1&amp;f=/srupdates/ir-cui-FS2340-0000-0061/ir-cui-FS2340-0000-0061_V4.5.6.9526d3-2A1.isu.bin</download>
    <mandatory>false</mandatory>
    <md5>d47c2e61efcef905ec8bb1c258e4fb9a</md5>
    <product>Internet Radio</product>
    <size>3244413</size>
    <summary>Copyright 2007,2008,2009 Frontier Silicon Ltd</summary>
    <vendor>Frontier Silicon</vendor>
  </software>
</updates>

FS2340: Download URL

All parameters except f seem to be optional:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/ir-cui-FS2340-0000-0061/ir-cui-FS2340-0000-0061_V4.5.6.9526d3-2A1.isu.bin

This way its also possible to construct url for devices without actual update, e.g. for the Hama DIT2006BT Radio:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/ir-cui-FS2340-0000-0025/ir-cui-FS2340-0000-0025_V4.5.10.46f70b-1A13.isu.bin

General structure of the download URL:

https://update.wifiradiofrontier.com/sr/Update.aspx?f=/srupdates/<CUSTOMIZATION>/<CUSTOMIZATION>_V<VERSION>.isu.bin

or alternatively:

https://nuv-isu-cdn.azureedge.net/srupdates/srupdates/<CUSTOMIZATION>/<CUSTOMIZATION>_V<VERSION>.isu.bin

FS5332: Download URL

Example:

https://nuv-isu-cdn.azureedge.net/nsupdates/nsupdates/ns-mmi-FS5332-0000-0082/ns-mmi-FS5332-0000-0082_1.7.8-18.ota.bin