Phoenix loaders and firmwares header format

[Hexxx]

Has anyone already reversed the firmwares' and loaders' header?
The only thing that i could understand from Dct4Crypter code, that there:
1) a signature 0xA0 (1 Byte)
2) length of the header (4 Bytes) Big Endian.
3) some unknown data (2 Bytes)
4) Loader name length (1 Byte)
5) Loader Name (Length is in 4) )
6) Again unknown data

There must be also a size of the firmware/loader. I'm writing a dumper ram-loader for DCTL models. My loader works, but to test it i have to take the original loader, find the of the header, and then overwrite the original code by my own.

[krisha]

go to www.g3gg0.de and scroll down a little bit ;)

[Hexxx]

Looks cool, but it doesn't match the header that i have.

0xA0 - Preloader Signature.
0x00, 0x00, 0x00, 0x13 - Header Length
0x00, 0x00, 0x00, 0x03 - Fields count

Field 1):
0xC2, 0x05, 0x44, 0x43, 0x54, 0x4C, 0x00 //"DCTL"
Field 2):
0xDB, 0x03, 0x01, 0x10, 0x00
Field 3):
0xC0, 0x01, 0x01

According to g3gg0 C2 - is a secondary_id, but in my case this should be algorithm_id. Fields 0xDB and 0xC0 are not described at all :(

[krisha]

take also a look to page 2, 4th post of his bloq.

i think he has the names from some flashfiles maybe :) ?¿

[Hexxx]

I've already saw that. Fields 0xDB and 0xC0 remain unknown... :-\