Would you send your customer the .bin with the firmware image?

[daqq]

Hi guys,

Yesterday I fixed a device - a 3000 EUR piece of gear that got stuck during a firmware update and got bricked.

It was a simple matter of taking a working one apart (fortunately they had one), removing the memories (I was quite scared, I didn't want to have 2 dead piece of equipment instead of one) and reading out the 2x16MB of serial FLASH on board (they were not protected against reading at all) with a cheap programmer, making a .bin image and burning it into the bricked ones memories.

I did this quite reluctantly however - there was a chance that I might kill the good device. Before we contacted the manufacturer and asked whether he would be kind enough to send the .bin files for the memories. He didn't, saying it was "their proprietary information". The device was two months out of warranty.

Seeing as the memories were not even protected or anything, nor was the firmware image (a linux file system image) encrypted, nor were any steps taken to avoid what I did implemented (encryption, memory locking, take your pick), it seems like an asshole thing to do of them. Particularly when the device was sent to their local service provider for service and they said it was not repairable.

If this was your device, and you were in this situation, would you send me the .bin files?

I probably would send such an image to my customer if he requested it.

Thanks,

David

[ataradov]

I would. With understanding that device will be out of warranty, which it is anyway in your case.

And if they did not, I would publish this firmware on relevant forums, so others have it as well.

[borjam]

First, I may understand that el-cheapo stuff won't be protected against firmware update failures because a proper protection increases costs.

But I've seen plenty of much cheaper devices that either have two copies of the firmware, so that you can roll back a botched update safely, or they have a ROM with a minimum boot system that guarantees that you won't reach a dead end.

Being unwilling to assist with your repair would make me add them to my black list. And indeed, in their place, I would have sent the files. Replicating a product takes much more than copying a bloody memory chip. Recovering a customer's lost faith is much more expensive.

[wraper]

As the customer themselves provided second device, it would be right thing to do.

[nowlan]

3000 EUR piece of gear that got stuck during a firmware update and got bricked.  < F' those guys, if their firmware update breaks your product.

[tautech]

@ daqq
Do you know how it happened?
Power failure while updating?

[daqq]

Thanks for the thoughts.

Do you know how it happened?
Power failure while updating?

According to the friend for whom I fixed it there was no sort of power interruption, it just hanged - some random error, glitch, not his fault. I have no reason to assume that this information is false.

Replicating a product takes much more than copying a bloody memory chip.

My thoughts exactly - the device has obscure ICs, BGAs, at least 8 layers of high speed PCB... as such copying out the firmware of the 2 FLASH memories would be the least of my worries.


My first thought was actually to avoid removing the memories from the good device all together and just hop out of their limited console into linux and hope I could find some memory device in the /dev/ . Sadly it didn't work...

[Jeroen3]

We don't share the binaries. The hardware is generic and the software adds the magic.

[ataradov]

We don't share the binaries. The hardware is generic and the software adds the magic.

Then you probably will do more than simply put that firmware into external flash with no protection?

[stmdude]

You're in Europe. No draconian DMCA regulations here..

The customer has licensed the use of the firmware by purchasing the equipment. They're "allowed" to have it. They're even allowed to disassemble the crap out of it, change it, and put it back in their equipment.
Darn, you're even allowed to crack any copy-protection/DRM there might be in there, as long as there's a reason for it (manufacturer not giving you support would be a valid reason).

_However_, you (nor they) are not allowed to distribute the firmware to people who don't have a license. That would be software piracy and/or IP infringement.

[Jeroen3]

Enable all write protection and add a thick layer of polyurethane potting. The product is not considered repairable.

[tautech]

Thanks for the thoughts.

Do you know how it happened?
Power failure while updating?

According to the friend for whom I fixed it there was no sort of power interruption, it just hanged - some random error, glitch, not his fault. I have no reason to assume that this information is false.

If the company had existing authorised service centers and you weren't one I could perfectly understand their response.

[Cerebus]

Of course I'd send it to you. Fine, the equipment is a few months out of warranty but it will cost me a few minutes to email you a file. Then, next time your customer is evaluating new purchase hopefully they'll remember that I provide helpful, actual customer service.

Conversely, if I was as unhelpful as your supplier was, next time the purchasing cycle rolls around your customer wouldn't even consider me because my equipment became an expensive paperweight a few months out of warranty and I wasn't prepared to help.

If I was you, I'd name and shame the supplier.

One of the reasons I always used to ask HP for a quote first, was because in my first encounter with an HP Sales Engineer they were honest with me and when they didn't have the best solution for my needs told me so, and even pointed me to competitors equipment that would fit my needs. It cost them nothing, but earned them a loyal customer in future. A little helpfulness goes a long way in building a customer's trust and confidence in you.

On the other hand, I'd heartily recommend that my competitors follow your suppliers example.

[Kjelt]

Our company would not sent the firmware either but then it is also not in the clear.
But our products do have a secure firmware update so we could sent that file which is encrypted and signed.
But hypothetically if we did have unprotected firmware and a customer that had this problem would ask, we would ask to sent the product in so we could reprogram it for them instead of letting the customer that then also needs to have the right equipment and knowledge to program it correctly. On the other hand our products are much cheaper so it would be easier to sent a replacement.

[thm_w]

Our company would not sent the firmware either but then it is also not in the clear.
But our products do have a secure firmware update so we could sent that file which is encrypted and signed.
But hypothetically if we did have unprotected firmware and a customer that had this problem would ask, we would ask to sent the product in so we could reprogram it for them instead of letting the customer that then also needs to have the right equipment and knowledge to program it correctly. On the other hand our products are much cheaper so it would be easier to sent a replacement.

Same here, no problem with sending it in. But not a chance you would get anything that requires more than a USB key to install. Even if you can prove you are competent, you were probably not dealing with the engineer who wrote the SW. They might not have the bin file for what you want (ie if its loaded via a production test app).
I don't see this as unfair. He decided to upgrade out of warranty, he could have just left it and it would have continued to operate (presumably).

Particularly when the device was sent to their local service provider for service and they said it was not repairable.

This is a joke though.
If you haven't, let them know the issue was a relatively easy fix, and their service center could use some training..

[hendorog]

We don't share the binaries. The hardware is generic and the software adds the magic.

The point being there ain't no magic without it.
They can just read it out of the device themselves then what do you possibly gain by not supplying it?

Do you suggest the customer should attach a handle to it and use it as a hammer?

Not helping a customer get their gear working is just bad service plain and simple.   

[Wilksey]

I would, with the explicit understanding that it's all done at end users risk!
If someone said they had a device that bricked whilst attempting a firmware update I'd be inclined to help as much as possible, seeing as it's a unfortunate incident, out of warranty or not!

I hate companies that don't look after their customers, they are too big to care, it's why I like dealing with smaller companies, you get to know the people you are buying from / selling to, and strike a good working relationship with them, and vice versa.

Far too many companies will take your money and run these days, and not answer support calls, even when in warranty, doesn't make you want to buy from them again does it?!

[Jeroen3]

We don't share the binaries. The hardware is generic and the software adds the magic.

The point being there ain't no magic without it.
They can just read it out of the device themselves then what do you possibly gain by not supplying it?

Do you suggest the customer should attach a handle to it and use it as a hammer?

Not helping a customer get their gear working is just bad service plain and simple.

No. If they've corrupted the firmware. Something went very wrong.
We often send an engineer because the use case is either very unique, or the customer is an idiot.
It's an industrial product. Not like someone at home is likely to copy it. The environment is hostile for electrics. Thats why it's potted.

[Kjelt]

But this is a good case for us HW and SW engineers to make sure we make products that even when the firmware update goes wrong because:
1) new firmware is bad
2) power went down halfway
3) any other cause besides a HW failure that can not be corrected (broken flashcells or whatever)

the product is always able to perform another firmware update.
So some possible design solutions could be to update the firmware from a bootloader that never ever is going to be replaced, so you can always boot and retry the firmware update
or to backup the old firmware safely in a seperate area that if the new firmware fails the user can revert back to the old firmware.

[NiHaoMike]

If you really are worried about the firmware getting "into the wild", maybe have them sign a NDA to get it?

[suicidaleggroll]

Yes I would, a few years ago I even went to the South Pole to repair a device that a customer had broken.  I offered to give them the software and tools and teach them how to repair it, but they didn't trust themselves, so they had me go instead.