# Overview and Status

Date: 2026-04-19
Host: macOS
Device: IQOS ILUMA i ONE over USB

## Objective

Extract or locate firmware for a locally connected IQOS device, prioritizing the firmware already present on the device. Avoid destructive operations such as successful firmware programming, reset, readout-protection regression, mass erase, or unverified vendor commands that could modify device state.

## Safety Boundary

Allowed so far:

- Passive USB and HID enumeration.
- Read-only WebApp interaction up to firmware availability check.
- Official IQOS WebApp login and device connection performed by the owner.
- Capturing browser network metadata and response bodies for firmware-update discovery.
- Downloading official IQOS WebApp JavaScript assets for static analysis.
- Instrumenting the active WebApp runtime to log firmware-download attempts and HID sends.
- Triggering the official update page after adding a runtime guard, solely to capture the official package URL and package body.

Not performed:

- No successful firmware update was completed.
- No readout-protection bypass, unprotect, recover, reset, or erase was attempted.
- No intentional raw programming sequence was sent outside the official WebApp path.
- No bootloader unlock was attempted.
- No brute-force HID command fuzzing was attempted.
- No invasive PCB/chip-off/SWD/JTAG work was attempted.
- No Homebrew install was performed.

## Installed Or Downloaded Items

No package manager install has been performed.

Official IQOS WebApp assets saved for local analysis:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_connect_main.300883fc.js`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_connect_6961.0d53dccf.chunk.js`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_connect_lazy_115.41a586b9.chunk.js`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_connect_lazy_c5t.b9b2bd14.chunk.js`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_pl_webapp.html`

Official firmware-update package saved for local analysis:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_fwu_150_7_1_package.json`

Derived package-analysis artifacts:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_fwu_150_7_1_program_frames.bin`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_fwu_150_7_1_program_payload_guess.bin`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_fwu_150_7_1_program_payload_no_frame_trailer_guess.bin`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/ciphertext_container_analysis.json`

Post-reconnect verification artifact:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_current_state_after_reconnect.json`

Redacted durable CDP logs:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_network.redacted.log`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_ws.redacted.log`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_firmware_hits.redacted.jsonl`

Raw durable CDP logs:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_network.raw.log`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_ws.raw.log`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_cdp_firmware_hits.raw.jsonl`

Temporary local probe/source files created:

- `/tmp/iqos_hid_probe.swift`
- `/tmp/iqos_hid_ping.swift`
- `/tmp/iqos_libusb_probe.c`
- `/tmp/iqos_usb_descriptors.c`
- `/tmp/iqos_libusb_probe`
- `/tmp/iqos_usb_descriptors`

Runtime capture tooling created:

- `../scripts/client_side_fwu_sniffer.cjs`
- `../scripts/analyze_ciphertext_container.cjs`
- `../scripts/analyze_hid_scp_catalog.cjs`
- `../scripts/probe_hid_scp_reads.cjs`
- `../scripts/analyze_scp_trailer_and_bundle.cjs`
- `../scripts/probe_hid_scp_crc_validation.cjs`
- `../scripts/analyze_fwu_package_format.cjs`
- `../scripts/analyze_backend_frame_sources.cjs`
- `../scripts/analyze_webapp_command_sources.cjs`

Runtime capture artifact:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/client_side_fwu_sniffer.raw.jsonl`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/hid_scp_command_catalog.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/hid_scp_direct_read_probe.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/hid_scp_direct_read_probe.raw.jsonl`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/scp_trailer_bundle_analysis.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/hid_scp_crc_validation.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/hid_scp_crc_validation.raw.jsonl`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/fwu_package_format_analysis.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/backend_frame_sources_analysis.json`
- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/webapp_command_source_analysis.json`

Temporary extracted JavaScript module snippets:

- `/tmp/iqos_module_*.js`

Temporary Chrome/CDP artifacts:

- `/tmp/iqos-chrome-profile/`

Raw CDP logs were moved out of `/tmp` into the durable artifact directory. They are sensitive local artifacts and should not be committed.

## Current Firmware State

The owner logged into the official IQOS WebApp and connected the device through Chrome/WebHID.

Read-only action performed:

- Clicked `ファームウェアのアップデートを確認する`.

Observed page after check:

- URL: `https://jp.iqos.com/apps/webapp/summary-update`
- Visible primary action: `アップデートを開始`
- Visible secondary action: `カスタム設定に戻る`

Captured firmware availability:

```json
{
  "availableFirmwares": [
    {
      "version": "150.7.1",
      "hasBootloaderUpdate": false
    }
  ],
  "availableAssociatedFirmwares": {
    "engine": []
  }
}
```

Captured device-state summary, identifiers redacted:

- Device type: `DEV_TYPE_P1V41A_CONTROL`
- Current device firmware: `150.5.0`
- Available device firmware: `150.7.1`
- Bootloader update available: `false`
- Associated engine type: `DEV_TYPE_P1V41J_ENGINE`
- Current engine firmware: `102.6.0`
- Available engine firmware: none
- Device SBL major version: `6`
- Engine SBL major version: `6`

Captured memory-partition metadata:

```text
startPartition0: 0x080000
endPartition0:   0x080100
startPartition1: 0x080150
endPartition1:   0x080790
startPartition2: 0x000000
endPartition2:   0x000000
```

## Official Update Package Capture

The guarded official update flow reached package download and then failed before a successful firmware update completed.

Observed update-flow events:

- `POST /asset/<redacted-asset-id>/device/actions/updateFirmware` returned a redacted async request ID.
- WebSocket async event reported `firmwareUpgradeStarted`.
- The WebApp downloaded `150_7_1.json` from the official S3 package path under `fwu_scp_package/USB/<redacted-serial>/extended/`.
- A later WebSocket async event reported `FAILED` with outer error `Device disconnected from Middleware`.
- The WebApp page was then navigated to `about:blank` to stop further update-page activity.

Captured package:

- Path: `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_fwu_150_7_1_package.json`
- Size: `675303` bytes
- SHA-256: `fb3d03aeb9643ad41b7cc5de6af047a5d9d088bf97856473c24ada8df29ed60b`
- Program blocks: `1347`
- Package version inferred from route and object name: `150.7.1`

## Post-Reconnect Firmware Verification

After the owner reconnected the device in the WebApp, the `device-settings/about-device` screen displayed:

- Device: `IQOS ILUMA i ONE`
- Firmware version: `150.5.0`

Sanitized snapshot:

- `../artifacts/2026-04-19-wired-iqos-iluma-i-one/iqos_current_state_after_reconnect.json`

Interpretation:

- The guarded official update attempt did not visibly change the installed control/device firmware version.
- The current-image extraction target remains `150.5.0`.

## Current Conclusion

The current on-device firmware image has not been extracted.

Evidence indicates:

- Standard wired USB extraction is not available through DFU, serial, mass storage, or WebUSB.
- The official wired path is vendor HID plus backend-assisted firmware update.
- The official path exposes update availability and device state, but not a direct readback of current flash.
- The official update package was captured, but it is firmware `150.7.1`, not the current installed `150.5.0`.
- The captured package is high entropy and does not expose an obvious plaintext firmware image without further protocol/key analysis.
- App-side raw firmware/key search did not find a browser-side FWU decrypt, decompress, or signing path. The observed app path downloads a JSON package and forwards package-provided frames to the device.
- A cleaner payload derivation that removes a likely 2-byte per-frame trailer remains high entropy and still does not expose a standard container or plaintext image.
- Runtime client-side capture during an approved update attempt observed `5470` WebHID sends and no decrypt events. Reconstructed HID program frames matched the captured package `program_blocks`, confirming the browser sent package frames rather than plaintext firmware.
- Follow-up ciphertext/container analysis found no compression gain, no repeated 16-byte blocks, no standard container magic, and no plausible Cortex-M vector table in the cleaner payload. This strongly disfavors signed-only plaintext or standard compression, but does not mathematically exclude a deliberately opaque signed vendor container.
- HID/SCP cataloging confirmed report ID `0x3f` atomic frames, report ID `0x40` segmented frames, FWU request/ack mappings, and six short `0x10` read/status request-response pairs. Normal settings page navigation emitted no fresh HID traffic after state was already synchronized.
- SCP trailer analysis found that ordinary `C0 <opcode> <len> <payload>` frames use CRC-16/OPENSAFETY-B over the bytes after the leading `C0`, stored little-endian. A live non-destructive validation regenerated six known read/status frames from selectors, matched all known frames, sent them successfully, and received seven input reports.
- FWU package format analysis confirmed that the visible update package is a transport script around a `301584` byte protected payload. The protected payload is exactly `18849` 16-byte blocks, and the program-block sequence is continuous as a 1-based 16-byte block counter.
- Raw CDP/WebHID/probe log frame extraction found no visible memory-read, flash-read, firmware-readback, backend-provided diagnostic frame set, or plaintext firmware route. The only unknown normal CRC-valid SCP frame found in that pass is `C0500600048E6BA71E1912`, an opcode `0x50` FWU/programming-family request that is not safe to replay outside the official update flow.
- Static WebApp command-source analysis found hardcoded identity-read constants only, no `readMemory`/`readFlash`/`readback`/firmware-dump term modules, and confirmed that backend/CM messages can dynamically provide `frames` or `conditional_frames`. Therefore, a clean initial-sync capture is now the highest-value non-invasive next task.
- Extracting the currently installed firmware still likely requires one of:
  - a vendor protocol command that reads memory/firmware, not yet identified;
  - a vulnerability/code-execution path that makes the device self-dump;
  - a plaintext package/key leak or verification bypass not present in the currently captured WebApp route.

Physical teardown and invasive paths are explicitly out of scope for the current plan.
