# IQOS Firmware Extraction Artifacts

Date: 2026-04-19

This directory stores durable artifacts moved out of `/tmp` for the wired IQOS ILUMA i ONE investigation.

## Files

- `iqos_pl_webapp.html`
  - Saved WebApp entry HTML used to identify bundled assets.
  - Size: approximately `322K`.
  - SHA-256: `8a82128b34f1892ad55d1b1d88499e52f3c292b352f741142aa5f08faa57a5f2`.

- `iqos_connect_main.300883fc.js`
  - Official IQOS WebApp main JavaScript bundle used for FWU/WebHID static analysis.
  - Size: approximately `2.9M`.
  - SHA-256: `1050d7741783df3346b2631875a53c97843f9beb56b0482edffe8d1c7274a068`.

- `iqos_connect_6961.0d53dccf.chunk.js`
  - Official IQOS WebApp chunk saved for local static analysis.
  - Size: approximately `80K`.
  - SHA-256: `8f684d17d4cefdb9ec43d418d647fc2749788ba74754c5dc2fc12b6c57543ce2`.

- `iqos_connect_lazy_115.41a586b9.chunk.js`
  - Lazy chunk captured during the WebApp update/device flow.
  - Size: approximately `14K`.
  - SHA-256: `f749e52b5d3c47baf78a78cda31f7373172340d0f1e7c1628a62876e501475dd`.

- `iqos_connect_lazy_c5t.b9b2bd14.chunk.js`
  - Lazy chunk captured during the WebApp update/device flow.
  - Size: approximately `456K`.
  - SHA-256: `4081bd6fc9ba1bedfcde667ad79997a8fd06c4cdfbed01f0f4c65b0015e09a36`.

- `iqos_fwu_150_7_1_package.json`
  - Official `150.7.1` FWU package captured from the IQOS WebApp update route.
  - Size: `675303` bytes.
  - SHA-256: `fb3d03aeb9643ad41b7cc5de6af047a5d9d088bf97856473c24ada8df29ed60b`.

- `iqos_fwu_150_7_1_program_frames.bin`
  - Concatenation of all `program_blocks[].f` frames from the captured package.
  - Size: `313707` bytes.
  - SHA-256: `41cbccd8fb1776d91d19eebd3834e0629d86158f5fb157e128a3ac2af09a993f`.

- `iqos_fwu_150_7_1_program_payload_guess.bin`
  - First-pass payload derivation with the observed 7-byte program-frame header removed from each block.
  - Size: `304278` bytes.
  - SHA-256: `a36686079ffee15fb1e39e22fe17c30029862b7310087994ebbd96a27c60abea`.

- `iqos_fwu_150_7_1_program_payload_no_frame_trailer_guess.bin`
  - Second-pass payload derivation with the observed 7-byte program-frame header and likely 2-byte per-frame trailer removed from each block.
  - Size: `301584` bytes.
  - SHA-256: `54fddb9033bd96f88f113050a83df162615800a90c414c119acd207e69043776`.

- `ciphertext_container_analysis.json`
  - Structured follow-up analysis for ciphertext-versus-opaque-container assessment.
  - Re-derives frame/payload boundaries, byte statistics, compression ratios, repeated-block checks, magic scans, vector-table scans, and trailer statistics.
  - Size: approximately `26K`.
  - SHA-256: `e69a7cc870278d343efd4c4b8ca5695ac529738764bb72b842b2734538159828`.

- `iqos_current_state_after_reconnect.json`
  - Sanitized post-reconnect verification snapshot showing the WebApp still displayed firmware `150.5.0`.
  - Size: `465` bytes.
  - SHA-256: `4110f034feb3bcbd67c0c122312b5f0914956a1795610e35e83d4afd35166293`.

- `iqos_cdp_network.redacted.log`
  - Redacted CDP network monitor log.
  - Size: approximately `300K`.
  - SHA-256: `bac1b8289c3c05c1271adfcab21059cd2499a0f816628ac8205ebdac48a90d88`.

- `iqos_cdp_ws.redacted.log`
  - Redacted CDP WebSocket monitor log.
  - Size: approximately `163K`.
  - SHA-256: `8b8da7f2b7bf54887a0b1f9b8d105ab522589ee124c21682c70731ee6b080488`.

- `iqos_cdp_firmware_hits.redacted.jsonl`
  - Redacted firmware-related CDP body/hit log.
  - Size: approximately `585K`.
  - SHA-256: `6869b63f3cd1a46fd2b5e6bff2939aa696a5cbb4d029f3341a38956ef4983f58`.

- `iqos_cdp_network.raw.log`
  - Raw CDP network monitor log moved from `/tmp`.
  - Size: approximately `338K`.
  - SHA-256: `8bd6439a2809f9aed005029fbecad7103a27c423f2309a2ea9381df6d5c4ac2f`.

- `iqos_cdp_ws.raw.log`
  - Raw CDP WebSocket monitor log moved from `/tmp`.
  - Size: approximately `190K`.
  - SHA-256: `ba6d4d260cc9cd7586cb1ccc3eb2345d8873b981045d324b523314b993c6b24b`.

- `iqos_cdp_firmware_hits.raw.jsonl`
  - Raw firmware-related CDP body/hit log moved from `/tmp`.
  - Size: approximately `592K`.
  - SHA-256: `b03e8e5e4816b4f3ae6c6381e350ad6ba53ef0b6fd9f9884c1b60e0b643106b7`.

- `client_side_fwu_sniffer.raw.jsonl`
  - Raw client-side runtime hook log for WebCrypto, WebHID, XHR/fetch, package parse, and related sinks.
  - Captures the approved update-start runtime attempt.
  - Size: approximately `8.5M`.
  - SHA-256: `8222de0879d076fd86bf6dca6263d92062278bf49f1eb6f422dfd1eb8b302235`.

- `client_side_fwu_runtime_analysis.json`
  - Summary of client-side runtime event counts and WebHID/package-frame comparison.
  - Size: approximately `2.2K`.
  - SHA-256: `139e4c9362af8d6fec50ce0f5e9dfd1d15203104e2f93d11fe0f883cec0a81e2`.

- `client_side_hid_reconstructed_segmented_frames.bin`
  - Concatenation of all report ID `0x40` segmented frames reconstructed from WebHID `sendReport` calls, including duplicates/retries.
  - Size: approximately `308K`.
  - SHA-256: `61b1e0950fefecc65ad2a3158401725f82ed83ed062e19482dd23039da6fcfca`.

- `client_side_hid_reconstructed_ordered_program_frames.bin`
  - Ordered reconstructed program frames from WebHID `sendReport`, matching the package `program_blocks` stream.
  - Size: `313707` bytes.
  - SHA-256: `41cbccd8fb1776d91d19eebd3834e0629d86158f5fb157e128a3ac2af09a993f`.

- `hid_scp_command_catalog.json`
  - Structured HID/SCP catalog generated from the FWU runtime capture plus the direct read probe.
  - Size: approximately `60K`.
  - SHA-256: `753ee333d220535ac21fc38396d3242925227643d9b2838603a118ad072dfe13`.

- `hid_scp_direct_read_probe.json`
  - Parsed result of the limited direct replay of six observed `0x10` read/status frames.
  - Contains raw response hex, including identity-like bytes from one response.
  - Size: approximately `3.6K`.
  - SHA-256: `6ad933808d84f2bf34c6571b7ca73a595cd203c5583e95c194e8446aee8d7b7e`.

- `hid_scp_direct_read_probe.raw.jsonl`
  - Raw direct read/status probe sends and input reports.
  - Size: approximately `3.1K`.
  - SHA-256: `cc1a655a3cc1bfb7ead868958a8607236bf61daf47288b2f3dce8c284a824cfe`.

- `scp_trailer_bundle_analysis.json`
  - Structured SCP trailer/checksum search plus saved WebApp bundle static-analysis hits.
  - Confirms CRC-16/OPENSAFETY-B as the likely normal SCP frame trailer for `99/105` mixed-corpus frames.
  - Size: approximately `70K`.
  - SHA-256: `9478a64ad8f436d3e4ae3728848f2bf12adc515ceef256da119be1eb49a6824d`.

- `fwu_package_format_analysis.json`
  - Structured parser output for the captured `150.7.1` FWU package.
  - Defines the visible SCP envelope, FWU subheader, 16-byte sequence unit, protected payload boundary, and start/end opaque fields.
  - Size: approximately `15K`.
  - SHA-256: `e5f61f18a1daba553e88e629f08dd189ba4c47cbbf84ab8d95b3126d26477323`.

- `backend_frame_sources_analysis.json`
  - Structured frame-like value extraction from saved raw CDP, WebHID, and probe logs.
  - Records frame hex, source file names, line numbers, event kinds, and JSON paths only; raw URLs, JWTs, serials, asset IDs, and request bodies are intentionally not copied into this derived artifact.
  - Size: approximately `35K`.
  - SHA-256: `da9de88d1967314232b9f8b8e5433beaae4693eced14926a17dbe492b3eb77c5`.

- `webapp_command_source_analysis.json`
  - Structured static analysis of saved official IQOS WebApp bundles for command-source modules, frame constants, transport helpers, FWU flow modules, and readback/search terms.
  - Records module IDs, offsets, imports, exports, frame-like string literals, and term hit counts only; source snippets, URLs, tokens, request bodies, serials, and account metadata are intentionally not copied.
  - Size: approximately `158K`.
  - SHA-256: `25aa4dd2cf871a4b9fa4f8820924825f9c2db03a03c791ad80da62830bc3eecc`.

- `hid_scp_crc_validation.json`
  - Parsed result of a live non-destructive validation that regenerated six known `0x10` read/status frames from selectors plus CRC-16/OPENSAFETY-B.
  - Size: approximately `5.0K`.
  - SHA-256: `e2a5953ae3e691e6a31bd4dcef9b74a6b1510d87fc55950eb4fc412518e45eb1`.

- `hid_scp_crc_validation.raw.jsonl`
  - Raw generated-frame, send, and input-report events from the live CRC validation.
  - May contain HID response bytes with identity-like fields.
  - Size: approximately `4.3K`.
  - SHA-256: `80b3356a8f412a7df5c664d70832c6b7bbacb11715084383c62b4f1bc4123b58`.

- `hid_scp_catalog_navigation_steps.json`
  - Metadata for safe settings/about page navigation clicks used to check whether normal page transitions emitted new HID traffic.
  - Size: approximately `17K`.
  - SHA-256: `307b32c07d43feee8933db0e444dbea936daf6088a46dff397d6f6920f6dab41`.

- `hid_scp_catalog_navigation.raw.jsonl`
  - Raw sniffer events from safe settings/about page navigation.
  - Size: approximately `13K`.
  - SHA-256: `02ba5d11bfa6f81331b4c7805ac9abf861d716902d2abb1cb38927d064ede3b6`.

- `hid_scp_catalog_intro_start.json`
  - Metadata for the post-reload `IQOS アプリへ` navigation attempt.
  - Size: approximately `4.0K`.
  - SHA-256: `5edb3542fa8718dc30bfeee6302195037ea8918d019988d394f6793b58cd4477`.

- `hid_scp_catalog_intro_start.raw.jsonl`
  - Raw sniffer events from the post-reload app-entry attempt; contains WebCrypto/AWS-signing events and no HID traffic.
  - Size: approximately `51K`.
  - SHA-256: `cba68f0609b3bde7404e79317653c5e02a8725742b402fa90df2dc5420be4d82`.

- `hid_scp_catalog_reload.json`
  - Metadata for the page reload attempt that returned the WebApp to `/apps/webapp/intro`.
  - Size: approximately `2.9K`.
  - SHA-256: `de4671ca2266c91e0710049eab2cc3e3eb38b704a8b583af37485f7d850e545e`.

- `hid_scp_catalog_reconnect.json`
  - Metadata for the attempted WebApp reconnect click after reload.
  - Size: approximately `549B`.
  - SHA-256: `cf20812f9c5bdb19ac82d735d881aafd3a5d6e2254d480a9bd5f589d95de81ce`.

## Notes

- These files are analysis artifacts, not a complete current-device firmware dump.
- The `.bin` files are derived from the official `150.7.1` update package, not extracted from the installed `150.5.0` flash image.
- Raw CDP/network logs are preserved here for reproducibility because this directory is not intended to be committed.
- Raw logs can contain JWTs, signed AWS URLs, WebCrypto key material used for request signing, serial numbers, asset IDs, account identifiers, and HID response bytes containing device identity fields. Treat them as sensitive local artifacts.
- Redacted CDP logs were scanned for obvious JWTs, AWS signed-token fields, hex serials, codentify strings, and UUIDs after redaction.
