The transport package of the first wave is hashed using the SHA-1 hashing algorithm. The next portion of the key produced by appending the produced data of the previous round to the next one.  

This {{pr.zip|tool}} can extract the package from any firmware .dat file. 

It starts with a short header.

The first data in the package is a boot image [[boot|Boot image]]. It starts from fixed 0x200 offset.

The second part of the package is a tar file with all the firmware data [[image-structure|Firmware files package]].