Track C — Orbit, the FUS firmware downloader (public project)

Repo: github.com/plomens/orbit (GPL-3.0, release v2.0.0). Born because every Samsung firmware mirror is slow, shady, or both — Orbit downloads firmware direct from Samsung's FUS servers, at full speed.

What was reverse-engineered

• FUS protocol, modern SmartDownload + legacy paths: the client flow, the auth_param.dat handshake (custom block cipher), binary XML responses, and the download URL shape (cloud-neofussvr.samsungmobile.com/NF_DownloadBinaryForMass.do).
• zip64 range extraction: firmware bundles are encrypted zip64 containers; Orbit downloads per-partition ranges — a BL alone is ~82 MB on the wire instead of a 21.6 GB bundle — with byte-identical results verified against SamFw's copies.
• Catalogue: all released builds per model (SamFrew endpoints), CP auto-resolution, factory channel, CSC browser.

Features

GUI (dark squircle UI) + CLI. Segmented downloads with pause/resume/cancel, per-part extraction, CRC32/md5/sha256 verification, phone auto-detect via adb (model + sales code → auto-check newest), download history, guides, factory firmware channel.

Why it matters to this research

• Gave us the verified DZI1 flash set (hashes in dumps-hashes/) used for Track A's downgrade and every recovery flash.
• The per-part range trick = the cheap way to pull single boot-chain images (BL etc.) for RE.