Samsung FUS firmware distribution — protocol notes

FUS = Samsung's firmware update server system. Fully implemented in Orbit (GPL-3.0). Summary of what was reverse-engineered:

Endpoints & flow

• XML request/response ("SmartDownload" modern flow + legacy binary XML fallback).
• Handshake writes an auth_param.dat protected by a custom block cipher (not TLS alone) — the client must replicate it to be served.
• Download URL shape (2026, verified): https://cloud-neofussvr.samsungmobile.com/NF_DownloadBinaryForMass.do?file=<RAW path> (raw path, no %2F).
• Model/CSC/IMEI/serial go into the XML to select the binary (factory channel exists as a separate flag).

The bundles

• Firmware = an encrypted zip64 container. The encryption header structure allows per-entry range extraction: compute an entry's byte range from the central directory and fetch only that range over HTTP Range — a BL = ~82 MB on the wire instead of a full 21.6 GB bundle.
• Extracted parts verified byte-identical to third-party mirror copies (CRC32 + md5 trailers + full SHA256).

Practical facts

• Full speed comes straight from Samsung; no mirror throttling.
• The NF_DownloadBinaryForMass.do endpoint worked when the SmartDownload-variant endpoint was dead — keep the fallback.
• Catalogue source that works without FUS login: SamFrew's uploads/model endpoints (all released builds per model), with CP versions auto-resolved.

See orbit repo source (fusclient/) for the full implementation: modern+legacy flows, range extraction, verification, CLI (check|csc|download|decrypt).