Monday, November 4, 2019

BMW NBT and NBT Evo Firmware Unpacker

It has been five years since I have released the first build of NBT firmware unpacker.

A few years ago I've had to stop the distribution of unpacker because the misuse of unpacker was disrupting the business of BMW retrofit shops. With 2018 public release of NBT and EVO vulnerabilities that have been known to the BMW retrofit scene since at least fall of 2014, and subsequent patching of vulnerabilities by BMW, I no longer consider distribution of the unpacker as harmful.

To commemorate the five years of NBT unpacker, I am releasing an updated and refactored version with the following new features:

  • Search for supported unpackable firmware files within specified folder
  • Searching for specific file within firmware across multiple firmware files in specified folder
  • Better handling of special cases like ASD or EQU files.
Download nbt_unpack release 1.0.0 here: Win32


  1. I didn't understand how to search for files

  2. This searches for i2c.cfg file in all supported firmware files in current folder:
    nbt_unpack.exe -fs i2c.cfg .\

  3. Do You have Firmware Unpacker for CIC Unit?

  4. Hey, when i launch the software nothing happens, it crashes

    1. Does it print any error message or stack trace? If not it's likely your OS or Antivirus that's preventing the unpacker from running.

    2. No it just launches the CMD window for a split second but doesnt do anything. I tried running it in compatibility mode and no dice

    3. It does not have graphical interface, so you need to run it from command line to see any output.

  5. Thanks for your help by the way


Changing XGS-PON factory settings for Zyxel PM7516-R0

I was able to get ZYXEL XGS-PON 10GE ONT for less than $50 on eBay. I have no real use for it, but I was wondering how difficult it is to ch...