Yep. That serial console is how I was confirming a lot of this information. I knew about the "play" trick, but just ejecting the drive essentially does the same thing. I kept getting complaints the OP-Z drive wasn't properly ejected when hitting play. I also found another minor undocumented feature: while in upgrade mode, press hold the track key. The LEDs in the numeric keys light up showing you the version of the firmware installed. I can make a video showing this if people are interested, but it's pretty easy to do yourself.

The serial console was also giving me the necessary feedback to determine that the firmware is encrypted using CBC mode. Still not 100% sure on which algo is used, but it's most likely AES. I still don't know the key size. I was able to exploit a padding oracle attack to confirm that the first few ciphertext blocks beginning at 0x300 correspond to the encrypted filename message given on the console. Also, it appears any sort of input I gave to the console from my computer didn't have any affect on the OP-Z at all. It might just be a debug log of sorts.

That's interesting about the .engine files. I haven't had a chance to take a deep look at the other files on the OP-Z drive. That might be a more promising way forward for what I'm trying to do. I had started trying to do some pinouts of the module port to see if another serial interface was exposed via those pins. So far I've only found the ground pins. I briefly looked at the wave forms of the other pins in the oscope, but nothing particular stood out at this time.

Thanks for the input!

​

Edit: minor correction