Update your APC devices without a Windows OS

I’ve been upgrading my APC UPSes to systems with APC management cards (AP9630/AP9631) in them. For some reason the APC site thinks that EVERYONE in the world only run Windows OSes. I don’t run windows… and it’s a PITA to get an eval VM just to update the APC firmware. Also, I really only have Linux boxes, or a MacOS X desktop.

Side note here: HEY APC! Can you create tools that run on any platform? Python maybe?

This article will give you some info on how to update the firmware on your APC with out the use of Windows OS.

Step one: Get binwalk https://github.com/ReFirmLabs/binwalk. One the Mac, after installing homebrew (https://brew.sh), run “brew install binwalk” – that will grab all the required components.

On Ubuntu you can run “sudo apt install binwalk”

Once you have a working binwalk, you can now go find the windows “exe” file from the APC website: https://www.apc.com/shop/mt/en/tools/software-firmware/. First figure out what version the UPS is on- this could be in the Admin menu, or the About menu. You will want to find the binary type, eg: “sumx”. If you search for your UPS type, and then enter in the managment card type- it should find the files on the site. Again, this is the worst, as it shows you like 3 or 5 different versions based on where that card goes. If the download has your UPS model in the name, it should work. EG: Smart-UPS & Galxy 3500. It’s a weird way to name & package firmware updates (EG: confusing).

Now, extract the file:

binwalk -e apc_hw05_aos688_sumx688_bootmon109.exe

You should then get something like this:

macbookpro13:Downloads username$ binwalk -e apc_hw05_aos688_sumx688_bootmon109.exe

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Microsoft executable, portable (PE)
28289         0x6E81          Zip archive data, at least v2.0 to extract, name: Bins/
28324         0x6EA4          Zip archive data, at least v2.0 to extract, compressed size: 1163832, uncompressed size: 3137792, name: Bins/apc_hw05_aos_688.bin
1192211       0x123113        Zip archive data, at least v2.0 to extract, compressed size: 81708, uncompressed size: 262144, name: Bins/apc_hw05_bootmon_109.bin
1273978       0x13707A        Zip archive data, at least v2.0 to extract, compressed size: 936098, uncompressed size: 3016836, name: Bins/apc_hw05_sumx_688.bin
2210132       0x21B954        Zip archive data, at least v2.0 to extract, compressed size: 186885, uncompressed size: 785780, name: Bins/sumx_688_esEszhCnjaJaptBrkoKo.lpk
2397085       0x24939D        Zip archive data, at least v2.0 to extract, compressed size: 191741, uncompressed size: 797409, name: Bins/sumx_688_frFrdeDeitItesEsptBr.lpk
2588894       0x2780DE        Zip archive data, at least v2.0 to extract, compressed size: 201265, uncompressed size: 900701, name: Bins/sumx_688_frFrdeDeruRuitItesEs.lpk
2790227       0x2A9353        Zip archive data, at least v2.0 to extract, compressed size: 197345, uncompressed size: 895158, name: Bins/sumx_688_frFrruRuzhCnjaJakoKo.lpk
2987640       0x2D9678        Zip archive data, at least v2.0 to extract, compressed size: 1149947, uncompressed size: 3464192, name: edtFTPnetPRO.dll
4137633       0x3F22A1        Zip archive data, at least v2.0 to extract, compressed size: 31586, uncompressed size: 74056, name: NMCFirmwareUpdateUtility.exe
4170378       0x3FA28A        End of Zip archive, footer length: 22
4170901       0x3FA495        Certificate in DER format (x509 v3), header length: 4, sequence length: 1006
4171911       0x3FA887        Certificate in DER format (x509 v3), header length: 4, sequence length: 1187
4173102       0x3FAD2E        Certificate in DER format (x509 v3), header length: 4, sequence length: 1227
4174333       0x3FB1FD        Certificate in DER format (x509 v3), header length: 4, sequence length: 1369
4175706       0x3FB75A        Certificate in DER format (x509 v3), header length: 4, sequence length: 1434

If you look that the above text- we see that it extracted the *.bin files that we need to update the firmware. NO MS Windows OS needed!

APC has a FAQ for updating their firmware manually. It feels like it was written by an engineer who has worked with the products for 20+ years, and can only run Windows OS. That FAQ is here (Very hard to read): https://www.apc.com/us/en/faqs/FA156047/

Bassicly- what it says is this:

If the package you downloaded has a .bin file that has “aos” someplace in the name, upload that first. Wait 20-30 seconds, Then upload the “bootmon” file. Wait 30+ seconds. Then upload the application file, eg: apc_hw05_sumx_688.bin

Now cd into the directory with the extracted binary files:

cd _apc_hw05_aos688_sumx688_bootmon109.exe.extracted/Bins/
macbookpro13:Bins username$ ls -l
total 19640
-rw-r--r--  1 username  staff  3137792 May  4 12:32 apc_hw05_aos_688.bin
-rw-r--r--  1 username  staff   262144 Jun  7  2019 apc_hw05_bootmon_109.bin
-rw-r--r--  1 username  staff  3016836 May  4 12:32 apc_hw05_sumx_688.bin
-rw-r--r--  1 username  staff   785780 May  4 12:17 sumx_688_esEszhCnjaJaptBrkoKo.lpk
-rw-r--r--  1 username  staff   797409 May  4 12:17 sumx_688_frFrdeDeitItesEsptBr.lpk
-rw-r--r--  1 username  staff   900701 May  4 12:17 sumx_688_frFrdeDeruRuitItesEs.lpk
-rw-r--r--  1 username  staff   895158 May  4 12:17 sumx_688_frFrruRuzhCnjaJakoKo.lpk

Now ftp to the APC device to be upgraded….

ncftp -u apc -p apc 192.168.101.21
put apc_hw05_aos_688.bin

# Wait 20-30 seconds for the APC to reboot - may have to restart ftp client

# login to APC again via FTP
ncftp -u apc -p apc 192.168.101.21
put apc_hw05_bootmon_109.bin

# Wait for the reboot again. 20-30 seconds.

# This final step will upgrade the Application on the card.
ncftp -u apc -p apc 192.168.101.21
put apc_hw05_sumx_688.bin

At this point you should have an updated version of the software ready to go, and now you can manage the device to your hearts content. If you brick your UPS managment card, it is not my fault. I take no responsibility for anyone following this process. But, it’s worked well for me, as I don’t have access to a windows box to run a .exe to unpack the firmware.

Good luck!