The transport package of the first wave is hashed using the SHA-1 hashing algorithm. The next portion of the key produced by appending the produced data of the previous round to the next one.
This tool can extract the package from any firmware .dat file.
It starts with a short header.
The first data in the package is a boot image Boot image. It starts from fixed 0x200 offset.
The second part of the package is a tar file with all the firmware data Firmware files package.