Repasando el tema con mas información:

Novatek Header

Vender=Novatek //16 bytes
Chip=658877 //16 bytes
ProductModel=0D0609 //16 bytes
AppVersion=0X000001030200F3910000000000000001 //16 bytes
DataLenght=0x5400800000 (Al reves si little endian, tamaño del fichero completo) // 4 bytes
Start Address=0x00000000 (Al reves si little endian, inicio posición en memoria flash) // 4 bytes
DataOffset= 0x07000000// 4 bytes
FileType= //2 bytes (
00 00 Boot
01 00 App1
02 00 Second Application OTA
03 00 Private Data
04 00 Db
05 00 Backup Db
06 00 Share Bank
07 00 All
08 00 Customize
0A 00 DefDb )
DbVersion=0x00 // 1 byte
Endian=81 //00 big,80 little,81 little // 1 byte



App Chunk
MagicCode = 0x31415926
Header=_FEB, _APU, __B1, __BM, DRUN, APP1, APP2, FRAW, DRAW
ModelID=NT78
Version=0x00010001
Attribute=0xaa5500xx //xx=00(none),xx=01(zip data), xx=02(encryption)
SectionLen=0x004BAF20 //the data length after stamp header
LoadDramAddr=0x802B0000 //This address get form rom vector address
EntryPointAddr=0x802B01BC //This address get form reset vector address
TargetAddr=0x00010000 //This is the target address of Raw data and this address depend by header type

aunque ya tenemos claro el tema de zip2006.exe que es un lzma con una mascara XOR 5A5A5A5A5A5A5A5A5A5A5A5A5A en el encabezado del fichero, nos quedan los problemas del make_ro.exe, gz909.exe y filex.exe.
Saludos