rbutil/mkamsboot/mkamsboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * mkamsboot.c - a tool for merging bootloader code into an Sansa V2
  11  *               (AMS) firmware file
  12  *
  13  * Copyright (C) 2008 Dave Chapman
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21  * KIND, either express or implied.
  22  *
  23  ****************************************************************************/
  24
  25 /*
  26
  27 Insert a Rockbox bootloader into a Sansa AMS original firmware file.
  28
  29 Layout of a Sansa AMS original firmware file:
  30
  31  ----------------------  0x0
  32 |        HEADER        |
  33 |----------------------| 0x400
  34 |    FIRMWARE BLOCK    |
  35 |----------------------| 0x400 + firmware block size
  36 |    LIBRARIES/DATA    |
  37  ----------------------  END
  38
  39 We replace the main firmware block (bytes 0x400..0x400+firmware_size)
  40 as follows:
  41
  42
  43  ----------------------  0x0
  44 |                      |
  45 |    Dual-boot code    |
  46 |                      |
  47 |----------------------|
  48 |     EMPTY SPACE      |
  49 |----------------------|
  50 |                      |
  51 | compressed RB image  |
  52 |                      |
  53 |----------------------|
  54 |                      |
  55 | compressed OF image  |
  56 |                      |
  57 |----------------------|
  58 | UCL unpack function  |
  59  ----------------------
  60
  61 This entire block fits into the space previously occupied by the main
  62 firmware block - the space saved by compressing the OF image is used
  63 to store the compressed version of the Rockbox bootloader.
  64
  65 On version 1 firmwares, the OF image is typically about 120KB, which allows
  66 us to store a Rockbox bootloader with an uncompressed size of about 60KB-70KB.
  67 Version 2 firmwares are bigger and are stored in SDRAM (instead of IRAM).
  68 In both cases, the RAM we are using is mapped at offset 0x0.
  69
  70 mkamsboot then corrects the checksums and writes a new legal firmware
  71 file which can be installed on the device.
  72
  73 When the Sansa device boots, this firmware block is loaded to RAM at
  74 address 0x0 and executed.
  75
  76 Firstly, the dual-boot code will copy the UCL unpack function to the
  77 end of RAM.
  78
  79 Then, depending on the detection of the dual-boot keypress, either the
  80 OF image or the Rockbox image is copied to the end of RAM (just before
  81 the ucl unpack function) and uncompressed to the start of RAM.
  82
  83 Finally, the ucl unpack function branches to address 0x0, passing
  84 execution to the uncompressed firmware.
  85
  86
  87 */
  88
  89 #include <stdio.h>
  90 #include <stdlib.h>
  91 #include <stdint.h>
  92 #include <sys/types.h>
  93 #include <sys/stat.h>
  94 #include <fcntl.h>
  95 #include <unistd.h>
  96 #include <string.h>
  97
  98 #include <ucl/ucl.h>
  99
 100 #include "mkamsboot.h"
 101
 102 #include "md5.h"
 103
 104 /* Header for ARM code binaries */
 105 #include "dualboot.h"
 106
 107 /* Win32 compatibility */
 108 #ifndef O_BINARY
 109 #define O_BINARY 0
 110 #endif
 111
 112 /* 4 for m200, 2 for e200/c200, 1 or 2 for fuze/clip, 1 for clip+ */
 113 const unsigned short hw_revisions[] = {
 114     [MODEL_FUZE]    = 1,
 115     [MODEL_CLIP]    = 1,
 116     [MODEL_CLIPV2]  = 2,
 117     [MODEL_E200V2]  = 2,
 118     [MODEL_M200V4]  = 4,
 119     [MODEL_C200V2]  = 2,
 120     [MODEL_CLIPPLUS]= 1,
 121 };
 122
 123 /* version 2 is used in Clipv2, Clip+ and Fuzev2 firmwares */
 124 const unsigned short fw_revisions[] = {
 125     [MODEL_FUZE]    = 1,
 126     [MODEL_CLIP]    = 1,
 127     [MODEL_CLIPV2]  = 2,
 128     [MODEL_E200V2]  = 1,
 129     [MODEL_M200V4]  = 1,
 130     [MODEL_C200V2]  = 1,
 131     [MODEL_CLIPPLUS]= 2,
 132 };
 133
 134 /* Descriptive name of these models */
 135 const char* model_names[] = {
 136     [MODEL_FUZE]    = "Fuze",
 137     [MODEL_CLIP]    = "Clip",
 138     [MODEL_CLIPV2]  = "Clip",
 139     [MODEL_CLIPPLUS]= "Clip+",
 140     [MODEL_E200V2]  = "e200",
 141     [MODEL_M200V4]  = "m200",
 142     [MODEL_C200V2]  = "c200",
 143 };
 144
 145 /* Dualboot functions for these models */
 146 static const unsigned char* bootloaders[] = {
 147     [MODEL_FUZE]    = dualboot_fuze,
 148     [MODEL_CLIP]    = dualboot_clip,
 149     [MODEL_CLIPV2]  = dualboot_clipv2,
 150     [MODEL_E200V2]  = dualboot_e200v2,
 151     [MODEL_M200V4]  = dualboot_m200v4,
 152     [MODEL_C200V2]  = dualboot_c200v2,
 153     [MODEL_CLIPPLUS]= dualboot_clipplus,
 154 };
 155
 156 /* Size of dualboot functions for these models */
 157 const int bootloader_sizes[] = {
 158     [MODEL_FUZE]    = sizeof(dualboot_fuze),
 159     [MODEL_CLIP]    = sizeof(dualboot_clip),
 160     [MODEL_CLIPV2]  = sizeof(dualboot_clipv2),
 161     [MODEL_E200V2]  = sizeof(dualboot_e200v2),
 162     [MODEL_M200V4]  = sizeof(dualboot_m200v4),
 163     [MODEL_C200V2]  = sizeof(dualboot_c200v2),
 164     [MODEL_CLIPPLUS]= sizeof(dualboot_clipplus),
 165 };
 166
 167 /* Model names used in the Rockbox header in ".sansa" files - these match the
 168    -add parameter to the "scramble" tool */
 169 static const char* rb_model_names[] = {
 170     [MODEL_FUZE]    = "fuze",
 171     [MODEL_CLIP]    = "clip",
 172     [MODEL_CLIPV2]  = "clv2",
 173     [MODEL_E200V2]  = "e2v2",
 174     [MODEL_M200V4]  = "m2v4",
 175     [MODEL_C200V2]  = "c2v2",
 176     [MODEL_CLIPPLUS]= "cli+",
 177 };
 178
 179 /* Model numbers used to initialise the checksum in the Rockbox header in
 180    ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
 181 static const int rb_model_num[] = {
 182     [MODEL_FUZE]    = 43,
 183     [MODEL_CLIP]    = 40,
 184     [MODEL_CLIPV2]  = 60,
 185     [MODEL_E200V2]  = 41,
 186     [MODEL_M200V4]  = 42,
 187     [MODEL_C200V2]  = 44,
 188     [MODEL_CLIPPLUS]= 66,
 189 };
 190
 191 /* Checksums of unmodified original firmwares - for safety, and device
 192    detection */
 193 static struct md5sums sansasums[] = {
 194     /* NOTE: Different regional versions of the firmware normally only
 195              differ in the filename - the md5sums are identical */
 196
 197     /*   model       version    md5                        */
 198     { MODEL_E200V2, "3.01.11", "e622ca8cb6df423f54b8b39628a1f0a3" },
 199     { MODEL_E200V2, "3.01.14", "2c1d0383fc3584b2cc83ba8cc2243af6" },
 200     { MODEL_E200V2, "3.01.16", "12563ad71b25a1034cf2092d1e0218c4" },
 201
 202     { MODEL_FUZE,   "1.01.11", "cac8ffa03c599330ac02c4d41de66166" },
 203     { MODEL_FUZE,   "1.01.15", "df0e2c1612727f722c19a3c764cff7f2" },
 204     { MODEL_FUZE,   "1.01.22", "5aff5486fe8dd64239cc71eac470af98" },
 205     { MODEL_FUZE,   "1.02.26", "7c632c479461c48c8833baed74eb5e4f" },
 206     { MODEL_FUZE,   "1.02.28", "5b34260f6470e75f702a9c6825471752" },
 207     { MODEL_FUZE,   "1.02.31", "66d01b37462a5ef7ccc6ad37188b4235" },
 208
 209     { MODEL_C200V2, "3.02.05", "b6378ebd720b0ade3fad4dc7ab61c1a5" },
 210
 211     { MODEL_M200V4, "4.00.45", "82e3194310d1514e3bbcd06e84c4add3" },
 212     { MODEL_M200V4, "4.01.08-A", "fc9dd6116001b3e6a150b898f1b091f0" },
 213     { MODEL_M200V4, "4.01.08-E", "d3fb7d8ec8624ee65bc99f8dab0e2369" },
 214
 215     { MODEL_CLIP,   "1.01.17", "12caad785d506219d73f538772afd99e" },
 216     { MODEL_CLIP,   "1.01.18", "d720b266bd5afa38a198986ef0508a45" },
 217     { MODEL_CLIP,   "1.01.20", "236d8f75189f468462c03f6d292cf2ac" },
 218     { MODEL_CLIP,   "1.01.29", "c12711342169c66e209540cd1f27cd26" },
 219     { MODEL_CLIP,   "1.01.30", "f2974d47c536549c9d8259170f1dbe4d" },
 220     { MODEL_CLIP,   "1.01.32", "d835d12342500732ffb9c4ee54abec15" },
 221
 222     { MODEL_CLIPV2, "2.01.16", "c57fb3fcbe07c2c9b360f060938f80cb" },
 223     { MODEL_CLIPV2, "2.01.32", "0ad3723e52022509089d938d0fbbf8c5" },
 224
 225     { MODEL_CLIPPLUS, "01.02.09", "656d38114774c2001dc18e6726df3c5d" },
 226 };
 227
 228 #define NUM_MD5S (sizeof(sansasums)/sizeof(sansasums[0]))
 229
 230 int firmware_revision(int model)
 231 {
 232     return fw_revisions[model];
 233 }
 234
 235 static off_t filesize(int fd)
 236 {
 237     struct stat buf;
 238
 239     if (fstat(fd, &buf) < 0) {
 240         perror("[ERR]  Checking filesize of input file");
 241         return -1;
 242     } else {
 243         return(buf.st_size);
 244     }
 245 }
 246
 247 static uint32_t get_uint32le(unsigned char* p)
 248 {
 249     return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 250 }
 251
 252 static uint32_t get_uint32be(unsigned char* p)
 253 {
 254     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 255 }
 256
 257 static void put_uint32le(unsigned char* p, uint32_t x)
 258 {
 259     p[0] = x & 0xff;
 260     p[1] = (x >> 8) & 0xff;
 261     p[2] = (x >> 16) & 0xff;
 262     p[3] = (x >> 24) & 0xff;
 263 }
 264
 265 void calc_MD5(unsigned char* buf, int len, char *md5str)
 266 {
 267     int i;
 268     md5_context ctx;
 269     unsigned char md5sum[16];
 270
 271     md5_starts(&ctx);
 272     md5_update(&ctx, buf, len);
 273     md5_finish(&ctx, md5sum);
 274
 275     for (i = 0; i < 16; ++i)
 276         sprintf(md5str + 2*i, "%02x", md5sum[i]);
 277 }
 278
 279 /* Calculate a simple checksum used in Sansa Original Firmwares */
 280 static uint32_t calc_checksum(unsigned char* buf, uint32_t n)
 281 {
 282     uint32_t sum = 0;
 283     uint32_t i;
 284
 285     for (i=0;i<n;i+=4)
 286         sum += get_uint32le(buf + i);
 287
 288     return sum;
 289 }
 290
 291 static int get_model(int model_id)
 292 {
 293     switch(model_id) {
 294         case 0x1e:
 295             return MODEL_FUZE;
 296         case 0x22:
 297             return MODEL_CLIP;
 298         case 0x23:
 299             return MODEL_C200V2;
 300         case 0x24:
 301             return MODEL_E200V2;
 302         case 0x25:
 303             return MODEL_M200V4;
 304         case 0x27:
 305             return MODEL_CLIPV2;
 306         case 0x28:
 307             return MODEL_CLIPPLUS;
 308     }
 309
 310     return MODEL_UNKNOWN;
 311 }
 312
 313 /* Compress using nrv2e algorithm : Thumb decompressor fits in 168 bytes ! */
 314 static unsigned char* uclpack(unsigned char* inbuf, int insize, int* outsize)
 315 {
 316     int maxsize;
 317     unsigned char* outbuf;
 318     int r;
 319
 320     /* The following formula comes from the UCL documentation */
 321     maxsize = insize + (insize / 8) + 256;
 322
 323     /* Allocate some memory for the output buffer */
 324     outbuf = malloc(maxsize);
 325
 326     if (outbuf == NULL)
 327         return NULL;
 328
 329     r = ucl_nrv2e_99_compress(
 330             (const ucl_bytep) inbuf,
 331             (ucl_uint) insize,
 332             (ucl_bytep) outbuf,
 333             (ucl_uintp) outsize,
 334             0, 10, NULL, NULL);
 335
 336     if (r != UCL_E_OK || *outsize > maxsize) {
 337         /* this should NEVER happen, and implies memory corruption */
 338         fprintf(stderr, "internal error - compression failed: %d\n", r);
 339         free(outbuf);
 340         return NULL;
 341     }
 342
 343     return outbuf;
 344 }
 345
 346 #define ERROR(format, ...) \
 347     do { \
 348         snprintf(errstr, errstrsize, format, __VA_ARGS__); \
 349         goto error; \
 350     } while(0)
 351
 352 /* Loads a Sansa AMS Original Firmware file into memory */
 353 unsigned char* load_of_file(
 354         char* filename, off_t* bufsize, struct md5sums *sum,
 355         int* firmware_size, unsigned char** of_packed,
 356         int* of_packedsize, char* errstr, int errstrsize)
 357 {
 358     int fd;
 359     unsigned char* buf =NULL;
 360     off_t n;
 361     unsigned int i=0;
 362     uint32_t checksum;
 363     int model_id;
 364     unsigned int last_word;
 365
 366     fd = open(filename, O_RDONLY|O_BINARY);
 367     if (fd < 0)
 368         ERROR("[ERR]  Could not open %s for reading\n", filename);
 369
 370     *bufsize = filesize(fd);
 371
 372     buf = malloc(*bufsize);
 373     if (buf == NULL)
 374         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 375
 376     n = read(fd, buf, *bufsize);
 377
 378     if (n != *bufsize)
 379         ERROR("[ERR]  Could not read file %s\n", filename);
 380
 381     /* check the file */
 382
 383     /* Calculate MD5 checksum of OF */
 384     calc_MD5(buf, *bufsize, sum->md5);
 385
 386     while ((i < NUM_MD5S) && (strcmp(sansasums[i].md5, sum->md5) != 0))
 387         i++;
 388
 389     if (i < NUM_MD5S) {
 390         *sum = sansasums[i];
 391     } else {
 392         int fw_version = (get_uint32le(&buf[0x204]) == 0x0000f000) ? 2 : 1;
 393         model_id = buf[(fw_version == 2) ? 0x219 : 0x215];
 394         sum->model = get_model(model_id);
 395
 396         if (sum->model == MODEL_UNKNOWN)
 397             ERROR("[ERR]  Unknown firmware model (v%d) - model id 0x%02x\n",
 398                   fw_version, model_id);
 399
 400 #if 1   /* comment to test new OFs */
 401         char tested_versions[100];
 402         tested_versions[0] = '\0';
 403
 404         for (i = 0; i < NUM_MD5S ; i++)
 405             if (sansasums[i].model == sum->model) {
 406                 if (tested_versions[0] != '\0') {
 407                     strncat(tested_versions, ", ",
 408                         sizeof(tested_versions) - strlen(tested_versions) - 1);
 409                 }
 410                 strncat(tested_versions, sansasums[i].version,
 411                     sizeof(tested_versions) - strlen(tested_versions) - 1);
 412             }
 413
 414         ERROR("[ERR]  Original firmware unknown, please try an other version." \
 415               " Tested %s versions are : %s\n",
 416               model_names[sum->model], tested_versions);
 417 #endif
 418     }
 419
 420     /* TODO: Do some more sanity checks on the OF image. Some images (like
 421        m200v4) dont have a checksum at the end, only padding (0xdeadbeef). */
 422     last_word = *bufsize - 4;
 423     checksum = get_uint32le(buf + last_word);
 424     if (checksum != 0xefbeadde && checksum != calc_checksum(buf, last_word))
 425         ERROR("%s", "[ERR]  Whole file checksum failed\n");
 426
 427     if (bootloaders[sum->model] == NULL)
 428         ERROR("[ERR]  Unsupported model - \"%s\"\n", model_names[sum->model]);
 429
 430     /* Get the firmware size */
 431     if (fw_revisions[sum->model] == 1)
 432         *firmware_size = get_uint32le(&buf[0x0c]);
 433     else if (fw_revisions[sum->model] == 2)
 434         *firmware_size = get_uint32le(&buf[0x10]);
 435
 436     /* Compress the original firmware image */
 437     *of_packed = uclpack(buf + 0x400, *firmware_size, of_packedsize);
 438     if (*of_packed == NULL)
 439         ERROR("[ERR]  Could not compress %s\n", filename);
 440
 441     return buf;
 442
 443 error:
 444     free(buf);
 445     return NULL;
 446 }
 447
 448 /* Loads a rockbox bootloader file into memory */
 449 unsigned char* load_rockbox_file(
 450             char* filename, int model, int* bufsize, int* rb_packedsize,
 451             char* errstr, int errstrsize)
 452 {
 453     int fd;
 454     unsigned char* buf = NULL;
 455     unsigned char* packed = NULL;
 456     unsigned char header[8];
 457     uint32_t sum;
 458     off_t n;
 459     int i;
 460
 461     fd = open(filename, O_RDONLY|O_BINARY);
 462     if (fd < 0)
 463         ERROR("[ERR]  Could not open %s for reading\n", filename);
 464
 465     /* Read Rockbox header */
 466     n = read(fd, header, sizeof(header));
 467     if (n != sizeof(header))
 468         ERROR("[ERR]  Could not read file %s\n", filename);
 469
 470     /* Check for correct model string */
 471     if (memcmp(rb_model_names[model], header + 4, 4)!=0)
 472         ERROR("[ERR]  Model name \"%s\" not found in %s\n",
 473                        rb_model_names[model], filename);
 474
 475     *bufsize = filesize(fd) - sizeof(header);
 476
 477     buf = malloc(*bufsize);
 478     if (buf == NULL)
 479         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 480
 481     n = read(fd, buf, *bufsize);
 482
 483     if (n != *bufsize)
 484         ERROR("[ERR]  Could not read file %s\n", filename);
 485
 486     /* Check checksum */
 487     sum = rb_model_num[model];
 488     for (i = 0; i < *bufsize; i++) {
 489          /* add 8 unsigned bits but keep a 32 bit sum */
 490          sum += buf[i];
 491     }
 492
 493     if (sum != get_uint32be(header))
 494         ERROR("[ERR]  Checksum mismatch in %s\n", filename);
 495
 496     packed = uclpack(buf, *bufsize, rb_packedsize);
 497     if(packed == NULL)
 498         ERROR("[ERR]  Could not compress %s\n", filename);
 499
 500     free(buf);
 501     return packed;
 502
 503 error:
 504     free(buf);
 505     return NULL;
 506 }
 507
 508 #undef ERROR
 509
 510 /* Patches a Sansa AMS Original Firmware file */
 511 void patch_firmware(
 512         int model, int fw_revision, int firmware_size, unsigned char* buf,
 513         int len, unsigned char* of_packed, int of_packedsize,
 514         unsigned char* rb_packed, int rb_packedsize)
 515 {
 516     unsigned char *p;
 517     uint32_t sum, filesum;
 518     unsigned int i;
 519
 520     /* Zero the original firmware area - not needed, but helps debugging */
 521     memset(buf + 0x400, 0, firmware_size);
 522
 523     /* Insert dual-boot bootloader at offset 0 */
 524     memcpy(buf + 0x400, bootloaders[model], bootloader_sizes[model]);
 525
 526     /* We are filling the firmware buffer backwards from the end */
 527     p = buf + 0x400 + firmware_size;
 528
 529     /* 1 - UCL unpack function */
 530     p -= sizeof(nrv2e_d8);
 531     memcpy(p, nrv2e_d8, sizeof(nrv2e_d8));
 532
 533     /* 2 - Compressed copy of original firmware */
 534     p -= of_packedsize;
 535     memcpy(p, of_packed, of_packedsize);
 536
 537     /* 3 - Compressed copy of Rockbox bootloader */
 538     p -= rb_packedsize;
 539     memcpy(p, rb_packed, rb_packedsize);
 540
 541     /* Write the locations of the various images to the variables at the
 542        start of the dualboot image - we save the location of the last byte
 543        in each image, along with the size in bytes */
 544
 545     /* UCL unpack function */
 546     put_uint32le(&buf[0x420], firmware_size - 1);
 547     put_uint32le(&buf[0x424], sizeof(nrv2e_d8));
 548
 549     /* Compressed original firmware image */
 550     put_uint32le(&buf[0x428], firmware_size - sizeof(nrv2e_d8) - 1);
 551     put_uint32le(&buf[0x42c], of_packedsize);
 552
 553     /* Compressed Rockbox image */
 554     put_uint32le(&buf[0x430], firmware_size - sizeof(nrv2e_d8) - of_packedsize
 555             - 1);
 556     put_uint32le(&buf[0x434], rb_packedsize);
 557
 558
 559     /* Update the firmware block checksum */
 560     sum = calc_checksum(buf + 0x400, firmware_size);
 561
 562     if (fw_revision == 1) {
 563         put_uint32le(&buf[0x04], sum);
 564         put_uint32le(&buf[0x204], sum);
 565     } else if (fw_revision == 2) {
 566         put_uint32le(&buf[0x08], sum);
 567         put_uint32le(&buf[0x208], sum);
 568
 569         /* Update the header checksums */
 570         put_uint32le(&buf[0x1fc], calc_checksum(buf, 0x1fc));
 571         put_uint32le(&buf[0x3fc], calc_checksum(buf + 0x200, 0x1fc));
 572     }
 573
 574     /* Update the whole-file checksum */
 575     filesum = 0;
 576     for (i=0;i < (unsigned)len - 4; i+=4)
 577         filesum += get_uint32le(&buf[i]);
 578
 579     put_uint32le(buf + len - 4, filesum);
 580 }
 581
 582 /* returns size of new firmware block */
 583 int total_size(int model, int rb_packedsize, int of_packedsize)
 584 {
 585     return bootloader_sizes[model] + sizeof(nrv2e_d8) + of_packedsize +
 586                 rb_packedsize;
 587 }
 588