14 #define MIN(a,b) ((a) < (b) ? (a) : (b))
17 #define cprintf(col, ...) do {color(col); printf(__VA_ARGS__); }while(0)
19 #define cprintf_field(str1, ...) do{ cprintf(GREEN, str1); cprintf(YELLOW, __VA_ARGS__); }while(0)
22 char *g_out_prefix
= NULL
;
23 char *g_in_file
= NULL
;
26 #define let_the_force_flow(x) do { if(!g_force) return x; } while(0)
27 #define continue_the_force(x) if(x) let_the_force_flow(x)
29 #define check_field(v_exp, v_have, str_ok, str_bad) \
30 if((v_exp) != (v_have)) \
31 { cprintf(RED, str_bad); let_the_force_flow(__LINE__); } \
32 else { cprintf(RED, str_ok); }
34 static void print_hex(void *p
, int size
, int unit
)
39 for(int i
= 0; i
< size
; i
+= unit
, p8
++, p16
++, p32
++)
41 if(i
!= 0 && (i
% 16) == 0)
46 printf(" %04x", *p16
);
48 printf(" %08x", *p32
);
56 #define FWU_SIG_SIZE 16
57 #define FWU_BLOCK_SIZE 512
61 uint8_t sig
[FWU_SIG_SIZE
];
63 uint32_t block_size
;// always 512
66 uint8_t sig2
[FWU_SIG_SIZE
];
67 } __attribute__((packed
));
69 const uint8_t g_fwu_signature
[FWU_SIG_SIZE
] =
71 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x75
79 uint8_t sig2
[FWU_SIG_SIZE
];
82 struct version_desc_t g_version
[] =
84 { 1, 0xd, 0xd0, { 0x76, 0x5c, 0x50, 0x94, 0x69, 0xb0, 0xa7, 0x03, 0x10, 0xf1, 0x7e, 0xdb, 0x88, 0x90, 0x86, 0x9d } },
85 { 1, 0xe, 0xd0, { 0x92, 0x22, 0x7a, 0x77, 0x08, 0x67, 0xae, 0x06, 0x16, 0x06, 0xb8, 0x65, 0xa6, 0x42, 0xf7, 0X52 } },
86 { 3, 0x7e, 0xe1, { 0x3f, 0xad, 0xf8, 0xb0, 0x2e, 0xaf, 0x67, 0x49, 0xb9, 0x85, 0x5f, 0x63, 0x4e, 0x5e, 0x8e, 0x2e } },
89 #define NR_VERSIONS (int)(sizeof(g_version)/sizeof(g_version[0]))
91 typedef struct ptr_bundle_t
103 uint32_t *ptr6
; // size
104 uint32_t *ptr7
; // size
105 uint32_t *ptr5
; // size
109 uint32_t *ptr3
; // size
110 uint32_t *ptr4
; // size
124 struct block_A_info_t g_decode_A_info
;
125 uint8_t g_subblock_A
[0x128];
127 uint8_t g_perm_B
[258];
128 uint8_t g_crypto_info_byte
;
129 uint8_t *g_decode_buffer
;
130 uint8_t *g_decode_buffer2
;
131 void *g_decode_buffer3
;
133 #include "atj_tables.h"
135 void compute_checksum(uint8_t *buf
, int size
, uint8_t t
[20])
139 for(int i
= 0; i
< size
; i
++)
141 for(int i
= 0; i
< 20; i
++)
145 int check_block(uint8_t *buf
, uint8_t ref
[20], unsigned size
)
148 compute_checksum(buf
, size
, t
);
150 return memcmp(ref
, t
, 20);
154 int get_version(uint8_t *buf
, unsigned long size
)
157 struct fwu_hdr_t
*hdr
= (void *)buf
;
158 for(int i
= 0; i
< NR_VERSIONS
; i
++)
159 if(hdr
->version
== g_version
[i
].value
)
164 static int decode_block_A(uint8_t block
[1020])
166 uint8_t *p
= &g_check_block_A_table
[32 * (block
[998] & 0x1f)];
169 for(int i
= 0; i
< 20; i
++)
171 block
[1000 + i
] ^= p
[i
];
172 key
[i
] = block
[1000 + i
];
174 for(int i
= 20; i
< 32; i
++)
175 key
[i
] = key
[i
- 20];
177 for(int i
= 0; i
< 992; i
++)
178 block
[i
] ^= key
[i
% 32] ^ g_check_block_A_table
[i
];
180 return check_block(block
- 1, block
+ 1000, 1001);
183 static void compute_perm(uint8_t *keybuf
, int size
, uint8_t perm
[258])
185 for(int i
= 0; i
< 256; i
++)
187 perm
[256] = perm
[257] = 0;
189 for(int i
= 0; i
< 256; i
++)
192 idx
= (v
+ keybuf
[i
% size
] + idx
) % 256;
198 static void decode_perm(uint8_t *buf
, int size
, uint8_t perm
[258])
200 uint8_t idxa
= perm
[256];
201 uint8_t idxb
= perm
[257];
202 for(int i
= 0; i
< size
; i
++)
204 idxa
= (idxa
+ 1) % 256;
205 uint8_t v
= perm
[idxa
];
206 idxb
= (idxb
+ v
) % 256;
207 perm
[idxa
] = perm
[idxb
];
209 buf
[i
] ^= perm
[(v
+ perm
[idxa
]) % 256];
213 static void decode_block_with_perm(uint8_t *keybuf
, int keysize
,
214 uint8_t *buf
, int bufsize
, uint8_t perm
[258])
216 compute_perm(keybuf
, keysize
, perm
);
217 decode_perm(buf
, bufsize
, perm
);
220 static void apply_perm(uint8_t *inbuf
, uint8_t *outbuf
, int size
, int swap
)
222 memcpy(outbuf
, inbuf
, size
);
224 int b
= (swap
>> 4) + 16;
225 uint8_t v
= outbuf
[a
];
226 outbuf
[a
] = outbuf
[b
];
230 static void decode_block_with_swap(uint8_t keybuf
[32], int swap
,
231 uint8_t *buf
, int bufsize
, uint8_t perm
[258])
233 uint8_t keybuf_interm
[32];
235 apply_perm(keybuf
, keybuf_interm
, 32, swap
);
236 decode_block_with_perm(keybuf_interm
, 32, buf
, bufsize
, perm
);
239 static void clear_memory(void *buf
, int size_dwords
)
241 memset(buf
, 0, 4 * size_dwords
);
244 static void set_bit(int bit_pos
, uint32_t *buf
)
246 buf
[bit_pos
/ 32] |= 1 << (bit_pos
% 32);
249 static int fill_decode_info(uint8_t sz
)
251 if(sz
== 2) sz
= 233;
252 else if(sz
== 3) sz
= 163;
255 g_decode_A_info
.nr_bits
= sz
;
256 g_decode_A_info
.nr_bytes2
= sz
/ 8 + (sz
% 8 != 0);
257 g_decode_A_info
.nr_words
= 2 * g_decode_A_info
.nr_bytes2
;
258 g_decode_A_info
.nr_bytes
= sz
/ 8 + (sz
% 8 != 0);
259 g_decode_A_info
.nr_words2
= 2 * g_decode_A_info
.nr_bytes2
;
260 g_decode_A_info
.nr_dwords
= sz
/ 32 + (sz
% 32 != 0);
261 g_decode_A_info
.size
= 4 * g_decode_A_info
.nr_dwords
;
262 g_decode_A_info
.nr_dwords_x8
= 8 * g_decode_A_info
.nr_dwords
;
263 g_decode_A_info
.nr_dwords_m1
= g_decode_A_info
.nr_dwords
- 1;
264 g_decode_A_info
.nr_dwords_x2
= 2 * g_decode_A_info
.nr_dwords
;
265 g_decode_A_info
.nr_dwords_x2_m1
= g_decode_A_info
.nr_dwords_x2
- 1;
266 g_decode_A_info
.nr_dwords_x12
= 12 * g_decode_A_info
.nr_dwords
;
267 g_decode_A_info
.ptr1
.ptrA
= malloc(4 * g_decode_A_info
.nr_dwords
);
268 g_decode_A_info
.ptr1
.ptrB
= malloc(g_decode_A_info
.size
);
269 g_decode_A_info
.ptr3
= malloc(g_decode_A_info
.size
);
270 g_decode_A_info
.ptr4
= malloc(g_decode_A_info
.size
);
271 g_decode_A_info
.ptr5
= malloc(g_decode_A_info
.size
);
272 g_decode_A_info
.ptr6
= malloc(g_decode_A_info
.size
);
273 g_decode_A_info
.ptr7
= malloc(g_decode_A_info
.size
);
275 cprintf(BLUE
, " Decode Info:\n");
276 cprintf_field(" Nr Bits: ", "%d\n", g_decode_A_info
.nr_bits
);
277 cprintf_field(" Nr Bytes: ", "%d\n", g_decode_A_info
.nr_bytes
);
278 cprintf_field(" Nr Bytes 2: ", "%d\n", g_decode_A_info
.nr_bytes2
);
279 cprintf_field(" Nr Words: ", "%d\n", g_decode_A_info
.nr_words
);
280 cprintf_field(" Nr Words 2: ", "%d\n", g_decode_A_info
.nr_words2
);
281 cprintf_field(" Nr DWords: ", "%d\n", g_decode_A_info
.nr_dwords
);
282 cprintf_field(" Size: ", "%d\n", g_decode_A_info
.size
);
287 static int process_block_A(uint8_t block
[1024])
289 cprintf(BLUE
, "Block A\n");
290 int ret
= decode_block_A(block
+ 4);
291 cprintf(GREEN
, " Check: ");
292 check_field(ret
, 0, "Pass\n", "Fail\n");
294 memcpy(g_subblock_A
, block
, sizeof(g_subblock_A
));
295 ret
= fill_decode_info(g_subblock_A
[276]);
296 cprintf(GREEN
, " Info: ");
297 check_field(ret
, 0, "Pass\n", "Fail\n");
299 int tmp
= 2 * g_decode_A_info
.nr_bytes2
+ 38;
300 int offset
= 1004 - tmp
+ 5;
301 g_crypto_info_byte
= block
[offset
- 1];
302 g_decode_buffer
= malloc(g_decode_A_info
.size
);
303 g_decode_buffer2
= malloc(g_decode_A_info
.size
);
305 memset(g_decode_buffer
, 0, g_decode_A_info
.size
);
306 memset(g_decode_buffer2
, 0, g_decode_A_info
.size
);
308 memcpy(g_decode_buffer
, &block
[offset
], g_decode_A_info
.nr_bytes2
);
309 int offset2
= g_decode_A_info
.nr_bytes2
+ offset
;
310 memcpy(g_decode_buffer2
, &block
[offset2
], g_decode_A_info
.nr_bytes2
);
313 cprintf_field(" Word: ", "%d ", *(uint16_t *)&g_subblock_A
[286]);
314 check_field(*(uint16_t *)&g_subblock_A
[286], 1, "Ok\n", "Mismatch\n");
319 static void decode_key_B(uint8_t buf
[20], uint8_t buf2
[16], uint8_t key
[20])
321 for(int i
= 0; i
< 20; i
++)
323 uint8_t v
= buf
[i
] ^ g_decode_B_table
[i
];
325 buf
[i
] = v
^ buf2
[i
% 16];
329 static void decode_block_B(uint8_t *buf
, uint8_t key
[16], int size
)
331 decode_key_B(&buf
[size
], key
, g_key_B
);
332 decode_block_with_perm(g_key_B
, 20, buf
, size
, g_perm_B
);
335 static int find_last_bit_set(uint32_t *buf
, bool a
)
337 int i
= a
? g_decode_A_info
.nr_dwords_m1
: g_decode_A_info
.nr_dwords_x2_m1
;
339 while(i
>= 0 && buf
[i
] == 0)
343 for(int j
= 31; j
>= 0; j
--)
344 if(buf
[i
] & (1 << j
))
346 return -1; // unreachable
349 static void xor_with_ptrs(uint8_t *buf
, ptr_bundle_t
*ptrs
)
352 int sz = g_decode_A_info.nr_bytes2 - 1;
355 for(int i = 0; i < sz; i++)
356 buf[i] ^= ptrs->ptrA[i];
357 for(int i = sz; i < 32; i++)
358 buf[i] ^= ptrs->ptrB[i - sz];
361 for(int i = 0; i < 32; i++)
362 buf[i] ^= ptrs->ptrA[i];
364 uint8_t *ptrA
= (uint8_t *)ptrs
->ptrA
;
365 uint8_t *ptrB
= (uint8_t *)ptrs
->ptrB
;
366 int sz
= MIN(g_decode_A_info
.nr_bytes2
- 1, 32);
367 for(int i
= 0; i
< sz
; i
++)
369 for(int i
= sz
; i
< 32; i
++)
370 buf
[i
] ^= ptrB
[i
- sz
];
373 static void copy_memory(uint32_t *to
, uint32_t *from
)
375 for(int i
= 0; i
< g_decode_A_info
.nr_dwords
; i
++)
379 static void swap_memory(uint32_t *a
, uint32_t *b
)
381 for(int i
= 0; i
< g_decode_A_info
.nr_dwords
; i
++)
389 static void shift_left(uint32_t *buf
, int nr_bits
)
391 for(int i
= g_decode_A_info
.nr_dwords_m1
; i
>= 0; i
--)
392 buf
[i
+ (nr_bits
/ 32)] = buf
[i
];
393 memset(buf
, 0, 4 * (nr_bits
/ 32));
395 int size
= g_decode_A_info
.nr_dwords
+ (nr_bits
+ 31) / 32;
396 nr_bits
= nr_bits
% 32;
399 for(int i
= 0; i
< size
; i
++)
401 uint32_t new_val
= buf
[i
] << nr_bits
| acc
;
402 /* WARNING if nr_bits = 0 then the right shift by 32 is undefined and so
403 * the following code could break. The additional AND catches this case
404 * and make sure the result is 0 */
405 acc
= ((1 << nr_bits
) - 1) & (buf
[i
] >> (32 - nr_bits
));
410 static void xor_big(uint32_t *res
, uint32_t *a
, uint32_t *b
)
412 for(int i
= 0; i
< g_decode_A_info
.nr_dwords_x2
; i
++)
413 res
[i
] = a
[i
] ^ b
[i
];
416 static void decode_with_xor(uint32_t *res
, uint32_t *key
)
418 uint32_t *tmp
= malloc(g_decode_A_info
.nr_dwords_x8
);
419 uint32_t *copy
= malloc(g_decode_A_info
.nr_dwords_x8
);
420 uint32_t *copy_arg
= malloc(g_decode_A_info
.nr_dwords_x8
);
421 uint32_t *tmp2
= malloc(g_decode_A_info
.nr_dwords_x8
);
422 clear_memory(tmp
, g_decode_A_info
.nr_dwords_x2
);
423 clear_memory(res
, g_decode_A_info
.nr_dwords
);
425 clear_memory(tmp2
, g_decode_A_info
.nr_dwords
);
426 copy_memory(copy_arg
, key
);
427 copy_memory(copy
, (uint32_t *)g_decode_A_info
.ptr5
);
429 for(int i
= find_last_bit_set(copy_arg
, 1); i
; i
= find_last_bit_set(copy_arg
, 1))
431 int pos
= i
- find_last_bit_set(copy
, 1);
434 swap_memory(copy_arg
, copy
);
435 swap_memory(res
, tmp2
);
438 copy_memory(tmp
, copy
);
439 shift_left(tmp
, pos
);
440 xor_big(copy_arg
, copy_arg
, tmp
);
441 copy_memory(tmp
, tmp2
);
442 shift_left(tmp
, pos
);
443 xor_big(res
, res
, tmp
);
451 static void shift_left_one(uint32_t *a
)
453 int pos
= find_last_bit_set(a
, 0) / 32 + 1;
457 for(int i
= 0; i
< pos
; i
++)
459 uint32_t new_val
= v
| a
[i
] << 1;
469 static void xor_mult(uint32_t *a1
, uint32_t *a2
, uint32_t *a3
)
471 uint32_t *tmp2
= malloc(g_decode_A_info
.nr_dwords_x8
);
472 clear_memory(tmp2
, g_decode_A_info
.nr_dwords_x2
);
473 copy_memory(tmp2
, a3
);
475 int pos
= g_decode_A_info
.nr_dwords
;
477 for(int i
= 0; i
< 32; i
++)
479 for(int j
= 0; j
< g_decode_A_info
.nr_dwords
; j
++)
482 for(int k
= 0; k
< pos
; k
++)
483 a1
[j
+ k
] ^= tmp2
[k
];
485 shift_left_one(tmp2
);
487 pos
= find_last_bit_set(tmp2
, 0) / 32 + 1;
492 static void xor_mult(uint32_t *a1
, uint32_t *a2
, uint32_t *a3
)
494 for(int i
= 0; i
< 32 * g_decode_A_info
.nr_dwords
; i
++)
495 for(int j
= 0; j
< 32 * g_decode_A_info
.nr_dwords
; j
++)
498 uint32_t v1
= (a2
[i
/ 32] >> (i
% 32)) & 1;
499 uint32_t v2
= (a3
[j
/ 32] >> (j
% 32)) & 1;
500 a1
[k
/ 32] ^= (v1
* v2
) << (k
% 32);
505 static int compare(uint32_t *a
, uint32_t *b
)
507 return memcmp(a
, b
, g_decode_A_info
.nr_dwords
* 4);
510 static void xor_mult_high(uint32_t *a1
, uint32_t *buf
, uint32_t *a3
)
513 uint32_t *tmp
= malloc(g_decode_A_info
.nr_dwords_x8
);
514 int v4
= g_decode_A_info
.field_34
;
515 int pos
= find_last_bit_set(buf
, 0);
516 for(int i
= pos
- v4
; i
>= 0; i
= find_last_bit_set(buf
, 0) - v4
)
518 clear_memory(tmp
, g_decode_A_info
.nr_dwords_x2
);
519 copy_memory(tmp
, a3
);
521 xor_big(buf
, buf
, tmp
);
526 static void xor_small(uint32_t *res
, uint32_t *a
, uint32_t *b
)
528 for(int i
= 0; i
< g_decode_A_info
.nr_dwords
; i
++)
529 res
[i
] = a
[i
] ^ b
[i
];
532 static void crypto(ptr_bundle_t
*a1
, ptr_bundle_t
*a2
)
534 uint32_t *v2
= malloc(g_decode_A_info
.nr_dwords_x8
);
535 uint32_t *v3
= malloc(g_decode_A_info
.nr_dwords_x8
);
536 uint32_t *v4
= malloc(g_decode_A_info
.nr_dwords_x8
);
537 uint32_t *v5
= malloc(g_decode_A_info
.nr_dwords_x8
);
538 uint32_t *v6
= malloc(g_decode_A_info
.nr_dwords_x8
);
539 clear_memory(a2
->ptrA
, g_decode_A_info
.nr_dwords
);
540 clear_memory(a2
->ptrB
, g_decode_A_info
.nr_dwords
);
541 clear_memory(v3
, g_decode_A_info
.nr_dwords_x2
);
542 clear_memory(v6
, g_decode_A_info
.nr_dwords_x2
);
543 clear_memory(v4
, g_decode_A_info
.nr_dwords_x2
);
544 decode_with_xor(v4
, a1
->ptrA
);
545 clear_memory(v5
, g_decode_A_info
.nr_dwords_x2
);
547 xor_mult(v5
, v4
, a1
->ptrB
);
548 xor_mult_high(v5
, v5
, g_decode_A_info
.ptr5
);
549 xor_small(v2
, a1
->ptrA
, v5
);
550 xor_small(v4
, v2
, g_decode_A_info
.ptr6
);
551 clear_memory(v3
, g_decode_A_info
.nr_dwords_x2
);
552 xor_mult(v3
, v2
, v2
);
553 xor_mult_high(v3
, v3
, g_decode_A_info
.ptr5
);
554 xor_small(a2
->ptrA
, v4
, v3
);
555 clear_memory(v5
, g_decode_A_info
.nr_dwords_x2
);
556 xor_small(v4
, v2
, g_xor_key
);
557 xor_mult(v5
, v4
, a2
->ptrA
);
558 xor_mult_high(v5
, v5
, g_decode_A_info
.ptr5
);
559 clear_memory(v6
, g_decode_A_info
.nr_dwords_x2
);
560 xor_mult(v6
, a1
->ptrA
, a1
->ptrA
);
561 xor_mult_high(v6
, v6
, g_decode_A_info
.ptr5
);
562 xor_small(a2
->ptrB
, v5
, v6
);
570 static void crypto2(ptr_bundle_t
*a1
, ptr_bundle_t
*a2
, ptr_bundle_t
*a3
)
572 uint32_t *v3
= malloc(g_decode_A_info
.nr_dwords_x8
);
573 uint32_t *v4
= malloc(g_decode_A_info
.nr_dwords_x8
);
574 uint32_t *v5
= malloc(g_decode_A_info
.nr_dwords_x8
);
575 uint32_t *v6
= malloc(g_decode_A_info
.nr_dwords_x8
);
576 uint32_t *v7
= malloc(g_decode_A_info
.nr_dwords_x8
);
577 clear_memory(a3
->ptrA
, g_decode_A_info
.nr_dwords
);
578 clear_memory(a3
->ptrB
, g_decode_A_info
.nr_dwords
);
579 clear_memory(v4
, g_decode_A_info
.nr_dwords_x2
);
580 clear_memory(v7
, g_decode_A_info
.nr_dwords_x2
);
581 xor_small(v5
, a1
->ptrB
, a2
->ptrB
);
582 xor_small(v6
, a1
->ptrA
, a2
->ptrA
);
583 decode_with_xor(v7
, v6
);
584 clear_memory(v3
, g_decode_A_info
.nr_dwords_x2
);
585 xor_mult(v3
, v7
, v5
);
586 xor_mult_high(v3
, v3
, g_decode_A_info
.ptr5
);
587 xor_small(v5
, v3
, g_decode_A_info
.ptr6
);
588 clear_memory(v4
, g_decode_A_info
.nr_dwords_x2
);
589 xor_mult(v4
, v3
, v3
);
590 xor_mult_high(v4
, v4
, g_decode_A_info
.ptr5
);
591 xor_small(v7
, v5
, v4
);
592 xor_small(a3
->ptrA
, v7
, v6
);
593 xor_small(v5
, a1
->ptrA
, a3
->ptrA
);
594 xor_small(v6
, a3
->ptrA
, a1
->ptrB
);
595 clear_memory(v7
, g_decode_A_info
.nr_dwords_x2
);
596 xor_mult(v7
, v5
, v3
);
597 xor_mult_high(v7
, v7
, g_decode_A_info
.ptr5
);
598 xor_small(a3
->ptrB
, v7
, v6
);
606 static int crypto3(uint32_t *a1
, ptr_bundle_t
*ptrs_alt
, ptr_bundle_t
*ptrs
)
608 ptr_bundle_t ptrs_others
;
610 ptrs_others
.ptrA
= malloc(g_decode_A_info
.size
);
611 ptrs_others
.ptrB
= malloc(g_decode_A_info
.size
);
612 clear_memory(ptrs
->ptrA
, g_decode_A_info
.nr_dwords
);
613 clear_memory(ptrs
->ptrB
, g_decode_A_info
.nr_dwords
);
614 clear_memory(ptrs_others
.ptrA
, g_decode_A_info
.nr_dwords
);
615 clear_memory(ptrs_others
.ptrB
, g_decode_A_info
.nr_dwords
);
616 int pos
= find_last_bit_set(a1
, 1);
618 copy_memory(ptrs_others
.ptrA
, ptrs_alt
->ptrA
);
619 copy_memory(ptrs_others
.ptrB
, ptrs_alt
->ptrB
);
620 for(int bit
= (pos
% 32) - 1; bit
>= 0; bit
--)
622 crypto(&ptrs_others
, ptrs
);
623 copy_memory(ptrs_others
.ptrA
, ptrs
->ptrA
);
624 copy_memory(ptrs_others
.ptrB
, ptrs
->ptrB
);
625 if(a1
[pos
/ 32] & (1 << bit
))
627 crypto2(&ptrs_others
, ptrs_alt
, ptrs
);
628 copy_memory(ptrs_others
.ptrA
, ptrs
->ptrA
);
629 copy_memory(ptrs_others
.ptrB
, ptrs
->ptrB
);
632 for(int i
= pos
/ 32 - 1; i
>= 0; i
--)
634 for(int bit
= 31; bit
>= 0; bit
--)
636 crypto(&ptrs_others
, ptrs
);
637 copy_memory(ptrs_others
.ptrA
, ptrs
->ptrA
);
638 copy_memory(ptrs_others
.ptrB
, ptrs
->ptrB
);
639 if(a1
[i
] & (1 << bit
))
641 crypto2(&ptrs_others
, ptrs_alt
, ptrs
);
642 copy_memory(ptrs_others
.ptrA
, ptrs
->ptrA
);
643 copy_memory(ptrs_others
.ptrB
, ptrs
->ptrB
);
647 copy_memory(ptrs
->ptrA
, ptrs_others
.ptrA
);
648 copy_memory(ptrs
->ptrB
, ptrs_others
.ptrB
);
649 free(ptrs_others
.ptrA
);
650 free(ptrs_others
.ptrB
);
654 static int crypto4(uint8_t *a1
, ptr_bundle_t
*ptrs
, uint32_t *a3
)
656 ptr_bundle_t ptrs_others
;
658 ptrs_others
.ptrA
= malloc(g_decode_A_info
.size
);
659 ptrs_others
.ptrB
= malloc(g_decode_A_info
.size
);
660 clear_memory(ptrs_others
.ptrA
, g_decode_A_info
.nr_dwords
);
661 clear_memory(ptrs_others
.ptrB
, g_decode_A_info
.nr_dwords
);
662 int ret
= crypto3(a3
, ptrs
, &ptrs_others
);
664 xor_with_ptrs(a1
, &ptrs_others
);
665 free(ptrs_others
.ptrA
);
666 free(ptrs_others
.ptrB
);
670 static int crypto_bits(uint32_t *buf
, int a2
)
672 clear_memory(buf
, g_decode_A_info
.nr_dwords
);
673 g_decode_A_info
.field_34
= 0;
679 g_decode_A_info
.field_34
= 233;
689 g_decode_A_info
.field_34
= 163;
696 static int crypto_bits_copy(ptr_bundle_t
*a1
, char a2
)
698 int ret
= crypto_bits(g_decode_A_info
.ptr5
, a2
);
702 copy_memory(a1
->ptrA
, g_crypto_table
);
703 copy_memory(a1
->ptrB
, g_crypto_table2
);
704 copy_memory(g_decode_A_info
.ptr6
, g_crypto_data
);
705 copy_memory(g_decode_A_info
.ptr7
, g_crypto_key6
);
710 copy_memory(a1
->ptrA
, g_crypto_key3
);
711 copy_memory(a1
->ptrB
, g_crypto_key4
);
712 copy_memory(g_decode_A_info
.ptr6
, g_crypto_data3
);
713 copy_memory(g_decode_A_info
.ptr7
, g_crypto_key5
);
720 static void create_guid(void *uid
, int bit_size
)
723 for(int i
= 0; i
< bit_size
/ 8; i
++)
727 static int process_block_B(uint8_t block
[512])
729 cprintf(BLUE
, "Block B\n");
730 decode_block_B(block
+ 3, g_subblock_A
+ 4, 489);
731 cprintf_field(" Word: ", "%d ", *(uint16_t *)(block
+ 3));
732 check_field(*(uint16_t *)(block
+ 3), 1, "Ok\n", "Mismatch\n");
734 int ret
= check_block(block
, block
+ 492, 492);
735 cprintf(GREEN
, " Check: ");
736 check_field(ret
, 0, "Pass\n", "Fail\n");
738 g_decode_buffer3
= malloc(g_decode_A_info
.size
);
739 memset(g_decode_buffer3
, 0, g_decode_A_info
.size
);
740 int offset
= *(uint16_t *)(block
+ 13) + 16;
741 memcpy(g_decode_buffer3
, &block
[offset
], g_decode_A_info
.nr_bytes2
);
746 static int do_fwu_v3(int size
, uint8_t *buf
, uint8_t *blockA
, uint8_t *blockB
,
747 uint8_t *unk
, uint8_t *unk2
, uint8_t *blo
)
750 uint8_t smallblock
[512];
751 uint8_t bigblock
[1024];
753 memset(smallblock
, 0, sizeof(smallblock
));
754 memset(bigblock
, 0, sizeof(bigblock
));
756 uint8_t ba
= buf
[0x1ee] & 0xf;
757 uint8_t bb
= buf
[0x1fe] & 0xf;
759 cprintf_field(" Block A: ", "%d\n", ba
+ 2);
760 cprintf(" Block B: ", "%d\n", ba
+ bb
+ 5);
762 *blockA
= buf
[494] & 0xf;
763 *blockB
= buf
[510] & 0xf;
764 memcpy(bigblock
, &buf
[512 * (*blockA
+ 2)], sizeof(bigblock
));
766 int ret
= process_block_A(bigblock
);
767 continue_the_force(ret
);
769 memcpy(smallblock
, &buf
[512 * (*blockA
+ *blockB
+ 5)], sizeof(smallblock
));
770 ret
= process_block_B(smallblock
);
771 continue_the_force(ret
);
773 cprintf(BLUE
, "Main\n");
775 // WARNING you need more that 48 because 17+32 > 48 !! (see code below) */
776 uint8_t smallbuf
[50];
777 memcpy(smallbuf
, buf
+ 42, sizeof(smallbuf
));
778 cprintf_field(" Byte: ", "%d ", smallbuf
[16]);
779 check_field(smallbuf
[16], 3, "Ok\n", "Mismatch\n");
782 ptrs
.ptrA
= malloc(g_decode_A_info
.size
);
783 ptrs
.ptrB
= malloc(g_decode_A_info
.size
);
784 memset(ptrs
.ptrA
, 0, g_decode_A_info
.size
);
785 memset(ptrs
.ptrB
, 0, g_decode_A_info
.size
);
786 memcpy(ptrs
.ptrA
, buf
+ 91, g_decode_A_info
.nr_bytes2
);
787 memcpy(ptrs
.ptrB
, buf
+ 91 + g_decode_A_info
.nr_bytes2
, g_decode_A_info
.nr_bytes2
);
789 ret
= crypto_bits_copy(&g_decode_A_info
.ptr1
, g_crypto_info_byte
);
790 cprintf(GREEN
, " Crypto bits copy: ");
791 check_field(ret
, 0, "Pass\n", "Fail\n");
793 ret
= crypto4(smallbuf
+ 17, &ptrs
, g_decode_buffer3
);
794 cprintf(GREEN
, " Crypto 4: ");
795 check_field(ret
, 0, "Pass\n", "Fail\n");
797 memcpy(unk2
, &smallbuf
[17], 32);
798 int offset
= g_decode_A_info
.nr_words
+ 91;
800 decode_block_with_swap(unk2
, 0, &buf
[offset
], 512 - offset
, g_perm_B
);
802 int pos
= *(uint16_t *)&buf
[offset
];
803 cprintf_field(" Word: ", "%d ", pos
);
804 int tmp
= g_decode_A_info
.nr_words2
+ 199;
805 check_field(pos
, 510 - tmp
, "Ok\n", "Mismatch\n");
808 memcpy(midbuf
, &buf
[pos
+ offset
+ 2], sizeof(midbuf
));
810 cprintf_field(" Byte: ", "%d ", midbuf
[0]);
811 check_field(midbuf
[0], 2, "Ok\n", "Invalid\n");
812 cprintf_field(" DWord: ", "%d ", *(uint32_t *)&midbuf
[1]);
813 check_field(*(uint32_t *)&midbuf
[1], 2056, "Ok\n", "Invalid\n");
814 cprintf_field(" DWord: ", "%d ", *(uint32_t *)&midbuf
[5]);
815 check_field(*(uint32_t *)&midbuf
[5], 8, "Ok\n", "Invalid\n");
816 cprintf_field(" Byte: ", "%d ", midbuf
[41]);
817 check_field(midbuf
[41], 190, "Ok\n", "Invalid\n");
820 create_guid(smallblock
, 3808);
821 memcpy(smallblock
+ 476, midbuf
+ 42, 16);
822 compute_checksum(smallblock
, 492, blo
+ 492);
824 memcpy(blo
, smallblock
, bsz
);
825 memcpy(blo
+ bsz
, midbuf
+ 42, 16);
826 memcpy(blo
+ bsz
+ 16, smallblock
+ bsz
, 476 - bsz
);
828 decode_block_with_perm(blo
+ 492, 16, blo
, 492, g_perm_B
);
829 ret
= check_block(buf
+ 42, midbuf
+ 88, 450);
830 cprintf(GREEN
, " Decode block: ");
831 check_field(ret
, 0, "Pass\n", "Fail\n");
833 ret
= memcmp(g_subblock_A
+ 4, midbuf
+ 9, 16);
834 cprintf(GREEN
, " Compare: ");
835 check_field(ret
, 0, "Pass\n", "Fail\n");
838 memset(zero
, 0, sizeof(zero
));
839 ret
= memcmp(unk
, zero
, sizeof(zero
));
840 cprintf(GREEN
, " Sanity: ");
841 check_field(ret
, 0, "Pass\n", "Fail\n");
844 ret = memcmp(midbuf + 25, zero, sizeof(zero));
845 cprintf(GREEN, " Sanity: ");
846 check_field(ret, 0, "Pass\n", "Fail\n");
852 static int do_sthg_fwu_v3(uint8_t *buf
, int *size
, uint8_t *unk
, uint8_t *block
)
857 memset(unk2
, 0, sizeof(unk2
));
858 int ret
= do_fwu_v3(*size
, buf
, &blockA
, &blockB
, unk
, unk2
, block
);
859 continue_the_force(ret
);
862 uint8_t *tmpbuf
= malloc(*size
);
863 memset(tmpbuf
, 0, *size
);
864 int offsetA
= (blockA
+ 1) << 9;
865 int offsetB
= (blockB
+ 1) << 9;
866 memcpy(tmpbuf
, buf
+ 512, offsetA
);
867 memcpy(tmpbuf
+ offsetA
, buf
+ offsetA
+ 1536, offsetB
);
868 memcpy(tmpbuf
+ offsetA
+ offsetB
,
869 buf
+ offsetA
+ 1536 + offsetB
+ 512, *size
- offsetA
- offsetB
);
870 compute_perm(unk2
, 32, g_perm_B
);
871 decode_perm(tmpbuf
, *size
, g_perm_B
);
872 memcpy(buf
, tmpbuf
, *size
);
877 /* [add]: string to add when there is no extension
878 * [replace]: string to replace extension */
879 static void build_out_prefix(char *add
, char *replace
, bool slash
)
883 /** copy input filename with extra space */
884 g_out_prefix
= malloc(strlen(g_in_file
) + strlen(add
) + 16);
885 strcpy(g_out_prefix
, g_in_file
);
886 /** remove extension and add '/' */
887 char *filename
= strrchr(g_out_prefix
, '/');
888 // have p points to the beginning or after the last '/'
889 filename
= (filename
== NULL
) ? g_out_prefix
: filename
+ 1;
891 char *dot
= strrchr(filename
, '.');
894 *dot
= 0; // cut at the dot
895 strcat(dot
, replace
);
898 strcat(filename
, add
); // add extra string
902 strcat(filename
, "/");
903 /** make sure the directory exists */
904 mkdir(g_out_prefix
, S_IRWXU
| S_IRGRP
| S_IROTH
);
908 static int do_fwu(uint8_t *buf
, int size
)
910 struct fwu_hdr_t
*hdr
= (void *)buf
;
912 if(size
< (int)sizeof(struct fwu_hdr_t
))
914 cprintf(GREY
, "File too small\n");
917 cprintf(BLUE
, "Header\n");
918 cprintf(GREEN
, " Signature:");
919 for(int i
= 0; i
< FWU_SIG_SIZE
; i
++)
920 cprintf(YELLOW
, " %02x", hdr
->sig
[i
]);
921 if(memcmp(hdr
->sig
, g_fwu_signature
, FWU_SIG_SIZE
) == 0)
922 cprintf(RED
, " Ok\n");
925 cprintf(RED
, " Mismatch\n");
926 let_the_force_flow(__LINE__
);
929 cprintf_field(" FW size: ", "%d ", hdr
->fw_size
);
930 if((int)hdr
->fw_size
== size
)
931 cprintf(RED
, " Ok\n");
932 else if((int)hdr
->fw_size
< size
)
933 cprintf(RED
, " Ok (file greater than firmware)\n");
936 cprintf(RED
, " Error (file too small)\n");
937 let_the_force_flow(__LINE__
);
940 cprintf_field(" Block size: ", "%d ", hdr
->block_size
);
941 check_field(hdr
->block_size
, FWU_BLOCK_SIZE
, "Ok\n", "Invalid\n");
943 cprintf_field(" Version: ", "%x ", hdr
->version
);
944 int ver
= get_version(buf
, size
);
947 cprintf(RED
, "(Unknown)\n");
951 cprintf(RED
, "(Ver. %d)\n", g_version
[ver
].version
);
953 cprintf_field(" Unknown: ", "0x%x ", hdr
->unk
);
954 check_field(hdr
->unk
, g_version
[ver
].unk
, "Ok\n", "Invalid\n");
956 cprintf(GREEN
, " Signature:");
957 for(int i
= 0; i
< FWU_SIG_SIZE
; i
++)
958 cprintf(YELLOW
, " %02x", hdr
->sig2
[i
]);
959 if(memcmp(hdr
->sig2
, g_version
[ver
].sig2
, FWU_SIG_SIZE
) == 0)
960 cprintf(RED
, " Ok\n");
963 cprintf(RED
, " Mismatch\n");
964 let_the_force_flow(__LINE__
);
967 build_out_prefix(".afi", ".afi", false);
969 if(g_version
[ver
].version
== 3)
972 memset(unk
, 0, sizeof(unk
));
974 memset(block
, 0, sizeof(block
));
975 int ret
= do_sthg_fwu_v3(buf
, &size
, unk
, block
);
976 continue_the_force(ret
);
978 cprintf(GREY
, "Descrambling to %s... ", g_out_prefix
);
979 FILE *f
= fopen(g_out_prefix
, "wb");
982 fwrite(buf
, size
, 1, f
);
984 cprintf(RED
, "Ok\n");
987 cprintf(RED
, "Failed: %m\n");
993 static bool check_fwu(uint8_t *buf
, int size
)
995 struct fwu_hdr_t
*hdr
= (void *)buf
;
997 if(size
< (int)sizeof(struct fwu_hdr_t
))
999 return memcmp(hdr
->sig
, g_fwu_signature
, FWU_SIG_SIZE
) == 0;
1005 * part of this work comes from s1mp3/s1fwx
1008 #define AFI_ENTRIES 126
1009 #define AFI_SIG_SIZE 4
1013 uint8_t sig
[AFI_SIG_SIZE
];
1015 uint16_t product_id
;
1017 uint8_t ext_ver_id
[2];
1023 } __attribute__((packed
));
1035 } __attribute__((packed
));
1037 struct afi_post_hdr_t
1041 } __attribute__((packed
));
1045 struct afi_hdr_t hdr
;
1046 struct afi_entry_t entry
[AFI_ENTRIES
];
1047 struct afi_post_hdr_t post
;
1050 #define AFI_ENTRY_BREC 'B'
1051 #define AFI_ENTRY_FWSC 'F'
1052 #define AFI_ENTRY_ADFUS 'A'
1053 #define AFI_ENTRY_FW 'I'
1055 #define AFI_ENTRY_DLADR_BREC 0x00000006 // 'B'
1056 #define AFI_ENTRY_DLADR_FWSC 0x00020008 // 'F'
1057 #define AFI_ENTRY_DLADR_ADFUS 0x000C0008 // 'A'
1058 #define AFI_ENTRY_DLADR_ADFU 0x00000000 // 'U'
1059 #define AFI_ENTRY_DLADR_FW 0x00000011 // 'I'
1061 const uint8_t g_afi_signature
[AFI_SIG_SIZE
] =
1066 static uint32_t afi_checksum(void *ptr
, int size
)
1070 for(; size
>= 4; size
-= 4)
1073 crc
+= *(uint8_t *)cp
;
1075 crc
+= *(uint16_t *)cp
;
1077 crc
+= *(uint16_t *)cp
+ ((*(uint8_t *)(cp
+ 2)) << 16);
1081 static void build_filename(char buf
[16], struct afi_entry_t
*ent
)
1084 for(int i
= 0; i
< 8 && ent
->name
[i
] != ' '; i
++)
1085 buf
[pos
++] = ent
->name
[i
];
1087 for(int i
= 0; i
< 3 && ent
->ext
[i
] != ' '; i
++)
1088 buf
[pos
++] = ent
->ext
[i
];
1092 static int do_afi(uint8_t *buf
, int size
)
1094 struct afi_t
*afi
= (void *)buf
;
1096 if(size
< (int)sizeof(struct afi_t
))
1098 cprintf(GREY
, "File too small\n");
1101 cprintf(BLUE
, "Header\n");
1102 cprintf(GREEN
, " Signature:");
1103 for(int i
= 0; i
< AFI_SIG_SIZE
; i
++)
1104 cprintf(YELLOW
, " %02x", afi
->hdr
.sig
[i
]);
1105 if(memcmp(afi
->hdr
.sig
, g_afi_signature
, AFI_SIG_SIZE
) == 0)
1106 cprintf(RED
, " Ok\n");
1109 cprintf(RED
, " Mismatch\n");
1110 let_the_force_flow(__LINE__
);
1113 cprintf_field(" Vendor ID: ", "0x%x\n", afi
->hdr
.vendor_id
);
1114 cprintf_field(" Product ID: ", "0x%x\n", afi
->hdr
.product_id
);
1115 cprintf_field(" Version: ", "%x.%x\n", afi
->hdr
.ver_id
[0], afi
->hdr
.ver_id
[1]);
1116 cprintf_field(" Ext Version: ", "%x.%x\n", afi
->hdr
.ext_ver_id
[0],
1117 afi
->hdr
.ext_ver_id
[1]);
1118 cprintf_field(" Date: ", "%x/%x/%x%x\n", afi
->hdr
.day
, afi
->hdr
.month
,
1119 afi
->hdr
.year
[0], afi
->hdr
.year
[1]);
1121 cprintf_field(" AFI size: ", "%d ", afi
->hdr
.afi_size
);
1122 if((int)afi
->hdr
.afi_size
== size
)
1123 cprintf(RED
, " Ok\n");
1124 else if((int)afi
->hdr
.afi_size
< size
)
1125 cprintf(RED
, " Ok (file greater than archive)\n");
1128 cprintf(RED
, " Error (file too small)\n");
1129 let_the_force_flow(__LINE__
);
1132 cprintf_field(" Reserved: ", "%x %x %x\n", afi
->hdr
.res
[0],
1133 afi
->hdr
.res
[1], afi
->hdr
.res
[2]);
1135 build_out_prefix(".fw", "", true);
1137 cprintf(BLUE
, "Entries\n");
1138 for(int i
= 0; i
< AFI_ENTRIES
; i
++)
1140 if(afi
->entry
[i
].name
[0] == 0)
1142 struct afi_entry_t
*entry
= &afi
->entry
[i
];
1144 build_filename(filename
, entry
);
1145 cprintf(RED
, " %s\n", filename
);
1146 cprintf_field(" Type: ", "%02x", entry
->type
);
1147 if(isprint(entry
->type
))
1148 cprintf(RED
, " %c", entry
->type
);
1150 cprintf_field(" Addr: ", "0x%x\n", entry
->addr
);
1151 cprintf_field(" Offset: ", "0x%x\n", entry
->offset
);
1152 cprintf_field(" Size: ", "0x%x\n", entry
->size
);
1153 cprintf_field(" Desc: ", "%.4s\n", entry
->desc
);
1154 cprintf_field(" Checksum: ", "0x%x ", entry
->checksum
);
1155 uint32_t chk
= afi_checksum(buf
+ entry
->offset
, entry
->size
);
1156 cprintf(RED
, "%s\n", chk
== entry
->checksum
? "Ok" : "Mismatch");
1158 char *name
= malloc(strlen(g_out_prefix
) + strlen(filename
) + 16);
1159 sprintf(name
, "%s%s", g_out_prefix
, filename
);
1161 cprintf(GREY
, "Unpacking to %s... ", name
);
1162 FILE *f
= fopen(name
, "wb");
1165 fwrite(buf
+ entry
->offset
, entry
->size
, 1, f
);
1167 cprintf(RED
, "Ok\n");
1170 cprintf(RED
, "Failed: %m\n");
1173 cprintf(BLUE
, "Post Header\n");
1174 cprintf_field(" Checksum: ", "%x ", afi
->post
.checksum
);
1175 uint32_t chk
= afi_checksum(buf
, sizeof(struct afi_t
) - 4);
1176 cprintf(RED
, "%s\n", chk
== afi
->post
.checksum
? "Ok" : "Mismatch");
1181 static bool check_afi(uint8_t *buf
, int size
)
1183 struct afi_hdr_t
*hdr
= (void *)buf
;
1185 if(size
< (int)sizeof(struct afi_hdr_t
))
1187 return memcmp(hdr
->sig
, g_afi_signature
, AFI_SIG_SIZE
) == 0;
1194 #define FW_SIG_SIZE 4
1196 #define FW_ENTRIES 240
1205 uint32_t block_offset
; // offset shift by 9
1209 } __attribute__((packed
));
1213 uint8_t sig
[FW_SIG_SIZE
];
1225 uint8_t res2
[8 * 16];
1228 char res3
[4 * 16 + 1];
1237 struct fw_entry_t entry
[FW_ENTRIES
];
1238 } __attribute__((packed
));
1240 const uint8_t g_fw_signature
[FW_SIG_SIZE
] =
1242 0x55, 0xaa, 0xf2, 0x0f
1245 static void build_filename_fw(char buf
[16], struct fw_entry_t
*ent
)
1248 for(int i
= 0; i
< 8 && ent
->name
[i
] != ' '; i
++)
1249 buf
[pos
++] = ent
->name
[i
];
1251 for(int i
= 0; i
< 3 && ent
->ext
[i
] != ' '; i
++)
1252 buf
[pos
++] = ent
->ext
[i
];
1256 static int do_fw(uint8_t *buf
, int size
)
1258 struct fw_hdr_t
*hdr
= (void *)buf
;
1260 if(size
< (int)sizeof(struct fw_hdr_t
))
1262 cprintf(GREY
, "File too small\n");
1265 cprintf(BLUE
, "Header\n");
1266 cprintf(GREEN
, " Signature:");
1267 for(int i
= 0; i
< FW_SIG_SIZE
; i
++)
1268 cprintf(YELLOW
, " %02x", hdr
->sig
[i
]);
1269 if(memcmp(hdr
->sig
, g_fw_signature
, FW_SIG_SIZE
) == 0)
1270 cprintf(RED
, " Ok\n");
1273 cprintf(RED
, " Mismatch\n");
1274 let_the_force_flow(__LINE__
);
1277 cprintf_field(" USB VID: ", "0x%x\n", hdr
->usb_vid
);
1278 cprintf_field(" USB PID: ", "0x%x\n", hdr
->usb_pid
);
1279 cprintf_field(" Date: ", "%x/%x/%x%x\n", hdr
->day
, hdr
->month
, hdr
->year
[0], hdr
->year
[1]);
1280 cprintf_field(" Checksum: ", "%x\n", hdr
->checksum
);
1281 cprintf_field(" Productor: ", "%.16s\n", hdr
->productor
);
1282 cprintf_field(" String 2: ", "%.16s\n", hdr
->str2
);
1283 cprintf_field(" String 3: ", "%.32s\n", hdr
->str3
);
1284 cprintf_field(" Device Name: ", "%.32s\n", hdr
->dev_name
);
1285 cprintf(GREEN
, " Unknown:\n");
1286 for(int i
= 0; i
< 8; i
++)
1288 cprintf(YELLOW
, " ");
1289 for(int j
= 0; j
< 16; j
++)
1290 cprintf(YELLOW
, "%02x ", hdr
->res2
[i
* 16 + j
]);
1291 cprintf(YELLOW
, "\n");
1293 cprintf_field(" USB Name 1: ", "%.8s\n", hdr
->usb_name1
);
1294 cprintf_field(" USB Name 2: ", "%.8s\n", hdr
->usb_name2
);
1295 cprintf_field(" MTP Name 1: ", "%.32s\n", hdr
->mtp_name1
);
1296 cprintf_field(" MTP Name 2: ", "%.32s\n", hdr
->mtp_name2
);
1297 cprintf_field(" MTP Version: ", "%.32s\n", hdr
->mtp_ver
);
1299 cprintf_field(" MTP VID: ", "0x%x\n", hdr
->mtp_vid
);
1300 cprintf_field(" MTP PID: ", "0x%x\n", hdr
->mtp_pid
);
1301 cprintf_field(" FW Version: ", "%.64s\n", hdr
->fw_ver
);
1303 build_out_prefix(".unpack", "", true);
1305 cprintf(BLUE
, "Entries\n");
1306 for(int i
= 0; i
< AFI_ENTRIES
; i
++)
1308 if(hdr
->entry
[i
].name
[0] == 0)
1310 struct fw_entry_t
*entry
= &hdr
->entry
[i
];
1312 build_filename_fw(filename
, entry
);
1313 cprintf(RED
, " %s\n", filename
);
1314 cprintf_field(" Attr: ", "%02x\n", entry
->attr
);
1315 cprintf_field(" Offset: ", "0x%x\n", entry
->block_offset
<< 9);
1316 cprintf_field(" Size: ", "0x%x\n", entry
->size
);
1317 cprintf_field(" Unknown: ", "%x\n", entry
->unk
);
1318 cprintf_field(" Checksum: ", "0x%x ", entry
->checksum
);
1319 uint32_t chk
= afi_checksum(buf
+ (entry
->block_offset
<< 9), entry
->size
);
1320 cprintf(RED
, "%s\n", chk
== entry
->checksum
? "Ok" : "Mismatch");
1323 char *name
= malloc(strlen(g_out_prefix
) + strlen(filename
) + 16);
1324 sprintf(name
, "%s%s", g_out_prefix
, filename
);
1326 cprintf(GREY
, "Unpacking to %s... ", name
);
1327 FILE *f
= fopen(name
, "wb");
1330 fwrite(buf
+ (entry
->block_offset
<< 9), entry
->size
, 1, f
);
1332 cprintf(RED
, "Ok\n");
1335 cprintf(RED
, "Failed: %m\n");
1342 static bool check_fw(uint8_t *buf
, int size
)
1344 struct fw_hdr_t
*hdr
= (void *)buf
;
1346 if(size
< (int)sizeof(struct fw_hdr_t
))
1348 return memcmp(hdr
->sig
, g_fw_signature
, FW_SIG_SIZE
) == 0;
1351 static void usage(void)
1353 printf("Usage: atjboottool [options] firmware\n");
1354 printf("Options:\n");
1355 printf(" -o <prefix>\tSet output prefix\n");
1356 printf(" -f/--force\tForce to continue on errors\n");
1357 printf(" -?/--help\tDisplay this message\n");
1358 printf(" -d/--debug\tDisplay debug messages\n");
1359 printf(" -c/--no-color\tDisable color output\n");
1360 printf(" --fwu\tUnpack a FWU firmware file\n");
1361 printf(" --afi\tUnpack a AFI archive file\n");
1362 printf(" --fw\tUnpack a FW archive file\n");
1363 printf("The default is to try to guess the format.\n");
1364 printf("If several formats are specified, all are tried.\n");
1365 printf("If no output prefix is specified, a default one is picked.\n");
1369 int main(int argc
, char **argv
)
1371 bool try_fwu
= false;
1372 bool try_afi
= false;
1373 bool try_fw
= false;
1377 static struct option long_options
[] =
1379 {"help", no_argument
, 0, '?'},
1380 {"debug", no_argument
, 0, 'd'},
1381 {"no-color", no_argument
, 0, 'c'},
1382 {"force", no_argument
, 0, 'f'},
1383 {"fwu", no_argument
, 0, 'u'},
1384 {"afi", no_argument
, 0, 'a'},
1385 {"fw", no_argument
, 0, 'w'},
1389 int c
= getopt_long(argc
, argv
, "?dcfo:a1", long_options
, NULL
);
1397 enable_color(false);
1409 g_out_prefix
= optarg
;
1425 if(argc
- optind
!= 1)
1431 g_in_file
= argv
[optind
];
1432 FILE *fin
= fopen(g_in_file
, "r");
1435 perror("Cannot open boot file");
1438 fseek(fin
, 0, SEEK_END
);
1439 long size
= ftell(fin
);
1440 fseek(fin
, 0, SEEK_SET
);
1442 void *buf
= malloc(size
);
1445 perror("Cannot allocate memory");
1449 if(fread(buf
, size
, 1, fin
) != 1)
1451 perror("Cannot read file");
1458 if(try_fwu
|| check_fwu(buf
, size
))
1459 ret
= do_fwu(buf
, size
);
1460 else if(try_afi
|| check_afi(buf
, size
))
1461 ret
= do_afi(buf
, size
);
1462 else if(try_fw
|| check_fw(buf
, size
))
1463 ret
= do_fw(buf
, size
);
1466 cprintf(GREY
, "No valid format found\n");
1472 cprintf(GREY
, "Error: %d", ret
);
1474 cprintf(GREY
, " (use --force to force processing)");