rbutil/mkimxboot/mkimxboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2011 by Amaury Pouly
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  18  * KIND, either express or implied.
  19  *
  20  ****************************************************************************/
  21 #include <stdio.h>
  22 #include <stdlib.h>
  23 #include <stdarg.h>
  24 #include "mkimxboot.h"
  25 #include "sb.h"
  26 #include "dualboot.h"
  27 #include "md5.h"
  28
  29 struct imx_fw_variant_desc_t
  30 {
  31     /* Offset within file */
  32     size_t offset;
  33     /* Total size of the firmware */
  34     size_t size;
  35 };
  36
  37 struct imx_md5sum_t
  38 {
  39     /* Device model */
  40     enum imx_model_t model;
  41     /* md5sum of the file */
  42     char *md5sum;
  43     /* Version string */
  44     const char *version;
  45     /* Variant descriptions */
  46     struct imx_fw_variant_desc_t fw_variants[VARIANT_COUNT];
  47 };
  48
  49 struct imx_model_desc_t
  50 {
  51     /* Descriptive name of this model */
  52     const char *model_name;
  53     /* Dualboot code for this model */
  54     const unsigned char *dualboot;
  55     /* Size of dualboot functions for this model */
  56     int dualboot_size;
  57     /* Model name used in the Rockbox header in ".sansa" files - these match the
  58        -add parameter to the "scramble" tool */
  59     const char *rb_model_name;
  60     /* Model number used to initialise the checksum in the Rockbox header in
  61        ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
  62     const int rb_model_num;
  63     /* Number of keys needed to decrypt/encrypt */
  64     int nr_keys;
  65     /* Array of keys */
  66     struct crypto_key_t *keys;
  67     /* Dualboot load address */
  68     uint32_t dualboot_addr;
  69     /* Bootloader load address */
  70     uint32_t bootloader_addr;
  71 };
  72
  73 static const char *imx_fw_variant[] =
  74 {
  75     [VARIANT_DEFAULT] = "default",
  76     [VARIANT_ZENXFI2_RECOVERY] = "ZEN X-Fi2 Recovery",
  77     [VARIANT_ZENXFI2_NAND] = "ZEN X-Fi2 NAND",
  78     [VARIANT_ZENXFI2_SD] = "ZEN X-Fi2 eMMC/SD",
  79 };
  80
  81 static const struct imx_md5sum_t imx_sums[] =
  82 {
  83     {
  84         /* Version 2.38.6 */
  85         MODEL_FUZEPLUS, "c3e27620a877dc6b200b97dcb3e0ecc7", "2.38.6",
  86         { [VARIANT_DEFAULT] = { 0, 34652624 } }
  87     },
  88     {
  89         /* Version 1.23.01e */
  90         MODEL_ZENXFI2, "e37e2c24abdff8e624d0a29f79157850", "1.23.01e",
  91     },
  92     {
  93         /* Version 1.23.01e */
  94         MODEL_ZENXFI2, "2beff2168212d332f13cfc36ca46989d", "1.23.01e",
  95         {
  96             [VARIANT_ZENXFI2_RECOVERY] = { 0x93010, 684192},
  97             [VARIANT_ZENXFI2_NAND] = { 0x13a0b0, 42410704 },
  98             [VARIANT_ZENXFI2_SD] = { 0x29ac380, 42304208 }
  99         }
 100     },
 101     {
 102         /* Version 1.00.15e */
 103         MODEL_ZENXFI3, "658a24eeef5f7186ca731085d8822a87", "1.00.15e",
 104         { [VARIANT_DEFAULT] = {0, 18110576} }
 105     },
 106     {
 107         /* Version 1.00.22e */
 108         MODEL_ZENXFI3, "a5114cd45ea4554ec221f51a71083862", "1.00.22e",
 109         { [VARIANT_DEFAULT] = {0, 18110576} }
 110     },
 111 };
 112
 113 static struct crypto_key_t zero_key =
 114 {
 115     .method = CRYPTO_KEY,
 116     .u.key = {0}
 117 };
 118
 119 static const struct imx_model_desc_t imx_models[] =
 120 {
 121     [MODEL_FUZEPLUS] = { "Fuze+",  dualboot_fuzeplus, sizeof(dualboot_fuzeplus), "fuz+", 72,
 122                           1, &zero_key, 0, 0x40000000 },
 123     [MODEL_ZENXFI2] = {"Zen X-Fi2", dualboot_zenxfi2, sizeof(dualboot_zenxfi2), "zxf2", 82,
 124                        1, &zero_key, 0, 0x40000000 },
 125     [MODEL_ZENXFI3] = {"Zen X-Fi3", dualboot_zenxfi3, sizeof(dualboot_zenxfi3), "zxf3", 83,
 126                        1, &zero_key, 0, 0x40000000 },
 127 };
 128
 129 #define NR_IMX_SUMS     (sizeof(imx_sums) / sizeof(imx_sums[0]))
 130 #define NR_IMX_MODELS   (sizeof(imx_models) / sizeof(imx_models[0]))
 131
 132 #define MAGIC_ROCK      0x726f636b /* 'rock' */
 133 #define MAGIC_RECOVERY  0xfee1dead
 134 #define MAGIC_NORMAL    0xcafebabe
 135
 136 static enum imx_error_t patch_std_zero_host_play(int jump_before, int model,
 137  enum imx_output_type_t type, struct sb_file_t *sb_file, void *boot, size_t boot_sz)
 138 {
 139     /* We assume the file has three boot sections: ____, host, play and one
 140      * resource section rsrc.
 141      *
 142      * Dual Boot:
 143      * ----------
 144      * We patch the file by inserting the dualboot code before the <jump_before>th
 145      * call in the ____ section. We give it as argument the section name 'rock'
 146      * and add a section called 'rock' after rsrc which contains the bootloader.
 147      *
 148      * Single Boot & Recovery:
 149      * -----------------------
 150      * We patch the file by inserting the bootloader code after the <jump_before>th
 151      * call in the ____ section and get rid of everything else. In recovery mode,
 152      * we give 0xfee1dead as argument */
 153
 154     /* Do not override real key and IV */
 155     sb_file->override_crypto_iv = false;
 156     sb_file->override_real_key = false;
 157
 158     /* first locate the good instruction */
 159     struct sb_section_t *sec = &sb_file->sections[0];
 160     int jump_idx = 0;
 161     while(jump_idx < sec->nr_insts && jump_before > 0)
 162         if(sec->insts[jump_idx++].inst == SB_INST_CALL)
 163             jump_before--;
 164     if(jump_idx == sec->nr_insts)
 165     {
 166         printf("[ERR] Cannot locate call in section ____\n");
 167         return IMX_DONT_KNOW_HOW_TO_PATCH;
 168     }
 169
 170     if(type == IMX_DUALBOOT)
 171     {
 172         /* create a new instruction array with a hole for two instructions */
 173         struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (sec->nr_insts + 2));
 174         memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
 175         memcpy(new_insts + jump_idx + 2, sec->insts + jump_idx,
 176             sizeof(struct sb_inst_t) * (sec->nr_insts - jump_idx));
 177         /* first instruction is be a load */
 178         struct sb_inst_t *load = &new_insts[jump_idx];
 179         memset(load, 0, sizeof(struct sb_inst_t));
 180         load->inst = SB_INST_LOAD;
 181         load->size = imx_models[model].dualboot_size;
 182         load->addr = imx_models[model].dualboot_addr;
 183         /* duplicate memory because it will be free'd */
 184         load->data = memdup(imx_models[model].dualboot, imx_models[model].dualboot_size);
 185         /* second instruction is a call */
 186         struct sb_inst_t *call = &new_insts[jump_idx + 1];
 187         memset(call, 0, sizeof(struct sb_inst_t));
 188         call->inst = SB_INST_CALL;
 189         call->addr = imx_models[model].dualboot_addr;
 190         call->argument = MAGIC_ROCK;
 191         /* free old instruction array */
 192         free(sec->insts);
 193         sec->insts = new_insts;
 194         sec->nr_insts += 2;
 195
 196         /* create a new section */
 197         struct sb_section_t rock_sec;
 198         memset(&rock_sec, 0, sizeof(rock_sec));
 199         /* section has two instructions: load and call */
 200         rock_sec.identifier = MAGIC_ROCK;
 201         rock_sec.alignment = BLOCK_SIZE;
 202         rock_sec.nr_insts = 2;
 203         rock_sec.insts = xmalloc(2 * sizeof(struct sb_inst_t));
 204         memset(rock_sec.insts, 0, 2 * sizeof(struct sb_inst_t));
 205         rock_sec.insts[0].inst = SB_INST_LOAD;
 206         rock_sec.insts[0].size = boot_sz;
 207         rock_sec.insts[0].data = memdup(boot, boot_sz);
 208         rock_sec.insts[0].addr = imx_models[model].bootloader_addr;
 209         rock_sec.insts[1].inst = SB_INST_JUMP;
 210         rock_sec.insts[1].addr = imx_models[model].bootloader_addr;
 211         rock_sec.insts[1].argument = MAGIC_NORMAL;
 212
 213         sb_file->sections = augment_array(sb_file->sections,
 214             sizeof(struct sb_section_t), sb_file->nr_sections,
 215             &rock_sec, 1);
 216         sb_file->nr_sections++;
 217
 218         return IMX_SUCCESS;
 219     }
 220     else if(type == IMX_SINGLEBOOT || type == IMX_RECOVERY)
 221     {
 222         bool recovery = type == IMX_RECOVERY;
 223         /* remove everything after the call and add two instructions: load and call */
 224         struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (jump_idx + 2));
 225         memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
 226         for(int i = jump_idx; i < sec->nr_insts; i++)
 227             sb_free_instruction(sec->insts[i]);
 228         memset(new_insts + jump_idx, 0, 2 * sizeof(struct sb_inst_t));
 229         new_insts[jump_idx + 0].inst = SB_INST_LOAD;
 230         new_insts[jump_idx + 0].size = boot_sz;
 231         new_insts[jump_idx + 0].data = memdup(boot, boot_sz);
 232         new_insts[jump_idx + 0].addr = imx_models[model].bootloader_addr;
 233         new_insts[jump_idx + 1].inst = SB_INST_JUMP;
 234         new_insts[jump_idx + 1].addr = imx_models[model].bootloader_addr;
 235         new_insts[jump_idx + 1].argument = recovery ? MAGIC_RECOVERY : MAGIC_NORMAL;
 236
 237         free(sec->insts);
 238         sec->insts = new_insts;
 239         sec->nr_insts = jump_idx + 2;
 240         /* remove all other sections */
 241         for(int i = 1; i < sb_file->nr_sections; i++)
 242             sb_free_section(sb_file->sections[i]);
 243         struct sb_section_t *new_sec = xmalloc(sizeof(struct sb_section_t));
 244         memcpy(new_sec, &sb_file->sections[0], sizeof(struct sb_section_t));
 245         free(sb_file->sections);
 246         sb_file->sections = new_sec;
 247         sb_file->nr_sections = 1;
 248
 249         return IMX_SUCCESS;
 250     }
 251     else
 252     {
 253         printf("[ERR] Bad output type !\n");
 254         return IMX_DONT_KNOW_HOW_TO_PATCH;
 255     }
 256 }
 257
 258 static enum imx_error_t patch_firmware(enum imx_model_t model,
 259     enum imx_firmware_variant_t variant, enum imx_output_type_t type,
 260     struct sb_file_t *sb_file, void *boot, size_t boot_sz)
 261 {
 262     switch(model)
 263     {
 264         case MODEL_FUZEPLUS:
 265             /* The Fuze+ uses the standard ____, host, play sections, patch after third
 266              * call in ____ section */
 267             return patch_std_zero_host_play(3, model, type, sb_file, boot, boot_sz);
 268         case MODEL_ZENXFI3:
 269             /* The ZEN X-Fi3 uses the standard ____, hSst, pSay sections, patch after third
 270              * call in ____ section. Although sections names use the S variant, they are standard. */
 271             return patch_std_zero_host_play(3, model, type, sb_file, boot, boot_sz);
 272         case MODEL_ZENXFI2:
 273             /* The ZEN X-Fi2 has two types of firmware: recovery and normal.
 274              * Normal uses the standard ___, host, play sections and recovery only ____ */
 275             switch(variant)
 276             {
 277                 case VARIANT_ZENXFI2_RECOVERY:
 278                 case VARIANT_ZENXFI2_NAND:
 279                 case VARIANT_ZENXFI2_SD:
 280                     return patch_std_zero_host_play(1, model, type, sb_file, boot, boot_sz);
 281                 default:
 282                     return IMX_DONT_KNOW_HOW_TO_PATCH;
 283             }
 284             break;
 285         default:
 286             return IMX_DONT_KNOW_HOW_TO_PATCH;
 287     }
 288 }
 289
 290 static void imx_printf(void *user, bool error, color_t c, const char *fmt, ...)
 291 {
 292     (void) user;
 293     (void) c;
 294     va_list args;
 295     va_start(args, fmt);
 296     /*
 297     if(error)
 298         printf("[ERR] ");
 299     else
 300         printf("[INFO] ");
 301     */
 302     vprintf(fmt, args);
 303     va_end(args);
 304 }
 305
 306 static uint32_t get_uint32be(unsigned char *p)
 307 {
 308     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 309 }
 310
 311 void dump_imx_dev_info(const char *prefix)
 312 {
 313     printf("%smkimxboot models:\n", prefix);
 314     for(int i = 0; i < NR_IMX_MODELS; i++)
 315     {
 316         printf("%s  %s: idx=%d rb_model=%s rb_num=%d\n", prefix,
 317             imx_models[i].model_name, i, imx_models[i].rb_model_name,
 318             imx_models[i].rb_model_num);
 319     }
 320     printf("%smkimxboot variants:\n", prefix);
 321     for(int i = 0; i < VARIANT_COUNT; i++)
 322     {
 323         printf("%s  %d: %s\n", prefix, i, imx_fw_variant[i]);
 324     }
 325     printf("%smkimxboot mapping:\n", prefix);
 326     for(int i = 0; i < NR_IMX_SUMS; i++)
 327     {
 328         printf("%s  md5sum=%s -> idx=%d, ver=%s\n", prefix, imx_sums[i].md5sum,
 329             imx_sums[i].model, imx_sums[i].version);
 330         for(int j = 0; j < VARIANT_COUNT; j++)
 331             if(imx_sums[i].fw_variants[j].size)
 332                 printf("%s    variant=%d -> offset=%#x size=%#x\n", prefix,
 333                     j, (unsigned)imx_sums[i].fw_variants[j].offset,
 334                     (unsigned)imx_sums[i].fw_variants[j].size);
 335     }
 336 }
 337
 338 enum imx_error_t mkimxboot(const char *infile, const char *bootfile,
 339     const char *outfile, struct imx_option_t opt)
 340 {
 341     /* Dump tables */
 342     if(opt.fw_variant > VARIANT_COUNT) {
 343         return IMX_ERROR;
 344     }
 345     dump_imx_dev_info("[INFO] ");
 346     /* compute MD5 sum of the file */
 347     uint8_t file_md5sum[16];
 348     do
 349     {
 350         FILE *f = fopen(infile, "rb");
 351         if(f == NULL)
 352         {
 353             printf("[ERR] Cannot open input file\n");
 354             return IMX_OPEN_ERROR;
 355         }
 356         fseek(f, 0, SEEK_END);
 357         size_t sz = ftell(f);
 358         fseek(f, 0, SEEK_SET);
 359         void *buf = xmalloc(sz);
 360         if(fread(buf, sz, 1, f) != 1)
 361         {
 362             fclose(f);
 363             free(buf);
 364             printf("[ERR] Cannot read file\n");
 365             return IMX_READ_ERROR;
 366         }
 367         fclose(f);
 368         md5_context ctx;
 369         md5_starts(&ctx);
 370         md5_update(&ctx, buf, sz);
 371         md5_finish(&ctx, file_md5sum);
 372         free(buf);
 373     }while(0);
 374     printf("[INFO] MD5 sum of the file: ");
 375     print_hex(file_md5sum, 16, true);
 376     /* find model */
 377     enum imx_model_t model;
 378     int md5_idx;
 379     do
 380     {
 381         int i = 0;
 382         while(i < NR_IMX_SUMS)
 383         {
 384             uint8_t md5[20];
 385             if(strlen(imx_sums[i].md5sum) != 32)
 386             {
 387                 printf("[INFO] Invalid MD5 sum in imx_sums\n");
 388                 return IMX_ERROR;
 389             }
 390             for(int j = 0; j < 16; j++)
 391             {
 392                 byte a, b;
 393                 if(convxdigit(imx_sums[i].md5sum[2 * j], &a) || convxdigit(imx_sums[i].md5sum[2 * j + 1], &b))
 394                 {
 395                     printf("[ERR][INTERNAL] Bad checksum format: %s\n", imx_sums[i].md5sum);
 396                     return IMX_ERROR;
 397                 }
 398                 md5[j] = (a << 4) | b;
 399             }
 400             if(memcmp(file_md5sum, md5, 16) == 0)
 401                 break;
 402             i++;
 403         }
 404         if(i == NR_IMX_SUMS)
 405         {
 406             printf("[ERR] MD5 sum doesn't match any known file\n");
 407             return IMX_NO_MATCH;
 408         }
 409         model = imx_sums[i].model;
 410         md5_idx = i;
 411     }while(0);
 412     printf("[INFO] File is for model %d (%s, version %s)\n", model,
 413         imx_models[model].model_name, imx_sums[md5_idx].version);
 414     /* load rockbox file */
 415     uint8_t *boot;
 416     size_t boot_size;
 417     do
 418     {
 419         FILE *f = fopen(bootfile, "rb");
 420         if(f == NULL)
 421         {
 422             printf("[ERR] Cannot open boot file\n");
 423             return IMX_OPEN_ERROR;
 424         }
 425         fseek(f, 0, SEEK_END);
 426         boot_size = ftell(f);
 427         fseek(f, 0, SEEK_SET);
 428         boot = xmalloc(boot_size);
 429         if(fread(boot, boot_size, 1, f) != 1)
 430         {
 431             free(boot);
 432             fclose(f);
 433             printf("[ERR] Cannot read boot file\n");
 434             return IMX_READ_ERROR;
 435         }
 436         fclose(f);
 437     }while(0);
 438     /* Check boot file */
 439     do
 440     {
 441         if(boot_size < 8)
 442         {
 443             printf("[ERR] Bootloader file is too small to be valid\n");
 444             free(boot);
 445             return IMX_BOOT_INVALID;
 446         }
 447         /* check model name */
 448         uint8_t *name = boot + 4;
 449         if(memcmp(name, imx_models[model].rb_model_name, 4) != 0)
 450         {
 451             printf("[ERR] Bootloader model doesn't match found model for input file\n");
 452             free(boot);
 453             return IMX_BOOT_MISMATCH;
 454         }
 455         /* check checksum */
 456         uint32_t sum = imx_models[model].rb_model_num;
 457         for(int i = 8; i < boot_size; i++)
 458             sum += boot[i];
 459         if(sum != get_uint32be(boot))
 460         {
 461             printf("[ERR] Bootloader checksum mismatch\n");
 462             free(boot);
 463             return IMX_BOOT_CHECKSUM_ERROR;
 464         }
 465     }while(0);
 466     /* load OF file */
 467     struct sb_file_t *sb_file;
 468     do
 469     {
 470         if(imx_sums[md5_idx].fw_variants[opt.fw_variant].size == 0)
 471         {
 472             printf("[ERR] Input file does not contain variant '%s'\n", imx_fw_variant[opt.fw_variant]);
 473             free(boot);
 474             return IMX_VARIANT_MISMATCH;
 475         }
 476         enum sb_error_t err;
 477         g_debug = opt.debug;
 478         clear_keys();
 479         add_keys(imx_models[model].keys, imx_models[model].nr_keys);
 480         sb_file = sb_read_file_ex(infile, imx_sums[md5_idx].fw_variants[opt.fw_variant].offset,
 481             imx_sums[md5_idx].fw_variants[opt.fw_variant].size, false, NULL, &imx_printf, &err);
 482         if(sb_file == NULL)
 483         {
 484             clear_keys();
 485             free(boot);
 486             return IMX_FIRST_SB_ERROR + err;
 487         }
 488     }while(0);
 489     /* produce file */
 490     enum imx_error_t ret = patch_firmware(model, opt.fw_variant, opt.output, sb_file, boot + 8, boot_size - 8);
 491     if(ret == IMX_SUCCESS)
 492         ret = sb_write_file(sb_file, outfile);
 493
 494     clear_keys();
 495     free(boot);
 496     sb_free(sb_file);
 497     return ret;
 498 }
 499
 500 enum imx_error_t extract_firmware(const char *infile,
 501     enum imx_firmware_variant_t fw_variant, const char *outfile)
 502 {
 503     /* Dump tables */
 504     if(fw_variant > VARIANT_COUNT) {
 505         return IMX_ERROR;
 506     }
 507     dump_imx_dev_info("[INFO] ");
 508     /* compute MD5 sum of the file */
 509     uint8_t file_md5sum[16];
 510     FILE *f = fopen(infile, "rb");
 511     if(f == NULL)
 512     {
 513         printf("[ERR] Cannot open input file\n");
 514         return IMX_OPEN_ERROR;
 515     }
 516     fseek(f, 0, SEEK_END);
 517     size_t sz = ftell(f);
 518     fseek(f, 0, SEEK_SET);
 519     void *buf = xmalloc(sz);
 520     if(fread(buf, sz, 1, f) != 1)
 521     {
 522         fclose(f);
 523         free(buf);
 524         printf("[ERR] Cannot read file\n");
 525         return IMX_READ_ERROR;
 526     }
 527     md5_context ctx;
 528     md5_starts(&ctx);
 529     md5_update(&ctx, buf, sz);
 530     md5_finish(&ctx, file_md5sum);
 531     fclose(f);
 532
 533     printf("[INFO] MD5 sum of the file: ");
 534     print_hex(file_md5sum, 16, true);
 535     /* find model */
 536     enum imx_model_t model;
 537     int md5_idx;
 538     do
 539     {
 540         int i = 0;
 541         while(i < NR_IMX_SUMS)
 542         {
 543             uint8_t md5[20];
 544             if(strlen(imx_sums[i].md5sum) != 32)
 545             {
 546                 printf("[INFO] Invalid MD5 sum in imx_sums\n");
 547                 return IMX_ERROR;
 548             }
 549             for(int j = 0; j < 16; j++)
 550             {
 551                 byte a, b;
 552                 if(convxdigit(imx_sums[i].md5sum[2 * j], &a) || convxdigit(imx_sums[i].md5sum[2 * j + 1], &b))
 553                 {
 554                     printf("[ERR][INTERNAL] Bad checksum format: %s\n", imx_sums[i].md5sum);
 555                     free(buf);
 556                     return IMX_ERROR;
 557                 }
 558                 md5[j] = (a << 4) | b;
 559             }
 560             if(memcmp(file_md5sum, md5, 16) == 0)
 561                 break;
 562             i++;
 563         }
 564         if(i == NR_IMX_SUMS)
 565         {
 566             printf("[ERR] MD5 sum doesn't match any known file\n");
 567             return IMX_NO_MATCH;
 568         }
 569         model = imx_sums[i].model;
 570         md5_idx = i;
 571     }while(0);
 572     printf("[INFO] File is for model %d (%s, version %s)\n", model,
 573         imx_models[model].model_name, imx_sums[md5_idx].version);
 574
 575     if(imx_sums[md5_idx].fw_variants[fw_variant].size == 0)
 576     {
 577         printf("[ERR] Input file does not contain variant '%s'\n", imx_fw_variant[fw_variant]);
 578         free(buf);
 579         return IMX_VARIANT_MISMATCH;
 580     }
 581
 582     f = fopen(outfile, "wb");
 583     if(f == NULL)
 584     {
 585         printf("[ERR] Cannot open input file\n");
 586         free(buf);
 587         return IMX_OPEN_ERROR;
 588     }
 589     enum imx_error_t ret = IMX_SUCCESS;
 590
 591     if(fwrite(buf + imx_sums[md5_idx].fw_variants[fw_variant].offset,
 592             imx_sums[md5_idx].fw_variants[fw_variant].size, 1, f) != 1)
 593     {
 594         printf("[ERR] Cannot write file\n");
 595         ret = IMX_ERROR;
 596     }
 597     fclose(f);
 598     free(buf);
 599
 600     return ret;
 601 }