rbutil/mkamsboot/mkamsboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * mkamsboot.c - a tool for merging bootloader code into an Sansa V2
  11  *               (AMS) firmware file
  12  *
  13  * Copyright (C) 2008 Dave Chapman
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21  * KIND, either express or implied.
  22  *
  23  ****************************************************************************/
  24
  25 /*
  26
  27 Insert a Rockbox bootloader into a Sansa AMS original firmware file.
  28
  29 Layout of a Sansa AMS original firmware file:
  30
  31  ----------------------  0x0
  32 |        HEADER        |
  33 |----------------------| 0x400
  34 |    FIRMWARE BLOCK    |
  35 |----------------------| 0x400 + firmware block size
  36 |    LIBRARIES/DATA    |
  37  ----------------------  END
  38
  39 We replace the main firmware block (bytes 0x400..0x400+firmware_size)
  40 as follows:
  41
  42
  43  ----------------------  0x0
  44 |                      |
  45 |    Dual-boot code    |
  46 |                      |
  47 |----------------------|
  48 |     EMPTY SPACE      |
  49 |----------------------|
  50 |                      |
  51 | compressed RB image  |
  52 |                      |
  53 |----------------------|
  54 |                      |
  55 | compressed OF image  |
  56 |                      |
  57 |----------------------|
  58 | UCL unpack function  |
  59  ----------------------
  60
  61 This entire block fits into the space previously occupied by the main
  62 firmware block - the space saved by compressing the OF image is used
  63 to store the compressed version of the Rockbox bootloader.
  64
  65 On version 1 firmwares, the OF image is typically about 120KB, which allows
  66 us to store a Rockbox bootloader with an uncompressed size of about 60KB-70KB.
  67 Version 2 firmwares are bigger and are stored in SDRAM (instead of IRAM).
  68 In both cases, the RAM we are using is mapped at offset 0x0.
  69
  70 mkamsboot then corrects the checksums and writes a new legal firmware
  71 file which can be installed on the device.
  72
  73 When the Sansa device boots, this firmware block is loaded to RAM at
  74 address 0x0 and executed.
  75
  76 Firstly, the dual-boot code will copy the UCL unpack function to the
  77 end of RAM.
  78
  79 Then, depending on the detection of the dual-boot keypress, either the
  80 OF image or the Rockbox image is copied to the end of RAM (just before
  81 the ucl unpack function) and uncompressed to the start of RAM.
  82
  83 Finally, the ucl unpack function branches to address 0x0, passing
  84 execution to the uncompressed firmware.
  85
  86
  87 */
  88
  89 #include <stdio.h>
  90 #include <stdlib.h>
  91 #include <stdint.h>
  92 #include <sys/types.h>
  93 #include <sys/stat.h>
  94 #include <fcntl.h>
  95 #include <unistd.h>
  96 #include <string.h>
  97
  98 #include <ucl/ucl.h>
  99
 100 #include "mkamsboot.h"
 101
 102 #include "md5.h"
 103
 104 /* Header for ARM code binaries */
 105 #include "dualboot.h"
 106
 107 /* Win32 compatibility */
 108 #ifndef O_BINARY
 109 #define O_BINARY 0
 110 #endif
 111
 112 /* 4 for m200, 2 for e200/c200, 1 or 2 for fuze/clip, 1 for clip+ */
 113 const unsigned short hw_revisions[] = {
 114     [MODEL_FUZE]    = 1,
 115     [MODEL_CLIP]    = 1,
 116     [MODEL_CLIPV2]  = 2,
 117     [MODEL_E200V2]  = 2,
 118     [MODEL_M200V4]  = 4,
 119     [MODEL_C200V2]  = 2,
 120     [MODEL_CLIPPLUS]= 1,
 121 };
 122
 123 /* version 2 is used in Clipv2, Clip+ and Fuzev2 firmwares */
 124 const unsigned short fw_revisions[] = {
 125     [MODEL_FUZE]    = 1,
 126     [MODEL_CLIP]    = 1,
 127     [MODEL_CLIPV2]  = 2,
 128     [MODEL_E200V2]  = 1,
 129     [MODEL_M200V4]  = 1,
 130     [MODEL_C200V2]  = 1,
 131     [MODEL_CLIPPLUS]= 2,
 132 };
 133
 134 /* Descriptive name of these models */
 135 const char* model_names[] = {
 136     [MODEL_FUZE]    = "Fuze",
 137     [MODEL_CLIP]    = "Clip",
 138     [MODEL_CLIPV2]  = "Clip",
 139     [MODEL_CLIPPLUS]= "Clip+",
 140     [MODEL_E200V2]  = "e200",
 141     [MODEL_M200V4]  = "m200",
 142     [MODEL_C200V2]  = "c200",
 143 };
 144
 145 /* Dualboot functions for these models */
 146 static const unsigned char* bootloaders[] = {
 147     [MODEL_FUZE]    = dualboot_fuze,
 148     [MODEL_CLIP]    = dualboot_clip,
 149     [MODEL_CLIPV2]  = dualboot_clipv2,
 150     [MODEL_E200V2]  = dualboot_e200v2,
 151     [MODEL_M200V4]  = dualboot_m200v4,
 152     [MODEL_C200V2]  = dualboot_c200v2,
 153     [MODEL_CLIPPLUS]= dualboot_clipplus,
 154 };
 155
 156 /* Size of dualboot functions for these models */
 157 const int bootloader_sizes[] = {
 158     [MODEL_FUZE]    = sizeof(dualboot_fuze),
 159     [MODEL_CLIP]    = sizeof(dualboot_clip),
 160     [MODEL_CLIPV2]  = sizeof(dualboot_clipv2),
 161     [MODEL_E200V2]  = sizeof(dualboot_e200v2),
 162     [MODEL_M200V4]  = sizeof(dualboot_m200v4),
 163     [MODEL_C200V2]  = sizeof(dualboot_c200v2),
 164     [MODEL_CLIPPLUS]= sizeof(dualboot_clipplus),
 165 };
 166
 167 /* Model names used in the Rockbox header in ".sansa" files - these match the
 168    -add parameter to the "scramble" tool */
 169 static const char* rb_model_names[] = {
 170     [MODEL_FUZE]    = "fuze",
 171     [MODEL_CLIP]    = "clip",
 172     [MODEL_CLIPV2]  = "clv2",
 173     [MODEL_E200V2]  = "e2v2",
 174     [MODEL_M200V4]  = "m2v4",
 175     [MODEL_C200V2]  = "c2v2",
 176     [MODEL_CLIPPLUS]= "cli+",
 177 };
 178
 179 /* Model numbers used to initialise the checksum in the Rockbox header in
 180    ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
 181 static const int rb_model_num[] = {
 182     [MODEL_FUZE]    = 43,
 183     [MODEL_CLIP]    = 40,
 184     [MODEL_CLIPV2]  = 60,
 185     [MODEL_E200V2]  = 41,
 186     [MODEL_M200V4]  = 42,
 187     [MODEL_C200V2]  = 44,
 188     [MODEL_CLIPPLUS]= 66,
 189 };
 190
 191 /* Checksums of unmodified original firmwares - for safety, and device
 192    detection */
 193 static struct md5sums sansasums[] = {
 194     /* NOTE: Different regional versions of the firmware normally only
 195              differ in the filename - the md5sums are identical */
 196
 197     /*   model       version    md5                        */
 198     { MODEL_E200V2, "3.01.11", "e622ca8cb6df423f54b8b39628a1f0a3" },
 199     { MODEL_E200V2, "3.01.14", "2c1d0383fc3584b2cc83ba8cc2243af6" },
 200     { MODEL_E200V2, "3.01.16", "12563ad71b25a1034cf2092d1e0218c4" },
 201
 202     { MODEL_FUZE,   "1.01.11", "cac8ffa03c599330ac02c4d41de66166" },
 203     { MODEL_FUZE,   "1.01.15", "df0e2c1612727f722c19a3c764cff7f2" },
 204     { MODEL_FUZE,   "1.01.22", "5aff5486fe8dd64239cc71eac470af98" },
 205     { MODEL_FUZE,   "1.02.26", "7c632c479461c48c8833baed74eb5e4f" },
 206     { MODEL_FUZE,   "1.02.28", "5b34260f6470e75f702a9c6825471752" },
 207     { MODEL_FUZE,   "1.02.31", "66d01b37462a5ef7ccc6ad37188b4235" },
 208
 209     { MODEL_C200V2, "3.02.05", "b6378ebd720b0ade3fad4dc7ab61c1a5" },
 210
 211     { MODEL_M200V4, "4.00.45", "82e3194310d1514e3bbcd06e84c4add3" },
 212     { MODEL_M200V4, "4.01.08-A", "fc9dd6116001b3e6a150b898f1b091f0" },
 213     { MODEL_M200V4, "4.01.08-E", "d3fb7d8ec8624ee65bc99f8dab0e2369" },
 214
 215     { MODEL_CLIP,   "1.01.17", "12caad785d506219d73f538772afd99e" },
 216     { MODEL_CLIP,   "1.01.18", "d720b266bd5afa38a198986ef0508a45" },
 217     { MODEL_CLIP,   "1.01.20", "236d8f75189f468462c03f6d292cf2ac" },
 218     { MODEL_CLIP,   "1.01.29", "c12711342169c66e209540cd1f27cd26" },
 219     { MODEL_CLIP,   "1.01.30", "f2974d47c536549c9d8259170f1dbe4d" },
 220     { MODEL_CLIP,   "1.01.32", "d835d12342500732ffb9c4ee54abec15" },
 221
 222     { MODEL_CLIPV2, "2.01.16", "c57fb3fcbe07c2c9b360f060938f80cb" },
 223     { MODEL_CLIPV2, "2.01.32", "0ad3723e52022509089d938d0fbbf8c5" },
 224
 225 #if 0 /* uncomment when Clip+ support is tested */
 226     { MODEL_CLIPPLUS, "01.02.09", "656d38114774c2001dc18e6726df3c5d" },
 227 #endif
 228 };
 229
 230 #define NUM_MD5S (sizeof(sansasums)/sizeof(sansasums[0]))
 231
 232 int firmware_revision(int model)
 233 {
 234     return fw_revisions[model];
 235 }
 236
 237 static off_t filesize(int fd)
 238 {
 239     struct stat buf;
 240
 241     if (fstat(fd, &buf) < 0) {
 242         perror("[ERR]  Checking filesize of input file");
 243         return -1;
 244     } else {
 245         return(buf.st_size);
 246     }
 247 }
 248
 249 static uint32_t get_uint32le(unsigned char* p)
 250 {
 251     return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 252 }
 253
 254 static uint32_t get_uint32be(unsigned char* p)
 255 {
 256     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 257 }
 258
 259 static void put_uint32le(unsigned char* p, uint32_t x)
 260 {
 261     p[0] = x & 0xff;
 262     p[1] = (x >> 8) & 0xff;
 263     p[2] = (x >> 16) & 0xff;
 264     p[3] = (x >> 24) & 0xff;
 265 }
 266
 267 void calc_MD5(unsigned char* buf, int len, char *md5str)
 268 {
 269     int i;
 270     md5_context ctx;
 271     unsigned char md5sum[16];
 272
 273     md5_starts(&ctx);
 274     md5_update(&ctx, buf, len);
 275     md5_finish(&ctx, md5sum);
 276
 277     for (i = 0; i < 16; ++i)
 278         sprintf(md5str + 2*i, "%02x", md5sum[i]);
 279 }
 280
 281 /* Calculate a simple checksum used in Sansa Original Firmwares */
 282 static uint32_t calc_checksum(unsigned char* buf, uint32_t n)
 283 {
 284     uint32_t sum = 0;
 285     uint32_t i;
 286
 287     for (i=0;i<n;i+=4)
 288         sum += get_uint32le(buf + i);
 289
 290     return sum;
 291 }
 292
 293 static int get_model(int model_id)
 294 {
 295     switch(model_id) {
 296         case 0x1e:
 297             return MODEL_FUZE;
 298         case 0x22:
 299             return MODEL_CLIP;
 300         case 0x23:
 301             return MODEL_C200V2;
 302         case 0x24:
 303             return MODEL_E200V2;
 304         case 0x25:
 305             return MODEL_M200V4;
 306         case 0x27:
 307             return MODEL_CLIPV2;
 308         case 0x28:
 309             return MODEL_CLIPPLUS;
 310     }
 311
 312     return MODEL_UNKNOWN;
 313 }
 314
 315 /* Compress using nrv2e algorithm : Thumb decompressor fits in 168 bytes ! */
 316 static unsigned char* uclpack(unsigned char* inbuf, int insize, int* outsize)
 317 {
 318     int maxsize;
 319     unsigned char* outbuf;
 320     int r;
 321
 322     /* The following formula comes from the UCL documentation */
 323     maxsize = insize + (insize / 8) + 256;
 324
 325     /* Allocate some memory for the output buffer */
 326     outbuf = malloc(maxsize);
 327
 328     if (outbuf == NULL)
 329         return NULL;
 330
 331     r = ucl_nrv2e_99_compress(
 332             (const ucl_bytep) inbuf,
 333             (ucl_uint) insize,
 334             (ucl_bytep) outbuf,
 335             (ucl_uintp) outsize,
 336             0, 10, NULL, NULL);
 337
 338     if (r != UCL_E_OK || *outsize > maxsize) {
 339         /* this should NEVER happen, and implies memory corruption */
 340         fprintf(stderr, "internal error - compression failed: %d\n", r);
 341         free(outbuf);
 342         return NULL;
 343     }
 344
 345     return outbuf;
 346 }
 347
 348 #define ERROR(format, ...) \
 349     do { \
 350         snprintf(errstr, errstrsize, format, __VA_ARGS__); \
 351         goto error; \
 352     } while(0)
 353
 354 /* Loads a Sansa AMS Original Firmware file into memory */
 355 unsigned char* load_of_file(
 356         char* filename, off_t* bufsize, struct md5sums *sum,
 357         int* firmware_size, unsigned char** of_packed,
 358         int* of_packedsize, char* errstr, int errstrsize)
 359 {
 360     int fd;
 361     unsigned char* buf =NULL;
 362     off_t n;
 363     unsigned int i=0;
 364     uint32_t checksum;
 365     int model_id;
 366     unsigned int last_word;
 367
 368     fd = open(filename, O_RDONLY|O_BINARY);
 369     if (fd < 0)
 370         ERROR("[ERR]  Could not open %s for reading\n", filename);
 371
 372     *bufsize = filesize(fd);
 373
 374     buf = malloc(*bufsize);
 375     if (buf == NULL)
 376         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 377
 378     n = read(fd, buf, *bufsize);
 379
 380     if (n != *bufsize)
 381         ERROR("[ERR]  Could not read file %s\n", filename);
 382
 383     /* check the file */
 384
 385     /* Calculate MD5 checksum of OF */
 386     calc_MD5(buf, *bufsize, sum->md5);
 387
 388     while ((i < NUM_MD5S) && (strcmp(sansasums[i].md5, sum->md5) != 0))
 389         i++;
 390
 391     if (i < NUM_MD5S) {
 392         *sum = sansasums[i];
 393     } else {
 394         int fw_version = (get_uint32le(&buf[0x204]) == 0x0000f000) ? 2 : 1;
 395         model_id = buf[(fw_version == 2) ? 0x219 : 0x215];
 396         sum->model = get_model(model_id);
 397
 398         if (sum->model == MODEL_UNKNOWN)
 399             ERROR("[ERR]  Unknown firmware model (v%d) - model id 0x%02x\n",
 400                   fw_version, model_id);
 401
 402 #if 1   /* comment to test new OFs */
 403         char tested_versions[100];
 404         tested_versions[0] = '\0';
 405
 406         for (i = 0; i < NUM_MD5S ; i++)
 407             if (sansasums[i].model == sum->model) {
 408                 if (tested_versions[0] != '\0') {
 409                     strncat(tested_versions, ", ",
 410                         sizeof(tested_versions) - strlen(tested_versions) - 1);
 411                 }
 412                 strncat(tested_versions, sansasums[i].version,
 413                     sizeof(tested_versions) - strlen(tested_versions) - 1);
 414             }
 415
 416         ERROR("[ERR]  Original firmware unknown, please try an other version." \
 417               " Tested %s versions are : %s\n",
 418               model_names[sum->model], tested_versions);
 419 #endif
 420     }
 421
 422     /* TODO: Do some more sanity checks on the OF image. Some images (like
 423        m200v4) dont have a checksum at the end, only padding (0xdeadbeef). */
 424     last_word = *bufsize - 4;
 425     checksum = get_uint32le(buf + last_word);
 426     if (checksum != 0xefbeadde && checksum != calc_checksum(buf, last_word))
 427         ERROR("%s", "[ERR]  Whole file checksum failed\n");
 428
 429     if (bootloaders[sum->model] == NULL)
 430         ERROR("[ERR]  Unsupported model - \"%s\"\n", model_names[sum->model]);
 431
 432     /* Get the firmware size */
 433     if (fw_revisions[sum->model] == 1)
 434         *firmware_size = get_uint32le(&buf[0x0c]);
 435     else if (fw_revisions[sum->model] == 2)
 436         *firmware_size = get_uint32le(&buf[0x10]);
 437
 438     /* Compress the original firmware image */
 439     *of_packed = uclpack(buf + 0x400, *firmware_size, of_packedsize);
 440     if (*of_packed == NULL)
 441         ERROR("[ERR]  Could not compress %s\n", filename);
 442
 443     return buf;
 444
 445 error:
 446     free(buf);
 447     return NULL;
 448 }
 449
 450 /* Loads a rockbox bootloader file into memory */
 451 unsigned char* load_rockbox_file(
 452             char* filename, int model, int* bufsize, int* rb_packedsize,
 453             char* errstr, int errstrsize)
 454 {
 455     int fd;
 456     unsigned char* buf = NULL;
 457     unsigned char* packed = NULL;
 458     unsigned char header[8];
 459     uint32_t sum;
 460     off_t n;
 461     int i;
 462
 463     fd = open(filename, O_RDONLY|O_BINARY);
 464     if (fd < 0)
 465         ERROR("[ERR]  Could not open %s for reading\n", filename);
 466
 467     /* Read Rockbox header */
 468     n = read(fd, header, sizeof(header));
 469     if (n != sizeof(header))
 470         ERROR("[ERR]  Could not read file %s\n", filename);
 471
 472     /* Check for correct model string */
 473     if (memcmp(rb_model_names[model], header + 4, 4)!=0)
 474         ERROR("[ERR]  Model name \"%s\" not found in %s\n",
 475                        rb_model_names[model], filename);
 476
 477     *bufsize = filesize(fd) - sizeof(header);
 478
 479     buf = malloc(*bufsize);
 480     if (buf == NULL)
 481         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 482
 483     n = read(fd, buf, *bufsize);
 484
 485     if (n != *bufsize)
 486         ERROR("[ERR]  Could not read file %s\n", filename);
 487
 488     /* Check checksum */
 489     sum = rb_model_num[model];
 490     for (i = 0; i < *bufsize; i++) {
 491          /* add 8 unsigned bits but keep a 32 bit sum */
 492          sum += buf[i];
 493     }
 494
 495     if (sum != get_uint32be(header))
 496         ERROR("[ERR]  Checksum mismatch in %s\n", filename);
 497
 498     packed = uclpack(buf, *bufsize, rb_packedsize);
 499     if(packed == NULL)
 500         ERROR("[ERR]  Could not compress %s\n", filename);
 501
 502     free(buf);
 503     return packed;
 504
 505 error:
 506     free(buf);
 507     return NULL;
 508 }
 509
 510 #undef ERROR
 511
 512 /* Patches a Sansa AMS Original Firmware file */
 513 void patch_firmware(
 514         int model, int fw_revision, int firmware_size, unsigned char* buf,
 515         int len, unsigned char* of_packed, int of_packedsize,
 516         unsigned char* rb_packed, int rb_packedsize)
 517 {
 518     unsigned char *p;
 519     uint32_t sum, filesum;
 520     unsigned int i;
 521
 522     /* Zero the original firmware area - not needed, but helps debugging */
 523     memset(buf + 0x400, 0, firmware_size);
 524
 525     /* Insert dual-boot bootloader at offset 0 */
 526     memcpy(buf + 0x400, bootloaders[model], bootloader_sizes[model]);
 527
 528     /* We are filling the firmware buffer backwards from the end */
 529     p = buf + 0x400 + firmware_size;
 530
 531     /* 1 - UCL unpack function */
 532     p -= sizeof(nrv2e_d8);
 533     memcpy(p, nrv2e_d8, sizeof(nrv2e_d8));
 534
 535     /* 2 - Compressed copy of original firmware */
 536     p -= of_packedsize;
 537     memcpy(p, of_packed, of_packedsize);
 538
 539     /* 3 - Compressed copy of Rockbox bootloader */
 540     p -= rb_packedsize;
 541     memcpy(p, rb_packed, rb_packedsize);
 542
 543     /* Write the locations of the various images to the variables at the
 544        start of the dualboot image - we save the location of the last byte
 545        in each image, along with the size in bytes */
 546
 547     /* UCL unpack function */
 548     put_uint32le(&buf[0x420], firmware_size - 1);
 549     put_uint32le(&buf[0x424], sizeof(nrv2e_d8));
 550
 551     /* Compressed original firmware image */
 552     put_uint32le(&buf[0x428], firmware_size - sizeof(nrv2e_d8) - 1);
 553     put_uint32le(&buf[0x42c], of_packedsize);
 554
 555     /* Compressed Rockbox image */
 556     put_uint32le(&buf[0x430], firmware_size - sizeof(nrv2e_d8) - of_packedsize
 557             - 1);
 558     put_uint32le(&buf[0x434], rb_packedsize);
 559
 560
 561     /* Update the firmware block checksum */
 562     sum = calc_checksum(buf + 0x400, firmware_size);
 563
 564     if (fw_revision == 1) {
 565         put_uint32le(&buf[0x04], sum);
 566         put_uint32le(&buf[0x204], sum);
 567     } else if (fw_revision == 2) {
 568         put_uint32le(&buf[0x08], sum);
 569         put_uint32le(&buf[0x208], sum);
 570
 571         /* Update the header checksums */
 572         put_uint32le(&buf[0x1fc], calc_checksum(buf, 0x1fc));
 573         put_uint32le(&buf[0x3fc], calc_checksum(buf + 0x200, 0x1fc));
 574     }
 575
 576     /* Update the whole-file checksum */
 577     filesum = 0;
 578     for (i=0;i < (unsigned)len - 4; i+=4)
 579         filesum += get_uint32le(&buf[i]);
 580
 581     put_uint32le(buf + len - 4, filesum);
 582 }
 583
 584 /* returns size of new firmware block */
 585 int total_size(int model, int rb_packedsize, int of_packedsize)
 586 {
 587     return bootloader_sizes[model] + sizeof(nrv2e_d8) + of_packedsize +
 588                 rb_packedsize;
 589 }
 590