rbutil/mkamsboot/mkamsboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * mkamsboot.c - a tool for merging bootloader code into an Sansa V2
  11  *               (AMS) firmware file
  12  *
  13  * Copyright (C) 2008 Dave Chapman
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21  * KIND, either express or implied.
  22  *
  23  ****************************************************************************/
  24
  25 /*
  26
  27 Insert a Rockbox bootloader into an AMS original firmware file.
  28
  29 We replace the main firmware block (bytes 0x400..0x400+firmware_size)
  30 as follows:
  31
  32
  33  ----------------------  0x0
  34 |                      |
  35 |    Dual-boot code    |
  36 |                      |
  37 |----------------------|
  38 |     EMPTY SPACE      |
  39 |----------------------|
  40 |                      |
  41 | compressed RB image  |
  42 |                      |
  43 |----------------------|
  44 |                      |
  45 | compressed OF image  |
  46 |                      |
  47 |----------------------|
  48 | UCL unpack function  |
  49  ----------------------
  50
  51 This entire block fits into the space previously occupied by the main
  52 firmware block - the space saved by compressing the OF image is used
  53 to store the compressed version of the Rockbox bootloader.  The OF
  54 image is typically about 120KB, which allows us to store a Rockbox
  55 bootloader with an uncompressed size of about 60KB-70KB.
  56
  57 mkamsboot then corrects the checksums and writes a new legal firmware
  58 file which can be installed on the device.
  59
  60 When the Sansa device boots, this firmware block is loaded to RAM at
  61 address 0x0 and executed.
  62
  63 Firstly, the dual-boot code will copy the UCL unpack function to the
  64 end of RAM.
  65
  66 Then, depending on the detection of the dual-boot keypress, either the
  67 OF image or the Rockbox image is copied to the end of RAM (just before
  68 the ucl unpack function) and uncompress it to the start of RAM.
  69
  70 Finally, the ucl unpack function branches to address 0x0, passing
  71 execution to the uncompressed firmware.
  72
  73
  74 */
  75
  76
  77 #include <stdio.h>
  78 #include <stdlib.h>
  79 #include <stdint.h>
  80 #include <sys/types.h>
  81 #include <sys/stat.h>
  82 #include <fcntl.h>
  83 #include <unistd.h>
  84 #include <string.h>
  85
  86 #include <ucl/ucl.h>
  87
  88 /* Headers for ARM code binaries */
  89 #include "uclimg.h"
  90 #include "md5.h"
  91
  92 #include "bootimg_clip.h"
  93 #include "bootimg_e200v2.h"
  94 #include "bootimg_m200v2.h"
  95
  96 /* Win32 compatibility */
  97 #ifndef O_BINARY
  98 #define O_BINARY 0
  99 #endif
 100
 101 #ifndef VERSION
 102 #define VERSION "0.1"
 103 #endif
 104
 105 enum
 106 {
 107     MODEL_UNKNOWN = -1,
 108     MODEL_FUZE = 0,
 109     MODEL_CLIP,
 110     MODEL_CLIPV2,
 111     MODEL_E200,
 112     MODEL_M200,
 113     MODEL_C200
 114 };
 115
 116 static const char* model_names[] =
 117 {
 118     "Fuze",
 119     "Clip",
 120     "Clip V2",
 121     "E200",
 122     "M200",
 123     "C200"
 124 };
 125
 126 static const unsigned char* bootloaders[] =
 127 {
 128     NULL,
 129     bootimg_clip,
 130     NULL,
 131     bootimg_e200v2,
 132     bootimg_m200v2,
 133     NULL
 134 };
 135
 136 static const int bootloader_sizes[] =
 137 {
 138     0,
 139     sizeof(bootimg_clip),
 140     0,
 141     sizeof(bootimg_e200v2),
 142     sizeof(bootimg_m200v2),
 143     0
 144 };
 145
 146 /* Model names used in the Rockbox header in ".sansa" files - these match the
 147    -add parameter to the "scramble" tool */
 148 static const char* rb_model_names[] =
 149 {
 150     NULL,
 151     "clip",
 152     NULL,
 153     "e2v2",
 154     "m2v2",
 155     NULL
 156 };
 157
 158 /* Model numbers used to initialise the checksum in the Rockbox header in
 159    ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
 160 static const int rb_model_num[] =
 161 {
 162     0,
 163     40,
 164     0,
 165     41,
 166     42,
 167     0
 168 };
 169
 170 struct md5sums {
 171     int model;
 172     char *version;
 173     int fw_version;
 174     char *md5;
 175 };
 176
 177 /* Checksums of unmodified original firmwares - for safety, and device
 178    detection */
 179 static struct md5sums sansasums[] = {
 180     /* NOTE: Different regional versions of the firmware normally only
 181              differ in the filename - the md5sums are identical */
 182     { MODEL_E200, "3.01.11",   1, "e622ca8cb6df423f54b8b39628a1f0a3" },
 183     { MODEL_E200, "3.01.14",   1, "2c1d0383fc3584b2cc83ba8cc2243af6" },
 184     { MODEL_E200, "3.01.16",   1, "12563ad71b25a1034cf2092d1e0218c4" },
 185
 186     { MODEL_FUZE, "1.01.11",   1, "cac8ffa03c599330ac02c4d41de66166" },
 187     { MODEL_FUZE, "1.01.15",   1, "df0e2c1612727f722c19a3c764cff7f2" },
 188
 189     { MODEL_C200, "3.02.05",   1, "b6378ebd720b0ade3fad4dc7ab61c1a5" },
 190
 191     { MODEL_M200, "4.00.45",   1, "82e3194310d1514e3bbcd06e84c4add3" },
 192     { MODEL_M200, "4.01.08-A", 1, "fc9dd6116001b3e6a150b898f1b091f0" },
 193     { MODEL_M200, "4.01.08-E", 1, "d3fb7d8ec8624ee65bc99f8dab0e2369" },
 194
 195     { MODEL_CLIP, "1.01.17",   1, "12caad785d506219d73f538772afd99e" },
 196     { MODEL_CLIP, "1.01.18",   1, "d720b266bd5afa38a198986ef0508a45" },
 197     { MODEL_CLIP, "1.01.20",   1, "236d8f75189f468462c03f6d292cf2ac" },
 198     { MODEL_CLIP, "1.01.29",   1, "c12711342169c66e209540cd1f27cd26" },
 199     { MODEL_CLIP, "1.01.30",   1, "f2974d47c536549c9d8259170f1dbe4d" },
 200 };
 201
 202 #define NUM_MD5S (sizeof(sansasums)/sizeof(sansasums[0]))
 203
 204 static off_t filesize(int fd) {
 205     struct stat buf;
 206
 207     if (fstat(fd,&buf) < 0) {
 208         perror("[ERR]  Checking filesize of input file");
 209         return -1;
 210     } else {
 211         return(buf.st_size);
 212     }
 213 }
 214
 215 static uint32_t get_uint32le(unsigned char* p)
 216 {
 217     return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 218 }
 219
 220 static uint32_t get_uint32be(unsigned char* p)
 221 {
 222     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 223 }
 224
 225 static void put_uint32le(unsigned char* p, uint32_t x)
 226 {
 227     p[0] = x & 0xff;
 228     p[1] = (x >> 8) & 0xff;
 229     p[2] = (x >> 16) & 0xff;
 230     p[3] = (x >> 24) & 0xff;
 231 }
 232
 233 void calc_MD5(unsigned char* buf, int len, char *md5str)
 234 {
 235     int i;
 236     md5_context ctx;
 237     unsigned char md5sum[16];
 238
 239     md5_starts(&ctx);
 240     md5_update(&ctx, buf, len);
 241     md5_finish(&ctx, md5sum);
 242
 243     for (i = 0; i < 16; ++i)
 244         sprintf(md5str + 2*i, "%02x", md5sum[i]);
 245 }
 246
 247
 248 static uint32_t calc_checksum(unsigned char* buf, uint32_t n)
 249 {
 250     uint32_t sum = 0;
 251     uint32_t i;
 252
 253     for (i=0;i<n;i+=4)
 254         sum += get_uint32le(buf + i);
 255
 256     return sum;
 257 }
 258
 259 static int get_model(int model_id)
 260 {
 261     switch(model_id)
 262     {
 263         case 0x1e:
 264             return MODEL_FUZE;
 265         case 0x22:
 266             return MODEL_CLIP;
 267         case 0x23:
 268             return MODEL_C200;
 269         case 0x24:
 270             return MODEL_E200;
 271         case 0x25:
 272             return MODEL_M200;
 273         case 0x27:
 274             return MODEL_CLIPV2;
 275     }
 276
 277     return MODEL_UNKNOWN;
 278 }
 279
 280
 281 static unsigned char* uclpack(unsigned char* inbuf, int insize, int* outsize)
 282 {
 283     int maxsize;
 284     unsigned char* outbuf;
 285     int r;
 286
 287     /* The following formula comes from the UCL documentation */
 288     maxsize = insize + (insize / 8) + 256;
 289
 290     /* Allocate some memory for the output buffer */
 291     outbuf = malloc(maxsize);
 292
 293     if (outbuf == NULL) {
 294         return NULL;
 295     }
 296
 297     r = ucl_nrv2e_99_compress(
 298             (const ucl_bytep) inbuf,
 299             (ucl_uint) insize,
 300             (ucl_bytep) outbuf,
 301             (ucl_uintp) outsize,
 302             0, 10, NULL, NULL);
 303
 304     if (r != UCL_E_OK || *outsize > maxsize)
 305     {
 306         /* this should NEVER happen, and implies memory corruption */
 307         fprintf(stderr, "internal error - compression failed: %d\n", r);
 308         free(outbuf);
 309         return NULL;
 310     }
 311
 312     return outbuf;
 313 }
 314
 315 static unsigned char* load_file(char* filename, off_t* bufsize)
 316 {
 317     int fd;
 318     unsigned char* buf;
 319     off_t n;
 320
 321     fd = open(filename, O_RDONLY|O_BINARY);
 322     if (fd < 0)
 323     {
 324         fprintf(stderr,"[ERR]  Could not open %s for reading\n",filename);
 325         return NULL;
 326     }
 327
 328     *bufsize = filesize(fd);
 329
 330     buf = malloc(*bufsize);
 331     if (buf == NULL) {
 332         fprintf(stderr,"[ERR]  Could not allocate memory for %s\n",filename);
 333         return NULL;
 334     }
 335
 336     n = read(fd, buf, *bufsize);
 337
 338     if (n != *bufsize) {
 339         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 340         return NULL;
 341     }
 342
 343     return buf;
 344 }
 345
 346
 347 static unsigned char* load_rockbox_file(char* filename, int model, off_t* bufsize)
 348 {
 349     int fd;
 350     unsigned char* buf;
 351     unsigned char header[8];
 352     uint32_t sum;
 353     off_t n;
 354     int i;
 355
 356     fd = open(filename, O_RDONLY|O_BINARY);
 357     if (fd < 0)
 358     {
 359         fprintf(stderr,"[ERR]  Could not open %s for reading\n",filename);
 360         return NULL;
 361     }
 362
 363     /* Read Rockbox header */
 364     n = read(fd, header, sizeof(header));
 365     if (n != sizeof(header)) {
 366         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 367         return NULL;
 368     }
 369
 370     /* Check for correct model string */
 371     if (memcmp(rb_model_names[model],header + 4,4)!=0) {
 372         fprintf(stderr,"[ERR]  Model name \"%s\" not found in %s\n",
 373                        rb_model_names[model],filename);
 374     }
 375
 376     *bufsize = filesize(fd) - sizeof(header);
 377
 378     buf = malloc(*bufsize);
 379     if (buf == NULL) {
 380         fprintf(stderr,"[ERR]  Could not allocate memory for %s\n",filename);
 381         return NULL;
 382     }
 383
 384     n = read(fd, buf, *bufsize);
 385
 386     if (n != *bufsize) {
 387         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 388         return NULL;
 389     }
 390
 391     /* Check checksum */
 392     sum = rb_model_num[model];
 393     for (i = 0; i < *bufsize; i++) {
 394          /* add 8 unsigned bits but keep a 32 bit sum */
 395          sum += buf[i];
 396     }
 397
 398     if (sum != get_uint32be(header)) {
 399         fprintf(stderr,"[ERR]  Checksum mismatch in %s\n",filename);
 400         return NULL;
 401     }
 402     return buf;
 403 }
 404
 405
 406 int main(int argc, char* argv[])
 407 {
 408     char *infile, *bootfile, *outfile;
 409     int fdout;
 410     off_t len;
 411     uint32_t n;
 412     unsigned char* buf;
 413     int firmware_size;
 414     off_t bootloader_size;
 415     uint32_t sum,filesum;
 416     uint8_t  model_id;
 417     int model;
 418     uint32_t i;
 419     unsigned char* of_packed;
 420     int of_packedsize;
 421     unsigned char* rb_unpacked;
 422     unsigned char* rb_packed;
 423     int rb_packedsize;
 424     int fw_version;
 425     int totalsize;
 426     unsigned char* p;
 427     uint32_t checksum;
 428     char md5sum[33]; /* 32 hex digits, plus terminating zero */
 429
 430     fprintf(stderr,"mkamsboot v" VERSION " - (C) Dave Chapman and Rafaël Carré 2008\n");
 431     fprintf(stderr,"This is free software; see the source for copying conditions.  There is NO\n");
 432     fprintf(stderr,"warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n");
 433
 434     if(argc != 4) {
 435         printf("Usage: mkamsboot <firmware file> <boot file> <output file>\n\n");
 436         return 1;
 437     }
 438
 439     infile = argv[1];
 440     bootfile = argv[2];
 441     outfile = argv[3];
 442
 443     /* Load original firmware file */
 444     buf = load_file(infile, &len);
 445
 446     if (buf == NULL) {
 447         fprintf(stderr,"[ERR]  Could not load %s\n",infile);
 448         return 1;
 449     }
 450
 451     /* Calculate MD5 checksum of OF */
 452     calc_MD5(buf, len, md5sum);
 453
 454     fprintf(stderr,"[INFO] MD5 sum - %s\n",md5sum);
 455
 456     i = 0;
 457     while ((i < NUM_MD5S) && (strcmp(sansasums[i].md5, md5sum) != 0))
 458         i++;
 459
 460     if (i < NUM_MD5S) {
 461         model = sansasums[i].model;
 462         fw_version = sansasums[i].fw_version;
 463         fprintf(stderr,"[INFO] Original firmware MD5 checksum match - %s %s\n",
 464                        model_names[model], sansasums[i].version);
 465     } else {
 466         fprintf(stderr,"[WARN] ****** Original firmware unknown ******\n");
 467
 468         if (get_uint32le(&buf[0x204])==0x0000f000) {
 469             fw_version = 2;
 470             model_id = buf[0x219];
 471         } else {
 472             fw_version = 1;
 473             model_id = buf[0x215];
 474         }
 475
 476         model = get_model(model_id);
 477
 478         if (model == MODEL_UNKNOWN) {
 479             fprintf(stderr,"[ERR]  Unknown firmware - model id 0x%02x\n",
 480                            model_id);
 481             free(buf);
 482             return 1;
 483         }
 484     }
 485
 486
 487     /* TODO: Do some more sanity checks on the OF image. Some images (like m200v2) dont have a checksum at the end, only padding (0xdeadbeef). */
 488     checksum = get_uint32le(buf + len - 4);
 489     if (checksum != 0xefbeadde && checksum != calc_checksum(buf, len - 4)) {
 490
 491         fprintf(stderr,"[ERR]  Whole file checksum failed - %s\n",infile);
 492         free(buf);
 493         return 1;
 494     }
 495
 496     if (bootloaders[model] == NULL) {
 497         fprintf(stderr,"[ERR]  Unsupported model - \"%s\"\n",model_names[model]);
 498         free(buf);
 499         return 1;
 500     }
 501
 502     /* Load bootloader file */
 503     rb_unpacked = load_rockbox_file(bootfile, model, &bootloader_size);
 504     if (rb_unpacked == NULL) {
 505         fprintf(stderr,"[ERR]  Could not load %s\n",bootfile);
 506         free(buf);
 507         return 1;
 508     }
 509
 510     printf("[INFO] Patching %s firmware\n",model_names[model]);
 511
 512     /* Get the firmware size */
 513     firmware_size = get_uint32le(&buf[0x0c]);
 514
 515     /* Compress the original firmware image */
 516     of_packed = uclpack(buf + 0x400, firmware_size, &of_packedsize);
 517     if (of_packed == NULL) {
 518         fprintf(stderr,"[ERR]  Could not compress original firmware\n");
 519         free(buf);
 520         free(rb_unpacked);
 521         return 1;
 522     }
 523
 524     rb_packed = uclpack(rb_unpacked, bootloader_size, &rb_packedsize);
 525     if (rb_packed == NULL) {
 526         fprintf(stderr,"[ERR]  Could not compress %s\n",bootfile);
 527         free(buf);
 528         free(rb_unpacked);
 529         free(of_packed);
 530         return 1;
 531     }
 532
 533     /* We are finished with the unpacked version of the bootloader */
 534     free(rb_unpacked);
 535
 536     fprintf(stderr,"[INFO] Original firmware size:   %d bytes\n",firmware_size);
 537     fprintf(stderr,"[INFO] Packed OF size:           %d bytes\n",of_packedsize);
 538     fprintf(stderr,"[INFO] Bootloader size:          %d bytes\n",(int)bootloader_size);
 539     fprintf(stderr,"[INFO] Packed bootloader size:   %d bytes\n",rb_packedsize);
 540     fprintf(stderr,"[INFO] Dual-boot function size:  %d bytes\n",bootloader_sizes[model]);
 541     fprintf(stderr,"[INFO] UCL unpack function size: %d bytes\n",sizeof(uclimg));
 542
 543     totalsize = bootloader_sizes[model] + sizeof(uclimg) + of_packedsize +
 544                 rb_packedsize;
 545
 546     fprintf(stderr,"[INFO] Total size of new image:  %d bytes\n",totalsize);
 547
 548     if (totalsize > firmware_size) {
 549         fprintf(stderr,"[ERR]  No room to insert bootloader, aborting\n");
 550         free(buf);
 551         free(rb_unpacked);
 552         free(of_packed);
 553         return 1;
 554     }
 555
 556     /* Zero the original firmware area - not needed, but helps debugging */
 557     memset(buf + 0x400, 0, firmware_size);
 558
 559
 560     /* Insert dual-boot bootloader at offset 0 */
 561     memcpy(buf + 0x400, bootloaders[model], bootloader_sizes[model]);
 562
 563     /* We are filling the firmware buffer backwards from the end */
 564     p = buf + 0x400 + firmware_size;
 565
 566     /* 1 - UCL unpack function */
 567     p -= sizeof(uclimg);
 568     memcpy(p, uclimg, sizeof(uclimg));
 569
 570     /* 2 - Compressed copy of original firmware */
 571     p -= of_packedsize;
 572     memcpy(p, of_packed, of_packedsize);
 573
 574     /* 3 - Compressed copy of Rockbox bootloader */
 575     p -= rb_packedsize;
 576     memcpy(p, rb_packed, rb_packedsize);
 577
 578     /* Write the locations of the various images to the variables at the
 579        start of the dualboot image - we save the location of the last byte
 580        in each image, along with the size in bytes */
 581
 582     /* UCL unpack function */
 583     put_uint32le(&buf[0x420], firmware_size - 1);
 584     put_uint32le(&buf[0x424], sizeof(uclimg));
 585
 586     /* Compressed original firmware image */
 587     put_uint32le(&buf[0x428], firmware_size - sizeof(uclimg) - 1);
 588     put_uint32le(&buf[0x42c], of_packedsize);
 589
 590     /* Compressed Rockbox image */
 591     put_uint32le(&buf[0x430], firmware_size - sizeof(uclimg) - of_packedsize - 1);
 592     put_uint32le(&buf[0x434], rb_packedsize);
 593
 594
 595     /* Update the firmware block checksum */
 596     sum = calc_checksum(buf + 0x400,firmware_size);
 597
 598     if (fw_version == 1) {
 599         put_uint32le(&buf[0x04], sum);
 600         put_uint32le(&buf[0x204], sum);
 601     } else {
 602         /* TODO: Verify that this is correct for the v2 firmware */
 603
 604         put_uint32le(&buf[0x08], sum);
 605         put_uint32le(&buf[0x208], sum);
 606
 607         /* Update the header checksums */
 608         put_uint32le(&buf[0x1fc], calc_checksum(buf, 0x1fc));
 609         put_uint32le(&buf[0x3fc], calc_checksum(buf + 0x200, 0x1fc));
 610     }
 611
 612     /* Update the whole-file checksum */
 613     filesum = 0;
 614     for (i=0;i < (unsigned)len - 4; i+=4)
 615         filesum += get_uint32le(&buf[i]);
 616
 617     put_uint32le(buf + len - 4, filesum);
 618
 619
 620     /* Write the new firmware */
 621     fdout = open(outfile, O_CREAT|O_TRUNC|O_WRONLY|O_BINARY,0666);
 622
 623     if (fdout < 0) {
 624         fprintf(stderr,"[ERR]  Could not open %s for writing\n",outfile);
 625         return 1;
 626     }
 627
 628     n = write(fdout, buf, len);
 629
 630     if (n != (unsigned)len) {
 631         fprintf(stderr,"[ERR]  Could not write firmware file\n");
 632         return 1;
 633     }
 634
 635     close(fdout);
 636
 637     fprintf(stderr," *****************************************************************************\n");
 638     fprintf(stderr," *** THIS CODE IS UNTESTED - DO NOT USE IF YOU CAN NOT RECOVER YOUR DEVICE ***\n");
 639     fprintf(stderr," *****************************************************************************\n");
 640
 641     return 0;
 642
 643 }