utils/samsungtools/samsung.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2012 Amaury Pouly
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  18  * KIND, either express or implied.
  19  *
  20  ****************************************************************************/
  21 #include "samsung.h"
  22 #include <openssl/md5.h>
  23 #include <string.h>
  24 #include <stdlib.h>
  25
  26 #ifndef MIN
  27 #define MIN(a,b) ((a) < (b) ? (a) : (b))
  28 #endif
  29
  30 static uint8_t g_yp_key[128] =
  31 {
  32     0xa3, 0x04, 0xb9, 0xcd, 0x34, 0x13, 0x4a, 0x19, 0x19, 0x35, 0xdf, 0xbb, 0x8f, 0x3d, 0x7f, 0x09,
  33     0x42, 0x3c, 0x96, 0xc6, 0x41, 0xa9, 0x95, 0xf1, 0xd0, 0xac, 0x16, 0x37, 0x57, 0x1f, 0x28, 0xe7,
  34     0x0b, 0xc2, 0x12, 0x09, 0x39, 0x42, 0xd2, 0x96, 0xf5, 0x00, 0xd2, 0x23, 0xa4, 0x24, 0xe2, 0x8e,
  35     0x50, 0x3c, 0x6e, 0x23, 0xeb, 0x68, 0xed, 0x31, 0xb7, 0xee, 0xc0, 0xc7, 0x09, 0xf8, 0x0e, 0x9d,
  36     0x51, 0xed, 0x17, 0x95, 0x64, 0x09, 0xe0, 0xf9, 0xf0, 0xef, 0x86, 0xc0, 0x04, 0x46, 0x89, 0x8a,
  37     0x6e, 0x27, 0x69, 0xde, 0xc7, 0x9d, 0x1e, 0xee, 0x3c, 0x3f, 0x17, 0x05, 0x44, 0xbb, 0xbb, 0x1d,
  38     0x3d, 0x5d, 0x6e, 0xf2, 0xcf, 0x15, 0xd6, 0x3c, 0xcc, 0x7d, 0x67, 0x1a, 0xb8, 0xd2, 0x1b, 0x54,
  39     0x97, 0xa2, 0x58, 0x58, 0xf7, 0x4e, 0x5e, 0x50, 0x42, 0x69, 0xdc, 0xe7, 0x3a, 0x87, 0x2e, 0x22
  40 };
  41
  42 static void cyclic_xor(void *data, int datasize, void *xor, int xorsize)
  43 {
  44     for(int i = 0; i < datasize; i++)
  45         *(uint8_t *)(data + i) ^= *(uint8_t *)(xor + (i % xorsize));
  46 }
  47
  48 struct samsung_firmware_t *samsung_read(samsung_read_t read,
  49     samsung_printf_t printf, void *user, enum samsung_error_t *err)
  50 {
  51     struct yp_header_t yp_hdr;
  52     struct yp_md5_t yp_md5;
  53
  54     /* read and check header */
  55     if(read(user, 0, &yp_hdr, sizeof(yp_hdr)) != sizeof(yp_hdr))
  56     {
  57         printf(user, true, "Cannot read YP header\n");
  58         *err = SAMSUNG_READ_ERROR;
  59         return NULL;
  60     }
  61     if(strncmp(yp_hdr.signature, YP_SIGNATURE, sizeof(yp_hdr.signature)) != 0)
  62     {
  63         printf(user, true, "Bad YP signature\n");
  64         *err = SAMSUNG_FORMAT_ERROR;
  65         return NULL;
  66     }
  67
  68     printf(user, false, "Model: %s\n", yp_hdr.model);
  69     printf(user, false, "Version: %s %s %s\n", yp_hdr.version, yp_hdr.region, yp_hdr.extra);
  70
  71     /* allocate and read data */
  72     struct samsung_firmware_t *fw = malloc(sizeof(struct samsung_firmware_t));
  73     memset(fw, 0, sizeof(struct samsung_firmware_t));
  74     fw->data_size = yp_hdr.datasize;
  75     fw->data = malloc(fw->data_size);
  76     strncpy(fw->version, yp_hdr.version, sizeof(yp_hdr.version));
  77     strncpy(fw->region, yp_hdr.region, sizeof(yp_hdr.region));
  78     strncpy(fw->extra, yp_hdr.extra, sizeof(yp_hdr.extra));
  79     strncpy(fw->model, yp_hdr.model, sizeof(yp_hdr.model));
  80
  81     if(read(user, sizeof(yp_hdr), fw->data, fw->data_size) != fw->data_size)
  82     {
  83         printf(user, true, "Cannot read data\n");
  84         *err = SAMSUNG_READ_ERROR;
  85         samsung_free(fw);
  86         return NULL;
  87     }
  88
  89     /* read and check MD5 */
  90     if(read(user, yp_hdr.datasize + sizeof(yp_hdr), &yp_md5, sizeof(yp_md5)) != sizeof(yp_md5))
  91     {
  92         printf(user, true, "Cannot read MD5 sum\n");
  93         *err = SAMSUNG_READ_ERROR;
  94         samsung_free(fw);
  95         return NULL;
  96     }
  97
  98     uint8_t actual_md5[MD5_DIGEST_LENGTH];
  99     MD5_CTX c;
 100     MD5_Init(&c);
 101     MD5_Update(&c, fw->data, fw->data_size);
 102     MD5_Final(actual_md5, &c);
 103
 104     if(memcmp(actual_md5, yp_md5.md5, MD5_DIGEST_LENGTH) != 0)
 105     {
 106         printf(user, true, "MD5 mismatch\n");
 107         *err = SAMSUNG_MD5_ERROR;
 108         samsung_free(fw);
 109         return NULL;
 110     }
 111
 112     /* decrypt */
 113     cyclic_xor(fw->data, fw->data_size, g_yp_key, sizeof(g_yp_key));
 114
 115     /* success ! */
 116     *err = SAMSUNG_SUCCESS;
 117     return fw;
 118 }
 119
 120 enum samsung_error_t samsung_write(samsung_write_t write, samsung_printf_t printf,
 121     void *user, struct samsung_firmware_t *fw)
 122 {
 123     struct yp_header_t yp_hdr;
 124     struct yp_md5_t yp_md5;
 125
 126     // write header
 127     strncpy(yp_hdr.signature, YP_SIGNATURE, sizeof(yp_hdr.signature));
 128     strncpy(yp_hdr.version, fw->version, sizeof(yp_hdr.version));
 129     strncpy(yp_hdr.region, fw->region, sizeof(yp_hdr.region));
 130     strncpy(yp_hdr.extra, fw->extra, sizeof(yp_hdr.extra));
 131     strncpy(yp_hdr.model, fw->model, sizeof(yp_hdr.model));
 132     yp_hdr.datasize = fw->data_size;
 133
 134     printf(user, false, "Model: %s\n", yp_hdr.model);
 135     printf(user, false, "Version: %s %s %s\n", yp_hdr.version, yp_hdr.region, yp_hdr.extra);
 136
 137     if(write(user, 0, &yp_hdr, sizeof(yp_hdr)) != sizeof(yp_hdr))
 138     {
 139         printf(user, true, "Cannot write header\n");
 140         return SAMSUNG_WRITE_ERROR;
 141     }
 142
 143     // encrypt data
 144     cyclic_xor(fw->data, fw->data_size, g_yp_key, sizeof(g_yp_key));
 145     // compute MD5
 146     MD5_CTX c;
 147     MD5_Init(&c);
 148     MD5_Update(&c, fw->data, fw->data_size);
 149     MD5_Final(yp_md5.md5, &c);
 150
 151     // write data
 152     if(write(user, sizeof(yp_hdr), fw->data, fw->data_size) != fw->data_size)
 153     {
 154         // decrypt data so that the firmware data is the same after the call
 155         cyclic_xor(fw->data, fw->data_size, g_yp_key, sizeof(g_yp_key));
 156         printf(user, true, "Cannot write data\n");
 157         return SAMSUNG_WRITE_ERROR;
 158     }
 159     // decrypt data so that the firmware data is the same after the call
 160     cyclic_xor(fw->data, fw->data_size, g_yp_key, sizeof(g_yp_key));
 161     // write md5
 162     if(write(user, sizeof(yp_hdr) + fw->data_size, &yp_md5, sizeof(yp_md5)) != sizeof(yp_md5))
 163     {
 164         printf(user, true, "Cannot write md5\n");
 165         return SAMSUNG_WRITE_ERROR;
 166     }
 167
 168     return SAMSUNG_SUCCESS;
 169 }
 170
 171 void samsung_free(struct samsung_firmware_t *fw)
 172 {
 173     if(fw)
 174     {
 175         free(fw->data);
 176         free(fw);
 177     }
 178 }