rbutil/mkamsboot/mkamsboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * mkamsboot.c - a tool for merging bootloader code into an Sansa V2
  11  *               (AMS) firmware file
  12  *
  13  * Copyright (C) 2008 Dave Chapman
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21  * KIND, either express or implied.
  22  *
  23  ****************************************************************************/
  24
  25 /*
  26
  27 Insert a Rockbox bootloader into an AMS original firmware file.
  28
  29 We replace the main firmware block (bytes 0x400..0x400+firmware_size)
  30 as follows:
  31
  32
  33  ----------------------  0x0
  34 |                      |
  35 |    Dual-boot code    |
  36 |                      |
  37 |----------------------|
  38 |     EMPTY SPACE      |
  39 |----------------------|
  40 |                      |
  41 | compressed RB image  |
  42 |                      |
  43 |----------------------|
  44 |                      |
  45 | compressed OF image  |
  46 |                      |
  47 |----------------------|
  48 | UCL unpack function  |
  49  ----------------------
  50
  51 This entire block fits into the space previously occupied by the main
  52 firmware block - the space saved by compressing the OF image is used
  53 to store the compressed version of the Rockbox bootloader.  The OF
  54 image is typically about 120KB, which allows us to store a Rockbox
  55 bootloader with an uncompressed size of about 60KB-70KB.
  56
  57 mkamsboot then corrects the checksums and writes a new legal firmware
  58 file which can be installed on the device.
  59
  60 When the Sansa device boots, this firmware block is loaded to RAM at
  61 address 0x0 and executed.
  62
  63 Firstly, the dual-boot code will copy the UCL unpack function to the
  64 end of RAM.
  65
  66 Then, depending on the detection of the dual-boot keypress, either the
  67 OF image or the Rockbox image is copied to the end of RAM (just before
  68 the ucl unpack function) and uncompress it to the start of RAM.
  69
  70 Finally, the ucl unpack function branches to address 0x0, passing
  71 execution to the uncompressed firmware.
  72
  73
  74 */
  75
  76
  77 #include <stdio.h>
  78 #include <stdlib.h>
  79 #include <stdint.h>
  80 #include <sys/types.h>
  81 #include <sys/stat.h>
  82 #include <fcntl.h>
  83 #include <unistd.h>
  84 #include <string.h>
  85
  86 #include <ucl/ucl.h>
  87
  88 /* Headers for ARM code binaries */
  89 #include "nrv2e_d8.h"
  90 #include "md5.h"
  91
  92 #include "dualboot_clip.h"
  93 #include "dualboot_e200v2.h"
  94 #include "dualboot_fuze.h"
  95 #include "dualboot_m200v4.h"
  96 #include "dualboot_c200v2.h"
  97
  98 /* Win32 compatibility */
  99 #ifndef O_BINARY
 100 #define O_BINARY 0
 101 #endif
 102
 103 #ifndef VERSION
 104 #define VERSION "0.1"
 105 #endif
 106
 107 enum
 108 {
 109     MODEL_UNKNOWN = -1,
 110     MODEL_FUZE = 0,
 111     MODEL_CLIP,
 112     MODEL_CLIPV2,
 113     MODEL_E200V2,
 114     MODEL_M200V4,
 115     MODEL_C200V2,
 116 };
 117
 118 static const char* model_names[] =
 119 {
 120     "Fuze",
 121     "Clip",
 122     "Clip V2",
 123     "e200 v2",
 124     "m200 v4",
 125     "c200 v2"
 126 };
 127
 128 static const unsigned char* bootloaders[] =
 129 {
 130     dualboot_fuze,
 131     dualboot_clip,
 132     NULL,
 133     dualboot_e200v2,
 134     dualboot_m200v4,
 135     dualboot_c200v2,
 136 };
 137
 138 static const int bootloader_sizes[] =
 139 {
 140     sizeof(dualboot_fuze),
 141     sizeof(dualboot_clip),
 142     0,
 143     sizeof(dualboot_e200v2),
 144     sizeof(dualboot_m200v4),
 145     sizeof(dualboot_c200v2),
 146 };
 147
 148 /* Model names used in the Rockbox header in ".sansa" files - these match the
 149    -add parameter to the "scramble" tool */
 150 static const char* rb_model_names[] =
 151 {
 152     "fuze",
 153     "clip",
 154     NULL,
 155     "e2v2",
 156     "m2v4",
 157     "c2v2",
 158 };
 159
 160 /* Model numbers used to initialise the checksum in the Rockbox header in
 161    ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
 162 static const int rb_model_num[] =
 163 {
 164     43,
 165     40,
 166     0,
 167     41,
 168     42,
 169     44
 170 };
 171
 172 struct md5sums {
 173     int model;
 174     char *version;
 175     int fw_version;
 176     char *md5;
 177 };
 178
 179 /* Checksums of unmodified original firmwares - for safety, and device
 180    detection */
 181 static struct md5sums sansasums[] = {
 182     /* NOTE: Different regional versions of the firmware normally only
 183              differ in the filename - the md5sums are identical */
 184     { MODEL_E200V2, "3.01.11",   1, "e622ca8cb6df423f54b8b39628a1f0a3" },
 185     { MODEL_E200V2, "3.01.14",   1, "2c1d0383fc3584b2cc83ba8cc2243af6" },
 186     { MODEL_E200V2, "3.01.16",   1, "12563ad71b25a1034cf2092d1e0218c4" },
 187
 188     { MODEL_FUZE, "1.01.11",   1, "cac8ffa03c599330ac02c4d41de66166" },
 189     { MODEL_FUZE, "1.01.15",   1, "df0e2c1612727f722c19a3c764cff7f2" },
 190     { MODEL_FUZE, "1.01.22",   1, "5aff5486fe8dd64239cc71eac470af98" },
 191
 192     { MODEL_C200V2, "3.02.05",   1, "b6378ebd720b0ade3fad4dc7ab61c1a5" },
 193
 194     { MODEL_M200V4, "4.00.45",   1, "82e3194310d1514e3bbcd06e84c4add3" },
 195     { MODEL_M200V4, "4.01.08-A", 1, "fc9dd6116001b3e6a150b898f1b091f0" },
 196     { MODEL_M200V4, "4.01.08-E", 1, "d3fb7d8ec8624ee65bc99f8dab0e2369" },
 197
 198     { MODEL_CLIP, "1.01.17",   1, "12caad785d506219d73f538772afd99e" },
 199     { MODEL_CLIP, "1.01.18",   1, "d720b266bd5afa38a198986ef0508a45" },
 200     { MODEL_CLIP, "1.01.20",   1, "236d8f75189f468462c03f6d292cf2ac" },
 201     { MODEL_CLIP, "1.01.29",   1, "c12711342169c66e209540cd1f27cd26" },
 202     { MODEL_CLIP, "1.01.30",   1, "f2974d47c536549c9d8259170f1dbe4d" },
 203     { MODEL_CLIP, "1.01.32",   1, "d835d12342500732ffb9c4ee54abec15" },
 204 };
 205
 206 #define NUM_MD5S (sizeof(sansasums)/sizeof(sansasums[0]))
 207
 208 static off_t filesize(int fd) {
 209     struct stat buf;
 210
 211     if (fstat(fd,&buf) < 0) {
 212         perror("[ERR]  Checking filesize of input file");
 213         return -1;
 214     } else {
 215         return(buf.st_size);
 216     }
 217 }
 218
 219 static uint32_t get_uint32le(unsigned char* p)
 220 {
 221     return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 222 }
 223
 224 static uint32_t get_uint32be(unsigned char* p)
 225 {
 226     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 227 }
 228
 229 static void put_uint32le(unsigned char* p, uint32_t x)
 230 {
 231     p[0] = x & 0xff;
 232     p[1] = (x >> 8) & 0xff;
 233     p[2] = (x >> 16) & 0xff;
 234     p[3] = (x >> 24) & 0xff;
 235 }
 236
 237 void calc_MD5(unsigned char* buf, int len, char *md5str)
 238 {
 239     int i;
 240     md5_context ctx;
 241     unsigned char md5sum[16];
 242
 243     md5_starts(&ctx);
 244     md5_update(&ctx, buf, len);
 245     md5_finish(&ctx, md5sum);
 246
 247     for (i = 0; i < 16; ++i)
 248         sprintf(md5str + 2*i, "%02x", md5sum[i]);
 249 }
 250
 251
 252 static uint32_t calc_checksum(unsigned char* buf, uint32_t n)
 253 {
 254     uint32_t sum = 0;
 255     uint32_t i;
 256
 257     for (i=0;i<n;i+=4)
 258         sum += get_uint32le(buf + i);
 259
 260     return sum;
 261 }
 262
 263 static int get_model(int model_id)
 264 {
 265     switch(model_id)
 266     {
 267         case 0x1e:
 268             return MODEL_FUZE;
 269         case 0x22:
 270             return MODEL_CLIP;
 271         case 0x23:
 272             return MODEL_C200V2;
 273         case 0x24:
 274             return MODEL_E200V2;
 275         case 0x25:
 276             return MODEL_M200V4;
 277         case 0x27:
 278             return MODEL_CLIPV2;
 279     }
 280
 281     return MODEL_UNKNOWN;
 282 }
 283
 284
 285 static unsigned char* uclpack(unsigned char* inbuf, int insize, int* outsize)
 286 {
 287     int maxsize;
 288     unsigned char* outbuf;
 289     int r;
 290
 291     /* The following formula comes from the UCL documentation */
 292     maxsize = insize + (insize / 8) + 256;
 293
 294     /* Allocate some memory for the output buffer */
 295     outbuf = malloc(maxsize);
 296
 297     if (outbuf == NULL) {
 298         return NULL;
 299     }
 300
 301     r = ucl_nrv2e_99_compress(
 302             (const ucl_bytep) inbuf,
 303             (ucl_uint) insize,
 304             (ucl_bytep) outbuf,
 305             (ucl_uintp) outsize,
 306             0, 10, NULL, NULL);
 307
 308     if (r != UCL_E_OK || *outsize > maxsize)
 309     {
 310         /* this should NEVER happen, and implies memory corruption */
 311         fprintf(stderr, "internal error - compression failed: %d\n", r);
 312         free(outbuf);
 313         return NULL;
 314     }
 315
 316     return outbuf;
 317 }
 318
 319 static unsigned char* load_file(char* filename, off_t* bufsize)
 320 {
 321     int fd;
 322     unsigned char* buf;
 323     off_t n;
 324
 325     fd = open(filename, O_RDONLY|O_BINARY);
 326     if (fd < 0)
 327     {
 328         fprintf(stderr,"[ERR]  Could not open %s for reading\n",filename);
 329         return NULL;
 330     }
 331
 332     *bufsize = filesize(fd);
 333
 334     buf = malloc(*bufsize);
 335     if (buf == NULL) {
 336         fprintf(stderr,"[ERR]  Could not allocate memory for %s\n",filename);
 337         return NULL;
 338     }
 339
 340     n = read(fd, buf, *bufsize);
 341
 342     if (n != *bufsize) {
 343         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 344         return NULL;
 345     }
 346
 347     return buf;
 348 }
 349
 350
 351 static unsigned char* load_rockbox_file(char* filename, int model, off_t* bufsize)
 352 {
 353     int fd;
 354     unsigned char* buf;
 355     unsigned char header[8];
 356     uint32_t sum;
 357     off_t n;
 358     int i;
 359
 360     fd = open(filename, O_RDONLY|O_BINARY);
 361     if (fd < 0)
 362     {
 363         fprintf(stderr,"[ERR]  Could not open %s for reading\n",filename);
 364         return NULL;
 365     }
 366
 367     /* Read Rockbox header */
 368     n = read(fd, header, sizeof(header));
 369     if (n != sizeof(header)) {
 370         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 371         return NULL;
 372     }
 373
 374     /* Check for correct model string */
 375     if (memcmp(rb_model_names[model],header + 4,4)!=0) {
 376         fprintf(stderr,"[ERR]  Model name \"%s\" not found in %s\n",
 377                        rb_model_names[model],filename);
 378     }
 379
 380     *bufsize = filesize(fd) - sizeof(header);
 381
 382     buf = malloc(*bufsize);
 383     if (buf == NULL) {
 384         fprintf(stderr,"[ERR]  Could not allocate memory for %s\n",filename);
 385         return NULL;
 386     }
 387
 388     n = read(fd, buf, *bufsize);
 389
 390     if (n != *bufsize) {
 391         fprintf(stderr,"[ERR]  Could not read file %s\n",filename);
 392         return NULL;
 393     }
 394
 395     /* Check checksum */
 396     sum = rb_model_num[model];
 397     for (i = 0; i < *bufsize; i++) {
 398          /* add 8 unsigned bits but keep a 32 bit sum */
 399          sum += buf[i];
 400     }
 401
 402     if (sum != get_uint32be(header)) {
 403         fprintf(stderr,"[ERR]  Checksum mismatch in %s\n",filename);
 404         return NULL;
 405     }
 406     return buf;
 407 }
 408
 409
 410 int main(int argc, char* argv[])
 411 {
 412     char *infile, *bootfile, *outfile;
 413     int fdout;
 414     off_t len;
 415     uint32_t n;
 416     unsigned char* buf;
 417     int firmware_size;
 418     off_t bootloader_size;
 419     uint32_t sum,filesum;
 420     uint8_t  model_id;
 421     int model;
 422     uint32_t i;
 423     unsigned char* of_packed;
 424     int of_packedsize;
 425     unsigned char* rb_unpacked;
 426     unsigned char* rb_packed;
 427     int rb_packedsize;
 428     int fw_version;
 429     int totalsize;
 430     unsigned char* p;
 431     uint32_t checksum;
 432     char md5sum[33]; /* 32 hex digits, plus terminating zero */
 433
 434     fprintf(stderr,"mkamsboot v" VERSION " - (C) Dave Chapman and Rafaël Carré 2008\n");
 435     fprintf(stderr,"This is free software; see the source for copying conditions.  There is NO\n");
 436     fprintf(stderr,"warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n");
 437
 438     if(argc != 4) {
 439         printf("Usage: mkamsboot <firmware file> <boot file> <output file>\n\n");
 440         return 1;
 441     }
 442
 443     infile = argv[1];
 444     bootfile = argv[2];
 445     outfile = argv[3];
 446
 447     /* Load original firmware file */
 448     buf = load_file(infile, &len);
 449
 450     if (buf == NULL) {
 451         fprintf(stderr,"[ERR]  Could not load %s\n",infile);
 452         return 1;
 453     }
 454
 455     /* Calculate MD5 checksum of OF */
 456     calc_MD5(buf, len, md5sum);
 457
 458     fprintf(stderr,"[INFO] MD5 sum - %s\n",md5sum);
 459
 460     i = 0;
 461     while ((i < NUM_MD5S) && (strcmp(sansasums[i].md5, md5sum) != 0))
 462         i++;
 463
 464     if (i < NUM_MD5S) {
 465         model = sansasums[i].model;
 466         fw_version = sansasums[i].fw_version;
 467         fprintf(stderr,"[INFO] Original firmware MD5 checksum match - %s %s\n",
 468                        model_names[model], sansasums[i].version);
 469     } else {
 470         fprintf(stderr,"[WARN] ****** Original firmware unknown ******\n");
 471
 472         if (get_uint32le(&buf[0x204])==0x0000f000) {
 473             fw_version = 2;
 474             model_id = buf[0x219];
 475         } else {
 476             fw_version = 1;
 477             model_id = buf[0x215];
 478         }
 479
 480         model = get_model(model_id);
 481
 482         if (model == MODEL_UNKNOWN) {
 483             fprintf(stderr,"[ERR]  Unknown firmware - model id 0x%02x\n",
 484                            model_id);
 485             free(buf);
 486             return 1;
 487         }
 488     }
 489
 490
 491     /* TODO: Do some more sanity checks on the OF image. Some images (like
 492        m200v4) dont have a checksum at the end, only padding (0xdeadbeef). */
 493     checksum = get_uint32le(buf + len - 4);
 494     if (checksum != 0xefbeadde && checksum != calc_checksum(buf, len - 4)) {
 495
 496         fprintf(stderr,"[ERR]  Whole file checksum failed - %s\n",infile);
 497         free(buf);
 498         return 1;
 499     }
 500
 501     if (bootloaders[model] == NULL) {
 502         fprintf(stderr,"[ERR]  Unsupported model - \"%s\"\n",model_names[model]);
 503         free(buf);
 504         return 1;
 505     }
 506
 507     /* Load bootloader file */
 508     rb_unpacked = load_rockbox_file(bootfile, model, &bootloader_size);
 509     if (rb_unpacked == NULL) {
 510         fprintf(stderr,"[ERR]  Could not load %s\n",bootfile);
 511         free(buf);
 512         return 1;
 513     }
 514
 515     printf("[INFO] Patching %s firmware\n",model_names[model]);
 516
 517     /* Get the firmware size */
 518     firmware_size = get_uint32le(&buf[0x0c]);
 519
 520     /* Compress the original firmware image */
 521     of_packed = uclpack(buf + 0x400, firmware_size, &of_packedsize);
 522     if (of_packed == NULL) {
 523         fprintf(stderr,"[ERR]  Could not compress original firmware\n");
 524         free(buf);
 525         free(rb_unpacked);
 526         return 1;
 527     }
 528
 529     rb_packed = uclpack(rb_unpacked, bootloader_size, &rb_packedsize);
 530     if (rb_packed == NULL) {
 531         fprintf(stderr,"[ERR]  Could not compress %s\n",bootfile);
 532         free(buf);
 533         free(rb_unpacked);
 534         free(of_packed);
 535         return 1;
 536     }
 537
 538     /* We are finished with the unpacked version of the bootloader */
 539     free(rb_unpacked);
 540
 541     fprintf(stderr,"[INFO] Original firmware size:   %d bytes\n",firmware_size);
 542     fprintf(stderr,"[INFO] Packed OF size:           %d bytes\n",of_packedsize);
 543     fprintf(stderr,"[INFO] Bootloader size:          %d bytes\n",(int)bootloader_size);
 544     fprintf(stderr,"[INFO] Packed bootloader size:   %d bytes\n",rb_packedsize);
 545     fprintf(stderr,"[INFO] Dual-boot function size:  %d bytes\n",bootloader_sizes[model]);
 546     fprintf(stderr,"[INFO] UCL unpack function size: %d bytes\n",sizeof(nrv2e_d8));
 547
 548     totalsize = bootloader_sizes[model] + sizeof(nrv2e_d8) + of_packedsize +
 549                 rb_packedsize;
 550
 551     fprintf(stderr,"[INFO] Total size of new image:  %d bytes\n",totalsize);
 552
 553     if (totalsize > firmware_size) {
 554         fprintf(stderr,"[ERR]  No room to insert bootloader, aborting\n");
 555         free(buf);
 556         free(rb_unpacked);
 557         free(of_packed);
 558         return 1;
 559     }
 560
 561     /* Zero the original firmware area - not needed, but helps debugging */
 562     memset(buf + 0x400, 0, firmware_size);
 563
 564
 565     /* Insert dual-boot bootloader at offset 0 */
 566     memcpy(buf + 0x400, bootloaders[model], bootloader_sizes[model]);
 567
 568     /* We are filling the firmware buffer backwards from the end */
 569     p = buf + 0x400 + firmware_size;
 570
 571     /* 1 - UCL unpack function */
 572     p -= sizeof(nrv2e_d8);
 573     memcpy(p, nrv2e_d8, sizeof(nrv2e_d8));
 574
 575     /* 2 - Compressed copy of original firmware */
 576     p -= of_packedsize;
 577     memcpy(p, of_packed, of_packedsize);
 578
 579     /* 3 - Compressed copy of Rockbox bootloader */
 580     p -= rb_packedsize;
 581     memcpy(p, rb_packed, rb_packedsize);
 582
 583     /* Write the locations of the various images to the variables at the
 584        start of the dualboot image - we save the location of the last byte
 585        in each image, along with the size in bytes */
 586
 587     /* UCL unpack function */
 588     put_uint32le(&buf[0x420], firmware_size - 1);
 589     put_uint32le(&buf[0x424], sizeof(nrv2e_d8));
 590
 591     /* Compressed original firmware image */
 592     put_uint32le(&buf[0x428], firmware_size - sizeof(nrv2e_d8) - 1);
 593     put_uint32le(&buf[0x42c], of_packedsize);
 594
 595     /* Compressed Rockbox image */
 596     put_uint32le(&buf[0x430], firmware_size - sizeof(nrv2e_d8) - of_packedsize - 1);
 597     put_uint32le(&buf[0x434], rb_packedsize);
 598
 599
 600     /* Update the firmware block checksum */
 601     sum = calc_checksum(buf + 0x400,firmware_size);
 602
 603     if (fw_version == 1) {
 604         put_uint32le(&buf[0x04], sum);
 605         put_uint32le(&buf[0x204], sum);
 606     } else {
 607         /* TODO: Verify that this is correct for the v2 firmware */
 608
 609         put_uint32le(&buf[0x08], sum);
 610         put_uint32le(&buf[0x208], sum);
 611
 612         /* Update the header checksums */
 613         put_uint32le(&buf[0x1fc], calc_checksum(buf, 0x1fc));
 614         put_uint32le(&buf[0x3fc], calc_checksum(buf + 0x200, 0x1fc));
 615     }
 616
 617     /* Update the whole-file checksum */
 618     filesum = 0;
 619     for (i=0;i < (unsigned)len - 4; i+=4)
 620         filesum += get_uint32le(&buf[i]);
 621
 622     put_uint32le(buf + len - 4, filesum);
 623
 624
 625     /* Write the new firmware */
 626     fdout = open(outfile, O_CREAT|O_TRUNC|O_WRONLY|O_BINARY,0666);
 627
 628     if (fdout < 0) {
 629         fprintf(stderr,"[ERR]  Could not open %s for writing\n",outfile);
 630         return 1;
 631     }
 632
 633     n = write(fdout, buf, len);
 634
 635     if (n != (unsigned)len) {
 636         fprintf(stderr,"[ERR]  Could not write firmware file\n");
 637         return 1;
 638     }
 639
 640     close(fdout);
 641
 642     fprintf(stderr," *****************************************************************************\n");
 643     fprintf(stderr," *** THIS CODE IS UNTESTED - DO NOT USE IF YOU CAN NOT RECOVER YOUR DEVICE ***\n");
 644     fprintf(stderr," *****************************************************************************\n");
 645
 646     return 0;
 647
 648 }