2 * jcgimage - Create a JCG firmware image
4 * Copyright (C) 2015 Reinhard Max <reinhard@m4x.de>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
23 * JCG firmware update images consist of a 512 byte header and a
24 * modified uImage (details below) as the payload.
26 * The payload is obfuscated by XORing it with a key that is generated
27 * from parts of the header. Fortunately only non-essential parts of
28 * the header are used for this and zeroing them results in a zero
29 * key, effectively disabling the obfuscation and allowing us to use
30 * clear text payloads.
32 * The mandatory parts of the header are:
34 * - A magic string of "YSZJ" at offset 0.
35 * - A value of 1 at offset 39 (header format version?)
36 * - A CRC32 checksum of the payload at offset 504.
37 * - A CRC32 checksum of the header at offset 508.
39 * An image constructed by these rules will be accepted by JCG's
40 * U-Boot in resuce mode via TFTP and the payload will be written to
41 * the flash starting at offset 0x00050000.
43 * JCG's U-Boot does check the content or size of the payload
44 * image. If it is too large, it wraps around and overwrites U-Boot,
45 * requiring JTAG to revive the board. To prevent such bricking from
46 * happening, this tool refuses to build such overlong images.
48 * Two more conditions have to be met for a JCG image to be accepted
49 * as a valid update by the web interface of the stock firware:
51 * - The bytes at offsets 109 and 111 in the header must be a binary
52 * representation of the first two components of the firmware
53 * version as displayed in the update web form, or it will be
54 * rejected as "incorrect product".
56 * - The payload must start with a valid uImage header whose data
57 * CRC checksum matches the whole rest of the update file rather
58 * than just the number of bytes specified in the size field of the
61 * This last condition is met by JCG's original firmware images,
62 * because they have both, kernel and rootfs inside the uImage and
63 * abuse the last four bytes of the name field to record the offset of
64 * the file system from the start of the uImage header. This tool
65 * produces such images when called with -k and -r, which are meant to
66 * repack the original firmware after modifying the file systen,
67 * e.g. to add debugging tools and enable shell access.
69 * In contrast, OpenWrt sysupgrade images consist of a uImage that
70 * only contains the kernel and has the rootfs appended to it. Hence,
71 * the CRC over kernel and file system does not match the one in the
72 * uImage header. Fixing this by adjusting the uImage header is not
73 * possible, because it makes the uImage unusable for booting. Instead
74 * we append four "patch" bytes to the end of the file system, that
75 * are calculated to force the checksum of kernel+fs to be the same as
76 * for the kernel alone.
83 #include <sys/types.h>
93 #include <arpa/inet.h>
97 * JCG Firmware image header
99 #define JH_MAGIC 0x59535a4a /* "YSZJ" */
102 uint8_t jh_version[32]; /* Firmware version string.
103 Fill with zeros to avoid encryption */
104 uint32_t jh_type; /* must be 1 */
105 uint8_t jh_info[64]; /* Firmware info string. Fill with
106 zeros to avoid encryption */
107 uint32_t jh_time; /* Image creation time in seconds since
108 * the Epoch. Does not seem to be used
109 * by the stock firmware. */
110 uint16_t jh_major; /* Major fimware version */
111 uint16_t jh_minor; /* Minor fimrmware version */
112 uint8_t jh_unknown[392]; /* Apparently unused and all zeros */
113 uint32_t jh_dcrc; /* CRC checksum of the payload */
114 uint32_t jh_hcrc; /* CRC checksum of the header */
118 * JCG uses a modified uImage header that replaces the last four bytes
119 * of the image name with the length of the kernel in the image.
121 #define IH_MAGIC 0x27051956 /* Image Magic Number */
122 #define IH_NMLEN 28 /* Image Name Length */
124 struct uimage_header {
125 uint32_t ih_magic; /* Image Header Magic Number */
126 uint32_t ih_hcrc; /* Image Header CRC Checksum */
127 uint32_t ih_time; /* Image Creation Timestamp */
128 uint32_t ih_size; /* Image Data Size */
129 uint32_t ih_load; /* Data Load Address */
130 uint32_t ih_ep; /* Entry Point Address */
131 uint32_t ih_dcrc; /* Image Data CRC Checksum */
132 uint8_t ih_os; /* Operating System */
133 uint8_t ih_arch; /* CPU architecture */
134 uint8_t ih_type; /* Image Type */
135 uint8_t ih_comp; /* Compression Type */
136 uint8_t ih_name[IH_NMLEN];/* Image Name */
137 uint32_t ih_fsoff; /* Offset of the file system
138 partition from the start of
143 * Open the named file and return its size and file descriptor.
144 * Exit in case of errors.
147 opensize(char *name, size_t *size)
150 int fd = open(name, O_RDONLY);
152 err(1, "cannot open \"%s\"", name);
154 if (fstat(fd, &s) == -1) {
155 err(1, "cannot stat \"%s\"", name);
162 * Write the JCG header
165 mkjcgheader(struct jcg_header *h, size_t psize, char *version)
168 uint16_t major = 0, minor = 0;
169 void *payload = (void *)h + sizeof(*h);
171 if (version != NULL) {
172 if (sscanf(version, "%hu.%hu", &major, &minor) != 2) {
173 err(1, "cannot parse version \"%s\"", version);
177 memset(h, 0, sizeof(*h));
178 h->jh_magic = htonl(JH_MAGIC);
179 h->jh_type = htonl(1);
180 h->jh_time = htonl(time(NULL));
181 h->jh_major = htons(major);
182 h->jh_minor = htons(minor);
184 /* CRC over JCG payload (uImage) */
185 crc = crc32(0L, Z_NULL, 0);
186 crc = crc32(crc, payload, psize);
187 h->jh_dcrc = htonl(crc);
189 /* CRC over JCG header */
190 crc = crc32(0L, Z_NULL, 0);
191 crc = crc32(crc, (void *)h, sizeof(*h));
192 h->jh_hcrc = htonl(crc);
196 * Write the uImage header
199 mkuheader(struct uimage_header *h, size_t ksize, size_t fsize)
202 void *payload = (void *)h + sizeof(*h);
204 // printf("mkuheader: %p, %zd, %zd\n", h, ksize, fsize);
205 memset(h, 0, sizeof(*h));
206 h->ih_magic = htonl(IH_MAGIC);
207 h->ih_time = htonl(time(NULL));
208 h->ih_size = htonl(ksize + fsize);
209 h->ih_load = htonl(0x80000000);
210 h->ih_ep = htonl(0x80292000);
215 h->ih_fsoff = htonl(sizeof(*h) + ksize);
216 strcpy((char *)h->ih_name, "Linux Kernel Image");
218 /* CRC over uImage payload (kernel and file system) */
219 crc = crc32(0L, Z_NULL, 0);
220 crc = crc32(crc, payload, ntohl(h->ih_size));
221 h->ih_dcrc = htonl(crc);
222 printf("CRC1: %08lx\n", crc);
224 /* CRC over uImage header */
225 crc = crc32(0L, Z_NULL, 0);
226 crc = crc32(crc, (void *)h, sizeof(*h));
227 h->ih_hcrc = htonl(crc);
228 printf("CRC2: %08lx\n", crc);
232 * Calculate a "patch" value and write it into the last four bytes of
233 * buf, so that the CRC32 checksum of the whole buffer is dcrc.
235 * Based on: SAR-PR-2006-05: Reversing CRC – Theory and Practice.
236 * Martin Stigge, Henryk Plötz, Wolf Müller, Jens-Peter Redlich.
237 * http://sar.informatik.hu-berlin.de/research/publications/#SAR-PR-2006-05
240 craftcrc(uint32_t dcrc, uint8_t *buf, size_t len)
245 uint32_t crc = crc32(0L, Z_NULL, 0);
248 for (i = 0; i < 32; i++) {
250 patch = (patch >> 1) ^ 0xedb88320L;
255 patch ^= 0x5b358fd3L;
259 patch ^= ~crc32(crc, buf, len - 4);
260 for (i = 0; i < 4; i++) {
261 buf[len - 4 + i] = patch & 0xff;
264 /* Verify that we actually get the desired result */
265 crc = crc32(0L, Z_NULL, 0);
266 crc = crc32(crc, buf, len);
268 errx(1, "CRC patching is broken: wanted %08x, but got %08x.",
275 fprintf(stderr, "Usage:\n"
276 "jcgimage -o outfile -u uImage [-v version]\n"
277 "jcgimage -o outfile -k kernel -f rootfs [-v version]\n");
281 #define MODE_UNKNOWN 0
282 #define MODE_UIMAGE 1
285 /* The output image must not be larger than 4MiB - 5*64kiB */
286 #define MAXSIZE (size_t)(4 * 1024 * 1024 - 5 * 64 * 1024)
289 main(int argc, char **argv)
291 struct jcg_header *jh;
292 struct uimage_header *uh;
294 char *imagefile = NULL;
297 char *version = NULL;
298 int mode = MODE_UNKNOWN;
300 size_t size1, size2, sizeu, sizeo, off1, off2;
303 /* Make sure the headers have the right size */
304 assert(sizeof(struct jcg_header) == 512);
305 assert(sizeof(struct uimage_header) == 64);
307 while ((c = getopt(argc, argv, "o:k:f:u:v:h")) != -1) {
313 if (mode == MODE_UIMAGE) {
314 errx(1,"-k cannot be combined with -u");
320 if (mode == MODE_UIMAGE) {
321 errx(1,"-f cannot be combined with -u");
327 if (mode == MODE_KR) {
328 errx(1,"-u cannot be combined with -k and -r");
341 if (optind != argc) {
342 errx(1, "illegal arg \"%s\"", argv[optind]);
344 if (imagefile == NULL) {
345 errx(1, "no output file specified");
347 if (mode == MODE_UNKNOWN) {
348 errx(1, "specify either -u or -k and -r");
350 if (mode == MODE_KR) {
351 if (file1 == NULL || file2 == NULL) {
352 errx(1,"need -k and -r");
354 fd2 = opensize(file2, &size2);
356 fd1 = opensize(file1, &size1);
357 if (mode == MODE_UIMAGE) {
360 sizeo = sizeof(*jh) + sizeu;
362 off1 = sizeof(*jh) + sizeof(*uh);
363 off2 = sizeof(*jh) + sizeof(*uh) + size1;
364 sizeu = sizeof(*uh) + size1 + size2;
365 sizeo = sizeof(*jh) + sizeu;
368 if (sizeo > MAXSIZE) {
369 errx(1,"payload too large: %zd > %zd\n", sizeo, MAXSIZE);
372 fdo = open(imagefile, O_RDWR | O_CREAT | O_TRUNC, 00644);
374 err(1, "cannot open \"%s\"", imagefile);
377 if (ftruncate(fdo, sizeo) == -1) {
378 err(1, "cannot grow \"%s\" to %zd bytes", imagefile, sizeo);
380 map = mmap(NULL, sizeo, PROT_READ|PROT_WRITE, MAP_SHARED, fdo, 0);
381 uh = map + sizeof(*jh);
382 if (map == MAP_FAILED) {
383 err(1, "cannot mmap \"%s\"", imagefile);
386 if (read(fd1, map + off1, size1) != size1) {
387 err(1, "cannot copy %s", file1);
390 if (mode == MODE_KR) {
391 if (read(fd2, map+off2, size2) != size2) {
392 err(1, "cannot copy %s", file2);
394 mkuheader(uh, size1, size2);
395 } else if (mode == MODE_UIMAGE) {
396 craftcrc(ntohl(uh->ih_dcrc), (void*)uh + sizeof(*uh),
397 sizeu - sizeof(*uh));
399 mkjcgheader(map, sizeu, version);