package/kernel/lantiq/ltq-vdsl-fw/src/w921v_fw_cutter.c

   1 /*
   2  *   This program is free software; you can redistribute it and/or modify
   3  *   it under the terms of the GNU General Public License as published by
   4  *   the Free Software Foundation; version 2 of the License
   5  *
   6  *   This program is distributed in the hope that it will be useful,
   7  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
   8  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   9  *   GNU General Public License for more details.
  10  *
  11  *   You should have received a copy of the GNU General Public License
  12  *   along with this program; if not, write to the Free Software
  13  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
  14  *
  15  *   Copyright (C) 2012 John Crispin <blogic@openwrt.org>
  16  */
  17
  18 #include <sys/types.h>
  19 #include <sys/stat.h>
  20 #include <unistd.h>
  21 #include <stdlib.h>
  22 #include <stdio.h>
  23 #include <string.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26
  27 #include "LzmaWrapper.h"
  28
  29 #define FW_NAME         "/tmp/Firmware_Speedport_W921V_1.20.000.bin"
  30
  31 #define MAGIC           0x50
  32 #define MAGIC_SZ        0x3FFC00
  33 #if __BYTE_ORDER == __LITTLE_ENDIAN
  34 #define MAGIC_PART      0x12345678
  35 #define MAGIC_LZMA      0x8000005D
  36 #define MAGIC_ANNEX_B   0x3C
  37 #define MAGIC_TAPI      0x5A
  38 #else
  39 #define MAGIC_PART      0x78563412
  40 #define MAGIC_LZMA      0x5D000080
  41 #define MAGIC_ANNEX_B   0x3C000000
  42 #define MAGIC_TAPI      0x5A000000
  43 #endif
  44
  45
  46 const char* part_type(u_int32_t id)
  47 {
  48         switch(id) {
  49         case MAGIC_ANNEX_B:
  50                 return "/tmp/vr9_dsl_fw_annex_b.bin";
  51         case MAGIC_TAPI:
  52                 return "/tmp/vr9_tapi_fw.bin";
  53         }
  54         printf("\tUnknown lzma type 0x%02X\n", id);
  55         return "/tmp/unknown.lzma";
  56 }
  57
  58 int main(int argc, char **argv)
  59 {
  60         struct stat s;
  61         u_int8_t *buf_orig;
  62         u_int32_t *buf;
  63         int buflen;
  64         int fd;
  65         int i;
  66         int err;
  67         int start = 0, end = 0;
  68
  69         printf("Arcadyan Firmware cutter v0.1\n");
  70         printf("-----------------------------\n");
  71         printf("This tool extracts the different parts of an arcadyan firmware update file\n");
  72         printf("This tool is for private use only. The Firmware that gets extracted has a license that forbids redistribution\n");
  73         printf("Please only run this if you understand the risks\n\n");
  74         printf("I understand the risks ? (y/N)\n");
  75
  76         if (getchar() != 'y')
  77                 return -1;
  78
  79         if (stat(FW_NAME, &s) != 0) {
  80                 printf("Failed to find %s\n", FW_NAME);
  81                 printf("Ask Google or try http://hilfe.telekom.de/dlp/eki/downloads/Speedport/Speedport%20W%20921V/Firmware_Speedport_W921V_1.20.000.bin\n");
  82                 return -1;
  83         }
  84
  85         buf_orig = malloc(s.st_size);
  86         if (!buf_orig) {
  87                 printf("Failed to alloc %d bytes\n", s.st_size);
  88                 return -1;
  89         }
  90
  91         fd = open(FW_NAME, O_RDONLY);
  92         if (fd < 0) {
  93                 printf("Unable to open %s\n", FW_NAME);
  94                 return -1;
  95         }
  96
  97         buflen = read(fd, buf_orig, s.st_size);
  98         close(fd);
  99         if (buflen != s.st_size) {
 100                 printf("Loaded %d instead of %d bytes inside %s\n", buflen, s.st_size, FW_NAME);
 101                 return -1;
 102         }
 103
 104         /* <magic> */
 105         buf_orig++;
 106         buflen -= 1;
 107         for (i = 0; i < MAGIC_SZ; i++) {
 108                 if ((i % 16) < 3)
 109                         buf_orig[i] = buf_orig[i + 16] ^ MAGIC;
 110                 else
 111                         buf_orig[i] = buf_orig[i] ^ MAGIC;
 112         }
 113         buflen -= 3;
 114         memmove(&buf_orig[MAGIC_SZ], &buf_orig[MAGIC_SZ + 3], buflen - MAGIC_SZ);
 115         /* </magic> */
 116
 117         buf = (u_int32_t*) buf_orig;
 118
 119         do {
 120                 if (buf[end] == MAGIC_PART) {
 121                         end += 2;
 122                         printf("Found partition at 0x%08X with size %d\n",
 123                                 start * sizeof(u_int32_t),
 124                                 (end - start) * sizeof(u_int32_t));
 125                         if (buf[start] == MAGIC_LZMA) {
 126                                 int dest_len = 1024 * 1024;
 127                                 int len = buf[end - 3];
 128                                 u_int32_t id = buf[end - 6];
 129                                 const char *type = part_type(id);
 130                                 u_int8_t *dest;
 131
 132                                 dest = malloc(dest_len);
 133                                 if (!dest) {
 134                                         printf("Failed to alloc dest buffer\n");
 135                                         return -1;
 136                                 }
 137
 138                                 if (lzma_inflate((u_int8_t*)&buf[start], len, dest, &dest_len)) {
 139                                         printf("Failed to decompress data\n");
 140                                         return -1;
 141                                 }
 142
 143                                 fd = creat(type, S_IRUSR | S_IWUSR);
 144                                 if (fd != -1) {
 145                                         if (write(fd, dest, dest_len) != dest_len)
 146                                                 printf("\tFailed to write %d bytes\n", dest_len);
 147                                         else
 148                                                 printf("\tWrote %d bytes to %s\n", dest_len, type);
 149                                         close(fd);
 150                                 } else {
 151                                         printf("\tFailed to open %s\n", type);
 152                                 }
 153                                 free(dest);
 154                         } else {
 155                                 printf("\tThis is not lzma\n");
 156                         }
 157                         start = end;
 158                 } else {
 159                         end++;
 160                 }
 161         } while(end < buflen / sizeof(u_int32_t));
 162
 163         return 0;
 164 }