2 * Builder/viewer/extractor utility for Poray firmware image files
4 * Copyright (C) 2013 Michel Stempin <michel.stempin@wanadoo.fr>
5 * Copyright (C) 2013 Felix Kaechele <felix@fetzig.org>
6 * Copyright (C) 2013 <admin@openschemes.com>
8 * This tool is based on:
9 * TP-Link firmware upgrade tool.
10 * Copyright (C) 2009 Gabor Juhos <juhosg@openwrt.org>
13 * TP-Link WR941 V2 firmware checksum fixing tool.
14 * Copyright (C) 2008,2009 Wang Jian <lark@linux.net.cn>
16 * This program is free software; you can redistribute it and/or modify it
17 * under the terms of the GNU General Public License version 2 as published
18 * by the Free Software Foundation.
32 #include <arpa/inet.h>
33 #include <netinet/in.h>
35 #if (__BYTE_ORDER == __BIG_ENDIAN)
36 # define HOST_TO_BE32(x) (x)
37 # define BE32_TO_HOST(x) (x)
38 # define HOST_TO_LE32(x) bswap_32(x)
39 # define LE32_TO_HOST(x) bswap_32(x)
41 # define HOST_TO_BE32(x) bswap_32(x)
42 # define BE32_TO_HOST(x) bswap_32(x)
43 # define HOST_TO_LE32(x) (x)
44 # define LE32_TO_HOST(x) (x)
47 /* Fixed header flags */
48 #define HEADER_FLAGS 0x020e0000
50 /* Recognized Hardware ID magic */
51 #define HWID_HAME_MPR_A1_L8 0x32473352
52 #define HWID_PORAY_R50B 0x31353033
53 #define HWID_PORAY_R50D 0x33353033
54 #define HWID_PORAY_R50E 0x34353033
55 #define HWID_PORAY_M3 0x31353335
56 #define HWID_PORAY_M4 0x32353335
57 #define HWID_PORAY_Q3 0x33353335
58 #define HWID_PORAY_X5_X6 0x35353335
59 #define HWID_PORAY_X8 0x36353335
60 #define HWID_PORAY_X1 0x38353335
61 #define HWID_NEXX_WT15XXX 0x30353332
62 #define HWID_NEXX_WT3020A 0x30323033
63 #define HWID_A5_V11 0x32473352
65 /* Recognized XOR obfuscation keys */
79 char *file_name; /* Name of the file */
80 uint32_t file_size; /* Length of the file */
84 uint32_t hw_id; /* Hardware id */
85 uint32_t firmware_len; /* Firmware data length */
86 uint32_t flags; /* Header flags */
88 } __attribute__ ((packed));
106 static char *progname;
108 static char *board_id;
109 static struct board_info *board;
110 static char *layout_id;
111 static struct flash_layout *layout;
112 static char *opt_hw_id;
113 static uint32_t hw_id;
114 static struct file_info firmware_info;
115 static uint32_t firmware_len = 0;
117 static int inspect = 0;
118 static int extract = 0;
120 static uint8_t key[][KEY_LEN] = {
121 {0xC8, 0x3C, 0x3A, 0x93, 0xA2, 0x95, 0xC3, 0x63, 0x48, 0x45, 0x58, 0x09, 0x12, 0x03, 0x08},
122 {0x89, 0x6B, 0x5A, 0x93, 0x92, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0xE6, 0xC7},
123 {0xC9, 0x1C, 0x3A, 0x93, 0x92, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0xE6, 0xC7},
124 {0x19, 0x1B, 0x3A, 0x93, 0x92, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0xE6, 0xC7},
125 {0x79, 0x7B, 0x7A, 0x93, 0x92, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0xE6, 0xC7},
126 {0x19, 0x1C, 0x4A, 0x93, 0x96, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0x16, 0xC6},
127 {0x39, 0x1C, 0x4A, 0x93, 0x96, 0x95, 0xC3, 0x63, 0xD0, 0xA3, 0x9C, 0x92, 0x2E, 0x16, 0xC6},
128 {0xC8, 0x3C, 0x3A, 0x93, 0xA2, 0x95, 0xC3, 0x63, 0x48, 0x45, 0x58, 0x09, 0x20, 0x11, 0x08},
131 static struct flash_layout layouts[] = {
134 .fw_max_len = 0x3c0000,
137 .fw_max_len = 0x7c0000,
139 /* terminating entry */
143 static struct board_info boards[] = {
146 .hw_id = HWID_A5_V11,
151 .hw_id = HWID_HAME_MPR_A1_L8,
156 .hw_id = HWID_HAME_MPR_A1_L8,
161 .hw_id = HWID_PORAY_R50B,
166 .hw_id = HWID_PORAY_R50D,
171 .hw_id = HWID_PORAY_R50E,
176 .hw_id = HWID_PORAY_M3,
181 .hw_id = HWID_PORAY_M4,
186 .hw_id = HWID_PORAY_Q3,
191 .hw_id = HWID_PORAY_X5_X6,
196 .hw_id = HWID_PORAY_X5_X6,
201 .hw_id = HWID_PORAY_X5_X6,
206 .hw_id = HWID_PORAY_X8,
211 .hw_id = HWID_PORAY_X1,
216 .hw_id = HWID_NEXX_WT15XXX,
221 .hw_id = HWID_NEXX_WT3020A,
225 /* terminating entry */
232 #define ERR(fmt, ...) do { \
234 fprintf(stderr, "[%s] *** error: " fmt "\n", \
235 progname, ## __VA_ARGS__ ); \
238 #define ERRS(fmt, ...) do { \
241 fprintf(stderr, "[%s] *** error: " fmt ":%s\n", \
242 progname, ## __VA_ARGS__, strerror(save)); \
245 #define DBG(fmt, ...) do { \
246 fprintf(stderr, "[%s] " fmt "\n", progname, ## __VA_ARGS__ ); \
250 * Find a board by its name
252 static struct board_info *find_board(char *id)
254 struct board_info *ret;
255 struct board_info *board;
258 for (board = boards; board->id != NULL; board++){
259 if (strcasecmp(id, board->id) == 0) {
269 * Find a board by its hardware ID
271 static struct board_info *find_board_by_hwid(uint32_t hw_id)
273 struct board_info *board;
275 for (board = boards; board->id != NULL; board++) {
276 if (hw_id == board->hw_id)
284 * Find a Flash memory layout by its name
286 static struct flash_layout *find_layout(char *id)
288 struct flash_layout *ret;
289 struct flash_layout *l;
292 for (l = layouts; l->id != NULL; l++){
293 if (strcasecmp(id, l->id) == 0) {
305 static void usage(int status)
307 FILE *stream = (status != EXIT_SUCCESS) ? stderr : stdout;
309 fprintf(stream, "Usage: %s [OPTIONS...]\n", progname);
313 " -B <board> create image for the board specified with <board>\n"
314 " -H <hwid> use hardware id specified with <hwid>\n"
315 " -F <id> use flash layout specified with <id>\n"
316 " -f <file> read firmware image from the file <file>\n"
317 " -o <file> write output to the file <file>\n"
318 " -i inspect given firmware file (requires -f)\n"
319 " -x extract combined kernel and rootfs while inspecting (implies -i)\n"
320 " -h show this screen\n"
327 * Get file statistics
329 static int get_file_stat(struct file_info *fdata)
334 if (fdata->file_name == NULL) {
337 res = stat(fdata->file_name, &st);
339 ERRS("stat failed on %s", fdata->file_name);
343 fdata->file_size = st.st_size;
348 * Read file into buffer
350 static int read_to_buf(struct file_info *fdata, uint8_t *buf)
353 int ret = EXIT_FAILURE;
355 f = fopen(fdata->file_name, "rb");
357 ERRS("could not open \"%s\" for reading", fdata->file_name);
362 fread(buf, fdata->file_size, 1, f);
364 ERRS("unable to read from file \"%s\"", fdata->file_name);
377 * Check command line options
379 static int check_options(void)
383 if (firmware_info.file_name == NULL) {
384 ERR("no firmware image specified");
388 ret = get_file_stat(&firmware_info);
395 if (board_id == NULL && opt_hw_id == NULL) {
396 ERR("either board or hardware id must be specified");
401 board = find_board(board_id);
403 ERR("unknown/unsupported board id \"%s\"", board_id);
406 if (layout_id == NULL) {
407 layout_id = board->layout_id;
409 hw_id = board->hw_id;
411 hw_id = strtoul(opt_hw_id, NULL, 0);
412 board = find_board_by_hwid(hw_id);
413 if (layout_id == NULL) {
414 layout_id = board->layout_id;
418 layout = find_layout(layout_id);
419 if (layout == NULL) {
420 ERR("unknown flash layout \"%s\"", layout_id);
424 firmware_len = firmware_info.file_size;
426 if (firmware_info.file_size >
427 layout->fw_max_len - sizeof (struct fw_header)) {
428 ERR("firmware image is too big");
432 if (ofname == NULL) {
433 ERR("no output file specified");
440 * Fill in firmware header
442 static void fill_header(uint8_t *buf)
444 struct fw_header *hdr = (struct fw_header *) buf;
446 memset(hdr, 0, sizeof (struct fw_header));
447 hdr->hw_id = HOST_TO_LE32(hw_id);
448 hdr->firmware_len = HOST_TO_LE32(firmware_len);
449 hdr->flags = HOST_TO_LE32(HEADER_FLAGS);
453 * Compute firmware checksum
455 static uint16_t checksum_fw(uint8_t *data, int len)
458 int32_t checksum = 0;
460 for (i = 0; i < len - 1; i += 2) {
461 checksum += (data[i + 1] << 8) | data[i];
466 checksum = checksum + (checksum >> 16) + 0xffff;
467 checksum = ~(checksum + (checksum >> 16)) & 0xffff;
468 return (uint16_t) checksum;
472 * (De)obfuscate firmware using an XOR operation with a fixed length key
474 static void xor_fw(uint8_t *data, int len)
478 for (i = 0; i <= len; i++) {
479 data[i] ^= key[board->key][i % KEY_LEN];
484 * Write firmware to file
486 static int write_fw(uint8_t *data, int len)
489 int ret = EXIT_FAILURE;
491 f = fopen(ofname, "wb");
493 ERRS("could not open \"%s\" for writing", ofname);
498 fwrite(data, len, 1, f);
500 ERRS("unable to write output file");
504 DBG("firmware file \"%s\" completed", ofname);
511 if (ret != EXIT_SUCCESS) {
519 * Build firmware file
521 static int build_fw(void)
525 int ret = EXIT_FAILURE;
529 buflen = layout->fw_max_len;
531 buf = (uint8_t *) malloc(buflen);
533 ERR("no memory for buffer\n");
537 memset(buf, 0xff, buflen);
538 p = buf + sizeof (struct fw_header);
539 ret = read_to_buf(&firmware_info, p);
543 writelen = sizeof (struct fw_header) + firmware_len + 2;
548 /* Compute firmware checksum */
549 checksum = checksum_fw(buf + sizeof (struct fw_header), firmware_len);
551 /* Cannot use network order function because checksum is not word-aligned */
552 buf[writelen - 1] = checksum >> 8;
553 buf[writelen - 2] = checksum & 0xff;
555 /* XOR obfuscate firmware */
556 xor_fw(buf + sizeof (struct fw_header), firmware_len + 2);
558 /* Write firmware file */
559 ret = write_fw(buf, writelen);
571 /* Helper functions to inspect_fw() representing different output formats */
572 static inline void inspect_fw_pstr(char *label, char *str)
574 printf("%-23s: %s\n", label, str);
577 static inline void inspect_fw_phex(char *label, uint32_t val)
579 printf("%-23s: 0x%08x\n", label, val);
582 static inline void inspect_fw_phexpost(char *label,
583 uint32_t val, char *post)
585 printf("%-23s: 0x%08x (%s)\n", label, val, post);
588 static inline void inspect_fw_phexdef(char *label,
589 uint32_t val, uint32_t defval)
591 printf("%-23s: 0x%08x ", label, val);
594 printf("(== OpenWrt default)\n");
596 printf("(OpenWrt default: 0x%08x)\n", defval);
600 static inline void inspect_fw_phexexp(char *label,
601 uint32_t val, uint32_t expval)
603 printf("%-23s: 0x%08x ", label, val);
608 printf("(expected: 0x%08x)\n", expval);
612 static inline void inspect_fw_phexdec(char *label, uint32_t val)
614 printf("%-23s: 0x%08x / %8u bytes\n", label, val, val);
617 static inline void inspect_fw_pchecksum(char *label,
618 uint16_t val, uint16_t expval)
620 printf("%-23s: 0x%04x ", label, val);
624 printf("(expected: 0x%04x)\n", expval);
628 static int inspect_fw(void)
631 struct fw_header *hdr;
632 int ret = EXIT_FAILURE;
633 uint16_t computed_checksum, file_checksum;
635 buf = (uint8_t *) malloc(firmware_info.file_size);
637 ERR("no memory for buffer!\n");
641 ret = read_to_buf(&firmware_info, buf);
645 hdr = (struct fw_header *)buf;
647 inspect_fw_pstr("File name", firmware_info.file_name);
648 inspect_fw_phexdec("File size", firmware_info.file_size);
652 inspect_fw_phexdec("Header size", sizeof (struct fw_header));
653 board = find_board_by_hwid(LE32_TO_HOST(hdr->hw_id));
655 layout = find_layout(board->layout_id);
656 inspect_fw_phexpost("Hardware ID",
657 LE32_TO_HOST( hdr->hw_id), board->id);
659 inspect_fw_phexpost("Hardware ID",
660 LE32_TO_HOST(hdr->hw_id), "unknown");
662 inspect_fw_phexdec("Firmware data length",
663 LE32_TO_HOST(hdr->firmware_len));
665 inspect_fw_phexexp("Flags",
666 LE32_TO_HOST(hdr->flags), HEADER_FLAGS);
669 /* XOR unobfuscate firmware */
670 xor_fw(buf + sizeof (struct fw_header), LE32_TO_HOST(hdr->firmware_len) + 2);
672 /* Compute firmware checksum */
673 computed_checksum = checksum_fw(buf + sizeof (struct fw_header), LE32_TO_HOST(hdr->firmware_len));
675 /* Cannot use network order function because checksum is not word-aligned */
676 file_checksum = (buf[firmware_info.file_size - 1] << 8) | buf[firmware_info.file_size - 2];
677 inspect_fw_pchecksum("Firmware checksum", computed_checksum, file_checksum);
679 /* Verify checksum */
680 if (computed_checksum != file_checksum) {
682 ERR("checksums do not match");
692 if (ofname == NULL) {
693 filename = malloc(strlen(firmware_info.file_name) + 10);
694 sprintf(filename, "%s-firmware", firmware_info.file_name);
698 printf("Extracting firmware to \"%s\"...\n", filename);
699 fp = fopen(filename, "wb");
701 if (!fwrite(buf + sizeof (struct fw_header),
702 LE32_TO_HOST(hdr->firmware_len), 1, fp)) {
703 ERRS("error in fwrite(): %s", strerror(errno));
707 ERRS("error in fopen(): %s", strerror(errno));
709 if (ofname == NULL) {
724 int main(int argc, char *argv[])
726 int ret = EXIT_FAILURE;
728 progname = basename(argv[0]);
732 while ((c = getopt(argc, argv, "B:H:F:f:o:ixh")) != -1) {
744 firmware_info.file_name = optarg;
765 ret = check_options();