mktplinkfw.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899
  1. /*
  2. * Copyright (C) 2009 Gabor Juhos <juhosg@openwrt.org>
  3. *
  4. * This tool was based on:
  5. * TP-Link WR941 V2 firmware checksum fixing tool.
  6. * Copyright (C) 2008,2009 Wang Jian <lark@linux.net.cn>
  7. *
  8. * This program is free software; you can redistribute it and/or modify it
  9. * under the terms of the GNU General Public License version 2 as published
  10. * by the Free Software Foundation.
  11. *
  12. */
  13. #include <stdio.h>
  14. #include <stdlib.h>
  15. #include <stdint.h>
  16. #include <string.h>
  17. #include <unistd.h> /* for unlink() */
  18. #include <libgen.h>
  19. #include <getopt.h> /* for getopt() */
  20. #include <stdarg.h>
  21. #include <errno.h>
  22. #include <sys/stat.h>
  23. #include <arpa/inet.h>
  24. #include <netinet/in.h>
  25. #include "md5.h"
  26. #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
  27. #define ARRAY_SIZE(a) (sizeof((a)) / sizeof((a)[0]))
  28. #define HEADER_VERSION_V1 0x01000000
  29. #define HEADER_VERSION_V2 0x02000000
  30. #define MD5SUM_LEN 16
  31. struct file_info {
  32. char *file_name; /* name of the file */
  33. uint32_t file_size; /* length of the file */
  34. };
  35. struct fw_header {
  36. uint32_t version; /* header version */
  37. char vendor_name[24];
  38. char fw_version[36];
  39. uint32_t hw_id; /* hardware id */
  40. uint32_t hw_rev; /* hardware revision */
  41. uint32_t region_code; /* region code */
  42. uint8_t md5sum1[MD5SUM_LEN];
  43. uint32_t unk2;
  44. uint8_t md5sum2[MD5SUM_LEN];
  45. uint32_t unk3;
  46. uint32_t kernel_la; /* kernel load address */
  47. uint32_t kernel_ep; /* kernel entry point */
  48. uint32_t fw_length; /* total length of the firmware */
  49. uint32_t kernel_ofs; /* kernel data offset */
  50. uint32_t kernel_len; /* kernel data length */
  51. uint32_t rootfs_ofs; /* rootfs data offset */
  52. uint32_t rootfs_len; /* rootfs data length */
  53. uint32_t boot_ofs; /* bootloader data offset */
  54. uint32_t boot_len; /* bootloader data length */
  55. uint16_t ver_hi;
  56. uint16_t ver_mid;
  57. uint16_t ver_lo;
  58. uint8_t pad[130];
  59. char region_str1[32];
  60. char region_str2[32];
  61. uint8_t pad2[160];
  62. } __attribute__ ((packed));
  63. struct flash_layout {
  64. char *id;
  65. uint32_t fw_max_len;
  66. uint32_t kernel_la;
  67. uint32_t kernel_ep;
  68. uint32_t rootfs_ofs;
  69. };
  70. struct fw_region {
  71. char name[4];
  72. uint32_t code;
  73. };
  74. /*
  75. * Globals
  76. */
  77. static char *ofname;
  78. static char *progname;
  79. static char *vendor = "TP-LINK Technologies";
  80. static char *version = "ver. 1.0";
  81. static char *fw_ver = "0.0.0";
  82. static uint32_t hdr_ver = HEADER_VERSION_V1;
  83. static char *layout_id;
  84. static struct flash_layout *layout;
  85. static char *opt_hw_id;
  86. static uint32_t hw_id;
  87. static char *opt_hw_rev;
  88. static uint32_t hw_rev;
  89. static uint32_t opt_hdr_ver = 1;
  90. static char *country;
  91. static const struct fw_region *region;
  92. static int fw_ver_lo;
  93. static int fw_ver_mid;
  94. static int fw_ver_hi;
  95. static struct file_info kernel_info;
  96. static uint32_t kernel_la = 0;
  97. static uint32_t kernel_ep = 0;
  98. static uint32_t kernel_len = 0;
  99. static struct file_info rootfs_info;
  100. static uint32_t rootfs_ofs = 0;
  101. static uint32_t rootfs_align;
  102. static struct file_info boot_info;
  103. static int combined;
  104. static int strip_padding;
  105. static int ignore_size;
  106. static int add_jffs2_eof;
  107. static unsigned char jffs2_eof_mark[4] = {0xde, 0xad, 0xc0, 0xde};
  108. static uint32_t fw_max_len;
  109. static uint32_t reserved_space;
  110. static struct file_info inspect_info;
  111. static int extract = 0;
  112. static const char md5salt_normal[MD5SUM_LEN] = {
  113. 0xdc, 0xd7, 0x3a, 0xa5, 0xc3, 0x95, 0x98, 0xfb,
  114. 0xdd, 0xf9, 0xe7, 0xf4, 0x0e, 0xae, 0x47, 0x38,
  115. };
  116. static const char md5salt_boot[MD5SUM_LEN] = {
  117. 0x8c, 0xef, 0x33, 0x5b, 0xd5, 0xc5, 0xce, 0xfa,
  118. 0xa7, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
  119. };
  120. static struct flash_layout layouts[] = {
  121. {
  122. .id = "4M",
  123. .fw_max_len = 0x3c0000,
  124. .kernel_la = 0x80060000,
  125. .kernel_ep = 0x80060000,
  126. .rootfs_ofs = 0x140000,
  127. }, {
  128. .id = "4Mlzma",
  129. .fw_max_len = 0x3c0000,
  130. .kernel_la = 0x80060000,
  131. .kernel_ep = 0x80060000,
  132. .rootfs_ofs = 0x100000,
  133. }, {
  134. .id = "8M",
  135. .fw_max_len = 0x7c0000,
  136. .kernel_la = 0x80060000,
  137. .kernel_ep = 0x80060000,
  138. .rootfs_ofs = 0x140000,
  139. }, {
  140. .id = "8Mlzma",
  141. .fw_max_len = 0x7c0000,
  142. .kernel_la = 0x80060000,
  143. .kernel_ep = 0x80060000,
  144. .rootfs_ofs = 0x100000,
  145. }, {
  146. .id = "16M",
  147. .fw_max_len = 0xf80000,
  148. .kernel_la = 0x80060000,
  149. .kernel_ep = 0x80060000,
  150. .rootfs_ofs = 0x140000,
  151. }, {
  152. .id = "16Mlzma",
  153. .fw_max_len = 0xf80000,
  154. .kernel_la = 0x80060000,
  155. .kernel_ep = 0x80060000,
  156. .rootfs_ofs = 0x100000,
  157. }, {
  158. .id = "16Mppc",
  159. .fw_max_len = 0xf80000,
  160. .kernel_la = 0x00000000 ,
  161. .kernel_ep = 0xc0000000,
  162. .rootfs_ofs = 0x2a0000,
  163. }, {
  164. /*
  165. Some devices (e.g. TL-WR1043 v4) use a mktplinkfw kernel image
  166. embedded in a tplink-safeloader image as os-image partition.
  167. We use a 1.5MB partition for the compressed kernel, which should
  168. be sufficient, but not too wasteful (the flash of the TL-WR1043 v4
  169. has 16MB in total).
  170. */
  171. .id = "16Msafeloader",
  172. .fw_max_len = 0x180000,
  173. .kernel_la = 0x80060000,
  174. .kernel_ep = 0x80060000,
  175. .rootfs_ofs = 0,
  176. }, {
  177. /* terminating entry */
  178. }
  179. };
  180. static const struct fw_region regions[] = {
  181. /* Default region (universal) uses code 0 as well */
  182. {"US", 1},
  183. {"EU", 0},
  184. };
  185. /*
  186. * Message macros
  187. */
  188. #define ERR(fmt, ...) do { \
  189. fflush(0); \
  190. fprintf(stderr, "[%s] *** error: " fmt "\n", \
  191. progname, ## __VA_ARGS__ ); \
  192. } while (0)
  193. #define ERRS(fmt, ...) do { \
  194. int save = errno; \
  195. fflush(0); \
  196. fprintf(stderr, "[%s] *** error: " fmt ": %s\n", \
  197. progname, ## __VA_ARGS__, strerror(save)); \
  198. } while (0)
  199. #define DBG(fmt, ...) do { \
  200. fprintf(stderr, "[%s] " fmt "\n", progname, ## __VA_ARGS__ ); \
  201. } while (0)
  202. static struct flash_layout *find_layout(const char *id)
  203. {
  204. struct flash_layout *ret;
  205. struct flash_layout *l;
  206. ret = NULL;
  207. for (l = layouts; l->id != NULL; l++){
  208. if (strcasecmp(id, l->id) == 0) {
  209. ret = l;
  210. break;
  211. }
  212. };
  213. return ret;
  214. }
  215. static const struct fw_region * find_region(const char *country) {
  216. size_t i;
  217. for (i = 0; i < ARRAY_SIZE(regions); i++) {
  218. if (strcasecmp(regions[i].name, country) == 0)
  219. return &regions[i];
  220. }
  221. return NULL;
  222. }
  223. static void usage(int status)
  224. {
  225. fprintf(stderr, "Usage: %s [OPTIONS...]\n", progname);
  226. fprintf(stderr,
  227. "\n"
  228. "Options:\n"
  229. " -c use combined kernel image\n"
  230. " -E <ep> overwrite kernel entry point with <ep> (hexval prefixed with 0x)\n"
  231. " -L <la> overwrite kernel load address with <la> (hexval prefixed with 0x)\n"
  232. " -H <hwid> use hardware id specified with <hwid>\n"
  233. " -W <hwrev> use hardware revision specified with <hwrev>\n"
  234. " -C <country> set region code to <country>\n"
  235. " -F <id> use flash layout specified with <id>\n"
  236. " -k <file> read kernel image from the file <file>\n"
  237. " -r <file> read rootfs image from the file <file>\n"
  238. " -a <align> align the rootfs start on an <align> bytes boundary\n"
  239. " -R <offset> overwrite rootfs offset with <offset> (hexval prefixed with 0x)\n"
  240. " -o <file> write output to the file <file>\n"
  241. " -s strip padding from the end of the image\n"
  242. " -S ignore firmware size limit (only for combined images)\n"
  243. " -j add jffs2 end-of-filesystem markers\n"
  244. " -N <vendor> set image vendor to <vendor>\n"
  245. " -V <version> set image version to <version>\n"
  246. " -v <version> set firmware version to <version>\n"
  247. " -m <version> set header version to <version>\n"
  248. " -i <file> inspect given firmware file <file>\n"
  249. " -x extract kernel and rootfs while inspecting (requires -i)\n"
  250. " -X <size> reserve <size> bytes in the firmware image (hexval prefixed with 0x)\n"
  251. " -h show this screen\n"
  252. );
  253. exit(status);
  254. }
  255. static void get_md5(const char *data, int size, uint8_t *md5)
  256. {
  257. MD5_CTX ctx;
  258. MD5_Init(&ctx);
  259. MD5_Update(&ctx, data, size);
  260. MD5_Final(md5, &ctx);
  261. }
  262. static int get_file_stat(struct file_info *fdata)
  263. {
  264. struct stat st;
  265. int res;
  266. if (fdata->file_name == NULL)
  267. return 0;
  268. res = stat(fdata->file_name, &st);
  269. if (res){
  270. ERRS("stat failed on %s", fdata->file_name);
  271. return res;
  272. }
  273. fdata->file_size = st.st_size;
  274. return 0;
  275. }
  276. static int read_to_buf(const struct file_info *fdata, char *buf)
  277. {
  278. FILE *f;
  279. int ret = EXIT_FAILURE;
  280. f = fopen(fdata->file_name, "r");
  281. if (f == NULL) {
  282. ERRS("could not open \"%s\" for reading", fdata->file_name);
  283. goto out;
  284. }
  285. errno = 0;
  286. fread(buf, fdata->file_size, 1, f);
  287. if (errno != 0) {
  288. ERRS("unable to read from file \"%s\"", fdata->file_name);
  289. goto out_close;
  290. }
  291. ret = EXIT_SUCCESS;
  292. out_close:
  293. fclose(f);
  294. out:
  295. return ret;
  296. }
  297. static int check_options(void)
  298. {
  299. int ret;
  300. int exceed_bytes;
  301. if (inspect_info.file_name) {
  302. ret = get_file_stat(&inspect_info);
  303. if (ret)
  304. return ret;
  305. return 0;
  306. } else if (extract) {
  307. ERR("no firmware for inspection specified");
  308. return -1;
  309. }
  310. if (opt_hw_id == NULL) {
  311. ERR("hardware id not specified");
  312. return -1;
  313. }
  314. hw_id = strtoul(opt_hw_id, NULL, 0);
  315. if (layout_id == NULL) {
  316. ERR("flash layout is not specified");
  317. return -1;
  318. }
  319. if (opt_hw_rev)
  320. hw_rev = strtoul(opt_hw_rev, NULL, 0);
  321. else
  322. hw_rev = 1;
  323. if (country) {
  324. region = find_region(country);
  325. if (!region) {
  326. ERR("unknown region code \"%s\"", country);
  327. return -1;
  328. }
  329. }
  330. layout = find_layout(layout_id);
  331. if (layout == NULL) {
  332. ERR("unknown flash layout \"%s\"", layout_id);
  333. return -1;
  334. }
  335. if (!kernel_la)
  336. kernel_la = layout->kernel_la;
  337. if (!kernel_ep)
  338. kernel_ep = layout->kernel_ep;
  339. if (!rootfs_ofs)
  340. rootfs_ofs = layout->rootfs_ofs;
  341. if (reserved_space > layout->fw_max_len) {
  342. ERR("reserved space is not valid");
  343. return -1;
  344. }
  345. fw_max_len = layout->fw_max_len - reserved_space;
  346. if (kernel_info.file_name == NULL) {
  347. ERR("no kernel image specified");
  348. return -1;
  349. }
  350. ret = get_file_stat(&kernel_info);
  351. if (ret)
  352. return ret;
  353. kernel_len = kernel_info.file_size;
  354. if (combined) {
  355. exceed_bytes = kernel_info.file_size - (fw_max_len - sizeof(struct fw_header));
  356. if (exceed_bytes > 0) {
  357. if (!ignore_size) {
  358. ERR("kernel image is too big by %i bytes", exceed_bytes);
  359. return -1;
  360. }
  361. layout->fw_max_len = sizeof(struct fw_header) +
  362. kernel_info.file_size +
  363. reserved_space;
  364. }
  365. } else {
  366. if (rootfs_info.file_name == NULL) {
  367. ERR("no rootfs image specified");
  368. return -1;
  369. }
  370. ret = get_file_stat(&rootfs_info);
  371. if (ret)
  372. return ret;
  373. if (rootfs_align) {
  374. kernel_len += sizeof(struct fw_header);
  375. kernel_len = ALIGN(kernel_len, rootfs_align);
  376. kernel_len -= sizeof(struct fw_header);
  377. DBG("kernel length aligned to %u", kernel_len);
  378. exceed_bytes = kernel_len + rootfs_info.file_size - (fw_max_len - sizeof(struct fw_header));
  379. if (exceed_bytes > 0) {
  380. ERR("images are too big by %i bytes", exceed_bytes);
  381. return -1;
  382. }
  383. } else {
  384. exceed_bytes = kernel_info.file_size - (rootfs_ofs - sizeof(struct fw_header));
  385. if (exceed_bytes > 0) {
  386. ERR("kernel image is too big by %i bytes", exceed_bytes);
  387. return -1;
  388. }
  389. exceed_bytes = rootfs_info.file_size - (fw_max_len - rootfs_ofs);
  390. if (exceed_bytes > 0) {
  391. ERR("rootfs image is too big by %i bytes", exceed_bytes);
  392. return -1;
  393. }
  394. }
  395. }
  396. if (ofname == NULL) {
  397. ERR("no output file specified");
  398. return -1;
  399. }
  400. ret = sscanf(fw_ver, "%d.%d.%d", &fw_ver_hi, &fw_ver_mid, &fw_ver_lo);
  401. if (ret != 3) {
  402. ERR("invalid firmware version '%s'", fw_ver);
  403. return -1;
  404. }
  405. if (opt_hdr_ver == 1) {
  406. hdr_ver = HEADER_VERSION_V1;
  407. } else if (opt_hdr_ver == 2) {
  408. hdr_ver = HEADER_VERSION_V2;
  409. } else {
  410. ERR("invalid header version '%u'", opt_hdr_ver);
  411. return -1;
  412. }
  413. return 0;
  414. }
  415. static void fill_header(char *buf, int len)
  416. {
  417. struct fw_header *hdr = (struct fw_header *)buf;
  418. memset(hdr, 0, sizeof(struct fw_header));
  419. hdr->version = htonl(hdr_ver);
  420. strncpy(hdr->vendor_name, vendor, sizeof(hdr->vendor_name));
  421. strncpy(hdr->fw_version, version, sizeof(hdr->fw_version));
  422. hdr->hw_id = htonl(hw_id);
  423. hdr->hw_rev = htonl(hw_rev);
  424. if (boot_info.file_size == 0)
  425. memcpy(hdr->md5sum1, md5salt_normal, sizeof(hdr->md5sum1));
  426. else
  427. memcpy(hdr->md5sum1, md5salt_boot, sizeof(hdr->md5sum1));
  428. hdr->kernel_la = htonl(kernel_la);
  429. hdr->kernel_ep = htonl(kernel_ep);
  430. hdr->fw_length = htonl(layout->fw_max_len);
  431. hdr->kernel_ofs = htonl(sizeof(struct fw_header));
  432. hdr->kernel_len = htonl(kernel_len);
  433. if (!combined) {
  434. hdr->rootfs_ofs = htonl(rootfs_ofs);
  435. hdr->rootfs_len = htonl(rootfs_info.file_size);
  436. }
  437. hdr->ver_hi = htons(fw_ver_hi);
  438. hdr->ver_mid = htons(fw_ver_mid);
  439. hdr->ver_lo = htons(fw_ver_lo);
  440. if (region) {
  441. hdr->region_code = htonl(region->code);
  442. snprintf(
  443. hdr->region_str1, sizeof(hdr->region_str1), "00000000;%02X%02X%02X%02X;",
  444. region->name[0], region->name[1], region->name[2], region->name[3]
  445. );
  446. snprintf(
  447. hdr->region_str2, sizeof(hdr->region_str2), "%02X%02X%02X%02X",
  448. region->name[0], region->name[1], region->name[2], region->name[3]
  449. );
  450. }
  451. get_md5(buf, len, hdr->md5sum1);
  452. }
  453. static int pad_jffs2(char *buf, int currlen)
  454. {
  455. int len;
  456. uint32_t pad_mask;
  457. len = currlen;
  458. pad_mask = (64 * 1024);
  459. while ((len < layout->fw_max_len) && (pad_mask != 0)) {
  460. uint32_t mask;
  461. int i;
  462. for (i = 10; i < 32; i++) {
  463. mask = 1 << i;
  464. if (pad_mask & mask)
  465. break;
  466. }
  467. len = ALIGN(len, mask);
  468. for (i = 10; i < 32; i++) {
  469. mask = 1 << i;
  470. if ((len & (mask - 1)) == 0)
  471. pad_mask &= ~mask;
  472. }
  473. for (i = 0; i < sizeof(jffs2_eof_mark); i++)
  474. buf[len + i] = jffs2_eof_mark[i];
  475. len += sizeof(jffs2_eof_mark);
  476. }
  477. return len;
  478. }
  479. static int write_fw(const char *data, int len)
  480. {
  481. FILE *f;
  482. int ret = EXIT_FAILURE;
  483. f = fopen(ofname, "w");
  484. if (f == NULL) {
  485. ERRS("could not open \"%s\" for writing", ofname);
  486. goto out;
  487. }
  488. errno = 0;
  489. fwrite(data, len, 1, f);
  490. if (errno) {
  491. ERRS("unable to write output file");
  492. goto out_flush;
  493. }
  494. DBG("firmware file \"%s\" completed", ofname);
  495. ret = EXIT_SUCCESS;
  496. out_flush:
  497. fflush(f);
  498. fclose(f);
  499. if (ret != EXIT_SUCCESS) {
  500. unlink(ofname);
  501. }
  502. out:
  503. return ret;
  504. }
  505. static int build_fw(void)
  506. {
  507. int buflen;
  508. char *buf;
  509. char *p;
  510. int ret = EXIT_FAILURE;
  511. int writelen = 0;
  512. buflen = layout->fw_max_len;
  513. buf = malloc(buflen);
  514. if (!buf) {
  515. ERR("no memory for buffer\n");
  516. goto out;
  517. }
  518. memset(buf, 0xff, buflen);
  519. p = buf + sizeof(struct fw_header);
  520. ret = read_to_buf(&kernel_info, p);
  521. if (ret)
  522. goto out_free_buf;
  523. writelen = sizeof(struct fw_header) + kernel_len;
  524. if (!combined) {
  525. if (rootfs_align)
  526. p = buf + writelen;
  527. else
  528. p = buf + rootfs_ofs;
  529. ret = read_to_buf(&rootfs_info, p);
  530. if (ret)
  531. goto out_free_buf;
  532. if (rootfs_align)
  533. writelen += rootfs_info.file_size;
  534. else
  535. writelen = rootfs_ofs + rootfs_info.file_size;
  536. if (add_jffs2_eof)
  537. writelen = pad_jffs2(buf, writelen);
  538. }
  539. if (!strip_padding)
  540. writelen = buflen;
  541. fill_header(buf, writelen);
  542. ret = write_fw(buf, writelen);
  543. if (ret)
  544. goto out_free_buf;
  545. ret = EXIT_SUCCESS;
  546. out_free_buf:
  547. free(buf);
  548. out:
  549. return ret;
  550. }
  551. /* Helper functions to inspect_fw() representing different output formats */
  552. static inline void inspect_fw_pstr(const char *label, const char *str)
  553. {
  554. printf("%-23s: %s\n", label, str);
  555. }
  556. static inline void inspect_fw_phex(const char *label, uint32_t val)
  557. {
  558. printf("%-23s: 0x%08x\n", label, val);
  559. }
  560. static inline void inspect_fw_phexdec(const char *label, uint32_t val)
  561. {
  562. printf("%-23s: 0x%08x / %8u bytes\n", label, val, val);
  563. }
  564. static inline void inspect_fw_pmd5sum(const char *label, const uint8_t *val, const char *text)
  565. {
  566. int i;
  567. printf("%-23s:", label);
  568. for (i=0; i<MD5SUM_LEN; i++)
  569. printf(" %02x", val[i]);
  570. printf(" %s\n", text);
  571. }
  572. static int inspect_fw(void)
  573. {
  574. char *buf;
  575. struct fw_header *hdr;
  576. uint8_t md5sum[MD5SUM_LEN];
  577. int ret = EXIT_FAILURE;
  578. buf = malloc(inspect_info.file_size);
  579. if (!buf) {
  580. ERR("no memory for buffer!\n");
  581. goto out;
  582. }
  583. ret = read_to_buf(&inspect_info, buf);
  584. if (ret)
  585. goto out_free_buf;
  586. hdr = (struct fw_header *)buf;
  587. inspect_fw_pstr("File name", inspect_info.file_name);
  588. inspect_fw_phexdec("File size", inspect_info.file_size);
  589. if ((ntohl(hdr->version) != HEADER_VERSION_V1) &&
  590. (ntohl(hdr->version) != HEADER_VERSION_V2)) {
  591. ERR("file does not seem to have V1/V2 header!\n");
  592. goto out_free_buf;
  593. }
  594. inspect_fw_phexdec("Version 1 Header size", sizeof(struct fw_header));
  595. memcpy(md5sum, hdr->md5sum1, sizeof(md5sum));
  596. if (ntohl(hdr->boot_len) == 0)
  597. memcpy(hdr->md5sum1, md5salt_normal, sizeof(md5sum));
  598. else
  599. memcpy(hdr->md5sum1, md5salt_boot, sizeof(md5sum));
  600. get_md5(buf, inspect_info.file_size, hdr->md5sum1);
  601. if (memcmp(md5sum, hdr->md5sum1, sizeof(md5sum))) {
  602. inspect_fw_pmd5sum("Header MD5Sum1", md5sum, "(*ERROR*)");
  603. inspect_fw_pmd5sum(" --> expected", hdr->md5sum1, "");
  604. } else {
  605. inspect_fw_pmd5sum("Header MD5Sum1", md5sum, "(ok)");
  606. }
  607. if (ntohl(hdr->unk2) != 0)
  608. inspect_fw_phexdec("Unknown value 2", hdr->unk2);
  609. inspect_fw_pmd5sum("Header MD5Sum2", hdr->md5sum2,
  610. "(purpose yet unknown, unchecked here)");
  611. if (ntohl(hdr->unk3) != 0)
  612. inspect_fw_phexdec("Unknown value 3", hdr->unk3);
  613. printf("\n");
  614. inspect_fw_pstr("Vendor name", hdr->vendor_name);
  615. inspect_fw_pstr("Firmware version", hdr->fw_version);
  616. inspect_fw_phex("Hardware ID", ntohl(hdr->hw_id));
  617. inspect_fw_phex("Hardware Revision", ntohl(hdr->hw_rev));
  618. inspect_fw_phex("Region code", ntohl(hdr->region_code));
  619. printf("\n");
  620. inspect_fw_phexdec("Kernel data offset",
  621. ntohl(hdr->kernel_ofs));
  622. inspect_fw_phexdec("Kernel data length",
  623. ntohl(hdr->kernel_len));
  624. inspect_fw_phex("Kernel load address",
  625. ntohl(hdr->kernel_la));
  626. inspect_fw_phex("Kernel entry point",
  627. ntohl(hdr->kernel_ep));
  628. inspect_fw_phexdec("Rootfs data offset",
  629. ntohl(hdr->rootfs_ofs));
  630. inspect_fw_phexdec("Rootfs data length",
  631. ntohl(hdr->rootfs_len));
  632. inspect_fw_phexdec("Boot loader data offset",
  633. ntohl(hdr->boot_ofs));
  634. inspect_fw_phexdec("Boot loader data length",
  635. ntohl(hdr->boot_len));
  636. inspect_fw_phexdec("Total firmware length",
  637. ntohl(hdr->fw_length));
  638. if (extract) {
  639. FILE *fp;
  640. char *filename;
  641. printf("\n");
  642. filename = malloc(strlen(inspect_info.file_name) + 8);
  643. sprintf(filename, "%s-kernel", inspect_info.file_name);
  644. printf("Extracting kernel to \"%s\"...\n", filename);
  645. fp = fopen(filename, "w");
  646. if (fp) {
  647. if (!fwrite(buf + ntohl(hdr->kernel_ofs),
  648. ntohl(hdr->kernel_len), 1, fp)) {
  649. ERR("error in fwrite(): %s", strerror(errno));
  650. }
  651. fclose(fp);
  652. } else {
  653. ERR("error in fopen(): %s", strerror(errno));
  654. }
  655. free(filename);
  656. filename = malloc(strlen(inspect_info.file_name) + 8);
  657. sprintf(filename, "%s-rootfs", inspect_info.file_name);
  658. printf("Extracting rootfs to \"%s\"...\n", filename);
  659. fp = fopen(filename, "w");
  660. if (fp) {
  661. if (!fwrite(buf + ntohl(hdr->rootfs_ofs),
  662. ntohl(hdr->rootfs_len), 1, fp)) {
  663. ERR("error in fwrite(): %s", strerror(errno));
  664. }
  665. fclose(fp);
  666. } else {
  667. ERR("error in fopen(): %s", strerror(errno));
  668. }
  669. free(filename);
  670. }
  671. out_free_buf:
  672. free(buf);
  673. out:
  674. return ret;
  675. }
  676. int main(int argc, char *argv[])
  677. {
  678. int ret = EXIT_FAILURE;
  679. progname = basename(argv[0]);
  680. while ( 1 ) {
  681. int c;
  682. c = getopt(argc, argv, "a:H:E:F:L:m:V:N:W:C:ci:k:r:R:o:xX:hsSjv:");
  683. if (c == -1)
  684. break;
  685. switch (c) {
  686. case 'a':
  687. sscanf(optarg, "0x%x", &rootfs_align);
  688. break;
  689. case 'H':
  690. opt_hw_id = optarg;
  691. break;
  692. case 'E':
  693. sscanf(optarg, "0x%x", &kernel_ep);
  694. break;
  695. case 'F':
  696. layout_id = optarg;
  697. break;
  698. case 'W':
  699. opt_hw_rev = optarg;
  700. break;
  701. case 'C':
  702. country = optarg;
  703. break;
  704. case 'L':
  705. sscanf(optarg, "0x%x", &kernel_la);
  706. break;
  707. case 'm':
  708. sscanf(optarg, "%u", &opt_hdr_ver);
  709. break;
  710. case 'V':
  711. version = optarg;
  712. break;
  713. case 'v':
  714. fw_ver = optarg;
  715. break;
  716. case 'N':
  717. vendor = optarg;
  718. break;
  719. case 'c':
  720. combined++;
  721. break;
  722. case 'k':
  723. kernel_info.file_name = optarg;
  724. break;
  725. case 'r':
  726. rootfs_info.file_name = optarg;
  727. break;
  728. case 'R':
  729. sscanf(optarg, "0x%x", &rootfs_ofs);
  730. break;
  731. case 'o':
  732. ofname = optarg;
  733. break;
  734. case 's':
  735. strip_padding = 1;
  736. break;
  737. case 'S':
  738. ignore_size = 1;
  739. break;
  740. case 'i':
  741. inspect_info.file_name = optarg;
  742. break;
  743. case 'j':
  744. add_jffs2_eof = 1;
  745. break;
  746. case 'x':
  747. extract = 1;
  748. break;
  749. case 'h':
  750. usage(EXIT_SUCCESS);
  751. break;
  752. case 'X':
  753. sscanf(optarg, "0x%x", &reserved_space);
  754. break;
  755. default:
  756. usage(EXIT_FAILURE);
  757. break;
  758. }
  759. }
  760. ret = check_options();
  761. if (ret)
  762. goto out;
  763. if (!inspect_info.file_name)
  764. ret = build_fw();
  765. else
  766. ret = inspect_fw();
  767. out:
  768. return ret;
  769. }