summaryrefslogtreecommitdiff
path: root/tools/firmware-utils/src/jcgimage.c
blob: c98b0b52985e854c2168f14577f8ef24473dc1a9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
/*
 * jcgimage - Create a JCG firmware image
 *
 * Copyright (C) 2015 Reinhard Max <reinhard@m4x.de>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 */

/*
 * JCG firmware update images consist of a 512 byte header and a
 * modified uImage (details below) as the payload.
 *
 * The payload is obfuscated by XORing it with a key that is generated
 * from parts of the header. Fortunately only non-essential parts of
 * the header are used for this and zeroing them results in a zero
 * key, effectively disabling the obfuscation and allowing us to use
 * clear text payloads.
 *
 * The mandatory parts of the header are:
 *
 * - A magic string of "YSZJ" at offset 0.
 * - A value of 1 at offset 39 (header format version?)
 * - A CRC32 checksum of the payload at offset 504.
 * - A CRC32 checksum of the header at offset 508.
 *
 * An image constructed by these rules will be accepted by JCG's
 * U-Boot in resuce mode via TFTP and the payload will be written to
 * the flash starting at offset 0x00050000.
 *
 * JCG's U-Boot does check the content or size of the payload
 * image. If it is too large, it wraps around and overwrites U-Boot,
 * requiring JTAG to revive the board. To prevent such bricking from
 * happening, this tool refuses to build such overlong images.
 *
 * Two more conditions have to be met for a JCG image to be accepted
 * as a valid update by the web interface of the stock firware:
 *
 *   - The bytes at offsets 109 and 111 in the header must be a binary
 *   representation of the first two components of the firmware
 *   version as displayed in the update web form, or it will be
 *   rejected as "incorrect product".
 *
 *   - The payload must start with a valid uImage header whose data
 *   CRC checksum matches the whole rest of the update file rather
 *   than just the number of bytes specified in the size field of the
 *   header.
 *
 * This last condition is met by JCG's original firmware images,
 * because they have both, kernel and rootfs inside the uImage and
 * abuse the last four bytes of the name field to record the offset of
 * the file system from the start of the uImage header. This tool
 * produces such images when called with -k and -r, which are meant to
 * repack the original firmware after modifying the file systen,
 * e.g. to add debugging tools and enable shell access.
 *
 * In contrast, OpenWrt sysupgrade images consist of a uImage that
 * only contains the kernel and has the rootfs appended to it. Hence,
 * the CRC over kernel and file system does not match the one in the
 * uImage header. Fixing this by adjusting the uImage header is not
 * possible, because it makes the uImage unusable for booting. Instead
 * we append four "patch" bytes to the end of the file system, that
 * are calculated to force the checksum of kernel+fs to be the same as
 * for the kernel alone.
 *
 */

#include <zlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <libgen.h>
#include <stdlib.h>
#include <errno.h>
#include <err.h>
#include <time.h>
#include <sys/mman.h>
#include <arpa/inet.h>
#include <assert.h>

/*
 * JCG Firmware image header
 */
#define JH_MAGIC 0x59535a4a    /* "YSZJ" */
struct jcg_header {
    uint32_t jh_magic;
    uint8_t  jh_version[32];   /* Firmware version string. Fill with
				  zeros to avoid encryption */
    uint32_t jh_type;          /* must be 1 */
    uint8_t  jh_info[64];      /* Firmware info string. Fill with
				  zeros to avoid encryption */
    uint32_t jh_time;          /* Image creation time in seconds since
				* the Epoch. Does not seem to be used
				* by the stock firmware. */
    uint16_t jh_major;         /* Major fimware version */
    uint16_t jh_minor;         /* Minor fimrmware version */
    uint8_t  jh_unknown[392];  /* Apparently unused and all zeros */
    uint32_t jh_dcrc;          /* CRC checksum of the payload */
    uint32_t jh_hcrc;          /* CRC checksum of the header */
};

/*
 * JCG uses a modified uImage header that replaces the last four bytes
 * of the image name with the length of the kernel in the image.
 */
#define IH_MAGIC    0x27051956    /* Image Magic Number     */
#define IH_NMLEN    28            /* Image Name Length      */

struct uimage_header {
    uint32_t    ih_magic;         /* Image Header Magic Number */
    uint32_t    ih_hcrc;          /* Image Header CRC Checksum */
    uint32_t    ih_time;          /* Image Creation Timestamp  */
    uint32_t    ih_size;          /* Image Data Size           */
    uint32_t    ih_load;          /* Data     Load  Address    */
    uint32_t    ih_ep;            /* Entry Point Address       */
    uint32_t    ih_dcrc;          /* Image Data CRC Checksum   */
    uint8_t     ih_os;            /* Operating System          */
    uint8_t     ih_arch;          /* CPU architecture          */
    uint8_t     ih_type;          /* Image Type                */
    uint8_t     ih_comp;          /* Compression Type          */
    uint8_t     ih_name[IH_NMLEN];/* Image Name                */
    uint32_t    ih_fsoff;         /* Offset of the file system partition */
};

/*
 * Open the named file and return its size and file descriptor.
 * Exit in case of errors.
 */
int
opensize(char *name, size_t *size)
{
    struct stat s;
    int fd = open(name, O_RDONLY);
    if (fd < 0) {
	err(1, "cannot open \"%s\"", name);
    }
    if (fstat(fd, &s) == -1) {
	err(1, "cannot stat \"%s\"", name);
    }
    *size = s.st_size;
    return fd;
}

/*
 * Write the JCG header
 */
void
mkjcgheader(struct jcg_header *h, size_t psize, char *version)
{
    uLong crc;
    uint16_t major = 0, minor = 0;
    void *payload = (void *)h + sizeof(*h);

    if (version != NULL) {
	if (sscanf(version, "%hu.%hu", &major, &minor) != 2) {
	    err(1, "cannot parse version \"%s\"", version);
	}
    }

    memset(h, 0, sizeof(*h));
    h->jh_magic = htonl(JH_MAGIC);
    h->jh_type  = htonl(1);
    h->jh_time  = htonl(time(NULL));
    h->jh_major = htons(major);
    h->jh_minor = htons(minor);

    /* CRC over JCG payload (uImage) */
    crc = crc32(0L, Z_NULL, 0);
    crc = crc32(crc, payload, psize);
    h->jh_dcrc  = htonl(crc);

    /* CRC over JCG header */
    crc = crc32(0L, Z_NULL, 0);
    crc = crc32(crc, (void *)h, sizeof(*h));
    h->jh_hcrc  = htonl(crc);
}

/*
 * Write the uImage header
 */
void
mkuheader(struct uimage_header *h, size_t ksize, size_t fsize)
{
    uLong crc;
    void *payload = (void *)h + sizeof(*h);

    // printf("mkuheader: %p, %zd, %zd\n", h, ksize, fsize);
    memset(h, 0, sizeof(*h));
    h->ih_magic = htonl(IH_MAGIC);
    h->ih_time  = htonl(time(NULL));
    h->ih_size  = htonl(ksize + fsize);
    h->ih_load  = htonl(0x80000000);
    h->ih_ep    = htonl(0x80292000);
    h->ih_os    = 0x05;
    h->ih_arch  = 0x05;
    h->ih_type  = 0x02;
    h->ih_comp  = 0x03;
    h->ih_fsoff = htonl(sizeof(*h) + ksize);
    strcpy((char *)h->ih_name, "Linux Kernel Image");

    /* CRC over uImage payload (kernel and file system) */
    crc = crc32(0L, Z_NULL, 0);
    crc = crc32(crc, payload, ntohl(h->ih_size));
    h->ih_dcrc  = htonl(crc);
    printf("CRC1: %08lx\n", crc);

    /* CRC over uImage header */
    crc = crc32(0L, Z_NULL, 0);
    crc = crc32(crc, (void *)h, sizeof(*h));
    h->ih_hcrc  = htonl(crc);
    printf("CRC2: %08lx\n", crc);
}

/*
 * Calculate a "patch" value and write it into the last four bytes of
 * buf, so that the CRC32 checksum of the whole buffer is dcrc.
 *
 * Based on: SAR-PR-2006-05: Reversing CRC – Theory and Practice.
 * Martin Stigge, Henryk Plötz, Wolf Müller, Jens-Peter Redlich.
 * http://sar.informatik.hu-berlin.de/research/publications/#SAR-PR-2006-05
 */
void
craftcrc(uint32_t dcrc, uint8_t *buf, size_t len)
{
    int i;
    uint32_t a;
    uint32_t patch = 0;
    uint32_t crc = crc32(0L, Z_NULL, 0);

    a = ~dcrc;
    for (i = 0; i < 32; i++) {
	if (patch & 1) {
	    patch = (patch >> 1) ^ 0xedb88320L;
	} else {
	    patch >>= 1;
	}
	if (a & 1) {
	    patch ^= 0x5b358fd3L;
	}
	a >>= 1;
    }
    patch ^= ~crc32(crc, buf, len - 4);
    for (i = 0; i < 4; i++) {
	buf[len - 4 + i] = patch & 0xff;
	patch >>= 8;
    }
    /* Verify that we actually get the desired result */
    crc = crc32(0L, Z_NULL, 0);
    crc = crc32(crc, buf, len);
    if (crc != dcrc) {
	errx(1, "CRC patching is broken: wanted %08x, but got %08x.", dcrc, crc);
    }
}

void
usage() {
    fprintf(stderr, "Usage:\n"
	    "   jcgimage -o outputfile -u uImage [-v version]\n"
	    "   jcgimage -o outputfile -k kernel -f rootfs [-v version]\n");
    exit(1);
}

#define MODE_UNKNOWN 0
#define MODE_UIMAGE 1
#define MODE_KR 2

/* The output image must not be larger than 4MiB - 5*64kiB */
#define MAXSIZE (size_t)(4 * 1024 * 1024 - 5 * 64 * 1024)

int
main(int argc, char **argv)
{
    struct jcg_header *jh;
    struct uimage_header *uh;
    int c;
    char *imagefile = NULL;
    char *file1 = NULL;
    char *file2 = NULL;
    char *version = NULL;
    int mode = MODE_UNKNOWN;
    int fdo, fd1, fd2;
    size_t size1, size2, sizeu, sizeo, off1, off2;
    void *map;

    /* Make sure the headers have the right size */
    assert(sizeof(struct jcg_header) == 512);
    assert(sizeof(struct uimage_header) == 64);

    while ((c = getopt(argc, argv, "o:k:f:u:v:h")) != -1) {
	switch (c) {
	case 'o':
	    imagefile = optarg;
	    break;
	case 'k':
	    if (mode == MODE_UIMAGE)
		errx(1,"-k cannot be combined with -u");
	    mode = MODE_KR;
	    file1 = optarg;
	    break;
	case 'f':
	    if (mode == MODE_UIMAGE)
		errx(1,"-f cannot be combined with -u");
	    mode = MODE_KR;
	    file2 = optarg;
	    break;
	case 'u':
	    if (mode == MODE_KR)
		errx(1,"-u cannot be combined with -k and -r");
	    mode = MODE_UIMAGE;
	    file1 = optarg;
	    break;
	case 'v':
	    version = optarg;
	    break;
	case 'h':
	default:
	    usage();
	}
    }
    if (optind != argc) {
	errx(1, "illegal arg \"%s\"", argv[optind]);
    }
    if (imagefile == NULL) {
	errx(1, "no output file specified");
    }
    if (mode == MODE_UNKNOWN)
	errx(1, "specify either -u or -k and -r");
    if (mode == MODE_KR) {
	if (file1 == NULL || file2 == NULL)
	    errx(1,"need -k and -r");
	fd2 = opensize(file2, &size2);
    }
    fd1 = opensize(file1, &size1);
    if (mode == MODE_UIMAGE) {
	off1 = sizeof(*jh);
	sizeu = size1 + 4;
	sizeo = sizeof(*jh) + sizeu;
    } else {
	off1 = sizeof(*jh) + sizeof(*uh);
	off2 = sizeof(*jh) + sizeof(*uh) + size1;
	sizeu = sizeof(*uh) + size1 + size2;
	sizeo = sizeof(*jh) + sizeu;
    }

    if (sizeo > MAXSIZE)
	errx(1,"payload too large: %zd > %zd\n", sizeo, MAXSIZE);

    fdo = open(imagefile, O_RDWR | O_CREAT | O_TRUNC, 00644);
    if (fdo < 0)
	err(1, "cannot open \"%s\"", imagefile);

    if (ftruncate(fdo, sizeo) == -1) {
	err(1, "cannot grow \"%s\" to %zd bytes", imagefile, sizeo);
    }
    map = mmap(NULL, sizeo, PROT_READ|PROT_WRITE, MAP_SHARED, fdo, 0);
    uh = map + sizeof(*jh);
    if (map == MAP_FAILED) {
	err(1, "cannot mmap \"%s\"", imagefile);
    }

    if (read(fd1, map + off1, size1) != size1)
	err(1, "cannot copy %s", file1);

    if (mode == MODE_KR) {
	if (read(fd2, map+off2, size2) != size2)
	    err(1, "cannot copy %s", file2);
	mkuheader(uh, size1, size2);
    } else if (mode == MODE_UIMAGE) {
	craftcrc(ntohl(uh->ih_dcrc), (void*)uh + sizeof(*uh),
		 sizeu - sizeof(*uh));
    }
    mkjcgheader(map, sizeu, version);
    munmap(map, sizeo);
    close(fdo);
    return 0;
}