OpenWrt – Blame information for rev 1
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | /* |
2 | * jcgimage - Create a JCG firmware image |
||
3 | * |
||
4 | * Copyright (C) 2015 Reinhard Max <reinhard@m4x.de> |
||
5 | * |
||
6 | * This program is free software; you can redistribute it and/or |
||
7 | * modify it under the terms of the GNU General Public License |
||
8 | * as published by the Free Software Foundation; either version 2 |
||
9 | * of the License, or (at your option) any later version. |
||
10 | * |
||
11 | * This program is distributed in the hope that it will be useful, |
||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
14 | * GNU General Public License for more details. |
||
15 | * |
||
16 | * You should have received a copy of the GNU General Public License |
||
17 | * along with this program; if not, write to the Free Software |
||
18 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
||
19 | * |
||
20 | */ |
||
21 | |||
22 | /* |
||
23 | * JCG firmware update images consist of a 512 byte header and a |
||
24 | * modified uImage (details below) as the payload. |
||
25 | * |
||
26 | * The payload is obfuscated by XORing it with a key that is generated |
||
27 | * from parts of the header. Fortunately only non-essential parts of |
||
28 | * the header are used for this and zeroing them results in a zero |
||
29 | * key, effectively disabling the obfuscation and allowing us to use |
||
30 | * clear text payloads. |
||
31 | * |
||
32 | * The mandatory parts of the header are: |
||
33 | * |
||
34 | * - A magic string of "YSZJ" at offset 0. |
||
35 | * - A value of 1 at offset 39 (header format version?) |
||
36 | * - A CRC32 checksum of the payload at offset 504. |
||
37 | * - A CRC32 checksum of the header at offset 508. |
||
38 | * |
||
39 | * An image constructed by these rules will be accepted by JCG's |
||
40 | * U-Boot in resuce mode via TFTP and the payload will be written to |
||
41 | * the flash starting at offset 0x00050000. |
||
42 | * |
||
43 | * JCG's U-Boot does check the content or size of the payload |
||
44 | * image. If it is too large, it wraps around and overwrites U-Boot, |
||
45 | * requiring JTAG to revive the board. To prevent such bricking from |
||
46 | * happening, this tool refuses to build such overlong images. |
||
47 | * |
||
48 | * Two more conditions have to be met for a JCG image to be accepted |
||
49 | * as a valid update by the web interface of the stock firware: |
||
50 | * |
||
51 | * - The bytes at offsets 109 and 111 in the header must be a binary |
||
52 | * representation of the first two components of the firmware |
||
53 | * version as displayed in the update web form, or it will be |
||
54 | * rejected as "incorrect product". |
||
55 | * |
||
56 | * - The payload must start with a valid uImage header whose data |
||
57 | * CRC checksum matches the whole rest of the update file rather |
||
58 | * than just the number of bytes specified in the size field of the |
||
59 | * header. |
||
60 | * |
||
61 | * This last condition is met by JCG's original firmware images, |
||
62 | * because they have both, kernel and rootfs inside the uImage and |
||
63 | * abuse the last four bytes of the name field to record the offset of |
||
64 | * the file system from the start of the uImage header. This tool |
||
65 | * produces such images when called with -k and -r, which are meant to |
||
66 | * repack the original firmware after modifying the file systen, |
||
67 | * e.g. to add debugging tools and enable shell access. |
||
68 | * |
||
69 | * In contrast, OpenWrt sysupgrade images consist of a uImage that |
||
70 | * only contains the kernel and has the rootfs appended to it. Hence, |
||
71 | * the CRC over kernel and file system does not match the one in the |
||
72 | * uImage header. Fixing this by adjusting the uImage header is not |
||
73 | * possible, because it makes the uImage unusable for booting. Instead |
||
74 | * we append four "patch" bytes to the end of the file system, that |
||
75 | * are calculated to force the checksum of kernel+fs to be the same as |
||
76 | * for the kernel alone. |
||
77 | * |
||
78 | */ |
||
79 | |||
80 | #include <zlib.h> |
||
81 | #include <stdio.h> |
||
82 | #include <string.h> |
||
83 | #include <sys/types.h> |
||
84 | #include <sys/stat.h> |
||
85 | #include <fcntl.h> |
||
86 | #include <unistd.h> |
||
87 | #include <libgen.h> |
||
88 | #include <stdlib.h> |
||
89 | #include <errno.h> |
||
90 | #include <err.h> |
||
91 | #include <time.h> |
||
92 | #include <sys/mman.h> |
||
93 | #include <arpa/inet.h> |
||
94 | #include <assert.h> |
||
95 | |||
96 | /* |
||
97 | * JCG Firmware image header |
||
98 | */ |
||
99 | #define JH_MAGIC 0x59535a4a /* "YSZJ" */ |
||
100 | struct jcg_header { |
||
101 | uint32_t jh_magic; |
||
102 | uint8_t jh_version[32]; /* Firmware version string. |
||
103 | Fill with zeros to avoid encryption */ |
||
104 | uint32_t jh_type; /* must be 1 */ |
||
105 | uint8_t jh_info[64]; /* Firmware info string. Fill with |
||
106 | zeros to avoid encryption */ |
||
107 | uint32_t jh_time; /* Image creation time in seconds since |
||
108 | * the Epoch. Does not seem to be used |
||
109 | * by the stock firmware. */ |
||
110 | uint16_t jh_major; /* Major fimware version */ |
||
111 | uint16_t jh_minor; /* Minor fimrmware version */ |
||
112 | uint8_t jh_unknown[392]; /* Apparently unused and all zeros */ |
||
113 | uint32_t jh_dcrc; /* CRC checksum of the payload */ |
||
114 | uint32_t jh_hcrc; /* CRC checksum of the header */ |
||
115 | }; |
||
116 | |||
117 | /* |
||
118 | * JCG uses a modified uImage header that replaces the last four bytes |
||
119 | * of the image name with the length of the kernel in the image. |
||
120 | */ |
||
121 | #define IH_MAGIC 0x27051956 /* Image Magic Number */ |
||
122 | #define IH_NMLEN 28 /* Image Name Length */ |
||
123 | |||
124 | struct uimage_header { |
||
125 | uint32_t ih_magic; /* Image Header Magic Number */ |
||
126 | uint32_t ih_hcrc; /* Image Header CRC Checksum */ |
||
127 | uint32_t ih_time; /* Image Creation Timestamp */ |
||
128 | uint32_t ih_size; /* Image Data Size */ |
||
129 | uint32_t ih_load; /* Data Load Address */ |
||
130 | uint32_t ih_ep; /* Entry Point Address */ |
||
131 | uint32_t ih_dcrc; /* Image Data CRC Checksum */ |
||
132 | uint8_t ih_os; /* Operating System */ |
||
133 | uint8_t ih_arch; /* CPU architecture */ |
||
134 | uint8_t ih_type; /* Image Type */ |
||
135 | uint8_t ih_comp; /* Compression Type */ |
||
136 | uint8_t ih_name[IH_NMLEN];/* Image Name */ |
||
137 | uint32_t ih_fsoff; /* Offset of the file system |
||
138 | partition from the start of |
||
139 | the header */ |
||
140 | }; |
||
141 | |||
142 | /* |
||
143 | * Open the named file and return its size and file descriptor. |
||
144 | * Exit in case of errors. |
||
145 | */ |
||
146 | int |
||
147 | opensize(char *name, size_t *size) |
||
148 | { |
||
149 | struct stat s; |
||
150 | int fd = open(name, O_RDONLY); |
||
151 | if (fd < 0) { |
||
152 | err(1, "cannot open \"%s\"", name); |
||
153 | } |
||
154 | if (fstat(fd, &s) == -1) { |
||
155 | err(1, "cannot stat \"%s\"", name); |
||
156 | } |
||
157 | *size = s.st_size; |
||
158 | return fd; |
||
159 | } |
||
160 | |||
161 | static time_t source_date_epoch = -1; |
||
162 | static void set_source_date_epoch() { |
||
163 | char *env = getenv("SOURCE_DATE_EPOCH"); |
||
164 | char *endptr = env; |
||
165 | errno = 0; |
||
166 | if (env && *env) { |
||
167 | source_date_epoch = strtoull(env, &endptr, 10); |
||
168 | if (errno || (endptr && *endptr != '\0')) { |
||
169 | fprintf(stderr, "Invalid SOURCE_DATE_EPOCH"); |
||
170 | exit(1); |
||
171 | } |
||
172 | } |
||
173 | } |
||
174 | |||
175 | /* |
||
176 | * Write the JCG header |
||
177 | */ |
||
178 | void |
||
179 | mkjcgheader(struct jcg_header *h, size_t psize, char *version) |
||
180 | { |
||
181 | uLong crc; |
||
182 | uint16_t major = 0, minor = 0; |
||
183 | void *payload = (void *)h + sizeof(*h); |
||
184 | time_t t; |
||
185 | |||
186 | if (source_date_epoch != -1) { |
||
187 | t = source_date_epoch; |
||
188 | } else if ((time(&t) == (time_t)(-1))) { |
||
189 | err(1, "time call failed"); |
||
190 | } |
||
191 | |||
192 | if (version != NULL) { |
||
193 | if (sscanf(version, "%hu.%hu", &major, &minor) != 2) { |
||
194 | err(1, "cannot parse version \"%s\"", version); |
||
195 | } |
||
196 | } |
||
197 | |||
198 | memset(h, 0, sizeof(*h)); |
||
199 | h->jh_magic = htonl(JH_MAGIC); |
||
200 | h->jh_type = htonl(1); |
||
201 | h->jh_time = htonl(t); |
||
202 | h->jh_major = htons(major); |
||
203 | h->jh_minor = htons(minor); |
||
204 | |||
205 | /* CRC over JCG payload (uImage) */ |
||
206 | crc = crc32(0L, Z_NULL, 0); |
||
207 | crc = crc32(crc, payload, psize); |
||
208 | h->jh_dcrc = htonl(crc); |
||
209 | |||
210 | /* CRC over JCG header */ |
||
211 | crc = crc32(0L, Z_NULL, 0); |
||
212 | crc = crc32(crc, (void *)h, sizeof(*h)); |
||
213 | h->jh_hcrc = htonl(crc); |
||
214 | } |
||
215 | |||
216 | /* |
||
217 | * Write the uImage header |
||
218 | */ |
||
219 | void |
||
220 | mkuheader(struct uimage_header *h, size_t ksize, size_t fsize) |
||
221 | { |
||
222 | uLong crc; |
||
223 | void *payload = (void *)h + sizeof(*h); |
||
224 | |||
225 | // printf("mkuheader: %p, %zd, %zd\n", h, ksize, fsize); |
||
226 | memset(h, 0, sizeof(*h)); |
||
227 | h->ih_magic = htonl(IH_MAGIC); |
||
228 | h->ih_time = htonl(time(NULL)); |
||
229 | h->ih_size = htonl(ksize + fsize); |
||
230 | h->ih_load = htonl(0x80000000); |
||
231 | h->ih_ep = htonl(0x80292000); |
||
232 | h->ih_os = 0x05; |
||
233 | h->ih_arch = 0x05; |
||
234 | h->ih_type = 0x02; |
||
235 | h->ih_comp = 0x03; |
||
236 | h->ih_fsoff = htonl(sizeof(*h) + ksize); |
||
237 | strcpy((char *)h->ih_name, "Linux Kernel Image"); |
||
238 | |||
239 | /* CRC over uImage payload (kernel and file system) */ |
||
240 | crc = crc32(0L, Z_NULL, 0); |
||
241 | crc = crc32(crc, payload, ntohl(h->ih_size)); |
||
242 | h->ih_dcrc = htonl(crc); |
||
243 | printf("CRC1: %08lx\n", crc); |
||
244 | |||
245 | /* CRC over uImage header */ |
||
246 | crc = crc32(0L, Z_NULL, 0); |
||
247 | crc = crc32(crc, (void *)h, sizeof(*h)); |
||
248 | h->ih_hcrc = htonl(crc); |
||
249 | printf("CRC2: %08lx\n", crc); |
||
250 | } |
||
251 | |||
252 | /* |
||
253 | * Calculate a "patch" value and write it into the last four bytes of |
||
254 | * buf, so that the CRC32 checksum of the whole buffer is dcrc. |
||
255 | * |
||
256 | * Based on: SAR-PR-2006-05: Reversing CRC – Theory and Practice. |
||
257 | * Martin Stigge, Henryk Plötz, Wolf Müller, Jens-Peter Redlich. |
||
258 | * http://sar.informatik.hu-berlin.de/research/publications/#SAR-PR-2006-05 |
||
259 | */ |
||
260 | void |
||
261 | craftcrc(uint32_t dcrc, uint8_t *buf, size_t len) |
||
262 | { |
||
263 | int i; |
||
264 | uint32_t a; |
||
265 | uint32_t patch = 0; |
||
266 | uint32_t crc = crc32(0L, Z_NULL, 0); |
||
267 | |||
268 | a = ~dcrc; |
||
269 | for (i = 0; i < 32; i++) { |
||
270 | if (patch & 1) { |
||
271 | patch = (patch >> 1) ^ 0xedb88320L; |
||
272 | } else { |
||
273 | patch >>= 1; |
||
274 | } |
||
275 | if (a & 1) { |
||
276 | patch ^= 0x5b358fd3L; |
||
277 | } |
||
278 | a >>= 1; |
||
279 | } |
||
280 | patch ^= ~crc32(crc, buf, len - 4); |
||
281 | for (i = 0; i < 4; i++) { |
||
282 | buf[len - 4 + i] = patch & 0xff; |
||
283 | patch >>= 8; |
||
284 | } |
||
285 | /* Verify that we actually get the desired result */ |
||
286 | crc = crc32(0L, Z_NULL, 0); |
||
287 | crc = crc32(crc, buf, len); |
||
288 | if (crc != dcrc) { |
||
289 | errx(1, "CRC patching is broken: wanted %08x, but got %08x.", |
||
290 | dcrc, crc); |
||
291 | } |
||
292 | } |
||
293 | |||
294 | void |
||
295 | usage() { |
||
296 | fprintf(stderr, "Usage:\n" |
||
297 | "jcgimage -o outfile -u uImage [-v version]\n" |
||
298 | "jcgimage -o outfile -k kernel -f rootfs [-v version]\n"); |
||
299 | exit(1); |
||
300 | } |
||
301 | |||
302 | #define MODE_UNKNOWN 0 |
||
303 | #define MODE_UIMAGE 1 |
||
304 | #define MODE_KR 2 |
||
305 | |||
306 | /* The output image must not be larger than 4MiB - 5*64kiB */ |
||
307 | #define MAXSIZE (size_t)(4 * 1024 * 1024 - 5 * 64 * 1024) |
||
308 | |||
309 | int |
||
310 | main(int argc, char **argv) |
||
311 | { |
||
312 | struct jcg_header *jh; |
||
313 | struct uimage_header *uh; |
||
314 | int c; |
||
315 | char *imagefile = NULL; |
||
316 | char *file1 = NULL; |
||
317 | char *file2 = NULL; |
||
318 | char *version = NULL; |
||
319 | int mode = MODE_UNKNOWN; |
||
320 | int fdo, fd1, fd2; |
||
321 | size_t size1, size2, sizeu, sizeo, off1, off2; |
||
322 | void *map; |
||
323 | |||
324 | /* Make sure the headers have the right size */ |
||
325 | assert(sizeof(struct jcg_header) == 512); |
||
326 | assert(sizeof(struct uimage_header) == 64); |
||
327 | set_source_date_epoch(); |
||
328 | |||
329 | while ((c = getopt(argc, argv, "o:k:f:u:v:h")) != -1) { |
||
330 | switch (c) { |
||
331 | case 'o': |
||
332 | imagefile = optarg; |
||
333 | break; |
||
334 | case 'k': |
||
335 | if (mode == MODE_UIMAGE) { |
||
336 | errx(1,"-k cannot be combined with -u"); |
||
337 | } |
||
338 | mode = MODE_KR; |
||
339 | file1 = optarg; |
||
340 | break; |
||
341 | case 'f': |
||
342 | if (mode == MODE_UIMAGE) { |
||
343 | errx(1,"-f cannot be combined with -u"); |
||
344 | } |
||
345 | mode = MODE_KR; |
||
346 | file2 = optarg; |
||
347 | break; |
||
348 | case 'u': |
||
349 | if (mode == MODE_KR) { |
||
350 | errx(1,"-u cannot be combined with -k and -r"); |
||
351 | } |
||
352 | mode = MODE_UIMAGE; |
||
353 | file1 = optarg; |
||
354 | break; |
||
355 | case 'v': |
||
356 | version = optarg; |
||
357 | break; |
||
358 | case 'h': |
||
359 | default: |
||
360 | usage(); |
||
361 | } |
||
362 | } |
||
363 | if (optind != argc) { |
||
364 | errx(1, "illegal arg \"%s\"", argv[optind]); |
||
365 | } |
||
366 | if (imagefile == NULL) { |
||
367 | errx(1, "no output file specified"); |
||
368 | } |
||
369 | if (mode == MODE_UNKNOWN) { |
||
370 | errx(1, "specify either -u or -k and -r"); |
||
371 | } |
||
372 | if (mode == MODE_KR) { |
||
373 | if (file1 == NULL || file2 == NULL) { |
||
374 | errx(1,"need -k and -r"); |
||
375 | } |
||
376 | fd2 = opensize(file2, &size2); |
||
377 | } |
||
378 | fd1 = opensize(file1, &size1); |
||
379 | if (mode == MODE_UIMAGE) { |
||
380 | off1 = sizeof(*jh); |
||
381 | sizeu = size1 + 4; |
||
382 | sizeo = sizeof(*jh) + sizeu; |
||
383 | } else { |
||
384 | off1 = sizeof(*jh) + sizeof(*uh); |
||
385 | off2 = sizeof(*jh) + sizeof(*uh) + size1; |
||
386 | sizeu = sizeof(*uh) + size1 + size2; |
||
387 | sizeo = sizeof(*jh) + sizeu; |
||
388 | } |
||
389 | |||
390 | if (sizeo > MAXSIZE) { |
||
391 | errx(1,"payload too large: %zd > %zd\n", sizeo, MAXSIZE); |
||
392 | } |
||
393 | |||
394 | fdo = open(imagefile, O_RDWR | O_CREAT | O_TRUNC, 00644); |
||
395 | if (fdo < 0) { |
||
396 | err(1, "cannot open \"%s\"", imagefile); |
||
397 | } |
||
398 | |||
399 | if (ftruncate(fdo, sizeo) == -1) { |
||
400 | err(1, "cannot grow \"%s\" to %zd bytes", imagefile, sizeo); |
||
401 | } |
||
402 | map = mmap(NULL, sizeo, PROT_READ|PROT_WRITE, MAP_SHARED, fdo, 0); |
||
403 | uh = map + sizeof(*jh); |
||
404 | if (map == MAP_FAILED) { |
||
405 | err(1, "cannot mmap \"%s\"", imagefile); |
||
406 | } |
||
407 | |||
408 | if (read(fd1, map + off1, size1) != size1) { |
||
409 | err(1, "cannot copy %s", file1); |
||
410 | } |
||
411 | |||
412 | if (mode == MODE_KR) { |
||
413 | if (read(fd2, map+off2, size2) != size2) { |
||
414 | err(1, "cannot copy %s", file2); |
||
415 | } |
||
416 | mkuheader(uh, size1, size2); |
||
417 | } else if (mode == MODE_UIMAGE) { |
||
418 | craftcrc(ntohl(uh->ih_dcrc), (void*)uh + sizeof(*uh), |
||
419 | sizeu - sizeof(*uh)); |
||
420 | } |
||
421 | mkjcgheader(map, sizeu, version); |
||
422 | munmap(map, sizeo); |
||
423 | close(fdo); |
||
424 | return 0; |
||
425 | } |