1/* 2 * jcgimage - Create a JCG firmware image 3 * 4 * Copyright (C) 2015 Reinhard Max <reinhard@m4x.de> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 2 9 * of the License, or (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 19 * 20 */ 21 22/* 23 * JCG firmware update images consist of a 512 byte header and a 24 * modified uImage (details below) as the payload. 25 * 26 * The payload is obfuscated by XORing it with a key that is generated 27 * from parts of the header. Fortunately only non-essential parts of 28 * the header are used for this and zeroing them results in a zero 29 * key, effectively disabling the obfuscation and allowing us to use 30 * clear text payloads. 31 * 32 * The mandatory parts of the header are: 33 * 34 * - A magic string of "YSZJ" at offset 0. 35 * - A value of 1 at offset 39 (header format version?) 36 * - A CRC32 checksum of the payload at offset 504. 37 * - A CRC32 checksum of the header at offset 508. 38 * 39 * An image constructed by these rules will be accepted by JCG's 40 * U-Boot in resuce mode via TFTP and the payload will be written to 41 * the flash starting at offset 0x00050000. 42 * 43 * JCG's U-Boot does check the content or size of the payload 44 * image. If it is too large, it wraps around and overwrites U-Boot, 45 * requiring JTAG to revive the board. To prevent such bricking from 46 * happening, this tool refuses to build such overlong images. 47 * 48 * Two more conditions have to be met for a JCG image to be accepted 49 * as a valid update by the web interface of the stock firware: 50 * 51 * - The bytes at offsets 109 and 111 in the header must be a binary 52 * representation of the first two components of the firmware 53 * version as displayed in the update web form, or it will be 54 * rejected as "incorrect product". 55 * 56 * - The payload must start with a valid uImage header whose data 57 * CRC checksum matches the whole rest of the update file rather 58 * than just the number of bytes specified in the size field of the 59 * header. 60 * 61 * This last condition is met by JCG's original firmware images, 62 * because they have both, kernel and rootfs inside the uImage and 63 * abuse the last four bytes of the name field to record the offset of 64 * the file system from the start of the uImage header. This tool 65 * produces such images when called with -k and -r, which are meant to 66 * repack the original firmware after modifying the file systen, 67 * e.g. to add debugging tools and enable shell access. 68 * 69 * In contrast, OpenWrt sysupgrade images consist of a uImage that 70 * only contains the kernel and has the rootfs appended to it. Hence, 71 * the CRC over kernel and file system does not match the one in the 72 * uImage header. Fixing this by adjusting the uImage header is not 73 * possible, because it makes the uImage unusable for booting. Instead 74 * we append four "patch" bytes to the end of the file system, that 75 * are calculated to force the checksum of kernel+fs to be the same as 76 * for the kernel alone. 77 * 78 */ 79 80#include <zlib.h> 81#include <stdio.h> 82#include <string.h> 83#include <sys/types.h> 84#include <sys/stat.h> 85#include <fcntl.h> 86#include <unistd.h> 87#include <libgen.h> 88#include <stdlib.h> 89#include <errno.h> 90#include <err.h> 91#include <time.h> 92#include <sys/mman.h> 93#include <arpa/inet.h> 94#include <assert.h> 95 96/* 97 * JCG Firmware image header 98 */ 99#define JH_MAGIC 0x59535a4a /* "YSZJ" */ 100struct jcg_header { 101 uint32_t jh_magic; 102 uint8_t jh_version[32]; /* Firmware version string. 103 Fill with zeros to avoid encryption */ 104 uint32_t jh_type; /* must be 1 */ 105 uint8_t jh_info[64]; /* Firmware info string. Fill with 106 zeros to avoid encryption */ 107 uint32_t jh_time; /* Image creation time in seconds since 108 * the Epoch. Does not seem to be used 109 * by the stock firmware. */ 110 uint16_t jh_major; /* Major fimware version */ 111 uint16_t jh_minor; /* Minor fimrmware version */ 112 uint8_t jh_unknown[392]; /* Apparently unused and all zeros */ 113 uint32_t jh_dcrc; /* CRC checksum of the payload */ 114 uint32_t jh_hcrc; /* CRC checksum of the header */ 115}; 116 117/* 118 * JCG uses a modified uImage header that replaces the last four bytes 119 * of the image name with the length of the kernel in the image. 120 */ 121#define IH_MAGIC 0x27051956 /* Image Magic Number */ 122#define IH_NMLEN 28 /* Image Name Length */ 123 124struct uimage_header { 125 uint32_t ih_magic; /* Image Header Magic Number */ 126 uint32_t ih_hcrc; /* Image Header CRC Checksum */ 127 uint32_t ih_time; /* Image Creation Timestamp */ 128 uint32_t ih_size; /* Image Data Size */ 129 uint32_t ih_load; /* Data Load Address */ 130 uint32_t ih_ep; /* Entry Point Address */ 131 uint32_t ih_dcrc; /* Image Data CRC Checksum */ 132 uint8_t ih_os; /* Operating System */ 133 uint8_t ih_arch; /* CPU architecture */ 134 uint8_t ih_type; /* Image Type */ 135 uint8_t ih_comp; /* Compression Type */ 136 uint8_t ih_name[IH_NMLEN];/* Image Name */ 137 uint32_t ih_fsoff; /* Offset of the file system 138 partition from the start of 139 the header */ 140}; 141 142/* 143 * Open the named file and return its size and file descriptor. 144 * Exit in case of errors. 145 */ 146int 147opensize(char *name, size_t *size) 148{ 149 struct stat s; 150 int fd = open(name, O_RDONLY); 151 if (fd < 0) { 152 err(1, "cannot open \"%s\"", name); 153 } 154 if (fstat(fd, &s) == -1) { 155 err(1, "cannot stat \"%s\"", name); 156 } 157 *size = s.st_size; 158 return fd; 159} 160 161/* 162 * Write the JCG header 163 */ 164void 165mkjcgheader(struct jcg_header *h, size_t psize, char *version) 166{ 167 uLong crc; 168 uint16_t major = 0, minor = 0; 169 void *payload = (void *)h + sizeof(*h); 170 171 if (version != NULL) { 172 if (sscanf(version, "%hu.%hu", &major, &minor) != 2) { 173 err(1, "cannot parse version \"%s\"", version); 174 } 175 } 176 177 memset(h, 0, sizeof(*h)); 178 h->jh_magic = htonl(JH_MAGIC); 179 h->jh_type = htonl(1); 180 h->jh_time = htonl(time(NULL)); 181 h->jh_major = htons(major); 182 h->jh_minor = htons(minor); 183 184 /* CRC over JCG payload (uImage) */ 185 crc = crc32(0L, Z_NULL, 0); 186 crc = crc32(crc, payload, psize); 187 h->jh_dcrc = htonl(crc); 188 189 /* CRC over JCG header */ 190 crc = crc32(0L, Z_NULL, 0); 191 crc = crc32(crc, (void *)h, sizeof(*h)); 192 h->jh_hcrc = htonl(crc); 193} 194 195/* 196 * Write the uImage header 197 */ 198void 199mkuheader(struct uimage_header *h, size_t ksize, size_t fsize) 200{ 201 uLong crc; 202 void *payload = (void *)h + sizeof(*h); 203 204 // printf("mkuheader: %p, %zd, %zd\n", h, ksize, fsize); 205 memset(h, 0, sizeof(*h)); 206 h->ih_magic = htonl(IH_MAGIC); 207 h->ih_time = htonl(time(NULL)); 208 h->ih_size = htonl(ksize + fsize); 209 h->ih_load = htonl(0x80000000); 210 h->ih_ep = htonl(0x80292000); 211 h->ih_os = 0x05; 212 h->ih_arch = 0x05; 213 h->ih_type = 0x02; 214 h->ih_comp = 0x03; 215 h->ih_fsoff = htonl(sizeof(*h) + ksize); 216 strcpy((char *)h->ih_name, "Linux Kernel Image"); 217 218 /* CRC over uImage payload (kernel and file system) */ 219 crc = crc32(0L, Z_NULL, 0); 220 crc = crc32(crc, payload, ntohl(h->ih_size)); 221 h->ih_dcrc = htonl(crc); 222 printf("CRC1: %08lx\n", crc); 223 224 /* CRC over uImage header */ 225 crc = crc32(0L, Z_NULL, 0); 226 crc = crc32(crc, (void *)h, sizeof(*h)); 227 h->ih_hcrc = htonl(crc); 228 printf("CRC2: %08lx\n", crc); 229} 230 231/* 232 * Calculate a "patch" value and write it into the last four bytes of 233 * buf, so that the CRC32 checksum of the whole buffer is dcrc. 234 * 235 * Based on: SAR-PR-2006-05: Reversing CRC ��� Theory and Practice. 236 * Martin Stigge, Henryk Pl��tz, Wolf M��ller, Jens-Peter Redlich. 237 * http://sar.informatik.hu-berlin.de/research/publications/#SAR-PR-2006-05 238 */ 239void 240craftcrc(uint32_t dcrc, uint8_t *buf, size_t len) 241{ 242 int i; 243 uint32_t a; 244 uint32_t patch = 0; 245 uint32_t crc = crc32(0L, Z_NULL, 0); 246 247 a = ~dcrc; 248 for (i = 0; i < 32; i++) { 249 if (patch & 1) { 250 patch = (patch >> 1) ^ 0xedb88320L; 251 } else { 252 patch >>= 1; 253 } 254 if (a & 1) { 255 patch ^= 0x5b358fd3L; 256 } 257 a >>= 1; 258 } 259 patch ^= ~crc32(crc, buf, len - 4); 260 for (i = 0; i < 4; i++) { 261 buf[len - 4 + i] = patch & 0xff; 262 patch >>= 8; 263 } 264 /* Verify that we actually get the desired result */ 265 crc = crc32(0L, Z_NULL, 0); 266 crc = crc32(crc, buf, len); 267 if (crc != dcrc) { 268 errx(1, "CRC patching is broken: wanted %08x, but got %08x.", 269 dcrc, crc); 270 } 271} 272 273void 274usage() { 275 fprintf(stderr, "Usage:\n" 276 "jcgimage -o outfile -u uImage [-v version]\n" 277 "jcgimage -o outfile -k kernel -f rootfs [-v version]\n"); 278 exit(1); 279} 280 281#define MODE_UNKNOWN 0 282#define MODE_UIMAGE 1 283#define MODE_KR 2 284 285/* The output image must not be larger than 4MiB - 5*64kiB */ 286#define MAXSIZE (size_t)(4 * 1024 * 1024 - 5 * 64 * 1024) 287 288int 289main(int argc, char **argv) 290{ 291 struct jcg_header *jh; 292 struct uimage_header *uh; 293 int c; 294 char *imagefile = NULL; 295 char *file1 = NULL; 296 char *file2 = NULL; 297 char *version = NULL; 298 int mode = MODE_UNKNOWN; 299 int fdo, fd1, fd2; 300 size_t size1, size2, sizeu, sizeo, off1, off2; 301 void *map; 302 303 /* Make sure the headers have the right size */ 304 assert(sizeof(struct jcg_header) == 512); 305 assert(sizeof(struct uimage_header) == 64); 306 307 while ((c = getopt(argc, argv, "o:k:f:u:v:h")) != -1) { 308 switch (c) { 309 case 'o': 310 imagefile = optarg; 311 break; 312 case 'k': 313 if (mode == MODE_UIMAGE) { 314 errx(1,"-k cannot be combined with -u"); 315 } 316 mode = MODE_KR; 317 file1 = optarg; 318 break; 319 case 'f': 320 if (mode == MODE_UIMAGE) { 321 errx(1,"-f cannot be combined with -u"); 322 } 323 mode = MODE_KR; 324 file2 = optarg; 325 break; 326 case 'u': 327 if (mode == MODE_KR) { 328 errx(1,"-u cannot be combined with -k and -r"); 329 } 330 mode = MODE_UIMAGE; 331 file1 = optarg; 332 break; 333 case 'v': 334 version = optarg; 335 break; 336 case 'h': 337 default: 338 usage(); 339 } 340 } 341 if (optind != argc) { 342 errx(1, "illegal arg \"%s\"", argv[optind]); 343 } 344 if (imagefile == NULL) { 345 errx(1, "no output file specified"); 346 } 347 if (mode == MODE_UNKNOWN) { 348 errx(1, "specify either -u or -k and -r"); 349 } 350 if (mode == MODE_KR) { 351 if (file1 == NULL || file2 == NULL) { 352 errx(1,"need -k and -r"); 353 } 354 fd2 = opensize(file2, &size2); 355 } 356 fd1 = opensize(file1, &size1); 357 if (mode == MODE_UIMAGE) { 358 off1 = sizeof(*jh); 359 sizeu = size1 + 4; 360 sizeo = sizeof(*jh) + sizeu; 361 } else { 362 off1 = sizeof(*jh) + sizeof(*uh); 363 off2 = sizeof(*jh) + sizeof(*uh) + size1; 364 sizeu = sizeof(*uh) + size1 + size2; 365 sizeo = sizeof(*jh) + sizeu; 366 } 367 368 if (sizeo > MAXSIZE) { 369 errx(1,"payload too large: %zd > %zd\n", sizeo, MAXSIZE); 370 } 371 372 fdo = open(imagefile, O_RDWR | O_CREAT | O_TRUNC, 00644); 373 if (fdo < 0) { 374 err(1, "cannot open \"%s\"", imagefile); 375 } 376 377 if (ftruncate(fdo, sizeo) == -1) { 378 err(1, "cannot grow \"%s\" to %zd bytes", imagefile, sizeo); 379 } 380 map = mmap(NULL, sizeo, PROT_READ|PROT_WRITE, MAP_SHARED, fdo, 0); 381 uh = map + sizeof(*jh); 382 if (map == MAP_FAILED) { 383 err(1, "cannot mmap \"%s\"", imagefile); 384 } 385 386 if (read(fd1, map + off1, size1) != size1) { 387 err(1, "cannot copy %s", file1); 388 } 389 390 if (mode == MODE_KR) { 391 if (read(fd2, map+off2, size2) != size2) { 392 err(1, "cannot copy %s", file2); 393 } 394 mkuheader(uh, size1, size2); 395 } else if (mode == MODE_UIMAGE) { 396 craftcrc(ntohl(uh->ih_dcrc), (void*)uh + sizeof(*uh), 397 sizeu - sizeof(*uh)); 398 } 399 mkjcgheader(map, sizeu, version); 400 munmap(map, sizeo); 401 close(fdo); 402 return 0; 403} 404