git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c

   1 #ifdef WIN32
   2 #include <windows.h>
   3 #include <setupapi.h>
   4 #define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
   5 BOOL UsbConnect(void);
   6 #else
   7 #include <proxusb.h>
   8 #endif
   9
  10 #include <usb_cmd.h>
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include <stdlib.h>
  14 #include <stdint.h>
  15 #include "flash.h"
  16 #include "elf.h"
  17 #include "proxusb.h"
  18
  19 static uint32_t ExpectedAddr;
  20 static uint8_t QueuedToSend[256];
  21 static BOOL AllWritten;
  22 #define PHYSICAL_FLASH_START 0x100000
  23 #define PHYSICAL_FLASH_END   0x200000
  24
  25 void WaitForAck(void)
  26 {
  27   UsbCommand ack;
  28   ReceiveCommand(&ack);
  29   if (ack.cmd != CMD_ACK) {
  30     printf("bad ACK\n");
  31     exit(-1);
  32   }
  33 }
  34
  35 struct partition partitions[] = {
  36   {0x100000, 0x102000, 1, "bootrom"},
  37   {0x102000, 0x110000, 0, "fpga"},
  38   {0x110000, 0x140000, 0, "os"},
  39   {0, 0, 0, NULL},
  40 };
  41
  42 void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
  43 {
  44   unsigned char temp_buf[256];
  45   if (block_start & 0xFF) {
  46     printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
  47     memset(temp_buf, 0xFF, block_start & 0xFF);
  48     memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
  49     block_start &= ~0xFF;
  50   } else {
  51     memcpy(temp_buf, buf, len);
  52   }
  53
  54   UsbCommand c = {CMD_SETUP_WRITE};
  55
  56   for (int i = 0; i < 240; i += 48) {
  57     memcpy(c.d.asBytes, temp_buf+i, 48);
  58     c.arg[0] = (i/4);
  59     SendCommand(&c);
  60     WaitForAck();
  61   }
  62
  63   c.cmd = CMD_FINISH_WRITE;
  64   c.arg[0] = block_start;
  65
  66 //  printf("writing block %08x\r", c.arg[0]);
  67   memcpy(c.d.asBytes, temp_buf+240, 16);
  68   SendCommand(&c);
  69   WaitForAck();
  70
  71   AllWritten = true;
  72 }
  73
  74 void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
  75 {
  76   FILE *f = fopen(file, "rb");
  77   if (!f) {
  78     printf("couldn't open file\n");
  79     exit(-1);
  80   }
  81
  82   char buf[4];
  83   fread(buf, 1, 4, f);
  84   if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
  85     fseek(f, 0, SEEK_SET);
  86     Elf32_Ehdr header;
  87     fread(&header, 1, sizeof(header), f);
  88     int count = header.e_phnum;
  89     printf("count=%d phoff=%x\n", count, header.e_phoff);
  90     Elf32_Phdr phdr;
  91
  92     for (int i = 0; i < header.e_phnum; ++i) {
  93       fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
  94       fread(&phdr, 1, sizeof(phdr), f);
  95       printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
  96         phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
  97       if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
  98         && (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
  99         printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
 100         if (phdr.p_offset == 0) {
 101           printf("skipping forward 0x2000 because of strange linker thing\n");
 102           phdr.p_offset += 0x2000;
 103           phdr.p_paddr += 0x2000;
 104           phdr.p_filesz -= 0x2000;
 105           phdr.p_memsz -= 0x2000;
 106         }
 107
 108         fseek(f, phdr.p_offset, SEEK_SET);
 109         ExpectedAddr = phdr.p_paddr;
 110         while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
 111           unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
 112           if (bytes_to_read > 256)
 113             bytes_to_read=256;
 114           else
 115             memset(QueuedToSend, 0xFF, 256);
 116           fread(QueuedToSend, 1, bytes_to_read, f);
 117           printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
 118             QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
 119             QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
 120             QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
 121             QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
 122           WriteBlock(ExpectedAddr, 256, QueuedToSend);
 123           ExpectedAddr += bytes_to_read;
 124         }
 125       }
 126     }
 127
 128     fclose(f);
 129     printf("\ndone.\n");
 130     return;
 131   } else printf("Bad file format\n");
 132 }
 133
 134 int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
 135 {
 136   if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
 137     UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
 138
 139     /* Only send magic when flashing bootrom */
 140     if (p->precious)
 141       c.arg[2] = START_FLASH_MAGIC;
 142     else
 143       c.arg[2] = 0;
 144
 145     SendCommand(&c);
 146     WaitForAck();
 147   } else {
 148     fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
 149     fprintf(stderr, "         It is recommended that you update your bootloader\n\n");
 150     exit(0);
 151   }
 152
 153   LoadFlashFromFile(filename, p->start, p->end);
 154   return 1;
 155 }
 156
 157 unsigned int GetProxmarkState(void)
 158 {
 159   unsigned int state = 0;
 160
 161   UsbCommand c;
 162   c.cmd = CMD_DEVICE_INFO;
 163   SendCommand(&c);
 164
 165   UsbCommand resp;
 166   ReceiveCommand(&resp);
 167   /* Three cases:
 168   * 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
 169   * 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
 170   * 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
 171   */
 172
 173   switch (resp.cmd) {
 174   case CMD_ACK:
 175     state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
 176     break;
 177   case CMD_DEBUG_PRINT_STRING:
 178     state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
 179     break;
 180   case CMD_DEVICE_INFO:
 181     state = resp.arg[0];
 182     break;
 183   default:
 184     fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
 185     exit(-1);
 186     break;
 187   }
 188
 189   return state;
 190 }
 191
 192 unsigned int EnterFlashState(void)
 193 {
 194   unsigned int state = GetProxmarkState();
 195
 196   if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
 197     /* Already in flash state, we're done. */
 198     return state;
 199   }
 200
 201   if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
 202     fprintf(stderr,"Entering flash-mode...\n");
 203     UsbCommand c;
 204     bzero(&c, sizeof(c));
 205
 206     if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) {
 207       /* New style handover: Send CMD_START_FLASH, which will reset the board and
 208        * enter the bootrom on the next boot.
 209       */
 210       c.cmd = CMD_START_FLASH;
 211       SendCommand(&c);
 212       fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
 213       fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 214     } else {
 215       /* Old style handover: Ask the user to press the button, then reset the board */
 216       c.cmd = CMD_HARDWARE_RESET;
 217       SendCommand(&c);
 218       fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
 219       fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 220     }
 221
 222 #ifdef WIN32
 223     Sleep(1000);
 224     while (!UsbConnect()) { Sleep(1000); }
 225 #else
 226     CloseProxmark();
 227     sleep(1);
 228
 229     while (!OpenProxmark(0)) { sleep(1); }
 230 #endif
 231     fprintf(stderr,"Found.\n");
 232
 233     return GetProxmarkState();
 234   }
 235
 236   return 0;
 237 }
 238
 239 /* On first call, have *offset = -1, *length = 0; */
 240 int find_next_area(const char *str, int *offset, int *length)
 241 {
 242   if (*str == '\0') return 0;
 243   if ((*offset >= 0) && str[*offset + *length] == '\0') return 0;
 244   *offset += 1 + *length;
 245
 246   char *next_comma = strchr(str + *offset, ',');
 247   if (next_comma == NULL) {
 248     *length = strlen(str) - *offset;
 249   } else {
 250     *length = next_comma-(str+*offset);
 251   }
 252   return 1;
 253 }
 254
 255 void do_flash(char **argv)
 256 {
 257   unsigned int state = EnterFlashState();
 258
 259   if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
 260     fprintf(stderr, "Proxmark would not enter flash state, abort\n");
 261     exit(-1);
 262   }
 263
 264   int offset=-1, length=0;
 265   int current_area = 0;
 266   while (find_next_area(argv[1], &offset, &length)) {
 267     struct partition *p = NULL;
 268     for (int i = 0; i<sizeof(partitions)/sizeof(partitions[0]); ++i) {
 269       if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
 270         /* Check if the name matches the bootrom partition, and if so, require "bootrom" to
 271          * be written in full. The other names may be abbreviated.
 272         */
 273         if(!partitions[i].precious || (strlen(partitions[i].name) == length))
 274           p = &partitions[i];
 275         break;
 276       }
 277     }
 278
 279     if (p == NULL) {
 280       fprintf(stderr, "Warning: area name '");
 281       fwrite(argv[1]+offset, length, 1, stderr);
 282       fprintf(stderr, "' unknown, ignored\n");
 283     } else {
 284       fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
 285       PrepareFlash(p, argv[2+current_area], state);
 286     }
 287     current_area++;
 288   }
 289 }