]> git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c
Reworked how 'hf 14a list' and 'hf iclass list' works, to use the same method. Now...
[proxmark3-svn] / client / flash.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // ELF file flasher
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include "proxmark3.h"
15 #include "sleep.h"
16 //#include "proxusb.h"
17 #include "flash.h"
18 #include "elf.h"
19 #include "proxendian.h"
20 #include "usb_cmd.h"
21
22 void SendCommand(UsbCommand* txcmd);
23 void ReceiveCommand(UsbCommand* rxcmd);
24 void CloseProxmark();
25 int OpenProxmark(size_t i);
26
27 // FIXME: what the fuckity fuck
28 unsigned int current_command = CMD_UNKNOWN;
29
30 #define FLASH_START 0x100000
31 #define FLASH_SIZE (256*1024)
32 #define FLASH_END (FLASH_START + FLASH_SIZE)
33 #define BOOTLOADER_SIZE 0x2000
34 #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE)
35
36 #define BLOCK_SIZE 0x200
37
38 static const uint8_t elf_ident[] = {
39 0x7f, 'E', 'L', 'F',
40 ELFCLASS32,
41 ELFDATA2LSB,
42 EV_CURRENT
43 };
44
45 // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent
46 // unaligned segments if needed
47 static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs)
48 {
49 Elf32_Phdr *phdr = phdrs;
50 flash_seg_t *seg;
51 uint32_t last_end = 0;
52
53 ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs);
54 if (!ctx->segments) {
55 fprintf(stderr, "Out of memory\n");
56 return -1;
57 }
58 ctx->num_segs = 0;
59 seg = ctx->segments;
60
61 fprintf(stderr, "Loading usable ELF segments:\n");
62 for (int i = 0; i < num_phdrs; i++) {
63 if (le32(phdr->p_type) != PT_LOAD) {
64 phdr++;
65 continue;
66 }
67 uint32_t vaddr = le32(phdr->p_vaddr);
68 uint32_t paddr = le32(phdr->p_paddr);
69 uint32_t filesz = le32(phdr->p_filesz);
70 uint32_t memsz = le32(phdr->p_memsz);
71 uint32_t offset = le32(phdr->p_offset);
72 uint32_t flags = le32(phdr->p_flags);
73 if (!filesz) {
74 phdr++;
75 continue;
76 }
77 fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n",
78 i, vaddr, paddr, filesz, memsz,
79 flags & PF_R ? 'R' : ' ',
80 flags & PF_W ? 'W' : ' ',
81 flags & PF_X ? 'X' : ' ',
82 offset);
83 if (filesz != memsz) {
84 fprintf(stderr, "Error: PHDR file size does not equal memory size\n"
85 "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n");
86 return -1;
87 }
88 if (paddr < last_end) {
89 fprintf(stderr, "Error: PHDRs not sorted or overlap\n");
90 return -1;
91 }
92 if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) {
93 fprintf(stderr, "Error: PHDR is not contained in Flash\n");
94 return -1;
95 }
96 if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) {
97 fprintf(stderr, "Error: Flash VMA segment is writable\n");
98 return -1;
99 }
100
101 uint8_t *data;
102 // make extra space if we need to move the data forward
103 data = malloc(filesz + BLOCK_SIZE);
104 if (!data) {
105 fprintf(stderr, "Out of memory\n");
106 return -1;
107 }
108 if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) {
109 fprintf(stderr, "Error while reading PHDR payload\n");
110 free(data);
111 return -1;
112 }
113
114 uint32_t block_offset = paddr & (BLOCK_SIZE-1);
115 if (block_offset) {
116 if (ctx->num_segs) {
117 flash_seg_t *prev_seg = seg - 1;
118 uint32_t this_end = paddr + filesz;
119 uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1);
120 uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1);
121
122 if (this_firstblock == prev_lastblock) {
123 uint32_t new_length = this_end - prev_seg->start;
124 uint32_t this_offset = paddr - prev_seg->start;
125 uint32_t hole = this_offset - prev_seg->length;
126 uint8_t *new_data = malloc(new_length);
127 if (!new_data) {
128 fprintf(stderr, "Out of memory\n");
129 free(data);
130 return -1;
131 }
132 memset(new_data, 0xff, new_length);
133 memcpy(new_data, prev_seg->data, prev_seg->length);
134 memcpy(new_data + this_offset, data, filesz);
135 fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n",
136 prev_seg->length, new_length);
137 if (hole)
138 fprintf(stderr, "Note: 0x%x-byte hole created\n", hole);
139 free(data);
140 free(prev_seg->data);
141 prev_seg->data = new_data;
142 prev_seg->length = new_length;
143 last_end = this_end;
144 phdr++;
145 continue;
146 }
147 }
148 fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n");
149 memmove(data + block_offset, data, filesz);
150 memset(data, 0xFF, block_offset);
151 filesz += block_offset;
152 paddr -= block_offset;
153 }
154
155 seg->data = data;
156 seg->start = paddr;
157 seg->length = filesz;
158 seg++;
159 ctx->num_segs++;
160
161 last_end = paddr + filesz;
162 phdr++;
163 }
164 return 0;
165 }
166
167 // Sanity check segments and check for bootloader writes
168 static int check_segs(flash_file_t *ctx, int can_write_bl) {
169 for (int i = 0; i < ctx->num_segs; i++) {
170 flash_seg_t *seg = &ctx->segments[i];
171
172 if (seg->start & (BLOCK_SIZE-1)) {
173 fprintf(stderr, "Error: Segment is not aligned\n");
174 return -1;
175 }
176 if (seg->start < FLASH_START) {
177 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
178 return -1;
179 }
180 if (seg->start + seg->length > FLASH_END) {
181 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
182 return -1;
183 }
184 if (!can_write_bl && seg->start < BOOTLOADER_END) {
185 fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n");
186 return -1;
187 }
188 }
189 return 0;
190 }
191
192 // Load an ELF file and prepare it for flashing
193 int flash_load(flash_file_t *ctx, const char *name, int can_write_bl)
194 {
195 FILE *fd = NULL;
196 Elf32_Ehdr ehdr;
197 Elf32_Phdr *phdrs = NULL;
198 int num_phdrs;
199 int res;
200
201 fd = fopen(name, "rb");
202 if (!fd) {
203 fprintf(stderr, "Could not open file '%s': ", name);
204 perror(NULL);
205 goto fail;
206 }
207
208 fprintf(stderr, "Loading ELF file '%s'...\n", name);
209
210 if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) {
211 fprintf(stderr, "Error while reading ELF file header\n");
212 goto fail;
213 }
214 if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident))
215 || le32(ehdr.e_version) != 1)
216 {
217 fprintf(stderr, "Not an ELF file or wrong ELF type\n");
218 goto fail;
219 }
220 if (le16(ehdr.e_type) != ET_EXEC) {
221 fprintf(stderr, "ELF is not executable\n");
222 goto fail;
223 }
224 if (le16(ehdr.e_machine) != EM_ARM) {
225 fprintf(stderr, "Wrong ELF architecture\n");
226 goto fail;
227 }
228 if (!ehdr.e_phnum || !ehdr.e_phoff) {
229 fprintf(stderr, "ELF has no PHDRs\n");
230 goto fail;
231 }
232 if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) {
233 // could be a structure padding issue...
234 fprintf(stderr, "Either the ELF file or this code is made of fail\n");
235 goto fail;
236 }
237 num_phdrs = le16(ehdr.e_phnum);
238
239 phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr));
240 if (!phdrs) {
241 fprintf(stderr, "Out of memory\n");
242 goto fail;
243 }
244 if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) {
245 fprintf(stderr, "Error while reading ELF PHDRs\n");
246 goto fail;
247 }
248 if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) {
249 fprintf(stderr, "Error while reading ELF PHDRs\n");
250 goto fail;
251 }
252
253 res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs);
254 if (res < 0)
255 goto fail;
256 res = check_segs(ctx, can_write_bl);
257 if (res < 0)
258 goto fail;
259
260 free(phdrs);
261 fclose(fd);
262 ctx->filename = name;
263 return 0;
264
265 fail:
266 if (phdrs)
267 free(phdrs);
268 if (fd)
269 fclose(fd);
270 flash_free(ctx);
271 return -1;
272 }
273
274 // Get the state of the proxmark, backwards compatible
275 static int get_proxmark_state(uint32_t *state)
276 {
277 UsbCommand c;
278 c.cmd = CMD_DEVICE_INFO;
279 // SendCommand_(&c);
280 SendCommand(&c);
281 UsbCommand resp;
282 ReceiveCommand(&resp);
283
284 // Three outcomes:
285 // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
286 // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
287 // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
288
289 switch (resp.cmd) {
290 case CMD_ACK:
291 *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
292 break;
293 case CMD_DEBUG_PRINT_STRING:
294 *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
295 break;
296 case CMD_DEVICE_INFO:
297 *state = resp.arg[0];
298 break;
299 default:
300 fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04"llx"\n", resp.cmd);
301 return -1;
302 break;
303 }
304
305 return 0;
306 }
307
308 // Enter the bootloader to be able to start flashing
309 static int enter_bootloader(char *serial_port_name)
310 {
311 uint32_t state;
312
313 if (get_proxmark_state(&state) < 0)
314 return -1;
315
316 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
317 /* Already in flash state, we're done. */
318 return 0;
319 }
320
321 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
322 fprintf(stderr,"Entering bootloader...\n");
323 UsbCommand c;
324 memset(&c, 0, sizeof (c));
325
326 if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT)
327 && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT))
328 {
329 // New style handover: Send CMD_START_FLASH, which will reset the board
330 // and enter the bootrom on the next boot.
331 c.cmd = CMD_START_FLASH;
332 SendCommand(&c);
333 fprintf(stderr,"(Press and release the button only to abort)\n");
334 } else {
335 // Old style handover: Ask the user to press the button, then reset the board
336 c.cmd = CMD_HARDWARE_RESET;
337 SendCommand(&c);
338 fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n");
339 }
340 msleep(100);
341 CloseProxmark();
342
343 fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name);
344 do {
345 sleep(1);
346 fprintf(stderr, ".");
347 } while (!OpenProxmark(0));
348 fprintf(stderr," Found.\n");
349
350 return 0;
351 }
352
353 fprintf(stderr, "Error: Unknown Proxmark mode\n");
354 return -1;
355 }
356
357 static int wait_for_ack(void)
358 {
359 UsbCommand ack;
360 ReceiveCommand(&ack);
361 if (ack.cmd != CMD_ACK) {
362 printf("Error: Unexpected reply 0x%04"llx" (expected ACK)\n", ack.cmd);
363 return -1;
364 }
365 return 0;
366 }
367
368 // Go into flashing mode
369 int flash_start_flashing(int enable_bl_writes,char *serial_port_name)
370 {
371 uint32_t state;
372
373 if (enter_bootloader(serial_port_name) < 0)
374 return -1;
375
376 if (get_proxmark_state(&state) < 0)
377 return -1;
378
379 if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
380 // This command is stupid. Why the heck does it care which area we're
381 // flashing, as long as it's not the bootloader area? The mind boggles.
382 UsbCommand c = {CMD_START_FLASH};
383
384 if (enable_bl_writes) {
385 c.arg[0] = FLASH_START;
386 c.arg[1] = FLASH_END;
387 c.arg[2] = START_FLASH_MAGIC;
388 } else {
389 c.arg[0] = BOOTLOADER_END;
390 c.arg[1] = FLASH_END;
391 c.arg[2] = 0;
392 }
393 SendCommand(&c);
394 // SendCommand_(&c);
395 return wait_for_ack();
396 } else {
397 fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n");
398 fprintf(stderr, " It is recommended that you update your bootloader\n\n");
399 }
400
401 return 0;
402 }
403
404 static int write_block(uint32_t address, uint8_t *data, uint32_t length)
405 {
406 uint8_t block_buf[BLOCK_SIZE];
407
408 memset(block_buf, 0xFF, BLOCK_SIZE);
409 memcpy(block_buf, data, length);
410 UsbCommand c;
411 /*
412 c.cmd = {CMD_SETUP_WRITE};
413 for (int i = 0; i < 240; i += 48) {
414 memcpy(c.d.asBytes, block_buf + i, 48);
415 c.arg[0] = i / 4;
416 SendCommand(&c);
417 // SendCommand_(&c);
418 if (wait_for_ack() < 0) {
419 return -1;
420 }
421 }
422 */
423 c.cmd = CMD_FINISH_WRITE;
424 c.arg[0] = address;
425 // memcpy(c.d.asBytes, block_buf+240, 16);
426 // SendCommand_(&c);
427 memcpy(c.d.asBytes, block_buf, length);
428 SendCommand(&c);
429 return wait_for_ack();
430 }
431
432 // Write a file's segments to Flash
433 int flash_write(flash_file_t *ctx)
434 {
435 fprintf(stderr, "Writing segments for file: %s\n", ctx->filename);
436 for (int i = 0; i < ctx->num_segs; i++) {
437 flash_seg_t *seg = &ctx->segments[i];
438
439 uint32_t length = seg->length;
440 uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
441 uint32_t end = seg->start + length;
442
443 fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]",
444 seg->start, end - 1, length, blocks);
445
446 int block = 0;
447 uint8_t *data = seg->data;
448 uint32_t baddr = seg->start;
449
450 while (length) {
451 uint32_t block_size = length;
452 if (block_size > BLOCK_SIZE)
453 block_size = BLOCK_SIZE;
454
455 if (write_block(baddr, data, block_size) < 0) {
456 fprintf(stderr, " ERROR\n");
457 fprintf(stderr, "Error writing block %d of %d\n", block, blocks);
458 return -1;
459 }
460
461 data += block_size;
462 baddr += block_size;
463 length -= block_size;
464 block++;
465 fprintf(stderr, ".");
466 }
467 fprintf(stderr, " OK\n");
468 }
469 return 0;
470 }
471
472 // free a file context
473 void flash_free(flash_file_t *ctx)
474 {
475 if (!ctx)
476 return;
477 if (ctx->segments) {
478 for (int i = 0; i < ctx->num_segs; i++)
479 free(ctx->segments[i].data);
480 free(ctx->segments);
481 ctx->segments = NULL;
482 ctx->num_segs = 0;
483 }
484 }
485
486 // just reset the unit
487 int flash_stop_flashing(void) {
488 UsbCommand c = {CMD_HARDWARE_RESET};
489 // SendCommand_(&c);
490 SendCommand(&c);
491 msleep(100);
492 return 0;
493 }
Impressum, Datenschutz