]> git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c
4d091126273a773a044b8e898f56cd533b15ef9f
[proxmark3-svn] / client / flash.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // ELF file flasher
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include "sleep.h"
15 //#include "proxusb.h"
16 #include "flash.h"
17 #include "elf.h"
18 #include "proxendian.h"
19 #include "usb_cmd.h"
20
21 void SendCommand(UsbCommand* txcmd);
22 void ReceiveCommand(UsbCommand* rxcmd);
23 void CloseProxmark();
24 int OpenProxmark(size_t i);
25
26 // FIXME: what the fuckity fuck
27 unsigned int current_command = CMD_UNKNOWN;
28
29 #define FLASH_START 0x100000
30 #define FLASH_SIZE (256*1024)
31 #define FLASH_END (FLASH_START + FLASH_SIZE)
32 #define BOOTLOADER_SIZE 0x2000
33 #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE)
34
35 #define BLOCK_SIZE 0x200
36
37 static const uint8_t elf_ident[] = {
38 0x7f, 'E', 'L', 'F',
39 ELFCLASS32,
40 ELFDATA2LSB,
41 EV_CURRENT
42 };
43
44 // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent
45 // unaligned segments if needed
46 static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs)
47 {
48 Elf32_Phdr *phdr = phdrs;
49 flash_seg_t *seg;
50 uint32_t last_end = 0;
51
52 ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs);
53 if (!ctx->segments) {
54 fprintf(stderr, "Out of memory\n");
55 return -1;
56 }
57 ctx->num_segs = 0;
58 seg = ctx->segments;
59
60 fprintf(stderr, "Loading usable ELF segments:\n");
61 for (int i = 0; i < num_phdrs; i++) {
62 if (le32(phdr->p_type) != PT_LOAD) {
63 phdr++;
64 continue;
65 }
66 uint32_t vaddr = le32(phdr->p_vaddr);
67 uint32_t paddr = le32(phdr->p_paddr);
68 uint32_t filesz = le32(phdr->p_filesz);
69 uint32_t memsz = le32(phdr->p_memsz);
70 uint32_t offset = le32(phdr->p_offset);
71 uint32_t flags = le32(phdr->p_flags);
72 if (!filesz) {
73 phdr++;
74 continue;
75 }
76 fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n",
77 i, vaddr, paddr, filesz, memsz,
78 flags & PF_R ? 'R' : ' ',
79 flags & PF_W ? 'W' : ' ',
80 flags & PF_X ? 'X' : ' ',
81 offset);
82 if (filesz != memsz) {
83 fprintf(stderr, "Error: PHDR file size does not equal memory size\n"
84 "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n");
85 return -1;
86 }
87 if (paddr < last_end) {
88 fprintf(stderr, "Error: PHDRs not sorted or overlap\n");
89 return -1;
90 }
91 if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) {
92 fprintf(stderr, "Error: PHDR is not contained in Flash\n");
93 return -1;
94 }
95 if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) {
96 fprintf(stderr, "Error: Flash VMA segment is writable\n");
97 return -1;
98 }
99
100 uint8_t *data;
101 // make extra space if we need to move the data forward
102 data = malloc(filesz + BLOCK_SIZE);
103 if (!data) {
104 fprintf(stderr, "Out of memory\n");
105 return -1;
106 }
107 if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) {
108 fprintf(stderr, "Error while reading PHDR payload\n");
109 free(data);
110 return -1;
111 }
112
113 uint32_t block_offset = paddr & (BLOCK_SIZE-1);
114 if (block_offset) {
115 if (ctx->num_segs) {
116 flash_seg_t *prev_seg = seg - 1;
117 uint32_t this_end = paddr + filesz;
118 uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1);
119 uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1);
120
121 if (this_firstblock == prev_lastblock) {
122 uint32_t new_length = this_end - prev_seg->start;
123 uint32_t this_offset = paddr - prev_seg->start;
124 uint32_t hole = this_offset - prev_seg->length;
125 uint8_t *new_data = malloc(new_length);
126 if (!new_data) {
127 fprintf(stderr, "Out of memory\n");
128 free(data);
129 return -1;
130 }
131 memset(new_data, 0xff, new_length);
132 memcpy(new_data, prev_seg->data, prev_seg->length);
133 memcpy(new_data + this_offset, data, filesz);
134 fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n",
135 prev_seg->length, new_length);
136 if (hole)
137 fprintf(stderr, "Note: 0x%x-byte hole created\n", hole);
138 free(data);
139 free(prev_seg->data);
140 prev_seg->data = new_data;
141 prev_seg->length = new_length;
142 last_end = this_end;
143 phdr++;
144 continue;
145 }
146 }
147 fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n");
148 memmove(data + block_offset, data, filesz);
149 memset(data, 0xFF, block_offset);
150 filesz += block_offset;
151 paddr -= block_offset;
152 }
153
154 seg->data = data;
155 seg->start = paddr;
156 seg->length = filesz;
157 seg++;
158 ctx->num_segs++;
159
160 last_end = paddr + filesz;
161 phdr++;
162 }
163 return 0;
164 }
165
166 // Sanity check segments and check for bootloader writes
167 static int check_segs(flash_file_t *ctx, int can_write_bl) {
168 for (int i = 0; i < ctx->num_segs; i++) {
169 flash_seg_t *seg = &ctx->segments[i];
170
171 if (seg->start & (BLOCK_SIZE-1)) {
172 fprintf(stderr, "Error: Segment is not aligned\n");
173 return -1;
174 }
175 if (seg->start < FLASH_START) {
176 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
177 return -1;
178 }
179 if (seg->start + seg->length > FLASH_END) {
180 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
181 return -1;
182 }
183 if (!can_write_bl && seg->start < BOOTLOADER_END) {
184 fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n");
185 return -1;
186 }
187 }
188 return 0;
189 }
190
191 // Load an ELF file and prepare it for flashing
192 int flash_load(flash_file_t *ctx, const char *name, int can_write_bl)
193 {
194 FILE *fd = NULL;
195 Elf32_Ehdr ehdr;
196 Elf32_Phdr *phdrs = NULL;
197 int num_phdrs;
198 int res;
199
200 fd = fopen(name, "rb");
201 if (!fd) {
202 fprintf(stderr, "Could not open file '%s': ", name);
203 perror(NULL);
204 goto fail;
205 }
206
207 fprintf(stderr, "Loading ELF file '%s'...\n", name);
208
209 if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) {
210 fprintf(stderr, "Error while reading ELF file header\n");
211 goto fail;
212 }
213 if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident))
214 || le32(ehdr.e_version) != 1)
215 {
216 fprintf(stderr, "Not an ELF file or wrong ELF type\n");
217 goto fail;
218 }
219 if (le16(ehdr.e_type) != ET_EXEC) {
220 fprintf(stderr, "ELF is not executable\n");
221 goto fail;
222 }
223 if (le16(ehdr.e_machine) != EM_ARM) {
224 fprintf(stderr, "Wrong ELF architecture\n");
225 goto fail;
226 }
227 if (!ehdr.e_phnum || !ehdr.e_phoff) {
228 fprintf(stderr, "ELF has no PHDRs\n");
229 goto fail;
230 }
231 if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) {
232 // could be a structure padding issue...
233 fprintf(stderr, "Either the ELF file or this code is made of fail\n");
234 goto fail;
235 }
236 num_phdrs = le16(ehdr.e_phnum);
237
238 phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr));
239 if (!phdrs) {
240 fprintf(stderr, "Out of memory\n");
241 goto fail;
242 }
243 if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) {
244 fprintf(stderr, "Error while reading ELF PHDRs\n");
245 goto fail;
246 }
247 if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) {
248 fprintf(stderr, "Error while reading ELF PHDRs\n");
249 goto fail;
250 }
251
252 res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs);
253 if (res < 0)
254 goto fail;
255 res = check_segs(ctx, can_write_bl);
256 if (res < 0)
257 goto fail;
258
259 free(phdrs);
260 fclose(fd);
261 ctx->filename = name;
262 return 0;
263
264 fail:
265 if (phdrs)
266 free(phdrs);
267 if (fd)
268 fclose(fd);
269 flash_free(ctx);
270 return -1;
271 }
272
273 // Get the state of the proxmark, backwards compatible
274 static int get_proxmark_state(uint32_t *state)
275 {
276 UsbCommand c;
277 c.cmd = CMD_DEVICE_INFO;
278 // SendCommand_(&c);
279 SendCommand(&c);
280 UsbCommand resp;
281 ReceiveCommand(&resp);
282
283 // Three outcomes:
284 // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
285 // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
286 // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
287
288 switch (resp.cmd) {
289 case CMD_ACK:
290 *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
291 break;
292 case CMD_DEBUG_PRINT_STRING:
293 *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
294 break;
295 case CMD_DEVICE_INFO:
296 *state = resp.arg[0];
297 break;
298 default:
299 fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04llx\n", resp.cmd);
300 return -1;
301 break;
302 }
303
304 return 0;
305 }
306
307 // Enter the bootloader to be able to start flashing
308 static int enter_bootloader(void)
309 {
310 uint32_t state;
311
312 if (get_proxmark_state(&state) < 0)
313 return -1;
314
315 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
316 /* Already in flash state, we're done. */
317 return 0;
318 }
319
320 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
321 fprintf(stderr,"Entering bootloader...\n");
322 UsbCommand c;
323 memset(&c, 0, sizeof (c));
324
325 if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT)
326 && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT))
327 {
328 // New style handover: Send CMD_START_FLASH, which will reset the board
329 // and enter the bootrom on the next boot.
330 c.cmd = CMD_START_FLASH;
331 SendCommand(&c);
332 fprintf(stderr,"(Press and release the button only to abort)\n");
333 } else {
334 // Old style handover: Ask the user to press the button, then reset the board
335 c.cmd = CMD_HARDWARE_RESET;
336 SendCommand(&c);
337 fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n");
338 }
339 fprintf(stderr,"Waiting for Proxmark to reappear on USB...");
340
341 CloseProxmark();
342 sleep(1);
343 while (!OpenProxmark(0)) {
344 sleep(1);
345 fprintf(stderr, ".");
346 }
347 fprintf(stderr," Found.\n");
348
349 return 0;
350 }
351
352 fprintf(stderr, "Error: Unknown Proxmark mode\n");
353 return -1;
354 }
355
356 static int wait_for_ack(void)
357 {
358 UsbCommand ack;
359 ReceiveCommand(&ack);
360 if (ack.cmd != CMD_ACK) {
361 printf("Error: Unexpected reply 0x%04llx (expected ACK)\n", ack.cmd);
362 return -1;
363 }
364 return 0;
365 }
366
367 // Go into flashing mode
368 int flash_start_flashing(int enable_bl_writes)
369 {
370 uint32_t state;
371
372 if (enter_bootloader() < 0)
373 return -1;
374
375 if (get_proxmark_state(&state) < 0)
376 return -1;
377
378 if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
379 // This command is stupid. Why the heck does it care which area we're
380 // flashing, as long as it's not the bootloader area? The mind boggles.
381 UsbCommand c = {CMD_START_FLASH};
382
383 if (enable_bl_writes) {
384 c.arg[0] = FLASH_START;
385 c.arg[1] = FLASH_END;
386 c.arg[2] = START_FLASH_MAGIC;
387 } else {
388 c.arg[0] = BOOTLOADER_END;
389 c.arg[1] = FLASH_END;
390 c.arg[2] = 0;
391 }
392 SendCommand(&c);
393 // SendCommand_(&c);
394 return wait_for_ack();
395 } else {
396 fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n");
397 fprintf(stderr, " It is recommended that you update your bootloader\n\n");
398 }
399
400 return 0;
401 }
402
403 static int write_block(uint32_t address, uint8_t *data, uint32_t length)
404 {
405 uint8_t block_buf[BLOCK_SIZE];
406
407 memset(block_buf, 0xFF, BLOCK_SIZE);
408 memcpy(block_buf, data, length);
409 UsbCommand c;
410 /*
411 c.cmd = {CMD_SETUP_WRITE};
412 for (int i = 0; i < 240; i += 48) {
413 memcpy(c.d.asBytes, block_buf + i, 48);
414 c.arg[0] = i / 4;
415 SendCommand(&c);
416 // SendCommand_(&c);
417 if (wait_for_ack() < 0) {
418 return -1;
419 }
420 }
421 */
422 c.cmd = CMD_FINISH_WRITE;
423 c.arg[0] = address;
424 // memcpy(c.d.asBytes, block_buf+240, 16);
425 // SendCommand_(&c);
426 memcpy(c.d.asBytes, block_buf, length);
427 SendCommand(&c);
428 return wait_for_ack();
429 }
430
431 // Write a file's segments to Flash
432 int flash_write(flash_file_t *ctx)
433 {
434 fprintf(stderr, "Writing segments for file: %s\n", ctx->filename);
435 for (int i = 0; i < ctx->num_segs; i++) {
436 flash_seg_t *seg = &ctx->segments[i];
437
438 uint32_t length = seg->length;
439 uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
440 uint32_t end = seg->start + length;
441
442 fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]",
443 seg->start, end - 1, length, blocks);
444
445 int block = 0;
446 uint8_t *data = seg->data;
447 uint32_t baddr = seg->start;
448
449 while (length) {
450 uint32_t block_size = length;
451 if (block_size > BLOCK_SIZE)
452 block_size = BLOCK_SIZE;
453
454 if (write_block(baddr, data, block_size) < 0) {
455 fprintf(stderr, " ERROR\n");
456 fprintf(stderr, "Error writing block %d of %d\n", block, blocks);
457 return -1;
458 }
459
460 data += block_size;
461 baddr += block_size;
462 length -= block_size;
463 block++;
464 fprintf(stderr, ".");
465 }
466 fprintf(stderr, " OK\n");
467 }
468 return 0;
469 }
470
471 // free a file context
472 void flash_free(flash_file_t *ctx)
473 {
474 if (!ctx)
475 return;
476 if (ctx->segments) {
477 for (int i = 0; i < ctx->num_segs; i++)
478 free(ctx->segments[i].data);
479 free(ctx->segments);
480 ctx->segments = NULL;
481 ctx->num_segs = 0;
482 }
483 }
484
485 // just reset the unit
486 int flash_stop_flashing(void) {
487 UsbCommand c = {CMD_HARDWARE_RESET};
488 // SendCommand_(&c);
489 SendCommand(&c);
490 return 0;
491 }
Impressum, Datenschutz