git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c

   1 #ifdef WIN32
   2 #include <windows.h>
   3 #include <setupapi.h>
   4 #include <ctype.h>
   5 #define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
   6 BOOL UsbConnect(void);
   7 #else
   8 #include <usb.h>
   9 #endif
  10 #include <stdio.h>
  11 #include <unistd.h>
  12 #include <stdlib.h>
  13 #include <stdint.h>
  14 #include <stdbool.h>
  15 #include <strings.h>
  16 #include <string.h>
  17 #include <errno.h>
  18 #include <ctype.h>
  19
  20 #include "prox.h"
  21 #ifndef WIN32
  22 #include "proxmark3.h"
  23 #endif
  24 #include "flash.h"
  25 #include "elf.h"
  26
  27 static uint32_t ExpectedAddr;
  28 static uint8_t QueuedToSend[256];
  29 static bool AllWritten;
  30 #define PHYSICAL_FLASH_START 0x100000
  31 #define PHYSICAL_FLASH_END   0x200000
  32
  33 void WaitForAck(void) {
  34         UsbCommand ack;
  35         ReceiveCommand(&ack);
  36         if(ack.cmd != CMD_ACK) {
  37                 printf("bad ACK\n");
  38                 exit(-1);
  39         }
  40 }
  41
  42 struct partition partitions[] = {
  43                 {0x100000, 0x102000, 1, "bootrom"},
  44                 {0x102000, 0x110000, 0, "fpga"},
  45                 {0x110000, 0x140000, 0, "os"},
  46                 {0, 0, 0, NULL},
  47 };
  48
  49 void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
  50 {
  51         unsigned char temp_buf[256];
  52         if (block_start & 0xFF) {
  53                 printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
  54                 memset(temp_buf, 0xFF, block_start & 0xFF);
  55                 memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
  56                 block_start &= ~0xFF;
  57         } else {
  58                 memcpy(temp_buf, buf, len);
  59         }
  60
  61         UsbCommand c = {CMD_SETUP_WRITE};
  62
  63         int i;
  64         for(i = 0; i < 240; i += 48) {
  65                 memcpy(c.d.asBytes, temp_buf+i, 48);
  66                 c.arg[0] = (i/4);
  67                 SendCommand(&c);
  68                 WaitForAck();
  69         }
  70
  71         c.cmd = CMD_FINISH_WRITE;
  72         c.arg[0] = block_start;
  73
  74 //      printf("writing block %08x\r", c.arg[0]);
  75         memcpy(c.d.asBytes, temp_buf+240, 16);
  76         SendCommand(&c);
  77         WaitForAck();
  78
  79         AllWritten = true;
  80 }
  81
  82 void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
  83 {
  84         FILE *f = fopen(file, "rb");
  85         if(!f) {
  86                 printf("couldn't open file\n");
  87                 exit(-1);
  88         }
  89
  90         char buf[4];
  91         fread(buf, 1, 4, f);
  92         if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
  93                 int i;
  94                 fseek(f, 0, SEEK_SET);
  95                 Elf32_Ehdr header;
  96                 fread(&header, 1, sizeof(header), f);
  97                 int count = header.e_phnum;
  98                 printf("count=%d phoff=%x\n", count, header.e_phoff);
  99                 Elf32_Phdr phdr;
 100
 101                 for (i=0; i<header.e_phnum; i++) {
 102                         fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
 103                         fread(&phdr, 1, sizeof(phdr), f);
 104                         printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
 105                                 phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
 106                         if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
 107                                 && (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
 108                                 printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
 109                                 if (phdr.p_offset == 0) {
 110                                         printf("skipping forward 0x2000 because of strange linker thing\n");
 111                                         phdr.p_offset += 0x2000;
 112                                         phdr.p_paddr += 0x2000;
 113                                         phdr.p_filesz -= 0x2000;
 114                                         phdr.p_memsz -= 0x2000;
 115                                 }
 116
 117                                 fseek(f, phdr.p_offset, SEEK_SET);
 118                                 ExpectedAddr = phdr.p_paddr;
 119                                 while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
 120                                         unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
 121                                         if (bytes_to_read > 256)
 122                                                 bytes_to_read=256;
 123                                         else
 124                                                 memset(QueuedToSend, 0xFF, 256);
 125                                         fread(QueuedToSend, 1, bytes_to_read, f);
 126                                         printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
 127                                                         QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
 128                                                         QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
 129                                                         QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
 130                                                         QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
 131                                         WriteBlock(ExpectedAddr, 256, QueuedToSend);
 132                                         ExpectedAddr += bytes_to_read;
 133                                 }
 134             }
 135         }
 136
 137                 fclose(f);
 138                 printf("\ndone.\n");
 139                 return;
 140         } else printf("Bad file format\n");
 141 }
 142
 143 int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
 144 {
 145         if(state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
 146                 UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
 147
 148                 /* Only send magic when flashing bootrom */
 149                 if(p->precious)
 150                         c.arg[2] = START_FLASH_MAGIC;
 151                 else
 152                         c.arg[2] = 0;
 153
 154                 SendCommand(&c);
 155                 WaitForAck();
 156         } else {
 157                 fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
 158                 fprintf(stderr, "         It is recommended that you update your bootloader\n\n");
 159                 exit(0);
 160         }
 161
 162         LoadFlashFromFile(filename, p->start, p->end);
 163         return 1;
 164 }
 165
 166 unsigned int GetProxmarkState(void)
 167 {
 168         unsigned int state = 0;
 169
 170         UsbCommand c;
 171         c.cmd = CMD_DEVICE_INFO;
 172         SendCommand(&c);
 173
 174         UsbCommand resp;
 175         ReceiveCommand(&resp);
 176         /* Three cases:
 177          * 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
 178          * 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
 179          * 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
 180          */
 181
 182         switch(resp.cmd) {
 183         case CMD_ACK:
 184                 state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
 185                 break;
 186         case CMD_DEBUG_PRINT_STRING:
 187                 state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
 188                 break;
 189         case CMD_DEVICE_INFO:
 190                 state = resp.arg[0];
 191                 break;
 192         default:
 193                 fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
 194                 exit(-1);
 195                 break;
 196         }
 197
 198         return state;
 199 }
 200
 201 unsigned int EnterFlashState(void)
 202 {
 203         unsigned int state = GetProxmarkState();
 204
 205         if(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
 206                 /* Already in flash state, we're done. */
 207                 return state;
 208         }
 209
 210         if(state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
 211                 fprintf(stderr,"Entering flash-mode...\n");
 212                 UsbCommand c;
 213                 bzero(&c, sizeof(c));
 214
 215                 if( (state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT) ) {
 216                         /* New style handover: Send CMD_START_FLASH, which will reset the board and
 217                          * enter the bootrom on the next boot.
 218                          */
 219                         c.cmd = CMD_START_FLASH;
 220                         SendCommand(&c);
 221                         fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
 222                         fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 223                 } else {
 224                         /* Old style handover: Ask the user to press the button, then reset the board */
 225                         c.cmd = CMD_HARDWARE_RESET;
 226                         SendCommand(&c);
 227                         fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
 228                         fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 229                 }
 230
 231 #ifdef WIN32
 232                 Sleep(1000);
 233                 while(!UsbConnect()) { Sleep(1000); }
 234 #else
 235                 CloseProxmark();
 236                 sleep(1);
 237
 238                 while(!(devh=OpenProxmark(0))) { sleep(1); }
 239 #endif
 240                 fprintf(stderr,"Found.\n");
 241
 242                 return GetProxmarkState();
 243         }
 244
 245         return 0;
 246 }
 247
 248 /* On first call, have *offset = -1, *length = 0; */
 249 int find_next_area(const char *str, int *offset, int *length)
 250 {
 251         if(*str == '\0') return 0;
 252         if((*offset >= 0) && str[*offset + *length] == '\0') return 0;
 253         *offset += 1 + *length;
 254
 255         char *next_comma = strchr(str + *offset, ',');
 256         if(next_comma == NULL) {
 257                 *length = strlen(str) - *offset;
 258         } else {
 259                 *length = next_comma-(str+*offset);
 260         }
 261         return 1;
 262 }
 263
 264 void do_flash(char **argv) {
 265         unsigned int state = EnterFlashState();
 266
 267         if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
 268                 fprintf(stderr, "Proxmark would not enter flash state, abort\n");
 269                 exit(-1);
 270         }
 271
 272         int offset=-1, length=0;
 273         int current_area = 0;
 274         while(find_next_area(argv[1], &offset, &length)) {
 275                 int i;
 276                 struct partition *p = NULL;
 277                 for (i=0; i<sizeof(partitions)/sizeof(partitions[0]); i++) {
 278                         if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
 279                                 /* Check if the name matches the bootrom partition, and if so, require "bootrom" to
 280                                 * be written in full. The other names may be abbreviated.
 281                                 */
 282                                 if(!partitions[i].precious || (strlen(partitions[i].name) == length))
 283                                         p = &partitions[i];
 284                                 break;
 285                         }
 286                 }
 287
 288                 if(p == NULL) {
 289                         fprintf(stderr, "Warning: area name '");
 290                         fwrite(argv[1]+offset, length, 1, stderr);
 291                         fprintf(stderr, "' unknown, ignored\n");
 292                 } else {
 293                         fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
 294                         PrepareFlash(p, argv[2+current_area], state);
 295                 }
 296                 current_area++;
 297         }
 298 }