]>
Commit | Line | Data |
---|---|---|
a553f267 | 1 | //----------------------------------------------------------------------------- |
8fe1a992 | 2 | // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com> |
3 | // | |
a553f267 | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8fe1a992 | 8 | // ELF file flasher |
a553f267 | 9 | //----------------------------------------------------------------------------- |
10 | ||
6e4d4ee6 | 11 | #include <stdio.h> |
6e4d4ee6 | 12 | #include <string.h> |
83a9b236 | 13 | #include <stdlib.h> |
43534cba | 14 | #include <inttypes.h> |
acf0582d | 15 | #include <unistd.h> |
125a98a1 | 16 | #include "proxmark3.h" |
acf0582d | 17 | #include "util.h" |
ec9c7112 | 18 | #include "util_posix.h" |
6e4d4ee6 | 19 | #include "flash.h" |
2cab856f | 20 | #include "elf.h" |
8fe1a992 | 21 | #include "proxendian.h" |
28fdb04f | 22 | #include "usb_cmd.h" |
3851172d | 23 | |
24 | void SendCommand(UsbCommand* txcmd); | |
25 | void ReceiveCommand(UsbCommand* rxcmd); | |
26 | void CloseProxmark(); | |
27 | int OpenProxmark(size_t i); | |
6e4d4ee6 | 28 | |
0ae6234a | 29 | // FIXME: what the fuckity fuck |
8fe1a992 | 30 | unsigned int current_command = CMD_UNKNOWN; |
31 | ||
32 | #define FLASH_START 0x100000 | |
33 | #define FLASH_SIZE (256*1024) | |
34 | #define FLASH_END (FLASH_START + FLASH_SIZE) | |
35 | #define BOOTLOADER_SIZE 0x2000 | |
36 | #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE) | |
37 | ||
28fdb04f | 38 | #define BLOCK_SIZE 0x200 |
8fe1a992 | 39 | |
40 | static const uint8_t elf_ident[] = { | |
41 | 0x7f, 'E', 'L', 'F', | |
42 | ELFCLASS32, | |
43 | ELFDATA2LSB, | |
44 | EV_CURRENT | |
45 | }; | |
46 | ||
47 | // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent | |
48 | // unaligned segments if needed | |
49 | static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs) | |
7fe9b0b7 | 50 | { |
8fe1a992 | 51 | Elf32_Phdr *phdr = phdrs; |
52 | flash_seg_t *seg; | |
53 | uint32_t last_end = 0; | |
54 | ||
55 | ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs); | |
56 | if (!ctx->segments) { | |
57 | fprintf(stderr, "Out of memory\n"); | |
58 | return -1; | |
59 | } | |
60 | ctx->num_segs = 0; | |
61 | seg = ctx->segments; | |
62 | ||
63 | fprintf(stderr, "Loading usable ELF segments:\n"); | |
64 | for (int i = 0; i < num_phdrs; i++) { | |
65 | if (le32(phdr->p_type) != PT_LOAD) { | |
66 | phdr++; | |
67 | continue; | |
68 | } | |
69 | uint32_t vaddr = le32(phdr->p_vaddr); | |
70 | uint32_t paddr = le32(phdr->p_paddr); | |
71 | uint32_t filesz = le32(phdr->p_filesz); | |
72 | uint32_t memsz = le32(phdr->p_memsz); | |
73 | uint32_t offset = le32(phdr->p_offset); | |
74 | uint32_t flags = le32(phdr->p_flags); | |
75 | if (!filesz) { | |
76 | phdr++; | |
77 | continue; | |
78 | } | |
79 | fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n", | |
80 | i, vaddr, paddr, filesz, memsz, | |
81 | flags & PF_R ? 'R' : ' ', | |
82 | flags & PF_W ? 'W' : ' ', | |
83 | flags & PF_X ? 'X' : ' ', | |
84 | offset); | |
85 | if (filesz != memsz) { | |
86 | fprintf(stderr, "Error: PHDR file size does not equal memory size\n" | |
87 | "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n"); | |
88 | return -1; | |
89 | } | |
90 | if (paddr < last_end) { | |
91 | fprintf(stderr, "Error: PHDRs not sorted or overlap\n"); | |
92 | return -1; | |
93 | } | |
94 | if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) { | |
95 | fprintf(stderr, "Error: PHDR is not contained in Flash\n"); | |
96 | return -1; | |
97 | } | |
98 | if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) { | |
99 | fprintf(stderr, "Error: Flash VMA segment is writable\n"); | |
100 | return -1; | |
101 | } | |
102 | ||
103 | uint8_t *data; | |
104 | // make extra space if we need to move the data forward | |
105 | data = malloc(filesz + BLOCK_SIZE); | |
106 | if (!data) { | |
107 | fprintf(stderr, "Out of memory\n"); | |
108 | return -1; | |
109 | } | |
110 | if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) { | |
111 | fprintf(stderr, "Error while reading PHDR payload\n"); | |
112 | free(data); | |
113 | return -1; | |
114 | } | |
115 | ||
116 | uint32_t block_offset = paddr & (BLOCK_SIZE-1); | |
117 | if (block_offset) { | |
118 | if (ctx->num_segs) { | |
119 | flash_seg_t *prev_seg = seg - 1; | |
120 | uint32_t this_end = paddr + filesz; | |
121 | uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1); | |
122 | uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1); | |
123 | ||
124 | if (this_firstblock == prev_lastblock) { | |
125 | uint32_t new_length = this_end - prev_seg->start; | |
126 | uint32_t this_offset = paddr - prev_seg->start; | |
127 | uint32_t hole = this_offset - prev_seg->length; | |
128 | uint8_t *new_data = malloc(new_length); | |
129 | if (!new_data) { | |
130 | fprintf(stderr, "Out of memory\n"); | |
131 | free(data); | |
132 | return -1; | |
133 | } | |
134 | memset(new_data, 0xff, new_length); | |
135 | memcpy(new_data, prev_seg->data, prev_seg->length); | |
136 | memcpy(new_data + this_offset, data, filesz); | |
137 | fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n", | |
138 | prev_seg->length, new_length); | |
139 | if (hole) | |
140 | fprintf(stderr, "Note: 0x%x-byte hole created\n", hole); | |
141 | free(data); | |
142 | free(prev_seg->data); | |
143 | prev_seg->data = new_data; | |
144 | prev_seg->length = new_length; | |
145 | last_end = this_end; | |
146 | phdr++; | |
147 | continue; | |
148 | } | |
149 | } | |
150 | fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n"); | |
151 | memmove(data + block_offset, data, filesz); | |
152 | memset(data, 0xFF, block_offset); | |
153 | filesz += block_offset; | |
154 | paddr -= block_offset; | |
155 | } | |
156 | ||
157 | seg->data = data; | |
158 | seg->start = paddr; | |
159 | seg->length = filesz; | |
160 | seg++; | |
161 | ctx->num_segs++; | |
162 | ||
163 | last_end = paddr + filesz; | |
164 | phdr++; | |
165 | } | |
166 | return 0; | |
6e4d4ee6 | 167 | } |
168 | ||
8fe1a992 | 169 | // Sanity check segments and check for bootloader writes |
170 | static int check_segs(flash_file_t *ctx, int can_write_bl) { | |
171 | for (int i = 0; i < ctx->num_segs; i++) { | |
172 | flash_seg_t *seg = &ctx->segments[i]; | |
173 | ||
174 | if (seg->start & (BLOCK_SIZE-1)) { | |
175 | fprintf(stderr, "Error: Segment is not aligned\n"); | |
176 | return -1; | |
177 | } | |
178 | if (seg->start < FLASH_START) { | |
179 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); | |
180 | return -1; | |
181 | } | |
182 | if (seg->start + seg->length > FLASH_END) { | |
183 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); | |
184 | return -1; | |
185 | } | |
186 | if (!can_write_bl && seg->start < BOOTLOADER_END) { | |
187 | fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n"); | |
188 | return -1; | |
189 | } | |
190 | } | |
191 | return 0; | |
192 | } | |
193 | ||
194 | // Load an ELF file and prepare it for flashing | |
195 | int flash_load(flash_file_t *ctx, const char *name, int can_write_bl) | |
196 | { | |
197 | FILE *fd = NULL; | |
198 | Elf32_Ehdr ehdr; | |
199 | Elf32_Phdr *phdrs = NULL; | |
200 | int num_phdrs; | |
201 | int res; | |
202 | ||
203 | fd = fopen(name, "rb"); | |
204 | if (!fd) { | |
205 | fprintf(stderr, "Could not open file '%s': ", name); | |
206 | perror(NULL); | |
207 | goto fail; | |
208 | } | |
209 | ||
210 | fprintf(stderr, "Loading ELF file '%s'...\n", name); | |
211 | ||
212 | if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) { | |
213 | fprintf(stderr, "Error while reading ELF file header\n"); | |
214 | goto fail; | |
215 | } | |
216 | if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident)) | |
217 | || le32(ehdr.e_version) != 1) | |
218 | { | |
219 | fprintf(stderr, "Not an ELF file or wrong ELF type\n"); | |
220 | goto fail; | |
221 | } | |
222 | if (le16(ehdr.e_type) != ET_EXEC) { | |
223 | fprintf(stderr, "ELF is not executable\n"); | |
224 | goto fail; | |
225 | } | |
226 | if (le16(ehdr.e_machine) != EM_ARM) { | |
227 | fprintf(stderr, "Wrong ELF architecture\n"); | |
228 | goto fail; | |
229 | } | |
230 | if (!ehdr.e_phnum || !ehdr.e_phoff) { | |
231 | fprintf(stderr, "ELF has no PHDRs\n"); | |
232 | goto fail; | |
233 | } | |
234 | if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) { | |
235 | // could be a structure padding issue... | |
236 | fprintf(stderr, "Either the ELF file or this code is made of fail\n"); | |
237 | goto fail; | |
238 | } | |
239 | num_phdrs = le16(ehdr.e_phnum); | |
240 | ||
241 | phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr)); | |
242 | if (!phdrs) { | |
243 | fprintf(stderr, "Out of memory\n"); | |
244 | goto fail; | |
245 | } | |
246 | if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) { | |
247 | fprintf(stderr, "Error while reading ELF PHDRs\n"); | |
248 | goto fail; | |
249 | } | |
250 | if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) { | |
251 | fprintf(stderr, "Error while reading ELF PHDRs\n"); | |
252 | goto fail; | |
253 | } | |
254 | ||
255 | res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs); | |
256 | if (res < 0) | |
257 | goto fail; | |
258 | res = check_segs(ctx, can_write_bl); | |
259 | if (res < 0) | |
260 | goto fail; | |
261 | ||
66d6ba70 | 262 | free(phdrs); |
8fe1a992 | 263 | fclose(fd); |
264 | ctx->filename = name; | |
265 | return 0; | |
266 | ||
267 | fail: | |
268 | if (phdrs) | |
269 | free(phdrs); | |
270 | if (fd) | |
271 | fclose(fd); | |
272 | flash_free(ctx); | |
273 | return -1; | |
274 | } | |
6e4d4ee6 | 275 | |
8fe1a992 | 276 | // Get the state of the proxmark, backwards compatible |
277 | static int get_proxmark_state(uint32_t *state) | |
6e4d4ee6 | 278 | { |
28fdb04f | 279 | UsbCommand c; |
8fe1a992 | 280 | c.cmd = CMD_DEVICE_INFO; |
3851172d | 281 | SendCommand(&c); |
28fdb04f | 282 | UsbCommand resp; |
3851172d | 283 | ReceiveCommand(&resp); |
8fe1a992 | 284 | |
285 | // Three outcomes: | |
286 | // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK | |
287 | // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command" | |
288 | // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags | |
289 | ||
290 | switch (resp.cmd) { | |
291 | case CMD_ACK: | |
292 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM; | |
293 | break; | |
294 | case CMD_DEBUG_PRINT_STRING: | |
295 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS; | |
296 | break; | |
297 | case CMD_DEVICE_INFO: | |
298 | *state = resp.arg[0]; | |
299 | break; | |
300 | default: | |
43534cba | 301 | fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04" PRIx64 "\n", resp.cmd); |
8fe1a992 | 302 | return -1; |
303 | break; | |
304 | } | |
305 | ||
306 | return 0; | |
6e4d4ee6 | 307 | } |
308 | ||
8fe1a992 | 309 | // Enter the bootloader to be able to start flashing |
3851172d | 310 | static int enter_bootloader(char *serial_port_name) |
6e4d4ee6 | 311 | { |
8fe1a992 | 312 | uint32_t state; |
313 | ||
314 | if (get_proxmark_state(&state) < 0) | |
315 | return -1; | |
316 | ||
317 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) { | |
318 | /* Already in flash state, we're done. */ | |
319 | return 0; | |
320 | } | |
321 | ||
322 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) { | |
323 | fprintf(stderr,"Entering bootloader...\n"); | |
28fdb04f | 324 | UsbCommand c; |
8fe1a992 | 325 | memset(&c, 0, sizeof (c)); |
326 | ||
327 | if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) | |
328 | && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) | |
329 | { | |
330 | // New style handover: Send CMD_START_FLASH, which will reset the board | |
331 | // and enter the bootrom on the next boot. | |
332 | c.cmd = CMD_START_FLASH; | |
28fdb04f | 333 | SendCommand(&c); |
8fe1a992 | 334 | fprintf(stderr,"(Press and release the button only to abort)\n"); |
335 | } else { | |
336 | // Old style handover: Ask the user to press the button, then reset the board | |
337 | c.cmd = CMD_HARDWARE_RESET; | |
28fdb04f | 338 | SendCommand(&c); |
8fe1a992 | 339 | fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n"); |
340 | } | |
3851172d | 341 | msleep(100); |
342 | CloseProxmark(); | |
d8193fa5 | 343 | |
e654346b | 344 | fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name); |
3851172d | 345 | do { |
8fe1a992 | 346 | sleep(1); |
347 | fprintf(stderr, "."); | |
3851172d | 348 | } while (!OpenProxmark(0)); |
8fe1a992 | 349 | fprintf(stderr," Found.\n"); |
3851172d | 350 | |
8fe1a992 | 351 | return 0; |
352 | } | |
353 | ||
354 | fprintf(stderr, "Error: Unknown Proxmark mode\n"); | |
355 | return -1; | |
6e4d4ee6 | 356 | } |
357 | ||
3851172d | 358 | static int wait_for_ack(void) |
6e4d4ee6 | 359 | { |
3851172d | 360 | UsbCommand ack; |
361 | ReceiveCommand(&ack); | |
362 | if (ack.cmd != CMD_ACK) { | |
363 | printf("Error: Unexpected reply 0x%04" PRIx64 " (expected ACK)\n", ack.cmd); | |
8fe1a992 | 364 | return -1; |
365 | } | |
366 | return 0; | |
6e4d4ee6 | 367 | } |
368 | ||
8fe1a992 | 369 | // Go into flashing mode |
3851172d | 370 | int flash_start_flashing(int enable_bl_writes,char *serial_port_name) |
6e4d4ee6 | 371 | { |
8fe1a992 | 372 | uint32_t state; |
373 | ||
3851172d | 374 | if (enter_bootloader(serial_port_name) < 0) |
8fe1a992 | 375 | return -1; |
376 | ||
377 | if (get_proxmark_state(&state) < 0) | |
378 | return -1; | |
379 | ||
380 | if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) { | |
381 | // This command is stupid. Why the heck does it care which area we're | |
382 | // flashing, as long as it's not the bootloader area? The mind boggles. | |
28fdb04f | 383 | UsbCommand c = {CMD_START_FLASH}; |
8fe1a992 | 384 | |
385 | if (enable_bl_writes) { | |
386 | c.arg[0] = FLASH_START; | |
387 | c.arg[1] = FLASH_END; | |
388 | c.arg[2] = START_FLASH_MAGIC; | |
389 | } else { | |
390 | c.arg[0] = BOOTLOADER_END; | |
391 | c.arg[1] = FLASH_END; | |
392 | c.arg[2] = 0; | |
393 | } | |
28fdb04f | 394 | SendCommand(&c); |
8fe1a992 | 395 | return wait_for_ack(); |
396 | } else { | |
397 | fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n"); | |
398 | fprintf(stderr, " It is recommended that you update your bootloader\n\n"); | |
399 | } | |
400 | ||
401 | return 0; | |
6e4d4ee6 | 402 | } |
403 | ||
8fe1a992 | 404 | static int write_block(uint32_t address, uint8_t *data, uint32_t length) |
6e4d4ee6 | 405 | { |
8fe1a992 | 406 | uint8_t block_buf[BLOCK_SIZE]; |
407 | ||
408 | memset(block_buf, 0xFF, BLOCK_SIZE); | |
409 | memcpy(block_buf, data, length); | |
28fdb04f | 410 | UsbCommand c; |
8fe1a992 | 411 | c.cmd = CMD_FINISH_WRITE; |
412 | c.arg[0] = address; | |
28fdb04f | 413 | memcpy(c.d.asBytes, block_buf, length); |
414 | SendCommand(&c); | |
415 | return wait_for_ack(); | |
6e4d4ee6 | 416 | } |
417 | ||
8fe1a992 | 418 | // Write a file's segments to Flash |
419 | int flash_write(flash_file_t *ctx) | |
6e4d4ee6 | 420 | { |
8fe1a992 | 421 | fprintf(stderr, "Writing segments for file: %s\n", ctx->filename); |
422 | for (int i = 0; i < ctx->num_segs; i++) { | |
423 | flash_seg_t *seg = &ctx->segments[i]; | |
424 | ||
425 | uint32_t length = seg->length; | |
426 | uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE; | |
427 | uint32_t end = seg->start + length; | |
428 | ||
429 | fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]", | |
430 | seg->start, end - 1, length, blocks); | |
431 | ||
432 | int block = 0; | |
433 | uint8_t *data = seg->data; | |
434 | uint32_t baddr = seg->start; | |
435 | ||
436 | while (length) { | |
437 | uint32_t block_size = length; | |
438 | if (block_size > BLOCK_SIZE) | |
439 | block_size = BLOCK_SIZE; | |
440 | ||
441 | if (write_block(baddr, data, block_size) < 0) { | |
442 | fprintf(stderr, " ERROR\n"); | |
443 | fprintf(stderr, "Error writing block %d of %d\n", block, blocks); | |
444 | return -1; | |
445 | } | |
446 | ||
447 | data += block_size; | |
448 | baddr += block_size; | |
449 | length -= block_size; | |
450 | block++; | |
451 | fprintf(stderr, "."); | |
452 | } | |
453 | fprintf(stderr, " OK\n"); | |
454 | } | |
455 | return 0; | |
6e4d4ee6 | 456 | } |
457 | ||
8fe1a992 | 458 | // free a file context |
459 | void flash_free(flash_file_t *ctx) | |
7fe9b0b7 | 460 | { |
8fe1a992 | 461 | if (!ctx) |
462 | return; | |
463 | if (ctx->segments) { | |
464 | for (int i = 0; i < ctx->num_segs; i++) | |
465 | free(ctx->segments[i].data); | |
466 | free(ctx->segments); | |
467 | ctx->segments = NULL; | |
468 | ctx->num_segs = 0; | |
469 | } | |
470 | } | |
471 | ||
472 | // just reset the unit | |
3851172d | 473 | int flash_stop_flashing(void) { |
28fdb04f | 474 | UsbCommand c = {CMD_HARDWARE_RESET}; |
3851172d | 475 | SendCommand(&c); |
476 | msleep(100); | |
477 | return 0; | |
6e4d4ee6 | 478 | } |