]>
Commit | Line | Data |
---|---|---|
a553f267 | 1 | //----------------------------------------------------------------------------- |
8fe1a992 | 2 | // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com> |
3 | // | |
a553f267 | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8fe1a992 | 8 | // ELF file flasher |
a553f267 | 9 | //----------------------------------------------------------------------------- |
10 | ||
6e4d4ee6 | 11 | #include <stdio.h> |
6e4d4ee6 | 12 | #include <string.h> |
83a9b236 | 13 | #include <stdlib.h> |
125a98a1 | 14 | #include "proxmark3.h" |
4cd41f34 | 15 | #include "sleep.h" |
6e4d4ee6 | 16 | #include "flash.h" |
2cab856f | 17 | #include "elf.h" |
8fe1a992 | 18 | #include "proxendian.h" |
28fdb04f | 19 | #include "usb_cmd.h" |
20 | ||
21 | void SendCommand(UsbCommand* txcmd); | |
22 | void ReceiveCommand(UsbCommand* rxcmd); | |
23 | void CloseProxmark(); | |
24 | int OpenProxmark(size_t i); | |
6e4d4ee6 | 25 | |
0ae6234a | 26 | // FIXME: what the fuckity fuck |
8fe1a992 | 27 | unsigned int current_command = CMD_UNKNOWN; |
28 | ||
29 | #define FLASH_START 0x100000 | |
30 | #define FLASH_SIZE (256*1024) | |
31 | #define FLASH_END (FLASH_START + FLASH_SIZE) | |
32 | #define BOOTLOADER_SIZE 0x2000 | |
33 | #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE) | |
34 | ||
28fdb04f | 35 | #define BLOCK_SIZE 0x200 |
8fe1a992 | 36 | |
37 | static const uint8_t elf_ident[] = { | |
38 | 0x7f, 'E', 'L', 'F', | |
39 | ELFCLASS32, | |
40 | ELFDATA2LSB, | |
41 | EV_CURRENT | |
42 | }; | |
43 | ||
44 | // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent | |
45 | // unaligned segments if needed | |
46 | static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs) | |
7fe9b0b7 | 47 | { |
8fe1a992 | 48 | Elf32_Phdr *phdr = phdrs; |
49 | flash_seg_t *seg; | |
50 | uint32_t last_end = 0; | |
51 | ||
52 | ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs); | |
53 | if (!ctx->segments) { | |
54 | fprintf(stderr, "Out of memory\n"); | |
55 | return -1; | |
56 | } | |
57 | ctx->num_segs = 0; | |
58 | seg = ctx->segments; | |
59 | ||
60 | fprintf(stderr, "Loading usable ELF segments:\n"); | |
61 | for (int i = 0; i < num_phdrs; i++) { | |
62 | if (le32(phdr->p_type) != PT_LOAD) { | |
63 | phdr++; | |
64 | continue; | |
65 | } | |
66 | uint32_t vaddr = le32(phdr->p_vaddr); | |
67 | uint32_t paddr = le32(phdr->p_paddr); | |
68 | uint32_t filesz = le32(phdr->p_filesz); | |
69 | uint32_t memsz = le32(phdr->p_memsz); | |
70 | uint32_t offset = le32(phdr->p_offset); | |
71 | uint32_t flags = le32(phdr->p_flags); | |
72 | if (!filesz) { | |
73 | phdr++; | |
74 | continue; | |
75 | } | |
76 | fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n", | |
77 | i, vaddr, paddr, filesz, memsz, | |
78 | flags & PF_R ? 'R' : ' ', | |
79 | flags & PF_W ? 'W' : ' ', | |
80 | flags & PF_X ? 'X' : ' ', | |
81 | offset); | |
82 | if (filesz != memsz) { | |
83 | fprintf(stderr, "Error: PHDR file size does not equal memory size\n" | |
84 | "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n"); | |
85 | return -1; | |
86 | } | |
87 | if (paddr < last_end) { | |
88 | fprintf(stderr, "Error: PHDRs not sorted or overlap\n"); | |
89 | return -1; | |
90 | } | |
91 | if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) { | |
92 | fprintf(stderr, "Error: PHDR is not contained in Flash\n"); | |
93 | return -1; | |
94 | } | |
95 | if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) { | |
96 | fprintf(stderr, "Error: Flash VMA segment is writable\n"); | |
97 | return -1; | |
98 | } | |
99 | ||
100 | uint8_t *data; | |
101 | // make extra space if we need to move the data forward | |
102 | data = malloc(filesz + BLOCK_SIZE); | |
103 | if (!data) { | |
104 | fprintf(stderr, "Out of memory\n"); | |
105 | return -1; | |
106 | } | |
107 | if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) { | |
108 | fprintf(stderr, "Error while reading PHDR payload\n"); | |
109 | free(data); | |
110 | return -1; | |
111 | } | |
112 | ||
113 | uint32_t block_offset = paddr & (BLOCK_SIZE-1); | |
114 | if (block_offset) { | |
115 | if (ctx->num_segs) { | |
116 | flash_seg_t *prev_seg = seg - 1; | |
117 | uint32_t this_end = paddr + filesz; | |
118 | uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1); | |
119 | uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1); | |
120 | ||
121 | if (this_firstblock == prev_lastblock) { | |
122 | uint32_t new_length = this_end - prev_seg->start; | |
123 | uint32_t this_offset = paddr - prev_seg->start; | |
124 | uint32_t hole = this_offset - prev_seg->length; | |
125 | uint8_t *new_data = malloc(new_length); | |
126 | if (!new_data) { | |
127 | fprintf(stderr, "Out of memory\n"); | |
128 | free(data); | |
129 | return -1; | |
130 | } | |
131 | memset(new_data, 0xff, new_length); | |
132 | memcpy(new_data, prev_seg->data, prev_seg->length); | |
133 | memcpy(new_data + this_offset, data, filesz); | |
134 | fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n", | |
135 | prev_seg->length, new_length); | |
136 | if (hole) | |
137 | fprintf(stderr, "Note: 0x%x-byte hole created\n", hole); | |
138 | free(data); | |
139 | free(prev_seg->data); | |
140 | prev_seg->data = new_data; | |
141 | prev_seg->length = new_length; | |
142 | last_end = this_end; | |
143 | phdr++; | |
144 | continue; | |
145 | } | |
146 | } | |
147 | fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n"); | |
148 | memmove(data + block_offset, data, filesz); | |
149 | memset(data, 0xFF, block_offset); | |
150 | filesz += block_offset; | |
151 | paddr -= block_offset; | |
152 | } | |
153 | ||
154 | seg->data = data; | |
155 | seg->start = paddr; | |
156 | seg->length = filesz; | |
157 | seg++; | |
158 | ctx->num_segs++; | |
159 | ||
160 | last_end = paddr + filesz; | |
161 | phdr++; | |
162 | } | |
163 | return 0; | |
6e4d4ee6 | 164 | } |
165 | ||
8fe1a992 | 166 | // Sanity check segments and check for bootloader writes |
167 | static int check_segs(flash_file_t *ctx, int can_write_bl) { | |
168 | for (int i = 0; i < ctx->num_segs; i++) { | |
169 | flash_seg_t *seg = &ctx->segments[i]; | |
170 | ||
171 | if (seg->start & (BLOCK_SIZE-1)) { | |
172 | fprintf(stderr, "Error: Segment is not aligned\n"); | |
173 | return -1; | |
174 | } | |
175 | if (seg->start < FLASH_START) { | |
176 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); | |
177 | return -1; | |
178 | } | |
179 | if (seg->start + seg->length > FLASH_END) { | |
180 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); | |
181 | return -1; | |
182 | } | |
183 | if (!can_write_bl && seg->start < BOOTLOADER_END) { | |
184 | fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n"); | |
185 | return -1; | |
186 | } | |
187 | } | |
188 | return 0; | |
189 | } | |
190 | ||
191 | // Load an ELF file and prepare it for flashing | |
192 | int flash_load(flash_file_t *ctx, const char *name, int can_write_bl) | |
193 | { | |
194 | FILE *fd = NULL; | |
195 | Elf32_Ehdr ehdr; | |
196 | Elf32_Phdr *phdrs = NULL; | |
197 | int num_phdrs; | |
198 | int res; | |
199 | ||
200 | fd = fopen(name, "rb"); | |
201 | if (!fd) { | |
202 | fprintf(stderr, "Could not open file '%s': ", name); | |
203 | perror(NULL); | |
204 | goto fail; | |
205 | } | |
206 | ||
207 | fprintf(stderr, "Loading ELF file '%s'...\n", name); | |
208 | ||
209 | if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) { | |
210 | fprintf(stderr, "Error while reading ELF file header\n"); | |
211 | goto fail; | |
212 | } | |
213 | if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident)) | |
214 | || le32(ehdr.e_version) != 1) | |
215 | { | |
216 | fprintf(stderr, "Not an ELF file or wrong ELF type\n"); | |
217 | goto fail; | |
218 | } | |
219 | if (le16(ehdr.e_type) != ET_EXEC) { | |
220 | fprintf(stderr, "ELF is not executable\n"); | |
221 | goto fail; | |
222 | } | |
223 | if (le16(ehdr.e_machine) != EM_ARM) { | |
224 | fprintf(stderr, "Wrong ELF architecture\n"); | |
225 | goto fail; | |
226 | } | |
227 | if (!ehdr.e_phnum || !ehdr.e_phoff) { | |
228 | fprintf(stderr, "ELF has no PHDRs\n"); | |
229 | goto fail; | |
230 | } | |
231 | if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) { | |
232 | // could be a structure padding issue... | |
233 | fprintf(stderr, "Either the ELF file or this code is made of fail\n"); | |
234 | goto fail; | |
235 | } | |
236 | num_phdrs = le16(ehdr.e_phnum); | |
237 | ||
238 | phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr)); | |
239 | if (!phdrs) { | |
240 | fprintf(stderr, "Out of memory\n"); | |
241 | goto fail; | |
242 | } | |
243 | if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) { | |
244 | fprintf(stderr, "Error while reading ELF PHDRs\n"); | |
245 | goto fail; | |
246 | } | |
247 | if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) { | |
248 | fprintf(stderr, "Error while reading ELF PHDRs\n"); | |
249 | goto fail; | |
250 | } | |
251 | ||
252 | res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs); | |
253 | if (res < 0) | |
254 | goto fail; | |
255 | res = check_segs(ctx, can_write_bl); | |
256 | if (res < 0) | |
257 | goto fail; | |
258 | ||
66d6ba70 | 259 | free(phdrs); |
8fe1a992 | 260 | fclose(fd); |
261 | ctx->filename = name; | |
262 | return 0; | |
263 | ||
264 | fail: | |
265 | if (phdrs) | |
266 | free(phdrs); | |
267 | if (fd) | |
268 | fclose(fd); | |
269 | flash_free(ctx); | |
270 | return -1; | |
271 | } | |
6e4d4ee6 | 272 | |
8fe1a992 | 273 | // Get the state of the proxmark, backwards compatible |
274 | static int get_proxmark_state(uint32_t *state) | |
6e4d4ee6 | 275 | { |
28fdb04f | 276 | UsbCommand c; |
8fe1a992 | 277 | c.cmd = CMD_DEVICE_INFO; |
28fdb04f | 278 | SendCommand(&c); |
279 | UsbCommand resp; | |
8fe1a992 | 280 | ReceiveCommand(&resp); |
281 | ||
282 | // Three outcomes: | |
283 | // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK | |
284 | // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command" | |
285 | // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags | |
286 | ||
287 | switch (resp.cmd) { | |
288 | case CMD_ACK: | |
289 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM; | |
290 | break; | |
291 | case CMD_DEBUG_PRINT_STRING: | |
292 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS; | |
293 | break; | |
294 | case CMD_DEVICE_INFO: | |
295 | *state = resp.arg[0]; | |
296 | break; | |
297 | default: | |
125a98a1 | 298 | fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04"llx"\n", resp.cmd); |
8fe1a992 | 299 | return -1; |
300 | break; | |
301 | } | |
302 | ||
303 | return 0; | |
6e4d4ee6 | 304 | } |
305 | ||
8fe1a992 | 306 | // Enter the bootloader to be able to start flashing |
e12b82d3 | 307 | static int enter_bootloader(char *serial_port_name) |
6e4d4ee6 | 308 | { |
8fe1a992 | 309 | uint32_t state; |
310 | ||
311 | if (get_proxmark_state(&state) < 0) | |
312 | return -1; | |
313 | ||
314 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) { | |
315 | /* Already in flash state, we're done. */ | |
316 | return 0; | |
317 | } | |
318 | ||
319 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) { | |
320 | fprintf(stderr,"Entering bootloader...\n"); | |
28fdb04f | 321 | UsbCommand c; |
8fe1a992 | 322 | memset(&c, 0, sizeof (c)); |
323 | ||
324 | if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) | |
325 | && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) | |
326 | { | |
327 | // New style handover: Send CMD_START_FLASH, which will reset the board | |
328 | // and enter the bootrom on the next boot. | |
329 | c.cmd = CMD_START_FLASH; | |
28fdb04f | 330 | SendCommand(&c); |
8fe1a992 | 331 | fprintf(stderr,"(Press and release the button only to abort)\n"); |
332 | } else { | |
333 | // Old style handover: Ask the user to press the button, then reset the board | |
334 | c.cmd = CMD_HARDWARE_RESET; | |
28fdb04f | 335 | SendCommand(&c); |
8fe1a992 | 336 | fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n"); |
337 | } | |
d8193fa5 | 338 | msleep(100); |
8fe1a992 | 339 | CloseProxmark(); |
d8193fa5 | 340 | |
e654346b | 341 | fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name); |
d8193fa5 | 342 | do { |
8fe1a992 | 343 | sleep(1); |
344 | fprintf(stderr, "."); | |
d8193fa5 | 345 | } while (!OpenProxmark(0)); |
8fe1a992 | 346 | fprintf(stderr," Found.\n"); |
347 | ||
348 | return 0; | |
349 | } | |
350 | ||
351 | fprintf(stderr, "Error: Unknown Proxmark mode\n"); | |
352 | return -1; | |
6e4d4ee6 | 353 | } |
354 | ||
8fe1a992 | 355 | static int wait_for_ack(void) |
6e4d4ee6 | 356 | { |
28fdb04f | 357 | UsbCommand ack; |
8fe1a992 | 358 | ReceiveCommand(&ack); |
359 | if (ack.cmd != CMD_ACK) { | |
125a98a1 | 360 | printf("Error: Unexpected reply 0x%04"llx" (expected ACK)\n", ack.cmd); |
8fe1a992 | 361 | return -1; |
362 | } | |
363 | return 0; | |
6e4d4ee6 | 364 | } |
365 | ||
8fe1a992 | 366 | // Go into flashing mode |
e12b82d3 | 367 | int flash_start_flashing(int enable_bl_writes,char *serial_port_name) |
6e4d4ee6 | 368 | { |
8fe1a992 | 369 | uint32_t state; |
370 | ||
e12b82d3 | 371 | if (enter_bootloader(serial_port_name) < 0) |
8fe1a992 | 372 | return -1; |
373 | ||
374 | if (get_proxmark_state(&state) < 0) | |
375 | return -1; | |
376 | ||
377 | if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) { | |
378 | // This command is stupid. Why the heck does it care which area we're | |
379 | // flashing, as long as it's not the bootloader area? The mind boggles. | |
28fdb04f | 380 | UsbCommand c = {CMD_START_FLASH}; |
8fe1a992 | 381 | |
382 | if (enable_bl_writes) { | |
383 | c.arg[0] = FLASH_START; | |
384 | c.arg[1] = FLASH_END; | |
385 | c.arg[2] = START_FLASH_MAGIC; | |
386 | } else { | |
387 | c.arg[0] = BOOTLOADER_END; | |
388 | c.arg[1] = FLASH_END; | |
389 | c.arg[2] = 0; | |
390 | } | |
28fdb04f | 391 | SendCommand(&c); |
8fe1a992 | 392 | return wait_for_ack(); |
393 | } else { | |
394 | fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n"); | |
395 | fprintf(stderr, " It is recommended that you update your bootloader\n\n"); | |
396 | } | |
397 | ||
398 | return 0; | |
6e4d4ee6 | 399 | } |
400 | ||
8fe1a992 | 401 | static int write_block(uint32_t address, uint8_t *data, uint32_t length) |
6e4d4ee6 | 402 | { |
8fe1a992 | 403 | uint8_t block_buf[BLOCK_SIZE]; |
404 | ||
405 | memset(block_buf, 0xFF, BLOCK_SIZE); | |
406 | memcpy(block_buf, data, length); | |
28fdb04f | 407 | UsbCommand c; |
8fe1a992 | 408 | c.cmd = CMD_FINISH_WRITE; |
409 | c.arg[0] = address; | |
28fdb04f | 410 | memcpy(c.d.asBytes, block_buf, length); |
411 | SendCommand(&c); | |
412 | return wait_for_ack(); | |
6e4d4ee6 | 413 | } |
414 | ||
8fe1a992 | 415 | // Write a file's segments to Flash |
416 | int flash_write(flash_file_t *ctx) | |
6e4d4ee6 | 417 | { |
8fe1a992 | 418 | fprintf(stderr, "Writing segments for file: %s\n", ctx->filename); |
419 | for (int i = 0; i < ctx->num_segs; i++) { | |
420 | flash_seg_t *seg = &ctx->segments[i]; | |
421 | ||
422 | uint32_t length = seg->length; | |
423 | uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE; | |
424 | uint32_t end = seg->start + length; | |
425 | ||
426 | fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]", | |
427 | seg->start, end - 1, length, blocks); | |
428 | ||
429 | int block = 0; | |
430 | uint8_t *data = seg->data; | |
431 | uint32_t baddr = seg->start; | |
432 | ||
433 | while (length) { | |
434 | uint32_t block_size = length; | |
435 | if (block_size > BLOCK_SIZE) | |
436 | block_size = BLOCK_SIZE; | |
437 | ||
438 | if (write_block(baddr, data, block_size) < 0) { | |
439 | fprintf(stderr, " ERROR\n"); | |
440 | fprintf(stderr, "Error writing block %d of %d\n", block, blocks); | |
441 | return -1; | |
442 | } | |
443 | ||
444 | data += block_size; | |
445 | baddr += block_size; | |
446 | length -= block_size; | |
447 | block++; | |
448 | fprintf(stderr, "."); | |
449 | } | |
450 | fprintf(stderr, " OK\n"); | |
451 | } | |
452 | return 0; | |
6e4d4ee6 | 453 | } |
454 | ||
8fe1a992 | 455 | // free a file context |
456 | void flash_free(flash_file_t *ctx) | |
7fe9b0b7 | 457 | { |
8fe1a992 | 458 | if (!ctx) |
459 | return; | |
460 | if (ctx->segments) { | |
461 | for (int i = 0; i < ctx->num_segs; i++) | |
462 | free(ctx->segments[i].data); | |
463 | free(ctx->segments); | |
464 | ctx->segments = NULL; | |
465 | ctx->num_segs = 0; | |
466 | } | |
467 | } | |
468 | ||
469 | // just reset the unit | |
470 | int flash_stop_flashing(void) { | |
28fdb04f | 471 | UsbCommand c = {CMD_HARDWARE_RESET}; |
28fdb04f | 472 | SendCommand(&c); |
d8193fa5 | 473 | msleep(100); |
28fdb04f | 474 | return 0; |
6e4d4ee6 | 475 | } |