a553f267 |
1 | //----------------------------------------------------------------------------- |
8fe1a992 |
2 | // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com> |
3 | // |
a553f267 |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of |
6 | // the license. |
7 | //----------------------------------------------------------------------------- |
8fe1a992 |
8 | // ELF file flasher |
a553f267 |
9 | //----------------------------------------------------------------------------- |
10 | |
6e4d4ee6 |
11 | #include <stdio.h> |
6e4d4ee6 |
12 | #include <string.h> |
83a9b236 |
13 | #include <stdlib.h> |
43534cba |
14 | #include <inttypes.h> |
acf0582d |
15 | #include <unistd.h> |
125a98a1 |
16 | #include "proxmark3.h" |
acf0582d |
17 | #include "util.h" |
ec9c7112 |
18 | #include "util_posix.h" |
6e4d4ee6 |
19 | #include "flash.h" |
2cab856f |
20 | #include "elf.h" |
8fe1a992 |
21 | #include "proxendian.h" |
28fdb04f |
22 | #include "usb_cmd.h" |
3851172d |
23 | |
24 | void SendCommand(UsbCommand* txcmd); |
25 | void ReceiveCommand(UsbCommand* rxcmd); |
26 | void CloseProxmark(); |
27 | int OpenProxmark(size_t i); |
6e4d4ee6 |
28 | |
0ae6234a |
29 | // FIXME: what the fuckity fuck |
8fe1a992 |
30 | unsigned int current_command = CMD_UNKNOWN; |
31 | |
32 | #define FLASH_START 0x100000 |
33 | #define FLASH_SIZE (256*1024) |
34 | #define FLASH_END (FLASH_START + FLASH_SIZE) |
35 | #define BOOTLOADER_SIZE 0x2000 |
36 | #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE) |
37 | |
28fdb04f |
38 | #define BLOCK_SIZE 0x200 |
8fe1a992 |
39 | |
40 | static const uint8_t elf_ident[] = { |
41 | 0x7f, 'E', 'L', 'F', |
42 | ELFCLASS32, |
43 | ELFDATA2LSB, |
44 | EV_CURRENT |
45 | }; |
46 | |
47 | // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent |
48 | // unaligned segments if needed |
49 | static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs) |
7fe9b0b7 |
50 | { |
8fe1a992 |
51 | Elf32_Phdr *phdr = phdrs; |
52 | flash_seg_t *seg; |
53 | uint32_t last_end = 0; |
54 | |
55 | ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs); |
56 | if (!ctx->segments) { |
57 | fprintf(stderr, "Out of memory\n"); |
58 | return -1; |
59 | } |
60 | ctx->num_segs = 0; |
61 | seg = ctx->segments; |
62 | |
63 | fprintf(stderr, "Loading usable ELF segments:\n"); |
64 | for (int i = 0; i < num_phdrs; i++) { |
65 | if (le32(phdr->p_type) != PT_LOAD) { |
66 | phdr++; |
67 | continue; |
68 | } |
69 | uint32_t vaddr = le32(phdr->p_vaddr); |
70 | uint32_t paddr = le32(phdr->p_paddr); |
71 | uint32_t filesz = le32(phdr->p_filesz); |
72 | uint32_t memsz = le32(phdr->p_memsz); |
73 | uint32_t offset = le32(phdr->p_offset); |
74 | uint32_t flags = le32(phdr->p_flags); |
75 | if (!filesz) { |
76 | phdr++; |
77 | continue; |
78 | } |
79 | fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n", |
80 | i, vaddr, paddr, filesz, memsz, |
81 | flags & PF_R ? 'R' : ' ', |
82 | flags & PF_W ? 'W' : ' ', |
83 | flags & PF_X ? 'X' : ' ', |
84 | offset); |
85 | if (filesz != memsz) { |
86 | fprintf(stderr, "Error: PHDR file size does not equal memory size\n" |
87 | "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n"); |
88 | return -1; |
89 | } |
90 | if (paddr < last_end) { |
91 | fprintf(stderr, "Error: PHDRs not sorted or overlap\n"); |
92 | return -1; |
93 | } |
94 | if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) { |
95 | fprintf(stderr, "Error: PHDR is not contained in Flash\n"); |
96 | return -1; |
97 | } |
98 | if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) { |
99 | fprintf(stderr, "Error: Flash VMA segment is writable\n"); |
100 | return -1; |
101 | } |
102 | |
103 | uint8_t *data; |
104 | // make extra space if we need to move the data forward |
105 | data = malloc(filesz + BLOCK_SIZE); |
106 | if (!data) { |
107 | fprintf(stderr, "Out of memory\n"); |
108 | return -1; |
109 | } |
110 | if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) { |
111 | fprintf(stderr, "Error while reading PHDR payload\n"); |
112 | free(data); |
113 | return -1; |
114 | } |
115 | |
116 | uint32_t block_offset = paddr & (BLOCK_SIZE-1); |
117 | if (block_offset) { |
118 | if (ctx->num_segs) { |
119 | flash_seg_t *prev_seg = seg - 1; |
120 | uint32_t this_end = paddr + filesz; |
121 | uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1); |
122 | uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1); |
123 | |
124 | if (this_firstblock == prev_lastblock) { |
125 | uint32_t new_length = this_end - prev_seg->start; |
126 | uint32_t this_offset = paddr - prev_seg->start; |
127 | uint32_t hole = this_offset - prev_seg->length; |
128 | uint8_t *new_data = malloc(new_length); |
129 | if (!new_data) { |
130 | fprintf(stderr, "Out of memory\n"); |
131 | free(data); |
132 | return -1; |
133 | } |
134 | memset(new_data, 0xff, new_length); |
135 | memcpy(new_data, prev_seg->data, prev_seg->length); |
136 | memcpy(new_data + this_offset, data, filesz); |
137 | fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n", |
138 | prev_seg->length, new_length); |
139 | if (hole) |
140 | fprintf(stderr, "Note: 0x%x-byte hole created\n", hole); |
141 | free(data); |
142 | free(prev_seg->data); |
143 | prev_seg->data = new_data; |
144 | prev_seg->length = new_length; |
145 | last_end = this_end; |
146 | phdr++; |
147 | continue; |
148 | } |
149 | } |
150 | fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n"); |
151 | memmove(data + block_offset, data, filesz); |
152 | memset(data, 0xFF, block_offset); |
153 | filesz += block_offset; |
154 | paddr -= block_offset; |
155 | } |
156 | |
157 | seg->data = data; |
158 | seg->start = paddr; |
159 | seg->length = filesz; |
160 | seg++; |
161 | ctx->num_segs++; |
162 | |
163 | last_end = paddr + filesz; |
164 | phdr++; |
165 | } |
166 | return 0; |
6e4d4ee6 |
167 | } |
168 | |
8fe1a992 |
169 | // Sanity check segments and check for bootloader writes |
170 | static int check_segs(flash_file_t *ctx, int can_write_bl) { |
171 | for (int i = 0; i < ctx->num_segs; i++) { |
172 | flash_seg_t *seg = &ctx->segments[i]; |
173 | |
174 | if (seg->start & (BLOCK_SIZE-1)) { |
175 | fprintf(stderr, "Error: Segment is not aligned\n"); |
176 | return -1; |
177 | } |
178 | if (seg->start < FLASH_START) { |
179 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); |
180 | return -1; |
181 | } |
182 | if (seg->start + seg->length > FLASH_END) { |
183 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); |
184 | return -1; |
185 | } |
186 | if (!can_write_bl && seg->start < BOOTLOADER_END) { |
187 | fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n"); |
188 | return -1; |
189 | } |
190 | } |
191 | return 0; |
192 | } |
193 | |
194 | // Load an ELF file and prepare it for flashing |
195 | int flash_load(flash_file_t *ctx, const char *name, int can_write_bl) |
196 | { |
197 | FILE *fd = NULL; |
198 | Elf32_Ehdr ehdr; |
199 | Elf32_Phdr *phdrs = NULL; |
200 | int num_phdrs; |
201 | int res; |
202 | |
203 | fd = fopen(name, "rb"); |
204 | if (!fd) { |
205 | fprintf(stderr, "Could not open file '%s': ", name); |
206 | perror(NULL); |
207 | goto fail; |
208 | } |
209 | |
210 | fprintf(stderr, "Loading ELF file '%s'...\n", name); |
211 | |
212 | if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) { |
213 | fprintf(stderr, "Error while reading ELF file header\n"); |
214 | goto fail; |
215 | } |
216 | if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident)) |
217 | || le32(ehdr.e_version) != 1) |
218 | { |
219 | fprintf(stderr, "Not an ELF file or wrong ELF type\n"); |
220 | goto fail; |
221 | } |
222 | if (le16(ehdr.e_type) != ET_EXEC) { |
223 | fprintf(stderr, "ELF is not executable\n"); |
224 | goto fail; |
225 | } |
226 | if (le16(ehdr.e_machine) != EM_ARM) { |
227 | fprintf(stderr, "Wrong ELF architecture\n"); |
228 | goto fail; |
229 | } |
230 | if (!ehdr.e_phnum || !ehdr.e_phoff) { |
231 | fprintf(stderr, "ELF has no PHDRs\n"); |
232 | goto fail; |
233 | } |
234 | if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) { |
235 | // could be a structure padding issue... |
236 | fprintf(stderr, "Either the ELF file or this code is made of fail\n"); |
237 | goto fail; |
238 | } |
239 | num_phdrs = le16(ehdr.e_phnum); |
240 | |
241 | phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr)); |
242 | if (!phdrs) { |
243 | fprintf(stderr, "Out of memory\n"); |
244 | goto fail; |
245 | } |
246 | if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) { |
247 | fprintf(stderr, "Error while reading ELF PHDRs\n"); |
248 | goto fail; |
249 | } |
250 | if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) { |
251 | fprintf(stderr, "Error while reading ELF PHDRs\n"); |
252 | goto fail; |
253 | } |
254 | |
255 | res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs); |
256 | if (res < 0) |
257 | goto fail; |
258 | res = check_segs(ctx, can_write_bl); |
259 | if (res < 0) |
260 | goto fail; |
261 | |
66d6ba70 |
262 | free(phdrs); |
8fe1a992 |
263 | fclose(fd); |
264 | ctx->filename = name; |
265 | return 0; |
266 | |
267 | fail: |
268 | if (phdrs) |
269 | free(phdrs); |
270 | if (fd) |
271 | fclose(fd); |
272 | flash_free(ctx); |
273 | return -1; |
274 | } |
6e4d4ee6 |
275 | |
8fe1a992 |
276 | // Get the state of the proxmark, backwards compatible |
277 | static int get_proxmark_state(uint32_t *state) |
6e4d4ee6 |
278 | { |
28fdb04f |
279 | UsbCommand c; |
8fe1a992 |
280 | c.cmd = CMD_DEVICE_INFO; |
3851172d |
281 | SendCommand(&c); |
28fdb04f |
282 | UsbCommand resp; |
3851172d |
283 | ReceiveCommand(&resp); |
8fe1a992 |
284 | |
285 | // Three outcomes: |
286 | // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK |
287 | // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command" |
288 | // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags |
289 | |
290 | switch (resp.cmd) { |
291 | case CMD_ACK: |
292 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM; |
293 | break; |
294 | case CMD_DEBUG_PRINT_STRING: |
295 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS; |
296 | break; |
297 | case CMD_DEVICE_INFO: |
298 | *state = resp.arg[0]; |
299 | break; |
300 | default: |
43534cba |
301 | fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04" PRIx64 "\n", resp.cmd); |
8fe1a992 |
302 | return -1; |
303 | break; |
304 | } |
305 | |
306 | return 0; |
6e4d4ee6 |
307 | } |
308 | |
8fe1a992 |
309 | // Enter the bootloader to be able to start flashing |
3851172d |
310 | static int enter_bootloader(char *serial_port_name) |
6e4d4ee6 |
311 | { |
8fe1a992 |
312 | uint32_t state; |
313 | |
314 | if (get_proxmark_state(&state) < 0) |
315 | return -1; |
316 | |
317 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) { |
318 | /* Already in flash state, we're done. */ |
319 | return 0; |
320 | } |
321 | |
322 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) { |
323 | fprintf(stderr,"Entering bootloader...\n"); |
28fdb04f |
324 | UsbCommand c; |
8fe1a992 |
325 | memset(&c, 0, sizeof (c)); |
326 | |
327 | if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) |
328 | && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) |
329 | { |
330 | // New style handover: Send CMD_START_FLASH, which will reset the board |
331 | // and enter the bootrom on the next boot. |
332 | c.cmd = CMD_START_FLASH; |
28fdb04f |
333 | SendCommand(&c); |
8fe1a992 |
334 | fprintf(stderr,"(Press and release the button only to abort)\n"); |
335 | } else { |
336 | // Old style handover: Ask the user to press the button, then reset the board |
337 | c.cmd = CMD_HARDWARE_RESET; |
28fdb04f |
338 | SendCommand(&c); |
8fe1a992 |
339 | fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n"); |
340 | } |
3851172d |
341 | msleep(100); |
342 | CloseProxmark(); |
d8193fa5 |
343 | |
e654346b |
344 | fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name); |
3851172d |
345 | do { |
8fe1a992 |
346 | sleep(1); |
347 | fprintf(stderr, "."); |
3851172d |
348 | } while (!OpenProxmark(0)); |
8fe1a992 |
349 | fprintf(stderr," Found.\n"); |
3851172d |
350 | |
8fe1a992 |
351 | return 0; |
352 | } |
353 | |
354 | fprintf(stderr, "Error: Unknown Proxmark mode\n"); |
355 | return -1; |
6e4d4ee6 |
356 | } |
357 | |
3851172d |
358 | static int wait_for_ack(void) |
6e4d4ee6 |
359 | { |
3851172d |
360 | UsbCommand ack; |
361 | ReceiveCommand(&ack); |
362 | if (ack.cmd != CMD_ACK) { |
363 | printf("Error: Unexpected reply 0x%04" PRIx64 " (expected ACK)\n", ack.cmd); |
8fe1a992 |
364 | return -1; |
365 | } |
366 | return 0; |
6e4d4ee6 |
367 | } |
368 | |
8fe1a992 |
369 | // Go into flashing mode |
3851172d |
370 | int flash_start_flashing(int enable_bl_writes,char *serial_port_name) |
6e4d4ee6 |
371 | { |
8fe1a992 |
372 | uint32_t state; |
373 | |
3851172d |
374 | if (enter_bootloader(serial_port_name) < 0) |
8fe1a992 |
375 | return -1; |
376 | |
377 | if (get_proxmark_state(&state) < 0) |
378 | return -1; |
379 | |
380 | if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) { |
381 | // This command is stupid. Why the heck does it care which area we're |
382 | // flashing, as long as it's not the bootloader area? The mind boggles. |
28fdb04f |
383 | UsbCommand c = {CMD_START_FLASH}; |
8fe1a992 |
384 | |
385 | if (enable_bl_writes) { |
386 | c.arg[0] = FLASH_START; |
387 | c.arg[1] = FLASH_END; |
388 | c.arg[2] = START_FLASH_MAGIC; |
389 | } else { |
390 | c.arg[0] = BOOTLOADER_END; |
391 | c.arg[1] = FLASH_END; |
392 | c.arg[2] = 0; |
393 | } |
28fdb04f |
394 | SendCommand(&c); |
8fe1a992 |
395 | return wait_for_ack(); |
396 | } else { |
397 | fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n"); |
398 | fprintf(stderr, " It is recommended that you update your bootloader\n\n"); |
399 | } |
400 | |
401 | return 0; |
6e4d4ee6 |
402 | } |
403 | |
8fe1a992 |
404 | static int write_block(uint32_t address, uint8_t *data, uint32_t length) |
6e4d4ee6 |
405 | { |
8fe1a992 |
406 | uint8_t block_buf[BLOCK_SIZE]; |
407 | |
408 | memset(block_buf, 0xFF, BLOCK_SIZE); |
409 | memcpy(block_buf, data, length); |
28fdb04f |
410 | UsbCommand c; |
8fe1a992 |
411 | c.cmd = CMD_FINISH_WRITE; |
412 | c.arg[0] = address; |
28fdb04f |
413 | memcpy(c.d.asBytes, block_buf, length); |
414 | SendCommand(&c); |
415 | return wait_for_ack(); |
6e4d4ee6 |
416 | } |
417 | |
8fe1a992 |
418 | // Write a file's segments to Flash |
419 | int flash_write(flash_file_t *ctx) |
6e4d4ee6 |
420 | { |
8fe1a992 |
421 | fprintf(stderr, "Writing segments for file: %s\n", ctx->filename); |
422 | for (int i = 0; i < ctx->num_segs; i++) { |
423 | flash_seg_t *seg = &ctx->segments[i]; |
424 | |
425 | uint32_t length = seg->length; |
426 | uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE; |
427 | uint32_t end = seg->start + length; |
428 | |
429 | fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]", |
430 | seg->start, end - 1, length, blocks); |
431 | |
432 | int block = 0; |
433 | uint8_t *data = seg->data; |
434 | uint32_t baddr = seg->start; |
435 | |
436 | while (length) { |
437 | uint32_t block_size = length; |
438 | if (block_size > BLOCK_SIZE) |
439 | block_size = BLOCK_SIZE; |
440 | |
441 | if (write_block(baddr, data, block_size) < 0) { |
442 | fprintf(stderr, " ERROR\n"); |
443 | fprintf(stderr, "Error writing block %d of %d\n", block, blocks); |
444 | return -1; |
445 | } |
446 | |
447 | data += block_size; |
448 | baddr += block_size; |
449 | length -= block_size; |
450 | block++; |
451 | fprintf(stderr, "."); |
452 | } |
453 | fprintf(stderr, " OK\n"); |
454 | } |
455 | return 0; |
6e4d4ee6 |
456 | } |
457 | |
8fe1a992 |
458 | // free a file context |
459 | void flash_free(flash_file_t *ctx) |
7fe9b0b7 |
460 | { |
8fe1a992 |
461 | if (!ctx) |
462 | return; |
463 | if (ctx->segments) { |
464 | for (int i = 0; i < ctx->num_segs; i++) |
465 | free(ctx->segments[i].data); |
466 | free(ctx->segments); |
467 | ctx->segments = NULL; |
468 | ctx->num_segs = 0; |
469 | } |
470 | } |
471 | |
472 | // just reset the unit |
3851172d |
473 | int flash_stop_flashing(void) { |
28fdb04f |
474 | UsbCommand c = {CMD_HARDWARE_RESET}; |
3851172d |
475 | SendCommand(&c); |
476 | msleep(100); |
477 | return 0; |
6e4d4ee6 |
478 | } |