]> git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c
Merge pull request #13 from k02a/patch-1
[proxmark3-svn] / client / flash.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // ELF file flasher
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include "proxmark3.h"
15 #include "sleep.h"
16 #include "flash.h"
17 #include "elf.h"
18 #include "proxendian.h"
19 #include "usb_cmd.h"
20 #include "at91sam7s512.h"
21
22 void SendCommand(UsbCommand* txcmd);
23 void ReceiveCommand(UsbCommand* rxcmd);
24 void CloseProxmark();
25 int OpenProxmark(size_t i);
26
27 // FIXME: what the fuckity fuck
28 unsigned int current_command = CMD_UNKNOWN;
29
30 #define FLASH_START 0x100000
31 #define FLASH_SIZE (256*1024)
32 #define FLASH_END (FLASH_START + FLASH_SIZE)
33 #define BOOTLOADER_SIZE 0x2000
34 #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE)
35
36 #define BLOCK_SIZE 0x200
37
38 static const uint8_t elf_ident[] = {
39 0x7f, 'E', 'L', 'F',
40 ELFCLASS32,
41 ELFDATA2LSB,
42 EV_CURRENT
43 };
44
45 // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent
46 // unaligned segments if needed
47 static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs)
48 {
49 Elf32_Phdr *phdr = phdrs;
50 flash_seg_t *seg;
51 uint32_t last_end = 0;
52
53 ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs);
54 if (!ctx->segments) {
55 fprintf(stderr, "Out of memory\n");
56 return -1;
57 }
58 ctx->num_segs = 0;
59 seg = ctx->segments;
60
61 fprintf(stderr, "Loading usable ELF segments:\n");
62 for (int i = 0; i < num_phdrs; i++) {
63 if (le32(phdr->p_type) != PT_LOAD) {
64 phdr++;
65 continue;
66 }
67 uint32_t vaddr = le32(phdr->p_vaddr);
68 uint32_t paddr = le32(phdr->p_paddr);
69 uint32_t filesz = le32(phdr->p_filesz);
70 uint32_t memsz = le32(phdr->p_memsz);
71 uint32_t offset = le32(phdr->p_offset);
72 uint32_t flags = le32(phdr->p_flags);
73 if (!filesz) {
74 phdr++;
75 continue;
76 }
77 fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n",
78 i, vaddr, paddr, filesz, memsz,
79 flags & PF_R ? 'R' : ' ',
80 flags & PF_W ? 'W' : ' ',
81 flags & PF_X ? 'X' : ' ',
82 offset);
83 if (filesz != memsz) {
84 fprintf(stderr, "Error: PHDR file size does not equal memory size\n"
85 "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n");
86 return -1;
87 }
88 if (paddr < last_end) {
89 fprintf(stderr, "Error: PHDRs not sorted or overlap\n");
90 return -1;
91 }
92 if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) {
93 fprintf(stderr, "Error: PHDR is not contained in Flash\n");
94 return -1;
95 }
96 if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) {
97 fprintf(stderr, "Error: Flash VMA segment is writable\n");
98 return -1;
99 }
100
101 uint8_t *data;
102 // make extra space if we need to move the data forward
103 data = malloc(filesz + BLOCK_SIZE);
104 if (!data) {
105 fprintf(stderr, "Out of memory\n");
106 return -1;
107 }
108 if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) {
109 fprintf(stderr, "Error while reading PHDR payload\n");
110 free(data);
111 return -1;
112 }
113
114 uint32_t block_offset = paddr & (BLOCK_SIZE-1);
115 if (block_offset) {
116 if (ctx->num_segs) {
117 flash_seg_t *prev_seg = seg - 1;
118 uint32_t this_end = paddr + filesz;
119 uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1);
120 uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1);
121
122 if (this_firstblock == prev_lastblock) {
123 uint32_t new_length = this_end - prev_seg->start;
124 uint32_t this_offset = paddr - prev_seg->start;
125 uint32_t hole = this_offset - prev_seg->length;
126 uint8_t *new_data = malloc(new_length);
127 if (!new_data) {
128 fprintf(stderr, "Out of memory\n");
129 free(data);
130 return -1;
131 }
132 memset(new_data, 0xff, new_length);
133 memcpy(new_data, prev_seg->data, prev_seg->length);
134 memcpy(new_data + this_offset, data, filesz);
135 fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n",
136 prev_seg->length, new_length);
137 if (hole)
138 fprintf(stderr, "Note: 0x%x-byte hole created\n", hole);
139 free(data);
140 free(prev_seg->data);
141 prev_seg->data = new_data;
142 prev_seg->length = new_length;
143 last_end = this_end;
144 phdr++;
145 continue;
146 }
147 }
148 fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n");
149 memmove(data + block_offset, data, filesz);
150 memset(data, 0xFF, block_offset);
151 filesz += block_offset;
152 paddr -= block_offset;
153 }
154
155 seg->data = data;
156 seg->start = paddr;
157 seg->length = filesz;
158 seg++;
159 ctx->num_segs++;
160
161 last_end = paddr + filesz;
162 phdr++;
163 }
164 return 0;
165 }
166
167 // Sanity check segments and check for bootloader writes
168 static int check_segs(flash_file_t *ctx, int can_write_bl) {
169 for (int i = 0; i < ctx->num_segs; i++) {
170 flash_seg_t *seg = &ctx->segments[i];
171
172 if (seg->start & (BLOCK_SIZE-1)) {
173 fprintf(stderr, "Error: Segment is not aligned\n");
174 return -1;
175 }
176 if (seg->start < FLASH_START) {
177 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
178 return -1;
179 }
180 if (seg->start + seg->length > FLASH_END) {
181 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
182 return -1;
183 }
184 if (!can_write_bl && seg->start < BOOTLOADER_END) {
185 fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n");
186 return -1;
187 }
188 }
189 return 0;
190 }
191
192 // Load an ELF file and prepare it for flashing
193 int flash_load(flash_file_t *ctx, const char *name, int can_write_bl)
194 {
195 FILE *fd = NULL;
196 Elf32_Ehdr ehdr;
197 Elf32_Phdr *phdrs = NULL;
198 int num_phdrs;
199 int res;
200
201 fd = fopen(name, "rb");
202 if (!fd) {
203 fprintf(stderr, "Could not open file '%s': ", name);
204 perror(NULL);
205 goto fail;
206 }
207
208 fprintf(stderr, "Loading ELF file '%s'...\n", name);
209
210 if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) {
211 fprintf(stderr, "Error while reading ELF file header\n");
212 goto fail;
213 }
214 if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident))
215 || le32(ehdr.e_version) != 1)
216 {
217 fprintf(stderr, "Not an ELF file or wrong ELF type\n");
218 goto fail;
219 }
220 if (le16(ehdr.e_type) != ET_EXEC) {
221 fprintf(stderr, "ELF is not executable\n");
222 goto fail;
223 }
224 if (le16(ehdr.e_machine) != EM_ARM) {
225 fprintf(stderr, "Wrong ELF architecture\n");
226 goto fail;
227 }
228 if (!ehdr.e_phnum || !ehdr.e_phoff) {
229 fprintf(stderr, "ELF has no PHDRs\n");
230 goto fail;
231 }
232 if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) {
233 // could be a structure padding issue...
234 fprintf(stderr, "Either the ELF file or this code is made of fail\n");
235 goto fail;
236 }
237 num_phdrs = le16(ehdr.e_phnum);
238
239 phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr));
240 if (!phdrs) {
241 fprintf(stderr, "Out of memory\n");
242 goto fail;
243 }
244 if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) {
245 fprintf(stderr, "Error while reading ELF PHDRs\n");
246 goto fail;
247 }
248 if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) {
249 fprintf(stderr, "Error while reading ELF PHDRs\n");
250 goto fail;
251 }
252
253 res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs);
254 if (res < 0)
255 goto fail;
256 res = check_segs(ctx, can_write_bl);
257 if (res < 0)
258 goto fail;
259
260 free(phdrs);
261 fclose(fd);
262 ctx->filename = name;
263 return 0;
264
265 fail:
266 if (phdrs)
267 free(phdrs);
268 if (fd)
269 fclose(fd);
270 flash_free(ctx);
271 return -1;
272 }
273
274 // Get the state of the proxmark, backwards compatible
275 static int get_proxmark_state(uint32_t *state)
276 {
277 UsbCommand c;
278 c.cmd = CMD_DEVICE_INFO;
279 SendCommand(&c);
280 UsbCommand resp;
281 ReceiveCommand(&resp);
282
283 // Three outcomes:
284 // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
285 // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
286 // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
287
288 switch (resp.cmd) {
289 case CMD_ACK:
290 *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
291 break;
292 case CMD_DEBUG_PRINT_STRING:
293 *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
294 break;
295 case CMD_DEVICE_INFO:
296 *state = resp.arg[0];
297 break;
298 default:
299 fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04"llx"\n", resp.cmd);
300 return -1;
301 break;
302 }
303
304 return 0;
305 }
306
307 // Enter the bootloader to be able to start flashing
308 static int enter_bootloader(char *serial_port_name)
309 {
310 uint32_t state;
311
312 if (get_proxmark_state(&state) < 0)
313 return -1;
314
315 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
316 /* Already in flash state, we're done. */
317 return 0;
318 }
319
320 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
321 fprintf(stderr,"Entering bootloader...\n");
322 UsbCommand c;
323 memset(&c, 0, sizeof (c));
324
325 if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT)
326 && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT))
327 {
328 // New style handover: Send CMD_START_FLASH, which will reset the board
329 // and enter the bootrom on the next boot.
330 c.cmd = CMD_START_FLASH;
331 SendCommand(&c);
332 fprintf(stderr,"(Press and release the button only to abort)\n");
333 } else {
334 // Old style handover: Ask the user to press the button, then reset the board
335 c.cmd = CMD_HARDWARE_RESET;
336 SendCommand(&c);
337 fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n");
338 }
339 msleep(100);
340 CloseProxmark();
341
342 fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name);
343 do {
344 sleep(1);
345 fprintf(stderr, ".");
346 } while (!OpenProxmark(0));
347 fprintf(stderr," Found.\n");
348
349 return 0;
350 }
351
352 fprintf(stderr, "Error: Unknown Proxmark mode\n");
353 return -1;
354 }
355
356 static int wait_for_ack(UsbCommand *ack)
357 {
358 ReceiveCommand(ack);
359 if (ack->cmd != CMD_ACK) {
360 printf("Error: Unexpected reply 0x%04"llx" (expected ACK)\n", ack->cmd);
361 return -1;
362 }
363 return 0;
364 }
365
366 // Go into flashing mode
367 int flash_start_flashing(int enable_bl_writes,char *serial_port_name)
368 {
369 uint32_t state;
370
371 if (enter_bootloader(serial_port_name) < 0)
372 return -1;
373
374 if (get_proxmark_state(&state) < 0)
375 return -1;
376
377 if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
378 // This command is stupid. Why the heck does it care which area we're
379 // flashing, as long as it's not the bootloader area? The mind boggles.
380 UsbCommand c = {CMD_START_FLASH};
381
382 if (enable_bl_writes) {
383 c.arg[0] = FLASH_START;
384 c.arg[1] = FLASH_END;
385 c.arg[2] = START_FLASH_MAGIC;
386 } else {
387 c.arg[0] = BOOTLOADER_END;
388 c.arg[1] = FLASH_END;
389 c.arg[2] = 0;
390 }
391 SendCommand(&c);
392 return wait_for_ack(&c);
393 } else {
394 fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n");
395 fprintf(stderr, " It is recommended that you update your bootloader\n\n");
396 }
397
398 return 0;
399 }
400
401 static int write_block(uint32_t address, uint8_t *data, uint32_t length)
402 {
403 uint8_t block_buf[BLOCK_SIZE];
404
405 memset(block_buf, 0xFF, BLOCK_SIZE);
406 memcpy(block_buf, data, length);
407 UsbCommand c;
408 c.cmd = CMD_FINISH_WRITE;
409 c.arg[0] = address;
410 memcpy(c.d.asBytes, block_buf, length);
411 SendCommand(&c);
412 int ret = wait_for_ack(&c);
413 if (ret && c.arg[0]) {
414 uint32_t lock_bits = c.arg[0] >> 16;
415 bool lock_error = c.arg[0] & AT91C_MC_LOCKE;
416 bool prog_error = c.arg[0] & AT91C_MC_PROGE;
417 bool security_bit = c.arg[0] & AT91C_MC_SECURITY;
418 printf("%s", lock_error?" Lock Error\n":"");
419 printf("%s", prog_error?" Invalid Command or bad Keyword\n":"");
420 printf("%s", security_bit?" Security Bit is set!\n":"");
421 printf(" Lock Bits: 0x%04x\n", lock_bits);
422 }
423 return ret;
424 }
425
426 // Write a file's segments to Flash
427 int flash_write(flash_file_t *ctx)
428 {
429 fprintf(stderr, "Writing segments for file: %s\n", ctx->filename);
430 for (int i = 0; i < ctx->num_segs; i++) {
431 flash_seg_t *seg = &ctx->segments[i];
432
433 uint32_t length = seg->length;
434 uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
435 uint32_t end = seg->start + length;
436
437 fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]",
438 seg->start, end - 1, length, blocks);
439
440 int block = 0;
441 uint8_t *data = seg->data;
442 uint32_t baddr = seg->start;
443
444 while (length) {
445 uint32_t block_size = length;
446 if (block_size > BLOCK_SIZE)
447 block_size = BLOCK_SIZE;
448
449 if (write_block(baddr, data, block_size) < 0) {
450 fprintf(stderr, " ERROR\n");
451 fprintf(stderr, "Error writing block %d of %d\n", block, blocks);
452 return -1;
453 }
454
455 data += block_size;
456 baddr += block_size;
457 length -= block_size;
458 block++;
459 fprintf(stderr, ".");
460 }
461 fprintf(stderr, " OK\n");
462 }
463 return 0;
464 }
465
466 // free a file context
467 void flash_free(flash_file_t *ctx)
468 {
469 if (!ctx)
470 return;
471 if (ctx->segments) {
472 for (int i = 0; i < ctx->num_segs; i++)
473 free(ctx->segments[i].data);
474 free(ctx->segments);
475 ctx->segments = NULL;
476 ctx->num_segs = 0;
477 }
478 }
479
480 // just reset the unit
481 int flash_stop_flashing(void) {
482 UsbCommand c = {CMD_HARDWARE_RESET};
483 SendCommand(&c);
484 msleep(100);
485 return 0;
486 }
Impressum, Datenschutz