git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c

   1 //-----------------------------------------------------------------------------
   2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   3 // at your option, any later version. See the LICENSE.txt file for the text of
   4 // the license.
   5 //-----------------------------------------------------------------------------
   6 // Flashing utility functions
   7 //-----------------------------------------------------------------------------
   8
   9 #include <stdio.h>
  10 #include <string.h>
  11 #include <stdlib.h>
  12 #include "sleep.h"
  13 #include "proxusb.h"
  14 #include "flash.h"
  15 #include "elf.h"
  16
  17 static uint32_t ExpectedAddr;
  18 static uint8_t QueuedToSend[256];
  19 #define PHYSICAL_FLASH_START 0x100000
  20 #define PHYSICAL_FLASH_END   0x200000
  21
  22 void WaitForAck(void)
  23 {
  24   UsbCommand ack;
  25   ReceiveCommand(&ack);
  26   if (ack.cmd != CMD_ACK) {
  27     printf("bad ACK\n");
  28     exit(-1);
  29   }
  30 }
  31
  32 struct partition partitions[] = {
  33   {0x100000, 0x102000, 1, "bootrom"},
  34   {0x102000, 0x110000, 0, "fpga"},
  35   {0x110000, 0x140000, 0, "os"},
  36   {0, 0, 0, NULL},
  37 };
  38
  39 void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
  40 {
  41   unsigned char temp_buf[256];
  42   if (block_start & 0xFF) {
  43     printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
  44     memset(temp_buf, 0xFF, block_start & 0xFF);
  45     memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
  46     block_start &= ~0xFF;
  47   } else {
  48     memcpy(temp_buf, buf, len);
  49   }
  50
  51   UsbCommand c = {CMD_SETUP_WRITE};
  52
  53   for (int i = 0; i < 240; i += 48) {
  54     memcpy(c.d.asBytes, temp_buf+i, 48);
  55     c.arg[0] = (i/4);
  56     SendCommand(&c);
  57     WaitForAck();
  58   }
  59
  60   c.cmd = CMD_FINISH_WRITE;
  61   c.arg[0] = block_start;
  62
  63 //  printf("writing block %08x\r", c.arg[0]);
  64   memcpy(c.d.asBytes, temp_buf+240, 16);
  65   SendCommand(&c);
  66   WaitForAck();
  67 }
  68
  69 void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
  70 {
  71   FILE *f = fopen(file, "rb");
  72   if (!f) {
  73     printf("couldn't open file\n");
  74     exit(-1);
  75   }
  76
  77   char buf[4];
  78   fread(buf, 1, 4, f);
  79   if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
  80     fseek(f, 0, SEEK_SET);
  81     Elf32_Ehdr header;
  82     fread(&header, 1, sizeof(header), f);
  83     int count = header.e_phnum;
  84     printf("count=%d phoff=%x\n", count, header.e_phoff);
  85     Elf32_Phdr phdr;
  86
  87     for (int i = 0; i < header.e_phnum; ++i) {
  88       fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
  89       fread(&phdr, 1, sizeof(phdr), f);
  90       printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
  91         phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
  92       if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
  93         && (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
  94         printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
  95         if (phdr.p_offset == 0) {
  96           printf("skipping forward 0x2000 because of strange linker thing\n");
  97           phdr.p_offset += 0x2000;
  98           phdr.p_paddr += 0x2000;
  99           phdr.p_filesz -= 0x2000;
 100           phdr.p_memsz -= 0x2000;
 101         }
 102
 103         fseek(f, phdr.p_offset, SEEK_SET);
 104         ExpectedAddr = phdr.p_paddr;
 105         while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
 106           unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
 107           if (bytes_to_read > 256)
 108             bytes_to_read=256;
 109           else
 110             memset(QueuedToSend, 0xFF, 256);
 111           fread(QueuedToSend, 1, bytes_to_read, f);
 112           printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
 113             QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
 114             QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
 115             QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
 116             QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
 117           WriteBlock(ExpectedAddr, 256, QueuedToSend);
 118           ExpectedAddr += bytes_to_read;
 119         }
 120       }
 121     }
 122
 123     fclose(f);
 124     printf("\ndone.\n");
 125     return;
 126   } else printf("Bad file format\n");
 127 }
 128
 129 int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
 130 {
 131   if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
 132     UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
 133
 134     /* Only send magic when flashing bootrom */
 135     if (p->precious)
 136       c.arg[2] = START_FLASH_MAGIC;
 137     else
 138       c.arg[2] = 0;
 139
 140     SendCommand(&c);
 141     WaitForAck();
 142   } else {
 143     fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
 144     fprintf(stderr, "         It is recommended that you update your bootloader\n\n");
 145     exit(0);
 146   }
 147
 148   LoadFlashFromFile(filename, p->start, p->end);
 149   return 1;
 150 }
 151
 152 unsigned int GetProxmarkState(void)
 153 {
 154   unsigned int state = 0;
 155
 156   UsbCommand c;
 157   c.cmd = CMD_DEVICE_INFO;
 158   SendCommand(&c);
 159
 160   UsbCommand resp;
 161   ReceiveCommand(&resp);
 162   /* Three cases:
 163   * 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
 164   * 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
 165   * 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
 166   */
 167
 168   switch (resp.cmd) {
 169   case CMD_ACK:
 170     state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
 171     break;
 172   case CMD_DEBUG_PRINT_STRING:
 173     state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
 174     break;
 175   case CMD_DEVICE_INFO:
 176     state = resp.arg[0];
 177     break;
 178   default:
 179     fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
 180     exit(-1);
 181     break;
 182   }
 183
 184   return state;
 185 }
 186
 187 unsigned int EnterFlashState(void)
 188 {
 189   unsigned int state = GetProxmarkState();
 190
 191   if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
 192     /* Already in flash state, we're done. */
 193     return state;
 194   }
 195
 196   if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
 197     fprintf(stderr,"Entering flash-mode...\n");
 198     UsbCommand c;
 199     memset(&c, 0, sizeof (c));
 200
 201     if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) {
 202       /* New style handover: Send CMD_START_FLASH, which will reset the board and
 203        * enter the bootrom on the next boot.
 204       */
 205       c.cmd = CMD_START_FLASH;
 206       SendCommand(&c);
 207       fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
 208       fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 209     } else {
 210       /* Old style handover: Ask the user to press the button, then reset the board */
 211       c.cmd = CMD_HARDWARE_RESET;
 212       SendCommand(&c);
 213       fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
 214       fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
 215     }
 216
 217     CloseProxmark();
 218     sleep(1);
 219
 220     while (!OpenProxmark(0)) { sleep(1); }
 221     fprintf(stderr,"Found.\n");
 222
 223     return GetProxmarkState();
 224   }
 225
 226   return 0;
 227 }
 228
 229 /* On first call, have *offset = -1, *length = 0; */
 230 int find_next_area(const char *str, int *offset, int *length)
 231 {
 232   if (*str == '\0') return 0;
 233   if ((*offset >= 0) && str[*offset + *length] == '\0') return 0;
 234   *offset += 1 + *length;
 235
 236   char *next_comma = strchr(str + *offset, ',');
 237   if (next_comma == NULL) {
 238     *length = strlen(str) - *offset;
 239   } else {
 240     *length = next_comma-(str+*offset);
 241   }
 242   return 1;
 243 }
 244
 245 void do_flash(char **argv)
 246 {
 247   unsigned int state = EnterFlashState();
 248
 249   if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
 250     fprintf(stderr, "Proxmark would not enter flash state, abort\n");
 251     exit(-1);
 252   }
 253
 254   int offset=-1, length=0;
 255   int current_area = 0;
 256   while (find_next_area(argv[1], &offset, &length)) {
 257     struct partition *p = NULL;
 258     for (int i = 0; i<sizeof(partitions)/sizeof(partitions[0]); ++i) {
 259       if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
 260         /* Check if the name matches the bootrom partition, and if so, require "bootrom" to
 261          * be written in full. The other names may be abbreviated.
 262         */
 263         if(!partitions[i].precious || (strlen(partitions[i].name) == length))
 264           p = &partitions[i];
 265         break;
 266       }
 267     }
 268
 269     if (p == NULL) {
 270       fprintf(stderr, "Warning: area name '");
 271       fwrite(argv[1]+offset, length, 1, stderr);
 272       fprintf(stderr, "' unknown, ignored\n");
 273     } else {
 274       fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
 275       PrepareFlash(p, argv[2+current_area], state);
 276     }
 277     current_area++;
 278   }
 279 }