mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-03-10 06:57:19 +08:00
New flash tool, needs to be ported to Windows.
+ [f]ast is gone, current mode will be autodetected
+ uses hands-free firmware update if supported by the bootrom (to be committed)
+ uses new bootrom safety features against accidental misflashes (to be committed)
+ supports S19 files with base address 0x0 or base address 0x100000
+ supports old bootroms which expect 0x0 and new bootroms which expect 0x100000 (to be committed)
+ new argument style: first argument is comma-separated (no spaces!) list of partition names, remaining arguments are file names
os and fpga may be abbreviated, bootrom must be given in full
Examples: ./flasher os ../armsrc/obj/osimage.s19
./flasher bootrom,o,f ../bootrom/obj/bootrom.s19 ../armsrc/obj/osimage.s19 ../armsrc/obj/fpgaimage.s19
This commit is contained in:
henryk@ploetzli.ch
parent
d5d42c0a4b
commit
a5b1ba2023
2 changed files with 240 additions and 59 deletions
|
|
@ -25,6 +25,7 @@ typedef struct {
|
|||
#define CMD_FINISH_WRITE 0x0003
|
||||
#define CMD_HARDWARE_RESET 0x0004
|
||||
#define CMD_START_FLASH 0x0005
|
||||
#define CMD_NACK 0x00fe
|
||||
#define CMD_ACK 0x00ff
|
||||
|
||||
// For general mucking around
|
||||
|
|
@ -75,4 +76,14 @@ typedef struct {
|
|||
// For direct FPGA control
|
||||
#define CMD_FPGA_MAJOR_MODE_OFF 0x0500
|
||||
|
||||
// CMD_DEVICE_INFO response packet has flags in ext1, flag definitions:
|
||||
#define DEVICE_INFO_FLAG_BOOTROM_PRESENT (1<<0) /* Whether a bootloader that understands the common_area is present */
|
||||
#define DEVICE_INFO_FLAG_OSIMAGE_PRESENT (1<<1) /* Whether a osimage that understands the common_area is present */
|
||||
#define DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM (1<<2) /* Set if the bootloader is currently executing */
|
||||
#define DEVICE_INFO_FLAG_CURRENT_MODE_OS (1<<3) /* Set if the OS is currently executing */
|
||||
#define DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH (1<<4) /* Set if this device understands the extend start flash command */
|
||||
|
||||
// CMD_START_FLASH may have three arguments: start of area to flash, end of area to flash, optional magic defined below
|
||||
#define START_FLASH_MAGIC 0x54494f44 /* The bootrom will not allow to overwrite itself unless this magic is given as third parameter */
|
||||
|
||||
#endif
|
||||
|
|
|
|||
288
linux/flasher.c
288
linux/flasher.c
|
|
@ -14,8 +14,24 @@
|
|||
static DWORD ExpectedAddr;
|
||||
static BYTE QueuedToSend[256];
|
||||
static BOOL AllWritten;
|
||||
#define PHYSICAL_FLASH_START 0x100000
|
||||
|
||||
static void FlushPrevious(void)
|
||||
struct partition {
|
||||
int start;
|
||||
int end;
|
||||
int precious;
|
||||
const char *name;
|
||||
};
|
||||
struct partition partitions[] = {
|
||||
{0x100000, 0x102000, 1, "bootrom"},
|
||||
{0x102000, 0x110000, 0, "fpga"},
|
||||
{0x110000, 0x140000, 0, "os"},
|
||||
};
|
||||
|
||||
/* If translate is set, subtract PHYSICAL_FLASH_START to translate for old
|
||||
* bootroms.
|
||||
*/
|
||||
static void FlushPrevious(int translate)
|
||||
{
|
||||
UsbCommand c;
|
||||
memset(&c, 0, sizeof(c));
|
||||
|
|
@ -32,6 +48,9 @@ static void FlushPrevious(void)
|
|||
|
||||
c.cmd = CMD_FINISH_WRITE;
|
||||
c.ext1 = (ExpectedAddr-1) & (~255);
|
||||
if(translate) {
|
||||
c.ext1 -= PHYSICAL_FLASH_START;
|
||||
}
|
||||
printf("c.ext1 = %08x\r", c.ext1);
|
||||
memcpy(c.d.asBytes, QueuedToSend+240, 16);
|
||||
SendCommand(&c, TRUE);
|
||||
|
|
@ -39,9 +58,16 @@ static void FlushPrevious(void)
|
|||
AllWritten = TRUE;
|
||||
}
|
||||
|
||||
static void GotByte(DWORD where, BYTE which)
|
||||
/* Where must be between start_addr (inclusive) and end_addr (exclusive).
|
||||
*/
|
||||
static void GotByte(DWORD where, BYTE which, int start_addr, int end_addr, int translate)
|
||||
{
|
||||
AllWritten = FALSE;
|
||||
|
||||
if(where < start_addr || where >= end_addr) {
|
||||
printf("bad: got byte at %08x, outside of range %08x-%08x\n", where, start_addr, end_addr);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
if(where != ExpectedAddr) {
|
||||
printf("bad: got at %08x, expected at %08x\n", where, ExpectedAddr);
|
||||
|
|
@ -52,7 +78,7 @@ static void GotByte(DWORD where, BYTE which)
|
|||
|
||||
if((where & 255) == 255) {
|
||||
// we have completed a full page
|
||||
FlushPrevious();
|
||||
FlushPrevious(translate);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -74,10 +100,10 @@ static BYTE HexByte(char *s)
|
|||
return (HexVal(s[0]) << 4) | HexVal(s[1]);
|
||||
}
|
||||
|
||||
static void LoadFlashFromSRecords(char *file, int addr)
|
||||
static void LoadFlashFromSRecords(const char *file, int start_addr, int end_addr, int translate)
|
||||
{
|
||||
ExpectedAddr = addr;
|
||||
|
||||
ExpectedAddr = start_addr;
|
||||
|
||||
FILE *f = fopen(file, "r");
|
||||
if(!f) {
|
||||
printf("couldn't open file\n");
|
||||
|
|
@ -97,82 +123,226 @@ static void LoadFlashFromSRecords(char *file, int addr)
|
|||
DWORD addr;
|
||||
sscanf(addrStr, "%x", &addr);
|
||||
s += 8;
|
||||
|
||||
/* Accept files that are located at PHYSICAL_FLASH_START, and files that are located at 0 */
|
||||
if(addr < PHYSICAL_FLASH_START)
|
||||
addr += PHYSICAL_FLASH_START;
|
||||
|
||||
int i;
|
||||
for(i = 0; i < len; i++) {
|
||||
while((addr+i) > ExpectedAddr) {
|
||||
GotByte(ExpectedAddr, 0xff);
|
||||
GotByte(ExpectedAddr, 0xff, start_addr, end_addr, translate);
|
||||
}
|
||||
GotByte(addr+i, HexByte(s));
|
||||
GotByte(addr+i, HexByte(s), start_addr, end_addr, translate);
|
||||
s += 2;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if(!AllWritten) FlushPrevious();
|
||||
if(!AllWritten) FlushPrevious(translate);
|
||||
|
||||
fclose(f);
|
||||
printf("\ndone.\n");
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
unsigned int addr = 0;
|
||||
BOOL fastflash = 0, flashboth = 0;
|
||||
UsbCommand c;
|
||||
|
||||
if (argc != 3 && ! ((argc == 4 && (*argv[3] == 'f' || strcmp(argv[1], "both") == 0) ) || (argc == 5 && *argv[4] == 'f'))) {
|
||||
fprintf(stderr,"Usage: %s {bootrom|os|fpga} image.s19 [f]ast\n", argv[0]);
|
||||
fprintf(stderr," %s {both} osimage.s19 fpgaimage.s19 [f]ast\n", argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if (!strcmp(argv[1],"bootrom")) {
|
||||
addr = 0;
|
||||
} else if (!strcmp(argv[1],"os")) {
|
||||
addr = FLASH_ADDR_OS;
|
||||
} else if (!strcmp(argv[1],"fpga")) {
|
||||
addr = FLASH_ADDR_FPGA;
|
||||
} else if (!strcmp(argv[1],"both")) {
|
||||
flashboth = 1;
|
||||
} else {
|
||||
fprintf(stderr,"Unknown action '%s'!\n", argv[1]);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if((argc == 4 && *argv[3] == 'f') || (argc == 5 && *argv[4] == 'f')) {
|
||||
fastflash= 1;
|
||||
fprintf(stderr,"Fastflash - device already in FLASH mode...\n");
|
||||
}
|
||||
|
||||
usb_init();
|
||||
|
||||
fprintf(stderr,"Waiting for Proxmark to appear on USB...\n");
|
||||
while(!(devh=OpenProxmark(0))) { sleep(1); }
|
||||
fprintf(stderr,"Found...\n");
|
||||
|
||||
if(!fastflash){
|
||||
fprintf(stderr,"Entering flash-mode...\n");
|
||||
bzero(&c, sizeof(c));
|
||||
static int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
|
||||
{
|
||||
int translate = 0;
|
||||
if(state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
|
||||
UsbCommand c;
|
||||
c.cmd = CMD_START_FLASH;
|
||||
SendCommand(&c, FALSE);
|
||||
c.ext1 = p->start;
|
||||
c.ext2 = p->end;
|
||||
|
||||
/* Only send magic when flashing bootrom */
|
||||
if(p->precious) {
|
||||
c.ext3 = START_FLASH_MAGIC;
|
||||
} else {
|
||||
c.ext3 = 0;
|
||||
}
|
||||
SendCommand(&c, TRUE);
|
||||
translate = 0;
|
||||
} else {
|
||||
fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
|
||||
fprintf(stderr, " It is recommended that you update your bootloader\n\n");
|
||||
translate = 1;
|
||||
}
|
||||
|
||||
LoadFlashFromSRecords(filename, p->start, p->end, translate);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static unsigned int GetProxmarkState(void)
|
||||
{
|
||||
unsigned int state = 0;
|
||||
|
||||
UsbCommand c;
|
||||
c.cmd = CMD_DEVICE_INFO;
|
||||
SendCommand(&c, FALSE);
|
||||
|
||||
UsbCommand resp;
|
||||
ReceiveCommand(&resp);
|
||||
/* Three cases:
|
||||
* 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
|
||||
* 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
|
||||
* 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
|
||||
*/
|
||||
|
||||
switch(resp.cmd) {
|
||||
case CMD_ACK:
|
||||
state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
|
||||
break;
|
||||
case CMD_DEBUG_PRINT_STRING:
|
||||
state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
|
||||
break;
|
||||
case CMD_DEVICE_INFO:
|
||||
state = resp.ext1;
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
|
||||
exit(-1);
|
||||
break;
|
||||
}
|
||||
|
||||
#if 0
|
||||
if(state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) printf("New bootrom present\n");
|
||||
if(state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT) printf("New osimage present\n");
|
||||
if(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) printf("Currently in bootrom\n");
|
||||
if(state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) printf("Currently in OS\n");
|
||||
#endif
|
||||
|
||||
return state;
|
||||
}
|
||||
|
||||
static unsigned int EnterFlashState(void)
|
||||
{
|
||||
unsigned int state = GetProxmarkState();
|
||||
|
||||
if(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
|
||||
/* Already in flash state, we're done. */
|
||||
return state;
|
||||
}
|
||||
|
||||
if(state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
|
||||
fprintf(stderr,"Entering flash-mode...\n");
|
||||
UsbCommand c;
|
||||
bzero(&c, sizeof(c));
|
||||
|
||||
if( (state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT) ) {
|
||||
/* New style handover: Send CMD_START_FLASH, which will reset the board and
|
||||
* enter the bootrom on the next boot.
|
||||
*/
|
||||
c.cmd = CMD_START_FLASH;
|
||||
SendCommand(&c, FALSE);
|
||||
fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
|
||||
fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
|
||||
} else {
|
||||
/* Old style handover: Ask the user to press the button, then reset the board */
|
||||
c.cmd = CMD_HARDWARE_RESET;
|
||||
SendCommand(&c, FALSE);
|
||||
fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
|
||||
fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
|
||||
}
|
||||
|
||||
CloseProxmark();
|
||||
sleep(1);
|
||||
|
||||
fprintf(stderr,"Waiting for Proxmark to reappear on USB...\n");
|
||||
fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
|
||||
while(!(devh=OpenProxmark(0))) { sleep(1); }
|
||||
fprintf(stderr,"Found...\n");
|
||||
}
|
||||
fprintf(stderr,"Found.\n");
|
||||
|
||||
if(!flashboth)
|
||||
LoadFlashFromSRecords(argv[2], addr);
|
||||
else {
|
||||
fprintf(stderr,"Flashing os...\n");
|
||||
LoadFlashFromSRecords(argv[2],FLASH_ADDR_OS);
|
||||
fprintf(stderr,"Flashing fpga...\n");
|
||||
LoadFlashFromSRecords(argv[3],FLASH_ADDR_FPGA);
|
||||
return GetProxmarkState();
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void usage(char **argv)
|
||||
{
|
||||
int i;
|
||||
fprintf(stderr, "Usage: %s areas image [image [image]]\n", argv[0]);
|
||||
fprintf(stderr, " areas is a comma-separated list of areas to flash, with no spaces\n");
|
||||
fprintf(stderr, " Known areas are:");
|
||||
for(i=0; i<(sizeof(partitions)/sizeof(partitions[0])); i++) {
|
||||
fprintf(stderr, " %s", partitions[i].name);
|
||||
}
|
||||
fprintf(stderr, "\n");
|
||||
fprintf(stderr, " image is the path to the corresponding image\n\n");
|
||||
fprintf(stderr, "Example: %s os,fpga path/to/osimage.s19 path/to/fpgaimage.s19\n", argv[0]);
|
||||
}
|
||||
|
||||
/* On first call, have *offset = -1, *length = 0; */
|
||||
static int find_next_area(const char *str, int *offset, int *length)
|
||||
{
|
||||
if(*str == '\0') return 0;
|
||||
if((*offset >= 0) && str[*offset + *length] == '\0') return 0;
|
||||
*offset += 1 + *length;
|
||||
|
||||
char *next_comma = strchr(str + *offset, ',');
|
||||
if(next_comma == NULL) {
|
||||
*length = strlen(str) - *offset;
|
||||
} else {
|
||||
*length = next_comma-(str+*offset);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
if(argc < 2) {
|
||||
usage(argv);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
/* Count area arguments */
|
||||
int areas = 0, offset=-1, length=0;
|
||||
while(find_next_area(argv[1], &offset, &length)) areas++;
|
||||
|
||||
if(areas != argc - 2) {
|
||||
usage(argv);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
usb_init();
|
||||
|
||||
fprintf(stderr,"Waiting for Proxmark to appear on USB... ");
|
||||
while(!(devh=OpenProxmark(0))) { sleep(1); }
|
||||
fprintf(stderr,"Found.\n");
|
||||
|
||||
unsigned int state = EnterFlashState();
|
||||
|
||||
if( !(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) ) {
|
||||
fprintf(stderr, "Proxmark would not enter flash state, abort\n");
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
offset=-1; length=0;
|
||||
int current_area = 0;
|
||||
while(find_next_area(argv[1], &offset, &length)) {
|
||||
int i;
|
||||
struct partition *p = NULL;
|
||||
for(i=0; i<sizeof(partitions)/sizeof(partitions[0]); i++) {
|
||||
if(strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
|
||||
/* Check if the name matches the bootrom partition, and if so, require "bootrom" to
|
||||
* be written in full. The other names may be abbreviated.
|
||||
*/
|
||||
if(!partitions[i].precious || (strlen(partitions[i].name) == length)) {
|
||||
p = &partitions[i];
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(p == NULL) {
|
||||
fprintf(stderr, "Warning: area name '");
|
||||
fwrite(argv[1]+offset, length, 1, stderr);
|
||||
fprintf(stderr, "' unknown, ignored\n");
|
||||
} else {
|
||||
fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
|
||||
PrepareFlash(p, argv[2+current_area], state);
|
||||
}
|
||||
current_area++;
|
||||
}
|
||||
|
||||
UsbCommand c;
|
||||
bzero(&c, sizeof(c));
|
||||
c.cmd = CMD_HARDWARE_RESET;
|
||||
SendCommand(&c, FALSE);
|
||||
|
|
|
|||
Loading…
Reference in a new issue