[proxmark3-svn] / client / flash.c

#ifdef WIN32
#include <windows.h>
#include <setupapi.h>
#include <ctype.h>
#define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
BOOL UsbConnect(void);
#else
#include <usb.h>
#endif
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <strings.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>

#include "prox.h"
#ifndef WIN32
#include "proxmark3.h"
#endif
#include "flash.h"
#include "elf.h"

static uint32_t ExpectedAddr;
static uint8_t QueuedToSend[256];
static bool AllWritten;
#define PHYSICAL_FLASH_START 0x100000
#define PHYSICAL_FLASH_END   0x200000

void WaitForAck(void) {
	UsbCommand ack;
	ReceiveCommand(&ack);
	if(ack.cmd != CMD_ACK) {
		printf("bad ACK\n");
		exit(-1);
	}
}

struct partition partitions[] = {
		{0x100000, 0x102000, 1, "bootrom"},
		{0x102000, 0x110000, 0, "fpga"},
		{0x110000, 0x140000, 0, "os"},
		{0, 0, 0, NULL},
};

void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
{
	unsigned char temp_buf[256];
	if (block_start & 0xFF) {
		printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
		memset(temp_buf, 0xFF, block_start & 0xFF);
		memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
		block_start &= ~0xFF;
	} else {
		memcpy(temp_buf, buf, len);
	}
	
	UsbCommand c = {CMD_SETUP_WRITE};

	int i;
	for(i = 0; i < 240; i += 48) {
		memcpy(c.d.asBytes, temp_buf+i, 48);
		c.arg[0] = (i/4);
		SendCommand(&c);
		WaitForAck();
	}

	c.cmd = CMD_FINISH_WRITE;
	c.arg[0] = block_start;

//	printf("writing block %08x\r", c.arg[0]);
	memcpy(c.d.asBytes, temp_buf+240, 16);
	SendCommand(&c);
	WaitForAck();

	AllWritten = true;
}

void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
{
	FILE *f = fopen(file, "rb");
	if(!f) {
		printf("couldn't open file\n");
		exit(-1);
	}

	char buf[4];
	fread(buf, 1, 4, f);
	if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
		int i;
		fseek(f, 0, SEEK_SET);
		Elf32_Ehdr header;
		fread(&header, 1, sizeof(header), f);
		int count = header.e_phnum;
		printf("count=%d phoff=%x\n", count, header.e_phoff);
		Elf32_Phdr phdr;
		
		for (i=0; i<header.e_phnum; i++) {
			fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
			fread(&phdr, 1, sizeof(phdr), f);
			printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
				phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
			if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
				&& (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
				printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
				if (phdr.p_offset == 0) {
					printf("skipping forward 0x2000 because of strange linker thing\n");
					phdr.p_offset += 0x2000;
					phdr.p_paddr += 0x2000;
					phdr.p_filesz -= 0x2000;
					phdr.p_memsz -= 0x2000;
				}

				fseek(f, phdr.p_offset, SEEK_SET);
				ExpectedAddr = phdr.p_paddr;
				while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
					unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
					if (bytes_to_read > 256)
						bytes_to_read=256;
					else
						memset(QueuedToSend, 0xFF, 256);
					fread(QueuedToSend, 1, bytes_to_read, f);
					printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
							QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
							QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
							QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
							QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
					WriteBlock(ExpectedAddr, 256, QueuedToSend);
					ExpectedAddr += bytes_to_read;
				}
            }
        }

		fclose(f);
		printf("\ndone.\n");
		return;
	} else printf("Bad file format\n");		
}

int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
{
	if(state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
		UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
		
		/* Only send magic when flashing bootrom */
		if(p->precious)
			c.arg[2] = START_FLASH_MAGIC;
		else
			c.arg[2] = 0;

		SendCommand(&c);
		WaitForAck();
	} else {
		fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
		fprintf(stderr, "         It is recommended that you update your bootloader\n\n");
		exit(0);
	}
	
	LoadFlashFromFile(filename, p->start, p->end);
	return 1;
}

unsigned int GetProxmarkState(void)
{
	unsigned int state = 0;
	
	UsbCommand c;
	c.cmd = CMD_DEVICE_INFO;
	SendCommand(&c);
	
	UsbCommand resp;
	ReceiveCommand(&resp);
	/* Three cases: 
	 * 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
	 * 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
	 * 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
	 */
	
	switch(resp.cmd) {
	case CMD_ACK:
		state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
		break;
	case CMD_DEBUG_PRINT_STRING:
		state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
		break;
	case CMD_DEVICE_INFO:
		state = resp.arg[0];
		break;
	default:
		fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
		exit(-1);
		break;
	}
	
	return state;
}

unsigned int EnterFlashState(void)
{
	unsigned int state = GetProxmarkState();
	
	if(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
		/* Already in flash state, we're done. */
		return state;
	}
	
	if(state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
		fprintf(stderr,"Entering flash-mode...\n");
		UsbCommand c;
		bzero(&c, sizeof(c));
		
		if( (state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT) ) {
			/* New style handover: Send CMD_START_FLASH, which will reset the board and
			 * enter the bootrom on the next boot.
			 */
			c.cmd = CMD_START_FLASH;
			SendCommand(&c);
			fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
			fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
		} else {
			/* Old style handover: Ask the user to press the button, then reset the board */
			c.cmd = CMD_HARDWARE_RESET;
			SendCommand(&c);
			fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
			fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
		}

#ifdef WIN32
		Sleep(1000);
		while(!UsbConnect()) { Sleep(1000); }
#else
		CloseProxmark();
		sleep(1);

		while(!(devh=OpenProxmark(0))) { sleep(1); }
#endif
		fprintf(stderr,"Found.\n");

		return GetProxmarkState();
	}
	
	return 0;
}

/* On first call, have *offset = -1, *length = 0; */
int find_next_area(const char *str, int *offset, int *length)
{
	if(*str == '\0') return 0;
	if((*offset >= 0) && str[*offset + *length] == '\0') return 0;
	*offset += 1 + *length;
	
	char *next_comma = strchr(str + *offset, ',');
	if(next_comma == NULL) {
		*length = strlen(str) - *offset;
	} else {
		*length = next_comma-(str+*offset);
	}
	return 1;
}

void do_flash(char **argv) {
	unsigned int state = EnterFlashState();

	if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
		fprintf(stderr, "Proxmark would not enter flash state, abort\n");
		exit(-1);
	}

	int offset=-1, length=0;
	int current_area = 0;
	while(find_next_area(argv[1], &offset, &length)) {
		int i;
		struct partition *p = NULL;
		for (i=0; i<sizeof(partitions)/sizeof(partitions[0]); i++) {
			if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
				/* Check if the name matches the bootrom partition, and if so, require "bootrom" to
			 	* be written in full. The other names may be abbreviated.
			 	*/
				if(!partitions[i].precious || (strlen(partitions[i].name) == length))
					p = &partitions[i];
				break;
			}
		}

		if(p == NULL) {
			fprintf(stderr, "Warning: area name '");
			fwrite(argv[1]+offset, length, 1, stderr);
			fprintf(stderr, "' unknown, ignored\n");
		} else {
			fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
			PrepareFlash(p, argv[2+current_area], state);
		}
		current_area++;
	}
}
Commit	Line	Data
6e4d4ee6	1	#ifdef WIN32
	2	#include <windows.h>
	3	#include <setupapi.h>
	4	#include <ctype.h>
	5	#define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
	6	BOOL UsbConnect(void);
	7	#else
	8	#include <usb.h>
	9	#endif
	10	#include <stdio.h>
	11	#include <unistd.h>
	12	#include <stdlib.h>
	13	#include <stdint.h>
	14	#include <stdbool.h>
	15	#include <strings.h>
	16	#include <string.h>
	17	#include <errno.h>
	18	#include <ctype.h>
	19
	20	#include "prox.h"
	21	#ifndef WIN32
	22	#include "proxmark3.h"
	23	#endif
	24	#include "flash.h"
2cab856f	25	#include "elf.h"
6e4d4ee6	26
	27	static uint32_t ExpectedAddr;
	28	static uint8_t QueuedToSend[256];
	29	static bool AllWritten;
	30	#define PHYSICAL_FLASH_START 0x100000
2cab856f	31	#define PHYSICAL_FLASH_END 0x200000
6e4d4ee6	32
	33	void WaitForAck(void) {
	34	UsbCommand ack;
	35	ReceiveCommand(&ack);
	36	if(ack.cmd != CMD_ACK) {
	37	printf("bad ACK\n");
	38	exit(-1);
	39	}
	40	}
	41
	42	struct partition partitions[] = {
	43	{0x100000, 0x102000, 1, "bootrom"},
	44	{0x102000, 0x110000, 0, "fpga"},
	45	{0x110000, 0x140000, 0, "os"},
	46	{0, 0, 0, NULL},
	47	};
	48
2cab856f	49	void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
6e4d4ee6	50	{
2cab856f	51	unsigned char temp_buf[256];
	52	if (block_start & 0xFF) {
	53	printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
	54	memset(temp_buf, 0xFF, block_start & 0xFF);
cef938d8	55	memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
2cab856f	56	block_start &= ~0xFF;
cef938d8	57	} else {
	58	memcpy(temp_buf, buf, len);
	59	}
2cab856f	60
2cab856f	61	UsbCommand c = {CMD_SETUP_WRITE};
6e4d4ee6	62
6e4d4ee6	63	int i;
6e4d4ee6	64	for(i = 0; i < 240; i += 48) {
2cab856f	65	memcpy(c.d.asBytes, temp_buf+i, 48);
6e4d4ee6	66	c.arg[0] = (i/4);
	67	SendCommand(&c);
	68	WaitForAck();
	69	}
	70
	71	c.cmd = CMD_FINISH_WRITE;
2cab856f	72	c.arg[0] = block_start;
2cab856f	73
815f3f25	74	// printf("writing block %08x\r", c.arg[0]);
2cab856f	75	memcpy(c.d.asBytes, temp_buf+240, 16);
6e4d4ee6	76	SendCommand(&c);
	77	WaitForAck();
	78
	79	AllWritten = true;
	80	}
	81
2cab856f	82	void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
6e4d4ee6	83	{
2cab856f	84	FILE *f = fopen(file, "rb");
6e4d4ee6	85	if(!f) {
	86	printf("couldn't open file\n");
	87	exit(-1);
	88	}
	89
2cab856f	90	char buf[4];
	91	fread(buf, 1, 4, f);
	92	if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
	93	int i;
	94	fseek(f, 0, SEEK_SET);
	95	Elf32_Ehdr header;
	96	fread(&header, 1, sizeof(header), f);
	97	int count = header.e_phnum;
	98	printf("count=%d phoff=%x\n", count, header.e_phoff);
	99	Elf32_Phdr phdr;
	100
	101	for (i=0; i<header.e_phnum; i++) {
	102	fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
	103	fread(&phdr, 1, sizeof(phdr), f);
815f3f25	104	printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
815f3f25	105	phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
2cab856f	106	if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
	107	&& (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
	108	printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
	109	if (phdr.p_offset == 0) {
	110	printf("skipping forward 0x2000 because of strange linker thing\n");
	111	phdr.p_offset += 0x2000;
	112	phdr.p_paddr += 0x2000;
815f3f25	113	phdr.p_filesz -= 0x2000;
815f3f25	114	phdr.p_memsz -= 0x2000;
6e4d4ee6	115	}
6e4d4ee6	116
2cab856f	117	fseek(f, phdr.p_offset, SEEK_SET);
	118	ExpectedAddr = phdr.p_paddr;
	119	while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
	120	unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
815f3f25	121	if (bytes_to_read > 256)
	122	bytes_to_read=256;
	123	else
	124	memset(QueuedToSend, 0xFF, 256);
2cab856f	125	fread(QueuedToSend, 1, bytes_to_read, f);
815f3f25	126	printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
	127	QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
	128	QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
	129	QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
	130	QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
	131	WriteBlock(ExpectedAddr, 256, QueuedToSend);
2cab856f	132	ExpectedAddr += bytes_to_read;
	133	}
	134	}
	135	}
6e4d4ee6	136
2cab856f	137	fclose(f);
	138	printf("\ndone.\n");
	139	return;
	140	} else printf("Bad file format\n");
6e4d4ee6	141	}
	142
	143	int PrepareFlash(struct partition p, const char filename, unsigned int state)
	144	{
6e4d4ee6	145	if(state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
2cab856f	146	UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
6e4d4ee6	147
6e4d4ee6	148	/* Only send magic when flashing bootrom */
2cab856f	149	if(p->precious)
6e4d4ee6	150	c.arg[2] = START_FLASH_MAGIC;
2cab856f	151	else
6e4d4ee6	152	c.arg[2] = 0;
2cab856f	153
6e4d4ee6	154	SendCommand(&c);
6e4d4ee6	155	WaitForAck();
6e4d4ee6	156	} else {
	157	fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
	158	fprintf(stderr, " It is recommended that you update your bootloader\n\n");
2cab856f	159	exit(0);
6e4d4ee6	160	}
6e4d4ee6	161
2cab856f	162	LoadFlashFromFile(filename, p->start, p->end);
6e4d4ee6	163	return 1;
	164	}
	165
	166	unsigned int GetProxmarkState(void)
	167	{
	168	unsigned int state = 0;
	169
	170	UsbCommand c;
	171	c.cmd = CMD_DEVICE_INFO;
	172	SendCommand(&c);
	173
	174	UsbCommand resp;
	175	ReceiveCommand(&resp);
	176	/* Three cases:
	177	* 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
	178	* 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
	179	* 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
	180	*/
	181
	182	switch(resp.cmd) {
	183	case CMD_ACK:
	184	state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
	185	break;
	186	case CMD_DEBUG_PRINT_STRING:
	187	state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
	188	break;
	189	case CMD_DEVICE_INFO:
	190	state = resp.arg[0];
	191	break;
	192	default:
	193	fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
	194	exit(-1);
	195	break;
	196	}
	197
	198	return state;
	199	}
	200
	201	unsigned int EnterFlashState(void)
	202	{
	203	unsigned int state = GetProxmarkState();
	204
	205	if(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
	206	/* Already in flash state, we're done. */
	207	return state;
	208	}
	209
	210	if(state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
	211	fprintf(stderr,"Entering flash-mode...\n");
	212	UsbCommand c;
	213	bzero(&c, sizeof(c));
	214
	215	if( (state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT) ) {
	216	/* New style handover: Send CMD_START_FLASH, which will reset the board and
	217	* enter the bootrom on the next boot.
	218	*/
	219	c.cmd = CMD_START_FLASH;
	220	SendCommand(&c);
	221	fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
	222	fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
	223	} else {
	224	/* Old style handover: Ask the user to press the button, then reset the board */
	225	c.cmd = CMD_HARDWARE_RESET;
	226	SendCommand(&c);
227	fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
228	fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
229	}
230
231	#ifdef WIN32
232	Sleep(1000);
233	while(!UsbConnect()) { Sleep(1000); }
234	#else
235	CloseProxmark();
236	sleep(1);
237
238	while(!(devh=OpenProxmark(0))) { sleep(1); }
239	#endif
240	fprintf(stderr,"Found.\n");
241
242	return GetProxmarkState();
243	}
244
245	return 0;
246	}
247
248	/* On first call, have offset = -1, length = 0; */
249	int find_next_area(const char str, int offset, int *length)
250	{
251	if(*str == '\0') return 0;
252	if((offset >= 0) && str[offset + *length] == '\0') return 0;
253	offset += 1 + length;
254
255	char next_comma = strchr(str + offset, ',');
256	if(next_comma == NULL) {
257	length = strlen(str) - offset;
258	} else {
259	length = next_comma-(str+offset);
260	}
261	return 1;
262	}
263
264	void do_flash(char **argv) {
265	unsigned int state = EnterFlashState();
266
267	if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
268	fprintf(stderr, "Proxmark would not enter flash state, abort\n");
269	exit(-1);
270	}
271
272	int offset=-1, length=0;
273	int current_area = 0;
274	while(find_next_area(argv[1], &offset, &length)) {
275	int i;
276	struct partition *p = NULL;
277	for (i=0; i<sizeof(partitions)/sizeof(partitions[0]); i++) {
278	if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
279	/* Check if the name matches the bootrom partition, and if so, require "bootrom" to
280	* be written in full. The other names may be abbreviated.
281	*/
282	if(!partitions[i].precious \|\| (strlen(partitions[i].name) == length))
283	p = &partitions[i];
284	break;
285	}
286	}
287
288	if(p == NULL) {
289	fprintf(stderr, "Warning: area name '");
290	fwrite(argv[1]+offset, length, 1, stderr);
291	fprintf(stderr, "' unknown, ignored\n");
292	} else {
293	fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
294	PrepareFlash(p, argv[2+current_area], state);
295	}
296	current_area++;
297	}
298	}