[proxmark3-svn] / client / flash.c

#ifdef WIN32
#include <windows.h>
#include <setupapi.h>
#define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
BOOL UsbConnect(void);
#else
#include <proxusb.h>
#endif

#include <usb_cmd.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include "flash.h"
#include "elf.h"
#include "proxusb.h"

static uint32_t ExpectedAddr;
static uint8_t QueuedToSend[256];
static BOOL AllWritten;
#define PHYSICAL_FLASH_START 0x100000
#define PHYSICAL_FLASH_END   0x200000

void WaitForAck(void)
{
  UsbCommand ack;
  ReceiveCommand(&ack);
  if (ack.cmd != CMD_ACK) {
    printf("bad ACK\n");
    exit(-1);
  }
}

struct partition partitions[] = {
  {0x100000, 0x102000, 1, "bootrom"},
  {0x102000, 0x110000, 0, "fpga"},
  {0x110000, 0x140000, 0, "os"},
  {0, 0, 0, NULL},
};

void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
{
  unsigned char temp_buf[256];
  if (block_start & 0xFF) {
    printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
    memset(temp_buf, 0xFF, block_start & 0xFF);
    memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
    block_start &= ~0xFF;
  } else {
    memcpy(temp_buf, buf, len);
  }

  UsbCommand c = {CMD_SETUP_WRITE};

  for (int i = 0; i < 240; i += 48) {
    memcpy(c.d.asBytes, temp_buf+i, 48);
    c.arg[0] = (i/4);
    SendCommand(&c);
    WaitForAck();
  }

  c.cmd = CMD_FINISH_WRITE;
  c.arg[0] = block_start;

//  printf("writing block %08x\r", c.arg[0]);
  memcpy(c.d.asBytes, temp_buf+240, 16);
  SendCommand(&c);
  WaitForAck();

  AllWritten = true;
}

void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
{
  FILE *f = fopen(file, "rb");
  if (!f) {
    printf("couldn't open file\n");
    exit(-1);
  }

  char buf[4];
  fread(buf, 1, 4, f);
  if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
    fseek(f, 0, SEEK_SET);
    Elf32_Ehdr header;
    fread(&header, 1, sizeof(header), f);
    int count = header.e_phnum;
    printf("count=%d phoff=%x\n", count, header.e_phoff);
    Elf32_Phdr phdr;

    for (int i = 0; i < header.e_phnum; ++i) {
      fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
      fread(&phdr, 1, sizeof(phdr), f);
      printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
        phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
      if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
        && (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
        printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
        if (phdr.p_offset == 0) {
          printf("skipping forward 0x2000 because of strange linker thing\n");
          phdr.p_offset += 0x2000;
          phdr.p_paddr += 0x2000;
          phdr.p_filesz -= 0x2000;
          phdr.p_memsz -= 0x2000;
        }

        fseek(f, phdr.p_offset, SEEK_SET);
        ExpectedAddr = phdr.p_paddr;
        while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
          unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
          if (bytes_to_read > 256)
            bytes_to_read=256;
          else
            memset(QueuedToSend, 0xFF, 256);
          fread(QueuedToSend, 1, bytes_to_read, f);
          printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
            QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
            QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
            QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
            QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
          WriteBlock(ExpectedAddr, 256, QueuedToSend);
          ExpectedAddr += bytes_to_read;
        }
      }
    }

    fclose(f);
    printf("\ndone.\n");
    return;
  } else printf("Bad file format\n");		
}

int PrepareFlash(struct partition *p, const char *filename, unsigned int state)
{
  if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
    UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};

    /* Only send magic when flashing bootrom */
    if (p->precious)
      c.arg[2] = START_FLASH_MAGIC;
    else
      c.arg[2] = 0;

    SendCommand(&c);
    WaitForAck();
  } else {
    fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
    fprintf(stderr, "         It is recommended that you update your bootloader\n\n");
    exit(0);
  }

  LoadFlashFromFile(filename, p->start, p->end);
  return 1;
}

unsigned int GetProxmarkState(void)
{
  unsigned int state = 0;

  UsbCommand c;
  c.cmd = CMD_DEVICE_INFO;
  SendCommand(&c);

  UsbCommand resp;
  ReceiveCommand(&resp);
  /* Three cases: 
  * 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
  * 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
  * 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
  */

  switch (resp.cmd) {
  case CMD_ACK:
    state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
    break;
  case CMD_DEBUG_PRINT_STRING:
    state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
    break;
  case CMD_DEVICE_INFO:
    state = resp.arg[0];
    break;
  default:
    fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
    exit(-1);
    break;
  }

  return state;
}

unsigned int EnterFlashState(void)
{
  unsigned int state = GetProxmarkState();

  if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
    /* Already in flash state, we're done. */
    return state;
  }

  if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
    fprintf(stderr,"Entering flash-mode...\n");
    UsbCommand c;
    bzero(&c, sizeof(c));

    if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) {
      /* New style handover: Send CMD_START_FLASH, which will reset the board and
       * enter the bootrom on the next boot.
      */
      c.cmd = CMD_START_FLASH;
      SendCommand(&c);
      fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
      fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
    } else {
      /* Old style handover: Ask the user to press the button, then reset the board */
      c.cmd = CMD_HARDWARE_RESET;
      SendCommand(&c);
      fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
      fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
    }

#ifdef WIN32
    Sleep(1000);
    while (!UsbConnect()) { Sleep(1000); }
#else
    CloseProxmark();
    sleep(1);

    while (!OpenProxmark(0)) { sleep(1); }
#endif
    fprintf(stderr,"Found.\n");

    return GetProxmarkState();
  }

  return 0;
}

/* On first call, have *offset = -1, *length = 0; */
int find_next_area(const char *str, int *offset, int *length)
{
  if (*str == '\0') return 0;
  if ((*offset >= 0) && str[*offset + *length] == '\0') return 0;
  *offset += 1 + *length;

  char *next_comma = strchr(str + *offset, ',');
  if (next_comma == NULL) {
    *length = strlen(str) - *offset;
  } else {
    *length = next_comma-(str+*offset);
  }
  return 1;
}

void do_flash(char **argv)
{
  unsigned int state = EnterFlashState();

  if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
    fprintf(stderr, "Proxmark would not enter flash state, abort\n");
    exit(-1);
  }

  int offset=-1, length=0;
  int current_area = 0;
  while (find_next_area(argv[1], &offset, &length)) {
    struct partition *p = NULL;
    for (int i = 0; i<sizeof(partitions)/sizeof(partitions[0]); ++i) {
      if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
        /* Check if the name matches the bootrom partition, and if so, require "bootrom" to
         * be written in full. The other names may be abbreviated.
        */
        if(!partitions[i].precious || (strlen(partitions[i].name) == length))
          p = &partitions[i];
        break;
      }
    }

    if (p == NULL) {
      fprintf(stderr, "Warning: area name '");
      fwrite(argv[1]+offset, length, 1, stderr);
      fprintf(stderr, "' unknown, ignored\n");
    } else {
      fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
      PrepareFlash(p, argv[2+current_area], state);
    }
    current_area++;
  }
}
Commit	Line	Data
6e4d4ee6	1	#ifdef WIN32
	2	#include <windows.h>
	3	#include <setupapi.h>
6e4d4ee6	4	#define bzero(b,len) (memset((b), '\0', (len)), (void) 0)
	5	BOOL UsbConnect(void);
	6	#else
7fe9b0b7	7	#include <proxusb.h>
6e4d4ee6	8	#endif
7fe9b0b7	9
393c3ef9	10	#include <usb_cmd.h>
6e4d4ee6	11	#include <stdio.h>
6e4d4ee6	12	#include <string.h>
83a9b236	13	#include <stdlib.h>
393c3ef9	14	#include <stdint.h>
6e4d4ee6	15	#include "flash.h"
2cab856f	16	#include "elf.h"
393c3ef9	17	#include "proxusb.h"
6e4d4ee6	18
	19	static uint32_t ExpectedAddr;
	20	static uint8_t QueuedToSend[256];
393c3ef9	21	static BOOL AllWritten;
6e4d4ee6	22	#define PHYSICAL_FLASH_START 0x100000
2cab856f	23	#define PHYSICAL_FLASH_END 0x200000
6e4d4ee6	24
7fe9b0b7	25	void WaitForAck(void)
	26	{
	27	UsbCommand ack;
	28	ReceiveCommand(&ack);
	29	if (ack.cmd != CMD_ACK) {
	30	printf("bad ACK\n");
	31	exit(-1);
	32	}
6e4d4ee6	33	}
	34
	35	struct partition partitions[] = {
7fe9b0b7	36	{0x100000, 0x102000, 1, "bootrom"},
	37	{0x102000, 0x110000, 0, "fpga"},
	38	{0x110000, 0x140000, 0, "os"},
	39	{0, 0, 0, NULL},
6e4d4ee6	40	};
6e4d4ee6	41
2cab856f	42	void WriteBlock(unsigned int block_start, unsigned int len, unsigned char *buf)
6e4d4ee6	43	{
7fe9b0b7	44	unsigned char temp_buf[256];
	45	if (block_start & 0xFF) {
	46	printf("moving stuff forward by %d bytes\n", block_start & 0xFF);
	47	memset(temp_buf, 0xFF, block_start & 0xFF);
	48	memcpy(temp_buf + (block_start & 0xFF), buf, len - (block_start & 0xFF));
	49	block_start &= ~0xFF;
	50	} else {
	51	memcpy(temp_buf, buf, len);
	52	}
	53
	54	UsbCommand c = {CMD_SETUP_WRITE};
	55
	56	for (int i = 0; i < 240; i += 48) {
	57	memcpy(c.d.asBytes, temp_buf+i, 48);
	58	c.arg[0] = (i/4);
	59	SendCommand(&c);
	60	WaitForAck();
	61	}
	62
	63	c.cmd = CMD_FINISH_WRITE;
	64	c.arg[0] = block_start;
	65
	66	// printf("writing block %08x\r", c.arg[0]);
	67	memcpy(c.d.asBytes, temp_buf+240, 16);
	68	SendCommand(&c);
	69	WaitForAck();
	70
	71	AllWritten = true;
6e4d4ee6	72	}
6e4d4ee6	73
2cab856f	74	void LoadFlashFromFile(const char *file, int start_addr, int end_addr)
6e4d4ee6	75	{
7fe9b0b7	76	FILE *f = fopen(file, "rb");
	77	if (!f) {
	78	printf("couldn't open file\n");
	79	exit(-1);
	80	}
	81
	82	char buf[4];
	83	fread(buf, 1, 4, f);
	84	if (memcmp(buf, "\x7F" "ELF", 4) == 0) {
	85	fseek(f, 0, SEEK_SET);
	86	Elf32_Ehdr header;
	87	fread(&header, 1, sizeof(header), f);
	88	int count = header.e_phnum;
	89	printf("count=%d phoff=%x\n", count, header.e_phoff);
	90	Elf32_Phdr phdr;
	91
	92	for (int i = 0; i < header.e_phnum; ++i) {
	93	fseek(f, header.e_phoff + i * sizeof(Elf32_Phdr), SEEK_SET);
	94	fread(&phdr, 1, sizeof(phdr), f);
	95	printf("type=%d offset=%x paddr=%x vaddr=%x filesize=%x memsize=%x flags=%x align=%x\n",
	96	phdr.p_type, phdr.p_offset, phdr.p_paddr, phdr.p_vaddr, phdr.p_filesz, phdr.p_memsz, phdr.p_flags, phdr.p_align);
	97	if (phdr.p_type == PT_LOAD && phdr.p_filesz > 0 && phdr.p_paddr >= PHYSICAL_FLASH_START
	98	&& (phdr.p_paddr + phdr.p_filesz) < PHYSICAL_FLASH_END) {
	99	printf("flashing offset=%x paddr=%x size=%x\n", phdr.p_offset, phdr.p_paddr, phdr.p_filesz);
	100	if (phdr.p_offset == 0) {
	101	printf("skipping forward 0x2000 because of strange linker thing\n");
	102	phdr.p_offset += 0x2000;
	103	phdr.p_paddr += 0x2000;
	104	phdr.p_filesz -= 0x2000;
	105	phdr.p_memsz -= 0x2000;
2cab856f	106	}
6e4d4ee6	107
7fe9b0b7	108	fseek(f, phdr.p_offset, SEEK_SET);
	109	ExpectedAddr = phdr.p_paddr;
	110	while (ExpectedAddr < (phdr.p_paddr + phdr.p_filesz)) {
	111	unsigned int bytes_to_read = phdr.p_paddr + phdr.p_filesz - ExpectedAddr;
	112	if (bytes_to_read > 256)
	113	bytes_to_read=256;
	114	else
	115	memset(QueuedToSend, 0xFF, 256);
	116	fread(QueuedToSend, 1, bytes_to_read, f);
	117	printf("WriteBlock(%x, %d, %02x %02x %02x %02x %02x %02x %02x %02x ... %02x %02x %02x %02x %02x %02x %02x %02x)\n", ExpectedAddr, bytes_to_read,
	118	QueuedToSend[0], QueuedToSend[1], QueuedToSend[2], QueuedToSend[3],
	119	QueuedToSend[4], QueuedToSend[5], QueuedToSend[6], QueuedToSend[7],
	120	QueuedToSend[248], QueuedToSend[249], QueuedToSend[250], QueuedToSend[251],
	121	QueuedToSend[252], QueuedToSend[253], QueuedToSend[254], QueuedToSend[255]);
	122	WriteBlock(ExpectedAddr, 256, QueuedToSend);
	123	ExpectedAddr += bytes_to_read;
	124	}
	125	}
	126	}
	127
	128	fclose(f);
	129	printf("\ndone.\n");
	130	return;
	131	} else printf("Bad file format\n");
6e4d4ee6	132	}
	133
	134	int PrepareFlash(struct partition p, const char filename, unsigned int state)
	135	{
7fe9b0b7	136	if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
	137	UsbCommand c = {CMD_START_FLASH, {p->start, p->end, 0}};
	138
	139	/* Only send magic when flashing bootrom */
	140	if (p->precious)
	141	c.arg[2] = START_FLASH_MAGIC;
	142	else
	143	c.arg[2] = 0;
	144
	145	SendCommand(&c);
	146	WaitForAck();
	147	} else {
	148	fprintf(stderr, "Warning: Your bootloader does not understand the new START_FLASH command\n");
	149	fprintf(stderr, " It is recommended that you update your bootloader\n\n");
	150	exit(0);
	151	}
	152
	153	LoadFlashFromFile(filename, p->start, p->end);
	154	return 1;
6e4d4ee6	155	}
	156
	157	unsigned int GetProxmarkState(void)
	158	{
7fe9b0b7	159	unsigned int state = 0;
	160
	161	UsbCommand c;
	162	c.cmd = CMD_DEVICE_INFO;
	163	SendCommand(&c);
	164
	165	UsbCommand resp;
	166	ReceiveCommand(&resp);
	167	/* Three cases:
	168	* 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
	169	* 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
	170	* 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
	171	*/
	172
	173	switch (resp.cmd) {
	174	case CMD_ACK:
	175	state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
	176	break;
	177	case CMD_DEBUG_PRINT_STRING:
	178	state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
	179	break;
	180	case CMD_DEVICE_INFO:
	181	state = resp.arg[0];
	182	break;
	183	default:
	184	fprintf(stderr, "Couldn't get proxmark state, bad response type: 0x%04X\n", resp.cmd);
	185	exit(-1);
	186	break;
	187	}
	188
	189	return state;
6e4d4ee6	190	}
	191
	192	unsigned int EnterFlashState(void)
	193	{
7fe9b0b7	194	unsigned int state = GetProxmarkState();
	195
	196	if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
	197	/* Already in flash state, we're done. */
	198	return state;
	199	}
	200
	201	if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
	202	fprintf(stderr,"Entering flash-mode...\n");
	203	UsbCommand c;
	204	bzero(&c, sizeof(c));
	205
	206	if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) {
	207	/* New style handover: Send CMD_START_FLASH, which will reset the board and
	208	* enter the bootrom on the next boot.
	209	*/
	210	c.cmd = CMD_START_FLASH;
	211	SendCommand(&c);
	212	fprintf(stderr,"(You don't have to do anything. Press and release the button only if you want to abort)\n");
	213	fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
	214	} else {
	215	/* Old style handover: Ask the user to press the button, then reset the board */
	216	c.cmd = CMD_HARDWARE_RESET;
	217	SendCommand(&c);
	218	fprintf(stderr,"(Press and hold down button NOW if your bootloader requires it)\n");
	219	fprintf(stderr,"Waiting for Proxmark to reappear on USB... ");
	220	}
6e4d4ee6	221
6e4d4ee6	222	#ifdef WIN32
7fe9b0b7	223	Sleep(1000);
7fe9b0b7	224	while (!UsbConnect()) { Sleep(1000); }
6e4d4ee6	225	#else
7fe9b0b7	226	CloseProxmark();
7fe9b0b7	227	sleep(1);
6e4d4ee6	228
7fe9b0b7	229	while (!OpenProxmark(0)) { sleep(1); }
6e4d4ee6	230	#endif
7fe9b0b7	231	fprintf(stderr,"Found.\n");
	232
	233	return GetProxmarkState();
	234	}
6e4d4ee6	235
7fe9b0b7	236	return 0;
6e4d4ee6	237	}
	238
	239	/* On first call, have offset = -1, length = 0; */
	240	int find_next_area(const char str, int offset, int *length)
	241	{
7fe9b0b7	242	if (*str == '\0') return 0;
	243	if ((offset >= 0) && str[offset + *length] == '\0') return 0;
	244	offset += 1 + length;
	245
	246	char next_comma = strchr(str + offset, ',');
	247	if (next_comma == NULL) {
	248	length = strlen(str) - offset;
	249	} else {
	250	length = next_comma-(str+offset);
	251	}
	252	return 1;
6e4d4ee6	253	}
6e4d4ee6	254
7fe9b0b7	255	void do_flash(char **argv)
	256	{
	257	unsigned int state = EnterFlashState();
	258
	259	if (!(state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM)) {
	260	fprintf(stderr, "Proxmark would not enter flash state, abort\n");
	261	exit(-1);
	262	}
	263
	264	int offset=-1, length=0;
	265	int current_area = 0;
	266	while (find_next_area(argv[1], &offset, &length)) {
	267	struct partition *p = NULL;
	268	for (int i = 0; i<sizeof(partitions)/sizeof(partitions[0]); ++i) {
	269	if (strncmp(partitions[i].name, argv[1] + offset, length) == 0) {
	270	/* Check if the name matches the bootrom partition, and if so, require "bootrom" to
	271	* be written in full. The other names may be abbreviated.
	272	*/
	273	if(!partitions[i].precious \|\| (strlen(partitions[i].name) == length))
	274	p = &partitions[i];
	275	break;
	276	}
	277	}
	278
	279	if (p == NULL) {
	280	fprintf(stderr, "Warning: area name '");
	281	fwrite(argv[1]+offset, length, 1, stderr);
	282	fprintf(stderr, "' unknown, ignored\n");
	283	} else {
	284	fprintf(stderr, "Flashing %s from %s\n", p->name, argv[2+current_area]);
	285	PrepareFlash(p, argv[2+current_area], state);
	286	}
	287	current_area++;
	288	}
6e4d4ee6	289	}