| 1 | //----------------------------------------------------------------------------- |
| 2 | // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com> |
| 3 | // |
| 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 5 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 6 | // the license. |
| 7 | //----------------------------------------------------------------------------- |
| 8 | // ELF file flasher |
| 9 | //----------------------------------------------------------------------------- |
| 10 | |
| 11 | #include <stdio.h> |
| 12 | #include <string.h> |
| 13 | #include <stdlib.h> |
| 14 | #include "proxmark3.h" |
| 15 | #include "sleep.h" |
| 16 | #include "flash.h" |
| 17 | #include "elf.h" |
| 18 | #include "proxendian.h" |
| 19 | #include "usb_cmd.h" |
| 20 | #include "at91sam7s512.h" |
| 21 | |
| 22 | void SendCommand(UsbCommand* txcmd); |
| 23 | void ReceiveCommand(UsbCommand* rxcmd); |
| 24 | void CloseProxmark(); |
| 25 | int OpenProxmark(size_t i); |
| 26 | |
| 27 | // FIXME: what the fuckity fuck |
| 28 | unsigned int current_command = CMD_UNKNOWN; |
| 29 | |
| 30 | #define FLASH_START 0x100000 |
| 31 | #define FLASH_SIZE (256*1024) |
| 32 | #define FLASH_END (FLASH_START + FLASH_SIZE) |
| 33 | #define BOOTLOADER_SIZE 0x2000 |
| 34 | #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE) |
| 35 | |
| 36 | #define BLOCK_SIZE 0x200 |
| 37 | |
| 38 | static const uint8_t elf_ident[] = { |
| 39 | 0x7f, 'E', 'L', 'F', |
| 40 | ELFCLASS32, |
| 41 | ELFDATA2LSB, |
| 42 | EV_CURRENT |
| 43 | }; |
| 44 | |
| 45 | // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent |
| 46 | // unaligned segments if needed |
| 47 | static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs) |
| 48 | { |
| 49 | Elf32_Phdr *phdr = phdrs; |
| 50 | flash_seg_t *seg; |
| 51 | uint32_t last_end = 0; |
| 52 | |
| 53 | ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs); |
| 54 | if (!ctx->segments) { |
| 55 | fprintf(stderr, "Out of memory\n"); |
| 56 | return -1; |
| 57 | } |
| 58 | ctx->num_segs = 0; |
| 59 | seg = ctx->segments; |
| 60 | |
| 61 | fprintf(stderr, "Loading usable ELF segments:\n"); |
| 62 | for (int i = 0; i < num_phdrs; i++) { |
| 63 | if (le32(phdr->p_type) != PT_LOAD) { |
| 64 | phdr++; |
| 65 | continue; |
| 66 | } |
| 67 | uint32_t vaddr = le32(phdr->p_vaddr); |
| 68 | uint32_t paddr = le32(phdr->p_paddr); |
| 69 | uint32_t filesz = le32(phdr->p_filesz); |
| 70 | uint32_t memsz = le32(phdr->p_memsz); |
| 71 | uint32_t offset = le32(phdr->p_offset); |
| 72 | uint32_t flags = le32(phdr->p_flags); |
| 73 | if (!filesz) { |
| 74 | phdr++; |
| 75 | continue; |
| 76 | } |
| 77 | fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n", |
| 78 | i, vaddr, paddr, filesz, memsz, |
| 79 | flags & PF_R ? 'R' : ' ', |
| 80 | flags & PF_W ? 'W' : ' ', |
| 81 | flags & PF_X ? 'X' : ' ', |
| 82 | offset); |
| 83 | if (filesz != memsz) { |
| 84 | fprintf(stderr, "Error: PHDR file size does not equal memory size\n" |
| 85 | "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n"); |
| 86 | return -1; |
| 87 | } |
| 88 | if (paddr < last_end) { |
| 89 | fprintf(stderr, "Error: PHDRs not sorted or overlap\n"); |
| 90 | return -1; |
| 91 | } |
| 92 | if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) { |
| 93 | fprintf(stderr, "Error: PHDR is not contained in Flash\n"); |
| 94 | return -1; |
| 95 | } |
| 96 | if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) { |
| 97 | fprintf(stderr, "Error: Flash VMA segment is writable\n"); |
| 98 | return -1; |
| 99 | } |
| 100 | |
| 101 | uint8_t *data; |
| 102 | // make extra space if we need to move the data forward |
| 103 | data = malloc(filesz + BLOCK_SIZE); |
| 104 | if (!data) { |
| 105 | fprintf(stderr, "Out of memory\n"); |
| 106 | return -1; |
| 107 | } |
| 108 | if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) { |
| 109 | fprintf(stderr, "Error while reading PHDR payload\n"); |
| 110 | free(data); |
| 111 | return -1; |
| 112 | } |
| 113 | |
| 114 | uint32_t block_offset = paddr & (BLOCK_SIZE-1); |
| 115 | if (block_offset) { |
| 116 | if (ctx->num_segs) { |
| 117 | flash_seg_t *prev_seg = seg - 1; |
| 118 | uint32_t this_end = paddr + filesz; |
| 119 | uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1); |
| 120 | uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1); |
| 121 | |
| 122 | if (this_firstblock == prev_lastblock) { |
| 123 | uint32_t new_length = this_end - prev_seg->start; |
| 124 | uint32_t this_offset = paddr - prev_seg->start; |
| 125 | uint32_t hole = this_offset - prev_seg->length; |
| 126 | uint8_t *new_data = malloc(new_length); |
| 127 | if (!new_data) { |
| 128 | fprintf(stderr, "Out of memory\n"); |
| 129 | free(data); |
| 130 | return -1; |
| 131 | } |
| 132 | memset(new_data, 0xff, new_length); |
| 133 | memcpy(new_data, prev_seg->data, prev_seg->length); |
| 134 | memcpy(new_data + this_offset, data, filesz); |
| 135 | fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n", |
| 136 | prev_seg->length, new_length); |
| 137 | if (hole) |
| 138 | fprintf(stderr, "Note: 0x%x-byte hole created\n", hole); |
| 139 | free(data); |
| 140 | free(prev_seg->data); |
| 141 | prev_seg->data = new_data; |
| 142 | prev_seg->length = new_length; |
| 143 | last_end = this_end; |
| 144 | phdr++; |
| 145 | continue; |
| 146 | } |
| 147 | } |
| 148 | fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n"); |
| 149 | memmove(data + block_offset, data, filesz); |
| 150 | memset(data, 0xFF, block_offset); |
| 151 | filesz += block_offset; |
| 152 | paddr -= block_offset; |
| 153 | } |
| 154 | |
| 155 | seg->data = data; |
| 156 | seg->start = paddr; |
| 157 | seg->length = filesz; |
| 158 | seg++; |
| 159 | ctx->num_segs++; |
| 160 | |
| 161 | last_end = paddr + filesz; |
| 162 | phdr++; |
| 163 | } |
| 164 | return 0; |
| 165 | } |
| 166 | |
| 167 | // Sanity check segments and check for bootloader writes |
| 168 | static int check_segs(flash_file_t *ctx, int can_write_bl) { |
| 169 | for (int i = 0; i < ctx->num_segs; i++) { |
| 170 | flash_seg_t *seg = &ctx->segments[i]; |
| 171 | |
| 172 | if (seg->start & (BLOCK_SIZE-1)) { |
| 173 | fprintf(stderr, "Error: Segment is not aligned\n"); |
| 174 | return -1; |
| 175 | } |
| 176 | if (seg->start < FLASH_START) { |
| 177 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); |
| 178 | return -1; |
| 179 | } |
| 180 | if (seg->start + seg->length > FLASH_END) { |
| 181 | fprintf(stderr, "Error: Segment is outside of flash bounds\n"); |
| 182 | return -1; |
| 183 | } |
| 184 | if (!can_write_bl && seg->start < BOOTLOADER_END) { |
| 185 | fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n"); |
| 186 | return -1; |
| 187 | } |
| 188 | } |
| 189 | return 0; |
| 190 | } |
| 191 | |
| 192 | // Load an ELF file and prepare it for flashing |
| 193 | int flash_load(flash_file_t *ctx, const char *name, int can_write_bl) |
| 194 | { |
| 195 | FILE *fd = NULL; |
| 196 | Elf32_Ehdr ehdr; |
| 197 | Elf32_Phdr *phdrs = NULL; |
| 198 | int num_phdrs; |
| 199 | int res; |
| 200 | |
| 201 | fd = fopen(name, "rb"); |
| 202 | if (!fd) { |
| 203 | fprintf(stderr, "Could not open file '%s': ", name); |
| 204 | perror(NULL); |
| 205 | goto fail; |
| 206 | } |
| 207 | |
| 208 | fprintf(stderr, "Loading ELF file '%s'...\n", name); |
| 209 | |
| 210 | if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) { |
| 211 | fprintf(stderr, "Error while reading ELF file header\n"); |
| 212 | goto fail; |
| 213 | } |
| 214 | if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident)) |
| 215 | || le32(ehdr.e_version) != 1) |
| 216 | { |
| 217 | fprintf(stderr, "Not an ELF file or wrong ELF type\n"); |
| 218 | goto fail; |
| 219 | } |
| 220 | if (le16(ehdr.e_type) != ET_EXEC) { |
| 221 | fprintf(stderr, "ELF is not executable\n"); |
| 222 | goto fail; |
| 223 | } |
| 224 | if (le16(ehdr.e_machine) != EM_ARM) { |
| 225 | fprintf(stderr, "Wrong ELF architecture\n"); |
| 226 | goto fail; |
| 227 | } |
| 228 | if (!ehdr.e_phnum || !ehdr.e_phoff) { |
| 229 | fprintf(stderr, "ELF has no PHDRs\n"); |
| 230 | goto fail; |
| 231 | } |
| 232 | if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) { |
| 233 | // could be a structure padding issue... |
| 234 | fprintf(stderr, "Either the ELF file or this code is made of fail\n"); |
| 235 | goto fail; |
| 236 | } |
| 237 | num_phdrs = le16(ehdr.e_phnum); |
| 238 | |
| 239 | phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr)); |
| 240 | if (!phdrs) { |
| 241 | fprintf(stderr, "Out of memory\n"); |
| 242 | goto fail; |
| 243 | } |
| 244 | if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) { |
| 245 | fprintf(stderr, "Error while reading ELF PHDRs\n"); |
| 246 | goto fail; |
| 247 | } |
| 248 | if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) { |
| 249 | fprintf(stderr, "Error while reading ELF PHDRs\n"); |
| 250 | goto fail; |
| 251 | } |
| 252 | |
| 253 | res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs); |
| 254 | if (res < 0) |
| 255 | goto fail; |
| 256 | res = check_segs(ctx, can_write_bl); |
| 257 | if (res < 0) |
| 258 | goto fail; |
| 259 | |
| 260 | free(phdrs); |
| 261 | fclose(fd); |
| 262 | ctx->filename = name; |
| 263 | return 0; |
| 264 | |
| 265 | fail: |
| 266 | if (phdrs) |
| 267 | free(phdrs); |
| 268 | if (fd) |
| 269 | fclose(fd); |
| 270 | flash_free(ctx); |
| 271 | return -1; |
| 272 | } |
| 273 | |
| 274 | // Get the state of the proxmark, backwards compatible |
| 275 | static int get_proxmark_state(uint32_t *state) |
| 276 | { |
| 277 | UsbCommand c; |
| 278 | c.cmd = CMD_DEVICE_INFO; |
| 279 | SendCommand(&c); |
| 280 | UsbCommand resp; |
| 281 | ReceiveCommand(&resp); |
| 282 | |
| 283 | // Three outcomes: |
| 284 | // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK |
| 285 | // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command" |
| 286 | // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags |
| 287 | |
| 288 | switch (resp.cmd) { |
| 289 | case CMD_ACK: |
| 290 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM; |
| 291 | break; |
| 292 | case CMD_DEBUG_PRINT_STRING: |
| 293 | *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS; |
| 294 | break; |
| 295 | case CMD_DEVICE_INFO: |
| 296 | *state = resp.arg[0]; |
| 297 | break; |
| 298 | default: |
| 299 | fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04"llx"\n", resp.cmd); |
| 300 | return -1; |
| 301 | break; |
| 302 | } |
| 303 | |
| 304 | return 0; |
| 305 | } |
| 306 | |
| 307 | // Enter the bootloader to be able to start flashing |
| 308 | static int enter_bootloader(char *serial_port_name) |
| 309 | { |
| 310 | uint32_t state; |
| 311 | |
| 312 | if (get_proxmark_state(&state) < 0) |
| 313 | return -1; |
| 314 | |
| 315 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) { |
| 316 | /* Already in flash state, we're done. */ |
| 317 | return 0; |
| 318 | } |
| 319 | |
| 320 | if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) { |
| 321 | fprintf(stderr,"Entering bootloader...\n"); |
| 322 | UsbCommand c; |
| 323 | memset(&c, 0, sizeof (c)); |
| 324 | |
| 325 | if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT) |
| 326 | && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT)) |
| 327 | { |
| 328 | // New style handover: Send CMD_START_FLASH, which will reset the board |
| 329 | // and enter the bootrom on the next boot. |
| 330 | c.cmd = CMD_START_FLASH; |
| 331 | SendCommand(&c); |
| 332 | fprintf(stderr,"(Press and release the button only to abort)\n"); |
| 333 | } else { |
| 334 | // Old style handover: Ask the user to press the button, then reset the board |
| 335 | c.cmd = CMD_HARDWARE_RESET; |
| 336 | SendCommand(&c); |
| 337 | fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n"); |
| 338 | } |
| 339 | msleep(100); |
| 340 | CloseProxmark(); |
| 341 | |
| 342 | fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name); |
| 343 | do { |
| 344 | sleep(1); |
| 345 | fprintf(stderr, "."); |
| 346 | } while (!OpenProxmark(0)); |
| 347 | fprintf(stderr," Found.\n"); |
| 348 | |
| 349 | return 0; |
| 350 | } |
| 351 | |
| 352 | fprintf(stderr, "Error: Unknown Proxmark mode\n"); |
| 353 | return -1; |
| 354 | } |
| 355 | |
| 356 | static int wait_for_ack(UsbCommand *ack) |
| 357 | { |
| 358 | ReceiveCommand(ack); |
| 359 | if (ack->cmd != CMD_ACK) { |
| 360 | printf("Error: Unexpected reply 0x%04"llx" (expected ACK)\n", ack->cmd); |
| 361 | return -1; |
| 362 | } |
| 363 | return 0; |
| 364 | } |
| 365 | |
| 366 | // Go into flashing mode |
| 367 | int flash_start_flashing(int enable_bl_writes,char *serial_port_name) |
| 368 | { |
| 369 | uint32_t state; |
| 370 | |
| 371 | if (enter_bootloader(serial_port_name) < 0) |
| 372 | return -1; |
| 373 | |
| 374 | if (get_proxmark_state(&state) < 0) |
| 375 | return -1; |
| 376 | |
| 377 | if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) { |
| 378 | // This command is stupid. Why the heck does it care which area we're |
| 379 | // flashing, as long as it's not the bootloader area? The mind boggles. |
| 380 | UsbCommand c = {CMD_START_FLASH}; |
| 381 | |
| 382 | if (enable_bl_writes) { |
| 383 | c.arg[0] = FLASH_START; |
| 384 | c.arg[1] = FLASH_END; |
| 385 | c.arg[2] = START_FLASH_MAGIC; |
| 386 | } else { |
| 387 | c.arg[0] = BOOTLOADER_END; |
| 388 | c.arg[1] = FLASH_END; |
| 389 | c.arg[2] = 0; |
| 390 | } |
| 391 | SendCommand(&c); |
| 392 | return wait_for_ack(&c); |
| 393 | } else { |
| 394 | fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n"); |
| 395 | fprintf(stderr, " It is recommended that you update your bootloader\n\n"); |
| 396 | } |
| 397 | |
| 398 | return 0; |
| 399 | } |
| 400 | |
| 401 | static int write_block(uint32_t address, uint8_t *data, uint32_t length) |
| 402 | { |
| 403 | uint8_t block_buf[BLOCK_SIZE]; |
| 404 | |
| 405 | memset(block_buf, 0xFF, BLOCK_SIZE); |
| 406 | memcpy(block_buf, data, length); |
| 407 | UsbCommand c; |
| 408 | c.cmd = CMD_FINISH_WRITE; |
| 409 | c.arg[0] = address; |
| 410 | memcpy(c.d.asBytes, block_buf, length); |
| 411 | SendCommand(&c); |
| 412 | int ret = wait_for_ack(&c); |
| 413 | if (ret && c.arg[0]) { |
| 414 | uint32_t lock_bits = c.arg[0] >> 16; |
| 415 | bool lock_error = c.arg[0] & AT91C_MC_LOCKE; |
| 416 | bool prog_error = c.arg[0] & AT91C_MC_PROGE; |
| 417 | bool security_bit = c.arg[0] & AT91C_MC_SECURITY; |
| 418 | printf("%s", lock_error?" Lock Error\n":""); |
| 419 | printf("%s", prog_error?" Invalid Command or bad Keyword\n":""); |
| 420 | printf("%s", security_bit?" Security Bit is set!\n":""); |
| 421 | printf(" Lock Bits: 0x%04x\n", lock_bits); |
| 422 | } |
| 423 | return ret; |
| 424 | } |
| 425 | |
| 426 | // Write a file's segments to Flash |
| 427 | int flash_write(flash_file_t *ctx) |
| 428 | { |
| 429 | fprintf(stderr, "Writing segments for file: %s\n", ctx->filename); |
| 430 | for (int i = 0; i < ctx->num_segs; i++) { |
| 431 | flash_seg_t *seg = &ctx->segments[i]; |
| 432 | |
| 433 | uint32_t length = seg->length; |
| 434 | uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE; |
| 435 | uint32_t end = seg->start + length; |
| 436 | |
| 437 | fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]", |
| 438 | seg->start, end - 1, length, blocks); |
| 439 | |
| 440 | int block = 0; |
| 441 | uint8_t *data = seg->data; |
| 442 | uint32_t baddr = seg->start; |
| 443 | |
| 444 | while (length) { |
| 445 | uint32_t block_size = length; |
| 446 | if (block_size > BLOCK_SIZE) |
| 447 | block_size = BLOCK_SIZE; |
| 448 | |
| 449 | if (write_block(baddr, data, block_size) < 0) { |
| 450 | fprintf(stderr, " ERROR\n"); |
| 451 | fprintf(stderr, "Error writing block %d of %d\n", block, blocks); |
| 452 | return -1; |
| 453 | } |
| 454 | |
| 455 | data += block_size; |
| 456 | baddr += block_size; |
| 457 | length -= block_size; |
| 458 | block++; |
| 459 | fprintf(stderr, "."); |
| 460 | } |
| 461 | fprintf(stderr, " OK\n"); |
| 462 | } |
| 463 | return 0; |
| 464 | } |
| 465 | |
| 466 | // free a file context |
| 467 | void flash_free(flash_file_t *ctx) |
| 468 | { |
| 469 | if (!ctx) |
| 470 | return; |
| 471 | if (ctx->segments) { |
| 472 | for (int i = 0; i < ctx->num_segs; i++) |
| 473 | free(ctx->segments[i].data); |
| 474 | free(ctx->segments); |
| 475 | ctx->segments = NULL; |
| 476 | ctx->num_segs = 0; |
| 477 | } |
| 478 | } |
| 479 | |
| 480 | // just reset the unit |
| 481 | int flash_stop_flashing(void) { |
| 482 | UsbCommand c = {CMD_HARDWARE_RESET}; |
| 483 | SendCommand(&c); |
| 484 | msleep(100); |
| 485 | return 0; |
| 486 | } |