utils/rk27utils/rkboottool/rkboottool.c

#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>

#define VERSION "v0.3"

/* time field stucture */
struct rktime_t
{
    uint16_t year;
    uint16_t month;
    uint16_t day;
    uint16_t hour;
    uint16_t minute;
    uint16_t second;
};

/* Rock27Boot.bin header structure */
struct rkboot_info_t
{
    char     sign[32];
    uint8_t  check_values[16];
    struct   rktime_t time;
    uint32_t ui_master_version;
    uint32_t ui_slave_version;
    uint32_t s1_offset;
    int32_t  s1_len;
    uint32_t s2_offset;
    int32_t  s2_len;
    uint32_t s3_offset;
    int32_t  s3_len;
    uint32_t s4_offset;
    int32_t  s4_len;
    uint32_t version_flag;
};

/* actions */
enum {
      NONE = 0,
      INFO = 1,
      EXTRACT = 2,
      SCRAMBLE = 4
};

/* scramble mode */
enum {
      CONTINOUS_ENC, /* scramble whole block at once */
      PAGE_ENC       /* nand bootloader is scrambled in 0x200 chunks */
};

/* scrambling/descrambling reverse engineered by AleMaxx */
static void encode_page(uint8_t *inpg, uint8_t *outpg, const int size)
{

uint8_t key[] = {
        0x7C, 0x4E, 0x03, 0x04,
        0x55, 0x05, 0x09, 0x07,
        0x2D, 0x2C, 0x7B, 0x38,
        0x17, 0x0D, 0x17, 0x11
};
        int i, i3, x, val, idx;

        uint8_t key1[0x100];
        uint8_t key2[0x100];

        for (i=0; i<0x100; i++) {
                key1[i] = i;
                key2[i] = key[i&0xf];
        }

        i3 = 0;
        for (i=0; i<0x100; i++) {
                x = key1[i];
                i3 = key1[i] + i3;
                i3 += key2[i];
                i3 &= 0xff;
                key1[i] = key1[i3];
                key1[i3] = x;
        }

        idx = 0;
        for (i=0; i<size; i++) {
                x = key1[(i+1) & 0xff];
                val = x;
                idx = (x + idx) & 0xff;
                key1[(i+1) & 0xff] = key1[idx];
                key1[idx] = (x & 0xff);
                val = (key1[(i+1)&0xff] + x) & 0xff;
                val = key1[val];
                outpg[i] = val ^ inpg[i];
        }
}

static void *binary_extract(FILE *fp, uint32_t offset, uint32_t len, int descramble, int encode_mode)
{
    void *buff, *buff_ptr;
    uint32_t ret;

    if ((fp == NULL) || len == 0)
        return NULL;

        /* allocate buff */
        if ((buff = malloc(len)) == NULL)
            return NULL;

        /* seek to the begining of the data */
        fseek(fp, offset, SEEK_SET);

        /* read into the buffer */
        ret = fread(buff, 1, len, fp);

        if (ret != len)
        {
            free(buff);
            return NULL;
        }

        /* descramble */
        if ( descramble )
        {
            buff_ptr = buff;
            if (encode_mode == PAGE_ENC)
            {
                while (len >= 0x200)
                {
                    encode_page((uint8_t *)buff_ptr,
                                (uint8_t *)buff_ptr,
                                0x200);

                    buff_ptr += 0x200;
                    len -= 0x200;
                }
            }
            encode_page((uint8_t *)buff_ptr, (uint8_t *)buff_ptr, len);
        }

    return buff;
}

static void usage(void)
{
    printf("Usage: rkboottool [options] Rock27Boot.bin\n");
    printf("-h|--help         This help message\n");
    printf("-e|--extract      Extract binary images from Rock27Boot.bin file\n");
    printf("-d|--descramble   Descramble extracted binary images\n");
    printf("-i|--info         Print info about Rock27Boot.bin file\n");
    printf("\n");
    printf("Usually you would like to use -d -e together to obtain raw binary\n");
    printf("(out files rkboot_s1.bin, rkboot_s2.bin, rkboot_s3.bin, rkboot_s4.bin)\n");
}

int main (int argc, char **argv)
{
    struct rkboot_info_t rkboot_info;
    FILE *fp_in, *fp_out;
    int32_t i = 0, action = NONE;
    int32_t ret;
    void *buff;
    char *in_filename = NULL;

    if ( argc < 2 )
    {
        usage();
        return -1;
    }

    /* print banner */
    fprintf(stderr,"rkboottool " VERSION "\n");
    fprintf(stderr,"(C) Marcin Bukat 2011\n");
    fprintf(stderr,"This is free software; see the source for copying conditions.  There is NO\n");
    fprintf(stderr,"warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n");

    /* arguments handling */
    while (i < argc)
    {
        if ((strcmp(argv[i],"-i")==0) || (strcmp(argv[i],"--info")==0))
        {
            action |= INFO;
        }
        else if ((strcmp(argv[i],"-e")==0) || (strcmp(argv[i],"--extract")==0))
        {
            action |= EXTRACT;
        }
        else if ((strcmp(argv[i],"-d")==0) || (strcmp(argv[i],"--descramble")==0))
        {
            action |= SCRAMBLE;
        }
        else if ((strcmp(argv[i],"-h")==0) || (strcmp(argv[i],"--help")==0))
        {
            usage();
            return 0;
        }
        else if ( argv[i][0] != '-' )
        {
            /* file argument */
            in_filename = argv[i];
        }
        i++;
    }

    if ( (fp_in = fopen(in_filename, "rb")) == NULL )
    {
        fprintf(stderr, "error: can't open %s file for reading\n", in_filename);
        return -1;
    }

    ret = fread(&rkboot_info, 1, sizeof(rkboot_info), fp_in);

    if (ret != sizeof(rkboot_info))
    {
        fclose(fp_in);
        fprintf(stderr, "error: can't read %s file header\n", in_filename);
        fprintf(stderr, "read %d, expected %d\n", ret, sizeof(rkboot_info));
        return -2;
    }

    if (action & INFO)
    {
        printf("file: %s\n", in_filename);
        printf("signature: %s\n", rkboot_info.sign);
        printf("check bytes: ");
        for (i = 0; i < 16; i++)
            printf("0x%0x ", rkboot_info.check_values[i]);

        printf("\n");
        printf("timestamp %d.%d.%d %d:%d:%d\n", rkboot_info.time.day,
                                                rkboot_info.time.month,
                                                rkboot_info.time.year,
                                                rkboot_info.time.hour,
                                                rkboot_info.time.minute,
                                                rkboot_info.time.second);
        printf("UI master version: 0x%0x\n", rkboot_info.ui_master_version);
        printf("UI slave version: 0x%0x\n", rkboot_info.ui_slave_version);
        printf("s1 data offset: 0x%0x\n", rkboot_info.s1_offset);
        printf("s1 data len: 0x%0x\n", rkboot_info.s1_len);
        printf("s2 offset: 0x%0x\n", rkboot_info.s2_offset);
        printf("s2 len: 0x%0x\n", rkboot_info.s2_len);
        printf("s3 offset: 0x%0x\n", rkboot_info.s3_offset);
        printf("s3 len: 0x%0x\n", rkboot_info.s3_len);
        printf("s4 offset: 0x%0x\n", rkboot_info.s4_offset);
        printf("s4 len: 0x%0x\n", rkboot_info.s4_len);
        printf("UI version flag: 0x%0x\n", rkboot_info.version_flag);
    }

    if (action & EXTRACT)
    {
        /* first stage */
        buff = binary_extract(fp_in, rkboot_info.s1_offset,
                                     rkboot_info.s1_len,
                                     action & SCRAMBLE,
                                     CONTINOUS_ENC);

        if ( buff == NULL )
        {
            fclose(fp_in);
            fprintf(stderr, "error: can't extract image\n");
            return -2;
        }

        /* output */
        if ((fp_out = fopen("rkboot_s1.bin", "wb")) == NULL)
        {
            free(buff);
            fclose(fp_in);
            fprintf(stderr, "[error]: can't open rkboot_s1.bin for writing\n");
            return -3;
        }

        fwrite(buff, 1, rkboot_info.s1_len, fp_out);
 
        fprintf(stderr, "[info]: extracted rkboot_s1.bin file\n");
        free(buff);
        fclose(fp_out);

        /* second stage */
        buff = binary_extract(fp_in, rkboot_info.s2_offset,
                                     rkboot_info.s2_len,
                                     action & SCRAMBLE,
                                     CONTINOUS_ENC);

        if ( buff == NULL )
        {
            fclose(fp_in);
            fprintf(stderr, "error: can't extract image\n");
            return -2;
        }

        if ((fp_out = fopen("rkboot_s2.bin", "wb")) == NULL)
        {
            free(buff);
            fclose(fp_in);
            fprintf(stderr, "[error]: can't open rkboot_s2.bin for writing\n");
            return -4;
        }

        fwrite(buff, 1, rkboot_info.s2_len, fp_out);

        fprintf(stderr, "[info]: extracted rkboot_s2.bin file\n");
        free(buff);
        fclose(fp_out);

        /* third stage */
        buff = binary_extract(fp_in, rkboot_info.s3_offset,
                                     rkboot_info.s3_len,
                                     action & SCRAMBLE,
                                     PAGE_ENC);
        if ( buff == NULL )
        {
            fclose(fp_in);
            fprintf(stderr, "[error]: can't extract image.\n");
            return -2;
        }

        if ((fp_out = fopen("rkboot_s3.bin", "wb")) == NULL)
        {
            free(buff);
            fclose(fp_in);
            fprintf(stderr, "[error]: can't open rkboot_s3.bin for writing\n");
            return -4;
        }

        fwrite(buff, 1, rkboot_info.s3_len, fp_out);

        fprintf(stderr, "[info]: extracted rkboot_s3.bin file\n");
        free(buff);
        fclose(fp_out);

        /* forth stage */
        buff = binary_extract(fp_in, rkboot_info.s4_offset,
                                     rkboot_info.s4_len,
                                     action & SCRAMBLE,
                                     CONTINOUS_ENC);
        if ( buff == NULL )
        {
            fclose(fp_in);
            fprintf(stderr, "[error]: can't extract image\n");
            return -2;
        }

        if ((fp_out = fopen("rkboot_s4.bin", "wb")) == NULL)
        {
            free(buff);
            fclose(fp_in);
            fprintf(stderr, "[error]: can't open rkboot_s4.bin for writing\n");
            return -4;
        }

        fwrite(buff, 1, rkboot_info.s4_len, fp_out);

        fprintf(stderr, "[info]: extracted rkboot_s4.bin file\n");
        free(buff);
        fclose(fp_out);
    }

    fclose(fp_in);
    return 0;
}