#include <stdlib.h>
#include <stdio.h>


#define IMG_SIZE     0x3e0000

#define KERNEL_START 0x020000
#define KERNEL_SIZE  0x0b0000

#define ROOTFS_START 0x0d0000
#define ROOTFS_SIZE  0x30ffb2

char* app_name;




void print_usage(void)
{
  fprintf(stderr, "usage: dgfirmware [<opts>] <img>\n");
  fprintf(stderr, "  <img>               firmware image filename\n");
  fprintf(stderr, "  <opts>  -h          print this message\n");
  fprintf(stderr, "          -f          fix the checksum\n");
  fprintf(stderr, "          -x  <file>  extract the rootfs file to <file>\n");
  fprintf(stderr, "          -xk <file>  extract the kernel to <file>\n");
  fprintf(stderr, "          -m  <file>  merge in rootfs fil\e from <file>\n");
  fprintf(stderr, "          -k  <file>  merge in kernel from <file>\n");
  fprintf(stderr, "          -w  <file>  write back the modified firmware\n");
}


unsigned char* read_img(const char *fname)
{
  FILE *fp;
  int size;
  unsigned char *img;

  fp = fopen(fname, "rb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }

  fseek(fp, 0, SEEK_END);
  size = ftell(fp);
  
  if (size != IMG_SIZE) {
    fprintf(stderr, "%s: image file has wrong size\n", app_name);
    fclose(fp);
    exit(-1);
  }

  rewind(fp);

  img = malloc(IMG_SIZE);
  if (img == NULL) {
    perror(app_name);
    fclose(fp);
    exit(-1);
  }

  if (fread(img, 1, IMG_SIZE, fp) != IMG_SIZE) {
    fprintf(stderr, "%s: can't read image file\n", app_name);
    fclose(fp);
    exit(-1);
  }

  fclose(fp);
  return img;
}


void write_img(unsigned char* img, const char *fname)
{
  FILE *fp;

  fp = fopen(fname, "wb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }

  if (fwrite(img, 1, IMG_SIZE, fp) != IMG_SIZE) {
    fprintf(stderr, "%s: can't write image file\n", app_name);
    fclose(fp);
    exit(-1);
  }
}


void write_rootfs(unsigned char* img, const char *fname)
{
  FILE *fp;

  fp = fopen(fname, "wb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }
  
  if (fwrite(img+ROOTFS_START, 1, ROOTFS_SIZE, fp) != ROOTFS_SIZE) {
    fprintf(stderr, "%s: can't write image file\n", app_name);
    fclose(fp);
    exit(-1);
  }
}


void write_kernel(unsigned char* img, const char *fname)
{
  FILE *fp;

  fp = fopen(fname, "wb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }
  
  if (fwrite(img+KERNEL_START, 1, KERNEL_SIZE, fp) != KERNEL_SIZE) {
    fprintf(stderr, "%s: can't write kernel file\n", app_name);
    fclose(fp);
    exit(-1);
  }
}


unsigned char* read_rootfs(unsigned char* img, const char *fname)
{
  FILE *fp;
  int size;
  int i;

  for (i=ROOTFS_START; i<ROOTFS_START+ROOTFS_SIZE; i++)
    img[i] = 0xff;

  fp = fopen(fname, "rb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }

  fseek(fp, 0, SEEK_END);
  size = ftell(fp);
  
  if (size > ROOTFS_SIZE) {
    fprintf(stderr, "%s: rootfs image file is too big\n", app_name);
    fclose(fp);
    exit(-1);
  }

  rewind(fp);

  if (fread(img+ROOTFS_START, 1, size, fp) != size) {
    fprintf(stderr, "%s: can't read rootfs image file\n", app_name);
    fclose(fp);
    exit(-1);
  }

  fclose(fp);
  return img;
}


unsigned char* read_kernel(unsigned char* img, const char *fname)
{
  FILE *fp;
  int size;
  int i;

  for (i=KERNEL_START; i<KERNEL_START+KERNEL_SIZE; i++)
    img[i] = 0xff;

  fp = fopen(fname, "rb");
  if (fp == NULL) {
    perror(app_name);
    exit(-1);
  }

  fseek(fp, 0, SEEK_END);
  size = ftell(fp);
  
  if (size > KERNEL_SIZE) {
    fprintf(stderr, "%s: kernel binary file is too big\n", app_name);
    fclose(fp);
    exit(-1);
  }

  rewind(fp);

  if (fread(img+KERNEL_START, 1, size, fp) != size) {
    fprintf(stderr, "%s: can't read kernel file\n", app_name);
    fclose(fp);
    exit(-1);
  }

  fclose(fp);
  return img;
}


int get_checksum(unsigned char* img)
{
  short unsigned s;

  s = img[0x3dfffc] + (img[0x3dfffd]<<8);

  return s;
}


void set_checksum(unsigned char*img, unsigned short sum)
{
  img[0x3dfffc] = sum & 0xff;
  img[0x3dfffd] = (sum>>8) & 0xff;
}


int compute_checksum(unsigned char* img)
{
  int i;
  short s=0;

  for (i=0; i<0x3dfffc; i++)
    s += img[i];

  return s;
}


int main(int argc, char* argv[])
{
  char *img_fname     = NULL;
  char *rootfs_fname  = NULL;
  char *kernel_fname  = NULL;
  char *new_img_fname = NULL;

  int do_fix_checksum = 0;
  int do_write        = 0;
  int do_write_rootfs = 0;
  int do_read_rootfs  = 0;
  int do_write_kernel = 0;
  int do_read_kernel  = 0;

  int i;
  unsigned char *img;
  unsigned short img_checksum;
  unsigned short real_checksum;

  app_name = argv[0];

  for (i=1; i<argc; i++) {
    if (!strcmp(argv[i], "-h")) {
      print_usage();
      return 0;
    }
    else if (!strcmp(argv[i], "-f")) {
      do_fix_checksum = 1;
    }
    else if (!strcmp(argv[i], "-x")) {
      if (i+1 >= argc) {
	fprintf(stderr, "%s: missing argument\n", app_name);
	return -1;
      }
      do_write_rootfs = 1;
      rootfs_fname = argv[i+1];
      i++;
    }
    else if (!strcmp(argv[i], "-xk")) {
      if (i+1 >= argc) {
	fprintf(stderr, "%s: missing argument\n", app_name);
	return -1;
      }
      do_write_kernel = 1;
      kernel_fname = argv[i+1];
      i++;
    }
    else if (!strcmp(argv[i], "-m")) {
      if (i+1 >= argc) {
	fprintf(stderr, "%s: missing argument\n", app_name);
	return -1;
      }
      do_read_rootfs = 1;
      rootfs_fname = argv[i+1];
      i++;
    }
    else if (!strcmp(argv[i], "-k")) {
      if (i+1 >= argc) {
	fprintf(stderr, "%s: missing argument\n", app_name);
	return -1;
      }
      do_read_kernel = 1;
      kernel_fname = argv[i+1];
      i++;
    }
    else if (!strcmp(argv[i], "-w")) {
      if (i+1 >= argc) {
	fprintf(stderr, "%s: missing argument\n", app_name);
	return -1;
      }
      do_write = 1;
      new_img_fname = argv[i+1];
      i++;
    }
    else if (img_fname != 0) {
      fprintf(stderr, "%s: too many arguments\n", app_name);
      return -1;
    }
    else {
      img_fname = argv[i];
    }
  }

  if (img_fname == NULL) {
    fprintf(stderr, "%s: missing argument\n", app_name);
    return -1;
  }

  if ((do_read_rootfs && do_write_rootfs) ||
      (do_read_kernel && do_write_kernel)) {
    fprintf(stderr, "%s: conflictuous options\n", app_name);
    return -1;
  }

  printf ("** Read firmware file\n");
  img = read_img(img_fname);

  printf ("Firmware product: %s\n", img+0x3dffbd);
  printf ("Firmware version: 1.%02d.%02d\n", (img[0x3dffeb] & 0x7f), img[0x3dffec]);

  if (do_write_rootfs) {
    printf ("** Write rootfs file\n");
    write_rootfs(img, rootfs_fname);
  }

  if (do_write_kernel) {
    printf ("** Write kernel file\n");
    write_kernel(img, kernel_fname);
  }

  if (do_read_rootfs) {
    printf ("** Read rootfs file\n");
    read_rootfs(img, rootfs_fname);
    do_fix_checksum = 1;
  }

  if (do_read_kernel) {
    printf ("** Read kernel file\n");
    read_kernel(img, kernel_fname);
    do_fix_checksum = 1;
  }

  img_checksum = get_checksum(img);
  real_checksum = compute_checksum(img);
  
  printf ("image checksum = %04x\n", img_checksum);
  printf ("real checksum  = %04x\n", real_checksum);

  if (do_fix_checksum) {
    if (img_checksum != real_checksum) {
      printf ("** Bad Checksum, fix it\n");
      set_checksum(img, real_checksum);
    }
    else {
      printf ("** Checksum is correct, good\n");
    }
  }

  if (do_write) {
    printf ("** Write image file\n");
    write_img(img, new_img_fname);
  }

  free(img);
  return 0;
}

127'>127</a>
<a id='n128' href='#n128'>128</a>
<a id='n129' href='#n129'>129</a>
<a id='n130' href='#n130'>130</a>
<a id='n131' href='#n131'>131</a>
<a id='n132' href='#n132'>132</a>
<a id='n133' href='#n133'>133</a>
<a id='n134' href='#n134'>134</a>
<a id='n135' href='#n135'>135</a>
<a id='n136' href='#n136'>136</a>
<a id='n137' href='#n137'>137</a>
<a id='n138' href='#n138'>138</a>
<a id='n139' href='#n139'>139</a>
<a id='n140' href='#n140'>140</a>
<a id='n141' href='#n141'>141</a>
<a id='n142' href='#n142'>142</a>
<a id='n143' href='#n143'>143</a>
<a id='n144' href='#n144'>144</a>
<a id='n145' href='#n145'>145</a>
<a id='n146' href='#n146'>146</a>
<a id='n147' href='#n147'>147</a>
<a id='n148' href='#n148'>148</a>
<a id='n149' href='#n149'>149</a>
<a id='n150' href='#n150'>150</a>
<a id='n151' href='#n151'>151</a>
<a id='n152' href='#n152'>152</a>
<a id='n153' href='#n153'>153</a>
<a id='n154' href='#n154'>154</a>
<a id='n155' href='#n155'>155</a>
<a id='n156' href='#n156'>156</a>
<a id='n157' href='#n157'>157</a>
<a id='n158' href='#n158'>158</a>
<a id='n159' href='#n159'>159</a>
<a id='n160' href='#n160'>160</a>
<a id='n161' href='#n161'>161</a>
<a id='n162' href='#n162'>162</a>
<a id='n163' href='#n163'>163</a>
<a id='n164' href='#n164'>164</a>
<a id='n165' href='#n165'>165</a>
<a id='n166' href='#n166'>166</a>
<a id='n167' href='#n167'>167</a>
<a id='n168' href='#n168'>168</a>
<a id='n169' href='#n169'>169</a>
<a id='n170' href='#n170'>170</a>
<a id='n171' href='#n171'>171</a>
<a id='n172' href='#n172'>172</a>
<a id='n173' href='#n173'>173</a>
<a id='n174' href='#n174'>174</a>
<a id='n175' href='#n175'>175</a>
<a id='n176' href='#n176'>176</a>
<a id='n177' href='#n177'>177</a>
<a id='n178' href='#n178'>178</a>
<a id='n179' href='#n179'>179</a>
<a id='n180' href='#n180'>180</a>
<a id='n181' href='#n181'>181</a>
<a id='n182' href='#n182'>182</a>
<a id='n183' href='#n183'>183</a>
<a id='n184' href='#n184'>184</a>
<a id='n185' href='#n185'>185</a>
<a id='n186' href='#n186'>186</a>
<a id='n187' href='#n187'>187</a>
<a id='n188' href='#n188'>188</a>
<a id='n189' href='#n189'>189</a>
<a id='n190' href='#n190'>190</a>
<a id='n191' href='#n191'>191</a>
<a id='n192' href='#n192'>192</a>
<a id='n193' href='#n193'>193</a>
<a id='n194' href='#n194'>194</a>
<a id='n195' href='#n195'>195</a>
<a id='n196' href='#n196'>196</a>
<a id='n197' href='#n197'>197</a>
<a id='n198' href='#n198'>198</a>
<a id='n199' href='#n199'>199</a>
<a id='n200' href='#n200'>200</a>
<a id='n201' href='#n201'>201</a>
<a id='n202' href='#n202'>202</a>
<a id='n203' href='#n203'>203</a>
<a id='n204' href='#n204'>204</a>
<a id='n205' href='#n205'>205</a>
<a id='n206' href='#n206'>206</a>
<a id='n207' href='#n207'>207</a>
<a id='n208' href='#n208'>208</a>
<a id='n209' href='#n209'>209</a>
<a id='n210' href='#n210'>210</a>
<a id='n211' href='#n211'>211</a>
<a id='n212' href='#n212'>212</a>
<a id='n213' href='#n213'>213</a>
<a id='n214' href='#n214'>214</a>
<a id='n215' href='#n215'>215</a>
<a id='n216' href='#n216'>216</a>
<a id='n217' href='#n217'>217</a>
<a id='n218' href='#n218'>218</a>
<a id='n219' href='#n219'>219</a>
<a id='n220' href='#n220'>220</a>
<a id='n221' href='#n221'>221</a>
<a id='n222' href='#n222'>222</a>
<a id='n223' href='#n223'>223</a>
<a id='n224' href='#n224'>224</a>
<a id='n225' href='#n225'>225</a>
<a id='n226' href='#n226'>226</a>
<a id='n227' href='#n227'>227</a>
<a id='n228' href='#n228'>228</a>
<a id='n229' href='#n229'>229</a>
<a id='n230' href='#n230'>230</a>
<a id='n231' href='#n231'>231</a>
<a id='n232' href='#n232'>232</a>
<a id='n233' href='#n233'>233</a>
<a id='n234' href='#n234'>234</a>
<a id='n235' href='#n235'>235</a>
<a id='n236' href='#n236'>236</a>
<a id='n237' href='#n237'>237</a>
<a id='n238' href='#n238'>238</a>
<a id='n239' href='#n239'>239</a>
<a id='n240' href='#n240'>240</a>
<a id='n241' href='#n241'>241</a>
<a id='n242' href='#n242'>242</a>
<a id='n243' href='#n243'>243</a>
<a id='n244' href='#n244'>244</a>
<a id='n245' href='#n245'>245</a>
<a id='n246' href='#n246'>246</a>
<a id='n247' href='#n247'>247</a>
<a id='n248' href='#n248'>248</a>
<a id='n249' href='#n249'>249</a>
<a id='n250' href='#n250'>250</a>
<a id='n251' href='#n251'>251</a>
<a id='n252' href='#n252'>252</a>
<a id='n253' href='#n253'>253</a>
<a id='n254' href='#n254'>254</a>
<a id='n255' href='#n255'>255</a>
<a id='n256' href='#n256'>256</a>
<a id='n257' href='#n257'>257</a>
<a id='n258' href='#n258'>258</a>
<a id='n259' href='#n259'>259</a>
<a id='n260' href='#n260'>260</a>
<a id='n261' href='#n261'>261</a>
<a id='n262' href='#n262'>262</a>
<a id='n263' href='#n263'>263</a>
<a id='n264' href='#n264'>264</a>
<a id='n265' href='#n265'>265</a>
</pre></td>
<td class='lines'><pre><code>