Read magic bytes from ofw bl directly (flash)

toniebox-reverse-engineering · Mar 7, 2021 · cb7d35d · cb7d35d
1 parent 897d947
commit cb7d35d
Show file tree

Hide file tree

Showing 5 changed files with 49 additions and 1 deletion.
diff --git a/sd-bootloader-ng/bootmanager/config.c b/sd-bootloader-ng/bootmanager/config.c
@@ -8,6 +8,7 @@ sGeneralSettings Config_generalSettings = {
   60,     //waitTimeoutInS
   2100,   //minBatteryLevel (Divide through around 700 to get voltage, so 3V should be save)
   0x0010014C, //ofwFixValue - Magic bytes from OFW BL
+  "\0",   //ofwFixFlash
   #ifdef NO_DEBUG_LOG
   false,  //serialLog
   #else
@@ -113,6 +114,10 @@ static void jsmn_str(const char *value, size_t len, void *user_arg) {
     if (strcmp("general", jsonGroupName) == 0) {
       if (strcmp("activeImg", jsonValueName) == 0) {
         Config_generalSettings.activeImage = getImageNumber(value);
+      } else if (strcmp("ofwFixFlash", jsonValueName) == 0) {
+        uint8_t cpyLen = min(len, CONFIG_FLASH_PATH_MAX-1);
+        strncpy(Config_generalSettings.ofwFixFlash, value, cpyLen);
+        Config_generalSettings.ofwFixFlash[cpyLen] = '\0';
       }
     } else if (strncmp(jsonGroupName, "ofw", 3) == 0
       || strncmp(jsonGroupName, "cfw", 3)

diff --git a/sd-bootloader-ng/bootmanager/config.h b/sd-bootloader-ng/bootmanager/config.h
@@ -24,6 +24,7 @@ typedef struct sGeneralSettings
   uint16_t waitTimeoutInS;
   uint16_t minBatteryLevel;
   uint32_t ofwFixValue;
+  char ofwFixFlash[CONFIG_FLASH_PATH_MAX];
   bool serialLog;
   uint8_t logLevel;
   bool logColor;

diff --git a/sd-bootloader-ng/bootmanager/main.c b/sd-bootloader-ng/bootmanager/main.c
@@ -669,6 +669,47 @@ static bool prepareRun(sImageInfo* imageInfo, char* imagePath, uint32_t filesize
     if (strnlen(creationDate, 13) == 12 //latest format
         || strnlen(creationDate, 29) == 28) //old format
       Logger_info(" creationDate=%s", creationDate);
+
+    if (Config_generalSettings.ofwFixFlash[0] != '\0') {
+      SimpleLinkInit();
+      _i32 fhandle;
+      SlFsFileInfo_t pFsFileInfo;
+      if (!sl_FsOpen(Config_generalSettings.ofwFixFlash, FS_MODE_OPEN_READ, NULL, &fhandle)) {
+        if (!sl_FsGetInfo(Config_generalSettings.ofwFixFlash, 0, &pFsFileInfo)) {
+          uint32_t numbers[2];
+          uint32_t offset = 0;
+          uint32_t readLen = 0;
+          if (pFsFileInfo.FileLen == 4) { //File with magic bytes only
+            offset = 0;
+            readLen = 4;
+            numbers[1] = 0xBEAC0005;
+            Logger_debug("Read OfwFix from 4-byte file flash:%s", Config_generalSettings.ofwFixFlash);
+          } else if (pFsFileInfo.FileLen == 20956) { //OFW BL
+            offset = pFsFileInfo.FileLen - 8;
+            readLen = 8;
+            Logger_debug("Read OfwFix from ofw bl flash:%s", Config_generalSettings.ofwFixFlash);
+          } else {
+            Logger_debug("Invalid OfwFix file flash:%s with len=%i", Config_generalSettings.ofwFixFlash, pFsFileInfo.FileLen);
+            readLen = 0;
+          }
+
+          if (readLen > 0 && (readLen == sl_FsRead(fhandle, offset, numbers, readLen))) {
+            sl_FsClose(fhandle, 0, 0, 0);
+            if (numbers[1] == 0xBEAC0005) {
+              Config_generalSettings.ofwFixValue = numbers[0];
+            } else {
+              Logger_error("Invalid OfwFix file flash:%s with wrong id=0x%08X instead of 0xBEAC0005", Config_generalSettings.ofwFixFlash, numbers[1]);
+            }
+          } else {
+            Logger_debug("Could not get read OfwFix file flash:%s ", Config_generalSettings.ofwFixFlash);
+          }
+        } else {
+          Logger_debug("Could not get size of OfwFix file flash:%s ", Config_generalSettings.ofwFixFlash);
+        }
+      } else {
+          Logger_debug("Could not open OfwFix file flash:%s ", Config_generalSettings.ofwFixFlash);
+      }
+    }
 
     Logger_debug("Apply OFW fix 0x%08X", Config_generalSettings.ofwFixValue);
     if (*pCheck1 == 0xBEAC0005 && *pCheck1 == *pCheck2) {

diff --git a/sd-bootloader-ng/bootmanager/sd/revvox/boot/ngCfg.json b/sd-bootloader-ng/bootmanager/sd/revvox/boot/ngCfg.json
@@ -5,7 +5,7 @@
         "waitTimeoutInS": 60,
         "_descMinBatteryLevel": "Divide through around 700 to get voltage",
         "minBatteryLevel": 2100,
-        "ofwFixValue": ["4C", "01", "10", "00"],
+        "ofwFixFlash": "/sys/pre-img.bin",
         "_descSerialLog": "Logging only works with the debug build!",
         "serialLog": false,
         "_descLogLevel": "0:Trace - 5:Fatal",

diff --git a/wiki/Bootloader.md b/wiki/Bootloader.md
@@ -43,6 +43,7 @@ The configuration for the bootloader is saved within [sd:/revvox/boot/ngCfg.json
 | waitTimeoutInS | Timeout in seconds for waitForPress if no earpress (hibernation) | 1-255 | 60 |
 | minBatteryLevel | Poweroff voltage to protect the battery. Divide through around 700 to get voltage (Standard 3V) | | 2100 |
 | ofwFixValue | Magic bytes to be placed into the OFW Image during boot (can be extracted from OFW BL data[-8:-4]) | hex array with 4 bytes | ["4C", "01", "10", "00"] |
+| ofwFixFlash| Magic bytes read from the ofw bootloader on flash | ex. /sys/pre-img.bin| |
 | serialLog | Enable log to UART (TX) @115200 baud. Only works for debug build! | true, false | true |
 | logLevel | Set Log level 0:Trace - 5:Fatal | 0-5 | DEBUG_LOG_LEVEL |
 | logColor | Enable colored log | true, false | false |