-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathcreatepayload.py
287 lines (233 loc) · 8.82 KB
/
createpayload.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
import os
import sys
from itertools import islice
THIS_FOLDER = os.path.dirname(os.path.abspath(__file__))
def rs232_checksum(the_bytes):
return b'%02X' % (sum(the_bytes) & 0xFF)
def stringify_address(address):
hexify = hex(address)
stringify = str(hexify).replace('0x', '')
prefix = '0'
while len(stringify) < 8:
stringify = prefix + stringify
return stringify.upper()
def generate_fill():
fill_byte = b'\xFF'
fill = bytearray()
count = 2048
while count > 0:
fill.extend(fill_byte)
count -= 1
return fill
def generate_area(ranges, start, end):
area = bytearray()
location = start
chunk = 2048
while location >= start and location < end:
for item in ranges['ranges']:
for key, value in item.items():
if key == stringify_address(location):
area.extend(item[key])
location += chunk
return area
def chunked(iterable, n):
it = iter(iterable)
values = bytes(islice(it, n))
while values:
yield values
values = bytes(islice(it, n))
def convert_to_bytes(byte_array, size):
final_header_array = []
sub_array = bytearray()
for array in byte_array:
for item in array:
new_item = int(item, 16)
converted = new_item.to_bytes(size, 'little')
sub_array.extend(converted)
final_header_array.append(sub_array)
sub_array = bytearray()
return final_header_array
def bytes_to_checksum(bytes_array):
header = header_payload(rs232_checksum(bytes_array))
return header
def sort_bytearray(bytes_array):
completed = []
for array in bytes_array:
completed.append(bytes_to_checksum(array))
return completed
def header_payload(checksum):
final_header_array = []
sig_array = []
# calculate header padding size
difference = 20 - int(len(checksum)/2) - 1 #need to subtract extra because byte is 2 characters
header_padding_array = []
while difference >= 0:
header_padding_array.append('00')
difference -= 1
final_padding = ''.join(header_padding_array)
final_header_hash = str(checksum).replace("b'","").replace("'","") + final_padding
final_header_array.append('H:' + str(int(len(final_header_hash)/2)) + ':' + final_header_hash + ':' + str(checksum).replace("b'","").replace("'",""))
return final_header_array
def security_payload(checksum):
final_header_array = []
sig_array = []
# calculate header padding size
difference = 20 - int(len(checksum)/2) - 1 #need to subtract extra because byte is 2 characters
header_padding_array = []
while difference >= 0:
header_padding_array.append('00')
difference -= 1
final_padding = ''.join(header_padding_array)
final_header_hash = str(checksum).replace("b'","").replace("'","") + final_padding
final_header_array.append('S:' + str(int(len(final_header_hash)/2)) + ':' + final_header_hash + ':' + str(checksum).replace("b'","").replace("'",""))
return final_header_array
def generate_security_header(vectors_header, additional_header):
header = sort_bytearray(convert_to_bytes(vectors_header + additional_header, 1))
security = convert_to_bytes(vectors_header + additional_header, 1)
array = []
for item in security:
x = str(rs232_checksum(item)).replace("b'","").replace("'","")
x_int = int(x, 16)
array.append(x_int)
security_checksum = security_payload(rs232_checksum(array))
return security_checksum
def create_final_payload(header, vectors, payload):
header_array = []
for array in header:
for item in array:
header_array.append(item)
final_header = '\n'.join(header_array)
final_vectors = '\n'.join(vectors)
final_payload = '\n'.join(payload)
final = final_header + '\n' + final_vectors + '\n' + final_payload + '\n'
return final
def write_payload(version, payload, filename):
path = os.path.join(THIS_FOLDER, 'payload')
path_exist = os.path.exists(path)
if path_exist == True:
with open(path + '/' + filename, 'w') as writefile:
writefile.write('# Version: ' + version + '\n' )
writefile.write(payload)
writefile.close()
else:
os.makedirs(path)
with open(path + '/' + filename, 'w') as writefile:
writefile.write('# Version: ' + version + '\n' )
writefile.write(payload)
writefile.close()
def create_payload(chunk, start):
# Initialize Variables
header_array = []
hex_counter = start
line_counter = 0
omit_counter = 0
omit_bytes = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'
header_payload_array = []
payload_array = []
chunk_array = []
final_header_array = []
for block_bytes in chunked(chunk, n=64):
if line_counter == 0:
length = len(hex(hex_counter).replace('0x',''))
total = 8 - length
prefix = ['D:']
while total > 0:
prefix.append('0')
total -= 1
final_prefix = ''.join(prefix)
chunk_array.append(final_prefix + hex(hex_counter).replace('0x','').upper() + ':' + str(len(block_bytes)) + ':' + block_bytes.hex().upper() + ':' + str(rs232_checksum(block_bytes)).replace("b'","").replace("'",""))
header_array.append(str(rs232_checksum(block_bytes)).replace("b'","").replace("'",""))
hex_counter += 64
if block_bytes == omit_bytes:
omit_counter += 1
if line_counter != 0:
chunk_array.append('+ :' + str(len(block_bytes)) + ':' + block_bytes.hex().upper() + ':' + str(rs232_checksum(block_bytes)).replace("b'","").replace("'",""))
header_array.append(str(rs232_checksum(block_bytes)).replace("b'","").replace("'",""))
hex_counter += 64
if block_bytes == omit_bytes:
omit_counter += 1
line_counter += 64
if line_counter == 2048:
line_counter = 0
if omit_counter < 32:
final_header_array.append(header_array)
payload_array.extend(chunk_array)
chunk_array = []
omit_counter = 0
header_array = []
else:
chunk_array = []
omit_counter = 0
header_array = []
return final_header_array, payload_array
def main(file, version):
smc_type = 'OLD'
ranges = {'ranges':[]}
start = 0
chunk = 2048
total = 262144
final = bytearray()
# create address ranges and store in dictionary array
while start < total:
block = {stringify_address(start): b''}
ranges['ranges'].append(block)
start += chunk
start = 0 # reinitialize start
with open(file, 'rb') as f:
while start < total:
f.seek(start)
data = f.read(chunk)
for item in ranges['ranges']:
for key, value in item.items():
if key == stringify_address(start):
item[key] = data
start += chunk
vectors_table_start = 0
flasher_base_start = 2048
flasher_update_start = 22528
epm1_start = 43008
epm2_start = 45056
user1_start = 47104
user2_start = 59392
end = 262144
vectors_table_area = generate_area(ranges, vectors_table_start, flasher_base_start)
flasher_base_area = generate_area(ranges, flasher_base_start, flasher_update_start)
flasher_update_area = generate_area(ranges,flasher_update_start, epm1_start)
epm1_area = generate_area(ranges, epm1_start, epm2_start)
epm2_area = generate_area(ranges, epm2_start, user1_start)
epm_area = epm2_area + epm1_area
if smc_type == 'OLD':
user_area = generate_area(ranges, user1_start, end)
if smc_type == 'NEW':
user1_area = generate_area(ranges, user1_start, user2_start)
user2_area = generate_area(ranges, user2_start, end)
user_area = user1_area + user2_area
print('creating payloads...')
vectors_header, vectors_table_payload = create_payload(vectors_table_area, vectors_table_start)
flasher_base_header, flasher_base_payload = create_payload(flasher_base_area, flasher_base_start)
fb_header = sort_bytearray(convert_to_bytes(vectors_header + flasher_base_header, 1))
fb_security = generate_security_header(vectors_header, flasher_base_header)
fb_header.append(fb_security)
fb_final = create_final_payload(fb_header, vectors_table_payload, flasher_base_payload)
flasher_update_header, flasher_update_payload = create_payload(flasher_update_area, flasher_update_start)
fu_header = sort_bytearray(convert_to_bytes(vectors_header + flasher_update_header, 1))
fu_security = generate_security_header(vectors_header, flasher_update_header)
fu_header.append(fu_security)
fu_final = create_final_payload(fu_header, vectors_table_payload, flasher_update_payload)
# To Do: decipher epm
#epm_payload = create_payload(epm_area, start_address?)
user_header, user_payload = create_payload(user_area, user1_start)
u_header = sort_bytearray(convert_to_bytes(vectors_header + user_header, 1))
u_security = generate_security_header(vectors_header, user_header)
u_header.append(u_security)
u_final = create_final_payload(u_header, vectors_table_payload, user_payload)
# Write Files:
write_payload(version, fb_final, 'flasher_base.smc')
write_payload(version, fu_final, 'flasher_update.smc')
# To Do: decipher epm
#write_payload(version, header, payload, 'firmware.epm')
write_payload(version, u_final, 'Mac-BoardID.smc')
file = sys.argv[1]
version = sys.argv[2]
main(file, version)
print('finished')