大破雑記帳

個人用メモな雑記ブログ いろんなことをざっくりと。

DGS-1210-28 F1 ファームウェアメモ

APRESIA Systems ApresiaLightGSシリーズも恐らく同じ
DGS-1210-28 F1のGPL tar内のMakefile, plfmake.h、 host/tools/ のツール類から

ヘッダ

ApresiaLightGSシリーズだと0x17に1byte何かが居る

    0x0                 0x4                 0x8                 0xC
     +-------------------+-------------------+-------------------+-------------------+
 0x0 |    Checksum *1    |                                  Model Name             ->|
     +-------------------+-------------------+-------------------+-------------------+
0x10 |->         (Model Name)                |               Signature             ->|
     +-------------------+-------------------+----+----+----+----+-------------------+ 
0x20 |->         (Signature)                 | *3 | *4 | *5 | *6 |   Board Version   |
     +-------------------+-------------------+----+----+----+----+-------------------+
0x30 |    Data Length    |                    Entry Point (text)                     |
     +-------------------+-------------------+-------------------+-------------------+

*1: Checksum
      data without block header (unit: 1byte, (addr 0x0) + (addr 0x1) + ...)
*2: Signature
      Kernel            -> "os"
      RootFS (SquashFS) -> "squashfs"
*3: Partition Index
*4: Header Length??
*5: Encrypted
*6: Customer Signature

フッタ

    0x0                 0x4                 0x8                 0xC
     +-------------------+-------------------+-------------------+-------------------+
 0x0 |                               FW Version (text)                               |
     +-------------------+-------------------+-------------------+-------------------+
0x10 |'C'  'A'  'M'  'E'  'O'  'T'  'A'  'G' |     OS Version    |    Checksum *1    |
     +-------------------+-------------------+-------------------+-------------------+ 

1: Checksum
     data without block header and last 4bytes of checksum
     (unit: 1byte, (addr 0x0) + (addr 0x1) + ...)

フッタのChecksumに、それを1byte分ずつ足したものがヘッダのChecksumになる 例:

  • ヘッダ: 0x07953DD6
  • フッタ: 0x07953C7F

0x07953C7F + 0x07 + 0x95 + 0x3C + 0x7F = 0x7953DD6

imghdr (APRESIA)実行結果

ApresiaLightGS120GT-SSのGPLソースコードとしてAPRESIA Systemsから提供を受けたもの

使用方法のメッセージと実際の引数の順番で、customer_sig と encrypted が入れ替わっている模様

tofu@Tofu-B450HVUB16:~/apresia⟫ ./imghdr aplgsR10104_blk_os_nohead.bin aplgsR10104_blk_os.hex.new APRESIA os 3 0 2 4
Usage: imghdr src dest model signature partition customer_sig encrypted board_ver os_dump
255
tofu@Tofu-B450HVUB16:~/apresia⟫ ./imghdr aplgsR10104_blk_os_nohead.bin aplgsR10104_blk_os.hex.new APRESIA os 3 0 2 4 vmlinux.dump
[imghdr]:Linux start address:0x80562f38
[imghdr]:hdr_len is 64
[imghdr]:model name: APRESIA
[imghdr]:signatue: os
[imghdr]:partition is 3
[imghdr]:encrypted is 0
[imghdr]:customer signature is 2
[imghdr]:board version is 67108864(4)
[imghdr]:aplgsR10104_blk_os_nohead.bin len is 936272
[imghdr]:checksum = 7953dd6

os_dumpはOpenWrtの適当なvmlinuxを用いた為stockと異なる

tofu@Tofu-B450HVUB16:~/apresia⟫ hexdump -n 64 -C aplgsR10104_blk_os.hex.new
00000000  07 95 3d d6 41 50 52 45  53 49 41 00 00 00 00 00  |..=.APRESIA.....|
00000010  00 00 00 00 00 00 00 02  6f 73 00 00 00 00 00 00  |........os......|
00000020  00 00 00 00 00 00 00 00  03 40 00 02 00 00 00 04  |.........@......|
00000030  00 0e 49 50 30 78 38 30  35 36 32 66 33 38 00 00  |..IP0x80562f38..|
00000040

imgtag (APRESIA)実行結果

tofu@Tofu-B450HVUB16:~/apresia⟫ ./imgtag aplgsR10104_blk_os_nohead_notag.bin 1 1.00.010
[imgtag]:src len is 936240
[imgtag]:success write FW 1.00.010 to aplgsR10104_blk_os_nohead_notag.bin!!
[imgtag]:success to create CAMEOTAG!!
[imgtag]:success to create version 1!!

imgtagの後にgenTotalChecksumを実行することでCAMEOTAG行末尾にチェックサムが付加される

tofu@Tofu-B450HVUB16:~/apresia⟫ hexdump -n 256 -C -s $((0xE48B0)) aplgsR10104_blk_os_nohead_notag.bin
000e48b0  5f fa f0 c3 7e ff 27 86  fe f6 fc a6 ee a6 aa 37  |_...~.'........7|
000e48c0  5a 56 7b df de 72 64 49  69 a9 bb f3 b2 4d a3 5b  |ZV{..rdIi....M.[|
000e48d0  fe b9 e4 3d bb 4a ef 4b  fc b2 fb 4b 07 3f 7b f9  |...=.J.K...K.?{.|
000e48e0  37 ae ff c8 a5 1f 79 3c  fa 91 85 e7 fe e8 f6 8e  |7.....y<........|
000e48f0  fe 2f fc e3 39 3b 5f bb  f9 e2 3d ff 73 e9 9f ff  |./..9;_...=.s...|
000e4900  5c 7b e8 33 95 a5 07 1e  6b 2a bb 36 bc ac 79 70  |\{.3....k*.6..yp|
000e4910  fb a3 9b 6f 1b 1c 1a aa  71 13 7e ef 6f b9 e8 10  |...o....q.~.o...|
000e4920  98 b5 ff 1b 06 ef 8a 95  86 d0 23 00 00 00 00 00  |..........#.....|
000e4930  31 2e 30 30 2e 30 31 30  00 00 00 00 00 00 00 00  |1.00.010........|
000e4940  43 41 4d 45 4f 54 41 47  00 00 00 01              |CAMEOTAG....|
000e494c