[X]Assistant

[Redscorpio]

imgRePackerRK
Utility for unpacking / packing firmware imagesRockchip(* .img)

Version 1.06 windows & linux imgRePackerRK_106.zip(176.25 KB)

Purpose:
Unpacking for making changes and then packing RockChip format firmware images. It can also be used to correct the checksums md5 and RockChip CRC.

Opportunities:
- unpacking and packingRkfw- images (format descriptiona) firmware (with / without processing files of the 2nd layer);
- unpacking and packingRkaf- images (format descriptiona) firmware (with / without processing files of the 2nd layer);
- unpacking and packing files of the 2nd layer; supported:Android boot image (04), RockChip bootloader image (15), gzip / cpio archive file (14), cpio_ascii_new archive file (19), Rockchip resources image (30).
- verification and correction of checksumsmd5andRockChip CRC.

Tested on firmware:
- RK28xx (ChipID = 0xXXXXXX21);
- RK29xx (ChipID = 0xXXXXXX5X);
- RK30xx (ChipID = 0xXXXXXX6X);
- RK31xx (ChipID = 0xXXXXXX7X);
- RK32xx (ChipID = 0xXXXXXX8X);
- RK33xx (ChipID = 0xXXXXXX4X).

Utility use

Note:
The Windows version of the utility uses an external library for unpacking / packing gzip / cpio files.zlib1.dll (http://www.zlib.net/)and its own simplified algorithm for unpacking / packing cpio (however, similar, judging by the result, the original). The Linux version uses a call to external native gzip / gunzip and cpio utilities (so simple repacking without changes does not directly match the resulting firmware).

Used codes designate file types:

-1 - not defined;
00 - Unknown;
04 - Android boot image;
06 - ext3 image;
11 - RockChip KRNL signed file;
12 - RockChip PARM signed file;
14 - gzip / cpio archive file;
15 - RockChip bootloader image;
16 - ext4 image;
17 - cpio_bin_odc archive file;
18 - cpio_ascii_odc archive file;
19 - cpio_ascii_new archive file;
20 - cpio_ascii_crc archive file.

The composition of the archive:
1. imgRePackerRK.exe - Windows version.
2. zlib1.dll - gzip file support library for Windows version.
3. imgrepackerrk - Linux version.
4. ReadMe.txt - this file.
5. ReadMe_utf8.txt - the same in UTF-8 encoding.

Special thanks:
Jean-loup Gailly & Mark Adler for zlib library (http://www.zlib.net/)

Change log and old versions

1.06 [W & L] (03/05/2017)
+ Added support for the format RockChip uboot;
+ added DirtyBlk method;
+ support for old format RKFW;
+ RK support ???? (ChipID = 0x00000021);
+ RK33xx support (ChipID = 0x00000041);
+ if the file size is undefined in parameters, set in firmware 0;
+ create files with size = 0;
+ check / pass BOM;
+ added the definition of OS;
+ added key / rmd4;
~ improved reading algorithm bcpath and lname;
~ minor improvements.
1.05 [W & L] (08/10/2015) imgRePackerRK_105.zip (153.68 KB)
~ using WinAPI to create directories;
+ support format Rockchip resources image;
+ support RK32xx (ChipID = 0x00000080);
+ added key / symb;
+ added key / bcpath;
+ added key / lname;
+ creating configuration files for RKAndroidTool v.1.xx / 2.xx;
+ check of "intersections" of sections and "holes" between them;
+ comparing file length with partition size.
1.04 [W & L] (02.17.2014) imgRePackerRK_104.zip (132.86 KB)
+ unpacking / packing PARM-signed single files;
~ the unpacking algorithm of the KRNL-signed files is changed (we cut off the "superfluous");
~ Improved algorithm for automatic correction of the error describing the size of the area reserved for individual files;
- removed the key / blk;
+ minor improvements.
1.03 [W & L] (01.21.2014) imgRePackerRK_103.zip (131.45 KB)
~ fixed bug checking symlink-s with absolute paths (CPIO);
+ Added automatic error correction describing the size of the area reserved for individual files;
+ added key / blk;
+ added key / cid.
1.02 [W & L] (Oct 3, 2013) imgRePackerRK_102.zip (130.35 KB)
~ Fixed bug with unpacking / packing of "single-faced" KRNL-signed images.
1.01 [W & L] (10/01/2013) imgRePackerRK_101.zip (130.15 KB)
+ Added support for the nongzipped format. cpio_ascii_new archive file;
+ added key / skip.
1.00 [W & L] (09/06/2013) imgRePackerRK_100.zip (125.34 KB)
! Release;
+ Added support for gzip / cpio archive file;
+ Added support for the cpio_ascii_new archive file format;
~ optimized some code sections;
- key / inter is deleted;
- fixed minor errors in the code;
+ minor improvements.
0.95 [W & L] (05/26/2013) imgRePackerRK_095.zip (57.5 KB)
! pre-release # 5;
+ Added support for the RockChip format bootloader image.
0.94 [W & L] (05/17/2013) imgRePackerRK_094.zip (51.52 KB)
! pre-release # 4;
+ added key / 2nd;
+ Added support for Android boot image format.
0.93 [W & L] (04/29/2013) imgRePackerRK_093.zip (38.54 KB)
! pre-release # 3.
0.92 [W & L] (04/21/2013)
! pre-release (for internal use)

Known Issues Pending

Description of firmware formats and component files

1. Rkwf
2. Rkaf
3. package-file
4. parameter
5. Checksum RockChip CRC
6. Android boot image
7. RockChip bootloader image
8. RSCE (RockShip resources image)
9. RockChip U-boot

Alternative download link

Post has been editedRedscorpio - 03.08.17, 15:12

[Redscorpio]

Using:
"imgRePackerRK.exe [options]<name [.ext]>"- unpacking (Windows)
"imgRePackerRK.exe [options]<name [.ext]>.dump"- packing (Windows)
"imgRePackerRK.exe [options]<name [.ext]>.cfg"- packing the file of the 2nd layer (Windows)
"./imgrepackerrk [options]<name [.ext]>"- unpacking (Linux)
"./imgrepackerrk [options]<name [.ext]>.dump"- packing (Linux)
"./imgrepackerrk [options]<name [.ext]>.cfg"- packing the file of the 2nd layer (Linux)

Options(the name in the ini-file and the default value are indicated in brackets):
/ log- create a log file (log = 0);
/ debug- write debug information, it works only with the / log option (debug = 0);
/ quiet- disable console output (quiet = 0);
/ mono- turn on monochrome mode (mono = 0);
/ md5- ignore md5 errors (when unpacking) or
do not add the checksum md5 (when packing) (md5 = 0);
/ rkcrc- ignore RockChip CRC errors (rkcrc = 0);
/ rkaf- create RKAF image (packing) (rkaf = 0);
/ skip- skip checking the size of the firmware image file; used when unpacking
(skip = 0);
/ 2nd- unpacking / packing files of the second layer (2nd = 0);
/ cid- do not check ChipID (cid = 0);
/ rmd4- ramdisk alignment in Android Boot image on the border of 4 bytes (rmd4 = 0);
/ symb- ignore symbolic link verification errors (symb = 0);
/ bcpath:<path>
- base path for RKAndroidTool configuration files;
/ lname:<[path] name>
- loader name for RKAndroidTool configuration files;
/ ini- overwrite ini-file with options from the command line (-);
Note:
Command line options always take precedence over ini file parameters.

Post has been editedRedscorpio - 03.05.17, 23:14

[Redscorpio]

RKFW file format (RockChip batch firmware image)

File structure(pic. 1)
1. Header
2. boot.img
3. Simple update.img orRkaf file
4. MD5 checksum (optional)

Fig. one

Header format

struct RKFW_Hdr {
char Magic [4]; // "RKFW"
unsigned short int HdrLen; // 0x00000066
unsigned long int Version; //
unsigned long int Code; // ???
unsigned short int Year; //
unsigned char Month; //
unsigned char day; //
unsigned char hour; //
unsigned char Minute; //
unsigned char Second; //
unsigned long int ChipID; // 0x00000060 / RK3066; 0x00000070 / RK3188
unsigned long loadOff int; // Loader offset (0x00000066)
unsigned long int LoadLen; // Loader length
unsigned long int DataOff; // Data offset
unsigned long int DataLen; // Data length
unsigned long int Unknown_1; // 0x00000000
unsigned long int RKFWtype; // 0x00000000 - just update.img, 0x00000001 - if RKAF
unsigned long int SysFStype; // 0x00000000
unsigned long int BackupEnd; //
unsigned char Reserved [45]; // 0x00000000
} ImgHdr;

Notes:
1. The names of the structure and its fields may not coincide with the intended developer (s).
2. As boot.img, the bootloader was used in all the firmwares encountered (for example, "RK30xxLoader (L) _V1.24.bin" for firmware RK3066).
3. No file alignment.
4. MD5 checksum is found not in all firmwares (it is not yet possible to determine exactly when it is needed, and when it isn’t).

Post has been editedRedscorpio - 03.08.17, 14:17

[Redscorpio]

RKAF file format (RockChip update firmware image)

File structure(fig.2)
1. Header
2. Files
3. RockChip CRC checksum (seealgorithm)

Fig. 2

Header format

struct RKAF_Hdr {
char Magic [4]; // "RKAF"
unsigned long int ImgLen;
char Model [34];
char Id [30];
char Manufacturer [56];
unsigned long int Unknown_1;
unsigned long int Version;
unsigned long int FileCount;

struct sUpdFile uFiles [16];
unsigned char Reserved [116];
} UpdHdr;

Where

struct sUpdFile {
char name [32];
char FileName [60];
unsigned long int NandSize;
unsigned long int Pos;
unsigned long int NandAddr;
unsigned long int ImgFSize;
unsigned long int OrigFSize;
}

Notes:
1. The names of the structure and its fields may not coincide with the intended developer (s).
2. Files are aligned on the border of 2KB (0x0800).
3. Number of files - up to 16.
4. Be sure to have filespackage-file(firmware composition; seedescription), bootloader(loader),parameter(A description of the properties and parameters of the firmware, including the NAND partitions; seedescription), update-scriptandrecover-script(clear from the title).
5. Fileparametersaved in firmware asPARMfile (RockChip PARM-signed file).

PARM file format

char Magic [4]; // "PARM"
unsigned long int FileLen; // file length
char File [FileLen]; // file directly
unsigned long int rkCRC; // Checksum RockChip CRC

6. Some files (sections) may be saved in the firmware asKRNLfile (RockChip KRNL-signed file).

KRNL file format

char Magic [4]; // "KRNL"
unsigned long int FileLen; // file length
char File [FileLen]; // file directly
unsigned long int rkCRC; // Checksum RockChip CRC

Post has been editedRedscorpio - 20.10.16, 18:23

[vin2809]

RedScorpio @ 04/29/2013, 10:16 PM

RK ???? (ChipID = 0x00000050)

This is the chip code RK29xx (see, for example, wendal).

About "2. boot.img"then it is ALWAYS a simple bootloader, i.e. Boot.bin.
About the alignment "1. Files are aligned on the border of 2KB (0x0800). ", then you set it in the same fileparameter.

Post has been editedvin2809 - 04.05.13, 08:24

[vin2809]

Yes, and the checksum should beIS ALWAYS. I think not everyoneromodels It turned out to boot with it, so in many firmware it is not.

[Redscorpio]

Vin2809 @ 05/04/2013, 09:26

Yes, and the checksum should ALWAYS be.

Maybe I just met a lot of firmware without it. In any case, this is now configured (checking / creating is disabled)

Vin2809 @ 05/04/2013, 09:17

As for alignment, "1. Files are aligned on the 2KB (0x0800) boundary.", Then you specify it in the same parameter file.

What parameter? When packing, I have now done fixed. It will be necessary to correct.

Update (05/18/2013)The question "hung in the air"; how to rule until I know

Post has been editedRedscorpio - 18.05.13, 18:59

[Redscorpio]

package-file

Purpose - a description of the composition of the firmware (file names).
It is a simple text file in which each line describes a file with two fields: the name (ID) and the name of the file on the physical media with a relative path. Fields are separated by spaces and / or tabs, comments in the file begin with the symbol#. The first field matchesName, second -FileNamestructuressupdfile(description of the files in the firmware) headerRkaf file.

Sample package-file

# NAME Relative path
#
#HWDEF HWDEF
package-file package-file
bootloader RK30xxLoader (L) _V1.24.bin
parameter parameter
misc Image / misc.img
#kernel Image / kernel.img
boot image / boot.img
recovery Image / recovery.img
system Image / system.img
# TЄRґIlbackup · ЦЗшµДД�юÑНКЗЧФЙнЈЁupdate.imgЈ ©
# SELF КЗ№Ш�ьЧЦЈ ¬ ± nКѕЙэ�¶ОД�юЈЁupdate.imgЈ © CHFIN
# ФЪЙъіЙЙЕ�¶OD�YUK ± ¬¬І »� У��ЛСЭЛФОДУµДДЬ�ЕЈ¬µ« ФЪН · ІїРЕПўЦРУРУЗВ�
# FvЅv ° ьYy�¶OD�YUK ± Ј¬І »v ° ьSELFOD�µDDNIEЎЈ
backup parameter
fwbackup SELF
update-script update-script
recover-script recover-script

Reserved names for the second fieldSELFandRESERVED

Post has been editedRedscorpio - 08.05.13, 20:15

[Redscorpio]

parameter

Purpose - a description of the firmware.
It is a simple text file in which each line is the name of the parameter and its value, separated by the symbol "colon" (":"), comments in the file begin with the symbol"#".

Example of parameter file

FIRMWARE_VER: 4.1.1
MACHINE_MODEL: 97R
MACHINE_ID: 007
MANUFACTURER: 97R
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3066
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#RECOVER_KEY: 1,1,0,20,0
CMDLINE: console = ttyFIQ0 androidboot.console = ttyFIQ0 init = / init initrd = 0x600a0000000.0x008000000 , 0x00100000 @ 0x00018000 (backup), 0x0003a000 @ 0x00118000 (cache), 0x00400000 @ 0x00152000 (userdata), 0x00002000 @ 0x00552000 (kpanic), 0x00100000 @ 0x00554000 (system), - @ 0x00654000 (0x00552000)

пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ (пїЅпїЅпїЅ пїЅпїЅпїЅпїЅпїЅпїЅпїЅ пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ): download

FIRMWARE_VER = RKAF_Hdr.Version
MACHINE_MODEL = RKAF_Hdr.Model
MACHINE_ID = RKAF_Hdr.Id
MANUFACTURER = RKAF_Hdr.Manufacturer
MAGIC =? (in the example "PARK")
ATAG =?
MACHINE =?
CHECK_MASK =?
KERNEL_IMG =?
CMDLINE= Command line (?); of greatest interestmtdpartsthat describes the NAND sections. For example, 0x00100000 @ 0x00554000 (system) means that the partitionsystem(Image / system.img file) is located at 0x00554000 (sUpdFile.NandAddr) and has a size of 0x00100000 (sUpdFile.NandSize). Values ​​are set in blocks (512B).

Post has been editedRedscorpio - 14.09.13, 11:01

[Redscorpio]

Checksum RockChip CRC

The algorithm was found on the Internet, there were no problems with the "implantation" in the utility.

The source code of the algorithm RockChip CRC (rkcrc.h)

/*-
* Copyright (c) 2010 FUKAUMI Naoki.
* All rights reserved.
*
* Redistribution and use forms
* modification, are not permitted provided that
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and / or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `` AS IS '' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARIZING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#ifndef _RKCRC_H
#define _RKCRC_H

#include

static uint32_t _t [256] = {
0x00000000, 0x04c10db7, 0x09821b6e, 0x0d4316d9,
0x130436dc, 0x17c53b6b, 0x1a862db2, 0x1e472005,
0x26086db8, 0x22c9600f, 0x2f8a76d6, 0x2b4b7b61,
0x350c5b64, 0x31cd56d3, 0x3c8e400a, 0x384f4dbd,
0x4c10db70, 0x48d1d6c7, 0x4592c01e, 0x4153cda9,
0x5f14edac, 0x5bd5e01b, 0x5696f6c2, 0x5257fb75,
0x6a18b6c8, 0x6ed9bb7f, 0x639aada6, 0x675ba011,
0x791c8014, 0x7ddd8da3, 0x709e9b7a, 0x745f96cd,
0x9821b6e0, 0x9ce0bb57, 0x91a3ad8e, 0x9562a039,
0x8b25803c, 0x8fe48d8b, 0x82a79b52, 0x866696e5,
0xbe29db58, 0xbae8d6ef, 0xb7abc036, 0xb36acd81,
0xad2ded84, 0xa9ece033, 0xa4aff6ea, 0xa06efb5d,
0xd4316d90, 0xd0f06027, 0xddb376fe, 0xd9727b49,
0xc7355b4c, 0xc3f456fb, 0xceb74022, 0xca764d95,
0xf2390028, 0xf6f80d9f, 0xfbbb1b46, 0xff7a16f1,
0xe13d36f4, 0xe5fc3b43, 0xe8bf2d9a, 0xec7e202d,
0x34826077, 0x30436dc0, 0x3d007b19, 0x39c176ae,
0x278656ab, 0x23475b1c, 0x2e044dc5, 0x2ac54072,
0x128a0dcf, 0x164b0078, 0x1b0816a1, 0x1fc91b16,
0x018e3b13, 0x054f36a4, 0x080c207d, 0x0ccd2dca,
0x7892bb07, 0x7c53b6b0, 0x7110a069, 0x75d1adde,
0x6b968ddb, 0x6f57806c, 0x621496b5, 0x66d59b02,
0x5e9ad6bf, 0x5a5bdb08, 0x5718cdd1, 0x53d9c066,
0x4d9ee063, 0x495fedd4, 0x441cfb0d, 0x40ddf6ba,
0xaca3d697, 0xa862db20, 0xa521cdf9, 0xa1e0c04e,
0xbfa7e04b, 0xbb66edfc, 0xb625fb25, 0xb2e4f692,
0x8aabbb2f, 0x8e6ab698, 0x8329a041, 0x87e8adf6,
0x99af8df3, 0x9d6e8044, 0x902d969d, 0x94ec9b2a,
0xe0b30de7, 0xe4720050, 0xe9311689, 0xedf01b3e,
0xf3b73b3b, 0xf776368c, 0xfa352055, 0xfef42de2,
0xc6bb605f, 0xc27a6de8, 0xcf397b31, 0xcbf87686,
0xd5bf5683, 0xd17e5b34, 0xdc3d4ded, 0xd8fc405a,
0x6904c0ee, 0x6dc5cd59, 0x6086db80, 0x6447d637,
0x7a00f632, 0x7ec1fb85, 0x7382ed5c, 0x7743e0eb,
0x4f0cad56, 0x4bcda0e1, 0x468eb638, 0x424fbb8f,
0x5c089b8a, 0x58c9963d, 0x558a80e4, 0x514b8d53,
0x25141b9e, 0x21d51629, 0x2c9600f0, 0x28570d47,
0x36102d42, 0x32d120f5, 0x3f92362c, 0x3b533b9b,
0x031c7626, 0x07dd7b91, 0x0a9e6d48, 0x0e5f60ff,
0x101840fa, 0x14d94d4d, 0x199a5b94, 0x1d5b5623,
0xf125760e, 0xf5e47bb9, 0xf8a76d60, 0xfc6660d7,
0xe22140d2, 0xe6e04d65, 0xeba35bbc, 0xef62560b,
0xd72d1bb6, 0xd3ec1601, 0xdeaf00d8, 0xda6e0d6f,
0xc4292d6a, 0xc0e820dd, 0xcdab3604, 0xc96a3bb3,
0xbd35ad7e, 0xb9f4a0c9, 0xb4b7b610, 0xb076bba7,
0xae319ba2, 0xaaf09615, 0xa7b380cc, 0xa3728d7b,
0x9b3dc0c6, 0x9ffccd71, 0x92bfdba8, 0x967ed61f,
0x8839f61a, 0x8cf8fbad, 0x81bbed74, 0x857ae0c3,
0x5d86a099, 0x5947ad2e, 0x5404bbf7, 0x50c5b640,
0x4e829645, 0x4a439bf2, 0x47008d2b, 0x43c1809c,
0x7b8ecd21, 0x7f4fc096, 0x720cd64f, 0x76cddbf8,
0x688afbfd, 0x6c4bf64a, 0x6108e093, 0x65c9ed24,
0x11967be9, 0x1557765e, 0x18146087, 0x1cd56d30,
0x02924d35, 0x06534082, 0x0b10565b, 0x0fd15bec,
0x379e1651, 0x335f1be6, 0x3e1c0d3f, 0x3add0088,
0x249a208d, 0x205b2d3a, 0x2d183be3, 0x29d93654,
0xc5a71679, 0xc1661bce, 0xcc250d17, 0xc8e400a0,
0xd6a320a5, 0xd2622d12, 0xdf213bcb, 0xdbe0367c,
0xe3af7bc1, 0xe76e7676, 0xea2d60af, 0xeeec6d18,
0xf0ab4d1d, 0xf46a40aa, 0xf9295673, 0xfde85bc4,
0x89b7cd09, 0x8d76c0be, 0x8035d667, 0x84f4dbd0,
0x9ab3fbd5, 0x9e72f662, 0x9331e0bb, 0x97f0ed0c,
0xafbfa0b1, 0xab7ead06, 0xa63dbbdf, 0xa2fcb668,
0xbcbb966d, 0xb87a9bda, 0xb5398d03, 0xb1f880b4,
};

#define RKCRC (crc, buf, size) \
do {\
size_t _s = (size); \
uint8_t * _b = (uint8_t *) (buf); \
while (_s--> 0) \
(crc) = ((crc) << 8) ^ _t [((crc) >> 24) ^ * _b ++]; \
} while (/ * CONSTCOND * / 0)

#endif // _ RKCRC_H

Post has been editedRedscorpio - 08.05.13, 21:28

[Redscorpio]

Android boot image format

File structure(pic.3)
1. Header
2. kernel
3. ramdisk
4. second file (optional)

Fig. 3

Header format

struct sABootimg_Hdr {
char Magic [8];
unsigned int KernelSize;
unsigned int KernelAddr;
unsigned int RamdiskSize;
unsigned int RamdiskAddr;
unsigned int SecondFSize;
unsigned int SecondFAddr;
unsigned int TagsAddr;
unsigned int PageSize;
unsigned int Unknown_1;
unsigned int Unknown_2;
char name [16];
char CmdLine [512];
unsigned char SHAdigest [20]; // SHA1 (20 bytes)
unsigned int Unknown_3;
unsigned int Unknown_4;
unsigned int Unknown_5;
};

Notes:
1. The names of the structure and its fields may not coincide with the intended developer (s).
2. Files are aligned on the border defined by the parameter.PageSizeheader
3. Second filemay be absent in this caseSecondfsizeset to 0.
4. Most sources describe the parameter followingCmdLine, as
unsigned id [8]; / * timestamp / checksum / sha1 / etc * /
however, in all the firmware on which I tested the utility, this is exactly the checksumSHA(more precisely,SHA1).
5. ChecksumSHAIt is calculated for all files (by actual size) and by title up to the field itself.SHAdigest (in details)
Note.In Allwinner firmware, the counting method is different.
6. In all met firmwareramdiskrepresents agzip / cpio-file.

Post has been editedRedscorpio - 14.09.13, 17:37

[Redscorpio]

RockChip format bootloader image

File structure(fig.4)
1. Header
2. Files table
3. Files (4)

Fig. four

Header format

struct sRKBootload_Hdr {
char Magic [4]; // "BOOT"
unsigned short int HdrLen; // 0x00000066
unsigned int Version; //
unsigned int Code; //
unsigned short int Year;
unsigned char Month;
unsigned char day;
unsigned char hour;
unsigned char Minute;
unsigned char Second;
unsigned int ChipID;
struct sStageRec StageRec [4];
unsigned char Reserved [53];
} RKBootload_Hdr;

Where

struct sStageRec {
unsigned char RecType;
unsigned int RecOff;
unsigned char RecLen;
};

File allocation table format

struct sRKBootFileRec {
unsigned char FileRecLen;
unsigned int FileNum;
#ifdef __linux
char LFileName [40];
#else
wchar_t FileName [20];
#endif
unsigned int FileOff;
unsigned int FileSize;
unsigned int Unknown;
} RKBootFileRecTable [4];

Notes:
1. Names of structures and fields may not coincide with those planned by the developer (s).
2. The names of some fields of the structures are given from assumptions that later turned out to be false; I did not rename it, because I could not find out the true purpose.
3. Files are encoded by the algorithmRC4.

RC4 key

static unsigned char RK_Key [16] = {
0x7C, 0x4E, 0x03, 0x04, 0x55, 0x05, 0x09, 0x07,
0x2D, ​​0x2C, 0x7B, 0x38, 0x17, 0x0D, 0x17, 0x11
};

[skalls]

I did not understand how to work with the version for windows, when I try to unpack it, I get some kind of error. if possible, I would like to see at least some interface. even of 3 buttons: review, unpack, pack.

[Redscorpio]

[email protected], 18:24

I did not understand how to work with the version for windows, when I try to unpack it, I get some kind of error. if possible, I would like to see at least some interface. even of 3 buttons: review, unpack, pack.

The interface was not, and never will be. Instead of the browse button, you can simply drag and drop the desired firmware file or directory with the unpacked firmware onto the program in the Explorer (drag'n'drop function).
As for the error:

RedScorpio @ 04/29/2013, 11:41 PM

In case of problems, please send a log (to know the operating parameters and utility options) and a link to the problematic firmware.

[dmtr76]

Dear, the source will not provide? I want to port on OSX.

[And_pda]

RedScorpio @ 05/18/2013, 10:26 PM

5. The SHA checksum is calculated for all files (by actual size) and by header up to the SHAdigest field itself.

How successfully I stumbled upon your post, maybe now I don’t have to search for the source code of abootimg or mkbootimg, tell me how to correctly set the byte area from which the SHA1 hash is typical for boot and recovery images. What is the sequence of files and header? I tried to copy the bytes in this way - first kernel (zImage), then insert the initrd.cpio.gz bytes (or maybe need to unpack the initrd.cpio) then 576 bytes of the recovery.img image header and from this all took SHA1 - it didn't work out that I not doing that? The second question - did you happen to have a 256 byte hash? Maybe more than you can help indiscussing- we are trying to assemble a working recovery for the Lenovo K900 on the x86 architecture, there is generally an incomprehensible structure of these images - the signature of the header is $ OS $ (there is practically nothing on the Internet about this topic)

[Redscorpio]

How many questions at once :-)

[email protected], 12:48

how to set the byte area correctly, which exactly makes the SHA1 hash typical for boot and recovery images. What is the sequence of files and header? I tried to copy the bytes in this way - first kernel (zImage), then insert the initrd.cpio.gz bytes (or maybe need to unpack the initrd.cpio) then 576 bytes of the recovery.img image header and from this all took SHA1 - it didn't work out that I not doing that?

To this part all the answers are directly inthe message?, the sequence of files and header even shown schematically in the figure. But, probably, meant: "what sequence of calculation of SHA1".

Known to mecalculation sequenceis this:
1. We count on the whole filekernel
2. ByABootimg_Hdr.KernelSize
3. Throughout the fileramdisk
4. ByABootimg_Hdr.RamdiskSize
5. Throughout the filesecondfile, if there is
6. ByABootimg_Hdr.SecondFSizeeven if it is 0
7. ByABootimg_Hdr.TagsAddr
8. ByABootimg_Hdr.PageSize
9. ByABootimg_Hdr.Unknown_1
10. ByABootimg_Hdr.Unknown_2
11. ByABootimg_Hdr.Name
12. ByABootimg_Hdr.CmdLine
But, judging from everything, it is not exactly specified, and therefore in Allwinner, for example, firmware SHA is considered somehow different. This algorithm is valid only for RockChip firmware (and even then not always).

[email protected], 12:48

have you ever encountered a 256 byte hash?

Did you mean the source code of the SHA256 algorithm? I met. But he (perhaps, so far) is of no interest to me, so where, now I don’t remember.

[email protected], 12:48

Maybe even more than you can help in the discussion - we are trying to assemble a working recovery for Lenovo K900 on the x86 architecture, there is generally an incomprehensible structure of these images - the signature of the header is $ OS $ (there is practically nothing on the Internet about this topic)

I can hardly help. First of all, due to the fact that I do not have “on the farm” of such devices and, accordingly, interest

Ps. For the first time, someone became interested in my research.

Post has been editedRedscorpio - 14.09.13, 17:46

[And_pda]

[email protected], 18:34

The sequence of calculation known to me is

Thank you, now everything turned out.

[email protected], 18:34

Did you mean the source code of the SHA256 algorithm?

No, the algorithms usually indicate the bit depth, the one that you specified - 256 bits at the output gives 32 bytes of everything, there is also SHA512 but there are 64 bytes, and 256 bytes are needed.

[email protected], 18:34

I can hardly help. First of all, due to the fact that I do not have “on the farm” of such devices and, accordingly, interest

Well, I don’t have such devices (there was a child’s RK3066), but I still have an interest in reverse engineering.

[Redscorpio]

[email protected], 1:00 pm

need 256 bytes

Not exactly met

[Funn1]

I do not understand anything, I prescribe for packingimgRePackerRK.exe [/ log]<system [.ext]>.dumpError: Can not find the specified file, system is the folder that I want to pack in img

Next tried the commandimgRePackerRK.exe [/ log]<system / system.img>Command syntax error

[Redscorpio]

Funn1,
To start:
1. The syntax for packing is:

RedScorpio @ 04/29/2013, 11:16 PM

"imgRePackerRK.exe [options]<name [.ext]>.dump "- packing (Windows)

and if the file is the 2nd layer (level), then

RedScorpio @ 04/29/2013, 11:16 PM

"imgRePackerRK.exe [options]<name [.ext]>.cfg "- packing the file of the 2nd layer (Windows)

Those. the command should look like:
imgRePackerRK.exe / log system.dump
or
imgRePackerRK.exe / log system.cfg
2. For packing, configuration files are used that are created automatically when unpacking the firmware in accordance with its structure or can be created manually, but this requires a sufficient level of skill.
3. What is the system folder?

For starters, I recommend unpacking any firmware to see how everything looks