|
|
Wiki > Main > ATJ213xFirmware (compare)
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Difference: ATJ213xFirmware (r2 vs. r1)HeaderEach file begin with a header containing crucial information about the firmware.
The block size is always 512. The first signature is the same for all versions of the firmware files.
The second signature and unknown field depends on the version which is encoding as follows.
CommonChecksumIn several places the firmware files use a xor-based checksum. This section describes the algorithm used. void pamaury_xor_it(uint8_t compute_checksum(uint8_t *buf, int size, uint8_t t[20]) { memset(t, 0, sizeof(t)); 20); for(int i = 0; i < size; i++) t[i % 20] ^= buf[i]; for(int i = 0; i < 20; i++) t[i] = ~t[i]; } int check_block(uint8_t *buf, uint8_t ref[20], unsigned size) { uint8_t t[20]; compute_checksum(buf, size, t); return memcmp(ref, t, 20); } Version 3The version 3 (encoded as 0x7e) differs significantly from previous versions. Header ExtraThe header contains a few extra fields described as follows.
The first field indicates the block address (minus 2) of a 1024 bytes block. The sum of first and the second fields indicates the block address (minus 5) of a 512 bytes block. The A block contains mainy information about what looks like a decompression algorithm. This block is 1024 bytes long and is located at block
static int decode_block_A(uint8_t block[1020])
{
uint8_t *p = &g_check_block_A_table[32 * (block[998] & 0x1f)];
uint8_t key[32];
for(int i = 0; i < 20; i++)
{
block[1000 + i] ^= p[i];
key[i] = block[1000 + i];
}
for(int i = 20; i < 32; i++)
key[i] = key[i - 20];
for(int i = 0; i < 992; i++)
block[i] ^= key[i % 32] ^ g_check_block_A_table[i];
return check_block(block - 1, block + 1000, 1001);
}
r3 - 14 Sep 2012 - 10:58:54 - AmauryPouly
Revision r2 - 12 Sep 2012 - 17:37 - AmauryPoulyRevision r1 - 11 Sep 2012 - 21:59 - AmauryPouly Copyright © by the contributing authors.
|