Subversion Repositories freemyipod

#!/usr/bin/env python

#

#

#    Copyright 2010 TheSeven

#

#

#    This file is part of TheSeven's iPod tools.

#

#    TheSeven's iBugger is free software: you can redistribute it and/or

#    modify it under the terms of the GNU General Public License as

#    published by the Free Software Foundation, either version 2 of the

#    License, or (at your option) any later version.

#

#    TheSeven's iBugger is distributed in the hope that it will be useful,

#    but WITHOUT ANY WARRANTY; without even the implied warranty of

#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

#    See the GNU General Public License for more details.

#

#    You should have received a copy of the GNU General Public License along

#    with TheSeven's iPod tools.  If not, see <http://www.gnu.org/licenses/>.

#

#

import sys

import struct

import usb.core

class ipoddfu:

  def __init__(self, generation = 0, type = 0):

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1220)

    if self.dev and generation in [0, 2] and type in [0, 1]:

      self.dev.set_configuration(1)

      self.generation = 2;

      self.type = 1;

      print("Connected to S5L8701 Bootrom DFU mode, USB version %s"  % self.dev.bcdDevice)

      return

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1240)

    if self.dev and generation in [0, 2] and type in [0, 2]:

      self.dev.set_configuration(1)

      self.generation = 2;

      self.type = 2;

      print("Connected to iPod Nano 2G NOR DFU mode, USB version %s"  % self.dev.bcdDevice)

      return

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1223)

    if self.dev and generation in [0, 3] and type in [0, 1]:

      self.dev.set_configuration(1)

      self.generation = 3;

      self.type = 1;

      print("Connected to S5L8702 Bootrom DFU mode, USB version %s"  % self.dev.bcdDevice)

      return

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1242)

    if self.dev and generation in [0, 3] and type in [0, 1]:

      self.dev.set_configuration(1)

      self.generation = 3;

      self.type = 2;

      print("Connected to iPod Nano 3G WTF mode, USB version %s"  % self.dev.bcdDevice)

      return

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1225)

    if self.dev and generation in [0, 4] and type in [0, 1]:

      self.dev.set_configuration(1)

      self.generation = 4;

      self.type = 1;

      print("Connected to S5L8720 Bootrom DFU mode, USB version %s"  % self.dev.bcdDevice)

      return

    self.dev = usb.core.find(idVendor=0x05ac, idProduct=0x1243)

    if self.dev and generation in [0, 4] and type in [0, 1]:

      self.dev.set_configuration(1)

      self.generation = 4;

      self.type = 2;

      print("Connected to iPod Nano 4G WTF mode, USB version %s"  % self.dev.bcdDevice)

      return

    raise Exception("Could not find specified DFU device (generation = %d, type = %d)" % (generation, type))

  @staticmethod

  def crc32(data):

    crc_table = []

    for i in range(256):

      t = i;

      for j in range(8):

        if t & 1:

          t = (t >> 1) ^ 0xedb88320

        else:

          t = t >> 1

      crc_table.append(t)

    crc = 0xffffffff

    for i in range(len(data)):

      crc = (crc >> 8) ^ crc_table[(crc ^ struct.unpack("B", data[i])[0]) & 0xff];

    return crc

  def getcpu(self):

    result = self.handle.controlMsg(0xa1, 0xff, 0x3f, 2, 0, 100)

    return struct.pack("%dB" % len(result), *result)

  def upload(self, data, exploit = 0):

    if exploit == 1 and self.generation == 2 and self.type == 1:

      data = f.read().ljust(0x200f0, "\0") \

           + "\xb8\x48\x02\x22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22" \

           + "\0\0\0\x22\0\0\0\x22\0\0\0\x22\0\0\0\x22"

    data = data + struct.pack("<I", self.crc32(data))

    sys.stdout.write("Upload: .")

    sys.stdout.flush()

    for index in range((len(data) + 2047) // 2048):

      self.dev.ctrl_transfer(0x21, 1, index, 0, data[2048 * index : 2048 * (index + 1)],   100)

      result = (0, 0, 0, 0, 0, 0)

      while result[4] != 0x05:

        result = self.dev.ctrl_transfer(0xa1, 3, 0, 0, 6, 100)

      sys.stdout.write(".")

      sys.stdout.flush()

    self.dev.ctrl_transfer(0x21, 1, index, 0, "",  100)

    result = (0, 0, 0, 0, 0, 0)

    index = 0

    try:

      while result[4] != 0x02 and index < 1000:

        result = self.dev.ctrl_transfer(0xa1, 3, 0, 0, 6, 100)

        index = index + 1

    except:

      pass

    if (exploit == 0 and (index == 1000 or result[4] == 0x02)) or \

       (exploit == 1 and (index == 1000 or result[4] != 0x04)):

      print(" failed: %X / %X" % (result[4], result[0]))

      raise Exception("DFU upload failed! (%X / %X)" % (result[4], result[0]))

    else:

      print(" done")

  def uploadfile(self, file, exploit = 0):

    f = open(file, "rb")

    data = f.read()

    f.close()

    self.upload(data, exploit)