Subversion Repositories freemyipod

//
//
//    Copyright 2010 TheSeven
//
//
//    This file is part of emCORE.
//
//    emCORE is free software: you can redistribute it and/or
//    modify it under the terms of the GNU General Public License as
//    published by the Free Software Foundation, either version 2 of the
//    License, or (at your option) any later version.
//
//    emCORE is distributed in the hope that it will be useful,
//    but WITHOUT ANY WARRANTY; without even the implied warranty of
//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
//    See the GNU General Public License for more details.
//
//    You should have received a copy of the GNU General Public License along
//    with emCORE.  If not, see <http://www.gnu.org/licenses/>.
//
//


#include "emcoreapp.h"
#include "libboot.h"


void main(int argc, const char** argv);
EMCORE_APP_HEADER("emCORE uninstaller", main, 127)


struct wakeup eventwakeup;
volatile int button;

#define nor ((uint8_t*)0x24000000)
#define norword ((uint32_t*)0x24000000)


void handler(void* user, enum button_event eventtype, int which, int value)
{
    if (eventtype == BUTTON_PRESS) button |= 1 << which;
    wakeup_signal(&eventwakeup);
}

void* safe_memalign(size_t align, size_t size)
{
    void* addr = memalign(align, size);
    if (!addr) panicf(PANIC_KILLTHREAD, "Out of memory!");
    return addr;
}

uint32_t freeret(uint32_t rc, void* ptr)
{
    free(ptr);
    return rc;
}

uint32_t decryptfw(void* image, uint32_t offset)
{
    uint32_t size = ((uint32_t*)image)[5];
    if (size > 0x800000) return 0;
    hwkeyaes(HWKEYAES_DECRYPT, ((uint32_t*)image)[2], &((uint8_t*)image)[offset], size);
    memcpy(image, &((uint8_t*)image)[offset], size);
    return size;
}

uint32_t getfw(const char* filename, uint32_t* sector, uint32_t* size)
{
    uint32_t i;
    uint32_t* buffer = safe_memalign(0x10, 0x800);
    if (storage_read_sectors_md(0, 0, 1, buffer) != 0) return freeret(1, buffer);
    if (*((uint16_t*)((uint32_t)buffer + 0x1FE)) != 0xAA55) return freeret(1, buffer);
    uint32_t startsector = 0;
    for (i = 0x1C2; i < 0x200; i += 0x10)
        if (((uint8_t*)buffer)[i] == 0)
        {
            startsector = *((uint16_t*)((uint32_t)buffer + i + 4))
                        | (*((uint16_t*)((uint32_t)buffer + i + 6)) << 16);
            break;
        }
    if (startsector == 0) return freeret(1, buffer);
    if (storage_read_sectors_md(0, startsector, 1, buffer) != 0) return freeret(1, buffer);
    if (buffer[0x40] != 0x5B68695D) return freeret(1, buffer);
    if (storage_read_sectors_md(0, startsector + 1 + (buffer[0x41] >> 11), 1, buffer) != 0)
        return freeret(1, buffer);
    for (i = 0; i < 0x1FE; i += 10)
        if (memcmp(&buffer[i], filename, 8) == 0)
        {
            *sector = startsector + (buffer[i + 3] >> 11);
            *size = buffer[i + 4] + 0x800;
            free(buffer);
            return 0;
        }
    return freeret(2, buffer);
}

uint32_t readfw(const char* filename, void** address, uint32_t* size)
{
    uint32_t sector;
    uint32_t rc = getfw(filename, &sector, size);
    if (rc) return rc;
    *address = safe_memalign(0x10, *size);
    if (storage_read_sectors_md(0, sector, ((*size + 0x7FF) >> 11), *address) != 0)
        return freeret(1, *address);
    *size = decryptfw(*address, 0x800);
    *address = realloc(*address, *size);
    return 0;
}

void main(int argc, const char** argv)
{
    uint32_t i, j, k;
    uint8_t* aupd;
    uint32_t aupdsize;
        uint32_t payloadstart = 0;
    struct progressbar_state progressbar;

    cputc(1, '.');

    if (norword[0x400] != 0x53436667)
        panicf(PANIC_KILLTHREAD, "Boot flash contents are damaged! (No SYSCFG found)\n\n"
                                 "Please ask for help.");

    aupdsize = 0;
    if (readfw("DNANdpua", (void**)&aupd, &aupdsize)) aupdsize = 0;
    cputc(1, '.');
    if (!aupdsize)
    {
        cputs(3, "\n\nPlease press any key to\nenter disk mode and\nrestore your iPod using\n"
                 "iTunes. After your iPod\nreboots, run the\nuninstaller again.\n"
                 "If this message is still\nshown after restoring,\nplease ask for help.");
        wakeup_init(&eventwakeup);
        struct button_hook_entry* hook = button_register_handler(handler, NULL);
        if (!hook) panicf(PANIC_KILLTHREAD, "Could not register button hook!");
        button = 0;
        while (true)
        {
            wakeup_wait(&eventwakeup, TIMEOUT_BLOCK);
            if (button)
            {
                void* firmware = NULL;
                int size;
                struct emcorelib_header* lib = get_library(LIBBOOT_IDENTIFIER, LIBBOOT_API_VERSION,
                                                           LIBSOURCE_BOOTFLASH, "libboot ");
                if (!lib) panicf(PANIC_KILLTHREAD, "Could not load libboot!");
                struct libboot_api* boot = (struct libboot_api*)lib->api;
                boot->load_from_flash(&firmware, &size, false, "diskmode", 0x100000);
                release_library(lib);
                library_unload(lib);
                if (!firmware)
                    panicf(PANIC_KILLTHREAD, "Could not boot disk mode.\nPlease ask for help.");
                shutdown(false);
                execfirmware((void*)0x08000000, firmware, size);
            }
        }
    }

    cputc(1, '.');
    uint8_t* norbuf = (uint8_t*)safe_memalign(0x10, 0x100000);
    #define norbufword ((uint32_t*)norbuf)
    cputc(1, '.');
    memset(norbuf, 0xff, 0x100000);
    cputc(1, '.');
    memcpy(&norbuf[0x4000], &nor[0x1000], 0x1000);
    cputc(1, '.');
    
    for (i = 0; i < (aupdsize >> 2); i++)
                if (((uint32_t*)aupd)[i] == 0x50796c64 && ((uint32_t*)aupd)[i + 4] == 0x46775570)
                    payloadstart = i << 2;
        if (!payloadstart)
        panicf(PANIC_KILLTHREAD, "Restore image is weird:\nNo payload start found.\n"
                                 "Please ask for help.");
    cputc(1, '.');
        memcpy(norbuf, &aupd[payloadstart + 0x2c], 0x2000);
    cputc(1, '.');
        memcpy(&norbuf[0x8800], &aupd[payloadstart + 0x2048], 0x1f800);
    cputc(1, '.');
        memcpy(&norbuf[0x28000], &aupd[payloadstart + 0x22048], 0xd8000);
    cputc(1, '.');
        free(aupd);

    memset(&norbuf[0x8000], 0, 0x800);
    cputc(1, '.');
    norbufword[0x2000] = 0x31303738;
    norbufword[0x2001] = 0x00302e31;
    norbufword[0x2002] = 0x800;
    norbufword[0x2003] = 0x1f800;
    cputc(1, '.');
    hmacsha1(&norbuf[0x8800], 0x1f800, &norbuf[0x8010]);
    cputc(1, '.');
    hmacsha1(&norbuf[0x8000], 0x40, &norbuf[0x8040]);
    cputc(1, '.');
    hwkeyaes(HWKEYAES_ENCRYPT, 2, &norbuf[0x8000], 0x20000);
    cputc(1, '.');
    for (i = 0xffe00; i < 0xffec8; i += 0x28)
        if (norbufword[i >> 2])
        {
            uint32_t offs = norbufword[(i >> 2) + 3] >> 2;
            norbufword[offs] = 0;
            norbufword[offs + 1] = 2;
            norbufword[offs + 2] = 2;
            norbufword[offs + 3] = 0x40;
            norbufword[offs + 4] = 0;
            norbufword[offs + 5] = norbufword[(i >> 2) + 4];
            cputc(1, '.');
            hmacsha1(&norbufword[offs + 0x80], norbufword[(i >> 2) + 4], &norbufword[offs + 7]);
            cputc(1, '.');
            memset(&norbufword[offs + 0x75], 0, 0x14);
            cputc(1, '.');
            hmacsha1(&norbufword[offs], 0x200, &norbufword[offs + 0x75]);
            cputc(1, '.');
            hwkeyaes(HWKEYAES_ENCRYPT, 2, &norbufword[offs + 0x80], norbufword[(i >> 2) + 4]);
            cputc(1, '.');
        }

    for (i = 0; i < 16; i++)
    {
        bootflash_writeraw(&norbuf[i * 0x10000], i * 0x10000, 0x10000);
        cputc(1, '.');
    }
    free(norbuf);
    shutdown(false);
    reset();
}