GUI firmware patcher for windows.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@6351 a1c6a512-1295-4272-9138-f99709370657

9 files changed, 1082 insertions, 0 deletions

diff --git a/tools/fwpatcher/checksums.h b/tools/fwpatcher/checksums.h
new file mode 100644
index 0000000000..a7de794126
--- /dev/null
+++ b/tools/fwpatcher/checksums.h
@@ -0,0 +1,4 @@
+"627d5195b56ebca3b431cccb535c3bfa", /* 1.63 eu */
+"5068bf62d68fdbfcb3d8a2eaf2f4fdfe", /* 1.63 us */
+"1afe2172a4d10f69069084466f7a83ce", /* 1.63 k */
+"5802da654706239f2782510f6ab73b26"      /* 1.65 eu */ 
diff --git a/tools/fwpatcher/favicon.ico b/tools/fwpatcher/favicon.ico
new file mode 100644
index 0000000000..c4989f558d
--- /dev/null
+++ b/tools/fwpatcher/favicon.ico
diff --git a/tools/fwpatcher/iriver.c b/tools/fwpatcher/iriver.c
new file mode 100644
index 0000000000..e24df8c768
--- /dev/null
+++ b/tools/fwpatcher/iriver.c
@@ -0,0 +1,393 @@
+/***************************************************************************
+ *             __________               __   ___.
+ *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
+ *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
+ *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
+ *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
+ *                     \/            \/     \/    \/            \/
+ * $Id$
+ *
+ * Copyright (C) 2004 by Dave Hooper
+ *
+ * This particular source code file is licensed under the X11 license. See the
+ * bottom of the COPYING file for details on this license.
+ *
+ * Original code from http://www.beermex.com/@spc/ihpfirm.src.zip
+ * Details at http://www.rockbox.org/twiki/bin/view/Main/IriverToolsGuide
+ *
+ ****************************************************************************/
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "iriver.h"
+
+const unsigned char munge[] = {
+  0x7a, 0x36, 0xc4, 0x43, 0x49, 0x6b, 0x35, 0x4e, 0xa3, 0x46, 0x25, 0x84,
+  0x4d, 0x73, 0x74, 0x61
+};
+
+const unsigned char header_modify[] = "* IHPFIRM-DECODED ";
+
+const char * const models[] = { "iHP-100", "iHP-120/iHP-140", "H300 series",
+                                NULL };
+
+/* aligns with models array;  expected min firmware size */
+const unsigned int firmware_minsize[] = { 0x100000, 0x100000, 0x200000 };
+/* aligns with models array;  expected max firmware size */
+const unsigned int firmware_maxsize[] = { 0x200000, 0x200000, 0x400000 };
+
+const unsigned char header[][16] = {
+  { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 },
+  { 0x20, 0x03, 0x08, 0x27, 0x24, 0x00, 0x02, 0x30, 0x19, 0x17, 0x65, 0x73,
+    0x85, 0x32, 0x83, 0x22 },
+  { 0x20, 0x04, 0x03, 0x27, 0x20, 0x50, 0x01, 0x70, 0x80, 0x30, 0x80, 0x06,
+    0x30, 0x19, 0x17, 0x65 }
+};
+
+static int testheader( const unsigned char * const data )
+{
+    const unsigned char * const d = data+16;
+    const char * const * m = models;
+    int index = 0;
+    while( *m )
+    {
+        if( memcmp( header[ index ], d, 16 ) == 0 )
+            return index;
+        index++;
+        m++;
+    };
+    return -1;
+};
+
+static void modifyheader( unsigned char * data )
+{
+    const unsigned char * h = header_modify;
+    int i;
+    for( i=0; i<512; i++ )
+    {
+        if( *h == '\0' )
+            h = header_modify;
+        *data++ ^= *h++;
+    };
+};
+
+static FILE * openinfile( const TCHAR * filename )
+{
+    FILE * F = _tfopen( filename, TEXT("rb") );
+    if( F == NULL )
+    {
+        fprintf( stderr, "Couldn't open input file %s\n", filename );
+        perror( "Error was " );
+    };
+    return F;
+};
+
+static FILE * openoutfile( const TCHAR * filename )
+{
+    FILE * F = _tfopen( filename, TEXT("wb") );
+    if( F == NULL )
+    {
+        fprintf( stderr, "Couldn't open output file %s\n", filename );
+        perror( "Error was " );
+    };
+    return F;
+};
+
+int iriver_decode(TCHAR *infile_name, TCHAR *outfile_name, unsigned int modify,
+                  enum striptype stripmode )
+{
+    FILE * infile = NULL;
+    FILE * outfile = NULL;
+    int i = -1;
+    unsigned char headerdata[512];
+    unsigned long dwLength1, dwLength2, dwLength3, fp = 0;
+    unsigned char blockdata[16+16];
+    unsigned char out[16];
+    unsigned char newmunge;
+    signed long lenread;
+    int s = 0;
+    unsigned char * pChecksums, * ppChecksums = 0;
+    unsigned char ck;
+
+    infile = openinfile(infile_name);
+    outfile = openoutfile(outfile_name);
+        if (!infile || !outfile) return -1;
+        
+    lenread = fread( headerdata, 1, 512, infile );
+    if( lenread != 512 )
+    {
+        fprintf( stderr, "This doesn't look like a valid encrypted iHP "
+                 "firmware - reason: header length\n" );
+        goto error;
+    };
+
+    i = testheader( headerdata );
+    if( i == -1 )
+    {
+        fprintf( stderr, "This firmware is for an unknown model, or is not"
+                 " a valid encrypted iHP firmware\n" );
+        goto error;
+    };
+    fprintf( stderr, "Model %s\n", models[ i ] );
+
+    dwLength1 = headerdata[0] | (headerdata[1]<<8) |
+        (headerdata[2]<<16) | (headerdata[3]<<24);
+    dwLength2 = headerdata[4] | (headerdata[5]<<8) |
+        (headerdata[6]<<16) | (headerdata[7]<<24);
+    dwLength3 = headerdata[8] | (headerdata[9]<<8) |
+        (headerdata[10]<<16) | (headerdata[11]<<24);
+
+    if( dwLength1 < firmware_minsize[ i ] ||
+        dwLength1 > firmware_maxsize[ i ] ||
+        dwLength2 < firmware_minsize[ i ] ||
+        dwLength2 > dwLength1 ||
+        dwLength3 > dwLength1 ||
+        dwLength2>>9 != dwLength3 ||
+        dwLength2+dwLength3+512 != dwLength1 )
+    {
+        fprintf( stderr, "This doesn't look like a valid encrypted "
+                 "iHP firmware - reason: file 'length' data\n" );
+                goto error;
+    };
+
+    pChecksums = ppChecksums = (unsigned char *)( malloc( dwLength3 ) );
+
+    if( modify )
+    {
+        modifyheader( headerdata );
+    };
+
+    if( stripmode == STRIP_NONE )
+        fwrite( headerdata, 512, 1, outfile );
+
+    memset( blockdata, 0, 16 );
+
+    ck = 0;
+    while( ( fp < dwLength2 ) &&
+           ( lenread = fread( blockdata+16, 1, 16, infile ) ) == 16 )
+    {
+        fp += 16;
+
+        for( i=0; i<16; ++i )
+        {
+            newmunge = blockdata[16+i] ^ munge[i];
+            out[i] = newmunge ^ blockdata[i];
+            blockdata[i] = newmunge;
+            ck += out[i];
+        }
+
+        if( fp > ESTF_SIZE || stripmode != STRIP_HEADER_CHECKSUM_ESTF )
+        {
+            fwrite( out+4, 1, 12, outfile );
+            fwrite( out, 1, 4, outfile );
+        }
+        else
+        {
+            if( ESTF_SIZE - fp < 16 )
+            {
+                memcpy( out+4, blockdata+16, 12 );
+                memcpy( out, blockdata+28, 4 );
+                fwrite( blockdata+16+ESTF_SIZE-fp, 1, ESTF_SIZE-fp, outfile );
+            }
+        }
+
+
+        if( s == 496 )
+        {
+            s = 0;
+            memset( blockdata, 0, 16 );
+            *ppChecksums++ = ck;
+            ck = 0;
+        }
+        else
+            s+=16;
+    };
+
+    if( fp != dwLength2 )
+    {
+        fprintf( stderr, "This doesn't look like a valid encrypted "
+                 "iHP firmware - reason: 'length2' mismatch\n" );
+                goto error;
+    };
+
+    fp = 0;
+    ppChecksums = pChecksums;
+    while( ( fp < dwLength3 ) &&
+           ( lenread = fread( blockdata, 1, 32, infile ) ) > 0 )
+    {
+        fp += lenread;
+        if( stripmode == STRIP_NONE )
+            fwrite( blockdata, 1, lenread, outfile );
+        if( memcmp( ppChecksums, blockdata, lenread ) != 0 )
+        {
+            fprintf( stderr, "This doesn't look like a valid encrypted "
+                     "iHP firmware - reason: Checksum mismatch!" );
+                        goto error;
+        };
+        ppChecksums += lenread;
+    };
+
+    if( fp != dwLength3 )
+    {
+        fprintf( stderr, "This doesn't look like a valid encrypted "
+                 "iHP firmware - reason: 'length3' mismatch\n" );
+                goto error;
+    };
+
+
+    fprintf( stderr, "File decoded correctly and all checksums matched!\n" );
+    switch( stripmode )
+    {
+        default:
+        case STRIP_NONE:
+            fprintf(stderr, "Output file contains all headers and "
+                    "checksums\n");
+            break;
+        case STRIP_HEADER_CHECKSUM:
+            fprintf( stderr, "NB:  output file contains only ESTFBINR header"
+                     " and decoded firmware code\n" );
+            break;
+        case STRIP_HEADER_CHECKSUM_ESTF:
+            fprintf( stderr, "NB:  output file contains only raw decoded "
+                     "firmware code\n" );
+            break;
+    };
+
+        fclose(infile);
+        fclose(outfile);
+    return 0;
+error:
+        fclose(infile);
+        fclose(outfile);
+        return -1;
+};
+
+int iriver_encode(TCHAR *infile_name, TCHAR *outfile_name, unsigned int modify )
+{
+    FILE * infile = NULL;
+    FILE * outfile = NULL;
+    int i = -1;
+    unsigned char headerdata[512];
+    unsigned long dwLength1, dwLength2, dwLength3, fp = 0;
+    unsigned char blockdata[16+16];
+    unsigned char out[16];
+    unsigned char newmunge;
+    signed long lenread;
+    int s = 0;
+    unsigned char * pChecksums, * ppChecksums;
+    unsigned char ck;
+
+    enum striptype stripmode = STRIP_NONE;
+
+    infile = openinfile(infile_name);
+    outfile = openoutfile(outfile_name);
+        if (!infile || !outfile) return -1;
+
+    lenread = fread( headerdata, 1, 512, infile );
+    if( lenread != 512 )
+    {
+        fprintf( stderr, "This doesn't look like a valid decoded "
+                 "iHP firmware - reason: header length\n" );
+        goto error;
+    };
+
+    if( modify )
+    {
+        modifyheader( headerdata ); /* reversible */
+    };
+
+    i = testheader( headerdata );
+    if( i == -1 )
+    {
+        fprintf( stderr, "This firmware is for an unknown model, or is not"
+                 " a valid decoded iHP firmware\n" );
+        goto error;
+    };
+    fprintf( stderr, "Model %s\n", models[ i ] );
+
+    dwLength1 = headerdata[0] | (headerdata[1]<<8) |
+        (headerdata[2]<<16) | (headerdata[3]<<24);
+    dwLength2 = headerdata[4] | (headerdata[5]<<8) |
+        (headerdata[6]<<16) | (headerdata[7]<<24);
+    dwLength3 = headerdata[8] | (headerdata[9]<<8) |
+        (headerdata[10]<<16) | (headerdata[11]<<24);
+
+    if( dwLength1 < firmware_minsize[i] ||
+        dwLength1 > firmware_maxsize[i] ||
+        dwLength2 < firmware_minsize[i] ||
+        dwLength2 > dwLength1 ||
+        dwLength3 > dwLength1 ||
+        dwLength2+dwLength3+512 != dwLength1 )
+    {
+        fprintf( stderr, "This doesn't look like a valid decoded iHP"
+                 " firmware - reason: file 'length' data\n" );
+        goto error;
+    };
+
+    pChecksums = ppChecksums = (unsigned char *)( malloc( dwLength3 ) );
+
+    fwrite( headerdata, 512, 1, outfile );
+
+    memset( blockdata, 0, 16 );
+    ck = 0;
+    while( ( fp < dwLength2 ) &&
+           ( lenread = fread( blockdata+16, 1, 16, infile ) ) == 16 )
+    {
+        fp += 16;
+        for( i=0; i<16; ++i )
+        {
+            newmunge = blockdata[16+((12+i)&0xf)] ^ blockdata[i];
+            out[i] = newmunge ^ munge[i];
+            ck += blockdata[16+i];
+            blockdata[i] = newmunge;
+        };
+        fwrite( out, 1, 16, outfile );
+
+        if( s == 496 )
+        {
+            s = 0;
+            memset( blockdata, 0, 16 );
+            *ppChecksums++ = ck;
+            ck = 0;
+        }
+        else
+            s+=16;
+    };
+
+    if( fp != dwLength2 )
+    {
+        fprintf( stderr, "This doesn't look like a valid decoded "
+                 "iHP firmware - reason: 'length1' mismatch\n" );
+        goto error;
+    };
+
+    /* write out remainder w/out applying descrambler */
+    fp = 0;
+    lenread = dwLength3;
+    ppChecksums = pChecksums;
+    while( ( fp < dwLength3) &&
+           ( lenread = fwrite( ppChecksums, 1, lenread, outfile ) ) > 0 )
+    {
+        fp += lenread;
+        ppChecksums += lenread;
+        lenread = dwLength3 - fp;
+    };
+
+    if( fp != dwLength3 )
+    {
+        fprintf( stderr, "This doesn't look like a valid decoded "
+                 "iHP firmware - reason: 'length2' mismatch\n" );
+        goto error;
+    };
+
+    fprintf( stderr, "File encoded successfully and checksum table built!\n" );
+
+        fclose(infile);
+        fclose(outfile);
+    return 0;
+error:
+        fclose(infile);
+        fclose(outfile);
+        return -1;
+};
diff --git a/tools/fwpatcher/iriver.h b/tools/fwpatcher/iriver.h
new file mode 100644
index 0000000000..d3d00d2eff
--- /dev/null
+++ b/tools/fwpatcher/iriver.h
@@ -0,0 +1,40 @@
+/***************************************************************************
+ *             __________               __   ___.
+ *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
+ *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
+ *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
+ *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
+ *                     \/            \/     \/    \/            \/
+ * $Id$
+ *
+ * Copyright (C) 2005 by Daniel Stenberg
+ *
+ * All files in this archive are subject to the GNU General Public License.
+ * See the file COPYING in the source tree root for full license agreement.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ****************************************************************************/
+
+#include <tchar.h>
+#include <windows.h>
+
+#define TRUE 1
+#define FALSE 0
+
+#define BOOL unsigned int
+
+#define ESTF_SIZE 32
+
+enum striptype
+{
+  STRIP_NONE,
+  STRIP_HEADER_CHECKSUM,
+  STRIP_HEADER_CHECKSUM_ESTF
+};
+
+/* protos for iriver.c */
+int iriver_decode(TCHAR *infile, TCHAR *outfile, BOOL modify,
+                  enum striptype stripmode );
+int iriver_encode(TCHAR *infile_name, TCHAR *outfile_name, BOOL modify );
diff --git a/tools/fwpatcher/main.c b/tools/fwpatcher/main.c
new file mode 100644
index 0000000000..c8fa11ea95
--- /dev/null
+++ b/tools/fwpatcher/main.c
@@ -0,0 +1,367 @@
+/***************************************************************************
+ *             __________               __   ___.
+ *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
+ *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
+ *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
+ *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
+ *                     \/            \/     \/    \/            \/
+ * $Id$
+ *
+ * Copyright (C) 2005 by Thom Johansen
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ****************************************************************************/
+
+/* TODO: integrate the iriver.c and mkboot stuff better, they're pretty much
+ * intended to be called from a command line tool, and i haven't changed that.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <tchar.h>
+#include <windows.h>
+#include "iriver.h"
+#include "md5.h"
+#include "resource.h"
+
+#define WINDOW_WIDTH 280 
+#define WINDOW_HEIGHT 130 
+
+#define IDM_RESTORE 1000
+#define IDM_EXIT 1010
+
+#define LABEL_FILENAME 0
+#define EDIT_FILENAME 1
+#define BUTTON_BROWSE 2
+#define BUTTON_PATCH 3
+
+#define CTL_NUM 4
+
+/* include precalculated checksums */
+static char *checksums[] = {
+#include "checksums.h"
+};
+
+HICON rbicon;
+HFONT deffont;
+HWND controls[CTL_NUM];
+
+/* begin mkboot.c excerpt */
+
+char image[0x200000 + 0x220 + 0x200000/0x200];
+
+int mkboot(TCHAR *infile, TCHAR *outfile, unsigned char *bldata, int bllen)
+{
+    FILE *f;
+    int i;
+    int len;
+    int actual_length, total_length, binary_length, num_chksums;
+
+    memset(image, 0xff, sizeof(image));
+
+    /* First, read the iriver original firmware into the image */
+    f = _tfopen(infile, TEXT("rb"));
+    if(!f) {
+        perror(infile);
+        return 0;
+    }
+
+    i = fread(image, 1, 16, f);
+    if(i < 16) {
+        perror(infile);
+        return 0;
+    }
+
+    /* This is the length of the binary image without the scrambling
+       overhead (but including the ESTFBINR header) */
+    binary_length = image[4] + (image[5] << 8) +
+        (image[6] << 16) + (image[7] << 24);
+
+    /* Read the rest of the binary data, but not the checksum block */
+    len = binary_length+0x200-16;
+    i = fread(image+16, 1, len, f);
+    if(i < len) {
+        perror(infile);
+        return 0;
+    }
+    
+    fclose(f);
+
+    memcpy(image + 0x220 + 0x1f0000, bldata, bllen);
+    
+    f = _tfopen(outfile, TEXT("wb"));
+    if(!f) {
+        perror(outfile);
+        return 0;
+    }
+
+    /* Patch the reset vector to start the boot loader */
+    image[0x220 + 4] = image[0x1f0000 + 0x220 + 4];
+    image[0x220 + 5] = image[0x1f0000 + 0x220 + 5];
+    image[0x220 + 6] = image[0x1f0000 + 0x220 + 6];
+    image[0x220 + 7] = image[0x1f0000 + 0x220 + 7];
+
+    /* This is the actual length of the binary, excluding all headers */
+    actual_length = 0x1f0000 + bllen;
+
+    /* Patch the ESTFBINR header */
+    image[0x20c] = (actual_length >> 24) & 0xff;
+    image[0x20d] = (actual_length >> 16) & 0xff;
+    image[0x20e] = (actual_length >> 8) & 0xff;
+    image[0x20f] = actual_length & 0xff;
+    
+    image[0x21c] = (actual_length >> 24) & 0xff;
+    image[0x21d] = (actual_length >> 16) & 0xff;
+    image[0x21e] = (actual_length >> 8) & 0xff;
+    image[0x21f] = actual_length & 0xff;
+
+    /* This is the length of the binary, including the ESTFBINR header and
+       rounded up to the nearest 0x200 boundary */
+    binary_length = (actual_length + 0x20 + 0x1ff) & 0xfffffe00;
+
+    /* The number of checksums, i.e number of 0x200 byte blocks */
+    num_chksums = binary_length / 0x200;
+
+    /* The total file length, including all headers and checksums */
+    total_length = binary_length + num_chksums + 0x200;
+
+    /* Patch the scrambler header with the new length info */
+    image[0] = total_length & 0xff;
+    image[1] = (total_length >> 8) & 0xff;
+    image[2] = (total_length >> 16) & 0xff;
+    image[3] = (total_length >> 24) & 0xff;
+    
+    image[4] = binary_length & 0xff;
+    image[5] = (binary_length >> 8) & 0xff;
+    image[6] = (binary_length >> 16) & 0xff;
+    image[7] = (binary_length >> 24) & 0xff;
+    
+    image[8] = num_chksums & 0xff;
+    image[9] = (num_chksums >> 8) & 0xff;
+    image[10] = (num_chksums >> 16) & 0xff;
+    image[11] = (num_chksums >> 24) & 0xff;
+    
+    i = fwrite(image, 1, total_length, f);
+    if(i < total_length) {
+        perror(outfile);
+        return 0;
+    }
+
+    fclose(f);
+    
+    return 1;
+}
+
+/* end mkboot.c excerpt */
+
+int FileMD5(TCHAR *name, char *md5)
+{
+    int i, read;
+    md5_context ctx;
+    unsigned char md5sum[16];
+    unsigned char block[32768];
+    FILE *file;
+    
+    file = _tfopen(name, TEXT("rb"));
+    if (!file) {
+        MessageBox(NULL,
+                   TEXT("Could not open patched firmware for checksum check"),
+                   TEXT("Error"), MB_ICONERROR);
+        return 0;
+    }
+    md5_starts(&ctx);
+    while ((read = fread(block, 1, sizeof(block), file)) > 0) {
+        md5_update(&ctx, block, read);
+    }
+    fclose(file);
+    md5_finish(&ctx, md5sum);
+    for (i = 0; i < 16; ++i)
+        sprintf(md5 + 2*i, "%02x", md5sum[i]);
+    return 1;
+}
+
+int PatchFirmware()
+{
+    TCHAR fn[MAX_PATH];
+    TCHAR name1[MAX_PATH], name2[MAX_PATH], name3[MAX_PATH];
+    HRSRC res;
+    HGLOBAL resload;
+    unsigned char *bootloader;
+    unsigned char md5sum_str[256];
+    DWORD blsize;
+    int i;
+      
+    /* get pointer to bootloader.bin */
+    res = FindResource(NULL, MAKEINTRESOURCE(IDI_BOOTLOADER), TEXT("BIN"));
+    resload = LoadResource(NULL, res);
+    bootloader = (unsigned char *)LockResource(resload);
+    blsize = SizeofResource(NULL, res);
+    
+    /* get filename from edit box */
+    GetWindowText(controls[EDIT_FILENAME], fn, MAX_PATH);
+    /* store temp files in temp directory */
+    GetTempPath(MAX_PATH, name1);
+    GetTempPath(MAX_PATH, name2);
+    GetTempPath(MAX_PATH, name3);
+    _tcscat(name1, TEXT("firmware.bin")); /* descrambled file */
+    _tcscat(name2, TEXT("new.bin"));      /* patched file */
+    _tcscat(name3, TEXT("new.hex"));      /* patched and scrambled file */
+    if (iriver_decode(fn, name1, FALSE, STRIP_NONE) == -1) {
+        MessageBox(NULL, TEXT("Error in descramble"),
+                   TEXT("Error"), MB_ICONERROR);
+        goto error;
+    }
+    if (!mkboot(name1, name2, bootloader, blsize)) {
+        MessageBox(NULL, TEXT("Error in patching"),
+                   TEXT("Error"), MB_ICONERROR);
+        goto error;
+    }
+    if (iriver_encode(name2, name3, FALSE) == -1) {
+        MessageBox(NULL, TEXT("Error in scramble"),
+                   TEXT("Error"), MB_ICONERROR);
+        goto error;
+    }
+    /* now md5sum it */
+    if (!FileMD5(name3, md5sum_str)) goto error;
+    for (i = 0; i < sizeof(checksums)/sizeof(char *); ++i) {
+        if (strncmp(checksums[i], md5sum_str, 32) != 0) {
+            MessageBox(NULL, 
+                       TEXT("Checksum doesn't match known good patched firmware.\n")
+                       TEXT("Download another firmware image, then try again."),
+                       TEXT("Error"), MB_ICONERROR);
+            goto error;
+        }
+    }
+    /* all is fine, rename the patched file to original name of the firmware */
+    MoveFileEx(name3, fn, MOVEFILE_COPY_ALLOWED | MOVEFILE_REPLACE_EXISTING);
+    /* delete temp files */
+    DeleteFile(name1);
+    DeleteFile(name2);
+    return 1;
+error:
+    /* delete all temp files, don't care if some aren't created yet */
+    DeleteFile(name1);
+    DeleteFile(name2);
+    DeleteFile(name3);
+    return 0;
+}
+
+int FileDialog(TCHAR *fn)
+{
+    OPENFILENAME ofn;
+    TCHAR filename[MAX_PATH];
+
+    ZeroMemory(&ofn, sizeof(ofn));
+    ofn.lStructSize = sizeof(ofn);
+    ofn.lpstrFile = filename;
+    ofn.lpstrFile[0] = '\0'; // no default filename
+    ofn.nMaxFile = sizeof(filename);
+    ofn.lpstrFilter = TEXT("Firmware\0*.HEX\0");
+    ofn.nFilterIndex = 1;
+    ofn.lpstrFileTitle = NULL;
+    ofn.nMaxFileTitle = 0;
+    ofn.lpstrInitialDir = NULL;
+    ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;
+    
+    if (GetOpenFileName(&ofn) == TRUE) {
+        _tcscpy(fn, filename);
+        return 1;
+    }
+    return 0;
+}
+
+LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
+{
+   int i;
+   switch (msg) {
+   case WM_CREATE:
+       /* text label */
+       controls[LABEL_FILENAME] = 
+           CreateWindowEx(0, TEXT("STATIC"), TEXT("Firmware file name:"),
+                          WS_CHILD | WS_VISIBLE, 10, 14,
+                          100, 32, hwnd, 0, 0, 0);
+       /* text field for inputing file name */
+       controls[EDIT_FILENAME] = 
+           CreateWindowEx(WS_EX_CLIENTEDGE, TEXT("EDIT"), TEXT(""),
+                          WS_CHILD | WS_TABSTOP | WS_VISIBLE | ES_AUTOHSCROLL,
+                          10, 35, 180, 20, hwnd, 0, 0, 0);
+       /* browse button */
+       controls[BUTTON_BROWSE] =
+           CreateWindowEx(0, TEXT("BUTTON"), TEXT("Browse"),
+                          WS_CHILD | WS_TABSTOP | WS_VISIBLE, 200, 32, 70, 25,
+                          hwnd, 0, 0, 0);        
+       /* patch button */
+       controls[BUTTON_PATCH] =
+           CreateWindowEx(0, TEXT("BUTTON"), TEXT("Patch"),
+                          WS_CHILD | WS_TABSTOP | WS_VISIBLE, 90, 70, 90, 25,
+                          hwnd, 0, 0, 0);
+       /* set default font on all controls, will be ugly if we don't do this */
+       deffont = GetStockObject(DEFAULT_GUI_FONT);
+       for (i = 0; i < CTL_NUM; ++i) 
+           SendMessage(controls[i], WM_SETFONT, (WPARAM)deffont,
+                       MAKELPARAM(FALSE, 0));
+        break;
+    case WM_CLOSE:
+        DestroyWindow(hwnd);
+        break;
+    case WM_DESTROY:
+        PostQuitMessage(0);
+        break;
+    case WM_SIZE:
+        break;
+    case WM_COMMAND:
+        /* user pressed browse button */
+        if (((HWND)lParam == controls[BUTTON_BROWSE])) {
+            TCHAR buf[MAX_PATH];
+            if (FileDialog(buf))
+                SetWindowText(controls[EDIT_FILENAME], buf);
+        }
+        /* user pressed patch button */
+        if (((HWND)lParam == controls[BUTTON_PATCH])) {
+            if (PatchFirmware())
+                MessageBox(NULL, TEXT("Firmware patched successfully"),
+                           TEXT("Success"), MB_OK);
+        }
+        break;
+    default:
+        return DefWindowProc(hwnd, msg, wParam, lParam);
+    }
+    return 0;
+}
+
+int WINAPI WinMain(HINSTANCE instance, HINSTANCE prev_instance,
+                   LPSTR command_line, int command_show) 
+{
+    HWND window;
+    WNDCLASSEX wc;
+    MSG msg;
+    
+    rbicon = LoadIcon(instance, MAKEINTRESOURCE(IDI_RBICON));
+    ZeroMemory(&wc, sizeof(wc));
+    wc.cbSize = sizeof(wc);
+    wc.lpfnWndProc = WndProc;
+    wc.hInstance = instance;
+    wc.hIcon = rbicon;
+    wc.hCursor = LoadCursor(0, IDC_ARROW);
+    wc.hbrBackground = (HBRUSH)(COLOR_3DFACE + 1);
+    wc.lpszClassName = TEXT("patcher");
+    RegisterClassEx(&wc);
+
+    window = CreateWindowEx(0, TEXT("patcher"), TEXT("Rockbox firmware patcher"),
+                            WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU |
+                            WS_MINIMIZEBOX, CW_USEDEFAULT, CW_USEDEFAULT,
+                            WINDOW_WIDTH, WINDOW_HEIGHT, 0, 0, instance, NULL);
+    if (!window) return 0;
+
+    ShowWindow(window, command_show);
+    while (GetMessage(&msg, 0, 0, 0) > 0) {
+        if (!IsDialogMessage(window, &msg)) {
+            TranslateMessage(&msg);
+            DispatchMessage(&msg);
+        }
+    }
+    return 0;
+}
+
diff --git a/tools/fwpatcher/md5.c b/tools/fwpatcher/md5.c
new file mode 100644
index 0000000000..6c5e8127f9
--- /dev/null
+++ b/tools/fwpatcher/md5.c
@@ -0,0 +1,246 @@
+/*
+ *  RFC 1321 compliant MD5 implementation
+ *
+ *  Copyright (C) 2001-2003  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <string.h>
+
+#include "md5.h"
+
+#define GET_UINT32(n,b,i)                       \
+{                                               \
+    (n) = ( (uint32) (b)[(i)    ]       )       \
+        | ( (uint32) (b)[(i) + 1] <<  8 )       \
+        | ( (uint32) (b)[(i) + 2] << 16 )       \
+        | ( (uint32) (b)[(i) + 3] << 24 );      \
+}
+
+#define PUT_UINT32(n,b,i)                       \
+{                                               \
+    (b)[(i)    ] = (uint8) ( (n)       );       \
+    (b)[(i) + 1] = (uint8) ( (n) >>  8 );       \
+    (b)[(i) + 2] = (uint8) ( (n) >> 16 );       \
+    (b)[(i) + 3] = (uint8) ( (n) >> 24 );       \
+}
+
+void md5_starts( md5_context *ctx )
+{
+    ctx->total[0] = 0;
+    ctx->total[1] = 0;
+
+    ctx->state[0] = 0x67452301;
+    ctx->state[1] = 0xEFCDAB89;
+    ctx->state[2] = 0x98BADCFE;
+    ctx->state[3] = 0x10325476;
+}
+
+void md5_process( md5_context *ctx, uint8 data[64] )
+{
+    uint32 X[16], A, B, C, D;
+
+    GET_UINT32( X[0],  data,  0 );
+    GET_UINT32( X[1],  data,  4 );
+    GET_UINT32( X[2],  data,  8 );
+    GET_UINT32( X[3],  data, 12 );
+    GET_UINT32( X[4],  data, 16 );
+    GET_UINT32( X[5],  data, 20 );
+    GET_UINT32( X[6],  data, 24 );
+    GET_UINT32( X[7],  data, 28 );
+    GET_UINT32( X[8],  data, 32 );
+    GET_UINT32( X[9],  data, 36 );
+    GET_UINT32( X[10], data, 40 );
+    GET_UINT32( X[11], data, 44 );
+    GET_UINT32( X[12], data, 48 );
+    GET_UINT32( X[13], data, 52 );
+    GET_UINT32( X[14], data, 56 );
+    GET_UINT32( X[15], data, 60 );
+
+#define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n)))
+
+#define P(a,b,c,d,k,s,t)                                \
+{                                                       \
+    a += F(b,c,d) + X[k] + t; a = S(a,s) + b;           \
+}
+
+    A = ctx->state[0];
+    B = ctx->state[1];
+    C = ctx->state[2];
+    D = ctx->state[3];
+
+#define F(x,y,z) (z ^ (x & (y ^ z)))
+
+    P( A, B, C, D,  0,  7, 0xD76AA478 );
+    P( D, A, B, C,  1, 12, 0xE8C7B756 );
+    P( C, D, A, B,  2, 17, 0x242070DB );
+    P( B, C, D, A,  3, 22, 0xC1BDCEEE );
+    P( A, B, C, D,  4,  7, 0xF57C0FAF );
+    P( D, A, B, C,  5, 12, 0x4787C62A );
+    P( C, D, A, B,  6, 17, 0xA8304613 );
+    P( B, C, D, A,  7, 22, 0xFD469501 );
+    P( A, B, C, D,  8,  7, 0x698098D8 );
+    P( D, A, B, C,  9, 12, 0x8B44F7AF );
+    P( C, D, A, B, 10, 17, 0xFFFF5BB1 );
+    P( B, C, D, A, 11, 22, 0x895CD7BE );
+    P( A, B, C, D, 12,  7, 0x6B901122 );
+    P( D, A, B, C, 13, 12, 0xFD987193 );
+    P( C, D, A, B, 14, 17, 0xA679438E );
+    P( B, C, D, A, 15, 22, 0x49B40821 );
+
+#undef F
+
+#define F(x,y,z) (y ^ (z & (x ^ y)))
+
+    P( A, B, C, D,  1,  5, 0xF61E2562 );
+    P( D, A, B, C,  6,  9, 0xC040B340 );
+    P( C, D, A, B, 11, 14, 0x265E5A51 );
+    P( B, C, D, A,  0, 20, 0xE9B6C7AA );
+    P( A, B, C, D,  5,  5, 0xD62F105D );
+    P( D, A, B, C, 10,  9, 0x02441453 );
+    P( C, D, A, B, 15, 14, 0xD8A1E681 );
+    P( B, C, D, A,  4, 20, 0xE7D3FBC8 );
+    P( A, B, C, D,  9,  5, 0x21E1CDE6 );
+    P( D, A, B, C, 14,  9, 0xC33707D6 );
+    P( C, D, A, B,  3, 14, 0xF4D50D87 );
+    P( B, C, D, A,  8, 20, 0x455A14ED );
+    P( A, B, C, D, 13,  5, 0xA9E3E905 );
+    P( D, A, B, C,  2,  9, 0xFCEFA3F8 );
+    P( C, D, A, B,  7, 14, 0x676F02D9 );
+    P( B, C, D, A, 12, 20, 0x8D2A4C8A );
+
+#undef F
+    
+#define F(x,y,z) (x ^ y ^ z)
+
+    P( A, B, C, D,  5,  4, 0xFFFA3942 );
+    P( D, A, B, C,  8, 11, 0x8771F681 );
+    P( C, D, A, B, 11, 16, 0x6D9D6122 );
+    P( B, C, D, A, 14, 23, 0xFDE5380C );
+    P( A, B, C, D,  1,  4, 0xA4BEEA44 );
+    P( D, A, B, C,  4, 11, 0x4BDECFA9 );
+    P( C, D, A, B,  7, 16, 0xF6BB4B60 );
+    P( B, C, D, A, 10, 23, 0xBEBFBC70 );
+    P( A, B, C, D, 13,  4, 0x289B7EC6 );
+    P( D, A, B, C,  0, 11, 0xEAA127FA );
+    P( C, D, A, B,  3, 16, 0xD4EF3085 );
+    P( B, C, D, A,  6, 23, 0x04881D05 );
+    P( A, B, C, D,  9,  4, 0xD9D4D039 );
+    P( D, A, B, C, 12, 11, 0xE6DB99E5 );
+    P( C, D, A, B, 15, 16, 0x1FA27CF8 );
+    P( B, C, D, A,  2, 23, 0xC4AC5665 );
+
+#undef F
+
+#define F(x,y,z) (y ^ (x | ~z))
+
+    P( A, B, C, D,  0,  6, 0xF4292244 );
+    P( D, A, B, C,  7, 10, 0x432AFF97 );
+    P( C, D, A, B, 14, 15, 0xAB9423A7 );
+    P( B, C, D, A,  5, 21, 0xFC93A039 );
+    P( A, B, C, D, 12,  6, 0x655B59C3 );
+    P( D, A, B, C,  3, 10, 0x8F0CCC92 );
+    P( C, D, A, B, 10, 15, 0xFFEFF47D );
+    P( B, C, D, A,  1, 21, 0x85845DD1 );
+    P( A, B, C, D,  8,  6, 0x6FA87E4F );
+    P( D, A, B, C, 15, 10, 0xFE2CE6E0 );
+    P( C, D, A, B,  6, 15, 0xA3014314 );
+    P( B, C, D, A, 13, 21, 0x4E0811A1 );
+    P( A, B, C, D,  4,  6, 0xF7537E82 );
+    P( D, A, B, C, 11, 10, 0xBD3AF235 );
+    P( C, D, A, B,  2, 15, 0x2AD7D2BB );
+    P( B, C, D, A,  9, 21, 0xEB86D391 );
+
+#undef F
+
+    ctx->state[0] += A;
+    ctx->state[1] += B;
+    ctx->state[2] += C;
+    ctx->state[3] += D;
+}
+
+void md5_update( md5_context *ctx, uint8 *input, uint32 length )
+{
+    uint32 left, fill;
+
+    if( ! length ) return;
+
+    left = ctx->total[0] & 0x3F;
+    fill = 64 - left;
+
+    ctx->total[0] += length;
+    ctx->total[0] &= 0xFFFFFFFF;
+
+    if( ctx->total[0] < length )
+        ctx->total[1]++;
+
+    if( left && length >= fill )
+    {
+        memcpy( (void *) (ctx->buffer + left),
+                (void *) input, fill );
+        md5_process( ctx, ctx->buffer );
+        length -= fill;
+        input  += fill;
+        left = 0;
+    }
+
+    while( length >= 64 )
+    {
+        md5_process( ctx, input );
+        length -= 64;
+        input  += 64;
+    }
+
+    if( length )
+    {
+        memcpy( (void *) (ctx->buffer + left),
+                (void *) input, length );
+    }
+}
+
+static uint8 md5_padding[64] =
+{
+ 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+void md5_finish( md5_context *ctx, uint8 digest[16] )
+{
+    uint32 last, padn;
+    uint32 high, low;
+    uint8 msglen[8];
+
+    high = ( ctx->total[0] >> 29 )
+         | ( ctx->total[1] <<  3 );
+    low  = ( ctx->total[0] <<  3 );
+
+    PUT_UINT32( low,  msglen, 0 );
+    PUT_UINT32( high, msglen, 4 );
+
+    last = ctx->total[0] & 0x3F;
+    padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last );
+
+    md5_update( ctx, md5_padding, padn );
+    md5_update( ctx, msglen, 8 );
+
+    PUT_UINT32( ctx->state[0], digest,  0 );
+    PUT_UINT32( ctx->state[1], digest,  4 );
+    PUT_UINT32( ctx->state[2], digest,  8 );
+    PUT_UINT32( ctx->state[3], digest, 12 );
+}
+
diff --git a/tools/fwpatcher/md5.h b/tools/fwpatcher/md5.h
new file mode 100644
index 0000000000..71fa395548
--- /dev/null
+++ b/tools/fwpatcher/md5.h
@@ -0,0 +1,25 @@
+#ifndef _MD5_H
+#define _MD5_H
+
+#ifndef uint8
+#define uint8  unsigned char
+#endif
+
+#ifndef uint32
+#define uint32 unsigned long int
+#endif
+
+typedef struct
+{
+    uint32 total[2];
+    uint32 state[4];
+    uint8 buffer[64];
+}
+md5_context;
+
+void md5_starts( md5_context *ctx );
+void md5_update( md5_context *ctx, uint8 *input, uint32 length );
+void md5_finish( md5_context *ctx, uint8 digest[16] );
+
+#endif /* md5.h */
+
diff --git a/tools/fwpatcher/resource.h b/tools/fwpatcher/resource.h
new file mode 100644
index 0000000000..9847eee88c
--- /dev/null
+++ b/tools/fwpatcher/resource.h
@@ -0,0 +1,3 @@
+#define IDI_RBICON  101
+#define IDI_BOOTLOADER 102
+
diff --git a/tools/fwpatcher/resource.rc b/tools/fwpatcher/resource.rc
new file mode 100644
index 0000000000..eabd9e49bd
--- /dev/null
+++ b/tools/fwpatcher/resource.rc
@@ -0,0 +1,4 @@
+#include "resource.h"
+
+IDI_RBICON ICON "favicon.ico"
+IDI_BOOTLOADER BIN "bootloader.bin"