From f182a11f3362017a6c669871414a9bb448ee050d Mon Sep 17 00:00:00 2001
From: Marcin Bukat <marcin.bukat@gmail.com>
Date: Mon, 2 Sep 2013 12:35:47 +0200
Subject: rk27utils: Add nandextract utility

This quick and dirty utility allows to extract nand bootloader
from raw 1st nand block dump. I post it mainly to somewhat
document how BCH error correction engine of the rk27xx works.

Change-Id: I37ca91add7d372e3576d2722afc946d0f08971a9
---
 utils/rk27utils/nandextract/nandextract.c | 235 ++++++++++++++++++++++++++++++
 1 file changed, 235 insertions(+)
 create mode 100644 utils/rk27utils/nandextract/nandextract.c

(limited to 'utils/rk27utils/nandextract/nandextract.c')

diff --git a/utils/rk27utils/nandextract/nandextract.c b/utils/rk27utils/nandextract/nandextract.c
new file mode 100644
index 0000000000..c9b41d26e3
--- /dev/null
+++ b/utils/rk27utils/nandextract/nandextract.c
@@ -0,0 +1,235 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include "libbch.h"
+
+#define SECTOR_DATA_SIZE 512
+#define SECTOR_META_SIZE 3
+#define SECTOR_ECC_SIZE 13
+#define SECTOR_SIZE (SECTOR_DATA_SIZE + SECTOR_META_SIZE + SECTOR_ECC_SIZE)
+
+/* scramble mode */
+enum {
+      CONTINOUS_ENC, /* scramble whole block at once */
+      PAGE_ENC       /* nand bootloader is scrambled in 0x200 chunks */
+};
+
+static uint8_t reverse_bits(uint8_t b)
+{
+	return (((b & 0x80) >> 7)|
+		((b & 0x40) >> 5)|
+		((b & 0x20) >> 3)|
+		((b & 0x10) >> 1)|
+		((b & 0x08) << 1)|
+		((b & 0x04) << 3)|
+		((b & 0x02) << 5)|
+		((b & 0x01) << 7));
+}
+
+static int libbch_decode_sec(struct bch_control *bch, uint8_t *inbuf, uint8_t *outbuf)
+{
+	unsigned int errloc[8];
+	static const uint8_t mask[13] = {
+		0x4e, 0x8c, 0x9d, 0x52,
+		0x2d, 0x6c, 0x7c, 0xcb,
+		0xc3, 0x12, 0x14, 0x19,
+		0x37,
+	};
+	
+	int i, err_num = 0;
+	
+	/* ecc masking polynomial */
+	for (i=0; i<SECTOR_ECC_SIZE; i++)
+		inbuf[SECTOR_DATA_SIZE+SECTOR_META_SIZE+i] ^= mask[i];
+		
+	/* fix ordering of input bits */
+	for (i = 0; i < SECTOR_SIZE; i++)
+		inbuf[i] = reverse_bits(inbuf[i]);
+
+	err_num = decode_bch(bch, inbuf,
+	                     (SECTOR_SIZE - SECTOR_ECC_SIZE),
+	                     &inbuf[SECTOR_SIZE - SECTOR_ECC_SIZE],
+	                     NULL, NULL, errloc);
+	
+	/* apply fixups */
+	for(i=0; i<err_num; i++)
+		inbuf[errloc[i]/8] ^= 1 << (errloc[i] % 8);
+
+	/* reverse bits back (data part only), remining bytes are scratched */		
+	for (i = 0; i < SECTOR_DATA_SIZE; i++)
+		outbuf[i] = reverse_bits(inbuf[i]);
+		
+	return err_num;
+}
+
+/* scrambling/descrambling reverse engineered by AleMaxx */
+static void encode_page(uint8_t *inpg, uint8_t *outpg, const int size)
+{
+
+uint8_t key[] = {
+        0x7C, 0x4E, 0x03, 0x04,
+        0x55, 0x05, 0x09, 0x07,
+        0x2D, 0x2C, 0x7B, 0x38,
+        0x17, 0x0D, 0x17, 0x11
+};
+        int i, i3, x, val, idx;
+
+        uint8_t key1[0x100];
+        uint8_t key2[0x100];
+
+        for (i=0; i<0x100; i++) {
+                key1[i] = i;
+                key2[i] = key[i&0xf];
+        }
+
+        i3 = 0;
+        for (i=0; i<0x100; i++) {
+                x = key1[i];
+                i3 = key1[i] + i3;
+                i3 += key2[i];
+                i3 &= 0xff;
+                key1[i] = key1[i3];
+                key1[i3] = x;
+        }
+
+        idx = 0;
+        for (i=0; i<size; i++) {
+                x = key1[(i+1) & 0xff];
+                val = x;
+                idx = (x + idx) & 0xff;
+                key1[(i+1) & 0xff] = key1[idx];
+                key1[idx] = (x & 0xff);
+                val = (key1[(i+1)&0xff] + x) & 0xff;
+                val = key1[val];
+                outpg[i] = val ^ inpg[i];
+        }
+}
+
+/* returns offset in bytes of the sector
+ * NOTE: bootrom assumes 4 secs per page (regardles of actual pagesize)
+ */
+static int offset(int sec_num, int page_size, int rom)
+{
+    int sec_per_page, page_num, page_offset;
+
+    if (rom)
+        sec_per_page = 4;
+    else
+    	sec_per_page = page_size / SECTOR_SIZE;
+
+    page_num = sec_num / sec_per_page;
+    page_offset = sec_num % sec_per_page;
+
+    printf("Sec per page: %d\n", sec_per_page);
+    printf("Page num: %d\n", page_num);
+    printf("Offset in page (sec): %d\n", page_offset);
+    printf("Offset in file (bytes): %d (0x%0x)\n", (page_num * page_size) +
+                                                   (page_offset * SECTOR_SIZE),
+                                                   (page_num * page_size) +
+                                                   (page_offset * SECTOR_SIZE));
+
+    return ((page_num * page_size) + (page_offset * SECTOR_SIZE));
+}
+
+static int sector_read(FILE *fp, void *buff, int sec_num, int nand_page_size, struct bch_control *bch)
+{
+    int ret;
+    int file_offset = offset(sec_num, nand_page_size, 1);
+    uint8_t inbuf[SECTOR_SIZE];  
+    uint8_t outbuf[SECTOR_SIZE];
+
+    if (fp == NULL)
+        return -1;
+
+   /* seek to the begining of the data */
+    fseek(fp, file_offset, SEEK_SET);
+
+    /* read into the buffer */
+    ret = fread(inbuf, 1, SECTOR_SIZE, fp);
+
+    if (ret != SECTOR_SIZE)
+    {
+        return -2;
+    }
+        
+    ret = libbch_decode_sec(bch, inbuf, outbuf);
+    
+    if (ret)
+    {
+		printf("LIBBCH Data %d error(s) in sector %d\n", ret, sec_num);
+	}
+		
+    memcpy(buff, outbuf, SECTOR_DATA_SIZE);
+    return ret;
+}
+
+int main (int argc, char **argv)
+{
+    FILE *ifp, *ofp;
+    void *obuf;
+    int i, size, sector, num_sectors, nand_page_size;
+    char *infile, *outfile, *ptr;
+
+	struct bch_control *bch;
+	
+    if (argc < 6)
+    {
+        printf("Usage: %s infile outfile start_sector num_sectors nand_page_size\n", argv[0]);
+        return 0;
+    }
+    
+    infile = argv[1];
+    outfile = argv[2];
+    sector = atoi(argv[3]);
+    num_sectors = atoi(argv[4]);
+    nand_page_size = atoi(argv[5]);
+
+    size = SECTOR_DATA_SIZE * num_sectors;    
+    obuf = malloc(size);
+    
+    if (obuf == NULL)
+    {
+		printf("Error allocating %d bytes of buffer\n", size);
+		return -1;
+    }
+    
+    ifp = fopen(infile, "rb");
+    
+    if (ifp == NULL)
+    {
+		printf("Cannot open %s file\n", infile);
+		free(obuf);
+		return -2;
+    }
+    
+    ofp = fopen(outfile, "wb");    
+    
+    if (ifp == NULL)
+    {
+		printf("Cannot open %s file\n", outfile);
+		fclose(ifp);
+		free(obuf);
+		return -3;
+    }
+
+    bch = init_bch(13, 8, 0x25af);
+     
+    ptr = (char *)obuf;
+    for(i=0; i<num_sectors; i++)
+    {
+		sector_read(ifp, ptr, sector++, nand_page_size, bch);
+		encode_page((uint8_t *)ptr, (uint8_t *)ptr, SECTOR_DATA_SIZE);
+		ptr += SECTOR_DATA_SIZE;
+    }
+
+    fwrite(obuf, 1, size, ofp);
+
+    fclose(ifp);
+    fclose(ofp);
+    free(obuf);
+    
+    free_bch(bch); 
+    return 0;
+}
-- 
cgit v1.2.3