search

o-gs / dji-firmware-tools

Tools for handling firmwares of DJI products, with focus on quadcopters.
GNU General Public License v3.0
1.57k stars 424 forks source link

Extraction #2

Closed notsolowki closed 7 years ago

notsolowki commented 7 years ago 
C:\Users\Usr\Desktop\phantom-firmware-tools-master>python dji_fwcon.py -vv -x -p P3X_FW_V01.08.0080.bin
P3X_FW_V01.08.0080.bin: Opening for extraction
P3X_FW_V01.08.0080.bin: Header:
{   'entry_count': 16,
    'hdrend_offs': 898,
    'magic': 305419896L,
    'magic_ver': 1,
    'manufacturer': 'DJI',
    'model': 'P3X',
    'padding': '00000000000000000000',
    'salt': 1459829053,
    'ver_latest': 17301584,
    'ver_latest_enc': 120364041,
    'ver_rollbk': 17236028,
    'ver_rollbk_enc': 119774309}
P3X_FW_V01.08.0080.bin: Module index 0
{   'decrypted_len': 43776L,
    'decrypted_md5': 'cc3baf52297f2eb67adf98f0270956f4',
    'dt_offs': 898L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 43776L,
    'stored_md5': 'bbd8964489204dfdb8858d5824a116b0',
    'target': 'm0305',
    'target_name': "main controller 'A3' ldr",
    'version': '34.02.0009'}
P3X_FW_V01.08.0080.bin: Module index 1
{   'decrypted_len': 790016L,
    'decrypted_md5': '9ee6f2692d3982e8ce532372789a50cd',
    'dt_offs': 44674L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 790016L,
    'stored_md5': '229617fbd99769da90e394b239621935',
    'target': 'm0306',
    'target_name': "main controller 'A3' app",
    'version': '02.04.3589'}
P3X_FW_V01.08.0080.bin: Module index 2
{   'decrypted_len': 93696L,
    'decrypted_md5': '2b06bdb11b7b813863cb8efe106667d8',
    'dt_offs': 834690L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 93696L,
    'stored_md5': '6a5e48b0a6b81ed24e14c7548b6d9027',
    'target': 'm0400',
    'target_name': 'gimbal mdl 0',
    'version': '01.44.0000'}
P3X_FW_V01.08.0080.bin: Module index 3
{   'decrypted_len': 19140L,
    'decrypted_md5': '09bebba2951faf82ea3f9cb0793f5dd7',
    'dt_offs': 928386L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 19140L,
    'stored_md5': '09bebba2951faf82ea3f9cb0793f5dd7',
    'target': 'm1100',
    'target_name': 'battery controller 1 app',
    'version': '01.07.3841'}
P3X_FW_V01.08.0080.bin: Module index 4
{   'decrypted_len': 42496L,
    'decrypted_md5': '8f773cc3245745ac6861af803fc520b6',
    'dt_offs': 947526L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 42496L,
    'stored_md5': '4b0ef2a6f0acac04b2c5582ee21361e8',
    'target': 'm1200',
    'target_name': 'electronic speed control 0',
    'version': '01.10.0000'}
P3X_FW_V01.08.0080.bin: Module index 5
{   'decrypted_len': 42496L,
    'decrypted_md5': '8f773cc3245745ac6861af803fc520b6',
    'dt_offs': 990022L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 42496L,
    'stored_md5': '4b0ef2a6f0acac04b2c5582ee21361e8',
    'target': 'm1201',
    'target_name': 'electronic speed control 1',
    'version': '01.10.0000'}
P3X_FW_V01.08.0080.bin: Module index 6
{   'decrypted_len': 42496L,
    'decrypted_md5': '8f773cc3245745ac6861af803fc520b6',
    'dt_offs': 1032518L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 42496L,
    'stored_md5': '4b0ef2a6f0acac04b2c5582ee21361e8',
    'target': 'm1202',
    'target_name': 'electronic speed control 2',
    'version': '01.10.0000'}
P3X_FW_V01.08.0080.bin: Module index 7
{   'decrypted_len': 42496L,
    'decrypted_md5': '8f773cc3245745ac6861af803fc520b6',
    'dt_offs': 1075014L,
    'encrypt_type': 1,
    'reserved2': 1,
    'spcoding': 16,
    'splvalue': 0,
    'stored_len': 42496L,
    'stored_md5': '4b0ef2a6f0acac04b2c5582ee21361e8',
    'target': 'm1203',
    'target_name': 'electronic speed control 3',
    'version': '01.10.0000'}
P3X_FW_V01.08.0080.bin: Module index 8
{   'decrypted_len': 2680L,
    'decrypted_md5': '08e01b61a70e503bb60362eaf4d734cc',
    'dt_offs': 1117510L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 2680L,
    'stored_md5': '08e01b61a70e503bb60362eaf4d734cc',
    'target': 'm1500',
    'target_name': "radio transmitter 'IG810 LB2_68013_TX'",
    'version': '01.01.0512'}
P3X_FW_V01.08.0080.bin: Module index 9
{   'decrypted_len': 77876L,
    'decrypted_md5': '47bea6b588988517d7731a677eaaef44',
    'dt_offs': 1120190L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 77876L,
    'stored_md5': '47bea6b588988517d7731a677eaaef44',
    'target': 'm1700',
    'target_name': "visual positioning module 'camera'",
    'version': '01.01.0263'}
P3X_FW_V01.08.0080.bin: Module index 10
{   'decrypted_len': 25908L,
    'decrypted_md5': 'def18f11a3b0ae5ab53624d52c0e322e',
    'dt_offs': 1198066L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 25908L,
    'stored_md5': 'def18f11a3b0ae5ab53624d52c0e322e',
    'target': 'm1701',
    'target_name': "visual positioning module 'sonar'",
    'version': '01.00.0519'}
P3X_FW_V01.08.0080.bin: Module index 11
{   'decrypted_len': 4194304L,
    'decrypted_md5': '2c3976888e71103fd4bd78f76452cb65',
    'dt_offs': 1223974L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 4194304L,
    'stored_md5': '2c3976888e71103fd4bd78f76452cb65',
    'target': 'm1900',
    'target_name': 'FPGA air model 0',
    'version': '01.00.2144'}
P3X_FW_V01.08.0080.bin: Module index 12
{   'decrypted_len': 56823260L,
    'decrypted_md5': '6cb0abed04e63b23e4e1dcdf6244fa3f',
    'dt_offs': 5418278L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 56823260L,
    'stored_md5': '6cb0abed04e63b23e4e1dcdf6244fa3f',
    'target': 'm0100',
    'target_name': "camera 'Ambarella A9SE' App",
    'version': '01.30.5036'}
P3X_FW_V01.08.0080.bin: Module index 13
{   'decrypted_len': 412780L,
    'decrypted_md5': '7966aeaca3ad0dd1d45551fd70503d3d',
    'dt_offs': 62241538L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 412780L,
    'stored_md5': '7966aeaca3ad0dd1d45551fd70503d3d',
    'target': 'm0101',
    'target_name': "camera 'Ambarella A9SE' Ldr",
    'version': '01.30.5036'}
P3X_FW_V01.08.0080.bin: Module index 14
{   'decrypted_len': 3363336L,
    'decrypted_md5': '62e63c7b2ddd4695a1fd9be58bf6db28',
    'dt_offs': 62654318L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 3363336L,
    'stored_md5': '62e63c7b2ddd4695a1fd9be58bf6db28',
    'target': 'm0800',
    'target_name': "video encoder 'DaVinci Dm368 Linux'",
    'version': '00.13.0007'}
P3X_FW_V01.08.0080.bin: Module index 15
{   'decrypted_len': 74596L,
    'decrypted_md5': '4681e06d881438206f178d1ce538aec9',
    'dt_offs': 66017654L,
    'encrypt_type': 0,
    'reserved2': 1,
    'spcoding': 0,
    'splvalue': 0,
    'stored_len': 74596L,
    'stored_md5': '4681e06d881438206f178d1ce538aec9',
    'target': 'm0900',
    'target_name': "MCU 'NXP LPC1765'",
    'version': '03.00.0010'}
P3X_FW_V01.08.0080.bin: Headers checksum 0F12 matches.
P3X_FW_V01.08.0080.bin: Extracting module index 0, 43776 bytes
P3X_FW_V01.08.0080.bin: Module index 0 stored checksum bbd8964489204dfdb8858d5824a116b0
P3X_FW_V01.08.0080.bin: Extracting module index 1, 790016 bytes
P3X_FW_V01.08.0080.bin: Module index 1 stored checksum 229617fbd99769da90e394b239621935
P3X_FW_V01.08.0080.bin: Extracting module index 2, 93696 bytes
P3X_FW_V01.08.0080.bin: Module index 2 stored checksum 6a5e48b0a6b81ed24e14c7548b6d9027
P3X_FW_V01.08.0080.bin: Extracting module index 3, 19140 bytes
P3X_FW_V01.08.0080.bin: Module index 3 stored checksum 09bebba2951faf82ea3f9cb0793f5dd7
P3X_FW_V01.08.0080.bin: Extracting module index 4, 42496 bytes
P3X_FW_V01.08.0080.bin: Module index 4 stored checksum 4b0ef2a6f0acac04b2c5582ee21361e8
P3X_FW_V01.08.0080.bin: Extracting module index 5, 42496 bytes
P3X_FW_V01.08.0080.bin: Module index 5 stored checksum 4b0ef2a6f0acac04b2c5582ee21361e8
P3X_FW_V01.08.0080.bin: Extracting module index 6, 42496 bytes
P3X_FW_V01.08.0080.bin: Module index 6 stored checksum 4b0ef2a6f0acac04b2c5582ee21361e8
P3X_FW_V01.08.0080.bin: Extracting module index 7, 42496 bytes
P3X_FW_V01.08.0080.bin: Module index 7 stored checksum 4b0ef2a6f0acac04b2c5582ee21361e8
P3X_FW_V01.08.0080.bin: Extracting module index 8, 2680 bytes
P3X_FW_V01.08.0080.bin: Module index 8 stored checksum 08e01b61a70e503bb60362eaf4d734cc
P3X_FW_V01.08.0080.bin: Extracting module index 9, 77876 bytes
P3X_FW_V01.08.0080.bin: Module index 9 stored checksum 47bea6b588988517d7731a677eaaef44
P3X_FW_V01.08.0080.bin: Extracting module index 10, 25908 bytes
P3X_FW_V01.08.0080.bin: Module index 10 stored checksum def18f11a3b0ae5ab53624d52c0e322e
P3X_FW_V01.08.0080.bin: Extracting module index 11, 4194304 bytes
P3X_FW_V01.08.0080.bin: Module index 11 stored checksum 2c3976888e71103fd4bd78f76452cb65
P3X_FW_V01.08.0080.bin: Extracting module index 12, 56823260 bytes
P3X_FW_V01.08.0080.bin: Module index 12 stored checksum 6cb0abed04e63b23e4e1dcdf6244fa3f
P3X_FW_V01.08.0080.bin: Extracting module index 13, 412780 bytes
P3X_FW_V01.08.0080.bin: Module index 13 stored checksum 7966aeaca3ad0dd1d45551fd70503d3d
P3X_FW_V01.08.0080.bin: Extracting module index 14, 3363336 bytes
P3X_FW_V01.08.0080.bin: Module index 14 stored checksum 62e63c7b2ddd4695a1fd9be58bf6db28
P3X_FW_V01.08.0080.bin: Extracting module index 15, 74596 bytes
P3X_FW_V01.08.0080.bin: Module index 15 stored checksum 4681e06d881438206f178d1ce538aec9
C:\Users\Usr\Desktop\phantom-firmware-tools-master>python amba_fwpak.py -vv -x -m P3X_FW_V01.08.0080_mi12.bin
P3X_FW_V01.08.0080_mi12.bin: Opening for extraction
P3X_FW_V01.08.0080_mi12.bin: Header:
{   'crc32': '10B78901',
    'model_name': 'FC300X',
    'ver_info': '0.0-0000'}
P3X_FW_V01.08.0080_mi12.bin: Entries:
[{   'crc32': '037E7EA9',
    'dt_len': 9269056L}, {   'crc32': '43CFCE9A',
    'dt_len': 3889408L}, {   'crc32': '684946EF',
    'dt_len': 11624704L}, {   'crc32': '05B46E5B',
    'dt_len': 5038864L}, {   'crc32': 'EF4876FE',
    'dt_len': 27001088L}]
P3X_FW_V01.08.0080_mi12.bin: Post Header:
{   'part_size': '00000800 00040000 00040000 00100000 02000000 00500000 00f00000 00a00000 03c00000 01e00000 00000000 00500000 00c00000 00500000 00100000'}
P3X_FW_V01.08.0080_mi12.bin: Entry 0
{   'build_date': '2016-03-24',
    'crc32': '56F034C9',
    'dt_len': 9268800L,
    'flag1': '00000000',
    'flag2': '00000000',
    'magic': 'A324EB90',
    'mem_addr': '0E600000',
    'padding': '00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000',
    'version': '1.0'}
P3X_FW_V01.08.0080_mi12.bin: Extracting entry  0, pos      140, len  9268800 bytes
Traceback (most recent call last):
  File "amba_fwpak.py", line 649, in 
    main(sys.argv[1:])
  File "amba_fwpak.py", line 620, in main
    amba_extract(po,fwmdlfile)
  File "amba_fwpak.py", line 405, in amba_extract
    hdcrc = amba_calculate_crc32h_part(copy_buffer, hdcrc)
  File "amba_fwpak.py", line 257, in amba_calculate_crc32h_part
    crc = crc32_tab[(crc ^ octet) & 0xff] ^ (crc >> 8)
TypeError: unsupported operand type(s) for ^: 'long' and 'str'

i wanted to mess around with your scripts just for fun to disassemble it and see what goes on. im not interested in anything illegal

mefistotelis commented 7 years ago

Looks like copy_buffer is a string instead of c_ubyte array. You should convert copy_buffer to array before calling amba_calculate_crc32h_part().

mefistotelis commented 7 years ago

Just to make sure: did you made any modifications to the cloned scripts? If not, this is likely caused by version of the python interpreter.

notsolowki commented 7 years ago

Actually, i got a configparaser error and changed it to ConfigParaser in all the scripts. im using python 2.7 on widows. what version of python would you recommend i use. i was trying to save myself the embarrassment. id like to thank you for your hard work too even if i don't figure it out

mefistotelis commented 7 years ago

I can confirm dji_fwcon.py and amba_fwpak.py works fine on Windows, with python from msys2 package:

python --version
Python 3.4.3

Some scripts will not work on Windows:

notsolowki commented 7 years ago

when i updated to python 3 all worked great thank you ill post on here if i have any more issues

mefistotelis commented 7 years ago

great; have fun.