Commit: 0c2696397edde93f497ed201d03dc45fe358ad8a - gsl-firmware (git)

Firmware of Silead Touchscreen Controller for Jumper EZpad 6 Pro.

Commit MetaInfo

• Revision: 0c2696397edde93f497ed201d03dc45fe358ad8a (tree)
• Time: 2018-05-15 03:57:12
• Author: Gregor Riepl <onitake@gmai...>
• Commiter: Gregor Riepl

Log Message

Added Windows driver extraction tool

Change Summary

• modified: tools/AUTHORS.md
• add: tools/scanwindrv

Incremental Difference

--- a/tools/AUTHORS.md
+++ b/tools/AUTHORS.md
@@ -1,2 +1,3 @@
 fw_extractor is (c) 2013-2014 by Joe Burmeister <[e-mail]>
-fwtool, unscramble, untscfg and autoconvert are (c) 2015-2016 by Gregor Riepl <[e-mail]>
\ No newline at end of file
+fwtool, unscramble, untscfg and autoconvert are (c) 2015-2016 by Gregor Riepl <[e-mail]>
+scanwindrv is (c) 2018 by Gregor Riepl <[e-mail]>, based on an example script by Bernhard Übelacker <[e-mail]>
\ No newline at end of file

--- /dev/null
+++ b/tools/scanwindrv
@@ -0,0 +1,129 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+require 5.018;
+use IO::File;
+
+sub usage() {
+	print(STDERR "Usage: scanwindrv SileadTouch.sys\n");
+	print(STDERR "Scans a Windows driver for sections that look like a firmware image and\n");
+	print(STDERR "writes each into sequentially numbered files: firmware_01.fw firmware_02.fw ...\n");
+	-1;
+}
+
+my $drvfile = $ARGV[0] or exit usage;
+
+my $driver = '';
+do {
+	my $in = IO::File->new($drvfile, 'r') or die "Can't open $drvfile: $!";
+	$in->binmode();
+	local $/;
+	$driver = <$in>;
+	defined $driver or die "Can't read firmware: $!";
+	$in->close();
+};
+
+my $candidate = 0;
+
+# find candidates
+for (my $offset = 0; $offset + 8 <= length($driver); $offset++) {
+
+	my ($cmd, $page) = unpack('(LL)<', substr($driver, $offset, 8));
+	if ($cmd == 0x000000f0 && ($page & 0xffffff00) == 0x00000000) {
+		printf(STDERR "Found possible candidate at offset 0x%08x\n", $offset);
+		# possible candidate, start copying pages
+
+		my $firmware = '';
+		my $size;
+		FIRMWARE: for ($size = 0; $offset + $size + 129 * 8 <= length($driver);) {
+
+			#printf(STDERR "offset=0x%08x size=%u[0x%08x]\n", $offset, $size, $size);
+			my ($cmd, $page) = unpack('(LL)<', substr($driver, $offset + $size, 8));
+			#printf(STDERR "Page header at 0x%08x: [0x%02x, 0x%08x]\n", $offset + $size, $cmd, $page);
+
+			# if this doesn't look like a page register - page pair, we're done
+			if ($cmd != 0x000000f0 || ($page & 0xffffff00) != 0x00000000) {
+				last FIRMWARE;
+			}
+
+			for (my $index = 0; $index + 4 <= 128; $index += 4) {
+				my ($idx, $dat) = unpack('(LL)<', substr($driver, $offset + $size + 8 + $index * 2, 8));
+				#printf(STDERR "Data at 0x%08x: [0x%02x, 0x%02x]\n", $offset + $size + 8 + $index * 2, $idx, $dat);
+
+				# if the index is not sequential, this is probably not part of the fw and we're done
+				if ($idx != $index) {
+					#printf(STDERR "Expected index 0x%02x, got 0x%02x\n", $index, $idx);
+					last FIRMWARE;
+				}
+			}
+
+			# one page complete, copy
+			substr($firmware, $size, 33 * 8) = substr($driver, $offset + $size, 33 * 8);
+			$size += 33 * 8;
+		}
+
+		# check if we have enough data
+		if (length($firmware) > 8) {
+			my $fwname = sprintf("firmware_%02u.fw", $candidate);
+			printf(STDERR "Writing firmware to %s, size = %u bytes\n", $fwname, length($firmware));
+			my $out = IO::File->new($fwname, 'w', 0666) or die "Can't open $fwname: $!";
+			$out->binmode();
+			print($out $firmware);
+			$out->close();
+			$candidate++;
+		} else {
+			printf(STDERR "Not a firmware, ignoring\n");
+		}
+
+		# skip ahead
+		$offset += $size;
+	}
+}
+
+=cut
+export F=SileadTouch.sys
+cat $F \
+    | hexdump -e '1/1  "0x%8.8_ax    "' -e '1/1  "%8._ad    "' -e '8/1 "%02X ""\n"""' \
+    | grep -i -E "F0 00 00 00 02 00 00 00|7C 00 00 00 .. .. .. .." \
+    | grep "F0 00 00 00 02 00 00 00" -B1 \
+    ; \
+echo -- \
+    ; \
+cat $F \
+    | hexdump -e '1/1  "0x%8.8_ax    "' -e '1/1  "%8._ad    "' -e '8/1 "%02X ""\n"""' \
+    | grep -i -E "F0 00 00 00 02 00 00 00|7C 00 00 00 .. .. .. .." \
+    | tail -n2
+
+cat <<EOF
+Search for the hex sequence F0 00 00 00, followed by a 32 bit
+number of the form xx 00 00 00 (i.e. an 8 bit value in a little
+endian 32 bit word) and lots of yy 00 00 00 zz zz zz zz word pairs
+(where yy is counting from 00 to 7C and zz is any hex code).
+There are normally several blocks of data with the same pattern that
+follow. Copy all of them into a new file and call it firmware.fw.
+This should be the firmware image for your device.
+EOF
+
+cat <<EOF
+0x00009540       38208    7C 00 00 00 00 00 00 01
+0x00009548       38216    F0 00 00 00 02 00 00 00   (start fw_1)
+--
+0x0000b010       45072    7C 00 00 00 00 00 00 00   (end fw_1)
+0x0000b818       47128    F0 00 00 00 02 00 00 00   (start fw_2)
+--
+0x000152c0       86720    7C 00 00 00 30 32 3A 32   (end fw_2)
+0x00015ac8       88776    F0 00 00 00 02 00 00 00   (start fw_3)
+--
+0x0001f570      128368    7C 00 00 00 30 32 3A 32   (end fw_3)
+0x0001fd78      130424    F0 00 00 00 02 00 00 00   (start fw_4)
+--
+0x00029b38      170808    7C 00 00 00 30 32 3A 32   (end fw_4)
+0x0002b468      177256    7C 00 00 00 01 30 07 30
+EOF
+
+dd bs=1 if=$F of=firmware.fw_1 skip=38216  count=$(( 45072 -  38216 + 8))
+dd bs=1 if=$F of=firmware.fw_2 skip=47128  count=$(( 86720 -  47128 + 8))
+dd bs=1 if=$F of=firmware.fw_3 skip=88776  count=$((128368 -  88776 + 8))
+dd bs=1 if=$F of=firmware.fw_4 skip=130424 count=$((170808 - 130424 + 8))
+