GK SDK 源码库: XMIPCLinuxV100R005C00SPC030 (kernel/tools/open_source excluded)
This commit is contained in:
+278
@@ -0,0 +1,278 @@
|
||||
#! /bin/bash
|
||||
|
||||
#If want to decrypt ddr_init.bin,u-boot.bin and their signatures,
|
||||
#you must to set the KEY and IV for aes, and IV can't be zero;
|
||||
#otherwise, u-boot.bin and their signatures would not be decrypted.
|
||||
|
||||
#The AUX_IV, BOOT_IV and ROOT_KEY0 must be used at the same time.
|
||||
# AUX_IV=00112233445566778899aabbccddeeff
|
||||
# BOOT_IV=00ffeeddccbbaa998877665544332211
|
||||
# M4_FW_IV=
|
||||
# ROOT_KEY0=67452301efcdab8998badcfe103254763322110077665544bbaa9988ffeeddcc
|
||||
|
||||
# if AES_ENABLE=true, the auxcode area and bootcode area will be encrypted by AES
|
||||
AES_ENABLE=$3
|
||||
|
||||
if [ "is${AES_ENABLE}" = "istrue" ];then
|
||||
# AES encryption iv
|
||||
BOOT_IV=00ffeeddccbbaa998877665544332211
|
||||
# AES encryption key
|
||||
ROOT_KEY0=67452301efcdab8998badcfe103254763322110077665544bbaa9988ffeeddcc
|
||||
else
|
||||
BOOT_IV=
|
||||
ROOT_KEY0=
|
||||
fi
|
||||
|
||||
# uboot.bin original file
|
||||
uboot_file=${1}
|
||||
# signed uboot.bin file
|
||||
uboot_sig_file=${2}
|
||||
|
||||
if [ -f ${uboot_file} ];then
|
||||
echo ""
|
||||
echo " uboot_file = $uboot_file";
|
||||
#echo " AUX_IV = $AUX_IV";
|
||||
echo " BOOT_IV = $BOOT_IV";
|
||||
echo " ROOT_KEY0 = $ROOT_KEY0";
|
||||
echo "";
|
||||
else
|
||||
echo -e "\033[0;31;1mError:${uboot_file} is not exist!\033[0m"
|
||||
exit
|
||||
fi
|
||||
|
||||
dec2hex(){
|
||||
printf "0x%08x" $1
|
||||
}
|
||||
|
||||
function H_TO_NL {
|
||||
local tmp1=$[$1 & 0xff]
|
||||
local tmp2=$[$[$1 & 0xff00] >> 8]
|
||||
local tmp3=$[$[$1 & 0xff0000] >> 16]
|
||||
local tmp4=$[$[$1 & 0xff000000] >> 24]
|
||||
local val=$[$[$tmp1 << 24] | $[$tmp2 << 16] | $[$tmp3 << 8] | $tmp4]
|
||||
|
||||
echo $val
|
||||
}
|
||||
|
||||
function HASH_OTP_TABLE {
|
||||
Str=`cat $1`
|
||||
echo $Str > $2
|
||||
echo ================================================================================== >> $2
|
||||
echo "input_file: $1" >> $2
|
||||
echo ================================================================================== >> $2
|
||||
for((i=0; i<64; i=i+8))
|
||||
do
|
||||
word=${Str:i:8};
|
||||
word=$(printf "0x%s" $word)
|
||||
word=$(H_TO_NL $word)
|
||||
word=$(printf "0x%08x" $word)
|
||||
reg=$[0x100A000C + $(($i/2))] # OTP reg
|
||||
reg=$(printf "%08x" $reg)
|
||||
echo rootkey_hash[$(($i/8))]=mw 0x$reg $word >> $2
|
||||
done
|
||||
}
|
||||
|
||||
function AES_OTP_TABLE {
|
||||
Str=$1
|
||||
echo "AES KEY FILE" > $2
|
||||
echo ================================================================================== >> $2
|
||||
echo "AES KEY:: $1" >> $2
|
||||
echo ================================================================================== >> $2
|
||||
for((i=0; i<64; i=i+8))
|
||||
do
|
||||
word=${Str:i:8};
|
||||
word=$(printf "0x%s" $word)
|
||||
word=$(H_TO_NL $word)
|
||||
word=$(printf "0x%08x" $word)
|
||||
reg=$[0x100A000C + $(($i/2))] # OTP reg
|
||||
reg=$(printf "%08x" $reg)
|
||||
echo aes_key_val[$(($i/8))]=mw 0x$reg $word >> $2
|
||||
done
|
||||
}
|
||||
|
||||
################ uboot.bin layout#######################
|
||||
HEAD_AREA_LEN=10240
|
||||
|
||||
# 1. key area
|
||||
KEY_AREA_POS=0
|
||||
KEY_AREA_LEN=1024
|
||||
|
||||
# 2. param area
|
||||
PARAMS_AREA_POS=1024
|
||||
PARAMS_AREA_LEN=8640
|
||||
|
||||
# 3. unchecked area
|
||||
UNCHECK_AREA_POS=10176
|
||||
UNCHECK_AREA_LEN=64
|
||||
|
||||
# 4. auxcode area
|
||||
AUXCODE_AREA_POS=10240
|
||||
########################################################
|
||||
|
||||
## 1. key area
|
||||
if [ -f rsa4096pem/rsa_pub_4096.pem ];then
|
||||
echo "....................start........................."
|
||||
echo "---------------calc hash for keys---------------"
|
||||
test -d output || mkdir -p output
|
||||
rm -rf output/*
|
||||
openssl base64 -d -in rsa4096pem/rsa_pub_4096.pem -out private_4096.bin
|
||||
dd if=./private_4096.bin of=./fb1 bs=1 skip=33 count=512
|
||||
for((i=1;i<=509;i++))
|
||||
do
|
||||
echo 0x00 | xxd -r >> fb2
|
||||
done
|
||||
dd if=./private_4096.bin of=./fb3 bs=1 skip=547 count=3
|
||||
cat fb1 fb2 fb3 > output/rsa_pub_4096.bin
|
||||
|
||||
filesize=`wc -c < output/rsa_pub_4096.bin`
|
||||
if [ $filesize == $KEY_AREA_LEN ];then
|
||||
echo ""
|
||||
echo 0:RSA_PUB creat OK!
|
||||
echo RSA_PUB file_size = $filesize
|
||||
echo ""
|
||||
else
|
||||
echo 0:RSA_PUB creat error!
|
||||
echo RSA_PUB file_size = $filesize
|
||||
echo ""
|
||||
fi
|
||||
## calc key area hash
|
||||
openssl dgst -sha256 -r -hex output/rsa_pub_4096.bin > rsa4096pem/rsa_pub_4096_sha256.txt
|
||||
rm -f fb1 fb2 fb3 private_4096.bin
|
||||
|
||||
## 2. params area
|
||||
echo "---------------make signature for params---------------"
|
||||
dd if=$uboot_file of=output/params.bin bs=1 skip=$PARAMS_AREA_POS count=$PARAMS_AREA_LEN conv=notrunc
|
||||
## aux iv/flag
|
||||
# if [ $AUX_IV ];then
|
||||
# echo 0x$AUX_IV | xxd -r > aux_iv.bin
|
||||
# echo 0x12c8132a | xxd -r > aux_enc_flag.bin
|
||||
# dd if=./aux_enc_flag.bin of=output/params.bin bs=1 seek=12 count=4 conv=notrunc
|
||||
# dd if=./aux_iv.bin of=output/params.bin bs=1 seek=24 count=16 conv=notrunc
|
||||
# rm aux_iv.bin aux_enc_flag.bin
|
||||
# fi
|
||||
|
||||
## m4 fw iv/flag
|
||||
# if [ $M4_FW_IV ];then
|
||||
# echo 0x$M4_FW_IV | xxd -r > m4_iv.bin
|
||||
# echo 0x12c8132a | xxd -r > m4_enc_flag.bin
|
||||
# dd if=./m4_enc_flag.bin of=output/params.bin bs=1 seek=20 count=4 conv=notrunc
|
||||
# dd if=./m4_iv.bin of=output/params.bin bs=1 seek=48 count=16 conv=notrunc
|
||||
# rm m4_iv.bin m4_enc_flag.bin
|
||||
# fi
|
||||
|
||||
## boot iv/flag
|
||||
if [ $BOOT_IV ];then
|
||||
echo 0x$BOOT_IV | xxd -r > boot_iv.bin
|
||||
echo 0x12c8132a | xxd -r > boot_enc_flag.bin
|
||||
dd if=./boot_enc_flag.bin of=output/params.bin bs=1 seek=16 count=4 conv=notrunc
|
||||
dd if=./boot_iv.bin of=output/params.bin bs=1 seek=40 count=16 conv=notrunc
|
||||
rm boot_iv.bin boot_enc_flag.bin
|
||||
fi
|
||||
|
||||
## make params area signature
|
||||
openssl dgst -sha256 -sign rsa4096pem/rsa_priv_4096.pem -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -out output/params_sig.bin output/params.bin
|
||||
|
||||
## 3. unchecked area
|
||||
dd if=$uboot_file of=output/unchecked_area.bin bs=1 skip=$UNCHECK_AREA_POS count=$UNCHECK_AREA_LEN conv=notrunc
|
||||
|
||||
## 4. auxcode area
|
||||
echo "---------------prepare auxcode area---------------"
|
||||
val=$(hexdump -e '16/4 "%04x"' -n 4 -s 0 output/params.bin)
|
||||
auxcode_area_len=$(printf "%d\n" 0x$val)
|
||||
dd if=$uboot_file of=output/auxcode_check.bin bs=1 skip=$AUXCODE_AREA_POS count=$auxcode_area_len conv=notrunc
|
||||
|
||||
# echo "---------------make signature for auxcode---------------"
|
||||
## make auxcode signature
|
||||
# openssl dgst -sha256 -sign rsa4096pem/rsa_priv_4096.pem -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -out output/auxcode_sig.bin output/auxcode_check.bin
|
||||
## enc auxcode area
|
||||
# if [ $AUX_IV ]; then
|
||||
# echo "---------------Auxcode encrypt enable---------------"
|
||||
## IV and KEY have set,
|
||||
## Obtain a new KEY by decrypting the ECB mode.
|
||||
# echo 0x1b7b45c0abd412c0382a0242c2824a61 | xxd -r > seed_1.bin
|
||||
# echo 0xcad7733ee80bd0741d9128627ea880ad | xxd -r > seed_2.bin
|
||||
# openssl enc -nopad -d -nosalt -aes-256-ecb -K "$ROOT_KEY0" -in seed_1.bin -out out_1.bin
|
||||
# openssl enc -nopad -d -nosalt -aes-256-ecb -K "$ROOT_KEY0" -in seed_2.bin -out out_2.bin
|
||||
# cat out_2.bin >> out_1.bin
|
||||
# KEY_ecb=$(xxd -ps out_1.bin | sed 'N;s/\n//g')
|
||||
# rm out_*.bin seed_*.bin
|
||||
# echo Obtain a new KEY by decrypting the ECB mode!
|
||||
# echo new_KEY = $KEY_ecb
|
||||
# echo ""
|
||||
## Use the new KEY and IV to encrypt the image in CBC mode.
|
||||
# openssl enc -aes-256-cbc -nopad -K "$KEY_ecb" -iv "$AUX_IV" -in output/auxcode_check.bin -out output/auxcode_check_enc.bin
|
||||
# mv output/auxcode_check_enc.bin output/auxcode_check.bin
|
||||
# fi
|
||||
|
||||
## MCU FW
|
||||
val=$(hexdump -e '16/4 "%04x"' -n 4 -s 8252 output/params.bin)
|
||||
mcu_fw_area_len=$(printf "%d\n" 0x$val)
|
||||
if [ $mcu_fw_area_len == 0 ]; then
|
||||
touch output/mcu_fw_area.bin
|
||||
else
|
||||
skip_offset=$[ $HEAD_AREA_LEN + $auxcode_area_len ]
|
||||
dd if=$uboot_file of=output/mcu_fw_area.bin bs=1 skip=$skip_offset count=$mcu_fw_area_len conv=notrunc
|
||||
fi
|
||||
|
||||
## 5. boot area
|
||||
echo "---------------make signature for boot area---------------"
|
||||
val=$(hexdump -e '16/4 "%04x"' -n 4 -s 4 output/params.bin)
|
||||
boot_check_area_len=$(printf "%d\n" 0x$val)
|
||||
echo boot_check_area_len=$boot_check_area_len
|
||||
boot_check_area_pos=$[ $HEAD_AREA_LEN + $auxcode_area_len + $mcu_fw_area_len ]
|
||||
dd if=$uboot_file of=output/boot_area.bin bs=1 skip=$boot_check_area_pos count=$boot_check_area_len conv=notrunc
|
||||
## make boot area signature
|
||||
openssl dgst -sha256 -sign rsa4096pem/rsa_priv_4096.pem -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -out output/boot_sig.bin output/boot_area.bin
|
||||
## encrypt boot area
|
||||
if [ $BOOT_IV ]; then
|
||||
echo "---------------Boot area encrypt enable---------------"
|
||||
## IV and KEY have set,
|
||||
## Obtain a new KEY by decrypting the ECB mode.
|
||||
echo 0x50db86c592c52f0c436cca6f2ffecaf5 | xxd -r > seed_1.bin
|
||||
echo 0x4a96ae013fc60e205e9da4c9d5ad9b99 | xxd -r > seed_2.bin
|
||||
openssl enc -nopad -d -nosalt -aes-256-ecb -K "$ROOT_KEY0" -in seed_1.bin -out out_1.bin
|
||||
openssl enc -nopad -d -nosalt -aes-256-ecb -K "$ROOT_KEY0" -in seed_2.bin -out out_2.bin
|
||||
cat out_2.bin >> out_1.bin
|
||||
KEY_ecb=$(xxd -ps out_1.bin | sed 'N;s/\n//g')
|
||||
rm out_*.bin seed_*.bin
|
||||
echo Obtain a new KEY by decrypting the ECB mode!
|
||||
echo new_KEY = $KEY_ecb
|
||||
echo ""
|
||||
## Use the new KEY and IV to encrypt the image in CBC mode.
|
||||
openssl enc -aes-256-cbc -nopad -K "$KEY_ecb" -iv "$BOOT_IV" -in output/boot_area.bin -out output/boot_area_enc.bin
|
||||
mv output/boot_area_enc.bin output/boot_area.bin
|
||||
fi
|
||||
|
||||
## 6. lbist test pattern
|
||||
val1=$(hexdump -e '16/4 "%04x"' -n 4 -s 8260 output/params.bin)
|
||||
lbist_test_pattern_len=$(printf "%d\n" 0x$val1)
|
||||
echo lbist_test_pattern_len=$lbist_test_pattern_len
|
||||
lbist_test_pattern_pos=$[ $HEAD_AREA_LEN + $auxcode_area_len + $mcu_fw_area_len + $boot_check_area_len + 0x200 ]
|
||||
echo lbist_test_pattern_pos=$lbist_test_pattern_pos
|
||||
dd if=$uboot_file of=output/lbist_test_pattern.bin bs=1 skip=$lbist_test_pattern_pos count=$lbist_test_pattern_len conv=notrunc
|
||||
|
||||
# 7. combine to Finalboot.bin
|
||||
cat output/rsa_pub_4096.bin > output/Finalboot.bin
|
||||
cat output/params.bin >> output/Finalboot.bin
|
||||
cat output/params_sig.bin >> output/Finalboot.bin
|
||||
cat output/unchecked_area.bin >> output/Finalboot.bin
|
||||
cat output/auxcode_check.bin >> output/Finalboot.bin
|
||||
cat output/mcu_fw_area.bin >> output/Finalboot.bin
|
||||
cat output/boot_area.bin >> output/Finalboot.bin
|
||||
cat output/boot_sig.bin >> output/Finalboot.bin
|
||||
cat output/lbist_test_pattern.bin >> output/Finalboot.bin
|
||||
|
||||
cp output/Finalboot.bin output/${uboot_sig_file}
|
||||
|
||||
HASH_OTP_TABLE rsa4096pem/rsa_pub_4096_sha256.txt rsa4096pem/rsa4096_pem_hash_val.txt
|
||||
cat rsa4096pem/rsa4096_pem_hash_val.txt
|
||||
|
||||
if [ $ROOT_KEY0 ]; then
|
||||
AES_OTP_TABLE $ROOT_KEY0 aes_otp_cfg.txt
|
||||
echo create aes_otp_cfg.txt over!
|
||||
fi
|
||||
|
||||
echo "....................end........................."
|
||||
fi
|
||||
exit
|
||||
|
||||
Reference in New Issue
Block a user