git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Branch: master
Branches Tags
file
/
magic
/
Magdir
/
firmware

firmware 5.4 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133 
  1. #------------------------------------------------------------------------------
    2. 

  2. # $File: firmware,v 1.7 2023/03/11 18:52:03 christos Exp $
    3. 

  3. # firmware:  file(1) magic for firmware files
    4. 

  4. #
    5. 

  5. 

  6. # https://github.com/MatrixEditor/frontier-smart-api/blob/main/docs/firmware-2.0.md#11-header-structure
    7. 

  7. # examples: https://github.com/cweiske/frontier-silicon-firmwares
    8. 

  8. 0	lelong		0x00001176	
    9. 

  9. >4	lelong		0x7c		Frontier Silicon firmware download
    10. 

  10. >>8	lelong		x		\b, MeOS version %x
    11. 

  11. >>12	string/32/T	x		\b, version %s
    12. 

  12. >>40	string/64/T	x		\b, customization %s
    13. 

  13. 

  14. # HPE iLO firmware update image
    15. 

  15. # From: Alexandre Iooss <erdnaxe@crans.org>
    16. 

  16. # URL: https://www.sstic.org/2018/presentation/backdooring_your_server_through_its_bmc_the_hpe_ilo4_case/
    17. 

  17. # iLO1 (ilo1*.bin) or iLO2 (ilo2_*.bin) images
    18. 

  18. 0               string                  \x20\x36\xc1\xce\x60\x37\x62\xf0\x3f\x06\xde\x00\x00\x03\x7f\x00
    19. 

  19. >16             ubeshort                =0xCFDD         HPE iLO2 firmware update image
    20. 

  20. >16             ubeshort                =0x6444         HPE iLO1 firmware update image
    21. 

  21. # iLO3 images (ilo3_*.bin) start directly with image name
    22. 

  22. 0               string                  iLO3\x20v\x20   HPE iLO3 firmware update image,
    23. 

  23. >7              string                  x               version %s
    24. 

  24. # iLO4 images (ilo4_*.bin) start with a signature and a certificate
    25. 

  25. 0               string                  --=</Begin\x20HP\x20Signed
    26. 

  26. >75             string                  label_HPBBatch
    27. 

  27. >>5828          string                  iLO\x204
    28. 

  28. >>>5732         string                  HPIMAGE\x00     HPE iLO4 firmware update image,
    29. 

  29. >>>6947         string                  x               version %s
    30. 

  30. # iLO5 images (ilo5_*.bin) start with a signature
    31. 

  31. >75             string                  label_HPE-HPB-BMC-ILO5-4096
    32. 

  32. >>880           string                  HPIMAGE\x00     HPE iLO5 firmware update image,
    33. 

  33. >>944           string                  x               version %s
    34. 

  34. 

  35. # IBM POWER Secure Boot Container
    36. 

  36. # from https://github.com/open-power/skiboot/blob/master/libstb/container.h
    37. 

  37. 0	belong	0x17082011	POWER Secure Boot Container,
    38. 

  38. >4	beshort	x		version %u
    39. 

  39. >6	bequad	x		container size %llu
    40. 

  40. # These are always zero
    41. 

  41. # >14	bequad	x		target HRMOR %llx
    42. 

  42. # >22	bequad  x		stack pointer %llx
    43. 

  43. >4096	ustring \xFD7zXZ\x00    XZ compressed
    44. 

  44. 0	belong	0x1bad1bad	POWER boot firmware
    45. 

  45. >256	belong	0x48002030	(PHYP entry point)
    46. 

  46. 

  47. # ARM Cortex-M vector table
    48. 

  48. # From: Alexandre Iooss <erdnaxe@crans.org>
    49. 

  49. # URL: https://developer.arm.com/documentation/100701/0200/Exception-properties
    50. 

  50. # Match stack MSB
    51. 

  51. 3		byte			0x20
    52. 

  52. # Function pointers must be in Thumb-mode and before 0x20000000 (4*5 bits match)
    53. 

  53. >4		ulelong&0xE0000001	1
    54. 

  54. >>8		ulelong&0xE0000001	1
    55. 

  55. >>>12		ulelong&0xE0000001	1
    56. 

  56. >>>>44		ulelong&0xE0000001	1
    57. 

  57. >>>>>56		ulelong&0xE0000001	1
    58. 

  58. # Match Cortex-M reserved sections (0x00000000 or 0xFFFFFFFF)
    59. 

  59. >>>>>>28	ulelong+1		<2
    60. 

  60. >>>>>>>32	ulelong+1		<2
    61. 

  61. >>>>>>>>36	ulelong+1		<2
    62. 

  62. >>>>>>>>>40	ulelong+1		<2
    63. 

  63. >>>>>>>>>>52	ulelong+1		<2	ARM Cortex-M firmware
    64. 

  64. >>>>>>>>>>>0	ulelong			>0	\b, initial SP at 0x%08x
    65. 

  65. >>>>>>>>>>>4	ulelong^1		x	\b, reset at 0x%08x
    66. 

  66. >>>>>>>>>>>8	ulelong^1		x	\b, NMI at 0x%08x
    67. 

  67. >>>>>>>>>>>12	ulelong^1		x	\b, HardFault at 0x%08x
    68. 

  68. >>>>>>>>>>>44	ulelong^1		x	\b, SVCall at 0x%08x
    69. 

  69. >>>>>>>>>>>56	ulelong^1		x	\b, PendSV at 0x%08x
    70. 

  70. 

  71. # ESP-IDF partition table entry
    72. 

  72. # From: Alexandre Iooss <erdnaxe@crans.org>
    73. 

  73. # URL: https://github.com/espressif/esp-idf/blob/v5.0/components/esp_partition/include/esp_partition.h
    74. 

  74. 0	string		\xAA\x50
    75. 

  75. >2	ubyte		<2		ESP-IDF partition table entry
    76. 

  76. >>12	string/16	x		\b, label: "%s"
    77. 

  77. >>2	ubyte		0
    78. 

  78. >>>3	ubyte		0x00		\b, factory app
    79. 

  79. >>>3	ubyte		0x10		\b, OTA_0 app
    80. 

  80. >>>3	ubyte		0x11		\b, OTA_1 app
    81. 

  81. >>>3	ubyte		0x12		\b, OTA_2 app
    82. 

  82. >>>3	ubyte		0x13		\b, OTA_3 app
    83. 

  83. >>>3	ubyte		0x14		\b, OTA_4 app
    84. 

  84. >>>3	ubyte		0x15		\b, OTA_5 app
    85. 

  85. >>>3	ubyte		0x16		\b, OTA_6 app
    86. 

  86. >>>3	ubyte		0x17		\b, OTA_7 app
    87. 

  87. >>>3	ubyte		0x18		\b, OTA_8 app
    88. 

  88. >>>3	ubyte		0x19		\b, OTA_9 app
    89. 

  89. >>>3	ubyte		0x1A		\b, OTA_10 app
    90. 

  90. >>>3	ubyte		0x1B		\b, OTA_11 app
    91. 

  91. >>>3	ubyte		0x1C		\b, OTA_12 app
    92. 

  92. >>>3	ubyte		0x1D		\b, OTA_13 app
    93. 

  93. >>>3	ubyte		0x1E		\b, OTA_14 app
    94. 

  94. >>>3	ubyte		0x1F		\b, OTA_15 app
    95. 

  95. >>>3	ubyte		0x20		\b, test app
    96. 

  96. >>2	ubyte		1
    97. 

  97. >>>3	ubyte		0x00		\b, OTA selection data
    98. 

  98. >>>3	ubyte		0x01		\b, PHY init data
    99. 

  99. >>>3	ubyte		0x02		\b, NVS data
    100. 

  100. >>>3	ubyte		0x03		\b, coredump data
    101. 

  101. >>>3	ubyte		0x04		\b, NVS keys
    102. 

  102. >>>3	ubyte		0x05		\b, emulated eFuse data
    103. 

  103. >>>3	ubyte		0x06		\b, undefined data
    104. 

  104. >>>3	ubyte		0x80		\b, ESPHTTPD partition
    105. 

  105. >>>3	ubyte		0x81		\b, FAT partition
    106. 

  106. >>>3	ubyte		0x82		\b, SPIFFS partition
    107. 

  107. >>>3	ubyte		0xFF		\b, any data
    108. 

  108. >>4	ulelong		x		\b, offset: 0x%X
    109. 

  109. >>8	ulelong		x		\b, size: 0x%X
    110. 

  110. >>28	ulelong&0x1	1		\b, encrypted
    111. 

  111. 

  112. # ESP-IDF application image
    113. 

  113. # From: Alexandre Iooss <erdnaxe@crans.org>
    114. 

  114. # URL: https://github.com/espressif/esp-idf/blob/v5.0/components/bootloader_support/include/esp_app_format.h
    115. 

  115. # Note: Concatenation of esp_image_header_t, esp_image_segment_header_t and esp_app_desc_t
    116. 

  116. # 	First segment contains esp_app_desc_t
    117. 

  117. 0	ubyte		0xE9
    118. 

  118. >32	ulelong		0xABCD5432	ESP-IDF application image
    119. 

  119. >>12	uleshort	0x0000		for ESP32
    120. 

  120. >>12	uleshort	0x0002		for ESP32-S2
    121. 

  121. >>12	uleshort	0x0005		for ESP32-C3
    122. 

  122. >>12	uleshort	0x0009		for ESP32-S3
    123. 

  123. >>12	uleshort	0x000A		for ESP32-H2 Beta1
    124. 

  124. >>12	uleshort	0x000C		for ESP32-C2
    125. 

  125. >>12	uleshort	0x000D		for ESP32-C6
    126. 

  126. >>12	uleshort	0x000E		for ESP32-H2 Beta2
    127. 

  127. >>12	uleshort	0x0010		for ESP32-H2
    128. 

  128. >>80	string/32	x		\b, project name: "%s"
    129. 

  129. >>48	string/32	x		\b, version %s
    130. 

  130. >>128	string/16	x		\b, compiled on %s
    131. 

  131. >>>112	string/16	x		%s
    132. 

  132. >>144	string/32	x		\b, IDF version: %s
    133. 

  133. >>4	ulelong		x		\b, entry address: 0x%08X
    134.