{"id":177,"date":"2010-08-27T00:23:12","date_gmt":"2010-08-27T04:23:12","guid":{"rendered":"http:\/\/hackspot.net\/iSpotBlog\/?p=177"},"modified":"2010-08-27T07:45:53","modified_gmt":"2010-08-27T11:45:53","slug":"release-of-fwtool-firmware-image-manipulation-tool","status":"publish","type":"post","link":"http:\/\/hackspot.net\/iSpotBlog\/?p=177","title":{"rendered":"Release of &#8216;fwtool&#8217; &#8211; firmware image manipulation tool"},"content":{"rendered":"<p>This is the initial public release of my &#8216;fwtool&#8217; firmware manipulation tool.\u00a0 The utility can be used to &#8216;unpack&#8217; a firmware update &#8220;.bin&#8221; file into the component pieces (kernel, rootfs, (optional)wifi firmware), or to &#8216;pack&#8217; these files back into a &#8220;.bin&#8221; firmware update file.<\/p>\n<p>Here is a link to the code (source code, Linux x86, MacOS x86 binaries inside): <a href=\"http:\/\/hackspot.net\/iSpot\/code\/fwtools_20100826c.tgz\">fwtools_20100826c.tgz<\/a><\/p>\n<p><strong><em>WARNING: Patching\/modifying firmware is not for everyone!\u00a0 You could very easily BRICK your iSpot if you make a mistake!\u00a0 Also,\u00a0loading custom\/patched firmware into your iSpot\u00a0will likely VOID your warranty!\u00a0 Proceed with caution!<\/em><\/strong><\/p>\n<p>The simplest use case is to unpack the &#8220;.bin&#8221; file to a directory which will contain the component files.\u00a0 For example (use &#8220;-unpack infile.bin outdir&#8221; args):<\/p>\n<pre>$ .\/fwtool -unpack iSpot_Software_080510.bin 080510_expanded\r\nWrote '080510_expanded\/kernel.bin' successfully\r\nWrote '080510_expanded\/rootfs.bin' successfully\r\nWrote '080510_expanded\/wifi.bin' successfully\r\nWrote '080510_expanded\/fwinfo.txt' successfully<\/pre>\n<p>&#8220;kernel.bin&#8221; is a Linux compressed kernel image (with &#8216;header app&#8217; that decompresses it) targetted for an ARM CPU.<\/p>\n<p>&#8220;rootfs.bin&#8221; is a JFFS2 root filesystem image (&#8220;kernel.bin&#8221; and &#8220;rootfs.bin&#8221; go together)<\/p>\n<p>&#8220;wifi.bin&#8221; (not always part of &#8220;.bin&#8221; file) contains the firmware for the WiFi daughterboard. It is a Linux compressed kernel image (with built-in <em>initrd<\/em> ramdisk) targetted for a MIPS CPU.<\/p>\n<p>At this point, you can inspect\/patch\/replace files in\u00a0the output directory.\u00a0 Once you are finished, you can\u00a0pack them back up into a new &#8220;.bin&#8221; file.\u00a0 For example (use &#8220;-pack indir outfile.bin&#8221; args):\u00a0<\/p>\n<pre>$ .\/fwtool -pack 080510_expanded iSpot_Software_080510_new.bin\r\nLoaded '080510_expanded\/fwinfo.txt' successfully\r\nLoaded '080510_expanded\/kernel.bin' successfully\r\nLoaded '080510_expanded\/rootfs.bin' successfully\r\nLoaded '080510_expanded\/wifi.bin' successfully\r\nWrote iSpot_Software_080510_new.bin successfully<\/pre>\n<p>As described in &#8220;<a href=\"http:\/\/hackspot.net\/iSpotBlog\/?p=169\">Why don\u2019t firmware \u2018downgrades\u2019 work on the iSpot?<\/a>&#8220;, the iSpot will refuse to install a firmware &#8220;.bin&#8221; file if the &#8220;svn version&#8221; is less than or equal to the current firmware&#8217;s version, <em>or<\/em> if the kernel\/rootfs md5sum is found in a &#8216;blacklist&#8217; table in the current firmware.<\/p>\n<p>In order to allow for downgrading to old\/blacklisted software, I&#8217;ve added a couple of options to the &#8220;-pack&#8221; process:<\/p>\n<ul>\n<li><strong>-svn-ver ####<\/strong> : Sets the output &#8220;.bin&#8221; file&#8217;s &#8220;svn version&#8221; value to &#8220;####&#8221;<\/li>\n<li><strong>-tweak-md5<\/strong> : If specified, fwtool will modify the kernel\/rootfs images in such a way that their md5sums will be different. This will allow them to get past the &#8216;blacklist&#8217; test.<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p>So, in order to modify an &#8216;illegal&#8217; (old\/blacklisted) &#8220;.bin&#8221; file in such a way that it will be accepted by the iSpot, first unpack the &#8220;.bin&#8221; to a directory.\u00a0 Then, pack the directory back into a new &#8220;.bin&#8221; &#8211; specifying &#8220;-svn-ver ####&#8221; with a value that is larger than the currently running firmware&#8217;s version, and &#8220;-tweak-md5&#8221;:<\/p>\n<pre>$ .\/fwtool -unpack iSpot_Software_080510.bin 080510_expanded\r\nWrote '080510_expanded\/kernel.bin' successfully\r\nWrote '080510_expanded\/rootfs.bin' successfully\r\nWrote '080510_expanded\/wifi.bin' successfully\r\nWrote '080510_expanded\/fwinfo.txt' successfully\r\n\r\n$ .\/fwtool -pack -svn-ver 1822 -tweak-md5 080510_expanded iSpot_Software_080510_allow_downgrade.bin\r\nLoaded '080510_expanded\/fwinfo.txt' successfully\r\nLoaded '080510_expanded\/kernel.bin' successfully\r\nLoaded '080510_expanded\/rootfs.bin' successfully\r\nLoaded '080510_expanded\/wifi.bin' successfully\r\nWrote iSpot_Software_080510_allow_downgrade.bin successfully<\/pre>\n<p><em>Disclaimer: information on this site is for educational purposes only, and intended to help iSpot owners experiment with their own devices. I do not condone any hacking for illegal purposes, such as stealing service, etc.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is the initial public release of my &#8216;fwtool&#8217; firmware manipulation tool.\u00a0 The utility can be used to &#8216;unpack&#8217; a firmware update &#8220;.bin&#8221; file into the component pieces (kernel, rootfs, (optional)wifi firmware), or to &#8216;pack&#8217; these files back into a &hellip; <a href=\"http:\/\/hackspot.net\/iSpotBlog\/?p=177\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-177","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/posts\/177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=177"}],"version-history":[{"count":12,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/posts\/177\/revisions"}],"predecessor-version":[{"id":188,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=\/wp\/v2\/posts\/177\/revisions\/188"}],"wp:attachment":[{"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=177"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/hackspot.net\/iSpotBlog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}