view factdiff.c @ 105:49c7cda96f04

C139 boot ROM fully cracked
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Mon, 31 Mar 2014 05:51:57 +0000
parents 00dedefbdfd1
children
line wrap: on
line source

/*
 * The 64 KiB "factory block" at the end of the 2nd flash chip select on
 * Pirelli DP-L10 phones is believed to contain juicy info (IMEI and RF
 * calibration data), but the format is yet to be cracked.
 *
 * This program compares Pirelli factory block images that have been read
 * out of several phones, seeking to determine which bytes are always the
 * same and which bytes change from specimen to specimen.
 *
 * Written by Spacefalcon the Outlaw.
 */

#include <sys/types.h>
#include <sys/file.h>
#include <stdio.h>
#include <stdlib.h>

u_char specimen0[65536];
char is_diff[65536];

read_specimen_file(filename, buf)
	char *filename;
	u_char *buf;
{
	int fd, cc;

	fd = open(filename, O_RDONLY);
	if (fd < 0) {
		perror(filename);
		exit(1);
	}
	cc = read(fd, buf, 65536);
	close(fd);
	if (cc != 65536) {
		fprintf(stderr, "%s: unable to read 64 KiB\n", filename);
		exit(1);
	}
}

process_comp_specimen(filename)
	char *filename;
{
	u_char this_spec[65536];
	int i;

	read_specimen_file(filename, this_spec);
	for (i = 0; i < 65536; i++)
		if (this_spec[i] != specimen0[i])
			is_diff[i] = 1;
}

output()
{
	int off, state, cstart, num;

	for (off = 0; off < 65536; ) {
		state = is_diff[off];
		cstart = off;
		while (off < 65536 && is_diff[off] == state)
			off++;
		printf("%04X-%04X: %s", cstart, off-1,
			state ? "varying" : "constant");
		if (state) {
			num = off - cstart;
			printf(" (%d byte%s)", num, num != 1 ? "s" : "");
		}
		putchar('\n');
	}
}

main(argc, argv)
	char **argv;
{
	char **ap;

	if (argc < 3) {
		fprintf(stderr, "usage: %s specimen0 specimen1 ...\n", argv[0]);
		exit(1);
	}
	read_specimen_file(argv[1], specimen0);
	for (ap = argv + 2; *ap; ap++)
		process_comp_specimen(*ap);
	output();
	exit(0);
}