|
|
@@ -0,0 +1,198 @@
|
|
|
+#!/usr/bin/env python3
|
|
|
+
|
|
|
+'''A program for manipulating tplink2022 images.
|
|
|
+
|
|
|
+A tplink2022 is an image format encountered on TP-Link devices around the year
|
|
|
+2022. This was seen at least on the EAP610-Outdoor. The format is a container
|
|
|
+for a rootfs, and has optional fields for the "software" version. It also
|
|
|
+ requires a "support" string that describes the list of compatible devices.
|
|
|
+
|
|
|
+This module is intended for creating such images with an OpenWRT UBI image, but
|
|
|
+also supports analysis and extraction of vendor images. Altough tplink2022
|
|
|
+images can be signed, this program does not support signing image.
|
|
|
+
|
|
|
+To get an explanation of the commandline arguments, run this program with the
|
|
|
+"--help" argument.
|
|
|
+'''
|
|
|
+
|
|
|
+import argparse
|
|
|
+import hashlib
|
|
|
+import os
|
|
|
+import pprint
|
|
|
+import struct
|
|
|
+
|
|
|
+def decode_header(datafile):
|
|
|
+ '''Read the tplink2022 image header anbd decode it into a dictionary'''
|
|
|
+ header = {}
|
|
|
+ fmt = '>2I'
|
|
|
+
|
|
|
+ datafile.seek(0x1014)
|
|
|
+ raw_header = datafile.read(8)
|
|
|
+ fields = struct.unpack(fmt, raw_header)
|
|
|
+
|
|
|
+ header['rootfs_size'] = fields[0]
|
|
|
+ header['num_items'] = fields[1]
|
|
|
+ header['items'] = []
|
|
|
+
|
|
|
+ rootfs = {}
|
|
|
+ rootfs['name'] = 'rootfs.ubi'
|
|
|
+ rootfs['offset'] = 0
|
|
|
+ rootfs['size'] = header['rootfs_size']
|
|
|
+ header['items'].append(rootfs)
|
|
|
+
|
|
|
+ for _ in range(header['num_items']):
|
|
|
+ entry = datafile.read(0x2c)
|
|
|
+ fmt = '>I32s2I'
|
|
|
+ fields = struct.unpack(fmt, entry)
|
|
|
+
|
|
|
+ section = {}
|
|
|
+ section['name'] = fields[1].decode("utf-8").rstrip('\0')
|
|
|
+ section['type'] = fields[0]
|
|
|
+ section['offset'] = fields[2]
|
|
|
+ section['size'] = fields[3]
|
|
|
+ header['items'].append(section)
|
|
|
+ return header
|
|
|
+
|
|
|
+def extract(datafile):
|
|
|
+ '''Extract the sections of the tplink2022 image to separate files'''
|
|
|
+ header = decode_header(datafile)
|
|
|
+
|
|
|
+ pretty = pprint.PrettyPrinter(indent=4, sort_dicts=False)
|
|
|
+ pretty.pprint(header)
|
|
|
+
|
|
|
+ for section in header['items']:
|
|
|
+ datafile.seek(0x1814 + section['offset'])
|
|
|
+ section_contents = datafile.read(section['size'])
|
|
|
+
|
|
|
+ with open(f"{section['name']}.bin", 'wb') as section_file:
|
|
|
+ section_file.write(section_contents)
|
|
|
+
|
|
|
+ with open('leftover.bin', 'wb') as extras_file:
|
|
|
+ extras_file.write(datafile.read())
|
|
|
+
|
|
|
+def get_section_contents(section):
|
|
|
+ '''I don't remember what this does. It's been a year since I wrote this'''
|
|
|
+ if section.get('data'):
|
|
|
+ data = section['data']
|
|
|
+ elif section.get('file'):
|
|
|
+ with open(section['file'], 'rb') as section_file:
|
|
|
+ data = section_file.read()
|
|
|
+ else:
|
|
|
+ data = bytes()
|
|
|
+
|
|
|
+ if section['size'] != len(data):
|
|
|
+ raise ValueError("Wrong section size", len(data))
|
|
|
+
|
|
|
+ return data
|
|
|
+
|
|
|
+def write_image(output_image, header):
|
|
|
+ '''Write a tplink2022 image with the contents in the "header" dictionary'''
|
|
|
+ with open(output_image, 'w+b') as out_file:
|
|
|
+ # header MD5
|
|
|
+ salt = [ 0x7a, 0x2b, 0x15, 0xed,
|
|
|
+ 0x9b, 0x98, 0x59, 0x6d,
|
|
|
+ 0xe5, 0x04, 0xab, 0x44,
|
|
|
+ 0xac, 0x2a, 0x9f, 0x4e
|
|
|
+ ]
|
|
|
+
|
|
|
+ out_file.seek(4)
|
|
|
+ out_file.write(bytes(salt))
|
|
|
+
|
|
|
+ # unknown section
|
|
|
+ out_file.write(bytes([0xff] * 0x1000))
|
|
|
+
|
|
|
+ # Table of contents
|
|
|
+ raw_header = struct.pack('>2I', header['rootfs_size'],
|
|
|
+ header['num_items'])
|
|
|
+ out_file.write(raw_header)
|
|
|
+
|
|
|
+ for section in header['items']:
|
|
|
+ if section['name'] == 'rootfs.ubi':
|
|
|
+ continue
|
|
|
+
|
|
|
+ hdr = struct.pack('>I32s2I',
|
|
|
+ section.get('type', 0),
|
|
|
+ section['name'].encode('utf-8'),
|
|
|
+ section['offset'],
|
|
|
+ section['size']
|
|
|
+ )
|
|
|
+
|
|
|
+ out_file.write(hdr)
|
|
|
+
|
|
|
+ for section in header['items']:
|
|
|
+ out_file.seek(0x1814 + section['offset'])
|
|
|
+ out_file.write(get_section_contents(section))
|
|
|
+
|
|
|
+ size = out_file.tell()
|
|
|
+
|
|
|
+ out_file.seek(4)
|
|
|
+ md5_sum = hashlib.md5(out_file.read())
|
|
|
+
|
|
|
+ out_file.seek(0)
|
|
|
+ out_file.write(struct.pack('>I16s', size, md5_sum.digest()))
|
|
|
+
|
|
|
+def encode_soft_verson():
|
|
|
+ '''Not sure of the meaning of version. Also doesn't appear to be needed.'''
|
|
|
+ return struct.pack('>4B1I2I', 0xff, 1, 0 ,0, 0x2020202, 30000, 1)
|
|
|
+
|
|
|
+def create_image(output_image, root, support):
|
|
|
+ '''Create an image with a ubi "root" and a "support" string.'''
|
|
|
+ header = {}
|
|
|
+
|
|
|
+ header['rootfs_size'] = os.path.getsize(root)
|
|
|
+ header['items'] = []
|
|
|
+
|
|
|
+ rootfs = {}
|
|
|
+ rootfs['name'] = 'rootfs.ubi'
|
|
|
+ rootfs['file'] = root
|
|
|
+ rootfs['offset'] = 0
|
|
|
+ rootfs['size'] = header['rootfs_size']
|
|
|
+ header['items'].append(rootfs)
|
|
|
+
|
|
|
+ support_list = {}
|
|
|
+ support_list['name'] = 'support-list'
|
|
|
+ support_list['data'] = support.replace(" ", "\r\n").encode('utf-8')
|
|
|
+ support_list['offset'] = header['rootfs_size']
|
|
|
+ support_list['size'] = len(support_list['data'])
|
|
|
+ header['items'].append(support_list)
|
|
|
+
|
|
|
+ sw_version = {}
|
|
|
+ sw_version['name'] = 'soft-version'
|
|
|
+ sw_version['type'] = 1
|
|
|
+ sw_version['data'] = encode_soft_verson()
|
|
|
+ sw_version['offset'] = support_list['offset'] + support_list['size']
|
|
|
+ sw_version['size'] = len(sw_version['data'])
|
|
|
+ header['items'].append(sw_version)
|
|
|
+
|
|
|
+ header['num_items'] = len(header['items']) - 1
|
|
|
+ write_image(output_image, header)
|
|
|
+
|
|
|
+def main(args):
|
|
|
+ '''We support image analysis,extraction, and creation'''
|
|
|
+ if args.extract:
|
|
|
+ with open(args.image, 'rb') as image:
|
|
|
+ extract(image)
|
|
|
+ elif args.create:
|
|
|
+ if not args.rootfs or not args.support:
|
|
|
+ raise ValueError('To create an image, specify rootfs and support list')
|
|
|
+ create_image(args.image, args.rootfs, args.support)
|
|
|
+ else:
|
|
|
+ with open(args.image, 'rb') as image:
|
|
|
+ header = decode_header(image)
|
|
|
+
|
|
|
+ pretty = pprint.PrettyPrinter(indent=4, sort_dicts=False)
|
|
|
+ pretty.pprint(header)
|
|
|
+
|
|
|
+if __name__ == "__main__":
|
|
|
+ parser = argparse.ArgumentParser(description='EAP extractor')
|
|
|
+ parser.add_argument('--info', action='store_true')
|
|
|
+ parser.add_argument('--extract', action='store_true')
|
|
|
+ parser.add_argument('--create', action='store_true')
|
|
|
+ parser.add_argument('image', type=str,
|
|
|
+ help='Name of image to create or decode')
|
|
|
+ parser.add_argument('--rootfs', type=str,
|
|
|
+ help='When creating an EAP image, UBI image with rootfs and kernel')
|
|
|
+ parser.add_argument('--support', type=str,
|
|
|
+ help='String for the "support-list" section')
|
|
|
+
|
|
|
+ main(parser.parse_args())
|
Alexandru Gagniuc