Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
###############################################
# TX SX Pro Custom Payload Packer - by CTCaer #
# Forked by AveSatanas to add argparse #
###############################################
import struct
import hashlib
import argparse
parser = argparse.ArgumentParser()
parser.add_argument("filename", help="filename to convert to SXPRO payload",
type=str)
args = parser.parse_args()
"""
typedef struct boot_dat_hdr
{
unsigned char ident[0x10];
unsigned char sha2_s2[0x20];
unsigned int s2_dst;
unsigned int s2_size;
unsigned int s2_enc;
unsigned char pad[0x10];
unsigned int s3_size;
unsigned char pad2[0x90];
unsigned char sha2_hdr[0x20];
} boot_dat_hdr_t;
"""
def sha256(data):
sha256 = hashlib.new('sha256')
sha256.update(data)
return sha256.digest()
boot_fn = 'boot.dat'
# Custom payload filename.
boot = open(boot_fn, 'wb')
with open(args.filename, 'rb') as fh:
stage2 = bytearray(fh.read())
stage2 = bytes(stage2)
# Re-create the header.
header = b''
# Magic ID.
header += b'\x43\x54\x43\x61\x65\x72\x20\x42\x4F\x4F\x54\x00'
# Version 2.5.
header += b'\x56\x32\x2E\x35'
# Set sha256 hash of stage2 payload.
header += sha256(stage2)
# Set stage2 payload destination to 0x40010000.
header += b'\x00\x00\x01\x40'
# Stage2 payload size.
header += struct.pack('I', len(stage2))
# Disable Stage2 encryption.
header += struct.pack('I', 0)
# Add padding. Stage3 size is 0.
header += b'\x00' * 0xA4
# Add header's sha256 hash.
sha256 = hashlib.new('sha256')
sha256.update(header)
header += sha256.digest()
# Write header and the plaintext custom payload.
boot.write(header)
boot.write(stage2)
boot.close()
@aveao

This comment has been minimized.

Copy link
Owner Author

@aveao aveao commented Aug 14, 2018

Heyo. This version of tx_custom_boot.py has argparse, so you can drag and drop payloads to it and it'll convert to boot.dat.

Also on command line, you can run it as python2/3 tx_custom_boot.py <payload> and again, it'll convert to boot.dat.

It works with both python2 and python3, tested on 2.7.15 and 3.7.0, only tested on Arch Linux, not tested on any SXPRO.

Sidenote: please consider buying or building an m0 payload injector instead. Source code for those can be found here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment