tx_custom_boot.py

###############################################
# TX SX Pro Custom Payload Packer - by CTCaer #
#    Forked by AveSatanas to add argparse     #
###############################################

import struct
import hashlib
import argparse

parser = argparse.ArgumentParser()
parser.add_argument("filename", help="filename to convert to SXPRO payload",
                    type=str)
args = parser.parse_args()

"""
typedef struct boot_dat_hdr
{
    unsigned char ident[0x10];
    unsigned char sha2_s2[0x20];
    unsigned int s2_dst;
    unsigned int s2_size;
    unsigned int s2_enc;
    unsigned char pad[0x10];
    unsigned int s3_size;
    unsigned char pad2[0x90];
    unsigned char sha2_hdr[0x20];
} boot_dat_hdr_t;
"""


def sha256(data):
    sha256 = hashlib.new('sha256')
    sha256.update(data)
    return sha256.digest()


boot_fn = 'boot.dat'
# Custom payload filename.

boot = open(boot_fn, 'wb')

with open(args.filename, 'rb') as fh:
    stage2 = bytearray(fh.read())
    stage2 = bytes(stage2)

# Re-create the header.
header = b''

# Magic ID.
header += b'\x43\x54\x43\x61\x65\x72\x20\x42\x4F\x4F\x54\x00'

# Version 2.5.
header += b'\x56\x32\x2E\x35'

# Set sha256 hash of stage2 payload.
header += sha256(stage2)

# Set stage2 payload destination to 0x40010000.
header += b'\x00\x00\x01\x40'

# Stage2 payload size.
header += struct.pack('I', len(stage2))

# Disable Stage2 encryption.
header += struct.pack('I', 0)

# Add padding. Stage3 size is 0.
header += b'\x00' * 0xA4

# Add header's sha256 hash.
sha256 = hashlib.new('sha256')
sha256.update(header)
header += sha256.digest()

# Write header and the plaintext custom payload.
boot.write(header)
boot.write(stage2)

boot.close()

Heyo. This version of tx_custom_boot.py has argparse, so you can drag and drop payloads to it and it'll convert to boot.dat.

Also on command line, you can run it as python2/3 tx_custom_boot.py <payload> and again, it'll convert to boot.dat.

It works with both python2 and python3, tested on 2.7.15 and 3.7.0, only tested on Arch Linux, not tested on any SXPRO.

Sidenote: please consider buying or building an m0 payload injector instead. Source code for those can be found here.