#!/usr/bin/env python3 | |
# initial script by b1n4r1b01 but he deleted his repo | |
# https://gist.github.com/woachk/6092f9ae950455dcdf8428c3ce2d639e | |
# added python3 support | |
import sys | |
import struct | |
import os | |
def extract_ticket(fw_bin): | |
""" | |
Extract APticket wich is DER encoded. | |
""" | |
fw_bin.seek(16) | |
data = fw_bin.read(4) | |
ticket_offset = struct.unpack('<i',data)[0] | |
print("ticket offset : {}".format(ticket_offset)) | |
fw_bin.seek(20) | |
data = fw_bin.read(4) | |
sz = struct.unpack('<i',data)[0] | |
print("ticket size : {}".format(sz)) | |
if sz != 0: | |
fw_bin.seek(ticket_offset) | |
ticket = fw_bin.read(sz) | |
open("ticket", 'wb').write(ticket) | |
def get_image_info(ftab, base_offset): | |
# seek at the occurence which is the name of the image | |
# first image should be rkos | |
ftab.seek(base_offset) | |
tag = ftab.read(4).decode() | |
# get address of image | |
ftab.seek(base_offset + 4) | |
offset = struct.unpack('<i', ftab.read(4))[0] | |
# get size of image | |
ftab.seek(base_offset + 8) | |
sz = struct.unpack('<i', ftab.read(4))[0] | |
return tag, offset, sz | |
def split_firmware(ftab): | |
default_offset = 48 | |
tag, offset, sz = get_image_info(ftab, 48) | |
offset_tag = offset | |
while default_offset < offset_tag: | |
print("tag : {} offset : {} size : {}".format(tag, hex(offset), hex(sz))) | |
ftab.seek(offset) | |
img_data = ftab.read(sz) | |
open(tag, 'wb').write(img_data) | |
default_offset += 16 | |
tag, offset, sz = get_image_info(ftab, default_offset) | |
if default_offset == offset_tag: | |
return 0 | |
return 1 | |
def main(): | |
if len(sys.argv) != 2: | |
print("Usage rkos_extract.py [ftab.bin]") | |
return 1 | |
firmware = sys.argv[1] | |
ftab = open(firmware, 'rb') | |
ftab.seek(0x20) | |
magic = ftab.read(8) | |
print(magic.decode()) | |
if magic.decode() != "rkosftab": | |
print("bad magic") | |
return 1 | |
extract_ticket(ftab) | |
split_firmware(ftab) | |
ftab.close() | |
return 0 | |
if __name__ == '__main__': | |
sys.exit(main()) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment