diff mbox

[LEDE-DEV] firmware-utils: mktplinkfw2: fix MD5 salt

Message ID 20170702151701.26197-1-zajec5@gmail.com
State Changes Requested
Delegated to: Rafał Miłecki
Headers show

Commit Message

Rafał Miłecki July 2, 2017, 3:17 p.m. UTC
From: Rafał Miłecki <rafal@milecki.pl>

LEDE supports 6 devices using TP-Link firmware format (V2 or V3):
ArcherC20i, ArcherC50, ArcherMR200, TDW8970, TDW8980 and VR200v.

Testing mktplinkfw2 tool with official (vendor generated) firmware files
for all above devices has shown an error when comparing calculated and
included MD5 sum, e.g.:
> mktplinkfw2 -i Archer_C20iv1_0.9.1_3.2_up_boot\(170221\)_2017-02-21_17.14.03.bin | grep -A 1 MD5Sum1
Header MD5Sum1         : 22 5a cb 92 10 d2 95 7b df 62 9a f8 62 17 37 10 (*ERROR*)
          --> expected : ad 19 11 d1 78 98 a7 42 5f 2e 64 da 8a 34 ec cb

This problem has been verified to occur with:
Archer_C20iv1_0.9.1_3.2_up_boot(170221)_2017-02-21_17.14.03.bin
Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin
Archer MR200v1_0.9.1_1.1_up_boot_v004a.0 Build 160905 Rel.60037n.bin
TD-W8970v3_0.9.1_2.0_up_boot(160816)_2016-08-16_10.40.57.bin
TD-W8980v1_0.6.0_1.8_up_boot(150514)_2015-05-14_11.16.43.bin
Archer_VR200vv2_0.2.0_0.8.0_up_boot(161202)_2016-12-05_14.39.06.bin

It's most likely that MD5 salt used in mktplinkfw2 has been always wrong
(and it's not a matter of e.g. a vendor change). Update it to fix MD5
calculation.

One problem that remains is zero MD5 sum calculated for:
Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
---
 tools/firmware-utils/src/mktplinkfw2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Piotr Dymacz July 2, 2017, 3:42 p.m. UTC | #1
Hello Rafał,

On 02.07.2017 17:17, Rafał Miłecki wrote:
> From: Rafał Miłecki <rafal@milecki.pl>
> 
> LEDE supports 6 devices using TP-Link firmware format (V2 or V3):
> ArcherC20i, ArcherC50, ArcherMR200, TDW8970, TDW8980 and VR200v.

I included (in 24043a0d2e01b9843c0dc529205b3b0bc7ecbbf9) another two 
TP-Link devices (TL-WR840N v4 and TL-WR841N v13) which use v3 header.

--
Cheers,
Piotr

> 
> Testing mktplinkfw2 tool with official (vendor generated) firmware files
> for all above devices has shown an error when comparing calculated and
> included MD5 sum, e.g.:
>> mktplinkfw2 -i Archer_C20iv1_0.9.1_3.2_up_boot\(170221\)_2017-02-21_17.14.03.bin | grep -A 1 MD5Sum1
> Header MD5Sum1         : 22 5a cb 92 10 d2 95 7b df 62 9a f8 62 17 37 10 (*ERROR*)
>            --> expected : ad 19 11 d1 78 98 a7 42 5f 2e 64 da 8a 34 ec cb
> 
> This problem has been verified to occur with:
> Archer_C20iv1_0.9.1_3.2_up_boot(170221)_2017-02-21_17.14.03.bin
> Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin
> Archer MR200v1_0.9.1_1.1_up_boot_v004a.0 Build 160905 Rel.60037n.bin
> TD-W8970v3_0.9.1_2.0_up_boot(160816)_2016-08-16_10.40.57.bin
> TD-W8980v1_0.6.0_1.8_up_boot(150514)_2015-05-14_11.16.43.bin
> Archer_VR200vv2_0.2.0_0.8.0_up_boot(161202)_2016-12-05_14.39.06.bin
> 
> It's most likely that MD5 salt used in mktplinkfw2 has been always wrong
> (and it's not a matter of e.g. a vendor change). Update it to fix MD5
> calculation.
> 
> One problem that remains is zero MD5 sum calculated for:
> Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin
> 
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> ---
>   tools/firmware-utils/src/mktplinkfw2.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/firmware-utils/src/mktplinkfw2.c b/tools/firmware-utils/src/mktplinkfw2.c
> index cfedf81d3b..ae7c6b7875 100644
> --- a/tools/firmware-utils/src/mktplinkfw2.c
> +++ b/tools/firmware-utils/src/mktplinkfw2.c
> @@ -153,8 +153,8 @@ char md5salt_normal[MD5SUM_LEN] = {
>   };
>   
>   char md5salt_boot[MD5SUM_LEN] = {
> -	0x8c, 0xef, 0x33, 0x5b, 0xd5, 0xc5, 0xce, 0xfa,
> -	0xa7, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
> +	0x8c, 0xef, 0x33, 0x5f, 0xd5, 0xc5, 0xce, 0xfa,
> +	0xac, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
>   };
>   
>   static struct flash_layout layouts[] = {
>
Mathias Kresin July 2, 2017, 10:04 p.m. UTC | #2
02.07.2017 17:17, Rafał Miłecki:
> From: Rafał Miłecki <rafal@milecki.pl>
> 
> LEDE supports 6 devices using TP-Link firmware format (V2 or V3):
> ArcherC20i, ArcherC50, ArcherMR200, TDW8970, TDW8980 and VR200v.
> 
> Testing mktplinkfw2 tool with official (vendor generated) firmware files
> for all above devices has shown an error when comparing calculated and
> included MD5 sum, e.g.:
>> mktplinkfw2 -i Archer_C20iv1_0.9.1_3.2_up_boot\(170221\)_2017-02-21_17.14.03.bin | grep -A 1 MD5Sum1
> Header MD5Sum1         : 22 5a cb 92 10 d2 95 7b df 62 9a f8 62 17 37 10 (*ERROR*)
>            --> expected : ad 19 11 d1 78 98 a7 42 5f 2e 64 da 8a 34 ec cb
> 
> This problem has been verified to occur with:
> Archer_C20iv1_0.9.1_3.2_up_boot(170221)_2017-02-21_17.14.03.bin
> Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin
> Archer MR200v1_0.9.1_1.1_up_boot_v004a.0 Build 160905 Rel.60037n.bin
> TD-W8970v3_0.9.1_2.0_up_boot(160816)_2016-08-16_10.40.57.bin
> TD-W8980v1_0.6.0_1.8_up_boot(150514)_2015-05-14_11.16.43.bin
> Archer_VR200vv2_0.2.0_0.8.0_up_boot(161202)_2016-12-05_14.39.06.bin
> 
> It's most likely that MD5 salt used in mktplinkfw2 has been always wrong
> (and it's not a matter of e.g. a vendor change). Update it to fix MD5
> calculation.
> 
> One problem that remains is zero MD5 sum calculated for:
> Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin
> 
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> ---
>   tools/firmware-utils/src/mktplinkfw2.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/firmware-utils/src/mktplinkfw2.c b/tools/firmware-utils/src/mktplinkfw2.c
> index cfedf81d3b..ae7c6b7875 100644
> --- a/tools/firmware-utils/src/mktplinkfw2.c
> +++ b/tools/firmware-utils/src/mktplinkfw2.c
> @@ -153,8 +153,8 @@ char md5salt_normal[MD5SUM_LEN] = {
>   };
>   
>   char md5salt_boot[MD5SUM_LEN] = {
> -	0x8c, 0xef, 0x33, 0x5b, 0xd5, 0xc5, 0xce, 0xfa,
> -	0xa7, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
> +	0x8c, 0xef, 0x33, 0x5f, 0xd5, 0xc5, 0xce, 0xfa,
> +	0xac, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
>   };
>   
>   static struct flash_layout layouts[] = {


Matches the values [0] I found while disassembling the TD-W8980v1 
bootloader.

Acked-by: Mathias Kresin <dev@kresin.me>

[0] https://github.com/xdarklight/mktplinkfw3
diff mbox

Patch

diff --git a/tools/firmware-utils/src/mktplinkfw2.c b/tools/firmware-utils/src/mktplinkfw2.c
index cfedf81d3b..ae7c6b7875 100644
--- a/tools/firmware-utils/src/mktplinkfw2.c
+++ b/tools/firmware-utils/src/mktplinkfw2.c
@@ -153,8 +153,8 @@  char md5salt_normal[MD5SUM_LEN] = {
 };
 
 char md5salt_boot[MD5SUM_LEN] = {
-	0x8c, 0xef, 0x33, 0x5b, 0xd5, 0xc5, 0xce, 0xfa,
-	0xa7, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
+	0x8c, 0xef, 0x33, 0x5f, 0xd5, 0xc5, 0xce, 0xfa,
+	0xac, 0x9c, 0x28, 0xda, 0xb2, 0xe9, 0x0f, 0x42,
 };
 
 static struct flash_layout layouts[] = {