devicenull / ipmi_firmware_tools Goto Github PK
View Code? Open in Web Editor NEWIPMI analysis tools
ipmi_firmware_tools's People
Contributors
Stargazers
Watchers
Forkers
erik-smit lazy404 kickertom petermartini naterh gema-arta gbdj mzhumakhanov thx0701 amesianx linux4 c0d3z3r0 bdwarr6 hanbule ledeuns sqrdevl henryzz0 gsly alhazred sushi-wa ixs zt-chen forkworkclone mk01 captain-highipmi_firmware_tools's Issues
ipmifw.FirmwareImage.getRawString() returns too much data
I've been playing with SMT_316.bin from an X8SIU-F board and realized that the repacking of the image fails:
[root@fedora-37 ipmi_firmware_tools]# ./rebuild_image.py
Writing bootloader...
Processing image 2: 1stFS at 0x40180000
Processing image 3: kernel at 0x40980000
ERROR: Previous image was too big, and has overriten data where the current image should begin.
Aborting.
That seemed weird, as nothing was modified yet. I added a lot of debug print and found the following:
Image definition is clear:
[image_2]
length = 0x7f1000
base_addr = 0x40180000
load_addr = 0xd00000
exec_addr = 0xd00000
name = 1stFS
type = 0x8
[image_3]
length = 0x112aac
base_addr = 0x40980000
load_addr = 0x8000
exec_addr = 0x8000
name = kernel
type = 0x17
Converting the base_addr and length data (subtracting the 0x40M offset) we get the following data for image2:
python -c "print('begin', hex(0x40180000 - 0x40000000)); print('end', hex(0x40180000 - 0x40000000 + 0x7f1000)); print('next', hex(0x40980000 - 0x40000000))"
begin 0x180000
end 0x971000
next 0x980000
The image begins at 0x18000, data ends at 0x971000 and the image 3 would begin at 0x980000.
For reference, the end of the 1stFS.bin file:
# hexdump -C data/1stFS.bin | tail -n 5
007f02f0 3c 8b be a2 c2 10 5e 29 b8 f4 0f a2 cf b4 95 fb |<.....^)........|
007f0300 05 6b 9a a8 56 00 00 00 00 00 00 00 00 00 00 00 |.k..V...........|
007f0310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
007f1000
Let's look at the output of the original SMT_316.bin file where the kernel part would start:
009702f0 3c 8b be a2 c2 10 5e 29 b8 f4 0f a2 cf b4 95 fb |<.....^)........|
00970300 05 6b 9a a8 56 00 00 00 00 00 00 00 00 00 00 00 |.k..V...........|
00970310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00971000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0097ffc0 ff ff ff ff ff ff ff ff ff ff ff ff 02 00 00 00 |................|
0097ffd0 00 00 18 40 00 10 7f 00 00 00 d0 00 00 00 d0 00 |...@............|
0097ffe0 31 73 74 46 53 00 00 00 00 00 00 00 00 00 00 00 |1stFS...........|
0097fff0 cc 50 ba 99 9f ff ff a0 08 00 00 00 05 2c 9a 3c |.P...........,.<|
00980000 50 4b 03 04 14 00 00 00 08 00 8c 8b de 44 2b 3d |PK...........D+=|
We can see the end of the 1stFS.bin file at 0x009702f0 to 0x007f1000.
We can see the padding to 0x0097ffc0 and see the FirmwareImage footer starting there.
And then, right after the footer ending at 0x97ffff we can see the PK ZIP header for the kernel image at 0x00980000.
Adding some debug prints to the Winbond and the rebuild_image file, we can see what the problem is:
# ./rebuild_image.py
Initializing image data/rebuilt_image.bin with 16777216 bytes
Writing bootloader...
configkey, imagenum, name, base_addr, imagestart, imagestart > 0x40000000, new_image.tell()
image_2 2 1stFS 1075314688 1075314688 True 64040
image_2 2 1stFS 1075314688 1572864 False 64040
Processing image 2: 1stFS at 0x40180000
Pos 1 1572864
len 8327168
Pos 2 1572864
Pos 3 9900032
<ipmifw.FirmwareImage.FirmwareImage object at 0x7fb03d8edbd0>
Pos 4 9961488
FP 9961411 CBE 9895936 9961488
configkey, imagenum, name, base_addr, imagestart, imagestart > 0x40000000, new_image.tell()
image_3 3 kernel 1083703296 1083703296 True 9961488
image_3 3 kernel 1083703296 9961472 False 9961488
Processing image 3: kernel at 0x40980000
ERROR: Previous image was too big, and has overriten data where the current image should begin.
Aborting.
Addresses are given in bytes, we're converting to hex here:
Pos 1 is where we start writing: 0x180000.
image length we're writing is 8327168 bytes.
Pos 2 can be ignored.
Pos 3 is when we finish writing the image: 0x971000. This matches with the data from the hexdumps above and is what we would expect.
Pos 4 is 0x980010 and that is 0x10 too far. Our FirmwareImage footer is 16 bytes too long it seems.
Looking at the code in FirmwareImage.py (with the py3 PR applied):
[...]
return b"\xff\xff\xff\xff\xff\xff\xff\xff\xff" + contents + b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
It seems our footer is 9 bytes padding, then the footer and then another 16 bytes padding, surprisingly exactly the extra padding we're seeing as too much...
Looking at the total length, the footer is not 64 but 80bytes long?
Removing the extra 16 bytes padding makes the rebuild of the image succeed instead.
The rebuilt image also matches the input byte for byte:
# md5sum ../SMT_316.bin data/rebuilt_image.bin
aa9212af9ad6ce3662f4bf059d27317c ../SMT_316.bin
aa9212af9ad6ce3662f4bf059d27317c data/rebuilt_image.bin
Rebuilding IPMI firmware
Hello,
Thanks for a great tool!
I'm trying to customize the firmware for old IPMI server based on X9 platform.
My platform motherboard is X9SRD-F. Official latest firmware on SM website is "SMT_X9_319.bin".
I found one firmware "SMT_X9_364.bin" for slightly different motherboard (X9SRE-F) https://www.supermicro.com/en/support/resources/downloadcenter/firmware/MBD-X9SRE-F/BMC
I was able to flash it with IPMI interface, however I find out that it is having some issue with IPMI java and support only x32 version of java =(
I tried to flash SMT_X9_319.bin back again, but after flashing I can only see that IPMI open only 2 ports: 22 & 5900, so the web interface is not available anymore. When I flash SMT_X9_364 again, web interface is working.
I'm have a plan to modify SMT_X9_364 and add some missing library to this firmware to be able to support x64 version of java.
I follow the instruction and when I tried to extract firmware I see some wired symbols was add to the end of extracted files:
[admin@devbox ipmi_firmware_tools]$ python3 read_header.py --extract ../SMT_X9_364.bin
Read 16777216 bytes
Detected valid bootloader: WPCM450 Boot Loader [ Version:1.0.14 ] Rebuilt on Mar 23 2012
Dumping bootloader as 0x0 to 0xfa28 to data/bootloader.bin
Firmware image: 2 Name: 1stFS@Â Base: 0x40180000 Length: 0x7d4000 (8208384) Load: 0xd00000 Exec: 0xd00000 Image Checksum: 0x4b44961c Signature: 0xa0ffff9f Type: file (0x8) Footer Checksum: 0x4b0fb5f3 * footer checksum mismatch, expected 0c8d1b4b4
Dumping 0x180000 (1572864) to 0x954000 (9781248) to data/1stFS@Â.bin
Image checksum matches
Firmware image: 3 Name: kernel@Â Base: 0x40970000 Length: 0x113384 (1127300) Load: 0x8000 Exec: 0x8000 Image Checksum: 0xb16242c6 Signature: 0xa0ffff9f Type: active, copy2ram, exec, compressed (0x17) Footer Checksum: 0xbe81b768 * footer checksum mismatch, expected 03c41b82a
Dumping 0x970000 (9895936) to 0xa83384 (11023236) to data/kernel@Â.bin
Image checksum matches
Firmware image: 4 Name: 2ndFS@Â Base: 0x40aa0000 Length: 0x474000 (4669440) Load: 0xd00000 Exec: 0xd00000 Image Checksum: 0x7aa3cedf Signature: 0xa0ffff9f Type: file (0x8) Footer Checksum: 0x1b64822d * footer checksum mismatch, expected 0992680ee
Dumping 0xaa0000 (11141120) to 0xf14000 (15810560) to data/2ndFS@Â.bin
Image checksum matches
Firmware footer version 2 firmware version 3.100 checksum: 0x7e4f00c5 tag: 0x7117 rootfs_nfo: 0x0 webfs_nfo: 0x0
Firmware checksum matches
I also tried to extract existing SMT_X9_319.bin and it's extracted as expected:
[admin@devbox ipmi_firmware_tools]$ python3 read_header.py --extract ../SMT_X9_319.bin
Read 16777216 bytes
Detected valid bootloader: WPCM450 Boot Loader [ Version:1.0.14 ] Rebuilt on Mar 23 2012
Dumping bootloader as 0x0 to 0xfa28 to data/bootloader.bin
Firmware image: 2 Name: 1stFS Base: 0x40180000 Length: 0x7c0000 (8126464) Load: 0xd00000 Exec: 0xd00000 Image Checksum: 0x7c0ced5b Signature: 0xa0ffff9f Type: file (0x8) Footer Checksum: 0x5a4a9f76 * footer checksum matches
Dumping 0x180000 (1572864) to 0x940000 (9699328) to data/1stFS.bin
Image checksum matches
Firmware image: 3 Name: kernel Base: 0x40980000 Length: 0x112aac (1125036) Load: 0x8000 Exec: 0x8000 Image Checksum: 0xd1242c12 Signature: 0xa0ffff9f Type: active, copy2ram, exec, compressed (0x17) Footer Checksum: 0xdebed7b6 * footer checksum matches
Dumping 0x980000 (9961472) to 0xa92aac (11086508) to data/kernel.bin
Image checksum matches
Firmware image: 4 Name: 2ndFS Base: 0x40b80000 Length: 0x1dd000 (1953792) Load: 0xd00000 Exec: 0xd00000 Image Checksum: 0x76c10637 Signature: 0xa0ffff9f Type: file (0x8) Footer Checksum: 0x5f64bb97 * footer checksum matches
Dumping 0xb80000 (12058624) to 0xd5d000 (14012416) to data/2ndFS.bin
Image checksum matches
Firmware footer version 2 firmware version 3.25 checksum: 0x32a67456 tag: 0x7117 rootfs_nfo: 0x0 webfs_nfo: 0x0
Firmware checksum matches
Please help
Tool seems to work with `BMC_X11AST2500-9101MS_20221028_3.77.02_STDsp.bin` for Supermicro SuperStorage `SSG-6049P-E1CR60L`
Hi!
I just tried to use this tool on the BMC_X11AST2500-9101MS_20221028_3.77.02_STDsp.bin binary provided as part of the REDFISH_X10DGO_375.zip package from https://www.supermicro.com/en/support/resources/downloadcenter/firmware/SSG-6049P-E1CR60L+/BMC and it seems to have worked correctly?
4410a1a9cf15c20bf0516bd9d9049d98 BMC_X11AST2500-9101MS_20221028_3.77.02_STDsp.bin
This is the output I get when I run it;
$ python3 ./ipmi_firmware_tools/read_header.py BMC_X11AST2500-9101MS_20221028_3.77.02_STDsp.bin
Read 33554432 bytes
Firmware image: 1 Name: u-boot.bin Base: 0x0 Length: 0x3a378 CRC32: 0xcf999c04
Firmware image: 2 Name: pdb_seca.bin Base: 0x50000 Length: 0x10000 CRC32: 0xfdf442dc
Firmware image: 3 Name: pdb_isec.bin Base: 0x60000 Length: 0x10000 CRC32: 0xa04f0273
Firmware image: 4 Name: out_kernel.bin Base: 0x70000 Length: 0x207af0 CRC32: 0xd99350ae
Firmware image: 5 Name: out_rootfs_img.bin Base: 0x2c0000 Length: 0x1225000 CRC32: 0x944dc0f9
Firmware image: 6 Name: out_webfs_img.bin Base: 0x1512000 Length: 0x820020 CRC32: 0xabd690dc
Configuration info:
[flash]
total_size = 33554432
[global]
major_version = 0
minor_version = 0
footer_version = 3
type = aspeed
[images]
1 = present
2 = present
3 = present
4 = present
5 = present
6 = present
[image_1]
name = u-boot.bin
base_addr = 0x0
length = 0x3a378
checksum = 0xcf999c04
[image_2]
name = pdb_seca.bin
base_addr = 0x50000
length = 0x10000
checksum = 0xfdf442dc
[image_3]
name = pdb_isec.bin
base_addr = 0x60000
length = 0x10000
checksum = 0xa04f0273
[image_4]
name = out_kernel.bin
base_addr = 0x70000
length = 0x207af0
checksum = 0xd99350ae
[image_5]
name = out_rootfs_img.bin
base_addr = 0x2c0000
length = 0x1225000
checksum = 0x944dc0f9
[image_6]
name = out_webfs_img.bin
base_addr = 0x1512000
length = 0x820020
checksum = 0xabd690dc
Any idea how to change fan speed control ?
Hello,
I've came across your project to edit SuperMicro IPMI firmware. Can it be used to change the Fan Control Speed ?
Encrypted images
ipmi_firmware_tools can now be used with encrypted images, too. ;-) https://github.com/c0d3z3r0/smcbmc
Tool to extract the images inside a file?
This doesn't seem to exist, so I'm about to write it. Will send a pull request when it has been created.
Tool seems to work with `REDFISH_X10DGO_3.75.bin` for Supermicro 4028GR-TVRT
Hi!
I just tried to use this tool on the REDFISH_X10DGO_3.75.bin binary provided as part of the REDFISH_X10DGO_375.zip package from https://www.supermicro.com/en/support/resources/downloadcenter/firmware/SYS-4028GR-TVRT/BMC and it seems to have worked correctly?
65c777519248a378962fe3772581c0c0 REDFISH_X10DGO_3.75.bin
This is the output I get when I run it;
$ python3 ./ipmi_firmware_tools/read_header.py REDFISH_X10DGO_3.75.bin
Read 33554432 bytes
Firmware image: 1 Name: u-boot.bin Base: 0x0 Length: 0x1ec38 CRC32: 0x45ad7679
Firmware image: 2 Name: out_rootfs_img.bin Base: 0x400000 Length: 0xddf000 CRC32: 0xae68c7cf
Firmware image: 3 Name: out_kernel.bin Base: 0x1400000 Length: 0x177603 CRC32: 0xe545a026
Firmware image: 4 Name: out_webfs_img.bin Base: 0x1700000 Length: 0x79500a CRC32: 0x3af6985b
Footer OK, rev: 3.75
Configuration info:
[flash]
total_size = 33554432
[global]
major_version = 3
minor_version = 117
footer_version = 3
type = aspeed
[images]
1 = present
2 = present
3 = present
4 = present
[image_1]
name = u-boot.bin
base_addr = 0x0
length = 0x1ec38
checksum = 0x45ad7679
[image_2]
name = out_rootfs_img.bin
base_addr = 0x400000
length = 0xddf000
checksum = 0xae68c7cf
[image_3]
name = out_kernel.bin
base_addr = 0x1400000
length = 0x177603
checksum = 0xe545a026
[image_4]
name = out_webfs_img.bin
base_addr = 0x1700000
length = 0x79500a
checksum = 0x3af6985b
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.