On Sun, Aug 14, 2022 at 08:04:01AM +0200, Sander Vanheule wrote:
> Hi,
>
> On Sat, 2022-08-13 at 13:51 -0500, Nick French wrote:
> > Support creating images for TP-Link Deco S4R v2.
> >
> > Original partition layout from OEM image:
> > partition fs-uboot base 0x00000 size 0x80000
> > partition product-info base 0x80000 size 0x05000
> > partition default-mac base 0x85000 size 0x01000
> > partition device-id base 0x86000 size 0x01000
> > partition support-list base 0x87000 size 0x10000
> > partition user-config base 0xa7000 size 0x10000
> > partition device-config base 0xb7000 size 0x10000
> > partition group-info base 0xc7000 size 0x10000
> > partition partition-table base 0xd7000 size 0x02000
> > partition soft-version base 0xd9000 size 0x10000
> > partition profile base 0xe9000 size 0x10000
> > partition default-config base 0xf9000 size 0x10000
> > partition url-sig base 0x1e0000 size 0x10000
> > partition radio base 0x1f0000 size 0x10000
> > partition os-image base 0x200000 size 0x200000
> > partition file-system base 0x400000 size 0xc00000
> >
> > The 'os-image' and 'file-system' partitions were merged into 'firmware'
> > to make use of the automatic mtd split.
> >
> > Signed-off-by: Nick French <nickfre...@gmail.com>
> > ---
> > src/tplink-safeloader.c | 43 +++++++++++++++++++++++++++++++++++++++++
> > 1 file changed, 43 insertions(+)
> >
> > diff --git a/src/tplink-safeloader.c b/src/tplink-safeloader.c
> > index 7a31ac2..7f9081d 100644
> > --- a/src/tplink-safeloader.c
> > +++ b/src/tplink-safeloader.c
> > @@ -1577,6 +1577,49 @@ static struct device_info boards[] = {
> > .last_sysupgrade_partition = "file-system",
> > },
> >
> > + /** Firmware layout for the Deco S4 v2 */
> > + {
> > + .id = "DECO-S4-V2",
> > + .vendor = "",
> > + .support_list =
> > + "SupportList:\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:5553000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:4555000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:4341000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:4A50000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:4155000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:1.0.0,special_id:4B52000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:5553000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:4555000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:4341000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:4A50000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:4155000
> > 0}\n"
> > +
> > "{product_name:S4,product_ver:2.0.0,special_id:4B52000
> > 0}\n",
>
> Looking at the FW images that can be downloaded from TP-Link's website, the
> support-list partition appears to be a binary blob instead of a plaintext
> table.
> Any idea what's going on here?
>
> Best,
> Sander
>
Yes, the firmware implements an encryption scheme for several
of the config partitions.
Decryption was reverse engineered and a tool was submitted separately
via github: https://github.com/openwrt/openwrt/pull/10445
(tools: deco-decrypt: add package to decrypt Deco S4 config)
As an example use of the tool, you can run it on the firmware file
directly such as:
$ deco_decrypt S4_1.5.1.bin $((0x1014 + 0x1000)) $((0x2d1))
SupportList:
{product_name:S4,product_ver:1.0.0,special_id:55530000}
{product_name:S4,product_ver:1.0.0,special_id:45550000}
{product_name:S4,product_ver:1.0.0,special_id:43410000}
{product_name:S4,product_ver:1.0.0,special_id:4A500000}
{product_name:S4,product_ver:1.0.0,special_id:41550000}
{product_name:S4,product_ver:1.0.0,special_id:4B520000}
{product_name:S4,product_ver:2.0.0,special_id:55530000}
{product_name:S4,product_ver:2.0.0,special_id:45550000}
{product_name:S4,product_ver:2.0.0,special_id:43410000}
{product_name:S4,product_ver:2.0.0,special_id:4A500000}
{product_name:S4,product_ver:2.0.0,special_id:41550000}
{product_name:S4,product_ver:2.0.0,special_id:4B520000}
- Nick
> > + .part_trail = 0x00,
> > + .soft_ver = SOFT_VER_DEFAULT,
> > +
> > + .partitions = {
> > + {"fs-uboot", 0x00000, 0x80000},
> > + {"product-info", 0x80000, 0x05000},
> > + {"default-mac", 0x85000, 0x01000},
> > + {"device-id", 0x86000, 0x01000},
> > + {"support-list", 0x87000, 0x10000},
> > + {"user-config", 0xa7000, 0x10000},
> > + {"device-config", 0xb7000, 0x10000},
> > + {"group-info", 0xc7000, 0x10000},
> > + {"partition-table", 0xd7000, 0x02000},
> > + {"soft-version", 0xd9000, 0x10000},
> > + {"profile", 0xe9000, 0x10000},
> > + {"default-config", 0xf9000, 0x10000},
> > + {"url-sig", 0x1e0000, 0x10000},
> > + {"radio", 0x1f0000, 0x10000},
> > + {"firmware", 0x200000, 0xe00000},
> > + {NULL, 0, 0}
> > + },
> > + .first_sysupgrade_partition = "os-image",
> > + .last_sysupgrade_partition = "file-system",
> > + },
> > +
> > /** Firmware layout for the EAP120 */
> > {
> > .id = "EAP120",
>
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
