Author Topic: CRC32 in bootloaders Last four bytes but not match any calculated value. Help  (Read 1875 times)

0 Members and 1 Guest are viewing this topic.

Offline relax79Topic starter

  • Contributor
  • Posts: 15
  • Country: tr
Hello friends, first sorry for my poor English.
I am noob and  try to understand and identify what crc32  method used LPC2148 ARM7 in bootloader binary file. I assume crc32 is last four bytes in the attached picture. I am delete these 4 bytes then check two different method (in picture 2)  in HxD hex editors cheksum tools but results not same precalculated value.
I have a couple of question for professionals

1.File actualy ends of 7fff and i am delete rest of the ff s in file because actual code ends of 177f, is this wrong?

2.If any complicated metod used in this file, how can i identify and reverse already existing code value in last 4 bytes to calculated actual crc32 value conversion method? (where comes from 13 F1 3C F0  bytes)

3.Is there any tool for embedded systems or arm mcu binary crc32 check, calculate, manipulate tool?

My goal is, if i find solution then i am add correct crc32 value end of the firmware for this bootloaders accepting firmware update.
 

Offline Jeroen3

  • Super Contributor
  • ***
  • Posts: 4078
  • Country: nl
  • Embedded Engineer
    • jeroen3.nl
They only run the checksum on the vector table iirc.
https://forum.sparkfun.com/viewtopic.php?t=2512

I also found this.
http://www.cnblogs.com/shangdawei/p/4785397.html
 

Offline rstofer

  • Super Contributor
  • ***
  • Posts: 9890
  • Country: us
I don't have the details in front of me but the idea is to determine if there is a valid flash image by testing the CRC of the vectors.  The CRC is stored in a low memory location in flash.  Check the documentation.

This CRC has nothing to do with the actual code or the loading of the code.  By the nature of the interrupt vectors, the CRC is often precomputed and placed in flash as a constant.

Now, some folks have added an additional bootloader for their own purposes and I have no idea what they are doing regarding CRCs, if anything.

I'm not sure why your image file is any longer than necessary.  Check your toolchain documentation or help files.
 

Offline relax79Topic starter

  • Contributor
  • Posts: 15
  • Country: tr
I read about some different hack threads like rigol and minipro programmer on this forum but first i hesitated to much detailed explanation because maybe it is not legal.
This is about realview  U.i.n.2 clone. I am found chinese articles and tool about this but i don't understand so much.

 first i found bootloader here but i don't know maybe fake or handwritten code clone
"http://www.edaboard.com/thread280512.html"

They are about firmware crc32
"http://www.microsofttranslator.com/bv.aspx?from=&to=en&a=http%3A%2F%2Fwww.ec66.com%2Farticle%2Flist.asp%3Findexid%3D3227"
"http://www.programdevelop.com/3913795/"
and i find this tool but chinese and not find any detailed exlanation to using program.
"http://en.pudn.com/downloads151/sourcecode/embed/detail653795_en.html"
I am buy clone but i am not able to use any commercial tool like UL2_configure.exe for switching cmsis-dap or other boot mode because fail in check somewhere in mcu (error "u.i.k loader not found"). If i load the bootloader, device stuck in pid 2727 bootloader mode "http://www.keil.com/support/man/docs/ulink2/ulink2_trblsh_hwcheck.htm"
« Last Edit: May 14, 2016, 02:38:43 pm by relax79 »
 

Offline richardman

  • Frequent Contributor
  • **
  • Posts: 427
  • Country: us
So you want a worldwide community to help you to hack a clone?  :o

You might be correct that it could be illegal activites  >:D
// richard http://imagecraft.com/
JumpStart C++ for Cortex (compiler/IDE/debugger): the fastest easiest way to get productive on Cortex-M.
Smart.IO: phone App for embedded systems with no app or wireless coding
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf