1 /***************************************************************************
3 * Open \______ \ ____ ____ | | _\_ |__ _______ ___
4 * Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
5 * Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
6 * Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
10 * bin2note - a program to insert binary code in an iPod Nano 2nd
11 * Generation notes file
13 * Based on research by stooo, TheSeven and others.
15 * Copyright (C) 2009 Dave Chapman
17 * This program is free software; you can redistribute it and/or
18 * modify it under the terms of the GNU General Public License
19 * as published by the Free Software Foundation; either version 2
20 * of the License, or (at your option) any later version.
22 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
23 * KIND, either express or implied.
25 ****************************************************************************/
29 #include <sys/types.h>
40 static off_t
filesize(int fd
)
48 void write_utf16le(unsigned char* buf
, int len
, FILE* fp
)
57 fwrite(tmp
, 1, sizeof(tmp
), fp
);
61 void insert_link(unsigned char* buf
, uint32_t pointer
)
63 char link
[] = "<a href=\"AAAAAAA"
85 sprintf(tmp
, "%%%02x%%%02x%%%02x%%%02x",
87 (pointer
>> 8) & 0xff,
88 (pointer
>> 16) & 0xff,
89 (pointer
>> 24) & 0xff);
91 memcpy(link
+ 0x11d, tmp
, 12);
93 /* UTF-16 little-endian BOM */
97 /* UTF-16 little-endian URL */
98 for (i
=0;i
<strlen(link
);i
++) {
104 #define MAX_NOTES_SIZE 4096
105 #define MAX_PAYLOAD_SIZE (MAX_NOTES_SIZE - 0x260 - 4)
107 int main (int argc
, char* argv
[])
112 unsigned char buf
[MAX_NOTES_SIZE
];
118 fprintf(stderr
,"Usage: bin2note file.bin file.htm\n");
125 fdin
= open(infile
,O_RDONLY
|O_BINARY
);
127 fprintf(stderr
,"Can not open %s\n",infile
);
131 len
= filesize(fdin
);
133 if (len
> MAX_PAYLOAD_SIZE
) {
134 fprintf(stderr
,"Payload too big!\n");
139 /* **** Input file is OK, now build the note **** */
141 /* Insert URL at start of note */
142 insert_link(buf
, 0x08640568);
144 /* Load code at offset 0x260 */
145 n
= read(fdin
,buf
+ 0x260,len
);
147 fprintf(stderr
,"Short read, aborting\n");
152 /* Fill the remaining buffer with NOPs (mov r1,r1) - 0xe1a01001 */
153 for (i
=0x260 + len
; i
< MAX_NOTES_SIZE
-4; i
+=4) {
160 /* Finally append a branch back to our code - 0x260 in the note */
161 buf
[MAX_NOTES_SIZE
-4] = 0x97;
162 buf
[MAX_NOTES_SIZE
-3] = 0xfc;
163 buf
[MAX_NOTES_SIZE
-2] = 0xff;
164 buf
[MAX_NOTES_SIZE
-1] = 0xea;
166 fdout
= open(htmname
, O_CREAT
|O_TRUNC
|O_BINARY
|O_WRONLY
, 0666);
168 fprintf(stderr
,"Could not open output file\n");
172 if (write(fdout
, buf
, sizeof(buf
)) != sizeof(buf
)) {
173 fprintf(stderr
,"Error writing output file\n");