I can't wait to get these babies fired up!


Code: Select all
# First we need to extract loader for PIX 8.0(4) firmware, it's ends at 0x19000
dd if=pix804.bin of=pix804.bin.loader bs=102400 count=1
# Extract rest of firmware, starts at 0x19000
dd if=pix804.bin of=pix804.bin.lzma bs=102400 skip=1
# There's footer at the end of image in offset 0x72a5d0 (7513552) we need as well
dd if=pix804.bin of=pix804.bin.footer bs=7513552 skip=1
# Extract LZMA image
lzma d pix804.bin.lzma pix804.bin.uncompressed
# Modify extracted image as needed and recompress. New image can't be bigger
# than old one when using this method to hack firmware.
# This time we only remove CRC check from image to make further hacks possible
# Copy pix804.bin.uncompressed to pix804.bin.uncompressed-hacked
cp pix804.bin.uncompressed pix804.bin.uncompressed-hacked
# Open pix804.bin.uncompressed-hacked in hex editor
# This will skip entire call to check validity of image.
# Offset 0x15bd0
# Old 00 e8 42 84 1f 01 85 c0 0f 84 c4 01 00 00 8b 45
# New 00 eb 03 84 1f 01 85 c0 0f 84 c4 01 00 00 8b 45
#
# There's another check when new flash image is saved to flash
# Offset 0xabde0
# Old 08 8d 45 b8 8d 55 d4 89 44 24 04 89 14 24 e8 c5
# New 08 8d 45 b8 8d 55 d4 89 44 24 04 89 14 24 eb 03
#
# PIX Flash Load Helper contains check as well
# Offset 0x1358d80
# Old 25 0f b7 43 28 50 53 57 e8 40 bf 00 00 83 c4 0c
# New 25 0f b7 43 28 50 53 57 eb 03 bf 00 00 83 c4 0c
#
# I also recommend searching
# for "MB RAM" and changing it to "MB-RAM" or something like that so you can see your
# PIX is actually running your custom fw right from start in case something goes wrong
# and it crashed early on boot.
# Compress image using LZMA. Default parameters are usually fine, but it's possible that
# your patched image turns out bigger than stock causing problem with relocation tables used
# by bootloader. Here we compress using bigger dictionary to gain some space.
lzma e -a1 -d24 pix804.bin.uncompressed-hacked pix804.bin.lzma-hacked
# In this case new image turned out to be 7375727 bytes long so difference is 35425 bytes
# pix804.bin.lzma - pix804.bin.lzma-hacked - pix804.bin.footer = padding size
# (7436288-7375727-25136=60561) and we need to pad that much.
dd if=/dev/zero of=pix804.bin.35425byte-padding bs=35425 count=1
# Since checksums don't match with our new images we need to patch loader to skip them
# just like we did with actual uncompressed firmware above.
# Copy pix804.bin.loader to pix804.bin.loader-hacked
cp pix804.bin.loader pix804.bin.loader-hacked
# Open pix804.bin.loader-hacked in hex editor
#
# Offset 0x064be (checksum verification on install image failed)
# Old 57 e8 52 1b 00 00 5a 85 c0 89 c3 74 10 6a 34 50
# New 57 eb 03 1b 00 00 5a 85 c0 89 c3 74 10 6a 34 50
#
# Offset 0x122c0
# Old 00 00 10 00 e8 9c 1b 00 00 85 c0 0f 84 5f 02 00
# New 00 00 10 00 eb 03 1b 00 00 85 c0 0f 84 5f 02 00
#
# Offset 0x12370 (checksum verification on uncompressed image failed)
# Old 24 08 e8 ee 1a 00 00 85 c0 0f 84 9b 01 00 00 0f
# New 24 08 eb 03 1a 00 00 85 c0 0f 84 9b 01 00 00 0f
#
# Now we combine hacked files to new image
cat pix804.bin.loader-hacked pix804.bin.lzma-hacked pix804.bin.35425byte-padding \
pix804.bin.footer > pix804.bin.hacked
# Done. Enjoy your new PIX-OS 8.0(4) image without checks for image validity.