1+ ###############################################
2+ # TX SX Pro Custom Payload Packer - by CTCaer #
3+ ###############################################
4+
5+ import struct
6+ import hashlib
7+ from os import unlink
8+
9+ """
10+ typedef struct boot_dat_hdr
11+ {
12+ unsigned char ident[0x10];
13+ unsigned char sha2_s2[0x20];
14+ unsigned int s2_dst;
15+ unsigned int s2_size;
16+ unsigned int s2_enc;
17+ unsigned char pad[0x10];
18+ unsigned int s3_size;
19+ unsigned char pad2[0x90];
20+ unsigned char sha2_hdr[0x20];
21+ } boot_dat_hdr_t;
22+ """
23+
24+ def sha256 (data ):
25+ sha256 = hashlib .new ('sha256' )
26+ sha256 .update (data )
27+ return sha256 .digest ()
28+
29+ boot_fn = 'boot.dat'
30+ # Custom payload filename.
31+ stage2_fn = 'fusee-primary.bin'
32+
33+ boot = open (boot_fn , 'wb' )
34+
35+ with open (stage2_fn , 'rb' ) as fh :
36+ stage2 = bytearray (fh .read ())
37+ stage2 = bytes (stage2 )
38+
39+ # Re-create the header.
40+ header = b''
41+
42+ # Magic ID.
43+ header += b'\x43 \x54 \x43 \x61 \x65 \x72 \x20 \x42 \x4F \x4F \x54 \x00 '
44+
45+ # Version 2.5.
46+ header += b'\x56 \x32 \x2E \x35 '
47+
48+ # Set sha256 hash of stage2 payload.
49+ header += sha256 (stage2 )
50+
51+ # Set stage2 payload destination to 0x40010000.
52+ header += b'\x00 \x00 \x01 \x40 '
53+
54+ # Stage2 payload size.
55+ header += struct .pack ('I' , len (stage2 ))
56+
57+ # Disable Stage2 encryption.
58+ header += struct .pack ('I' , 0 )
59+
60+ # Add padding. Stage3 size is 0.
61+ header += b'\x00 ' * 0xA4
62+
63+ # Add header's sha256 hash.
64+ sha256 = hashlib .new ('sha256' )
65+ sha256 .update (header )
66+ header += sha256 .digest ()
67+
68+ # Write header and the plaintext custom payload.
69+ boot .write (header )
70+ boot .write (stage2 )
71+
72+ boot .close ()
0 commit comments