BSP

From AVIC Hacking
Jump to navigation Jump to search

BSP area contents[edit | edit source]

BSP area is located in first partition of NOR flash. Two copies of BSP area are stored (at 0x250000 and 0x260000 positions).

BSP is 84-byte structure containing signature (A5 5A 5A A5, used for structure validation), 76 bytes of data and 4 bytes of CRC32 field.

CRC32 field can be calculated using following PHP code:

$file = file_get_contents("bsp_block_wo_crc"); // must be 80 bytes length
$file_original_with_crc32 = $file . pack("V", crc32($file));
file_put_contents("bsp_block_with_crc_original_from_php", $file_original_with_crc32); // 84 bytes


BSP fields[edit | edit source]

struct bsp_data_info
{
    ulong ulSignature; // 0
    ulong ulbootmode; // 4
    ulong ullaunchmode; // 8
    ulong ultestsubmode; // 12
    ulong ulbootimageflag; // 16
    ulong ulrecoveryimageflag; // 20
    ulong uldebugswitch; // 24
    ulong ulusbotgswitch; // 28
    ulong ulmemchkflag; // 32
    ulong ulwarpboot; // 36
    ulong ulsubbootmode; // 40
    ulong ulupdateflag; // 44
    ulong ulupdatesubflag; // 48
    char  passwd[MMC_SET_PASSWD_MAX_LEN]; // 52
    ulong uluiupdateflag; // 68
    ulong ulreserved1; // 72
    ulong ulreserved2; // 74
    ulong ulcrc32; // 80
};

All fields are unsigned 32-bit integers (4 bytes, except password) and stored in Little-endian form. So value 0x12345678 is stored as 0x78 0x56 0x34 0x12 (order of bytes is reversed)

Real-world BSP structure example[edit | edit source]

A5 5A 5A A5 // ulSignature; // 0 //
00 00 00 00 // ulbootmode; // 4 // normal boot
00 00 00 00 // ullaunchmode; // 8 // APL
00 00 00 00 // ultestsubmode; // 12 // TestMode.apk
00 00 00 00 // ulbootimageflag; // 16 // side a
00 00 00 00 // ulrecoveryimageflag; // 20 // side a
00 00 00 00 // uldebugswitch; // 24 // debugging disabled
00 00 00 00 // ulusbotgswitch; // 28 // usb otg disabled
00 00 00 00 // ulmemchkflag; // 32 // do not check memory at startup
00 00 00 00 // ulwarpboot; // 36 // warp boot side A
02 00 00 00 // ulsubbootmode; // 40 // enable warp boot
00 00 00 00 // ulupdateflag; // 44 // recovery-update
02 00 00 00 // ulupdatesubflag; // 48 // USB2
4C 4B 50 46 65 44 34 42 63 56 7A 45 53 52 32 59 // password: LKPFeD4BcVzESR2Y
00 00 00 00 // uluiupdateflag; // 68 // non-updating
FF FF FF FF // ulreserved1; // 72
FF FF FF FF // ulreserved2; // 74
96 8D 6E 12 // ulcrc32; // 80 crc32 of all previous data including signature

Editing BSP area[edit | edit source]

BSP can be edited by using bootloader's DebugConsole. You can use bsp get command to get current BSP contents and bsp set to change contents.


Example output of bsp get command:

        Magic Number       :0xa55a5aa5(a55a5aa5:Valid, other:Invalid)
        Boot Mode          :0x00000000(0:Normal,
                                       1:Recovery,
                                       2:EasyRecovery,
                                       3:Re-EasyRecovery,
                                       default:Normal)
        Launch Mode        :0x00000000(0:APL,
                                       1:TestMode.apk,
                                       2:Slave TestMode,
                                       3:Boot Error,
                                       default:APL)
        TestMode Sub-Mode  :0x00000000(0:TextMode_A.key, 1:Serv Mode,        2:Tech Mode,     default:Tech Mode)
        Bootimage Side     :0x00000000(0:Side A,         1:Side B,                            default:Side A)
        Recoveryimage Side :0x00000000(0:Side A,         1:Side B,                            default:Side A)
        Debug Switch       :0x00000001(0:OFF,            1:ON,                                default:OFF)
        Usb OTG Switch     :0x00000000(0:Host,           1:Device,                            default:Host)
        Memchk flag        :0x00000000(0:No,             1:Yes,                               default:No)
        Warp boot          :0x00000000(0:Side A,         1:Side B,                            default:Side A)
        Boot Sub-Mode      :0x00000000(0:Normal,         1:Catch snapshot,   2:Warp,          default:Normal)
        Update flag        :0x0000000c(0:Recovery-Update,
                                       1:uboot update,
                                       2:boot.img update,
                                       3:recovery.img update,
                                       4:system.img update,
                                       5:opening data update,
                                       6:UI update,
                                       7:All image update,
                                       8:TESTMODE_N.KEY,
                                       9:easyrecovery copy,
                                       a:easyrecovery copy&verify,
                                       b:password key copy&verify,
                                       c:easyrecovery mode change,
                                       default:Recovery-Update)
        Update sub-flag    :0x00000001(0:SD Card,        1:USB1,             2:USB2           default:SD Card)
        UI Update  flag    :0x00000000(0:non-updating,   1:updating,         default:non-updating)
        Reserved1  flag    :0xffffffff(default:0xFFFFFFFF)
        Reserved2  flag    :0xffffffff(default:0xFFFFFFFF)