137 lines
6.7 KiB
Python
137 lines
6.7 KiB
Python
|
"""按「角色」切负载：replace（只负责替换）/ restore（只负责还原）。
|
|||
|
|
|
|||
|
|
拆盘的要点：一个 .face 只装一份负载，体积减半。
|
|||
|
|
* replace 盘：pay = q63 的帧（新字节）；rb = **原厂字节前 64 B 的指纹**（只用于版本校验）
|
|||
|
|
* restore 盘：pay = 原厂字节； rb = **新字节前 64 B 的指纹**
|
|||
|
|
指纹表让「写入前版本校验 + 写入后回读比对」两道保险都还在，代价只有 117*64 ≈ 7.5 KB。
|
|||
|
|
两份盘用同一个 watchface id，装其中一份就会顶掉另一份，设备上始终只占一份空间。
|
|||
|
|
|
|||
|
|
产出：
|
|||
|
|
<out>/payload[_restore]/ NNN_<name>.bin + payload.lua
|
|||
|
|
<out>/blob_<role>/payload.bin 单条目：魔数 + 顺序拼接
|
|||
|
|
<out>/blob_<role>/fp.bin 指纹单条目
|
|||
|
|
<out>/flash.sh | restore.sh 线性 nsh 脚本（replace 盘还有 restore.sh 的对应物）
|
|||
|
|
<out>/payload.json 机器可读清单
|
|||
|
|
"""
|
|||
|
|
import os, sys, json, hashlib
|
|||
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|||
|
|
from paths import PROJ, INPUTS, WORK
|
|||
|
|
|
|||
|
|
ROLE = (sys.argv[1] if len(sys.argv) > 1 else 'replace').lower()
|
|||
|
|
assert ROLE in ('replace', 'restore'), ROLE
|
|||
|
|
STOCK = os.path.join(INPUTS, 'target', 'vela_app.bin')
|
|||
|
|
PATCHED = os.path.join(WORK, 'anim', 'vela_app_anim.bin')
|
|||
|
|
OUT = PROJ
|
|||
|
|
|
|||
|
|
recs_in = json.load(open(os.path.join(WORK, 'anim', 'manifest.json'), encoding='utf-8'))
|
|||
|
|
stock = open(STOCK, 'rb').read()
|
|||
|
|
patched = open(PATCHED, 'rb').read()
|
|||
|
|
assert len(stock) == len(patched)
|
|||
|
|
|
|||
|
|
SRC = patched if ROLE == 'replace' else stock # 要写进设备的字节
|
|||
|
|
OTHER = stock if ROLE == 'replace' else patched # 另一侧的字节（做指纹）
|
|||
|
|
FPDIR = os.path.join(OUT, 'payload' if ROLE == 'replace' else 'payload_restore')
|
|||
|
|
BLOBDIR = os.path.join(OUT, 'blob_' + ROLE)
|
|||
|
|
FP_LEN = 64
|
|||
|
|
|
|||
|
|
# 不再往偏移 0 写那 32 字节的「canary」：写 superblock 头没有意义，
|
|||
|
|
# 而且它极可能就是真机上「总是失败 1」的那一条（偏移 0 的写/读回最容易出岔子）。
|
|||
|
|
assert stock[:8] == b'-rom1fs-'
|
|||
|
|
records = []
|
|||
|
|
for r in recs_in['records']:
|
|||
|
|
off, ln = r['offset'], r['length']
|
|||
|
|
records.append(dict(name=r['name'], offset=off, length=ln, data=SRC[off:off + ln],
|
|||
|
|
changed=(stock[off:off + ln] != patched[off:off + ln]) if ROLE == 'replace' else True,
|
|||
|
|
fp=OTHER[off:off + FP_LEN]))
|
|||
|
|
emitted = [r for r in records if r['changed']]
|
|||
|
|
dropped = [r for r in records if not r['changed']]
|
|||
|
|
|
|||
|
|
|
|||
|
|
def write_pack(d):
|
|||
|
|
os.makedirs(d, exist_ok=True)
|
|||
|
|
for f in os.listdir(d):
|
|||
|
|
os.remove(os.path.join(d, f))
|
|||
|
|
rows = []
|
|||
|
|
for i, r in enumerate(emitted):
|
|||
|
|
fn = '%03d_%s.bin' % (i, r['name'])
|
|||
|
|
open(os.path.join(d, fn), 'wb').write(r['data'])
|
|||
|
|
assert r['offset'] % 4 == 0, r['name']
|
|||
|
|
rows.append(dict(name=r['name'], file=fn, offset=r['offset'], length=r['length']))
|
|||
|
|
with open(os.path.join(d, 'payload.lua'), 'w', encoding='utf-8', newline='\n') as f:
|
|||
|
|
f.write('-- generated by tools/make_dd_payload.py (%s) -- do not hand-edit\n' % ROLE)
|
|||
|
|
f.write('-- dd: -if <this dir>/<file> -of /dev/app bs=4 seek=offset/4 count=length/4\n')
|
|||
|
|
f.write('return {\n')
|
|||
|
|
for r in rows:
|
|||
|
|
f.write(' { name = "%s", file = "%s", offset = %d, length = %d },\n'
|
|||
|
|
% (r['name'], r['file'], r['offset'], r['length']))
|
|||
|
|
f.write('}\n')
|
|||
|
|
return rows
|
|||
|
|
|
|||
|
|
|
|||
|
|
lua_rows = write_pack(FPDIR)
|
|||
|
|
|
|||
|
|
MAGIC_PAY = b'\x00S4P-PAYv1\x00\xa5\x5a\xc3\x3c' # 15 B，必须全局唯一
|
|||
|
|
MAGIC_FP = b'\x00S4P-FPv1\x00\x5a\xa5\x3c\xc3'
|
|||
|
|
os.makedirs(BLOBDIR, exist_ok=True)
|
|||
|
|
for f in os.listdir(BLOBDIR):
|
|||
|
|
os.remove(os.path.join(BLOBDIR, f))
|
|||
|
|
pay_blob = MAGIC_PAY + b''.join(r['data'] for r in emitted)
|
|||
|
|
fp_blob = MAGIC_FP + b''.join(r['fp'] for r in emitted)
|
|||
|
|
open(os.path.join(BLOBDIR, 'payload.bin'), 'wb').write(pay_blob)
|
|||
|
|
open(os.path.join(BLOBDIR, 'fp.bin'), 'wb').write(fp_blob)
|
|||
|
|
rel, off, fpoff = [], 0, 0
|
|||
|
|
for r in emitted:
|
|||
|
|
rel.append(dict(name=r['name'], rel=off, fprel=fpoff, target=r['offset'],
|
|||
|
|
length=r['length'], fplen=len(r['fp'])))
|
|||
|
|
off += r['length']
|
|||
|
|
fpoff += len(r['fp'])
|
|||
|
|
assert fpoff == len(fp_blob) - len(MAGIC_FP), (fpoff, len(fp_blob))
|
|||
|
|
json.dump(dict(role=ROLE, magic_len=len(MAGIC_PAY), magic_fp_len=len(MAGIC_FP), fp_len=FP_LEN,
|
|||
|
|
records=rel, pay_bytes=len(pay_blob), fp_bytes=len(fp_blob)),
|
|||
|
|
open(os.path.join(BLOBDIR, 'offsets.json'), 'w', encoding='utf-8'), indent=1)
|
|||
|
|
print('blob_%s/ 单条目: payload.bin %d B + fp.bin %d B（%d 条记录）'
|
|||
|
|
% (ROLE, len(pay_blob), len(fp_blob), len(rel)))
|
|||
|
|
|
|||
|
|
|
|||
|
|
def script(fname, rows, header, base, verify, tail):
|
|||
|
|
with open(os.path.join(OUT, fname), 'w', encoding='utf-8', newline='\n') as f:
|
|||
|
|
f.write('#!/bin/sh\n')
|
|||
|
|
for line in header:
|
|||
|
|
f.write('# ' + line + '\n')
|
|||
|
|
f.write('\nDEV=/dev/app\nBASE=' + base + '\n\n')
|
|||
|
|
f.write('echo "target check"\nls -l $DEV\n\n')
|
|||
|
|
for r in rows:
|
|||
|
|
b = 4 if (r['offset'] % 4 == 0 and r['length'] % 4 == 0) else 1
|
|||
|
|
f.write('echo "== ' + r['name'] + ' ==\n')
|
|||
|
|
f.write('dd if=$BASE/%s of=$DEV bs=%d seek=%d count=%d\n'
|
|||
|
|
% (r['file'], b, r['offset'] // b, r['length'] // b))
|
|||
|
|
if verify:
|
|||
|
|
f.write('dd if=$DEV of=/tmp/chk.bin bs=%d skip=%d count=%d\n'
|
|||
|
|
% (b, r['offset'] // b, r['length'] // b))
|
|||
|
|
f.write('cmp /tmp/chk.bin $BASE/%s\n\n' % r['file'])
|
|||
|
|
f.write(tail + '\n')
|
|||
|
|
|
|||
|
|
|
|||
|
|
if ROLE == 'replace':
|
|||
|
|
script('flash.sh', lua_rows,
|
|||
|
|
['S5 41mm 压力检测动画 -> S4 eSIM（只写负载）',
|
|||
|
|
'把 flash.sh 与 payload/ 放到同一个目录，例如 /data/s4panim/',
|
|||
|
|
'然后: sh /data/s4panim/flash.sh 最后: reboot',
|
|||
|
|
'还原用 restore.sh 或安装还原盘 S4PAnimRestore.face'],
|
|||
|
|
'/data/s4panim/payload', True,
|
|||
|
|
'rm /tmp/chk.bin\necho "all done - run reboot to apply"')
|
|||
|
|
else:
|
|||
|
|
script('restore.sh', lua_rows,
|
|||
|
|
['把 S4 eSIM 的压力检测动画写回原厂（还原盘）'],
|
|||
|
|
'/data/s4panim/payload_restore', True,
|
|||
|
|
'rm /tmp/chk.bin\necho "restore done - run reboot to apply"')
|
|||
|
|
|
|||
|
|
json.dump(dict(device='Xiaomi Watch S4 eSIM (o62lte)', target='/dev/app',
|
|||
|
|
role=ROLE, kind='pressure-measure-anim',
|
|||
|
|
dd='dd if=<dir>/<file> of=/dev/app bs=4 seek=<offset/4> count=<length/4>',
|
|||
|
|
block_size=4, records=lua_rows,
|
|||
|
|
dropped_identical=[r['name'] for r in dropped]),
|
|||
|
|
open(os.path.join(OUT, 'payload.json'), 'w', encoding='utf-8'), indent=1, ensure_ascii=False)
|
|||
|
|
total = sum(r['length'] for r in lua_rows)
|
|||
|
|
print('role=%s: emitted %d records, %.2f MB; dropped %d' % (ROLE, len(lua_rows), total / 1048576, len(dropped)))
|