"""按「角色」切负载:replace(只负责替换)/ restore(只负责还原)。 拆盘的要点:一个 .face 只装一份负载,体积减半。 * replace 盘:pay = q63 的帧(新字节);rb = **原厂字节前 64 B 的指纹**(只用于版本校验) * restore 盘:pay = 原厂字节; rb = **新字节前 64 B 的指纹** 指纹表让「写入前版本校验 + 写入后回读比对」两道保险都还在,代价只有 117*64 ≈ 7.5 KB。 两份盘用同一个 watchface id,装其中一份就会顶掉另一份,设备上始终只占一份空间。 产出: /payload[_restore]/ NNN_.bin + payload.lua /blob_/payload.bin 单条目:魔数 + 顺序拼接 /blob_/fp.bin 指纹单条目 /flash.sh | restore.sh 线性 nsh 脚本(replace 盘还有 restore.sh 的对应物) /payload.json 机器可读清单 """ import os, sys, json, hashlib sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) from paths import PROJ, INPUTS, WORK ROLE = (sys.argv[1] if len(sys.argv) > 1 else 'replace').lower() assert ROLE in ('replace', 'restore'), ROLE STOCK = os.path.join(INPUTS, 'target', 'vela_app.bin') PATCHED = os.path.join(WORK, 'anim', 'vela_app_anim.bin') OUT = PROJ recs_in = json.load(open(os.path.join(WORK, 'anim', 'manifest.json'), encoding='utf-8')) stock = open(STOCK, 'rb').read() patched = open(PATCHED, 'rb').read() assert len(stock) == len(patched) SRC = patched if ROLE == 'replace' else stock # 要写进设备的字节 OTHER = stock if ROLE == 'replace' else patched # 另一侧的字节(做指纹) FPDIR = os.path.join(OUT, 'payload' if ROLE == 'replace' else 'payload_restore') BLOBDIR = os.path.join(OUT, 'blob_' + ROLE) FP_LEN = 64 # 不再往偏移 0 写那 32 字节的「canary」:写 superblock 头没有意义, # 而且它极可能就是真机上「总是失败 1」的那一条(偏移 0 的写/读回最容易出岔子)。 assert stock[:8] == b'-rom1fs-' records = [] for r in recs_in['records']: off, ln = r['offset'], r['length'] records.append(dict(name=r['name'], offset=off, length=ln, data=SRC[off:off + ln], changed=(stock[off:off + ln] != patched[off:off + ln]) if ROLE == 'replace' else True, fp=OTHER[off:off + FP_LEN])) emitted = [r for r in records if r['changed']] dropped = [r for r in records if not r['changed']] def write_pack(d): os.makedirs(d, exist_ok=True) for f in os.listdir(d): os.remove(os.path.join(d, f)) rows = [] for i, r in enumerate(emitted): fn = '%03d_%s.bin' % (i, r['name']) open(os.path.join(d, fn), 'wb').write(r['data']) assert r['offset'] % 4 == 0, r['name'] rows.append(dict(name=r['name'], file=fn, offset=r['offset'], length=r['length'])) with open(os.path.join(d, 'payload.lua'), 'w', encoding='utf-8', newline='\n') as f: f.write('-- generated by tools/make_dd_payload.py (%s) -- do not hand-edit\n' % ROLE) f.write('-- dd: -if / -of /dev/app bs=4 seek=offset/4 count=length/4\n') f.write('return {\n') for r in rows: f.write(' { name = "%s", file = "%s", offset = %d, length = %d },\n' % (r['name'], r['file'], r['offset'], r['length'])) f.write('}\n') return rows lua_rows = write_pack(FPDIR) MAGIC_PAY = b'\x00S4P-PAYv1\x00\xa5\x5a\xc3\x3c' # 15 B,必须全局唯一 MAGIC_FP = b'\x00S4P-FPv1\x00\x5a\xa5\x3c\xc3' os.makedirs(BLOBDIR, exist_ok=True) for f in os.listdir(BLOBDIR): os.remove(os.path.join(BLOBDIR, f)) pay_blob = MAGIC_PAY + b''.join(r['data'] for r in emitted) fp_blob = MAGIC_FP + b''.join(r['fp'] for r in emitted) open(os.path.join(BLOBDIR, 'payload.bin'), 'wb').write(pay_blob) open(os.path.join(BLOBDIR, 'fp.bin'), 'wb').write(fp_blob) rel, off, fpoff = [], 0, 0 for r in emitted: rel.append(dict(name=r['name'], rel=off, fprel=fpoff, target=r['offset'], length=r['length'], fplen=len(r['fp']))) off += r['length'] fpoff += len(r['fp']) assert fpoff == len(fp_blob) - len(MAGIC_FP), (fpoff, len(fp_blob)) json.dump(dict(role=ROLE, magic_len=len(MAGIC_PAY), magic_fp_len=len(MAGIC_FP), fp_len=FP_LEN, records=rel, pay_bytes=len(pay_blob), fp_bytes=len(fp_blob)), open(os.path.join(BLOBDIR, 'offsets.json'), 'w', encoding='utf-8'), indent=1) print('blob_%s/ 单条目: payload.bin %d B + fp.bin %d B(%d 条记录)' % (ROLE, len(pay_blob), len(fp_blob), len(rel))) def script(fname, rows, header, base, verify, tail): with open(os.path.join(OUT, fname), 'w', encoding='utf-8', newline='\n') as f: f.write('#!/bin/sh\n') for line in header: f.write('# ' + line + '\n') f.write('\nDEV=/dev/app\nBASE=' + base + '\n\n') f.write('echo "target check"\nls -l $DEV\n\n') for r in rows: b = 4 if (r['offset'] % 4 == 0 and r['length'] % 4 == 0) else 1 f.write('echo "== ' + r['name'] + ' ==\n') f.write('dd if=$BASE/%s of=$DEV bs=%d seek=%d count=%d\n' % (r['file'], b, r['offset'] // b, r['length'] // b)) if verify: f.write('dd if=$DEV of=/tmp/chk.bin bs=%d skip=%d count=%d\n' % (b, r['offset'] // b, r['length'] // b)) f.write('cmp /tmp/chk.bin $BASE/%s\n\n' % r['file']) f.write(tail + '\n') if ROLE == 'replace': script('flash.sh', lua_rows, ['S5 41mm 压力检测动画 -> S4 eSIM(只写负载)', '把 flash.sh 与 payload/ 放到同一个目录,例如 /data/s4panim/', '然后: sh /data/s4panim/flash.sh 最后: reboot', '还原用 restore.sh 或安装还原盘 S4PAnimRestore.face'], '/data/s4panim/payload', True, 'rm /tmp/chk.bin\necho "all done - run reboot to apply"') else: script('restore.sh', lua_rows, ['把 S4 eSIM 的压力检测动画写回原厂(还原盘)'], '/data/s4panim/payload_restore', True, 'rm /tmp/chk.bin\necho "restore done - run reboot to apply"') json.dump(dict(device='Xiaomi Watch S4 eSIM (o62lte)', target='/dev/app', role=ROLE, kind='pressure-measure-anim', dd='dd if=/ of=/dev/app bs=4 seek= count=', block_size=4, records=lua_rows, dropped_identical=[r['name'] for r in dropped]), open(os.path.join(OUT, 'payload.json'), 'w', encoding='utf-8'), indent=1, ensure_ascii=False) total = sum(r['length'] for r in lua_rows) print('role=%s: emitted %d records, %.2f MB; dropped %d' % (ROLE, len(lua_rows), total / 1048576, len(dropped)))