2024-04-23 18:22:53 -04:00
|
|
|
#!/usr/bin/env python3 -B
|
|
|
|
# coding=utf-8
|
2022-07-06 10:54:17 -04:00
|
|
|
|
|
|
|
"""
|
|
|
|
Insyde IFD Extract
|
|
|
|
Insyde iFlash/iFdPacker Extractor
|
2024-04-23 18:22:53 -04:00
|
|
|
Copyright (C) 2022-2024 Plato Mavropoulos
|
2022-07-06 10:54:17 -04:00
|
|
|
"""
|
|
|
|
|
|
|
|
import ctypes
|
2024-04-23 18:22:53 -04:00
|
|
|
import os
|
2022-07-06 10:54:17 -04:00
|
|
|
|
|
|
|
from common.comp_szip import is_szip_supported, szip_decompress
|
2024-04-23 18:22:53 -04:00
|
|
|
from common.path_ops import get_extract_path, get_path_files, make_dirs, safe_name
|
2022-07-06 10:54:17 -04:00
|
|
|
from common.patterns import PAT_INSYDE_IFL, PAT_INSYDE_SFX
|
2024-04-23 18:22:53 -04:00
|
|
|
from common.struct_ops import Char, get_struct, UInt32
|
2022-09-12 16:09:12 -04:00
|
|
|
from common.system import printer
|
|
|
|
from common.templates import BIOSUtility
|
2022-07-06 10:54:17 -04:00
|
|
|
from common.text_ops import file_to_bytes
|
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
TITLE = 'Insyde iFlash/iFdPacker Extractor v3.0'
|
|
|
|
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
class IflashHeader(ctypes.LittleEndianStructure):
|
2024-04-23 18:22:53 -04:00
|
|
|
""" Insyde iFlash Header """
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
_pack_ = 1
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
# noinspection PyTypeChecker
|
2022-07-06 10:54:17 -04:00
|
|
|
_fields_ = [
|
2024-04-23 18:22:53 -04:00
|
|
|
('Signature', Char * 8), # 0x00 $_IFLASH
|
|
|
|
('ImageTag', Char * 8), # 0x08
|
|
|
|
('TotalSize', UInt32), # 0x10 from header end
|
|
|
|
('ImageSize', UInt32), # 0x14 from header end
|
2022-07-06 10:54:17 -04:00
|
|
|
# 0x18
|
|
|
|
]
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def _get_padd_len(self) -> int:
|
2022-07-06 18:31:29 -04:00
|
|
|
return self.TotalSize - self.ImageSize
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def get_image_tag(self) -> str:
|
|
|
|
""" Get Insyde iFlash image tag """
|
|
|
|
|
|
|
|
return self.ImageTag.decode('utf-8', 'ignore').strip('_')
|
|
|
|
|
|
|
|
def struct_print(self, padd: int) -> None:
|
|
|
|
""" Display structure information """
|
|
|
|
|
|
|
|
printer(['Signature :', self.Signature.decode('utf-8')], padd, False)
|
|
|
|
printer(['Image Name:', self.get_image_tag()], padd, False)
|
|
|
|
printer(['Image Size:', f'0x{self.ImageSize:X}'], padd, False)
|
|
|
|
printer(['Total Size:', f'0x{self.TotalSize:X}'], padd, False)
|
|
|
|
printer(['Padd Size :', f'0x{self._get_padd_len():X}'], padd, False)
|
|
|
|
|
|
|
|
|
|
|
|
def is_insyde_ifd(input_object: str | bytes | bytearray) -> bool:
|
|
|
|
""" Check if input is Insyde iFlash/iFdPacker Update image """
|
|
|
|
|
|
|
|
input_buffer: bytes = file_to_bytes(input_object)
|
|
|
|
|
|
|
|
is_ifl: bool = bool(insyde_iflash_detect(input_buffer))
|
|
|
|
|
|
|
|
is_sfx: bool = bool(PAT_INSYDE_SFX.search(input_buffer))
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
return is_ifl or is_sfx
|
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def insyde_ifd_extract(input_object: str | bytes | bytearray, extract_path: str, padding: int = 0) -> int:
|
|
|
|
""" Parse & Extract Insyde iFlash/iFdPacker Update images """
|
|
|
|
|
|
|
|
input_buffer: bytes = file_to_bytes(input_object)
|
|
|
|
|
|
|
|
iflash_code: int = insyde_iflash_extract(input_buffer, extract_path, padding)
|
|
|
|
|
|
|
|
ifdpack_path: str = os.path.join(extract_path, 'Insyde iFdPacker SFX')
|
|
|
|
|
|
|
|
ifdpack_code: int = insyde_packer_extract(input_buffer, ifdpack_path, padding)
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
return iflash_code and ifdpack_code
|
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def insyde_iflash_detect(input_buffer: bytes) -> list:
|
|
|
|
""" Detect Insyde iFlash Update image """
|
|
|
|
|
|
|
|
iflash_match_all: list = []
|
|
|
|
iflash_match_nan: list = [0x0, 0xFFFFFFFF]
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
for iflash_match in PAT_INSYDE_IFL.finditer(input_buffer):
|
2024-04-23 18:22:53 -04:00
|
|
|
ifl_bgn: int = iflash_match.start()
|
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
if len(input_buffer[ifl_bgn:]) <= INS_IFL_LEN:
|
2022-07-06 10:54:17 -04:00
|
|
|
continue
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
ifl_hdr = get_struct(input_buffer, ifl_bgn, IflashHeader)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
if ifl_hdr.TotalSize in iflash_match_nan \
|
2024-04-23 18:22:53 -04:00
|
|
|
or ifl_hdr.ImageSize in iflash_match_nan \
|
|
|
|
or ifl_hdr.TotalSize < ifl_hdr.ImageSize \
|
|
|
|
or ifl_bgn + INS_IFL_LEN + ifl_hdr.TotalSize > len(input_buffer):
|
2022-07-06 10:54:17 -04:00
|
|
|
continue
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
iflash_match_all.append([ifl_bgn, ifl_hdr])
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
return iflash_match_all
|
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def insyde_iflash_extract(input_buffer: bytes, extract_path: str, padding: int = 0) -> int:
|
|
|
|
""" Extract Insyde iFlash Update image """
|
|
|
|
|
|
|
|
insyde_iflash_all: list = insyde_iflash_detect(input_buffer)
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
if not insyde_iflash_all:
|
2022-07-06 18:31:29 -04:00
|
|
|
return 127
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
printer('Detected Insyde iFlash Update image!', padding)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
make_dirs(extract_path, delete=True)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
exit_codes: list = []
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
for insyde_iflash in insyde_iflash_all:
|
2024-04-23 18:22:53 -04:00
|
|
|
exit_code: int = 0
|
|
|
|
|
|
|
|
ifl_bgn, ifl_hdr = insyde_iflash
|
|
|
|
|
|
|
|
img_bgn: int = ifl_bgn + INS_IFL_LEN
|
|
|
|
img_end: int = img_bgn + ifl_hdr.ImageSize
|
|
|
|
img_bin: bytes = input_buffer[img_bgn:img_end]
|
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
if len(img_bin) != ifl_hdr.ImageSize:
|
|
|
|
exit_code = 1
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
img_val: list = [ifl_hdr.get_image_tag(), 'bin']
|
|
|
|
img_tag, img_ext = INS_IFL_IMG.get(img_val[0], img_val)
|
|
|
|
|
|
|
|
img_name: str = f'{img_tag} [0x{img_bgn:08X}-0x{img_end:08X}]'
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
printer(f'{img_name}\n', padding + 4)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
ifl_hdr.struct_print(padding + 8)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
if img_val == [img_tag, img_ext]:
|
2022-07-06 10:54:17 -04:00
|
|
|
printer(f'Note: Detected new Insyde iFlash tag {img_tag}!', padding + 12, pause=True)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
out_name: str = f'{img_name}.{img_ext}'
|
|
|
|
|
|
|
|
out_path: str = os.path.join(extract_path, safe_name(out_name))
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
with open(out_path, 'wb') as out_image:
|
|
|
|
out_image.write(img_bin)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
printer(f'Succesfull Insyde iFlash > {img_tag} extraction!', padding + 12)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
exit_codes.append(exit_code)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
return sum(exit_codes)
|
2022-07-06 10:54:17 -04:00
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
def insyde_packer_extract(input_buffer: bytes, extract_path: str, padding: int = 0) -> int:
|
|
|
|
""" Extract Insyde iFdPacker 7-Zip SFX 7z Update image """
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
match_sfx = PAT_INSYDE_SFX.search(input_buffer)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
if not match_sfx:
|
|
|
|
return 127
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
printer('Detected Insyde iFdPacker Update image!', padding)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
make_dirs(extract_path, delete=True)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
sfx_buffer: bytearray = bytearray(input_buffer[match_sfx.end() - 0x5:])
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
if sfx_buffer[:0x5] == b'\x6E\xF4\x79\x5F\x4E':
|
2022-07-06 18:31:29 -04:00
|
|
|
printer('Detected Insyde iFdPacker > 7-Zip SFX > Obfuscation!', padding + 4)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
for index, byte in enumerate(sfx_buffer):
|
2022-07-06 10:54:17 -04:00
|
|
|
sfx_buffer[index] = byte // 2 + (128 if byte % 2 else 0)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
printer('Removed Insyde iFdPacker > 7-Zip SFX > Obfuscation!', padding + 8)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
printer('Extracting Insyde iFdPacker > 7-Zip SFX archive...', padding + 4)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
if bytes(INS_SFX_PWD, 'utf-16le') in input_buffer[:match_sfx.start()]:
|
|
|
|
printer('Detected Insyde iFdPacker > 7-Zip SFX > Password!', padding + 8)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
printer(INS_SFX_PWD, padding + 12)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
sfx_path: str = os.path.join(extract_path, 'Insyde_iFdPacker_SFX.7z')
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
with open(sfx_path, 'wb') as sfx_file:
|
|
|
|
sfx_file.write(sfx_buffer)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-08-28 13:02:55 -04:00
|
|
|
if is_szip_supported(sfx_path, padding + 8, args=[f'-p{INS_SFX_PWD}'], check=True):
|
2022-07-06 18:31:29 -04:00
|
|
|
if szip_decompress(sfx_path, extract_path, 'Insyde iFdPacker > 7-Zip SFX',
|
2024-04-23 18:22:53 -04:00
|
|
|
padding + 8, args=[f'-p{INS_SFX_PWD}'], check=True) == 0:
|
2022-07-06 10:54:17 -04:00
|
|
|
os.remove(sfx_path)
|
|
|
|
else:
|
|
|
|
return 125
|
|
|
|
else:
|
|
|
|
return 126
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
exit_codes = []
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
for sfx_file in get_path_files(extract_path):
|
|
|
|
if is_insyde_ifd(sfx_file):
|
|
|
|
printer(f'{os.path.basename(sfx_file)}', padding + 12)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
|
|
|
ifd_code: int = insyde_ifd_extract(sfx_file, get_extract_path(sfx_file), padding + 16)
|
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
exit_codes.append(ifd_code)
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 10:54:17 -04:00
|
|
|
return sum(exit_codes)
|
|
|
|
|
2024-04-23 18:22:53 -04:00
|
|
|
|
2022-07-06 18:31:29 -04:00
|
|
|
# Insyde iFdPacker known 7-Zip SFX Password
|
2024-04-23 18:22:53 -04:00
|
|
|
INS_SFX_PWD: str = 'Y`t~i!L@i#t$U%h^s7A*l(f)E-d=y+S_n?i'
|
2022-07-06 18:31:29 -04:00
|
|
|
|
|
|
|
# Insyde iFlash known Image Names
|
2024-04-23 18:22:53 -04:00
|
|
|
INS_IFL_IMG: dict = {
|
|
|
|
'BIOSCER': ['Certificate', 'bin'],
|
|
|
|
'BIOSCR2': ['Certificate 2nd', 'bin'],
|
|
|
|
'BIOSIMG': ['BIOS-UEFI', 'bin'],
|
|
|
|
'DRV_IMG': ['isflash', 'efi'],
|
|
|
|
'EC_IMG': ['Embedded Controller', 'bin'],
|
|
|
|
'INI_IMG': ['platform', 'ini'],
|
|
|
|
'ME_IMG': ['Management Engine', 'bin'],
|
|
|
|
'OEM_ID': ['OEM Identifier', 'bin'],
|
|
|
|
}
|
2022-07-06 10:54:17 -04:00
|
|
|
|
|
|
|
# Get common ctypes Structure Sizes
|
2024-04-23 18:22:53 -04:00
|
|
|
INS_IFL_LEN: int = ctypes.sizeof(IflashHeader)
|
2022-07-06 10:54:17 -04:00
|
|
|
|
|
|
|
if __name__ == '__main__':
|
2024-04-23 18:22:53 -04:00
|
|
|
BIOSUtility(title=TITLE, check=is_insyde_ifd, main=insyde_ifd_extract).run_utility()
|