#!/usr/bin/env python3 -B # coding=utf-8 """ Insyde IFD Extract Insyde iFlash/iFdPacker Extractor Copyright (C) 2022-2024 Plato Mavropoulos """ import ctypes import os from common.comp_szip import is_szip_supported, szip_decompress from common.path_ops import get_extract_path, get_path_files, make_dirs, safe_name from common.patterns import PAT_INSYDE_IFL, PAT_INSYDE_SFX from common.struct_ops import Char, get_struct, UInt32 from common.system import printer from common.templates import BIOSUtility from common.text_ops import file_to_bytes TITLE = 'Insyde iFlash/iFdPacker Extractor v3.0' class IflashHeader(ctypes.LittleEndianStructure): """ Insyde iFlash Header """ _pack_ = 1 # noinspection PyTypeChecker _fields_ = [ ('Signature', Char * 8), # 0x00 $_IFLASH ('ImageTag', Char * 8), # 0x08 ('TotalSize', UInt32), # 0x10 from header end ('ImageSize', UInt32), # 0x14 from header end # 0x18 ] def _get_padd_len(self) -> int: return self.TotalSize - self.ImageSize def get_image_tag(self) -> str: """ Get Insyde iFlash image tag """ return self.ImageTag.decode('utf-8', 'ignore').strip('_') def struct_print(self, padd: int) -> None: """ Display structure information """ printer(['Signature :', self.Signature.decode('utf-8')], padd, False) printer(['Image Name:', self.get_image_tag()], padd, False) printer(['Image Size:', f'0x{self.ImageSize:X}'], padd, False) printer(['Total Size:', f'0x{self.TotalSize:X}'], padd, False) printer(['Padd Size :', f'0x{self._get_padd_len():X}'], padd, False) def is_insyde_ifd(input_object: str | bytes | bytearray) -> bool: """ Check if input is Insyde iFlash/iFdPacker Update image """ input_buffer: bytes = file_to_bytes(input_object) is_ifl: bool = bool(insyde_iflash_detect(input_buffer)) is_sfx: bool = bool(PAT_INSYDE_SFX.search(input_buffer)) return is_ifl or is_sfx def insyde_ifd_extract(input_object: str | bytes | bytearray, extract_path: str, padding: int = 0) -> int: """ Parse & Extract Insyde iFlash/iFdPacker Update images """ input_buffer: bytes = file_to_bytes(input_object) iflash_code: int = insyde_iflash_extract(input_buffer, extract_path, padding) ifdpack_path: str = os.path.join(extract_path, 'Insyde iFdPacker SFX') ifdpack_code: int = insyde_packer_extract(input_buffer, ifdpack_path, padding) return iflash_code and ifdpack_code def insyde_iflash_detect(input_buffer: bytes) -> list: """ Detect Insyde iFlash Update image """ iflash_match_all: list = [] iflash_match_nan: list = [0x0, 0xFFFFFFFF] for iflash_match in PAT_INSYDE_IFL.finditer(input_buffer): ifl_bgn: int = iflash_match.start() if len(input_buffer[ifl_bgn:]) <= INS_IFL_LEN: continue ifl_hdr = get_struct(input_buffer, ifl_bgn, IflashHeader) if ifl_hdr.TotalSize in iflash_match_nan \ or ifl_hdr.ImageSize in iflash_match_nan \ or ifl_hdr.TotalSize < ifl_hdr.ImageSize \ or ifl_bgn + INS_IFL_LEN + ifl_hdr.TotalSize > len(input_buffer): continue iflash_match_all.append([ifl_bgn, ifl_hdr]) return iflash_match_all def insyde_iflash_extract(input_buffer: bytes, extract_path: str, padding: int = 0) -> int: """ Extract Insyde iFlash Update image """ insyde_iflash_all: list = insyde_iflash_detect(input_buffer) if not insyde_iflash_all: return 127 printer('Detected Insyde iFlash Update image!', padding) make_dirs(extract_path, delete=True) exit_codes: list = [] for insyde_iflash in insyde_iflash_all: exit_code: int = 0 ifl_bgn, ifl_hdr = insyde_iflash img_bgn: int = ifl_bgn + INS_IFL_LEN img_end: int = img_bgn + ifl_hdr.ImageSize img_bin: bytes = input_buffer[img_bgn:img_end] if len(img_bin) != ifl_hdr.ImageSize: exit_code = 1 img_val: list = [ifl_hdr.get_image_tag(), 'bin'] img_tag, img_ext = INS_IFL_IMG.get(img_val[0], img_val) img_name: str = f'{img_tag} [0x{img_bgn:08X}-0x{img_end:08X}]' printer(f'{img_name}\n', padding + 4) ifl_hdr.struct_print(padding + 8) if img_val == [img_tag, img_ext]: printer(f'Note: Detected new Insyde iFlash tag {img_tag}!', padding + 12, pause=True) out_name: str = f'{img_name}.{img_ext}' out_path: str = os.path.join(extract_path, safe_name(out_name)) with open(out_path, 'wb') as out_image: out_image.write(img_bin) printer(f'Succesfull Insyde iFlash > {img_tag} extraction!', padding + 12) exit_codes.append(exit_code) return sum(exit_codes) def insyde_packer_extract(input_buffer: bytes, extract_path: str, padding: int = 0) -> int: """ Extract Insyde iFdPacker 7-Zip SFX 7z Update image """ match_sfx = PAT_INSYDE_SFX.search(input_buffer) if not match_sfx: return 127 printer('Detected Insyde iFdPacker Update image!', padding) make_dirs(extract_path, delete=True) sfx_buffer: bytearray = bytearray(input_buffer[match_sfx.end() - 0x5:]) if sfx_buffer[:0x5] == b'\x6E\xF4\x79\x5F\x4E': printer('Detected Insyde iFdPacker > 7-Zip SFX > Obfuscation!', padding + 4) for index, byte in enumerate(sfx_buffer): sfx_buffer[index] = byte // 2 + (128 if byte % 2 else 0) printer('Removed Insyde iFdPacker > 7-Zip SFX > Obfuscation!', padding + 8) printer('Extracting Insyde iFdPacker > 7-Zip SFX archive...', padding + 4) if bytes(INS_SFX_PWD, 'utf-16le') in input_buffer[:match_sfx.start()]: printer('Detected Insyde iFdPacker > 7-Zip SFX > Password!', padding + 8) printer(INS_SFX_PWD, padding + 12) sfx_path: str = os.path.join(extract_path, 'Insyde_iFdPacker_SFX.7z') with open(sfx_path, 'wb') as sfx_file: sfx_file.write(sfx_buffer) if is_szip_supported(sfx_path, padding + 8, args=[f'-p{INS_SFX_PWD}'], check=True): if szip_decompress(sfx_path, extract_path, 'Insyde iFdPacker > 7-Zip SFX', padding + 8, args=[f'-p{INS_SFX_PWD}'], check=True) == 0: os.remove(sfx_path) else: return 125 else: return 126 exit_codes = [] for sfx_file in get_path_files(extract_path): if is_insyde_ifd(sfx_file): printer(f'{os.path.basename(sfx_file)}', padding + 12) ifd_code: int = insyde_ifd_extract(sfx_file, get_extract_path(sfx_file), padding + 16) exit_codes.append(ifd_code) return sum(exit_codes) # Insyde iFdPacker known 7-Zip SFX Password INS_SFX_PWD: str = 'Y`t~i!L@i#t$U%h^s7A*l(f)E-d=y+S_n?i' # Insyde iFlash known Image Names INS_IFL_IMG: dict = { 'BIOSCER': ['Certificate', 'bin'], 'BIOSCR2': ['Certificate 2nd', 'bin'], 'BIOSIMG': ['BIOS-UEFI', 'bin'], 'DRV_IMG': ['isflash', 'efi'], 'EC_IMG': ['Embedded Controller', 'bin'], 'INI_IMG': ['platform', 'ini'], 'ME_IMG': ['Management Engine', 'bin'], 'OEM_ID': ['OEM Identifier', 'bin'], } # Get common ctypes Structure Sizes INS_IFL_LEN: int = ctypes.sizeof(IflashHeader) if __name__ == '__main__': BIOSUtility(title=TITLE, check=is_insyde_ifd, main=insyde_ifd_extract).run_utility()