1
+ ###############################################
2
+ # TX SX Pro Custom Payload Packer - by CTCaer #
3
+ ###############################################
4
+
5
+ import struct
6
+ import hashlib
7
+ from os import unlink
8
+
9
+ """
10
+ typedef struct boot_dat_hdr
11
+ {
12
+ unsigned char ident[0x10];
13
+ unsigned char sha2_s2[0x20];
14
+ unsigned int s2_dst;
15
+ unsigned int s2_size;
16
+ unsigned int s2_enc;
17
+ unsigned char pad[0x10];
18
+ unsigned int s3_size;
19
+ unsigned char pad2[0x90];
20
+ unsigned char sha2_hdr[0x20];
21
+ } boot_dat_hdr_t;
22
+ """
23
+
24
+ def sha256 (data ):
25
+ sha256 = hashlib .new ('sha256' )
26
+ sha256 .update (data )
27
+ return sha256 .digest ()
28
+
29
+ boot_fn = 'boot.dat'
30
+ # Custom payload filename.
31
+ stage2_fn = 'fusee-primary.bin'
32
+
33
+ boot = open (boot_fn , 'wb' )
34
+
35
+ with open (stage2_fn , 'rb' ) as fh :
36
+ stage2 = bytearray (fh .read ())
37
+ stage2 = bytes (stage2 )
38
+
39
+ # Re-create the header.
40
+ header = b''
41
+
42
+ # Magic ID.
43
+ header += b'\x43 \x54 \x43 \x61 \x65 \x72 \x20 \x42 \x4F \x4F \x54 \x00 '
44
+
45
+ # Version 2.5.
46
+ header += b'\x56 \x32 \x2E \x35 '
47
+
48
+ # Set sha256 hash of stage2 payload.
49
+ header += sha256 (stage2 )
50
+
51
+ # Set stage2 payload destination to 0x40010000.
52
+ header += b'\x00 \x00 \x01 \x40 '
53
+
54
+ # Stage2 payload size.
55
+ header += struct .pack ('I' , len (stage2 ))
56
+
57
+ # Disable Stage2 encryption.
58
+ header += struct .pack ('I' , 0 )
59
+
60
+ # Add padding. Stage3 size is 0.
61
+ header += b'\x00 ' * 0xA4
62
+
63
+ # Add header's sha256 hash.
64
+ sha256 = hashlib .new ('sha256' )
65
+ sha256 .update (header )
66
+ header += sha256 .digest ()
67
+
68
+ # Write header and the plaintext custom payload.
69
+ boot .write (header )
70
+ boot .write (stage2 )
71
+
72
+ boot .close ()
0 commit comments