Skip to content

Commit bcaeef3

Browse files
authored
pattern: Added DJI Firmware Pattern (#392)
* added IM*H pattern * improved README
1 parent ee8d2f5 commit bcaeef3

File tree

3 files changed

+53
-0
lines changed

3 files changed

+53
-0
lines changed

README.md

+1
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi
8787
| HSDT || [`patterns/hsdt.hexpat`](patterns/hsdt.hexpat) | HiSilicon device-tree table images |
8888
| ICO | | [`patterns/ico.hexpat`](patterns/ico.hexpat) | Icon (.ico) or Cursor (.cur) files |
8989
| ID3 | `audio/mpeg` | [`patterns/id3.hexpat`](patterns/id3.hexpat) | ID3 tags in MP3 files |
90+
| IM*H || [`patterns/imah.hexpat`](patterns/imah.hexpat) | DJI Signed Firmware (IM*H) |
9091
| Intel HEX | | [`patterns/intel_hex.hexpat`](patterns/intel_hex.hexpat) | [Intel hexadecimal object file format definition]("https://en.wikipedia.org/wiki/Intel_HEX") |
9192
| IP | | [`patterns/ip.hexpat`](patterns/ip.hexpat) | Ethernet II Frames (IP Packets) |
9293
| IPS | | [`patterns/ips.hexpat`](patterns/ips.hexpat) | IPS (International Patching System) files |

patterns/imah.hexpat

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#pragma author Hrant (0xZ3R0)
2+
#pragma description DJI Encrypted/Signed Firmware (IM*H)
3+
#pragma endian little
4+
5+
// refs:
6+
// - "Challenges in Dynamic Analysis of Drone Firmware and Its Solutions" (DOI: 10.1109/ACCESS.2024.3425604)
7+
// - "Drone Security and the Mysterious Case of DJI’s DroneID" (DOI: 10.14722/ndss.2023.24217)
8+
// - https://github.com/o-gs/dji-firmware-tools
9+
10+
struct imah_chunk_header {
11+
s8 id[4];
12+
u32 offset;
13+
u32 size;
14+
u32 attrib;
15+
u64 address;
16+
u8 reserved[8];
17+
};
18+
19+
struct imah_header {
20+
s8 magic[4];
21+
u32 header_version;
22+
u32 size;
23+
u8 reserved[4];
24+
u32 header_size;
25+
u32 signature_size;
26+
u32 payload_size;
27+
u32 target_size;
28+
u8 os;
29+
u8 arch;
30+
u8 compression;
31+
u8 anti_version;
32+
u32 auth_alg;
33+
u8 auth_key[4];
34+
u8 enc_key[4];
35+
u8 scram_key[16];
36+
s8 name[32];
37+
u8 type[4];
38+
u32 version;
39+
u32 date;
40+
u32 encr_cksum;
41+
u8 reserved2[16];
42+
s8 userdata[16];
43+
u8 entry[8];
44+
u32 plain_cksum;
45+
u32 chunk_num;
46+
u8 payload_digest[32];
47+
};
48+
49+
imah_header header @ 0x00;
50+
imah_chunk_header chunks[header.chunk_num] @ addressof (header) + sizeof (header);
51+
u8 signature[header.signature_size] @ addressof (chunks) + sizeof (chunks);
52+
u8 payload_start @ addressof (signature) + sizeof (signature);
512 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)