File tree 3 files changed +53
-0
lines changed
3 files changed +53
-0
lines changed Original file line number Diff line number Diff line change @@ -87,6 +87,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi
87
87
| HSDT || [ ` patterns/hsdt.hexpat ` ] ( patterns/hsdt.hexpat ) | HiSilicon device-tree table images |
88
88
| ICO | | [ ` patterns/ico.hexpat ` ] ( patterns/ico.hexpat ) | Icon (.ico) or Cursor (.cur) files |
89
89
| ID3 | ` audio/mpeg ` | [ ` patterns/id3.hexpat ` ] ( patterns/id3.hexpat ) | ID3 tags in MP3 files |
90
+ | IM* H || [ ` patterns/imah.hexpat ` ] ( patterns/imah.hexpat ) | DJI Signed Firmware (IM* H) |
90
91
| Intel HEX | | [ ` patterns/intel_hex.hexpat ` ] ( patterns/intel_hex.hexpat ) | [ Intel hexadecimal object file format definition] ( "https://en.wikipedia.org/wiki/Intel_HEX" ) |
91
92
| IP | | [ ` patterns/ip.hexpat ` ] ( patterns/ip.hexpat ) | Ethernet II Frames (IP Packets) |
92
93
| IPS | | [ ` patterns/ips.hexpat ` ] ( patterns/ips.hexpat ) | IPS (International Patching System) files |
Original file line number Diff line number Diff line change
1
+ #pragma author Hrant (0xZ3R0)
2
+ #pragma description DJI Encrypted/Signed Firmware (IM*H)
3
+ #pragma endian little
4
+
5
+ // refs:
6
+ // - "Challenges in Dynamic Analysis of Drone Firmware and Its Solutions" (DOI: 10.1109/ACCESS.2024.3425604)
7
+ // - "Drone Security and the Mysterious Case of DJI’s DroneID" (DOI: 10.14722/ndss.2023.24217)
8
+ // - https://github.com/o-gs/dji-firmware-tools
9
+
10
+ struct imah_chunk_header {
11
+ s8 id[4];
12
+ u32 offset;
13
+ u32 size;
14
+ u32 attrib;
15
+ u64 address;
16
+ u8 reserved[8];
17
+ };
18
+
19
+ struct imah_header {
20
+ s8 magic[4];
21
+ u32 header_version;
22
+ u32 size;
23
+ u8 reserved[4];
24
+ u32 header_size;
25
+ u32 signature_size;
26
+ u32 payload_size;
27
+ u32 target_size;
28
+ u8 os;
29
+ u8 arch;
30
+ u8 compression;
31
+ u8 anti_version;
32
+ u32 auth_alg;
33
+ u8 auth_key[4];
34
+ u8 enc_key[4];
35
+ u8 scram_key[16];
36
+ s8 name[32];
37
+ u8 type[4];
38
+ u32 version;
39
+ u32 date;
40
+ u32 encr_cksum;
41
+ u8 reserved2[16];
42
+ s8 userdata[16];
43
+ u8 entry[8];
44
+ u32 plain_cksum;
45
+ u32 chunk_num;
46
+ u8 payload_digest[32];
47
+ };
48
+
49
+ imah_header header @ 0x00;
50
+ imah_chunk_header chunks[header.chunk_num] @ addressof (header) + sizeof (header);
51
+ u8 signature[header.signature_size] @ addressof (chunks) + sizeof (chunks);
52
+ u8 payload_start @ addressof (signature) + sizeof (signature);
You can’t perform that action at this time.
0 commit comments