diff --git a/patch-airsense b/patch-airsense index d03e9a8..22bf429 100755 --- a/patch-airsense +++ b/patch-airsense @@ -69,9 +69,37 @@ check_hash() { cp "$IN" "$OUT" || die "$OUT: copy failed" patch_tamper() { - # patch the jump instruction that checks for tamper - printf '\xc0\x46' | patch 0xf0 \ - || die "startup patch failed" + # All firmware versions across airsense and aircurve devices have BID=SX577-0200 + # But Lumis running on SX585-0200 is unique + + local version=$(dd if="$OUT" bs=1 skip=$((0x3f80)) count=10 2>/dev/null) + + case "$version" in + "SX577-0200") + echo -n "Patching firmware integrity checks... " + # Skip BLX check + printf '\x01\x20\xc0\x46' | patch 0x310e && echo -n "BLX ok " || die "patch failed (BLX)" + # Skip CCX check + printf '\x00\x20\xc0\x46' | patch 0x313e && echo -n "CCX ok " || die "patch failed (CCX)" + # Skip CDX check + printf '\x00\x20\xc0\x46' | patch 0x3130 && echo -n "CDX ok " || die "patch failed (CDX)" + echo + ;; + "SX585-0200") + # Skip BLX check + printf '\x01\x20\xc0\x46' | patch 0x316e && echo -n "BLX ok " || die "patch failed (BLX)" + # Skip CCX check + printf '\x00\x20\xc0\x46' | patch 0x319e && echo -n "CCX ok " || die "patch failed (CCX)" + # Skip CDX check + printf '\x00\x20\xc0\x46' | patch 0x3190 && echo -n "CDX ok " || die "patch failed (CDX)" + echo + ;; + *) + die "Unknown bootloader version: '$version'" + # or try previous method if you know what you're doing + # printf '\xc0\x46' | patch 0xf0 || die "startup patch failed" + ;; + esac } patch_strings() { diff --git a/python/patch-airsense.py b/python/patch-airsense.py index b162ef3..ebf5e0b 100644 --- a/python/patch-airsense.py +++ b/python/patch-airsense.py @@ -260,10 +260,20 @@ def __init__(self, asf): def bypass_startcheck(self): #Start-up check for CRC etc, bypass it to avoid (might not be needed) - if self.asf.hash == self.known_units[0].hash: - asf.patch(b'\xc0\x46', 0xF0, clobber=True) + loader = self.asf.str_loader_ver.strip('\x00') + + if loader.startswith('SX577-0200'): + # AirSense / AirCurve variant + asf.patch(b'\x01\x20\xc0\x46', 0x310e, clobber=True) # BLX + asf.patch(b'\x00\x20\xc0\x46', 0x313e, clobber=True) # CCX + asf.patch(b'\x00\x20\xc0\x46', 0x3130, clobber=True) # CDX + elif loader.startswith('SX585-0200'): + # Lumis + self.asf.patch(b'\x01\x20\xc0\x46', 0x316e, clobber=True) # BLX + self.asf.patch(b'\x00\x20\xc0\x46', 0x319e, clobber=True) # CCX + self.asf.patch(b'\x00\x20\xc0\x46', 0x3190, clobber=True) # CDX else: - raise IOError("Unknown hash: %s"%self.asf.hash) + raise IOError("Unknown bootloader version: '%s' (hash: %s)" % (loader, self.asf.hash)) def change_text(self): if self.asf.hash == self.known_units[0].hash: