xref: /freebsd/contrib/file/magic/Magdir/firmware (revision b64c5a0ace59af62eff52bfe110a521dc73c937b)
1#------------------------------------------------------------------------------
2# $File: firmware,v 1.13 2024/09/04 19:04:03 christos Exp $
3# firmware:  file(1) magic for firmware files
4#
5
6# https://github.com/MatrixEditor/frontier-smart-api/blob/main/docs/firmware-2.0.md#11-header-structure
7# examples: https://github.com/cweiske/frontier-silicon-firmwares
80	lelong		0x00001176
9>4	lelong		0x7c		Frontier Silicon firmware download
10>>8	lelong		x		\b, MeOS version %x
11>>12	string/32/T	x		\b, version %s
12>>40	string/64/T	x		\b, customization %s
13
14# HPE iLO firmware update image
15# From: Alexandre Iooss <erdnaxe@crans.org>
16# URL: https://www.sstic.org/2018/presentation/backdooring_your_server_through_its_bmc_the_hpe_ilo4_case/
17# iLO1 (ilo1*.bin) or iLO2 (ilo2_*.bin) images
180               string                  \x20\x36\xc1\xce\x60\x37\x62\xf0\x3f\x06\xde\x00\x00\x03\x7f\x00
19>16             ubeshort                =0xCFDD         HPE iLO2 firmware update image
20>16             ubeshort                =0x6444         HPE iLO1 firmware update image
21# iLO3 images (ilo3_*.bin) start directly with image name
220               string                  iLO3\x20v\x20   HPE iLO3 firmware update image,
23>7              string                  x               version %s
24# iLO4 images (ilo4_*.bin) start with a signature and a certificate
250               string                  --=</Begin\x20HP\x20Signed
26>75             string                  label_HPBBatch
27>>5828          string                  iLO\x204
28>>>5732         string                  HPIMAGE\x00     HPE iLO4 firmware update image,
29>>>6947         string                  x               version %s
30# iLO5 images (ilo5_*.bin) start with a signature
31>75             string                  label_HPE-HPB-BMC-ILO5-4096
32>>880           string                  HPIMAGE\x00     HPE iLO5 firmware update image,
33>>944           string                  x               version %s
34
35# IBM POWER Secure Boot Container
36# from https://github.com/open-power/skiboot/blob/master/libstb/container.h
370	belong	0x17082011	POWER Secure Boot Container,
38>4	beshort	x		version %u
39>6	bequad	x		container size %llu
40# These are always zero
41# >14	bequad	x		target HRMOR %llx
42# >22	bequad  x		stack pointer %llx
43>4096	ustring \xFD7zXZ\x00    XZ compressed
440	belong	0x1bad1bad	POWER boot firmware
45>256	belong	0x48002030	(PHYP entry point)
46
47# ARM Cortex-M vector table
48# From: Alexandre Iooss <erdnaxe@crans.org>
49# URL: https://developer.arm.com/documentation/100701/0200/Exception-properties
50# Match stack MSB
513		byte			0x20
52# Function pointers must be in Thumb-mode and before 0x20000000 (4*5 bits match)
53>4		ulelong&0xE0000001	1
54>>8		ulelong&0xE0000001	1
55>>>12		ulelong&0xE0000001	1
56>>>>44		ulelong&0xE0000001	1
57>>>>>56		ulelong&0xE0000001	1
58# Match Cortex-M reserved sections (0x00000000 or 0xFFFFFFFF)
59>>>>>>28	ulelong+1		<2
60>>>>>>>32	ulelong+1		<2
61>>>>>>>>36	ulelong+1		<2
62>>>>>>>>>40	ulelong+1		<2
63>>>>>>>>>>52	ulelong+1		<2	ARM Cortex-M firmware
64>>>>>>>>>>>0	ulelong			>0	\b, initial SP at 0x%08x
65>>>>>>>>>>>4	ulelong^1		x	\b, reset at 0x%08x
66>>>>>>>>>>>8	ulelong^1		x	\b, NMI at 0x%08x
67>>>>>>>>>>>12	ulelong^1		x	\b, HardFault at 0x%08x
68>>>>>>>>>>>44	ulelong^1		x	\b, SVCall at 0x%08x
69>>>>>>>>>>>56	ulelong^1		x	\b, PendSV at 0x%08x
70
71# ESP-IDF partition table entry
72# From: Alexandre Iooss <erdnaxe@crans.org>
73# URL: https://github.com/espressif/esp-idf/blob/v5.0/components/esp_partition/include/esp_partition.h
740	string		\xAA\x50
75>2	ubyte		<2		ESP-IDF partition table entry
76>>12	string/16	x		\b, label: "%s"
77>>2	ubyte		0
78>>>3	ubyte		0x00		\b, factory app
79>>>3	ubyte		0x10		\b, OTA_0 app
80>>>3	ubyte		0x11		\b, OTA_1 app
81>>>3	ubyte		0x12		\b, OTA_2 app
82>>>3	ubyte		0x13		\b, OTA_3 app
83>>>3	ubyte		0x14		\b, OTA_4 app
84>>>3	ubyte		0x15		\b, OTA_5 app
85>>>3	ubyte		0x16		\b, OTA_6 app
86>>>3	ubyte		0x17		\b, OTA_7 app
87>>>3	ubyte		0x18		\b, OTA_8 app
88>>>3	ubyte		0x19		\b, OTA_9 app
89>>>3	ubyte		0x1A		\b, OTA_10 app
90>>>3	ubyte		0x1B		\b, OTA_11 app
91>>>3	ubyte		0x1C		\b, OTA_12 app
92>>>3	ubyte		0x1D		\b, OTA_13 app
93>>>3	ubyte		0x1E		\b, OTA_14 app
94>>>3	ubyte		0x1F		\b, OTA_15 app
95>>>3	ubyte		0x20		\b, test app
96>>2	ubyte		1
97>>>3	ubyte		0x00		\b, OTA selection data
98>>>3	ubyte		0x01		\b, PHY init data
99>>>3	ubyte		0x02		\b, NVS data
100>>>3	ubyte		0x03		\b, coredump data
101>>>3	ubyte		0x04		\b, NVS keys
102>>>3	ubyte		0x05		\b, emulated eFuse data
103>>>3	ubyte		0x06		\b, undefined data
104>>>3	ubyte		0x80		\b, ESPHTTPD partition
105>>>3	ubyte		0x81		\b, FAT partition
106>>>3	ubyte		0x82		\b, SPIFFS partition
107>>>3	ubyte		0xFF		\b, any data
108>>4	ulelong		x		\b, offset: 0x%X
109>>8	ulelong		x		\b, size: 0x%X
110>>28	ulelong&0x1	1		\b, encrypted
111
112# ESP-IDF application image
113# From: Alexandre Iooss <erdnaxe@crans.org>
114# Update:	Joerg Jenderek
115# URL: https://github.com/espressif/esp-idf/blob/v5.0/components/bootloader_support/include/esp_app_format.h
116# Reference:	https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/system/app_image_format.html
117# Note: Concatenation of esp_image_header_t, esp_image_segment_header_t and esp_app_desc_t
118# 	First segment contains esp_app_desc_t
119# ESP_IMAGE_HEADER_MAGIC at the beginning of esp_image_header_t structure
1200	ubyte		0xE9
121# display ESP-IDF application image (strength=40=40+0) before DOS executable with 16bit JuMP (strength=40) handled by ./msdos
122#!:strength	+0
123# ESP_APP_DESC_MAGIC_WORD; magic for the esp_app_desc_t structure
124>32	ulelong		0xABCD5432	ESP-IDF application image
125#!:mime	application/octet-stream
126!:mime	application/x-espressif-bin
127!:ext	bin
128>>12	uleshort	0x0000		for ESP32
129>>12	uleshort	0x0002		for ESP32-S2
130>>12	uleshort	0x0005		for ESP32-C3
131>>12	uleshort	0x0009		for ESP32-S3
132>>12	uleshort	0x000A		for ESP32-H2 Beta1
133>>12	uleshort	0x000C		for ESP32-C2
134>>12	uleshort	0x000D		for ESP32-C6
135>>12	uleshort	0x000E		for ESP32-H2 Beta2
136>>12	uleshort	0x0010		for ESP32-H2
137>>80	string/32	x		\b, project name: "%s"
138>>48	string/32	x		\b, version %s
139>>128	string/16	x		\b, compiled on %s
140>>>112	string/16	x		%s
141>>144	string/32	x		\b, IDF version: %s
142>>4	ulelong		x		\b, entry address: 0x%08X
143
144# AVR firmware
145# From: Alexandre Iooss <erdnaxe@crans.org>
146# URL: https://microchipdeveloper.com/8avr:int
147# Match 4-byte JMP for Reset, Int0-2, PcInt0-3 and WDT
1480		uleshort&0xFE0E	0x940C
149>4		uleshort&0xFE0E	0x940C
150>>8		uleshort&0XFE0E	0x940C
151>>>12		uleshort&0XFE0E	0x940C
152>>>>16		uleshort&0XFE0E	0x940C
153>>>>>20		uleshort&0XFE0E	0x940C
154>>>>>>24	uleshort&0XFE0E	0x940C
155>>>>>>>28	uleshort&0XFE0E	0x940C
156>>>>>>>>32	uleshort&0XFE0E	0x940C	AVR firmware
157# Handle only 16-bit addressing
158>>>>>>>>>0	uleshort	0x940C
159>>>>>>>>>>2	uleshort	x	\b, reset at 0x%04x
160# Match 2-byte RJMP for Reset, Int0-2, PcInt0-3 and WDT for smaller AVR
1611		byte&0xF0	0xC0
162>3		byte&0xF0	0xC0
163>>5		byte&0xF0	0xC0
164>>>7		byte&0xF0	0xC0
165>>>>9		byte&0xF0	0xC0
166>>>>>11		byte&0xF0	0xC0
167>>>>>>13	byte&0xF0	0xC0
168>>>>>>>15	byte&0xF0	0xC0
169>>>>>>>>17	byte&0xF0	0xC0	AVR firmware
170>>>>>>>>>0	uleshort&0x0FFF	x	\b, reset at 0x%04x
171
172# Summary:	Intel HEXadecimal file format
173# URL:		https://en.wikipedia.org/wiki/Intel_HEX
174# Reference:	http://www.piclist.com/techref/fileext/hex/intel.htm
175#		http://mark0.net/download/triddefs_xml.7z/defs/h/hex-intel.trid.xml
176# From:		Joerg Jenderek
177# Note:		called "Intel Hexadecimal object format" by TrID, "Intel� hexadecimal object file" on Linux
178#		and "Intel HEX binary data" by Notepad++
179# look for start code; 1 character, an ASCII colon ':'; all characters preceding this symbol should be ignored
1800	ubyte		0x3A
181# check for valid record type string with range 00 - 05 (3030h - 3035h)
182>&6	ubeshort&0xFFf8	=0x3030
183# check for valid record length string like: 02 04 08 10h 20h 03 (usbdload.hex usbdldv2.hex from Windows Vista)
184#>>1	string		x		LENGTH_STRING=%0.2s
185#>>1	ubeshort	x		LENGTH=%#4.4x
186>>&-8	ubeshort&0xFCf0	=0x3030
187>>>0	use		intel-hex
188#	display information (offset, record length and type) of Intel HEX
1890	name		intel-hex
190# RECORD MARK
191>0	ubyte		x		Intel hexadecimal object
192#!:mime	text/plain
193!:mime	text/x-hex
194!:ext	hex
195# no samples with other suffix found
196# .hex .mcs .int .ihex .ihe .ihx .h80 .h86 .a43 .a90 .obj .obl .obh .rom .eep
197# .hxl-.hxh .h00-.h15 .p00-.pff
198# RECLEN; 2 hex digits for number of bytes in 1st data field; like 0x02 0x03 0x04 0x08 0x10 0x20; maximum 255
199>1	string		x		\b, 0x%2.2s record length
200# OFFSET; 4 hex digits for 1st 16-bit memory offset of data like: 0000 (often) 1C00h 1E00h 3800h 3E00h 76EDh 7800h 7E00h ...
201>3	string		x		\b, 0x%4.4s offset
202# RECTYP; 2 hex digits (00 - 05); meaning of 1st data field; 00~DataRecord (often) 0l~EndOfFileRecord 02~ExtendedSegmentAddressRecord 03~StartSegmentAddressRecord 04~ExtendedLinearAddressRecord 05~StartLinearAddressRecord
203>7	string		x		\b, '%2.2s' type
204# DATA; n bytes of 1st data represented by 2n hex digits followed by 1 byte checksum
205>9	string		x		\b, data+checksum %s
206# last record :00000001FF with RECLEN 0, OFFSET 0, record type 01 for EndOfFile and 1 checksum byte FF
207# samples with CarriageReturnLineFeed terminator
208>-2	ubeshort	=0x0d0a
209# This should not happen!
210>>-13	string		!:00000001FF	\b, last line %s
211>-2	ubeshort	!0x0d0a
212# samples with LineFeed terminator
213>>-1	ubyte		=0x0a
214# This should not happen!
215>>>-12	string		!:00000001FF	\b, last line %s
216
217# Raspberry Pi RP2040 firmware
218# From: Alexandre Iooss <erdnaxe@crans.org>
219# Note: RP2040 flash image starts with stage2 bootloader, then a vector table.
220# URL: https://github.com/raspberrypi/pico-sdk/tree/1.5.1/src/rp2_common/boot_stage2
221# boot2_*.S code (_stage2_boot)
2220		ulelong			0x4B32B500
223>4		ulelong			0x60582021
224>>8		ulelong			0x21026898
225# exit_from_boot2.S code (check_return) `pop {r0}; cmp r0, #0`
226>>>148		ulelong			0x2800bc01
227# Cortex-M vector table with reserved section filled with a default interrupt address
228>>>>259		byte			0x20
229# make sure required vector table entries are ARM Thumb and in flash
230>>>>>260	ulelong&0xE0000001	1
231>>>>>>264	ulelong&0xE0000001	1
232>>>>>>>268	ulelong&0xE0000001	1
233>>>>>>>>300	ulelong&0xE0000001	1
234>>>>>>>>>312	ulelong&0xE0000001	1		Raspberry Pi RP2040 firmware
235>>>>>>>>>>256	ulelong			>0		\b, initial SP at 0x%08x
236>>>>>>>>>>260	ulelong^1		x		\b, reset at 0x%08x
237>>>>>>>>>>264	ulelong^1		x		\b, NMI at 0x%08x
238>>>>>>>>>>268	ulelong^1		x		\b, HardFault at 0x%08x
239>>>>>>>>>>300	ulelong^1		x		\b, SVCall at 0x%08x
240>>>>>>>>>>312	ulelong^1		x		\b, PendSV at 0x%08x
241# optional binary_info in the first 256 bytes, used by picotool
242# https://github.com/raspberrypi/pico-sdk/blob/master/src/common/pico_binary_info/include/pico/binary_info/defs.h
243>>>>>>>>>>256	search/256		\xf2\xeb\x88\x71	\b, with binary_info
244
245# Silicon Labs Gecko Bootloader update image
246# From: Alexandre Iooss <erdnaxe@crans.org>
247# Reference: https://github.com/raboof/gbl
248#            https://github.com/dsyx/emberznet-doc
249# Note: TLV always starting with tag 0x03A617EB of length 8
2500	ulelong		0x03A617EB
251>4	ulelong		8		Silicon Labs Gecko bootloader update image
252!:ext	gbl
253>>12	byte		1		\b, encrypted (AES-CTR-128)
254>>13	byte		1		\b, signed (ECDSA-P256)
255# If not encrypted, indicate first image type
256>>16	ulelong		0xF40A0AF4	\b, application image
257>>16	ulelong		0xF50909F5	\b, bootloader image
258
259# Silicon Labs Gecko Bootloader OTA update with Zigbee EmberZNet SDK
260# URL: https://github.com/SiliconLabs/gecko_sdk
2610	ulelong		0x0BEEF11E
262>6	ulelong		0x38		Silicon Labs Gecko EmberZNet OTA image
263!:ext	ota/zigbee
264>>4	ubeshort	x		v%d
265
266# Device Firmware Upgrade with ST STMicroelectronics extensions
267# From: Alexandre Iooss <erdnaxe@crans.org>
268# Reference: STMicroelectronics note UM0391
269# Reference: https://dfu-util.sourceforge.net/dfuse.html
270# DFU prefix
2710	string		DfuSe\x01	DFU image (STM variant)
272!:ext	dfu
273>6	ulelong		x		\b, size: %d bytes
274# DFU suffix, specification 0x011A
275>-10	string		\x1A\x01UFD
276>>-12	uleshort	x		\b, for device %04X:
277>>-14	uleshort	x		\b%04X
278