allbins/tools/resign_tool/resign.sh

#!/bin/bash

set -e

if [ $# -lt 2 ]; then
    echo "$0 private_key work_dir"
    exit -1
fi

PRIVATE_KEY=$1
WORK_DIR=$2
#v3t for old device, sha256 is not supported, only md5
DEVICE=$3
HASH_STR="sha256"

echo "PRIVATE_KEY:" $PRIVATE_KEY
echo "WORK_DIR:" $WORK_DIR

#ap_cpucap name changed for checking errors
if [ -f $WORK_DIR/ap_cpucap.bin ]; then
    mv $WORK_DIR/ap_cpucap.bin $WORK_DIR/inter_ap_cpucap.bin
fi
# vehicle device zloader.bin structure
# ---------------------------------------------------------------
# |      8 KB         |        24 KB       |       8KB          |
# ---------------------------------------------------------------
# |   bootrom1.bin    |   bootrom2.bin     |   zloader3.bin     | 
# ---------------------------------------------------------------
if [ x"$DEVICE" = x"v3t" ]; then
    HASH_STR="md5"
    if [ `ls -s $WORK_DIR/zloader.bin | awk '{print $1}'` -gt 32 ]; then
        #old v3t device for vehicle
        fileread  $WORK_DIR/zloader.bin     0  8192  $WORK_DIR/bootrom1.bin
        fileread  $WORK_DIR/zloader.bin  8192 24576  $WORK_DIR/bootrom2.bin
        fileread  $WORK_DIR/zloader.bin 32768     0  $WORK_DIR/zloader3.bin
        SignImage -z -i $WORK_DIR/bootrom1.bin -k $PRIVATE_KEY -t $HASH_STR
        SignImage -z -i $WORK_DIR/bootrom2.bin -k $PRIVATE_KEY -t $HASH_STR
        SignImage -z -i $WORK_DIR/zloader3.bin -k $PRIVATE_KEY -t $HASH_STR
        cat $WORK_DIR/bootrom1.bin $WORK_DIR/bootrom2.bin $WORK_DIR/zloader3.bin > $WORK_DIR/zloader.bin
        rm -v $WORK_DIR/bootrom1.bin $WORK_DIR/bootrom2.bin $WORK_DIR/zloader3.bin
    else
        #old v3t device for mdl/mifi etc.
        SignImage -z -i $WORK_DIR/zloader.bin -k $PRIVATE_KEY -t $HASH_STR
    fi
    SignImage -z -i $WORK_DIR/tloader.bin -k $PRIVATE_KEY -t $HASH_STR
fi
echo "HASH_STR:" $HASH_STR
SignImage -r -i $WORK_DIR/uboot.bin -k $PRIVATE_KEY -t $HASH_STR

# ap_rootfs.img ap_cpuap.bin
# ---------------------------------------------------------------------------------------------------------------
# |     640 Bytes         |        640 Bytes       |      64 Bytes                |    64 Bytes                 |
# ---------------------------------------------------------------------------------------------------------------
# | ap_cpuap.bin signdata | ap_rootfs.img signdata | ap_rootfs.img mkimage header | ap_cpuap.bin mkimage header |
# ---------------------------------------------------------------------------------------------------------------
#mkimage -A arm -O linux -C none  -T filesystem -a 0 -e 0 -n 'rootfs' -d $WORK_DIR/ap_rootfs.img $WORK_DIR/ap_rootfs_u.img
fileread $WORK_DIR/ap_cpuap.bin  1280 64 $WORK_DIR/rootfs_mkimage_header.img
cat $WORK_DIR/rootfs_mkimage_header.img $WORK_DIR/ap_rootfs.img > $WORK_DIR/ap_rootfs.u
SignImage -i $WORK_DIR/ap_rootfs.u  -o $WORK_DIR/ap_rootfs.signed  -k $PRIVATE_KEY -t $HASH_STR
fileread $WORK_DIR/ap_rootfs.signed 0 704 $WORK_DIR/ap_rootfs.sign
filewrite $WORK_DIR/ap_cpuap.bin 640 $WORK_DIR/ap_rootfs.sign $WORK_DIR/ap_cpuap.bin
SignImage -r -i  $WORK_DIR/ap_cpuap.bin -k $PRIVATE_KEY -t $HASH_STR

SignImage -r -i $WORK_DIR/evb_cpurpm.img -k $PRIVATE_KEY -t $HASH_STR
SignImage -r -i $WORK_DIR/evb_cpuphy.bin -k $PRIVATE_KEY -t $HASH_STR
SignImage -r -i $WORK_DIR/inter_ap_cpucap.bin  -k $PRIVATE_KEY -t $HASH_STR

if [ -f $WORK_DIR/ap_caprootfs.img.dm ]; then
    echo "ap_caprootfs.img resign start"
    rm -rf $WORK_DIR/verity && mkdir -p $WORK_DIR/verity
    zxic_parse_squashfs_verity $WORK_DIR/ap_caprootfs.img.dm  $WORK_DIR/verity/sign $WORK_DIR/verity/raw_table $WORK_DIR/verity/hash_tree_offset
    SignImage -d -i  $WORK_DIR/verity/raw_table -o $WORK_DIR/verity/raw_table.signed  -k $PRIVATE_KEY -t $HASH_STR
    fileseek $WORK_DIR/ap_caprootfs.img $WORK_DIR/verity/sign > $WORK_DIR/verity/sign_offset
    filewrite  $WORK_DIR/ap_caprootfs.img $WORK_DIR/verity/sign_offset  $WORK_DIR/verity/raw_table.signed $WORK_DIR/ap_caprootfs.img

    #fix ap_caprootfs.img.dm
    fileseek $WORK_DIR/ap_caprootfs.img.dm $WORK_DIR/verity/sign > $WORK_DIR/verity/sign_offset
    filewrite  $WORK_DIR/ap_caprootfs.img.dm $WORK_DIR/verity/sign_offset  $WORK_DIR/verity/raw_table.signed $WORK_DIR/ap_caprootfs.img.dm

    echo "ap_caprootfs.img resign success"
fi
if [ -f $WORK_DIR/cap_oem.img.dm ]; then
    echo "cap_oem.img resign start"
    rm -rf $WORK_DIR/verity && mkdir -p $WORK_DIR/verity
    zxic_parse_squashfs_verity $WORK_DIR/cap_oem.img.dm  $WORK_DIR/verity/sign $WORK_DIR/verity/raw_table $WORK_DIR/verity/hash_tree_offset
    SignImage -d -i  $WORK_DIR/verity/raw_table -o $WORK_DIR/verity/raw_table.signed  -k $PRIVATE_KEY -t $HASH_STR
    fileseek $WORK_DIR/cap_oem.img $WORK_DIR/verity/sign > $WORK_DIR/verity/sign_offset
    filewrite  $WORK_DIR/cap_oem.img $WORK_DIR/verity/sign_offset  $WORK_DIR/verity/raw_table.signed $WORK_DIR/cap_oem.img

    #fix cap_oem.img.dm
    fileseek $WORK_DIR/cap_oem.img.dm $WORK_DIR/verity/sign > $WORK_DIR/verity/sign_offset
    filewrite  $WORK_DIR/cap_oem.img.dm $WORK_DIR/verity/sign_offset  $WORK_DIR/verity/raw_table.signed $WORK_DIR/cap_oem.img.dm
    echo "cap_oem.img resign success"
fi

mv $WORK_DIR/inter_ap_cpucap.bin $WORK_DIR/ap_cpucap.bin

rm -fv $WORK_DIR/ap_rootfs.u
rm -fv $WORK_DIR/ap_rootfs.sign
rm -fv $WORK_DIR/rootfs_mkimage_header.img
rm -fv $WORK_DIR/ap_rootfs.signed
rm -fv $WORK_DIR/ap_imagefs*.img
rm -fr $WORK_DIR/verity