added imagetool utility to just do png<->img conversions

includes/xpwn/ibootim.h

@@ -38,6 +38,7 @@ extern "C" {
 	AbstractFile* createAbstractFileFromIBootIM(AbstractFile* file);
 	AbstractFile* duplicateIBootIMFile(AbstractFile* file, AbstractFile* backing);
 	void* replaceBootImage(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, AbstractFile* png, size_t *fileSize);
+	int convertToPNG(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, const char* png);
 #ifdef __cplusplus
 }
 #endif

ipsw-patch/CMakeLists.txt

@@ -64,6 +64,9 @@ target_link_libraries(ipsw xpwn)
 add_executable(xpwntool xpwntool.c)
 target_link_libraries(xpwntool xpwn)
 
+add_executable(imagetool imagetool.c)
+target_link_libraries(imagetool xpwn)
+
 IF(WIN32)
 	ADD_EXECUTABLE(itunespwn itunespwn.c)
 	TARGET_LINK_LIBRARIES(itunespwn xpwn gdi32)

ipsw-patch/ibootim.c

@@ -194,6 +194,69 @@ void pngError(png_structp png_ptr, png_const_charp error_msg) {
 	exit(0);
 }
 
+int convertToPNG(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, const char* png) {
+	AbstractFile* imageFile;
+
+	FILE *fp = fopen(png, "wb");
+	if(!fp)
+		return -1;
+
+	if(key != NULL) {
+		imageFile = openAbstractFile2(imageWrapper, key, iv);
+	} else {	
+		imageFile = openAbstractFile(imageWrapper);
+	}
+	InfoIBootIM* info = (InfoIBootIM*) (imageFile->data);
+
+	png_structp png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, NULL, pngError, pngError);
+	if (!png_ptr) {
+		return -1;
+	}
+
+	png_infop info_ptr = png_create_info_struct(png_ptr);
+	if (!info_ptr)
+	{
+		png_destroy_read_struct(&png_ptr, (png_infopp)NULL, (png_infopp)NULL);
+		return -1;
+	}
+
+	png_init_io(png_ptr, fp);
+
+	int color_type;
+	int bytes_per_pixel;
+
+	if(info->header.format == IBOOTIM_ARGB) {
+		color_type = PNG_COLOR_TYPE_RGB_ALPHA;
+		bytes_per_pixel = 4;
+	} else if(info->header.format == IBOOTIM_GREY) {
+		color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
+		bytes_per_pixel = 2;
+	}
+
+	png_set_IHDR(png_ptr, info_ptr, info->header.width, info->header.height,
+		     8, color_type, PNG_INTERLACE_NONE,
+		     PNG_COMPRESSION_TYPE_DEFAULT, PNG_FILTER_TYPE_DEFAULT);
+
+	png_set_bgr(png_ptr);
+	png_set_invert_alpha(png_ptr);
+
+	png_write_info(png_ptr, info_ptr);
+
+
+	void* imageBuffer = malloc(imageFile->getLength(imageFile));
+	imageFile->read(imageFile, imageBuffer, imageFile->getLength(imageFile));
+
+	png_bytepp row_pointers = (png_bytepp) malloc(sizeof(png_bytep) * info->header.height);
+	int i;
+	for(i = 0; i < info_ptr->height; i++) {
+		row_pointers[i] = imageBuffer + (info->header.width * bytes_per_pixel * i);
+	}
+
+	png_write_image(png_ptr, row_pointers);
+
+	png_write_end(png_ptr, NULL);
+}
+
 void* replaceBootImage(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, AbstractFile* png, size_t *fileSize) {
 	AbstractFile* imageFile;
 	unsigned char header[8];

ipsw-patch/imagetool.c

@@ -0,0 +1,82 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <xpwn/libxpwn.h>
+#include "abstractfile.h"
+#include <xpwn/nor_files.h>
+#include <xpwn/ibootim.h>
+#include <string.h>
+
+void print_usage() {
+	XLOG(0, "usage:\timagetool extract <source.img2/3> <destination.png> [iv] [key]");
+	XLOG(0, "usage:\timagetool inject <source.png> <destination.img2/3> <template.img2/3> [iv] [key]");
+}
+
+int main(int argc, char* argv[]) {
+	init_libxpwn();
+	
+	if(argc < 4) {
+		print_usage();
+		return 0;
+	}
+
+	AbstractFile* png;
+	AbstractFile* img;
+	AbstractFile* dst;
+	void* imageBuffer;
+	size_t imageSize;
+
+	unsigned int key[16];
+	unsigned int iv[16];
+	unsigned int* pKey = NULL;
+	unsigned int* pIV = NULL;
+
+	if(strcmp(argv[1], "inject") == 0) {
+		if(argc < 5) {
+			print_usage();
+			return 0;
+		}
+
+		png = createAbstractFileFromFile(fopen(argv[2], "rb"));
+		img = createAbstractFileFromFile(fopen(argv[4], "rb"));
+		dst = createAbstractFileFromFile(fopen(argv[3], "wb"));
+
+		if(argc >= 7) {
+			sscanf(argv[5], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x",
+				&iv[0], &iv[1], &iv[2], &iv[3], &iv[4], &iv[5], &iv[6], &iv[7], &iv[8],
+				&iv[9], &iv[10], &iv[11], &iv[12], &iv[13], &iv[14], &iv[15]);
+
+			sscanf(argv[6], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x",
+				&key[0], &key[1], &key[2], &key[3], &key[4], &key[5], &key[6], &key[7], &key[8],
+				&key[9], &key[10], &key[11], &key[12], &key[13], &key[14], &key[15]);
+
+			pKey = key;
+			pIV = iv;
+		}
+
+		imageBuffer = replaceBootImage(img, pKey, pIV, png, &imageSize);
+		dst->write(dst, imageBuffer, imageSize);
+		dst->close(dst);
+	} else if(strcmp(argv[1], "extract") == 0) {
+		img = createAbstractFileFromFile(fopen(argv[2], "rb"));
+
+		if(argc >= 6) {
+			sscanf(argv[4], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x",
+				&iv[0], &iv[1], &iv[2], &iv[3], &iv[4], &iv[5], &iv[6], &iv[7], &iv[8],
+				&iv[9], &iv[10], &iv[11], &iv[12], &iv[13], &iv[14], &iv[15]);
+
+			sscanf(argv[5], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x",
+				&key[0], &key[1], &key[2], &key[3], &key[4], &key[5], &key[6], &key[7], &key[8],
+				&key[9], &key[10], &key[11], &key[12], &key[13], &key[14], &key[15]);
+
+			pKey = key;
+			pIV = iv;
+		}
+
+		if(convertToPNG(img, pKey, pIV, argv[3]) < 0) {
+			XLOG(1, "error converting img to png");
+		}
+	}
+
+	return 0;
+}
+