NetBoot/bbraun-pram/NBPRAM.c

/*
 * Initialize netboot pram
 * - Rob Braun <bbraun@synack.net>
 * 2012
 */

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <Traps.h>

void get_netboot_pram(struct netboot *nb);
void set_netboot_pram(struct netboot *nb);

#pragma parameter __D0 ReadXPRam(__D0, __D1, __A0)
short ReadXPRam(short size, short offset, char *where) = {0x4840, 0x3001, _ReadXPRam};
#pragma parameter __D0 WriteXPRam(__D0, __D1, __A0)
short WriteXPRam(short size, short offset, char *where) = {0x4840, 0x3001, _WriteXPRam};

struct netboot {
	char machineID; /* this is used as part of the boot protocol */
	char protocol;
	char errors;
	char flags; /* Used to enable netbooting, and allow guest netbooting */
	char intervalCount; /* high nibble is the retry count, low nibble is the interval between retries */
	char timeout;
	unsigned long signature[4];
	char userName[31];
	char password[8];
	short serverID; /* the value here will be translated to ascii encoded hex and used as the server name to boot from. */
	
	char padding[7];
};

void get_netboot_pram(struct netboot *nb) {
	char *i = (char*)nb;
	
	ReadXPRam(4, 4, i);
	i += 4;
	ReadXPRam(3, 0xAB, i);
	i += 3;
	ReadXPRam(1, 0xBC, i);
	i++;
	ReadXPRam(0x20, 0x20, i);
	i += 0x20;
	ReadXPRam(0x20, 0x8B, i);
	return;
}

void set_netboot_pram(struct netboot *nb) {
	char *i = (char*)nb;
	
	WriteXPRam(4, 4, i);
	i += 4;
	WriteXPRam(3, 0xAB, i);
	i += 3;
	WriteXPRam(1, 0xBC, i);
	i++;
	WriteXPRam(0x20, 0x20, i);
	i += 0x20;
	WriteXPRam(0x20, 0x8B, i);
	return;
}


void main(void)
{
	struct netboot nb;
	char *i;
	int n;
	
	memset(&nb, 0, sizeof(nb));
	get_netboot_pram(&nb);
	for(i = (char*)&nb, n = 0; n < sizeof(nb); n++) {
		printf("0x%x ", i[n]);
	}
	printf("\n");

#if 1
	memset(&nb, 0, sizeof(nb));
	nb.machineID = 1;
	nb.protocol = 1;
	nb.errors = 0;
	nb.flags = 0xC0;
	nb.intervalCount = 0x24; /* low nibble is interval, high nibble is count for lookups */
	nb.timeout = 127;
	nb.signature[0] = 'PWD ';
	//nb.userName[0] = '\0';
	strcpy(nb.userName, "bbraun");
	nb.password[0] = '\0';
	nb.serverID = 0xEBAB;
	
	set_netboot_pram(&nb);
#endif
}