Pi4 / Pi5 EEPROM tools

Created for use by info-beamer hosted: They allow you to modify the pieeprom EEPROM images used for the Pi4 and Pi5. You can inspect those EEPROM files and modify some of their content for fun and profit :)

Somewhat based on https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-config

Usage:

Fetch one of the EEPROM files from the firmware repository:

$ wget https://github.com/raspberrypi/rpi-eeprom/raw/master/firmware-2711/latest/pieeprom-2023-05-11.bin -o pieeprom.bin

Inspecting an EEPROM file

$ ./pi-eeprom-ls pieeprom.bin
eeprom version: 4fd8f1f3, 2023-05-11 (pi4)
-----------------------------------
<ChunkBoot: <bootsys>         60424 @ 0x00000000 /      0>
<ChunkFile: bootmain         226258 @ 0x0000ec20 /  60448>
<ChunkFile: memsys00.bin      14328 @ 0x00047000 / 290816>
<ChunkFile: memsys01.bin      12946 @ 0x0004a810 / 305168>
<ChunkFile: memsys02.bin      11918 @ 0x0004dac0 / 318144>
<ChunkFile: memsys03.bin      11650 @ 0x00050968 / 330088>
<ChunkFile: memsys04.bin      13659 @ 0x00053708 / 341768>
<ChunkFile: memsys05.bin      13914 @ 0x00056c80 / 355456>
<ChunkFile: memsys06.bin      13005 @ 0x0005a2f8 / 369400>
<ChunkFile: memsys07.bin      13533 @ 0x0005d5e0 / 382432>
<ChunkFile: memsys08.bin      12596 @ 0x00060ad8 / 395992>
<ChunkFile: mcb.bin            4157 @ 0x00063c28 / 408616>
<ChunkFile: vl805hub.bin       7012 @ 0x00064c80 / 412800>
<ChunkFile: vl805mcu.bin      60435 @ 0x00066800 / 419840>
<ChunkFile: logo.bin           2410 @ 0x00075430 / 480304>
<ChunkFile: font.bin           8803 @ 0x00075db8 / 482744>
<ChunkFile: qrcode.bin         1586 @ 0x00078038 / 491576>
<ChunkConf: pubkey.bin         1024 @ 0x00079000 / 495616>
<ChunkConf: bootconf.sig       1024 @ 0x0007a000 / 499712>
<ChunkConf: bootconf.txt         54 @ 0x0007b000 / 503808>
-[ bootconf.txt ]------------------
[all]
BOOT_UART=0
WAKE_ON_GPIO=1
POWER_OFF_ON_HALT=0


-[ bootconf.sig ]------------------
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
-[ pubkey.bin ]--------------------
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Extracting EEPROM content

You can extract and decompress the files within an EEPROM image into individual files:

$ mkdir pieeprom
$ ./pi-eeprom-extract pieeprom.bin pieeprom
$ ls -l pieeprom
total 720
-rw-rw-r-- 1 dividuum dividuum  60424 Nov 10 15:29 boot
-rw-rw-r-- 1 dividuum dividuum   1024 Nov 10 15:29 bootconf.sig
-rw-rw-r-- 1 dividuum dividuum     54 Nov 10 15:29 bootconf.txt
-rw-rw-r-- 1 dividuum dividuum 244964 Nov 10 15:29 bootmain
-rw-rw-r-- 1 dividuum dividuum  27404 Nov 10 15:29 font.bin
-rw-rw-r-- 1 dividuum dividuum  12844 Nov 10 15:29 logo.bin
-rw-rw-r-- 1 dividuum dividuum   5440 Nov 10 15:29 mcb.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys00.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys01.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys02.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys03.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys04.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys05.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys06.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys07.bin
-rw-rw-r-- 1 dividuum dividuum  20492 Nov 10 15:29 memsys08.bin
-rw-rw-r-- 1 dividuum dividuum   1024 Nov 10 15:29 pubkey.bin
-rw-rw-r-- 1 dividuum dividuum  40044 Nov 10 15:29 qrcode.bin
-rw-rw-r-- 1 dividuum dividuum   9446 Nov 10 15:29 vl805hub.bin
-rw-rw-r-- 1 dividuum dividuum  86680 Nov 10 15:29 vl805mcu.bin

$ file pieeprom/bootmain 
pieeprom/bootmain: ELF 32-bit LSB executable, Broadcom VideoCore III, version 1 (SYSV), statically linked, stripped

$ gimp pieeprom/logo.bin

Rewriting bootconf.txt

This can be used to create files needed for the update process (see here):

$ ./pi-eeprom-update pieeprom.bin updated.bin updated.sig updated.ver

This will create three new files. updated.bin contains the modified EEPROM, updated.sig is a signature file and updated.ver contains the version number of the EEPROM.

Use

$ ./pi-eeprom-ls updated.bin 

to confirm that these changes are have been made.

Recompressing the firmware files

Not sure why you would do that, but it here it is. Be sure to run make first so compress.so gets built. Otherwise the compression is shit:

$ make
gcc compress.c -O3 -shared -o compress.so
$ ./pi-eeprom-recompress pieeprom.bin updated.bin

$ ./pi-eeprom-ls pieeprom.bin |grep bootmain
<ChunkFile: bootmain         226258 @ 0x0000ec20 /  60448>

$ ./pi-eeprom-ls updated.bin |grep bootmain
<ChunkFile: bootmain         223675 @ 0x0000ec20 /  60448>