initial commit

.gitignore

@@ -0,0 +1,5 @@
+*.iso
+*.crc32
+*.UPD
+*.key
+.vscode/

LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Connor Worley
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,27 @@
+SHELL=/bin/bash
+
+CDJ3Kv000.UPD: LOOP=$(shell sudo losetup -f)
+CDJ3Kv000.UPD CDJ3Kv000.UPD.crc32: CDJ3K-RK3399.iso src/* src/.*
+	genisoimage -R -J -input-charset utf-8 --graft-points -o CDJ3Kv000.UPD images/CDJ3K-RK3399.iso=CDJ3K-RK3399.iso src/* src/.*
+	isoinfo -R -l -i CDJ3Kv000.UPD
+#   Make room for LUKS header
+	dd if=/dev/zero bs=32M count=1 >> CDJ3Kv000.UPD
+	sudo losetup ${LOOP} CDJ3Kv000.UPD
+	sudo cryptsetup reencrypt \
+		--batch-mode \
+		--encrypt \
+		--reduce-device-size 32M \
+		--type luks1 \
+		--cipher aes-xts-plain64 \
+		--key-size 512 \
+		--key-file aes256.key \
+		$(LOOP) cdj_firmware
+	sudo losetup -d $(LOOP)
+#   Calculate CRC before writing magic trailer
+	./crc32.py CDJ3Kv000.UPD > CDJ3Kv000.UPD.crc32
+	echo -n -e 'XDJ-RR0.00\x00' >> CDJ3Kv000.UPD
+	cat CDJ3Kv000.UPD.crc32 >> CDJ3Kv000.UPD
+
+CDJ3K-RK3399.iso: src/* src/.*
+	genisoimage -R -J -input-charset utf-8 -o CDJ3K-RK3399.iso src/* src/.*
+	isoinfo -R -l -i CDJ3K-RK3399.iso

README.md

@@ -0,0 +1,26 @@
+# cdj3k-root
+Enable root SSH access on your CDJ-3000.
+
+## Why?
+Customers should have full access to modify their gear. Rooting your CDJ is a great way to debug errors, explore building custom software, or [play DOOM during your next set](https://x.com/_ichi_nichi_/status/1840214687696437594).
+
+## Quick guide
+> [!CAUTION]
+> This tool is experimental software with the potential to brick your CDJ. **USE AT YOUR OWN RISK**.
+
+1. [Download](https://github.com/connorworley/cdj3k-root/releases) an update file or [build one yourself](#building-from-source) and place it on a FAT32 USB drive.
+2. Copy the set of SSH public keys that you want to have root access to a file named `authorized_keys` at the root of the same USB drive. Only ECDSA keys appear to be compatible with all CDJ hardware revisions.
+3. Plug the drive into your CDJ and run the firmware update process. After the update completes, manually power cycle the CDJ. Depending on the hardware revision of your CDJ, it will automatically reboot itself or ask you to manually power cycle it two more times before booting normally. Each step of the process produces log files, so keep your USB drive connected the entire time in case something goes wrong.
+4. Your CDJ is rooted!
+
+## Unrooting
+SSH into your CDJ and run `~/.unroot.sh`. Depending on the hardware revision of your CDJ, it will automatically reboot itself or ask you to manually power cycle it.
+
+## Building from source
+To build from source, you will need to acquire a valid firmware encryption key. Instructions to do this are not provided here. Once you have the key, save it to `aes256.key` in the repo root and run `make` to build a new update file.
+
+## License
+cdj3k-root uses the MIT License. The project contains no Pioneer DJ/AlphaTheta code.
+
+## Contact
+[DM me](https://x.com/_ichi_nichi_). If this project gains enough traction I may set up a Discord server.

crc32.py

@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+import sys
+from zlib import crc32
+
+with open(sys.argv[1], 'rb') as f:
+    crc = crc32(f.read())
+    print(f'crc: {crc:x}', file=sys.stderr)
+    sys.stdout.buffer.write(crc.to_bytes(4, 'little'))

src/.unroot.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euTo pipefail
+
+UPDATE_MEDIA_DEVICE=
+UPDATE_MEDIA_MOUNTPOINT=
+
+while read -r MOUNT; do
+    DEVICE=$(echo "$MOUNT" | cut -d' ' -f1)
+    MOUNTPOINT=$(echo "$MOUNT" | cut -d' ' -f2)
+    if [[ -e $MOUNTPOINT/CDJ3Kv000.UPD ]]; then
+        UPDATE_MEDIA_DEVICE=$DEVICE
+        UPDATE_MEDIA_MOUNTPOINT=$MOUNTPOINT
+        break
+    fi
+done < /proc/mounts
+
+if [[ -n $UPDATE_MEDIA_DEVICE ]]; then
+    mount -o remount,rw "$UPDATE_MEDIA_DEVICE" "$UPDATE_MEDIA_MOUNTPOINT"
+
+    SCRIPT_NAME=$(basename "$0")
+    exec >"$UPDATE_MEDIA_MOUNTPOINT"/"$SCRIPT_NAME".log
+    exec 2>&1
+
+    trap 'printf "[%s] %s: %s\n" "$(cut -d" " -f1 /proc/uptime)" "$SCRIPT_NAME" "${BASH_COMMAND:-}" 1>&2' DEBUG
+fi
+
+rm /mnt/pdj.tar.gz
+
+if [[ -b /dev/mmcblk1p8 ]]; then
+    # Rockchip model
+    systemctl reboot
+    exit 0
+fi
+
+systemctl disable xserver-nodm
+systemctl stop xserver-nodm
+echo 1 > /sys/class/vtconsole/vtcon1/bind
+openvt -s -- echo '*** Unroot complete. Please manually power cycle your CDJ. ***'
+sleep 30d

src/payload.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl start sshd.socket
+systemctl start dropbear

src/phase1.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euTo pipefail
+
+shopt -s extglob
+shopt -s nullglob
+
+UPDATE_MEDIA_DEVICE=
+UPDATE_MEDIA_MOUNTPOINT=
+
+while read -r MOUNT; do
+    DEVICE=$(echo "$MOUNT" | cut -d' ' -f1)
+    MOUNTPOINT=$(echo "$MOUNT" | cut -d' ' -f2)
+    if [[ -e $MOUNTPOINT/CDJ3Kv000.UPD ]]; then
+        UPDATE_MEDIA_DEVICE=$DEVICE
+        UPDATE_MEDIA_MOUNTPOINT=$MOUNTPOINT
+        break
+    fi
+done < /proc/mounts
+
+if [[ -n $UPDATE_MEDIA_DEVICE ]]; then
+    mount -o remount,rw "$UPDATE_MEDIA_DEVICE" "$UPDATE_MEDIA_MOUNTPOINT"
+
+    SCRIPT_NAME=$(basename "$0")
+    exec >"$UPDATE_MEDIA_MOUNTPOINT"/"$SCRIPT_NAME".log
+    exec 2>&1
+
+    trap 'printf "[%s] %s: %s\n" "$(cut -d" " -f1 /proc/uptime)" "$SCRIPT_NAME" "${BASH_COMMAND:-}" 1>&2' DEBUG
+fi
+
+OVERLAY_MEDIA_MOUNTPOINT=/mnt
+
+PDJ_TAR_WORKDIR=$(mktemp -d)
+tar -xvzf "$OVERLAY_MEDIA_MOUNTPOINT"/pdj.tar.gz -C "$PDJ_TAR_WORKDIR"
+
+rm "$PDJ_TAR_WORKDIR"/scripts/apl_start.sh
+
+APP_ORIGINAL=(/home/root/pdj/EP+([[:digit:]]))
+APP="$PDJ_TAR_WORKDIR"/pdj/$(basename "${APP_ORIGINAL[0]}")
+mkdir -p "$(dirname "$APP")"
+mv "$PDJ_TAR_WORKDIR"/phase2.sh "$APP"
+
+tar -cvzf "$OVERLAY_MEDIA_MOUNTPOINT"/pdj.tar.gz -C "$PDJ_TAR_WORKDIR" .
+
+if [[ -b /dev/mmcblk1p8 ]]; then
+    # Rockchip model
+    systemctl reboot
+    exit 0
+fi
+
+systemctl disable xserver-nodm
+systemctl stop xserver-nodm
+echo 1 > /sys/class/vtconsole/vtcon1/bind
+openvt -s -- echo '*** Phase 1 of 2 complete. Please manually power cycle your CDJ. ***'
+sleep 30d

src/phase2.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+set -euTo pipefail
+
+UPDATE_MEDIA_DEVICE=
+UPDATE_MEDIA_MOUNTPOINT=
+
+while read -r MOUNT; do
+    DEVICE=$(echo "$MOUNT" | cut -d' ' -f1)
+    MOUNTPOINT=$(echo "$MOUNT" | cut -d' ' -f2)
+    if [[ -e $MOUNTPOINT/CDJ3Kv000.UPD ]]; then
+        UPDATE_MEDIA_DEVICE=$DEVICE
+        UPDATE_MEDIA_MOUNTPOINT=$MOUNTPOINT
+        break
+    fi
+done < /proc/mounts
+
+if [[ -n $UPDATE_MEDIA_DEVICE ]]; then
+    mount -o remount,rw "$UPDATE_MEDIA_DEVICE" "$UPDATE_MEDIA_MOUNTPOINT"
+
+    SCRIPT_NAME=$(basename "$0")
+    exec >"$UPDATE_MEDIA_MOUNTPOINT"/"$SCRIPT_NAME".log
+    exec 2>&1
+
+    trap 'printf "[%s] %s: %s\n" "$(cut -d" " -f1 /proc/uptime)" "$SCRIPT_NAME" "${BASH_COMMAND:-}" 1>&2' DEBUG
+fi
+
+OVERLAY_MEDIA_MOUNTPOINT=/mnt
+
+PDJ_TAR_WORKDIR=$(mktemp -d)
+tar -xvzf "$OVERLAY_MEDIA_MOUNTPOINT"/pdj.tar.gz -C "$PDJ_TAR_WORKDIR"
+
+rm -r "$PDJ_TAR_WORKDIR"/pdj
+
+APL_START=$PDJ_TAR_WORKDIR/scripts/apl_start.sh
+mkdir -p "$(dirname "$APL_START")"
+mv "$PDJ_TAR_WORKDIR"/payload.sh "$APL_START"
+cat /home/root/scripts/apl_start.sh >> "$APL_START"
+
+tar -cvzf "$OVERLAY_MEDIA_MOUNTPOINT"/pdj.tar.gz -C "$PDJ_TAR_WORKDIR" .
+
+
+if [[ -b /dev/mmcblk1p8 ]]; then
+    # Rockchip model
+    systemctl reboot
+    exit 0
+fi
+
+systemctl disable xserver-nodm
+systemctl stop xserver-nodm
+echo 1 > /sys/class/vtconsole/vtcon1/bind
+openvt -s -- echo '*** Phase 2 of 2 complete. Please manually power cycle your CDJ. ***'
+sleep 30d

src/usb_update.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+set -euTo pipefail
+
+UPDATE_MEDIA_DEVICE=
+UPDATE_MEDIA_MOUNTPOINT=
+
+while read -r MOUNT; do
+    DEVICE=$(echo "$MOUNT" | cut -d' ' -f1)
+    MOUNTPOINT=$(echo "$MOUNT" | cut -d' ' -f2)
+    if [[ -e $MOUNTPOINT/CDJ3Kv000.UPD ]]; then
+        UPDATE_MEDIA_DEVICE=$DEVICE
+        UPDATE_MEDIA_MOUNTPOINT=$MOUNTPOINT
+        break
+    fi
+done < /proc/mounts
+
+if [[ -z $UPDATE_MEDIA_DEVICE ]]; then
+    echo "Couldn't locate update media"
+    exit 1
+fi
+
+mount -o remount,rw "$UPDATE_MEDIA_DEVICE" "$UPDATE_MEDIA_MOUNTPOINT"
+
+SCRIPT_NAME=$(basename "$0")
+exec >"$UPDATE_MEDIA_MOUNTPOINT"/"$SCRIPT_NAME".log
+exec 2>&1
+
+trap 'printf "[%s] %s: %s\n" "$(cut -d" " -f1 /proc/uptime)" "$SCRIPT_NAME" "${BASH_COMMAND:-}" 1>&2' DEBUG
+
+ISO_MOUNTPOINT=$1
+LANGUAGE=$2
+
+function safe_cp() {
+    SRC=$1
+    DST=$2
+
+    mkdir -p "$(dirname "$DST")"
+    cp "$SRC" "$DST"
+}
+
+function install_phase1() {
+    OVERLAY_MEDIA=$1
+
+    OVERLAY_MEDIA_MOUNTPOINT=$(mktemp -d)
+    ls "$OVERLAY_MEDIA_MOUNTPOINT"
+    mount -o rw "$OVERLAY_MEDIA" "$OVERLAY_MEDIA_MOUNTPOINT"
+
+    PDJ_TAR_WORKDIR=$(mktemp -d)
+
+    safe_cp $"$ISO_MOUNTPOINT"/phase1.sh  "$PDJ_TAR_WORKDIR"/scripts/apl_start.sh
+    safe_cp $"$ISO_MOUNTPOINT"/phase2.sh  "$PDJ_TAR_WORKDIR"/phase2.sh
+    safe_cp $"$ISO_MOUNTPOINT"/payload.sh "$PDJ_TAR_WORKDIR"/payload.sh
+    safe_cp $"$ISO_MOUNTPOINT"/.unroot.sh "$PDJ_TAR_WORKDIR"/.unroot.sh
+
+    safe_cp $"$UPDATE_MEDIA_MOUNTPOINT"/authorized_keys "$PDJ_TAR_WORKDIR"/.ssh/authorized_keys
+
+    tar -cvzf "$OVERLAY_MEDIA_MOUNTPOINT"/pdj.tar.gz -C "$PDJ_TAR_WORKDIR" .
+    umount "$OVERLAY_MEDIA_MOUNTPOINT"
+}
+
+if [[ -b /dev/mmcblk0p5 ]]; then
+    # Renesas model
+    install_phase1 /dev/mmcblk0p5
+    gui_image D007 "$LANGUAGE" "" >/dev/null 2>&1
+elif [[ -b /dev/mmcblk1p8 ]]; then
+    # Rockchip model
+    install_phase1 /dev/mmcblk1p8
+    pkill gui_image
+    gui_image D007 "$LANGUAGE" >/dev/null 2>&1 &
+else
+    echo "Unknown MMC partition layout"
+    exit 1
+fi