Skip to content

Latest commit

 

History

History
100 lines (63 loc) · 5.08 KB

pad.md

File metadata and controls

100 lines (63 loc) · 5.08 KB

Padstack (*.pad)

Looks like the file is mostly structured as a list of identifiers (increased one by one) with its trailing information. The information itself is then zero padded to 4 byte boundaries.

Official Documentation

Not everything needs to reverse engineered, some information is already available after installing Allegro.

Example *.pad files:

  • C:\Cadence\SPB_17.4\share\pcb\pcb_lib\symbols

Example *.pxml files:

  • C:\Cadence\SPB_17.4\share\pcb\examples\padstack_xml

Description of *.pxml content/structure:

  • C:\Cadence\SPB_17.4\share\pcb\xml-formats\cdn_padstack.dtd
  • C:\Cadence\SPB_17.4\share\pcb\xml-formats\cdn_padstack_multi.dtd
  • C:\Cadence\SPB_17.4\share\pcb\examples\padstack_xml\padstack_xml.docx

Documentation for padstack_editor.exe (previously called pad_designer.exe)

  • C:\Cadence\SPB_17.4\share\pcb\batchhelp\pad_designer.txt
  • C:\Cadence\SPB_17.4\share\pcb\examples\padstack_xml\padstack_xml.docx

Automation

Padstack Editor allows XML import/export of the padstack as a *.pxml file.

It's possible to record scripts (*.scr) for automated file generation.

Temporary ZIP File while Saving Padstacks

When saving a padstack Padstack Editor creates a temporary file like %USERPROFILE%\AppData\Local\Temp\#Taaaaaa00765.tmp. The file name will probably be slightly different as the name is always adjusted to prevent name collisions. Further, the number at the end of the name is the zero padded process ID (PID) of Padstack Editor, in this example 765.

Process Monitor can be used to investigate operating system calls of Padstack Editor. It shows that Padstack Editor starts cdsZip.exe and writes the temporary file #Taaaaaa00765.tmp.

Because the *.tmp file is directly deleted after the *.pad file was written, it is not possible to view it directly. However, it's possible to recover it with e.g. Recuva directly after the write process.

Running the file command on the temporary shows us that it's actually a ZIP file what explains why cdsZip.exe was called.

file \#Taaaaaa00765.tmp
#Taaaaaa00765.tmp: Zip archive data, at least v2.0 to extract

Trying to open it with Padstack Editor after renaming it to *.pad results in the following error, that suggests that padstacks were saved as ZIP files in older file format versions.

ERROR(SPMHOD-19): Padstack revision is too old to open directly, use dbdoctor to uprev it.

Using allegro_uprev on it might upgrade the file to the current file format version.

Though the file is recognized as a ZIP file it can not be opened directly as the last data block in the file does not contain any information but rather all 0's. We can still recover the incomplete file with the following command.

zip -FF \#Taaaaaa00765.tmp --out recovered_zip
# Confirm 'Is this a single-disk archive?' with 'Y'.
unzip recovered_zip.zip

Alternatively ezyZip and extract.me are free online extractors that can cope with the incomplete ZIP archive.

Taking a look at the extracted file #Taaaaaa00765.tmp we see that it's a JSON file containing padstack information in a human-readable way.

Note that the JSON implementation has some flaws. The following simplified example shows the issue. Observe that property subclass_name is assigned a string followed by a comma. This comma must only be used when there is some data following. In this case it's a syntax error that a few JSON parsers struggle with. Either find one, that accepts this comma or preprocess the JSON first and remove illegal commas.

"padDesign" : {
	"pad" : [
	{
		"shape" : "Circle",
		"subclass_name" : "BEGIN LAYER",
	}
	]
}

File Structure

Previously we saw that Padstack Editor saves some ZIP file before the *.pad file is generated. Actually the ZIP file is stored inside the binary *.pad file. Fortunately the temporary ZIP file is just incomplete and the all 0 block at the end of the archive is filled with legit information now. This means we can extract the ZIP from the *.pad by using the following command, where skip specifies the hexadecimal offset and count the hexadecimal byte length of the ZIP file. The beginning of the ZIP can be easily found by its magic byte PK\x03\x04 sequence.

dd if=my_pad.pad bs=1 status=none skip=$((0xabc)) count=$((0x123)) of=my_pad.zip

The ZIP can now be opened with any standard archive viewer and the JSON file can be extracted. It makes probably sense to rename the extracted #Taaaaaa00765.tmp to my_pad.json.

The following regular expression will match the temporary files.

#T[a-z]{6}\d{5}\.tmp

Note that the temporary ZIP file and the actual ZIP inside the *.pad have the exact same byte length.

Looks like the JSON files exist only in newer file format versions. However opening an old file with a "new" Allegro version will integrate the JSON into the file.