| 00:19.10 | hno | toxicpsion, still around? |
| 00:27.21 | toxicpsion | sorta. |
| 00:28.36 | hno | in your unpacked firmware, do you have some FES* files? |
| 00:28.48 | toxicpsion | yup. |
| 00:30.11 | hno | Do they make any sense to you? These should be the USB Fel bootloader. |
| 00:30.19 | toxicpsion | FES _FES_000000000000, FES _FES_200000000000, FES _FES_1-1000000000, FES _FES_1-2000000000 |
| 00:32.28 | hno | The numbered ones looks like they are different stages of boot0. |
| 00:32.49 | toxicpsion | the only one with any size is FES _FES_000000000000 |
| 00:32.53 | hno | and the big unumbered one is most likely the actual loader, but is encrypted somehow. |
| 00:33.48 | hno | what is the md5 of _FES_1-1? |
| 00:34.37 | toxicpsion | 9482f78f1bc092df3c604f58d6165a33 |
| 00:35.10 | hno | hm.. differenf than any of the ones I have. Can you upload them somewhere? |
| 00:35.40 | toxicpsion | it's 680 bytes |
| 00:36.02 | hno | yes, or mail them if you like. |
| 00:36.17 | toxicpsion | dcc? |
| 00:36.27 | hno | can't do. |
| 00:39.15 | toxicpsion | 'sc. |
| 00:39.18 | toxicpsion | sec* |
| 00:41.32 | toxicpsion | http://www.mediafire.com/?adpul6t2agc98g4,ej65qeeko0qaydb,djdh5tirma2g66r,9t4e2ao6fe2uubc,mx9p6amnr5w5vbh,1svfaz9zhvdhskr,drvb423i5rn53pv,8m3f1np734qzy27 |
| 00:43.24 | hno | thanks |
| 00:43.32 | toxicpsion | np |
| 00:46.14 | hno | which firmware is these from? |
| 00:46.18 | toxicpsion | i imagine it's encrypted with some twofish variant. at least from code ive come across elsewhere. |
| 00:46.37 | hno | the firmware image is indeed. |
| 00:47.09 | hno | but not sure about these. |
| 00:48.05 | menomc | toxicpsion: can you add a tar file including them all? :) for those without a mediafire premium account |
| 00:49.00 | toxicpsion | just FES or want anything else? |
| 00:49.55 | menomc | the more the better :) |
| 00:50.23 | menomc | but FES is good |
| 00:51.23 | toxicpsion | everything but RFSFAT16_* -> work.tar.gz |
| 00:51.56 | toxicpsion | being on gsm, i'm tryin to keep size down :/ |
| 00:52.59 | hno | There is a bunch of these in the Novo SDK as well. |
| 00:53.07 | toxicpsion | hno: it's from a Ly-F1 firmware that crashes less than g2 stock |
| 00:53.20 | toxicpsion | sec. gotta go find what one |
| 00:53.36 | toxicpsion | hno: lyf1-2.3.4-20120209-0.7.1-a721.img |
| 00:53.52 | menomc | uh, then don't worry... I won't look at it today |
| 00:57.38 | toxicpsion | so far have replaced the kernel with on i build from the .config i got from extract-ikconfig on stock G2 rom, and some cleanups.. this ly rom is the only one i've seen so far that has a cramfs oem partition in nand. |
| 00:58.02 | toxicpsion | but it does repack and flash... so so far so good. |
| 00:58.46 | zenitraM | mmm i have a few unpacked ICS firmwares around here |
| 00:59.26 | zenitraM | fc40a3958e3e9ba169eb4ac9516c8c4b FES _FES_000000000000 |
| 00:59.27 | zenitraM | edc9c36d9981bb55211864223f259dd8 FES _FES_000000000000 |
| 00:59.37 | hno | fes_1-1 and fes_2 is identical to what is in the Novo 7 SDK. fes_2 differs but so does it in the 5 copies in the SDK as well. |
| 00:59.47 | toxicpsion | i did manage to get u-boot into fastboot mode, recompiling it with FASTBOOT boot argument, and ignoring env , but was no good to me from there |
| 01:00.17 | hno | and there is one copy in the sdk that differs a lot from the other. |
| 01:00.43 | toxicpsion | which one? |
| 01:01.06 | hno | novo7_2.3.4/lichee/buildroot/boot/u-boot/eFEX/ |
| 01:02.31 | hno | seems to be from someone trying to reverse the boot process to fit u-boot there. There is some broken memory dumps and other stuff as well there. |
| 01:07.54 | hno | fes_1-2 differs, not fes_2 |
| 01:12.14 | toxicpsion | you still happen to have a link to where that SDK came from? mine is missing the entire buildroot forlder... or am i just missing something> |
| 01:13.02 | hno | not sure. |
| 01:14.30 | zenitraM | i have it, lichee.tar.gz |
| 01:14.53 | hno | only 600MB that one. |
| 01:15.12 | hno | whole SDK archive was 1.8G |
| 01:15.54 | hno | android2.3.4 1Gbyte |
| 01:16.12 | hno | lichee.tar.gz 600Mbyte |
| 01:16.35 | hno | crane_sdk_docs.tar.gz 14Mbyte |
| 01:16.48 | toxicpsion | translating that one was fun :P |
| 01:17.15 | hno | tools.tar.gz 142Mbyte |
| 01:18.07 | hno | a matter of definition of fun.. |
| 01:18.54 | toxicpsion | mind numbing? |
| 01:19.35 | toxicpsion | so PhoenixUsb uses a .key file for what? |
| 01:19.57 | toxicpsion | when Livesuit doesn't need one? or is it just coded into livesuit? |
| 01:19.58 | hno | translating the text files using the wrong chineese charset using google translate was very funny. |
| 01:20.07 | toxicpsion | i bet. |
| 01:22.25 | zenitraM | there's some funny stuff going inside livesuit/phoenix indeed |
| 01:22.34 | zenitraM | zenitram@atomico:~/ainol/dumps/novo7a_ics_0.4_preview.img.dump$ file PXTOOLS\ _xxxxxxxxxxxxxxxx |
| 01:22.34 | zenitraM | PXTOOLS _xxxxxxxxxxxxxxxx: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
| 01:23.07 | zenitraM | anyone up for infected firmwares? lol |
| 01:23.19 | toxicpsion | :| |
| 01:24.49 | zenitraM | PANIC : dev_manager_open_fel_dev() : input == NULL |
| 01:24.49 | zenitraM | PANIC : DeviceOpenMode = %x not support |
| 01:24.49 | zenitraM | PANIC : dev_manager_open_fel_dev() : can not open fel dev |
| 01:24.49 | zenitraM | PANIC : dev_manager_open_fel_dev() : priv_info == NULL |
| 01:24.53 | zenitraM | strings inside that dll |
| 01:25.05 | zenitraM | looks.. useful. |
| 01:26.21 | hno | zenitraM, yes, it's the "fel" DLL which talks to the devicen AND interacts with the uploaded code. |
| 01:27.33 | hno | have a bunch of those "firmware" DLLs in the SDK. |
| 01:28.12 | zenitraM | oh well.. china. |
| 01:28.20 | zenitraM | gonna sleep, cya tomorrow |
| 01:38.16 | hno | The fes files looks scrambled, not encrypted. Probably xor + rot. |
| 01:43.16 | hno | 00 02 08 0A 0B 0E 10 12 is most likely 00 01 02 03 04 05 06 07 |
| 01:44.13 | hno | and fes_1-[1/2] may be plain even. |
| 02:00.38 | hno | yes, fes_1-* is plain executable arm code. |
| 04:34.38 | *** join/#arm-netbook hipboi (~hipboi@123.89.254.8) |
| 05:43.12 | *** join/#arm-netbook toxicpsion (~toxicpsio@out-ab-215.wireless.telus.com) |
| 06:07.40 | *** join/#arm-netbook eflatun (~eflatun@109.228.222.95) |
| 06:16.57 | *** join/#arm-netbook A2Sheds (~ly@unaffiliated/l84supper) |
| 07:46.48 | *** join/#arm-netbook ManoftheSea (~dlahouss@72.22.81.52) |
| 08:19.31 | *** join/#arm-netbook hipboi (~hipboi@123.89.251.102) |
| 09:16.03 | CIA-46 | rhombus-tech: Garry master * rad02fff1a734 /allwinner_a10/orders/garrybodsworth.mdwn: garrybodsworth preorder |
| 09:41.36 | CIA-46 | rhombus-tech: christoph master * r0f1d45320cc7 /allwinner_a10/orders/blobon.mdwn: |
| 09:47.58 | hno | toxicpsion, where have you seen a .key file for phoenixusb? |
| 09:53.59 | hno | and what is phoenixusb. I am only aware of livesuite for usb and phoenixcard for sd cards. |
| 10:58.38 | CIA-46 | rhombus-tech: pepe master * r431cd570f05e /allwinner_a10/orders/pernambucox.mdwn: |
| 11:28.23 | CIA-46 | rhombus-tech: lkcl master * r22861f901701 /presentation.mdwn: |
| 12:01.21 | *** join/#arm-netbook eflatun (~eflatun@109.228.222.95) |
| 12:17.38 | CIA-46 | rhombus-tech: bailey master * r06a9aa33dba9 /allwinner_a10/orders/fygilwu.mdwn: |
| 12:27.19 | *** join/#arm-netbook penguin42 (~dg@tu006.demon.co.uk) |
| 13:10.50 | *** join/#arm-netbook QingPei (~qingpei@114.241.191.165) |
| 13:19.21 | *** join/#arm-netbook hipboi (~hipboi@123.89.251.102) |
| 13:44.31 | CIA-46 | rhombus-tech: lkcl master * rc84683776ee4 /allwinner_a10/orders/ (blobon.mdwn pernambucox.mdwn): order processing cleanup |
| 14:01.58 | hno | There is some crazy stuff in fes_1-1. Functions consisting of simply a return, conditions on constant expressions and the like. |
| 14:02.51 | hno | guesses it's source is assembly with loads of macros and compiletime conditions. |
| 14:03.29 | hno | could also be C, but some things looks odd for being of C origin. |
| 14:04.44 | hno | mm.. need to look into uboot spl. |
| 14:08.47 | hno | odd.. seem to have misplaced my A10 u-boot git tree somewhere, and git.hands.com do not seem to answer to git today. |
| 14:36.34 | zenitraM | seems to work for me.. |
| 14:56.08 | *** join/#arm-netbook arokux_h (~arokux@HSI-KBW-046-005-103-006.hsi8.kabel-badenwuerttemberg.de) |
| 15:15.29 | toxicpsion | hno: /tools/production/proxypid1_solution_net_141516D2-8AC7-4a7a-8D0A-1E49BE70842E.key ... have even flashed with it using this key. |
| 15:23.18 | *** part/#arm-netbook QingPei (~qingpei@114.241.191.165) |
| 15:30.55 | toxicpsion | anyone have any info on the SPR subdir that it referenced in 'how to config, pack, download firmware' ? |
| 15:33.35 | CIA-46 | rhombus-tech: giuseppa master * r8dcc04abd43f /allwinner_a10/orders/beddama.mdwn: |
| 15:48.10 | *** join/#arm-netbook tp1936 (18b909a4@gateway/web/freenode/ip.24.185.9.164) |
| 17:54.37 | hno | zenitraM, git clone works now. |
| 17:54.57 | hno | toxicpsion, where did you get that key? |
| 17:55.59 | hno | toxicpsion, have not seen a SPR subdir anywhere. |
| 17:58.03 | toxicpsion | to totally sure where it came from, one of he random ainol sdk files floating around..i think... i do most of my d/l away from home, rural connectivity here sucks. |
| 17:58.26 | toxicpsion | i'll look... jus firing up my lappy... should still be in history. |
| 17:59.48 | toxicpsion | tools.rar.... from a numbered ip that looks like it's one of 115's hosts |
| 18:02.49 | CIA-46 | rhombus-tech: lkcl master * r9a038d61edb9 /allwinner_a10/orders/beddama.mdwn: order processing cleanup |
| 18:03.24 | toxicpsion | originally @ http://dl.dbank.com/c0bazkwbh5 |
| 18:09.00 | toxicpsion | went on an autotranslator rampage the day after i got my tablet :P |
| 18:15.15 | arokux_h | zenitraM, how is your Mele. have you got it booting allwinner's kernel? |
| 18:15.34 | zenitraM | arokux_h: my mele is apparently dead |
| 18:15.55 | arokux_h | zenitraM, have the others got theirs? |
| 18:16.05 | zenitraM | it reboots itself at boot1 and when trying to execute any kernel from u-boot |
| 18:16.31 | zenitraM | my roommate got another one but he's not here |
| 18:16.36 | zenitraM | idk if anyone else got theirs |
| 18:17.04 | zenitraM | mine came using DHL (and billing me 60€ for customs…), the rest are somewhere on sweden post |
| 18:17.20 | arokux_h | wow |
| 18:17.42 | zenitraM | so be careful, because they contain a bill for the true value of 65$ |
| 18:17.47 | zenitraM | and yours might also get stopped |
| 18:19.27 | *** join/#arm-netbook eflatun (~eflatun@109.228.222.95) |
| 18:29.00 | CIA-46 | rhombus-tech: Oscar master * r2a7ae3aa695e /allwinner_a10/orders/xaicbsdhjsdhaj.mdwn: |
| 19:12.52 | *** join/#arm-netbook MaDMaLKaV (~IceChat9@188.86.253.69) |
| 19:26.13 | *** join/#arm-netbook MaDMaLKaV (~IceChat9@188.86.253.69) |
| 19:33.01 | hno | toxicpsion, found the key in tools.tar.gz |
| 19:33.43 | hno | wonder what charset production/ReadMe.txt is using... |
| 19:34.58 | toxicpsion | good to hear.... it's GBK |
| 19:37.05 | toxicpsion | you've gopt phoenixusbro tin that folder too? |
| 19:37.10 | toxicpsion | got* |
| 19:52.07 | *** join/#arm-netbook specing (~specing@unaffiliated/specing) |
| 19:52.44 | specing | Hello |
| 19:56.01 | toxicpsion | 'lo. |
| 19:57.47 | specing | I seem to have an allwinner10-based 7" tablet |
| 19:58.16 | toxicpsion | of what vintage? thhere's quite a few now. |
| 20:02.19 | specing | It seems to be branded as CAMIDA-6 NEW |
| 20:02.28 | specing | Otherwise it lacks labels |
| 20:02.44 | specing | It just says "Android tablet" on the box |
| 20:05.53 | specing | It comes rooted out of the box, running android 2.3 |
| 20:06.34 | toxicpsion | kernel/build#? |
| 20:06.59 | specing | Linux version 2.6.36-android (yang@ubuntu) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #9 PREEMPT Fri Nov 11 16:09:11 CST 2011 |
| 20:11.37 | toxicpsion | 512MB Ram/ 4GB flash?front camera only, came with an otg cable and case? |
| 20:14.20 | specing | 2.5Gb flash, it seems |
| 20:14.38 | toxicpsion | http://s31.pic.web.id/2147_inch_android_23_boxc.jpg? |
| 20:14.46 | specing | Not sure of the OTG cable, but I got a keyboard case with a nonworking stylus |
| 20:15.07 | specing | Nope |
| 20:15.15 | specing | Its not like in the picture |
| 20:15.22 | toxicpsion | hm.. |
| 20:15.56 | specing | the control buttons are on top and the camera is near the connectors |
| 20:19.21 | specing | The CPU's BGA says "Allwinner tech\nA10" though |
| 20:21.40 | specing | So what do I actually have? |
| 20:22.39 | toxicpsion | some mass produced chinese oem A10 based tablet. :P |
| 20:23.43 | toxicpsion | what's lsmod show? |
| 20:24.17 | toxicpsion | https://encrypted-tbn0.google.com/images?q=tbn:ANd9GcSe7NX4ZdqQwHcldIO-OUKNjjH1E5gTj4vo25hGb6i5oskpOslKJg? |
| 20:24.36 | toxicpsion | without the las ? |
| 20:34.05 | specing | nope, its all white |
| 20:34.18 | specing | err |
| 20:34.32 | specing | its similar |
| 20:34.37 | specing | black on top |
| 20:35.06 | specing | the camera looks hidden though |
| 20:36.54 | toxicpsion | hm. |
| 20:36.55 | specing | http://paste.pocoo.org/show/FvtaxccZUnaAZ4O52wT7/ |
| 20:41.37 | specing | How hard, measured it days, would be to put a regular distro on it and make it work with most of the components(touchscreen, usb h/d, wifi, sound)? |
| 20:44.40 | toxicpsion | can't even give a definite answer to that... |
| 20:46.15 | specing | Well if I manage to crosscompile Gentoo in a day, configure the kernel in another ... |
| 20:46.50 | specing | As far as I've read, most of the hardware seems to have opensource drivers |
| 20:49.16 | toxicpsion | ya... most of it is there, it's just some of the picky, strange bits left to be done. |
| 20:50.26 | toxicpsion | hno: you around? |
| 20:51.41 | toxicpsion | ..you think that's a signing key, or crypt key? |
| 21:00.31 | zenitraM | specing: not really hard |
| 21:00.45 | zenitraM | you can use the same kernel to boot a Linux root instead of an Android root |
| 21:00.49 | zenitraM | i've done it with Ubuntu |
| 21:01.02 | zenitraM | just load the modules, and you have framebuffer, display, wifi |
| 21:01.26 | zenitraM | touchscreen required some easy patching for X11 to recognize the events properly |
| 21:01.35 | zenitraM | (that I don't know how to do) |
| 21:07.31 | specing | One more thing: does suspend work? |
| 21:24.53 | specing | Heh, suddenly silence:D |
| 21:41.18 | zenitraM | sorry, wasn't here |
| 21:41.33 | zenitraM | specing: that's something i haven't tried |
| 21:41.47 | zenitraM | it is probably implemented "the android way" so it may not work as-is |
| 21:46.22 | specing | Meh |
| 21:47.02 | specing | I'd like to completely remove android because it ahem.ahem..sucks |
| 21:47.56 | specing | I was thinking about using a tiling vm on top of that, since I have a keyboard case |
| 21:50.14 | specing | And what is the android way, btw? |
| 21:52.06 | specing | http://paste.pocoo.org/show/UqjvnigDRwW9wo3J9Arz/ |
| 22:04.37 | zenitraM | with "the android way" i meant.. triggered by android |
| 22:05.29 | zenitraM | not sure how it triggers supension |
| 22:07.30 | specing | I would assume Linux deinitialises all hardware except DRAM controller and interrupts |
| 22:08.10 | specing | In the ps output above one can also see suspend listed as a kernel task |
| 22:17.48 | zenitraM | android suspend is more complex than that i think |
| 22:18.05 | zenitraM | it has wakelocks than can be triggered by processes, also wifi is enabled for sync.. |
| 22:18.55 | specing | Oh my |
| 22:19.33 | specing | zenitraM: but those wakelocks are just timer interrupts, right? |
| 22:21.01 | zenitraM | i don't know |
| 22:23.18 | hno | toxicpsion, yes |
| 22:23.59 | hno | no idea what kind of key it is. Seem to be used for building firmware and not for uploading. |
| 22:24.18 | hno | but not sure. |
| 22:32.57 | toxicpsion | from the usb flash log's i've been lookin at, the flash utility sends all of the packets(RFSFA, FES, FET,PX) as seperate transfers, which would mean that it needs to 'decrypt' the img file to flash. |
| 22:39.48 | hno | yes |
| 22:44.32 | hno | LiveSuit seems to contain another key in LiveSuit.dat |
| 22:44.38 | hno | toxicpsion^ |
| 22:46.12 | hno | or maybe same key but scrambled slightly differently. A bit too much the same. |
| 22:48.46 | toxicpsion | agreed. |
| 23:11.27 | hno | toxicpsion, in your USB dumps, have you identified how FES 1 & 2 is transferred to the board? |
| 23:11.52 | toxicpsion | not totally yet... ist a 230M packet capture :| |
| 23:12.19 | hno | Only the first part is interesting as it shows how to load some code onto the board. |
| 23:13.41 | hno | you can cut it at the transfer of FES_000000000000. From that point onwards is not interesting. |
| 23:18.17 | toxicpsion | kk i'll try to get to it after supper here. |
