| 00:42.01 | *** join/#elinux TxRomeo (n=bob@65.170.133.242) |
| 01:15.22 | MonMotha | ibot seen sorphin |
| 01:15.34 | ibot | sorphin <n=dans@mewp.captainrock.com> was last seen on IRC in channel #edev, 17d 23h 21m 20s ago, saying: 'because unless i get called, i've been off the clock since 5:30pm :)'. |
| 01:16.22 | *** join/#elinux noclouds (n=mhfan@60.166.51.79) |
| 01:29.22 | *** join/#elinux Tmob (n=total@c-24-6-95-52.hsd1.ca.comcast.net) |
| 02:22.02 | *** join/#elinux Tmob (n=total@c-24-6-95-52.hsd1.ca.comcast.net) |
| 03:11.55 | MonMotha | ibot seen sjhill |
| 03:12.06 | ibot | sjhill <n=sjhill@eth13.com-link.com> was last seen on IRC in channel #uclibc, 4d 9h 6m 16s ago, saying: 'that's my speculation'. |
| 03:31.42 | ricmm | MonMotha: I would recommend #mipslinux to contact sjhill, he seems to be there more often than anywhere else |
| 03:31.45 | ricmm | he isnt there atm tho ;) |
| 03:38.43 | MonMotha | ricmm: not surprising |
| 03:38.54 | MonMotha | I was looking for him for that purpose actually...had some MIPS questions |
| 03:39.03 | ricmm | you can go in there |
| 03:39.04 | MonMotha | you know much about the NEC VR5432? |
| 03:39.09 | MonMotha | true, I could :) |
| 03:39.10 | ricmm | plenty of MIPS gurus |
| 03:39.51 | ricmm | MonMotha: my field of experimentation doesnt go past VR4xxx series |
| 03:39.53 | ricmm | ;) |
| 03:40.42 | MonMotha | ricmm: ok, well, this is pretty basic stuff on those procs |
| 03:41.07 | MonMotha | I have a bunch of references to 0xBFAxxxxx. It looks like some sort of memory mapped thingie given what's being written in there, but it could conceivably just be SRAM |
| 03:44.26 | ricmm | never heard of specific mapping in those addresses, but let me recheck docs in case I missed something |
| 03:44.32 | MonMotha | ok |
| 03:44.37 | MonMotha | I looked throught the stuff and didn't see anything |
| 03:44.46 | MonMotha | it looks like init values for an MMU, but that's on coproc 0 |
| 03:47.54 | ricmm | no, I can't recall any references to 0xBFAxxxxx on vr41xx line of processors |
| 03:48.02 | ricmm | perhaps its something specific on vr5xxx ? |
| 03:48.14 | MonMotha | I didn't see any references in the VR5xxx docs, either |
| 03:48.23 | MonMotha | it could just be SRAM, but it really looks like register init |
| 03:48.39 | ricmm | what makes you think that |
| 03:48.45 | ricmm | where are you seeing those references? |
| 03:49.27 | MonMotha | DCT5000 boot ROM |
| 03:49.39 | MonMotha | there's this procedure that inits a bunch of processor bits, and it has a bunch of these refernces |
| 03:49.59 | MonMotha | then at the end goes and writes zero to a bunch of cp0 regs |
| 03:51.02 | ricmm | logic would say register init |
| 03:51.11 | ricmm | but perhaps its mapping something into ram? |
| 03:51.46 | MonMotha | that's what I'm wondering is if there's something memory mapped there |
| 03:51.51 | MonMotha | ROM shows up at 0xBFC00000 |
| 03:52.00 | MonMotha | that's where the cold boot exception handling vector is |
| 03:52.38 | MonMotha | there values it's poking are somewhat "magic". Lots of large nice hex numbers |
| 03:53.01 | MonMotha | things like 0x80000000, 0xEE000000, et. |
| 03:53.32 | *** part/#elinux TxRomeo (n=bob@65.170.133.242) |
| 03:53.33 | ricmm | thats weird, any chance on dumping those memory addresses after booting the thing? |
| 03:55.02 | MonMotha | can I do that via JTAG? |
| 03:55.51 | ricmm | you got it identified in that thing? |
| 03:56.17 | MonMotha | yeah, it's on a header |
| 03:56.22 | MonMotha | I don't have a connector handy, but i can get it |
| 04:07.29 | ricmm | MonMotha: sorry kind of busy atm, can ram be dumped from jtag on runtime? |
| 04:07.48 | MonMotha | I don't knwow |
| 04:16.23 | MonMotha | they could just be global variables, but they look like maybe initing an MMU or something |
| 04:25.32 | MonMotha | ricmm: the VR5xxx is backwards compatible enough to the VR4xxx that I should be able to get Linux running on it as such, right? That would seem to be the indication fromw aht I've read |
| 04:55.58 | ricmm | MonMotha: sorry, was on the phone with a friend, its her bday today |
| 04:56.20 | ricmm | but I don't really know specs on the VR5xxx series, I would need to dig some docs for that and it's pretty late tonight |
| 04:56.22 | MonMotha | ah, ok |
| 04:56.28 | MonMotha | that's fine |
| 04:56.32 | ricmm | but as far as I know all the line of VR cpu's share a basically similar structure |
| 04:56.38 | MonMotha | where are you at, btw? |
| 04:56.41 | MonMotha | timezone wise |
| 04:57.00 | ricmm | the basic vr41xx code on the mips branch should give some signs of life with minimal memory mapping changes |
| 04:57.09 | ricmm | im on EST+1, if that makes any sense |
| 04:57.18 | ricmm | 1am but I got class at like 7am so I should sleep, heh |
| 04:58.50 | MonMotha | ah, so same time as here |
| 04:59.10 | MonMotha | there's a group of us on Wed. who are going to get together in a room with a couple projectors and start working through this |
| 04:59.26 | ricmm | ah that sounds interesting |
| 04:59.40 | ricmm | are you still at Rose Hullman (or however its spelt)? |
| 05:00.06 | MonMotha | yeah, Rose-Hulman |
| 05:00.16 | MonMotha | we'll probably chuck an IRC window up on one projector if we get some others interested |
| 05:00.28 | MonMotha | ala hh dev conference (though we only have two screens) |
| 05:00.34 | ricmm | hehe |
| 05:00.56 | ricmm | I remember an old conference, probably the first that used vo-ip broadcasting and questioning |
| 05:02.47 | ricmm | a hh conf that was |
| 05:03.19 | MonMotha | yeah, I remember that one |
| 05:04.17 | MonMotha | yeah, this part is definately compiler generated... |
| 05:04.28 | MonMotha | I could condense like 20 of these instructions that are playing with masks into a single constant |
| 05:07.02 | T0mW | ricmm: naw, you cannot dump ram from a running cpu |
| 05:08.30 | ricmm | ya thought so, it already sounded like a vicious idea |
| 05:08.31 | ricmm | heh |
| 05:08.44 | T0mW | yeah, a "siphon" |
| 05:09.13 | T0mW | never hurts to ask though, heh |
| 05:09.17 | *** join/#elinux Spetznaz (n=spetznaz@tac.mukachevo.net) |
| 05:09.38 | T0mW | ibot: weather kabe |
| 05:09.59 | T0mW | supposed to have frost tonight |
| 05:11.49 | MonMotha | T0mW: can you halt the CPU via the test interface to perform pin twiddle operations, then resume operation? |
| 05:11.55 | MonMotha | that would let you do the same thing :) |
| 05:11.59 | T0mW | yes |
| 05:12.22 | MonMotha | you could halt it, read the RAM manually, then put everything back the way it was and resume operation as if nothing happened |
| 05:12.35 | T0mW | with the Abatron, I can halt the cpu, examine, alter memory, then tell it to 'go' |
| 05:13.50 | T0mW | Dunno what the DRAM controller would be doing while I'm halting cpu though, the CPU as my current target is SRAM |
| 05:15.29 | MonMotha | well, as far as I can tell, this stuff would have to either be SRAM or some sort of memory mapped peripheral |
| 05:15.43 | MonMotha | unless the DRAM controller comes up initilized correctly for the RAM on this target, which I highly doubt |
| 05:15.55 | MonMotha | heck, the MMU isn't even configured yet |
| 05:16.31 | T0mW | It might start in a "dead duck" mode, where it has a few K and slow timing? |
| 05:16.33 | MonMotha | the values just seem sorta odd to be stuffing in global variables. They look more like things you might configure an MMU with, actually |
| 05:16.44 | MonMotha | well, there's plenty of SRAM on this board, but that is possible |
| 05:17.01 | T0mW | lots of flash on that board too |
| 05:17.06 | MonMotha | I guess I could go start trying to poke around to trip chick selects with the JTAG |
| 05:17.16 | MonMotha | yeah, though they're storing to these locations, so it can't be flash as they aren't flash commands |
| 05:18.04 | T0mW | SPI port maybe? |
| 05:18.27 | MonMotha | you know...it may be the DRAM controller |
| 05:18.32 | T0mW | You trying to reverse the boot rom? |
| 05:18.39 | MonMotha | yeah |
| 05:18.46 | MonMotha | I'm trying to see if there might be a way to not have to replace it |
| 05:19.02 | MonMotha | I can't for the life of me find a place to buy the flash equiv part, and it would be nice for the others if that were not required |
| 05:19.18 | T0mW | doesn't that unit come up dumb, init the RF modules, then signon to a remote controller to get it's runtime program? |
| 05:19.23 | MonMotha | if I could buy the flash equiv part (and program it in system via JTAG or otherwise), that would be REALLY nice |
| 05:19.26 | ricmm | VR's user manuals are nice |
| 05:19.29 | MonMotha | yeah, that's what it appears to want to do |
| 05:19.36 | MonMotha | ricmm: yup, I've got them up |
| 05:19.51 | ricmm | they are rather "complete" |
| 05:19.54 | MonMotha | indeed |
| 05:20.10 | ricmm | while you see some controllers that would merit a good 500 pages of docs they only get like 90 |
| 05:20.20 | ricmm | the vr4121 has a 830 pages um x.x |
| 05:20.36 | T0mW | heh |
| 05:20.55 | MonMotha | T0mW: if I could replace that ROM, I could just chuck a kernel right in the ROM and let it try to boot itself, though I'm not entirely sure how the serial port is hooked up (looks like probably through that PC "southbridge" chip that handles the parport and IDE) |
| 05:21.06 | T0mW | sounds like you would need to have a team just to handle the vr4121 stuff |
| 05:21.18 | ricmm | pretty much |
| 05:21.19 | ricmm | its a bible |
| 05:21.39 | T0mW | "In the beginning, there was germanium..." |
| 05:21.58 | ricmm | heh |
| 05:22.10 | T0mW | "and a cats' wisker" |
| 05:22.30 | ricmm | ok I should really go to bed |
| 05:22.31 | ricmm | good night |
| 05:22.52 | *** join/#elinux angom_h (n=angom@red-corp-201.130.156.80.telnor.net) |
| 05:22.53 | T0mW | MonMotha: I couldn't identify the ROM, I was able to get "close" and read from it. |
| 05:23.12 | T0mW | the data looked reasonable |
| 05:24.26 | MonMotha | T0mW: I've got an image. It's on elinux.org |
| 05:24.40 | T0mW | yeah, that's the one I sucked in, I think. |
| 05:24.48 | MonMotha | there's also a flash part suggested that I cannot locate a place to buy it from. The really old 16Mbit EPROMs would work, but they're 5V only and this runs at 3 |
| 05:25.16 | MonMotha | I could make a little board with a bunch of buffers and such, but then I might as well just start stacking smaller flash chips up |
| 05:25.24 | MonMotha | a drop-in replacement would be very nice |
| 05:26.23 | T0mW | well, if you do use a 5v flash, the address lines should be okay with the 3.3v drive levels. Depends. |
| 05:26.50 | T0mW | where you would need to be carefull is on the data lines, they would have to be clipped to 3.3volts max |
| 05:27.25 | T0mW | I would run some, what, 100ohm, 400ohm resistors in series with the mainboard Databus signals. |
| 05:27.38 | MonMotha | oh, and just run the chip at 5V? hum, that would work I gues |
| 05:27.47 | MonMotha | woudl remove my ISP ability though since those old parts are UV erase |
| 05:28.03 | MonMotha | and I lack an EPROM programmer unless I'm at school, which I won't be by the end of this week |
| 05:28.14 | T0mW | then, use 1N4148 diodes at the "far end" (farthest from the 5volt flash) to 'clip' the voltage up to the 3.3v supply. |
| 05:28.47 | T0mW | then the only power would be that dissappated via the 400 ohm resistors * excess voltage |
| 05:29.32 | T0mW | use carbon comp resistors |
| 05:29.39 | T0mW | no film |
| 05:30.10 | T0mW | ah, film should be ok |
| 05:30.54 | MonMotha | heh, it's not running THAT fast :) |
| 05:31.00 | T0mW | MonMotha: I wasn't that interested in MIPS to do anything with the DCT5000 |
| 05:31.10 | MonMotha | T0mW: well, I just want to egt this stuff working at this point |
| 05:31.16 | MonMotha | and all the ARM stuff already has Linux ported to it :) |
| 05:31.22 | T0mW | heh |
| 05:51.18 | *** join/#elinux FireEgl (i=Atlantic@Atlantica.US) |
| 06:04.55 | MonMotha | MIPS has a reasonably standardized memory layout, right? |
| 06:05.09 | MonMotha | 8xxxxxxx is RAM, axxxxxxx is uncached RAM, etc? |
| 06:05.15 | MonMotha | (most of the time, of course) |
| 06:06.29 | T0mW | sjhill is the MIPS lackey |
| 06:07.23 | MonMotha | I know |
| 06:13.40 | T0mW | but, I'll take their money |
| 06:15.19 | *** join/#elinux derkling (n=derkling@213-140-6-119.ip.fastwebnet.it) |
| 06:33.32 | *** join/#elinux ignatoff (n=ignatov@c1-30-13.rrba.isadsl.co.za) |
| 06:59.21 | MonMotha | ok, so I was right |
| 06:59.37 | MonMotha | 0xBFAxxxxx is the base of the memory mapped registers for the memory controller |
| 06:59.43 | MonMotha | so it's doing DRAM init, chip select setup, etc. |
| 06:59.47 | MonMotha | whcih is what it lookedl ike |
| 07:54.49 | derkling | what stand for "relocation truncated to fit: R_ARM_PC24 rpl_malloc" |
| 07:54.50 | derkling | I'm doing a crosscompilation with --build=i686-pc-linux-gnu --host=arm-linux) |
| 07:58.42 | T0mW | means you went too far |
| 07:59.16 | T0mW | generally means the branch is too far to the target addr |
| 07:59.31 | T0mW | like trying to jump to RAM from Flash memory |
| 08:01.11 | T0mW | derkling: ping |
| 08:01.12 | MonMotha | holy hell |
| 08:01.26 | T0mW | MonMotha: what's up Batman? |
| 08:01.40 | MonMotha | this thing is nothing more than a NEC DDS5476 dev board with some more stuff thrown on |
| 08:01.46 | MonMotha | and that board is (somewhat) supported by linux |
| 08:01.57 | MonMotha | the flash has been moved, btu that's fixable |
| 08:02.07 | T0mW | how did you figure that out? |
| 08:02.08 | MonMotha | the southbridge chipset is the same |
| 08:02.15 | MonMotha | amongst other things |
| 08:02.23 | MonMotha | DRAM is in the same place |
| 08:02.47 | MonMotha | it doesn't have all the hardware that's ont he dev board, but mostly it's the same as far as I can tell |
| 08:02.53 | MonMotha | comparing VRC5476 init values |
| 08:03.12 | MonMotha | so now I just need to be able to get a program on the darn board and convince it to boot it |
| 08:03.18 | T0mW | NEC DDB5476 |
| 08:03.22 | MonMotha | yup |
| 08:03.29 | MonMotha | that's what I meant |
| 08:03.31 | T0mW | huh |
| 08:03.33 | MonMotha | I guess I typed S instead of B |
| 08:03.34 | T0mW | interesting |
| 08:04.04 | T0mW | I'm trying to get this *()&*ing program done tonite, I WANT TO PLAY TOO! WAHHH! |
| 08:04.06 | MonMotha | looks like the two flash banks are at 0x1C000000 and 0x1F000000 on this board |
| 08:04.19 | MonMotha | everything else is likely dangling off PCI |
| 08:04.31 | MonMotha | and that should be discoverable once Linux is booting |
| 08:04.43 | T0mW | prolly, don't re-invent the wheel if you can purchase one ready-made |
| 08:04.47 | MonMotha | yeah |
| 08:04.58 | MonMotha | the SRAM appears to all be hooked up to various peripherals, looking at the board |
| 08:05.04 | MonMotha | so probably none available to the OS |
| 08:05.20 | T0mW | heh, like the ZipIt, it is a collection of Appnotes |
| 08:05.33 | MonMotha | the webpal is the PS7500 dev kit in a box |
| 08:06.11 | T0mW | yeah, it is, I had the CL_PS7500-FE EVB, paid $1500 for that trash |
| 08:06.35 | T0mW | that is where it is today, in the local landfill |
| 08:06.38 | MonMotha | hehe |
| 08:06.43 | T0mW | :( |
| 08:06.46 | MonMotha | might as well just buy a webpal |
| 08:07.01 | MonMotha | even has most of the stuff brought out to IOs of some form |
| 08:07.11 | T0mW | well, I bought it about 2000 (2001?) |
| 08:08.17 | MonMotha | ah, ok |
| 08:08.43 | T0mW | cool |
| 08:09.10 | MonMotha | T0mW: you wouldn't happen to know where I could acquire a copy of the VRC5476 manual? |
| 08:09.31 | T0mW | thinking about the DCT5000 distracted me enough to realize my programming error. All fixed now. |
| 08:09.32 | MonMotha | having to reverse engineer the behavior of the thing from the linux source (which is not well commented at all) and the disassembly is tough |
| 08:09.36 | MonMotha | ah, there you go |
| 08:09.39 | T0mW | no, I don't |
| 08:09.40 | MonMotha | see, I was beneficial :) |
| 08:09.59 | T0mW | ibot: give MonMotha a snack |
| 08:10.01 | ibot | ACTION gives a snack to MonMotha |
| 08:10.09 | T0mW | :D |
| 08:10.51 | MonMotha | awesome! :) |
| 08:11.05 | T0mW | time for a break, maybe run down to the local pitstop (gas n go) to get a granola bar or something |
| 08:11.42 | T0mW | I've got a few more functions to code & test, then shovel this code into the target system and test it. |
| 08:12.19 | T0mW | MonMotha: then invoice the customer and I can buy food again |
| 08:13.13 | MonMotha | hey, that's always good |
| 08:13.24 | MonMotha | I've actually got a stint at On this summer making eval/demo boards |
| 08:13.26 | MonMotha | should be fun |
| 08:13.38 | MonMotha | hey, I've got an init sequence here |
| 08:13.47 | MonMotha | think you could look at it really quick and see ify ou recognize what it might be? |
| 08:14.03 | MonMotha | I think it may be some sort of flash, but I could be completely wrong. It's mapped straight off the MMU into a 2MB space |
| 08:14.18 | T0mW | paste it up |
| 08:15.27 | T0mW | MonMotha: Lineo did the original linux port on that board, and you know they weren't terribly smart people, heh |
| 08:15.35 | MonMotha | heh |
| 08:15.44 | MonMotha | this is coming from the disassembly from the DCT5000 |
| 08:15.47 | MonMotha | let me get this typed up |
| 08:16.36 | MonMotha | http://gigapet.monmotha.net/~monmotha/mysteryinit.txt |
| 08:17.02 | T0mW | thats a Flash dance |
| 08:17.13 | MonMotha | ok, I figured |
| 08:17.26 | T0mW | 28 or 29 series flash |
| 08:17.27 | MonMotha | recognize any specifics, what it might be doing? Which chip it might be talking to (would be AMD or Intel)? |
| 08:17.37 | MonMotha | yeah, that would be what's on this board :) |
| 08:17.46 | T0mW | Intel I think, AMD did similar dances |
| 08:17.47 | MonMotha | AMD 29 series and Intel 28 series |
| 08:18.04 | MonMotha | have you seen the DCT5000? |
| 08:18.06 | T0mW | yeah, looks like intel 28 |
| 08:18.09 | MonMotha | ok |
| 08:18.13 | T0mW | MonMotha: I've got one here |
| 08:18.18 | MonMotha | handy? |
| 08:18.23 | MonMotha | mind taking a brief look at something for me? |
| 08:18.28 | T0mW | ok |
| 08:18.37 | MonMotha | there's two "sets" of flash, right? |
| 08:19.00 | MonMotha | one set is two large Intel 28 series chips, while the other set is two smaller chips mixed between 28 series Intel and 29 series AMD |
| 08:19.35 | MonMotha | any thoughts? their physical proximity and the fact that I have two chip selects being generated leads me to believe they are being mapped separately, but why mix the Intel and AMD? |
| 08:22.30 | T0mW | ok, i've got it opened up |
| 08:23.19 | MonMotha | see above? |
| 08:24.09 | T0mW | I have always thought that U7 & U9 are for the main processor |
| 08:24.20 | T0mW | with U5 & U6 going to the broadcom chip |
| 08:25.22 | MonMotha | ah, you're right |
| 08:25.29 | MonMotha | maybe |
| 08:25.38 | T0mW | U6 is 8bit |
| 08:25.52 | MonMotha | there's a goodly number of lines to the U21 going down towards the other stuff, nearer to the proc |
| 08:26.02 | MonMotha | to the left of the screw |
| 08:26.20 | MonMotha | U21 is 16bit, just found a datasheet |
| 08:26.57 | T0mW | you mean u6, not u21 |
| 08:27.15 | T0mW | same thing |
| 08:27.37 | T0mW | are you sure, that is the 44 pin TSOP, isn't it? |
| 08:27.39 | MonMotha | indeed, what is U21 referrign to there? |
| 08:27.45 | MonMotha | yeah it looks too small |
| 08:27.55 | MonMotha | but the datasheet for that part with full matching number (C3 suffix) says 16 bit |
| 08:28.02 | T0mW | it is a double purpose footprint: u21 or u6 |
| 08:28.10 | MonMotha | ah, ok |
| 08:29.03 | T0mW | Ahhhhh, I think you are correct. IIRC, the E28F320's are StrataFlash. |
| 08:29.16 | MonMotha | Intel® Advanced+ Boot Block Flash Memory (C3) according to the datasheet |
| 08:29.30 | MonMotha | the J5 is x8/x16 |
| 08:29.32 | T0mW | StrataFlash doesn't do the 'dance', it has a different algorithm |
| 08:29.37 | MonMotha | ok |
| 08:29.59 | T0mW | then you must be dancing the u6 (u21) |
| 08:30.05 | T0mW | or u5 |
| 08:30.20 | T0mW | IIRC, the 29F series also danced |
| 08:30.22 | MonMotha | ok |
| 08:31.22 | MonMotha | so all those Intel parts would not use that algorithm? |
| 08:31.27 | T0mW | hmmm, SW900 looks interesting, eh? SPST switch |
| 08:31.34 | MonMotha | SW900 is reset |
| 08:31.48 | MonMotha | same as a power cycle, at least with the stock firmware |
| 08:31.48 | T0mW | I don't think so, it's been a while. |
| 08:32.03 | MonMotha | <PROTECTED> |
| 08:34.27 | T0mW | http://download.intel.com/design/flcomp/datashts/30666608.pdf |
| 08:35.51 | T0mW | To perform a write operation, both CE# and WE# are asserted while RST# and OE# are deasserted. |
| 08:35.51 | T0mW | During a write operation, address and data are latched on the rising edge of WE# or CE#, |
| 08:35.51 | T0mW | whichever occurs first. Table 19, ?Command Bus Cycles? on page 50 shows the bus cycle |
| 08:35.52 | T0mW | sequence for each of the supported device commands, while Table 20, ?Command Codes and |
| 08:35.52 | T0mW | Definitions? on page 51 describes each command. See Section 7.0, ?AC Characteristics? on |
| 08:35.52 | T0mW | page 33 for signal-timing details. |
| 08:36.28 | *** part/#elinux derkling (n=derkling@213-140-6-119.ip.fastwebnet.it) |
| 08:36.38 | T0mW | it uses hardware bitline sequencing + command mailbox to program strataFlash, no dance |
| 08:37.44 | MonMotha | ok |
| 08:41.24 | T0mW | Well, there is a way via JTAG to program the Flash. We used the Boundry Scan Chain to program the TuxScreen that way. |
| 08:41.46 | T0mW | problem has been that boot rom |
| 08:42.14 | T0mW | as in, wtf is it and can we get any of them? |
| 08:42.15 | T0mW | heh |
| 08:42.19 | MonMotha | yeah, I'm familiar with that procedure |
| 08:42.24 | MonMotha | exactly |
| 08:42.34 | MonMotha | there's got to be a way to convince that ROM to run what's in flash |
| 08:42.36 | MonMotha | I'm trying to find it |
| 08:42.45 | MonMotha | I have some ideas right now |
| 08:43.27 | MonMotha | it checks for a magic value in flash. If it doesn't find it, it sets that magic value, and copies some program (which appears to just bang at the DRAM controller indefinately) and jumps into it |
| 08:44.10 | MonMotha | if it does find it, it writes back a DIFFERENT value, goes on to init the processor some more, and I haven't gotten any further |
| 08:44.41 | T0mW | yeah, reversing compiled code is "interesting" |
| 08:44.59 | T0mW | Its not hand written assembler is it? |
| 08:45.27 | MonMotha | not past the first few lines |
| 08:45.33 | T0mW | k |
| 08:45.35 | MonMotha | some of it is VERY obviously compiler generated |
| 08:45.52 | MonMotha | like 20 instructions worth of masks that could be condensed into 4 if you wanted to |
| 08:46.09 | *** join/#elinux HJBIII (n=HJBIII__@c1-30-13.rrba.isadsl.co.za) |
| 08:46.33 | Zta | ...damn. T0mW turned out not to be Tom Waits after all. |
| 08:46.38 | T0mW | heh, one customer wanted me to implement some security in his new board because he was afraid someone could reverse engineer 150K of compiled ARM C code. |
| 08:47.05 | MonMotha | hahaq |
| 08:47.15 | MonMotha | yeah, you can...if you have infinite, worthless time on your hands |
| 08:47.15 | T0mW | yeah, idiot |
| 08:47.29 | MonMotha | basically, just make sure the startup is reasonably secure if you're afraid and most people will just plain give up |
| 08:47.46 | T0mW | Oh, he thought there was a utility that would do it for you: reconstitute C from machine code |
| 08:48.36 | MonMotha | not in any intelligent manner |
| 08:48.41 | T0mW | heh |
| 08:48.52 | MonMotha | if you know the compiler well, you can start to piece things together fairly quickly, but even then it's hard to automate |
| 08:49.02 | MonMotha | at best you can pull out basic loop constructs with no-name variables |
| 08:49.14 | T0mW | I did reverse 28K of Turbo C generated code once. That took me a couple of weeks, but I knew that compiler and how it gen'ed code |
| 08:49.23 | MonMotha | Ida can sometimes put together switch statements for you |
| 08:49.37 | MonMotha | I don't know what compiler this was, certainly not GCC as far as I can tell |
| 08:49.58 | T0mW | well, turn on -Os and try to reverse that |
| 08:50.20 | T0mW | I cannot even debug that when I have the source files! |
| 08:50.52 | T0mW | I selectively turn on -O0 to do debugging |
| 08:53.32 | T0mW`candy_store | TomW.com is for sale $4,088.00 |
| 08:53.44 | T0mW`candy_store | who are they kidding? |
| 08:53.46 | T0mW`candy_store | ! |
| 08:54.13 | MonMotha | haha |
| 09:15.10 | T0mW | I got a brownie |
| 09:39.15 | MonMotha | well, I got to go to bed :) |
| 09:39.30 | MonMotha | though a brownie sounds nice |
| 09:40.30 | T0mW | and the apple strudul was good too |
| 09:47.37 | *** join/#elinux noclouds (n=mhfan@60.166.48.24) |
| 11:33.06 | *** join/#elinux jayakumar2 (n=jayakuma@203.121.47.18) |
| 11:38.43 | chouimat | morning |
| 11:39.10 | *** join/#elinux tuxmaniac (n=aanjhan@60.254.67.17) |
| 13:18.52 | *** join/#elinux cbrake (i=user103@216.144.26.242) |
| 13:34.44 | *** join/#elinux Crofton (n=balister@hc6521dcb.dhcp.vt.edu) |
| 13:38.12 | *** join/#elinux gcl (n=gcl@S0106001346b91f0f.cg.shawcable.net) |
| 14:03.48 | *** join/#elinux kris (n=Asier@197.Red-80-38-245.staticIP.rima-tde.net) |
| 14:21.54 | CosmicPenguin | morning |
| 14:27.25 | *** part/#elinux kris (n=Asier@197.Red-80-38-245.staticIP.rima-tde.net) |
| 14:29.19 | *** join/#elinux chouimat (n=dieu@kde/developer/chouinard) |
| 15:14.39 | *** join/#elinux bbart (n=bbart@p54BDFDC5.dip.t-dialin.net) |
| 15:19.47 | *** join/#elinux ctaylor (n=ctaylor@static-70-106-125-178.pskn.east.verizon.net) |
| 15:22.19 | ctaylor | anyone know what controls when buildroot decides to make the filesystem, I'm having a problem where it is making the jffs2 filesystem image before it has finished compiling all the components. |
| 15:28.04 | *** join/#elinux eggers (n=eggers@bi01p1.co.us.ibm.com) |
| 15:53.29 | *** join/#elinux likewise (n=chatzill@82-171-189-134.dsl.ip.tiscali.nl) |
| 15:53.36 | *** part/#elinux likewise (n=chatzill@82-171-189-134.dsl.ip.tiscali.nl) |
| 16:09.14 | *** join/#elinux mallum (n=mallum@host86-141-47-51.range86-141.btcentralplus.com) |
| 16:09.15 | *** mode/#elinux [+v mallum] by ChanServ |
| 16:09.54 | mallum | hey file |
| 16:24.46 | *** join/#elinux lyakh (n=lyakh@85.197.31.25) |
| 16:44.36 | *** join/#elinux hufnus (n=slonsiki@DSL135-086.labridge.com) |
| 16:58.32 | *** join/#elinux tuxmaniac (n=aanjhan@60.254.67.17) |
| 17:00.43 | CosmicPenguin | mallum: greets |
| 17:14.43 | mallum | hey CosmicPenguin |
| 17:16.33 | kergoth | morning |
| 17:19.21 | CosmicPenguin | mallum: everything going well over at ol' o-hand? |
| 17:21.04 | mallum | CosmicPenguin: yeah pretty well |
| 17:42.23 | ricmm | kergoth: hello there |
| 20:14.53 | *** join/#elinux ctaylor (n=ctaylor@static-70-106-125-178.pskn.east.verizon.net) |
| 21:28.55 | *** join/#elinux Crofton (n=balister@66-207-66-26.black.dmt.ntelos.net) |
| 21:39.55 | *** join/#elinux FireEgl (n=FireEgl@Atlantica.IRCNut.Com) |
| 22:26.56 | *** join/#elinux andersee (n=andersen@codepoet.org) |
| 22:26.56 | *** mode/#elinux [+o andersee] by ChanServ |
| 22:37.47 | kergoth | chouimat: ping |
| 22:39.57 | CosmicPenguin | pivot you rat bastard! |
| 23:42.26 | chouimat | kergoth: pong |