| 00:11.28 | *** join/#htc-linux balans (~server@82-170-217-205.ip.telfort.nl) |
| 00:15.02 | *** join/#htc-linux mitsutaka (~mitsutaka@rt.miraclelinux.com) |
| 00:15.54 | *** join/#htc-linux cmw (~icesith@c-75-70-52-162.hsd1.co.comcast.net) |
| 00:51.39 | *** join/#htc-linux hardwalker (~hardwalke@122-117-115-146.HINET-IP.hinet.net) |
| 01:02.35 | *** join/#htc-linux dekar (~dekar@drms-590c48bb.pool.mediaWays.net) |
| 01:03.27 | *** join/#htc-linux ORi| (~ORi@91.181.107.203) |
| 01:11.54 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 01:32.54 | *** join/#htc-linux mitsutaka (~mitsutaka@rt.miraclelinux.com) |
| 01:34.51 | *** join/#htc-linux AstainHellbring (AstainHell@unaffiliated/astainhellbring) |
| 01:43.33 | *** join/#htc-linux furtardo (~mks@nat/yahoo/x-ibafmozzmiqcpgvy) |
| 01:47.02 | *** join/#htc-linux Rob2222 (~Miranda@p5DE4BAE4.dip.t-dialin.net) |
| 01:57.59 | *** join/#htc-linux Rob2222 (~Miranda@p4FFF2C75.dip.t-dialin.net) |
| 02:01.41 | *** join/#htc-linux schmave (~dave@14-200-67-183.static.tpgi.com.au) |
| 02:05.18 | *** part/#htc-linux schmave (~dave@14-200-67-183.static.tpgi.com.au) |
| 02:16.58 | *** join/#htc-linux dave (~dave@14-200-67-183.static.tpgi.com.au) |
| 02:18.15 | Guest8701 | alright, i conceed, i'm not good enough |
| 02:18.19 | Guest8701 | wyrm |
| 02:19.01 | Guest8701 | oh great |
| 02:19.04 | Guest8701 | haha |
| 02:19.09 | *** join/#htc-linux WyrM (~WyrM@unaffiliated/wyrm) |
| 02:19.17 | Guest8701 | wyrm |
| 02:19.28 | Guest8701 | are you there? |
| 02:26.54 | WyrM | Guest8701: I am now. |
| 02:27.13 | Guest8701 | okay |
| 02:27.17 | Guest8701 | I coneec |
| 02:27.19 | Guest8701 | conceed* |
| 02:28.00 | WyrM | ? |
| 02:28.25 | Guest8701 | I'm not good enough to find super_peek_poke |
| 02:28.34 | Guest8701 | i think its 0x4c 0xfc |
| 02:28.46 | Guest8701 | but I wouldn't know the arguments |
| 02:29.24 | Guest8701 | so I've decided to release the driver I write in the public domain, since you said your employer will anyway haha |
| 02:29.59 | Guest8701 | closed source doesn't help anyone |
| 02:30.06 | WyrM | :) |
| 02:32.47 | Guest8701 | so, am I right? |
| 02:32.58 | Guest8701 | is 4c super_peek_poke? |
| 02:33.08 | WyrM | no. |
| 02:33.14 | Guest8701 | haha aww |
| 02:33.19 | Guest8701 | but then |
| 02:33.22 | Guest8701 | there are no more commands left |
| 02:33.30 | Guest8701 | in brcm_patchram_plus.c |
| 02:33.36 | Guest8701 | or the hcd files |
| 02:35.03 | WyrM | I guess my brcm_patchram_plus.c is different. |
| 02:35.40 | Guest8701 | how so? |
| 02:35.50 | Guest8701 | different to say, this? |
| 02:36.18 | Guest8701 | http://www.netmite.com/android/mydroid/2.0/system/bluetooth/brcm_patchram_plus/brcm_patchram_plus.c |
| 02:40.08 | WyrM | yes. |
| 02:40.12 | WyrM | http://pastebin.com/1GjY3e1x |
| 02:41.22 | Guest8701 | hectic |
| 02:45.29 | WyrM | but you can hack it with 4c too. |
| 02:45.58 | Guest8701 | but 4c only accesses the ram addresses? |
| 02:46.13 | WyrM | its patchram, try to extract the .hcd some patches will be code which you can disasm on ida. |
| 02:48.36 | Guest8701 | but still, theoretically that will only give me ram access right? |
| 02:48.43 | *** join/#htc-linux theredundant (~theredund@27-32-116-207.static.tpgi.com.au) |
| 02:48.57 | Guest8701 | why did the linux people only get a short copy of patchram? |
| 02:49.11 | WyrM | you can change the code to access anything. |
| 02:49.21 | WyrM | peek_poke is a patchram patch. |
| 02:49.32 | Guest8701 | oh |
| 02:49.43 | Guest8701 | so without the patch to ram |
| 02:49.47 | Guest8701 | you can't peek_poke? |
| 02:50.16 | theredundant | oh i remember those days last year when this room was constantly active with the dev on the hd2 |
| 02:51.10 | WyrM | haven't tried. |
| 02:51.17 | WyrM | but i think i can't. |
| 02:51.38 | Guest8701 | yeah, they wouldn't put it in the hcd otherwise |
| 02:52.27 | WyrM | most of the code in the .hcd are replacements for rom functions. |
| 02:52.43 | Guest8701 | yeah okay, |
| 02:53.00 | Guest8701 | I was wondering why we even needed hcd files in the first place lol |
| 02:53.13 | Guest8701 | that was something I wanted to get straight haha |
| 02:53.40 | Guest8701 | but yeah, I couldn't see any uniformity in the file apart from the hci header |
| 02:53.51 | Guest8701 | how many bytes are parameters to 4c? |
| 02:54.18 | WyrM | 4c 4f <len> <data> ... |
| 02:54.28 | Guest8701 | yeah but where does it put it? |
| 02:54.35 | Guest8701 | <mem offset> |
| 02:54.37 | Guest8701 | ? |
| 02:54.49 | WyrM | first 4 bytes, little endian. |
| 02:54.50 | Guest8701 | i got 4c fc len data |
| 02:54.55 | Guest8701 | ahh touche |
| 02:55.17 | Guest8701 | 4c is a no mucking around write? you don't need another byte to specify read/write? |
| 02:55.46 | Guest8701 | 4c fc len 4byteaddr ida ida ida ida ida ida |
| 02:55.57 | *** join/#htc-linux Bry8Star (~Bry8Star@gateway/tor-sasl/bry8star) |
| 02:56.00 | WyrM | its write. i dont know if there is a read function. |
| 02:56.07 | Guest8701 | yeah, I got that impression |
| 02:56.15 | Guest8701 | they wouldn't expose a read function |
| 02:56.21 | WyrM | but some hci commands just use the next (4d) as a read operation. |
| 02:56.22 | Guest8701 | if they didn't have to |
| 02:56.49 | Guest8701 | read ram right? |
| 02:58.14 | Guest8701 | 4e? |
| 02:58.24 | Guest8701 | that is sequentially next |
| 02:58.34 | Guest8701 | but i think it means 'terminate ram write connection' |
| 02:58.39 | Guest8701 | would that be close to the money? |
| 02:58.50 | WyrM | Dont know. |
| 02:59.00 | Guest8701 | they send that at the end of every hcd |
| 03:00.40 | WyrM | Im not using 4c. |
| 03:00.57 | WyrM | 0x0a |
| 03:08.32 | Guest8701 | 0x0a for what? |
| 03:08.54 | *** part/#htc-linux cmw (~icesith@c-75-70-52-162.hsd1.co.comcast.net) |
| 03:12.53 | WyrM | a fc len op addr |
| 03:22.57 | Guest8701 | addr of what? |
| 03:40.27 | *** join/#htc-linux ElFinLazz (~elfinlazz@112.154.189.103) |
| 03:40.51 | Guest8701 | what about the hcd files that say |
| 03:40.54 | Guest8701 | 'generic rx' |
| 03:41.05 | Guest8701 | 'generic fmrx' |
| 03:41.07 | Guest8701 | sorry |
| 03:48.05 | *** join/#htc-linux MDJ_ru (~MDJ@213.87.121.32) |
| 03:52.07 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 03:53.51 | *** join/#htc-linux Rob2223 (~Miranda@p4FFF30EF.dip.t-dialin.net) |
| 04:19.37 | *** join/#htc-linux dobrin (~dobrin@85.91.150.26) |
| 04:36.38 | *** join/#htc-linux programmer8922 (~Evan@67.219.164.162) |
| 04:47.51 | *** join/#htc-linux kiozen (~kiozen@ppp-93-104-83-228.dynamic.mnet-online.de) |
| 05:08.49 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 05:32.38 | *** join/#htc-linux mastermerlin (~Adium@pD9E2E62F.dip.t-dialin.net) |
| 05:33.20 | *** join/#htc-linux MDJ_ru (~MDJ@46.182.128.248) |
| 05:43.10 | *** join/#htc-linux kiozen (~kiozen@p5DDF362F.dip.t-dialin.net) |
| 06:02.10 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-173-9.26-151.libero.it) |
| 06:14.50 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-173-9.26-151.libero.it) |
| 06:20.32 | *** join/#htc-linux Andreyxxl[HD2EU] (Andreyxxl@94.52.236.39) |
| 06:21.18 | *** join/#htc-linux dekar (~dekar@drms-4d015c7b.pool.mediaWays.net) |
| 06:31.16 | *** join/#htc-linux tjs_bsd (~tjs@ec2-46-51-235-118.ap-northeast-1.compute.amazonaws.com) |
| 06:32.56 | *** join/#htc-linux tjs_bsd (~tjs@ec2-46-51-235-118.ap-northeast-1.compute.amazonaws.com) |
| 07:00.19 | *** join/#htc-linux avinashhm (~avinash-h@192.94.92.11) |
| 07:55.00 | *** join/#htc-linux dave (~dave@110-175-9-69.static.tpgi.com.au) |
| 08:13.38 | *** join/#htc-linux leviathan (~quassel@c-82-192-226-27.customer.ggaweb.ch) |
| 08:16.39 | *** join/#htc-linux paulk (~paulk@lib33-1-82-233-88-171.fbx.proxad.net) |
| 09:07.29 | *** join/#htc-linux avinashhm (~avinash-h@192.94.92.11) |
| 09:13.41 | *** join/#htc-linux idanfima (~idanfima@bzq-79-181-185-218.red.bezeqint.net) |
| 09:21.09 | *** join/#htc-linux helicopter88 (~helicopte@host33-18-dynamic.22-79-r.retail.telecomitalia.it) |
| 09:22.45 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 09:31.46 | *** join/#htc-linux idanfima_ (~idanfima@80.250.146.42) |
| 09:47.35 | *** join/#htc-linux theredundant (~theredund@27-32-116-207.static.tpgi.com.au) |
| 10:01.35 | *** join/#htc-linux _twitch (~burning_a@49.114.96.58.static.exetel.com.au) |
| 10:03.22 | *** join/#htc-linux dobrin (~dobrin@85.91.150.26) |
| 10:05.31 | *** join/#htc-linux avinashhm (~avinash-h@192.91.66.189) |
| 10:14.34 | *** join/#htc-linux GNUtoo|laptop (~gnutoo@50.118-226-89.dsl.completel.net) |
| 10:30.14 | *** join/#htc-linux idanfima (~idanfima@bzq-79-182-184-239.red.bezeqint.net) |
| 10:33.12 | *** join/#htc-linux sleeplessnerd (~sleepless@ip-109-91-30-178.unitymediagroup.de) |
| 10:42.14 | *** join/#htc-linux ccube (~ccube@pass-5d864f5c.pool.mediaWays.net) |
| 10:51.47 | *** join/#htc-linux idanfima (~idanfima@bzq-79-176-185-181.red.bezeqint.net) |
| 11:02.12 | *** join/#htc-linux GlemSom (~glemsom@0x5da34bca.cpe.ge-1-1-0-1105.sdnqu1.customer.tele.dk) |
| 11:03.36 | *** join/#htc-linux ccube (~ccube@pass-5d864f5c.pool.mediaWays.net) |
| 11:21.28 | *** join/#htc-linux theredundant (~theredund@27-32-116-207.static.tpgi.com.au) |
| 11:23.04 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-173-9.26-151.libero.it) |
| 11:24.28 | *** join/#htc-linux idanfima_ (~idanfima@bzq-79-176-185-181.red.bezeqint.net) |
| 11:40.09 | *** join/#htc-linux skodde (~skodde@unaffiliated/skodde) |
| 11:43.34 | *** join/#htc-linux Segnale0_ (~Segnale00@ppp-5-5.26-151.libero.it) |
| 11:45.59 | *** join/#htc-linux raymonddull (~raymonddu@c-69-245-125-111.hsd1.mi.comcast.net) |
| 12:17.34 | *** join/#htc-linux MN-- (~yaaic@host86-134-107-44.range86-134.btcentralplus.com) |
| 12:18.18 | *** join/#htc-linux rajkosto (~rajkosto@cable-188-2-156-181.dynamic.sbb.rs) |
| 12:24.35 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-5-5.26-151.libero.it) |
| 12:35.30 | *** join/#htc-linux dave (~dave@110-175-9-69.static.tpgi.com.au) |
| 13:01.18 | *** join/#htc-linux newbie (~helicopte@host33-18-dynamic.22-79-r.retail.telecomitalia.it) |
| 13:18.13 | *** join/#htc-linux GlemSom (~glemsom@0x5da34bca.cpe.ge-1-1-0-1105.sdnqu1.customer.tele.dk) |
| 13:21.26 | *** join/#htc-linux theredundant (~theredund@27-32-116-207.static.tpgi.com.au) |
| 13:21.54 | *** join/#htc-linux arif-ali (~arif-ali@bc2.cat.com) |
| 13:25.05 | *** join/#htc-linux dave (~dave@110-175-9-69.static.tpgi.com.au) |
| 13:28.19 | *** join/#htc-linux Alex[sp3dev] (~alexander@86.110.163.19) |
| 13:31.42 | *** join/#htc-linux Broam (~brian@fsf/member/Broam) |
| 13:40.50 | *** part/#htc-linux Broam (~brian@fsf/member/Broam) |
| 13:49.32 | *** join/#htc-linux |Jeroen| (~jeroen@d5152B25B.access.telenet.be) |
| 13:59.18 | *** join/#htc-linux Andreyxxl[HD2EU] (Andreyxxl@94.52.236.39) |
| 14:01.35 | Guest82575 | okay, I am at a compiler |
| 14:01.51 | Guest82575 | are you sure they are four byte memory offsets? |
| 14:15.49 | *** join/#htc-linux defendthecommons (~defendthe@50-48-47-32.drr05.mdtw.ny.frontiernet.net) |
| 14:20.40 | *** join/#htc-linux theredundant (~theredund@27-32-116-207.static.tpgi.com.au) |
| 14:21.14 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 14:35.51 | *** join/#htc-linux AstainHellbring (~AstainHel@unaffiliated/astainhellbring) |
| 14:36.17 | Guest82575 | nah, they're four byte offsets :P |
| 14:39.40 | *** join/#htc-linux |Jeroen| (~jeroen@d5152B25B.access.telenet.be) |
| 14:40.56 | WyrM | Guest82575: are you talking about what exactly? |
| 14:41.08 | WyrM | .hcd files? |
| 14:41.19 | Guest82575 | i was trying to print the mem offsets but they weren't coming out right |
| 14:41.39 | Guest82575 | yeah |
| 14:41.44 | WyrM | they are absolute addresses, directly mappable to the arm7tdmi core. |
| 14:41.59 | Guest82575 | yeah, no, I was just printing them incorrectly |
| 14:42.00 | Guest82575 | haha |
| 14:42.19 | WyrM | rom is at 0x0, ram is at 0x8000 and peripherals at 0xe0020. |
| 14:42.36 | Guest82575 | how do you know this? |
| 14:42.48 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 14:43.06 | WyrM | trial and error mostly. ;) |
| 14:43.20 | WyrM | but after you have a rom dump you can just look at the code. |
| 14:43.33 | Guest82575 | and why is the ram and peripherals sequentially mapped |
| 14:43.44 | Guest82575 | crazy, I've never been this far into a chip before |
| 14:43.54 | Guest82575 | it's always been theoretical to me |
| 14:45.51 | Guest82575 | yeah, I'm just working towards that rom dump |
| 14:46.07 | Guest82575 | once I have it, everything should be self-evident |
| 14:47.38 | Guest82575 | which year of uni/college do they teach this in, do you know? |
| 14:48.07 | WyrM | No idea. |
| 14:48.15 | Guest82575 | how did you learn it? |
| 14:48.24 | WyrM | google. |
| 14:48.28 | WyrM | :D |
| 14:48.39 | Guest82575 | hectic haha, did you go to uni/college? |
| 14:48.59 | WyrM | No. |
| 14:49.16 | Guest82575 | wow, are you self taught? |
| 14:49.30 | WyrM | yes. |
| 14:49.39 | Guest82575 | wow |
| 14:49.42 | Guest82575 | :) |
| 14:50.52 | WyrM | have you tried "a fc len op addr"? |
| 14:51.34 | Guest82575 | to be honest, it was too contracted for me to understand :P |
| 14:53.01 | Guest82575 | do you mean 0xa 0xfc len op(code??) mem offset? |
| 14:53.21 | WyrM | yes |
| 14:53.23 | Guest82575 | is 0xa a peek/poke command |
| 14:53.28 | Guest82575 | what does op mean? |
| 14:53.46 | WyrM | i had to guess "op", its not on my brcm_patchram_plus either. |
| 14:54.01 | Guest82575 | yeah but your brcm patchram plus has 0xa |
| 14:54.01 | WyrM | but you can start with 4. ;) |
| 14:54.15 | Guest82575 | so not fair :) |
| 14:54.24 | *** join/#htc-linux [acl] (~abel@96.246.167.90) |
| 14:54.47 | Guest82575 | i thought 0xa would drop out from the hcd files :) |
| 14:54.59 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 14:55.09 | Guest82575 | I was just about to chuck the hcd functions into ida |
| 14:55.22 | WyrM | try: 0a fc 05 04 00 00 00 00 |
| 14:55.34 | WyrM | then increase addr, remember its little endian. |
| 14:55.58 | Guest82575 | 4? how do I know it won't erase my rom!!!! |
| 14:56.44 | WyrM | You don't. |
| 14:56.51 | Guest82575 | ! |
| 14:56.57 | Guest82575 | i'm going to die |
| 14:57.16 | Guest82575 | heavy, do you have a means of reflashing your rom? |
| 14:57.37 | WyrM | I think its really ROM. |
| 14:57.44 | WyrM | so you can't change it. |
| 14:57.46 | Guest82575 | oh |
| 14:58.01 | Guest82575 | then how do you poke it? |
| 14:58.05 | Guest82575 | or can you only poke ram |
| 14:58.19 | WyrM | I dont poke ROM, just ram and peripherals. |
| 14:58.21 | Guest82575 | ahhh, makes sense, otherwise why bother patching ram when you could |
| 14:58.28 | Guest82575 | just patch rom once |
| 14:58.33 | Guest82575 | and be done |
| 15:04.39 | *** join/#htc-linux rpierce99_ (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 15:06.04 | *** join/#htc-linux MDJ_ru (~MDJ@46.182.128.248) |
| 15:07.15 | Guest82575 | 04 = peek? |
| 15:07.22 | WyrM | y |
| 15:07.33 | Guest82575 | 5 or 3 = poke |
| 15:07.43 | WyrM | 5 |
| 15:15.41 | *** join/#htc-linux MDJ__ru (~MDJ@46.182.128.248) |
| 15:15.47 | WyrM | You should find stuff like: |
| 15:15.49 | WyrM | Copyright (c) 1996-2003 Express Logic Inc. * ThreadX ATMEL/Green Hills Version G4.0b.4.0c |
| 15:15.51 | WyrM | Copyright (c) Broadcom Corp. 2004 BCM2045 (r) Bluetooth Firmware |
| 15:16.34 | Guest82575 | ascii strings? |
| 15:16.45 | Guest82575 | how much do they comment the code...? |
| 15:17.00 | Guest82575 | i thought I would have to be parsing arm assembly |
| 15:17.00 | Guest82575 | haha |
| 15:17.16 | WyrM | You will. lol. |
| 15:17.31 | *** join/#htc-linux kiozen (~kiozen@ppp-93-104-83-228.dynamic.mnet-online.de) |
| 15:17.34 | Guest82575 | lol |
| 15:17.39 | WyrM | how would i know about comments? i dont have source code. |
| 15:18.21 | Guest82575 | well if they put ascii strings in then that's like free information -- practically like a comment |
| 15:18.39 | Guest82575 | like who the hell would actually need that string? |
| 15:18.47 | Guest82575 | ...it's human readable |
| 15:19.06 | Guest82575 | is bcm going to come to my house and check my firmware version...? haha |
| 15:19.15 | WyrM | There is some kind of debug console i guess. |
| 15:19.22 | Guest82575 | Version G4.0b.4.0c? okay good, phew |
| 15:19.29 | Guest82575 | he hasn't been messing with it |
| 15:19.52 | Guest82575 | okaie dokie, I'm going to chuck this function from my hcd file into ida |
| 15:20.02 | Guest82575 | then I'll start rom dumping :) |
| 15:20.11 | WyrM | Fun is how they check if ram contains firmware patches that should be used. |
| 15:20.21 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 15:20.53 | WyrM | its if (strcmp(some-ram-address, "Copy") == 0) |
| 15:21.16 | Guest82575 | serious? |
| 15:22.11 | WyrM | Actually, not strcmp, they compare 32 bits, and these 32 bits are the string "Copy" from "Copyright ..." |
| 15:22.23 | Guest82575 | hahaha |
| 15:25.04 | WyrM | Anyway, hope that you can get started reversing the fw soon. |
| 15:25.35 | WyrM | i still need help mapping some peripherals bits. |
| 15:25.59 | Guest82575 | oh, are you not finished? |
| 15:26.18 | Guest82575 | I would be so definitely up for helping you :) |
| 15:26.31 | Guest82575 | although I might not be good enough haha |
| 15:26.35 | WyrM | no, im not trying to reverse everything. Just the audio port peripheral. |
| 15:26.39 | Guest82575 | me too! |
| 15:26.40 | Guest82575 | haha |
| 15:27.00 | Guest82575 | oh, by everything do you mean you don't care about things like rds or tx? |
| 15:27.41 | WyrM | I don't think you will find much about this in the firmware. |
| 15:28.28 | WyrM | the fm part is a different core connected to the ARM7TDMI via I2C. |
| 15:29.59 | Guest82575 | yes I got that much |
| 15:30.25 | Guest82575 | i am able to do the smbus byte read/write :) |
| 15:31.17 | Guest82575 | but the fw will give clues about how to talk in i2c to the fm core? |
| 15:31.19 | Guest82575 | no? |
| 15:31.39 | WyrM | Yes. |
| 15:32.00 | Guest82575 | prime |
| 15:32.12 | WyrM | There are also some "pseudo registers", which aren't really in the fm core. |
| 15:32.27 | Guest82575 | where are they? |
| 15:32.30 | Guest82575 | bt core? |
| 15:33.11 | WyrM | things like preset stations scan, volume, etc.. |
| 15:33.27 | WyrM | yes, they are in the bt core firmware. |
| 15:35.10 | Guest82575 | oh, does the bt core handle some of the fm functions? |
| 15:38.51 | WyrM | Yes. |
| 15:39.09 | WyrM | It also does audio data conversion, so you can hear fm audio with a bt headset. |
| 15:39.16 | *** join/#htc-linux balans (~server@82-170-217-205.ip.telfort.nl) |
| 15:39.50 | Guest82575 | oh, so it routes sco(?) over the bluetooth radio? |
| 15:40.05 | Guest82575 | crazy |
| 15:40.29 | Guest82575 | is there a chance that my fm antenna is just not connected |
| 15:40.37 | Guest82575 | and all of this is useless |
| 15:41.12 | WyrM | you can tune to a known frequency and check rssi. |
| 15:41.29 | Guest82575 | yes I was getting close to 60db most of the time |
| 15:41.36 | Guest82575 | for a really strong sydney station |
| 15:41.51 | WyrM | then you do have an antenna connected. |
| 15:41.54 | Guest82575 | or at least I wasn't getting the same value the whole time |
| 15:42.18 | Guest82575 | I was thinking of faraday caging it |
| 15:42.26 | Guest82575 | because it jumped around a lot |
| 15:42.39 | Guest82575 | like for a few seconds it would go to 0 then 10 then back to 100% |
| 15:42.55 | Guest82575 | does it do that? |
| 15:43.11 | WyrM | i dont know what you are using to read/convert rssi values. |
| 15:43.14 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-5-5.26-151.libero.it) |
| 15:43.28 | WyrM | its 2's complement, the value the hardware gives you is signed. |
| 15:43.29 | Guest82575 | i was just reading the register as an int8_t |
| 15:43.36 | WyrM | signed 8 bit. |
| 15:43.42 | Guest82575 | straight-up |
| 15:43.47 | Guest82575 | it was jumping around like a bitch |
| 15:44.00 | Guest82575 | I knew it would have to be a signed 8 |
| 15:44.07 | Guest82575 | but I didn't believe it |
| 15:44.15 | WyrM | -60dbm is very good signal. |
| 15:44.32 | Guest82575 | yes but what I'm saying is that |
| 15:45.07 | Guest82575 | it jumped around, like -60 -60 -60 -60 -100 -60 -60 etc |
| 15:45.07 | WyrM | i have audio (and RDS) even when RSSI is -90dbm. |
| 15:45.16 | Guest82575 | oh, okay |
| 15:45.34 | Guest82575 | what's the m for? |
| 15:45.57 | Guest82575 | well the station is way strong |
| 15:46.31 | Guest82575 | 'the fine people of my city need their pop rock in the morning' |
| 15:47.41 | WyrM | m is from mW. |
| 15:48.11 | WyrM | dbm is absolute signal strength, not signal x noise. |
| 15:48.55 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 15:49.05 | Guest82575 | ahh touche |
| 15:49.19 | *** join/#htc-linux LordDeath (~LordDeath@cable-81-173-164-71.netcologne.de) |
| 15:50.07 | Guest82575 | hmmph, I couldn't load my hcd file function |
| 15:50.09 | Guest82575 | into ida |
| 15:50.33 | WyrM | Not all patches are code. |
| 15:50.45 | WyrM | just the ones near the end of ram space. |
| 15:51.25 | Guest82575 | oh, mine starts at 0x86828 |
| 15:51.29 | Guest82575 | not code? |
| 15:52.07 | WyrM | mine starts with 00087410.bin |
| 15:52.14 | WyrM | so, i don't know :) |
| 15:52.32 | WyrM | The ones at 8d000 and higher are code. |
| 15:52.42 | Guest82575 | oh |
| 15:53.04 | *** join/#htc-linux ray|yar (~raymonddu@c-69-245-125-111.hsd1.mi.comcast.net) |
| 15:53.16 | Guest82575 | mine ends around 89156 + 1c - 4 |
| 15:53.24 | Guest82575 | that four is decimal :P |
| 15:53.31 | Guest82575 | lol, not code |
| 15:53.34 | Guest82575 | not code at all! |
| 15:53.42 | Guest82575 | okay, I'm going to dump my rom now, |
| 15:53.51 | WyrM | but you already know how to peek, dump the rom and disasm it. |
| 15:54.05 | Guest82575 | fingers crossed this doesn't write zeroes onto my chi[p |
| 15:54.06 | Guest82575 | haha |
| 15:54.31 | WyrM | Dump ROM and RAM, load both on IDA. |
| 15:54.56 | Guest82575 | yeah okay |
| 15:55.05 | Guest82575 | which version of ida are you using? |
| 15:55.24 | WyrM | Don't know. |
| 15:55.33 | WyrM | its not on this pc. |
| 15:55.35 | Guest82575 | help-> about? |
| 15:55.38 | Guest82575 | oh okay |
| 15:55.40 | Guest82575 | haha |
| 15:55.47 | Guest82575 | 5.2 will be alright? |
| 15:56.00 | WyrM | i guess its ok. |
| 15:56.10 | Guest82575 | i only have the generic arm or arm7a10 or something |
| 15:56.19 | WyrM | all versions (including free) support arm7tdmi. |
| 15:57.35 | *** join/#htc-linux mitsutaka (~mitsutaka@p1227-ipbf3907marunouchi.tokyo.ocn.ne.jp) |
| 15:59.27 | Guest82575 | okay coolies |
| 15:59.29 | *** join/#htc-linux WyrM (~WyrM@unaffiliated/wyrm) |
| 15:59.54 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-5-5.26-151.libero.it) |
| 16:00.19 | *** part/#htc-linux WyrM (~WyrM@unaffiliated/wyrm) |
| 16:00.53 | *** join/#htc-linux WyrM (~WyrM@unaffiliated/wyrm) |
| 16:05.05 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 16:06.07 | *** join/#htc-linux rob_w (~bob@ppp-188-174-41-3.dynamic.mnet-online.de) |
| 16:18.31 | Guest82575 | so dump until e0019? |
| 16:21.48 | *** join/#htc-linux DoerOfThings (~Drew@216.106.50.98.reverse.socket.net) |
| 16:24.27 | WyrM | Guest82575: 256KB of rom, 58KB of ram. |
| 16:24.46 | Guest82575 | is it really that much more convenient for arm processors to work in little endian? |
| 16:25.11 | WyrM | err, 56KB of ram. |
| 16:26.01 | WyrM | Don't know about the endianess, there are processors which can work with both. |
| 16:26.36 | Guest82575 | http://en.wikipedia.org/wiki/Carry_propagation |
| 16:26.56 | Guest82575 | no I was saying the equivalent of "why do we have to learn this" when in a maths class |
| 16:26.57 | Guest82575 | haha |
| 16:27.14 | Guest82575 | apparently it makes adding heaps easier |
| 16:27.25 | Guest82575 | at the expense of being backwards |
| 16:34.16 | *** join/#htc-linux idanfima (~idanfima@bzq-79-183-184-63.red.bezeqint.net) |
| 16:43.48 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 16:44.34 | *** join/#htc-linux skodde (~skodde@ppp-191-211.32-151.iol.it) |
| 16:44.42 | *** join/#htc-linux skodde (~skodde@unaffiliated/skodde) |
| 16:47.31 | WyrM | Guest82575: how is it going? have you dumped the rom? |
| 16:47.36 | Guest82575 | hectic! |
| 16:47.41 | Guest82575 | I am dumping it right now |
| 16:47.51 | WyrM | at 115200? |
| 16:47.57 | Guest82575 | yah |
| 16:48.19 | WyrM | first time i was at 115200 too, lost patience and set it to 3000000 :D |
| 16:48.51 | Guest82575 | should I dump up to 0x07 ff ff |
| 16:48.53 | Guest82575 | ? |
| 16:48.57 | Guest82575 | the start with |
| 16:49.01 | Guest82575 | to start with* |
| 16:49.01 | Guest82575 | ? |
| 16:49.40 | WyrM | if you read anywhere out of mappable bounds it will stop responding to hci commands. |
| 16:50.24 | Guest82575 | wait doesn't ram start at 0x80000 |
| 16:50.36 | WyrM | yes. |
| 16:50.39 | Guest82575 | so rom is up to 0x07ffff? |
| 16:51.12 | WyrM | but rom finishes at 0x0 + 256KB, so 0x0-0x3ffff |
| 16:51.50 | Guest82575 | oh |
| 16:51.51 | Guest82575 | lol |
| 16:52.29 | Guest82575 | yeah I was wondering why you kept saying 0x3ffff |
| 16:52.39 | Guest82575 | and that ram starts at 0x80000 |
| 16:52.57 | WyrM | there are holes. :) |
| 16:52.59 | Guest82575 | is there anything in betweem? |
| 16:53.01 | Guest82575 | haha |
| 16:53.07 | *** join/#htc-linux GlemSom (~glemsom@0x5da34bca.cpe.ge-1-1-0-1105.sdnqu1.customer.tele.dk) |
| 16:53.08 | Guest82575 | nah |
| 16:53.20 | Guest82575 | that's called 'extra disk space' |
| 16:53.23 | WyrM | I think not, trying to read 0x40000 freezes the chip |
| 16:53.35 | Guest82575 | might freeze your chip |
| 16:53.36 | WyrM | it needs a reboot then. |
| 16:53.43 | Guest82575 | mine's not a pussy |
| 16:53.44 | Guest82575 | :P |
| 16:53.57 | WyrM | lol. |
| 16:54.06 | Guest82575 | i actually really like this line of work |
| 16:54.30 | Guest82575 | i can't believe you get paid for it! |
| 16:54.36 | Guest82575 | I want someone to pay me to do this haha! |
| 16:54.54 | Guest82575 | imagine job ads of the future: "hackers wanted" |
| 16:54.58 | *** join/#htc-linux raymonddull (~raymonddu@c-69-245-125-111.hsd1.mi.comcast.net) |
| 16:56.28 | Guest82575 | how long will it take at 115200 and waiting 5ms between peeks? |
| 16:56.48 | WyrM | omg, no idea. probably lots of time. :D |
| 16:57.05 | Guest82575 | hang on |
| 16:57.10 | Guest82575 | when it's not 3 am |
| 16:57.14 | WyrM | it takes 4 minutes at 3000000, with no delay. |
| 16:57.14 | Guest82575 | I'm a mathematician |
| 16:57.20 | Guest82575 | lets work this shit out |
| 16:57.44 | Guest82575 | (i figured i should delay because I was having some problems with my writes back to back) |
| 16:57.54 | Guest82575 | just to be safe on the first dumping haha |
| 16:58.41 | Guest82575 | 262143 read writes, and each one takes 5-10ms |
| 16:59.25 | Guest82575 | fudge |
| 16:59.32 | Guest82575 | 43 minutes |
| 17:01.22 | WyrM | Ohh, you are really reading it :) |
| 17:01.39 | WyrM | I didn't say how many bytes peek returns. |
| 17:01.58 | Guest82575 | Copy |
| 17:01.59 | Guest82575 | Copyright (c) Broadcom Corp. 2004 BCM2045 (r) Bluetooth Firmware 0123.4567 |
| 17:02.04 | Guest82575 | so past that |
| 17:02.06 | Guest82575 | :P |
| 17:02.17 | WyrM | Great! |
| 17:02.20 | WyrM | Congrats. |
| 17:02.25 | Guest82575 | lol, this is all you |
| 17:04.22 | Guest82575 | I'm going to change speeds (i can't get 3 mill because my cfsetspeed is weird and I haven't had to do anything that fast anyway haha) and also I'm going to change the delay |
| 17:04.31 | Guest82575 | then I'll get back to you :) |
| 17:06.32 | WyrM | Ok. You will want faster speeds because its easier to do multiple peripheral space dumps to figure what the bits are for. |
| 17:06.43 | WyrM | It's not always clear from looking at the code. |
| 17:07.33 | *** join/#htc-linux Berger (~noreply@90.149.127.254) |
| 17:11.47 | *** join/#htc-linux mitsutaka (~mitsutaka@p1227-ipbf3907marunouchi.tokyo.ocn.ne.jp) |
| 17:16.55 | *** join/#htc-linux nIghtorius (~nIghtoriu@5ED559D8.cm-7-6b.dynamic.ziggo.nl) |
| 17:30.46 | Guest82575 | hectic |
| 17:45.10 | *** join/#htc-linux arrrghhh (~arrrghhh@unaffiliated/arrrghhh) |
| 17:49.03 | *** join/#htc-linux swc|666 (~gecko@unaffiliated/swc666/x-4934821) |
| 18:04.26 | *** join/#htc-linux idanfima (~idanfima@bzq-79-183-184-63.red.bezeqint.net) |
| 18:08.21 | Guest82575 | rrr |
| 18:08.26 | Guest82575 | this is actually a problem |
| 18:08.39 | Guest82575 | cfsetspeed can't do 3000000 |
| 18:09.53 | *** join/#htc-linux idanfima_ (~idanfima@80.250.146.44) |
| 18:18.35 | Guest82575 | in fact it can't do more than 460800... this is a problem |
| 18:18.37 | Guest82575 | hmmph |
| 18:18.46 | Guest82575 | I think I'll look into it tomorrow haha |
| 18:18.50 | Guest82575 | I'm going to bed! |
| 18:24.50 | *** join/#htc-linux vw (4463ed13@gateway/web/freenode/ip.68.99.237.19) |
| 18:25.12 | *** join/#htc-linux idanfima (~idanfima@80.250.146.44) |
| 18:33.57 | *** join/#htc-linux idanfima_ (~idanfima@bzq-79-176-184-251.red.bezeqint.net) |
| 18:39.06 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 18:44.21 | *** join/#htc-linux ORi| (~ORi@91.181.90.254) |
| 18:56.58 | *** join/#htc-linux Segnale007 (~Segnale00@ppp-5-5.26-151.libero.it) |
| 19:01.23 | *** join/#htc-linux arrrghhh_ (~arrrghhh@c-24-9-150-163.hsd1.co.comcast.net) |
| 19:01.48 | *** join/#htc-linux arrrghhh (~arrrghhh@unaffiliated/arrrghhh) |
| 19:05.17 | *** join/#htc-linux Ham3r (~chatzilla@public141454.cdma.centertel.pl) |
| 19:10.48 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 19:11.24 | *** join/#htc-linux Refuge (refuge@ppp-99-14-99-237.dsl.ipltin.sbcglobal.net) |
| 19:35.11 | *** join/#htc-linux helicopter88 (~helicopte@host51-95-dynamic.2-79-r.retail.telecomitalia.it) |
| 19:47.05 | *** join/#htc-linux MDJ_ru (~MDJ@46.182.128.248) |
| 19:50.38 | *** join/#htc-linux tomaw (tom@freenode/staff/tomaw) |
| 19:59.40 | *** join/#htc-linux T-Junk (C7xx@f147035.upc-f.chello.nl) |
| 20:49.02 | *** join/#htc-linux mastermerlin (~Adium@pD9E2E62F.dip.t-dialin.net) |
| 20:51.14 | *** join/#htc-linux [acl] (~abel@96.246.167.90) |
| 20:52.50 | *** join/#htc-linux infernix (nix@unaffiliated/infernix) |
| 20:52.53 | *** join/#htc-linux WyrM (~WyrM@unaffiliated/wyrm) |
| 21:19.42 | *** join/#htc-linux furtardo (~mks@nat/yahoo/x-cggviwyhcnsflkps) |
| 22:07.59 | *** join/#htc-linux emwe (~emwe@cable-86-56-10-158.cust.telecolumbus.net) |
| 22:12.04 | *** join/#htc-linux gauner1986 (~Miranda@ip-109-91-240-23.unitymediagroup.de) |
| 22:28.49 | *** join/#htc-linux Berger (~noreply@90.149.127.254) |
| 22:41.59 | *** join/#htc-linux Berger (~noreply@90.149.127.254) |
| 23:14.19 | *** join/#htc-linux idanfima (~idanfima@46.210.240.216) |
| 23:21.37 | *** join/#htc-linux rpierce99 (~rpierce99@96-42-102-103.dhcp.stcd.mn.charter.com) |
| 23:27.17 | *** part/#htc-linux Alex[sp3dev] (~alexander@86.110.163.19) |
| 23:31.36 | *** join/#htc-linux eval- (~eval@a-trix.net) |
| 23:40.25 | *** join/#htc-linux programmer8922 (~Evan@67.219.164.162) |