| 00:05.18 | *** join/#openezx ljp (n=lpotter@203.94.178.46) |
| 01:06.56 | *** join/#openezx proberts (n=proberts@cpe-76-167-78-52.socal.res.rr.com) |
| 01:18.50 | *** join/#openezx kenws_ (n=ken@dslb-088-064-138-149.pools.arcor-ip.net) |
| 04:10.27 | *** join/#openezx proberts (n=proberts@cpe-76-167-78-52.socal.res.rr.com) |
| 04:10.45 | proberts | nh_home: Are you still up? |
| 04:10.57 | nh_home | proberts: for a little bit.. What's up? |
| 04:12.42 | proberts | I confirmed that the rc.d script that calls ac_getflexbit is calling the same function in the kernel module, and also some part of the policy in acpolicy.cfg is baked into the build (inodes) |
| 04:12.56 | nh_home | proberts: aha! |
| 04:13.27 | nh_home | proberts: so is the /etc/ac_policy.cfg file use at all? |
| 04:14.06 | proberts | I'm still looking to see which lines in the two flex files controls turing security on and off. It would be easy to hack the ac_getflexbit if we had +w access :P |
| 04:14.28 | proberts | I don't think so from the kernel module. |
| 04:14.51 | nh_home | I assume this means the source for their module is different? |
| 04:16.21 | proberts | oh - wait a sec... my mistake. The have their own "fopen" local to the module. |
| 04:17.08 | nh_home | oh! now that you mention it I remember seeing that. |
| 04:17.30 | proberts | Right now I'm writing a module to see if I can "rw" open any of the protected files. |
| 04:18.33 | nh_home | proberts: on an alternate front, it looks like some people are having some success extracting from mtd and producing backup firmware. |
| 04:18.43 | proberts | nice. |
| 04:19.00 | nh_home | proberts: and editing it. |
| 04:20.54 | proberts | Nice. |
| 04:21.01 | proberts | Any info link? |
| 04:21.24 | nh_home | http://rokre2.jconserv.net/viewtopic.php?t=209 |
| 04:22.10 | nh_home | that's part of it, but in another thread I saw reference to "backing up" the current firmware on the phone. |
| 04:23.17 | nh_home | If I understand correctly, the smg files may actually be 1-to-1 mappings of the mtd devices. |
| 04:23.30 | nh_home | I need to read more about it though. |
| 04:24.50 | proberts | cool. Thanks. |
| 04:25.09 | nh_home | no problem, it's the least I could do after all the hacking you've been doing. :) |
| 04:25.38 | proberts | yeah - well... it's a lot more fun than what I'm really supposed to be doing |
| 04:25.40 | proberts | :P |
| 04:25.47 | nh_home | heh, good. ;) |
| 04:26.13 | proberts | The .bin files inside the sbf files are 1:1 mappings. |
| 04:27.27 | nh_home | http://rokre2.jconserv.net/viewtopic.php?t=214 |
| 04:27.53 | nh_home | it looks like someone wrote a program that can dump the smg files from the phone. |
| 04:28.32 | proberts | So if I make a module that can "rw" a file, what do you think would be the best way to disable the policy? I'm thinking RE the flexbit file and change the setting there. Another option would be to comment out the call to ac_getflexbit and hope the default is "disabled", or write a replacement command that the script calls that forces the disable call. |
| 04:29.29 | proberts | there's "unsbf" that's part of ezxflash. I can't remember where I got it from, but Stefan pointed me to it. I was able to make a modded rootsf, but I could only find a 45P flash file, not a 33P or 38P. |
| 04:29.59 | nh_home | ah |
| 04:30.25 | proberts | It was what I used along with the 45P flash file to get the flash data posted on the wiki. |
| 04:31.05 | nh_home | proberts: regarding the best way to disable the policy, I think we have multiple options. If ac_policydb_read doesn't succeed (ie it goes to "bad:"), ac_policy_init never gets set. |
| 04:31.15 | nh_home | well, it never gets set to 1 that is. |
| 04:32.02 | proberts | hmmm... when I just ran /etc/ac_getflexbit, it says it's disabled. |
| 04:32.26 | nh_home | that's one route. ac_policy_init appears to be set to 1 by default so unless you think we can get the syscall to work it won't be useful. |
| 04:32.39 | nh_home | s/ac_policy_init/ac_policy_enable |
| 04:33.11 | nh_home | proberts: huh, let me hook up my phone |
| 04:34.23 | proberts | Another option is to hijack open and replace the security struct in the inode |
| 04:36.08 | nh_home | proberts: I was looking at discussions about doing that. Would you need to overwrite via /dev/kmem or can you do it through a module? |
| 04:36.20 | proberts | module |
| 04:36.35 | nh_home | that's convenient |
| 04:36.45 | jonwil | thats one of the brillaint things about linux |
| 04:37.08 | jonwil | if you can load a kernel module, you can overcome just about any security |
| 04:37.43 | jonwil | which is good for us :) |
| 04:37.47 | jonwil | not so good for motoroal :P |
| 04:37.48 | proberts | yeah - I'm sure the next verison Motorola puts out will have insmod -x |
| 04:37.55 | nh_home | proberts: what route do you think is best to try first? |
| 04:38.28 | proberts | I'm going to see if I can make a module open a protected file in rw mode. |
| 04:39.10 | proberts | If I can do that, we can figure out what would be best to mod. If not, it means going to something harder |
| 04:40.33 | nh_home | proberts: btw, someone is claiming they have a hacked firmware from one of the modders out there with "777 root access". If that's true, we might be able to find out what they did. |
| 04:46.10 | proberts | hmmm... have they posted anything? There was some guy I saw saying he'd edited the seem file to make his LEDs turn on blue. |
| 04:46.19 | proberts | (which is probably b.s.) |
| 04:47.07 | nh_home | proberts: nothing yet. We'll see I guess. |
| 04:47.43 | jonwil | Can we replace the kernel somehow yet? |
| 04:47.49 | proberts | It shouldn't be hard to change the magic number in the acpolicy.cfg file and bork the read. |
| 04:48.07 | nh_home | proberts: yeah, I was thinking that might not be a bad option. ;) |
| 04:48.13 | proberts | if my mod can rw it, maybe that's what I'll try first. |
| 04:48.56 | nh_home | proberts: Just so long as it doesn't do anything nasty when ac_policydb_read returns -1. |
| 04:53.00 | nh_home | the only place in the motoac source that loads the policy is ac_load_policy which is only called by ac_post_mountroot. |
| 05:03.07 | nh_home | well, I'm heading to bed. Good luck! |
| 05:03.42 | proberts | thanks :) later... I'll tell you what happens tomorrow |
| 05:48.57 | *** join/#openezx _dion_ (n=dionua@xen.inhex.net) |
| 08:16.32 | Hopscotch | good morning |
| 08:29.30 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 08:39.54 | ao2 | alphaone, I tried to boot my own 2.4 kernel bit I always get the message "TAPI server disconnect" also with mux_cli enabled in kernel. I am on A780. |
| 09:26.26 | alphaone | ao2: Does the phone turn off after 1.5mins? |
| 09:26.55 | stefan_schmidt | hi all |
| 09:27.03 | alphaone | hi |
| 09:27.14 | jonwil | hi all |
| 09:27.15 | stefan_schmidt | ao2: You booted the kernel over usb, right? |
| 09:27.18 | stefan_schmidt | hi jonwil |
| 09:27.19 | alphaone | stefan_schmidt: home or work? |
| 09:27.21 | stefan_schmidt | hi alphaone |
| 09:27.30 | stefan_schmidt | alphaone: home |
| 09:27.34 | alphaone | kay |
| 09:28.18 | stefan_schmidt | ao2: BP in flash mode should be the reason aof your TAPI server disconnect |
| 09:28.24 | alphaone | Right. If you boot over USB we don't have any possibility to reset the bp |
| 09:28.39 | alphaone | ^^ What he says :-) |
| 09:29.28 | stefan_schmidt | alphaone: This would be interesting, too. But later. |
| 09:29.54 | alphaone | Actually it would be much more interesting right now... |
| 09:30.17 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 09:30.23 | ao2 | alphaone, the screen gets black but the phone is up and running, I can access the usb storage, for example |
| 09:30.38 | ao2 | and yes, I booted via usb |
| 09:31.58 | jonwil | unless we find a way to properly "reboot" the BP in non flash mode from the AP, booting from a USB kernel wont be possible |
| 09:31.58 | alphaone | ao2: We don't have any possibility to reset the BP and when booted via USB it is in flash mode so normal communication with BP is not possible |
| 09:34.09 | ao2 | ok, I see. |
| 09:38.32 | jonwil | are you sure there is no way to signal PCAP to reboot BP or something? |
| 09:39.32 | stefan_schmidt | jonwil: We can not be sure. We just found no way until now. |
| 09:39.38 | jonwil | ok |
| 09:39.50 | stefan_schmidt | jonwil: I hope this will change some time. |
| 09:48.01 | *** join/#openezx proberts (n=proberts@cpe-76-167-78-52.socal.res.rr.com) |
| 09:50.40 | ao2 | now I'mtrying to build a 2.4 kernel with mmc driver, just to see if we can start opie from external flash with it |
| 09:51.26 | proberts | nh_work: You're not going to believe this, and I feel like total idiot. I think that first module I sent you actually does work to disable selinux, but the reason it didn't appear to do anything for the fs (and I feel totally stupid for missing this) is that root is cramfs, and cramfs (unlike jffs) is read-only (even though is says it's mounted rw... the inodes f_opts don't return a write property) |
| 09:52.10 | stefan_schmidt | ao2: Keep us informed about your work |
| 09:52.17 | proberts | nh_work: If there's any good news, it's that I can probably write a 100% user-space solution, instead of needing a module. |
| 09:52.44 | stefan_schmidt | proberts: That sounds really cool.. |
| 09:52.46 | proberts | hi stefan |
| 09:53.05 | stefan_schmidt | hi proberts |
| 09:53.36 | proberts | stefan_schmidt: Yeah-- but it's retarded I've been working for like 3 days on all sorts of crazy module/kernel hacking and missed something so simple! |
| 09:53.37 | proberts | :P |
| 09:54.06 | stefan_schmidt | proberts: :( |
| 09:54.18 | stefan_schmidt | proberts: You're not alone... |
| 09:54.22 | *** join/#openezx florian_kc (n=fuchs@dns.kernelconcepts.de) |
| 09:54.24 | proberts | :P |
| 09:54.35 | alphaone | proberts: We had some of these moments, too... |
| 09:55.05 | proberts | well, at least I can get back to what I'm supposed to be doing, which is finding a way without Qt/ezx to grab keypad input |
| 09:55.23 | proberts | ...and I learned a lot about kernel hacking :) |
| 09:55.24 | alphaone | proberts: Good luck |
| 09:55.26 | alphaone | :-) |
| 09:56.40 | proberts | alphaone: thanks :) |
| 09:56.57 | florian_kc | good morning |
| 09:57.11 | proberts | anyway... 2am here... later :) |
| 10:00.14 | stefan_schmidt | hi florian_kc |
| 10:04.39 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 10:34.33 | jonwil | I think the biggest problem affecting the OpenEZX project is a lack of time |
| 10:35.11 | florian_kc | jonwil: well... isn't that the problem of all projects? |
| 10:35.35 | florian_kc | but i just found out that it is quite likely that i have a little bit time to help soon |
| 10:52.23 | stefan_schmidt | florian_kc: Good to hear. kernelconcepts found a interested customer? |
| 10:53.31 | florian_kc | stefan_schmidt: not really, but we know people interested in cellphones in general of course. |
| 10:53.42 | stefan_schmidt | florian_kc: ok :) |
| 10:55.55 | florian_kc | stefan_schmidt: it is quite unlikely to find someone who pays for this kind of stuff... but once it is working and we show that open source is good for the complete cellphone software stack more people might get interested. |
| 11:01.03 | stefan_schmidt | florian_kc: Yes, it is unlikely, but there are still nice companies out there. The work on mux_cli is sponsored by the openezx developer found. |
| 11:01.52 | florian_kc | stefan_schmidt: yes sure... |
| 11:02.29 | florian_kc | stefan_schmidt: that's good - of course this is something which is very important for future projects |
| 11:02.47 | stefan_schmidt | florian_kc: yes |
| 11:02.48 | jonwil | I hope that some manufacturer out there (preferably one with a good phone chipset) sees the value in producing a phone that is as open as it is legally possible to make it |
| 11:03.53 | stefan_schmidt | jonwil: Yes, I hope some things will change after the Neo1973 release of FIC. |
| 11:04.01 | jonwil | FIC is? |
| 11:04.03 | stefan_schmidt | jonwil: Future will tell. |
| 11:04.24 | stefan_schmidt | jonwil: http://openmoko.com/press/index.html |
| 11:05.07 | jonwil | yeah. |
| 11:05.34 | stefan_schmidt | jonwil: It could be interesting how other companies react on this step. |
| 11:05.45 | jonwil | I think other companies wont do that much |
| 11:06.09 | jonwil | I dont see it being much of a threat to Nokia, Motorola, Errikson etc |
| 11:06.30 | stefan_schmidt | jonwil: They would not start such a project, but perhaps use openmoko to save money for development. |
| 11:06.40 | jonwil | maybe |
| 11:07.10 | stefan_schmidt | jonwil: It rumors Nokia already plays with linux on thier phones in the labs... |
| 11:07.19 | jonwil | But it is not in the best interests of the companies like motorola to have a phone that is that open |
| 11:07.31 | stefan_schmidt | jonwil: No idea about Motorola and Errikson. |
| 11:07.43 | stefan_schmidt | jonwil: Why? |
| 11:07.51 | jonwil | For one thing, carriers like phones that are closed |
| 11:07.56 | jonwil | especially in america |
| 11:08.12 | stefan_schmidt | jonwil: GSM stack is closed. |
| 11:08.33 | jonwil | they like to be able to prevent ringtone loading onto the phone to preserve their SMS ringtone monopoly for example |
| 11:08.34 | stefan_schmidt | jonwil: They just added a PDA to the phone with some glue. |
| 11:09.14 | stefan_schmidt | jonwil: OK ringtone is a market, but downloading new applications over GPRS is also a market. |
| 11:09.23 | jonwil | true |
| 11:09.40 | stefan_schmidt | jonwil: And most phones already support mp3 ringtones uploaded with bluetooth, etc... |
| 11:09.56 | jonwil | but carriers (Verizon is notorious for this) disable such features |
| 11:10.47 | stefan_schmidt | jonwil: It is of course not without risk for FIC doing such s step. I'm very thankfull for Sean getting his company to doing this step. |
| 11:11.23 | stefan_schmidt | jonwil: They brand the phones not to be able to use selfmade ringtones? wow |
| 11:11.45 | jonwil | no basicly they disable bluetooth obex through FLEX |
| 11:11.53 | stefan_schmidt | ouch |
| 11:12.02 | jonwil | Hey, verizon are evil |
| 11:12.06 | stefan_schmidt | heh |
| 11:12.28 | jonwil | I have never experienced them |
| 11:12.28 | stefan_schmidt | s/ion/in/ |
| 11:12.40 | jonwil | Just going based on what people online have said |
| 11:12.53 | jonwil | Ntt DoCoMo of japan is supposedly just as bad |
| 11:13.00 | jonwil | thankfully none of the australian carriers are that bad |
| 11:13.33 | jonwil | The only vaguely evil thing that Telstra (the carrier I am with) has done is subsidy locking their prepaid phones |
| 11:13.43 | jonwil | network lock I mean |
| 11:13.58 | stefan_schmidt | jonwil: That's the same here. |
| 11:14.04 | jonwil | but considering how they give you a nice discount compared to RRP, its not an issue |
| 11:14.20 | jonwil | plus I think they will unlock it for a fee or if you are with them for long enough |
| 11:14.26 | jonwil | and spend enough recharge credit |
| 11:14.57 | stefan_schmidt | Sorry, have to go. University is calling. |
| 11:16.46 | jonwil | cya |
| 11:31.37 | *** join/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 13:19.42 | *** join/#openezx blkhawk[work] (n=blkhawk@IP-213157024141.dialin.heagmedianet.de) |
| 13:51.44 | nh_work | proberts: doh! That makes perfect sense. Can you tell if it was enabled in the first place? I'm having trouble finding a good test case. |
| 14:07.15 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 14:35.43 | *** join/#openezx agd5f (n=DeucherA@65.242.105.130) |
| 15:45.47 | *** join/#openezx kenws (n=ken@dslb-088-064-138-149.pools.arcor-ip.net) |
| 16:40.38 | *** join/#openezx leoncamel (n=leoncame@219.142.137.2) |
| 16:58.52 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 17:07.50 | *** part/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 18:22.19 | *** join/#openezx vmaster_ (i=vmaster@p549B7F70.dip.t-dialin.net) |
| 18:44.25 | *** join/#openezx TimRiker (n=timr@216.49.181.128) |
| 18:47.11 | florian_kc | bbl |
| 18:55.15 | *** join/#openezx proberts (n=proberts@rrcs-64-183-51-174.west.biz.rr.com) |
| 18:56.25 | *** join/#openezx nh_work (n=nh@aurora.msi.umn.edu) |
| 18:56.43 | proberts | nh_work: Hi |
| 18:57.13 | proberts | nh_work: Did you happen to catch my post last night (after you were afk)? |
| 18:57.29 | nh_work | proberts: yeah, doh! :) |
| 18:57.38 | nh_work | proberts: I saw it this morning |
| 18:58.01 | nh_work | I tried to see if I could find a test case to even tell if the security is on by default. |
| 18:58.17 | proberts | nh_work: So I'll code up a user space app to disable/enable the policy. |
| 18:58.24 | proberts | nh_work: It appears to be off by default. |
| 18:58.48 | proberts | nh_work: At least ac_getflexbit reports that it |
| 18:59.01 | nh_work | proberts: Do you have the library it needs? |
| 18:59.04 | proberts | nh_work: At least ac_getflexbit reports that it's off. I'm going to look closer at the disassem to make sure |
| 18:59.28 | proberts | yeah - you have to 'export LD_LIBRARY_PATH /usr/lib/ezx/lib' before running it |
| 19:00.06 | nh_work | ah |
| 19:01.10 | nh_work | heh, "disable AC!!" |
| 19:01.56 | nh_work | proberts: alright, so from what I've read it sounds like we won't be writing to cramfs any time soon. |
| 19:02.14 | nh_work | at least not to a mounted cramfs filesystem. |
| 19:02.17 | proberts | yeah - no write methods in the driver |
| 19:02.27 | proberts | Although we can create our own. |
| 19:03.52 | nh_work | proberts: I wonder if we'd get enough compression to move certain parts of the system to jffs2. |
| 19:05.02 | proberts | I think it may be possible to make an app that flashes parts of the phone's flashmem from image files on the SD card... so an OpenEZX dist could just be untgz'ed to a cf card and inserted into the phone, run the 'install' app, and reboot with OpenEZX installed. |
| 19:06.02 | proberts | nh_work: Probably. There's a few things that could be discarded from the rootfs to make a little extra room. |
| 19:09.02 | nh_work | proberts: Maybe we can get Harald to be a guinea pig with his E2. ;) |
| 19:09.40 | proberts | :P Yeah - I won't be able to flash anything to mine since I need a clean factory phone. |
| 19:11.34 | nh_work | proberts: Seems so bizarre that moto would ship a disabled access control system and leave the keys to the kingdom basically laying around for us to play with. |
| 19:11.35 | proberts | nh_work: BTW- if Motorola do try to increase the selinux protection, I have a module now that hijacks all the policy vectors and always returns permission granted for any request. |
| 19:12.38 | nh_work | They didn't have much choice about giving us the source code, but the rest is just odd. |
| 19:12.48 | nh_work | I guess it wasn't that much of a priority for them. |
| 19:13.19 | nh_work | proberts: that's nice. We'll have to see what they do if the E2 comes out in the US. |
| 19:13.38 | nh_work | That might still have a lot of use. |
| 19:13.53 | proberts | Yeah - I never would have guessed they would have put all the policy stuff into the system then not bothered to turn it on. (Although it would have save a lot of time if I'd just checked that to start with :P ) |
| 19:15.57 | nh_work | proberts: heh. Live and learn I guess. In some ways, getting around motoac seemed less hairy than copying the cramfs imagse to jffs2. :) |
| 19:49.09 | nh_work | proberts: do you mind if I post about your findings on some of the E2 forums? |
| 19:49.42 | nh_work | (specifically motoac being off, and about cramfs being read-only). |
| 19:50.09 | proberts | No, I was going to update the wiki tonight as well. |
| 19:55.24 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 20:17.31 | *** join/#openezx proberts (n=proberts@rrcs-64-183-51-174.west.biz.rr.com) |
| 20:19.29 | *** join/#openezx alphaone_ (n=daniel@c120.apm.etc.tu-bs.de) |
| 20:23.10 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 20:24.04 | *** join/#openezx Shoragan (n=shoragan@datenfreihafen.org) |
| 20:24.11 | *** join/#openezx stefan_schmidt (n=stefan@datenfreihafen.org) |
| 20:24.26 | *** join/#openezx alphaone (n=daniel@datenfreihafen.org) |
| 20:44.01 | proberts | stefan_schmidt: I have a ida file started for tapisrv if you want it |
| 20:56.35 | stefan_schmidt | proberts: Thanks for the offer. We will start with capturing the usb traffic. This should be enough. If not I contact you again. |
| 20:59.04 | |dion| | stefan_schmidt: using ipclog kernel module? |
| 21:00.58 | stefan_schmidt | |dion|: Yes, that's the idea. |
| 21:03.34 | |dion| | i tried only to sniff userspace traffic between tapisrv and client apps |
| 21:04.30 | stefan_schmidt | |dion|: ok |
| 21:04.36 | proberts | |dion| over the udp sockets? |
| 21:05.10 | stefan_schmidt | |dion|: But I don't plan to be backwards compatible with the motorola software. |
| 21:05.57 | proberts | stefan_schmidt: If you guys are correct, I should be able to kill tapisrv and the phone will shut down in ~60 seconds? |
| 21:06.06 | stefan_schmidt | proberts: Yes |
| 21:07.09 | proberts | hmmm... I've killed tapisrv before but I don't think it shut down. |
| 21:07.21 | |dion| | proberts: UNIX socket |
| 21:07.22 | stefan_schmidt | proberts: hmm, you are sure it don't came back? |
| 21:07.47 | proberts | I can try it again tonight. I was trying to find which proc had the /dev/keypad0 open |
| 21:08.05 | stefan_schmidt | proberts: There could be one other reason. Perhaps tapisrv don't send a keep alive, but makes a special init with the BP. |
| 21:08.28 | stefan_schmidt | proberts: Then it would stay alive after init and without tapisrv. |
| 21:09.21 | proberts | stefan_schmidt: I can check if there's anything periodically sent in the disassembly |
| 21:10.05 | stefan_schmidt | proberts: That could de interesting. |
| 21:13.54 | proberts | all: anyone know of an IDA-like RE tool under Linux? |
| 21:14.05 | Hopscotch | ida is available for linux |
| 21:14.15 | Hopscotch | and windows ida can read elf-files |
| 21:14.18 | vmaster | objdump |
| 21:14.31 | proberts | Sorry, a free/open-source tool under linux |
| 21:15.04 | stefan_schmidt | hi vmaster |
| 21:15.10 | vmaster | hey stefan_schmidt |
| 21:15.13 | Hopscotch | ah, ok - then objdump, grep, vi... |
| 21:15.27 | stefan_schmidt | vmaster: You found anything else usefull in our logfiles? |
| 21:15.46 | vmaster | 20:34 < vmaster> stefan_schmidt: not really, the logs look fine - i.e. all the usb commands sent are ok, but the jtag communication seems to fail |
| 21:15.50 | vmaster | 20:35 < vmaster> stefan_schmidt: that might be because of the reset circuitry on the phone, or because of the transmission lines |
| 21:15.54 | vmaster | 20:36 < vmaster> stefan_schmidt: you could try with a very low speed (e.g. jtag_speed 50) and large reset delays (e.g. jtag_n[st]rst_delay 5000) |
| 21:15.55 | stefan_schmidt | vmaster: I'm still interested in JTAG even if we don't need it for the mux_cli problem right now. |
| 21:15.56 | proberts | thanks.... I want to code some simple GUI wrapper for objdump/readelf so I don't have to keep dual-booting into windows for ida :P |
| 21:16.20 | vmaster | proberts: if you have no problems with non-open tools, ida runs fine under wine |
| 21:16.25 | stefan_schmidt | vmaster: Ah, sorry. I did not get this. |
| 21:17.14 | proberts | vmaster: Really? cool - I'll give that a shot. (Although IDA doesn't handle the ARM ELF files as good as it could) |
| 21:17.14 | vmaster | stefan_schmidt: the first check that fails is the first access to one of the xscale specific registers (DCSR) |
| 21:17.30 | stefan_schmidt | vmaster: Next time I'm at the phone I'll try this. |
| 21:17.58 | vmaster | stefan_schmidt: i've checked every usb command sent up to the failure, and everything is as it should be |
| 21:18.32 | vmaster | stefan_schmidt: it's just that apparently the DCSR instruction isn't loaded correctly, or that the Shift-DR state isn't reached correctly |
| 21:19.24 | stefan_schmidt | vmaster: OK, thanks. I' ll report after my tests. |
| 21:19.59 | stefan_schmidt | ~lart my bouncer for not displaying vmaster's messages. |
| 21:27.59 | *** join/#openezx _dion_ (n=dionua@xen.inhex.net) |
| 21:40.26 | ao2 | hey stefan_schmidt, I am playing with my own 2.4 kernel booted over usb, I'm using it over 30 minutes and the phone does not shut down completely. I am using it via telnet, indeed the touchscreen got blank, but the phone is up... (I managed to get the shell before the ts went black). |
| 21:40.49 | ao2 | still no luck in booting from mmc |
| 21:41.06 | ao2 | hemm, I mean mount rootf from mmc |
| 21:42.22 | stefan_schmidt | ao2: Yeah, I has the same experience. Never tried SD on 2.4 |
| 21:42.24 | ao2 | obviously tapisrv does not work, but I want to point out that the phone does not halt |
| 21:43.37 | stefan_schmidt | ao2: k |
| 21:44.08 | ao2 | I made a small patchset for 2.4.20 from opensource.motorola.com, so to have mux_cli and mmc driver integrated. I'll post it later |
| 21:52.19 | *** join/#openezx jim_rayner (n=jim_rayn@beyondvoice.plus.com) |
| 21:56.16 | stefan_schmidt | ao2: Nice. Make sure you cc mickey_away on this mail as he think about a 2.4 oe bb file. |
| 21:56.19 | stefan_schmidt | hi jim_rayner |
| 21:56.50 | jim_rayner | hi stefan_schmidt |
| 21:57.33 | jim_rayner | I've just read the log, interesting bet with alphaone :) |
| 22:28.15 | *** join/#openezx jamesmck (n=james@gimel.esc.cam.ac.uk) |
| 22:32.22 | *** join/#openezx ljp_ (n=lpotter@203.94.178.46) |
| 22:37.24 | *** join/#openezx robtaylor (n=robtaylo@dhansak.collabora.co.uk) |
| 22:47.04 | *** join/#openezx nevarrie_ (n=jgrant@CPE-24-163-233-209.kc.res.rr.com) |
| 22:47.04 | *** join/#openezx SuN (i=unices@ip5652ade4.speed.planet.nl) [NETSPLIT VICTIM] |
| 23:02.37 | *** join/#openezx nevarrie_ (n=jgrant@CPE-24-163-233-209.kc.res.rr.com) [NETSPLIT VICTIM] |
| 23:03.09 | *** join/#openezx SuN (i=unices@ip5652ade4.speed.planet.nl) [NETSPLIT VICTIM] |
| 23:04.25 | *** join/#openezx jonwil (n=jonwil@220-245-202-116-wa-pppoe.tpgi.com.au) |