IRC log for #openezx on 20080309

00:46.11*** part/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de)
02:11.10jonwildamnit, why wont my java apps work :(
02:35.22*** join/#openezx mib_zhf8id0v (i=bd54c101@gateway/web/ajax/mibbit.com/x-158ff9dc80ee3f21)
03:00.13jonwilYAY, java works again
03:43.54jonwilbut now my phonebook is being wierd. gaah :(
04:00.59*** join/#openezx purl_ (i=ibot@pdpc/supporter/active/TimRiker/bot/apt)
04:00.59*** topic/#openezx is OpenEZX Developer Lounge -- Open Source Software Stack for Motorola EZX phones -- http://openezx.org
04:24.54jonwilYAY, everything is back to normal :)
06:37.47*** join/#openezx yansa (n=yans@host-89-230-211-114.lublin.mm.pl)
06:40.37*** join/#openezx naWel (n=nawel@190.9.13.180)
06:41.15naWelhi
06:43.08naWeli'm trying to install OpenEzx in my a1200,,, what kernel and rootfs image i need?
06:58.28naWelalphaone
06:59.31*** join/#openezx par_ (i=par@dipole.idlepattern.com)
07:00.18naWelpar_
07:00.26naWelpar
07:00.36naWeli'm trying to install OpenEzx in my a1200 what kernel and rootfs image i need
07:01.42*** join/#openezx Hopscotch (n=cd@touchdown.maintech.de) [NETSPLIT VICTIM]
07:02.04*** join/#openezx tombhadAC (n=tombhad@pD95DF577.dip.t-dialin.net)
07:02.04*** join/#openezx agd5f (n=alex@c-69-143-24-183.hsd1.va.comcast.net) [NETSPLIT VICTIM]
07:02.05*** join/#openezx mickey_away (i=mickey@srv043.dedi23.de) [NETSPLIT VICTIM]
07:06.50*** join/#openezx drath (i=vmaster@p5B07D136.dip.t-dialin.net)
08:23.42Hopscotchgood morning
08:47.42*** join/#openezx Gottox (n=Gottox@s01.de)
09:10.54*** join/#openezx jonwil (n=jonwil@124.182.54.182)
09:11.12jonwilhi
09:15.24*** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1)
10:42.04ghanejonwil: hi
10:59.38jonwilhi
11:09.20*** join/#openezx ghane_ (n=ghane@1-1-4-27a.mdp.mlm.bostream.se)
11:09.35ghane_jonwil: looking at your code now
11:09.47ghane_segfaults here too
11:09.59jonwilok
11:10.05ghane_second read
11:10.17ghane_but you used it for reading out your phone?
11:12.55jonwilno
11:14.16ghane_ok
11:14.46ghane_but the code sais sort of what it should do?
11:15.17jonwilyes
11:15.57ghane_then i'll continue and try rewrite it so it works
11:16.46ghane_i wonder if you really need to send the ramloader, shouldnt it already be on the phone?
11:22.45ghane_jonwil: also, what to change for the telnet? cant find it anywhere
11:33.46jonwilyes you do need to send the ramloader
11:33.50jonwilthe ramloader is not on the phone
11:33.56jonwilIts special code that is only sent when you flash
11:34.15jonwilso yeah the code should work (and in fact, the first read command actually reads the right data)
11:34.27ghane_yes, but then it segfaults
11:34.31jonwilya
11:34.36jonwilWhy its doing that I dont know
11:34.50ghane_i'm trying to figure out right now
11:35.00jonwilok
11:35.20ghane_also comparing the flash-tools with the ezxflash
11:35.38jonwilas for telnet, I can tell you what changes I have on my phone on top of the "unmodified" FLEX
11:35.59ghane_yes please
11:36.00jonwilI do have a toolchain that works now though
11:36.05ghane_nice
11:36.41jonwilso yeah I guess #1 idea is to try a kernel module that can read from memory so we can come up with a memory map for the z6
11:36.43ghane_i found out that there is something related to a motmode that is run at init, which descides if its a production or developer device
11:37.53ghane_ah, the telnet thingie, is it the "Engineering mode" flex bit?
11:37.59jonwilno
11:38.02jonwilIts nothing like that
11:38.47ghane_when i looked at the init scripts it looks like telnet will be enabled if engineering mode is true
11:39.04jonwilwell I havent touched any of the flexbits
11:39.17jonwilThe changes I have on my phone right now, there is one change in cg43
11:39.23jonwilwhich is in ezx_opera.cfg
11:39.27ghane_ah
11:39.28jonwilFind the line application/sdp = 3,/usr/SYSqtapp/mediaplayer/mediaplayer -d,,,sdp,|
11:39.28ghane_that hack
11:39.36jonwiland add application/x-csh = 3,/bin/sh ,,,csh,|
11:39.42jonwilthere is more
11:39.49jonwilThats the only change to cg43 though
11:40.18jonwilin CG52, I have a bunch of changes
11:40.58jonwilI have 2 png files in the root folder called 1_usr and 2_usr (used as icons for the "reboot phone" and "enable usblan" menu options that the hack adds
11:41.27ghane_ok
11:41.39jonwilIn the oss folder, I have another folder called .setup (which contains a tar file called bftpd.tar which is the ftpd for the ftp hack
11:41.49ghane_usbnet isnt really needed since we can set that from modem mode
11:42.18jonwilyeah but having it as a phone option makes life easier IMO
11:42.25ghane_true
11:42.36jonwilalso in the oss folder, I have scriptws
11:42.38jonwilscripts
11:42.43jonwil.ftp.csh has this
11:42.48jonwil#!/bin/sh
11:42.50jonwil/ezxlocal/download/mystuff/.system/bftpd -c /ezxlocal/download/mystuff/.system/bftpd.conf -d
11:43.24jonwil.usblan.csh has this
11:43.25jonwil#!/bin/sh
11:43.29jonwilusr/local/bin/vendor_usb 13
11:43.33jonwilwith / at the front
11:43.35jonwilsleep 5
11:43.37jonwilif ! ifconfig | grep -q 192.168.16.2; then ifconfig usbl0 192.168.16.2 broadcast 192.168.16.7 netmask 255.255.255.248; fi
11:44.01jonwil.telnet.csh has this
11:44.02jonwil#!/bin/sh
11:44.04jonwilbusybox killall inetd
11:44.05jonwilmount -t devpts devpts /dev/pts
11:44.08jonwilinetd /etc/inetd.engr
11:44.19jonwil.restart.csh simply executes /sbin/reboot
11:44.30ghane_ah yes, setting the ip address from the phone is good
11:44.37jonwil.remount.csh does #!/bin/sh
11:44.39jonwilmount -o remount -t vfat /dev/mmca1 /mmc/mmca1
11:44.41jonwilmount -t vfat -o remount /dev/loop/0 /ezxlocal/download/mystuff
11:44.53jonwilWhich removes noexec from the locations you can write to
11:45.05jonwilThat is definatly a usefull change :)
11:45.05ghane_great
11:45.19ghane_ya it sure is
11:45.50jonwilthere is also .install.csh which does this
11:45.51jonwil#!/bin/sh
11:45.53jonwilif [ -f /ezxlocal/download/mystuff/.pol_installed ]; then
11:45.55jonwilcp /usr/setup/ezx_mp.cfg /ezxlocal/download/appwrite/setup/
11:45.56jonwilcp /usr/setup/ezx_camera.cfg /ezxlocal/download/appwrite/setup/
11:45.58jonwilcp /usr/setup/ezx_system.cfg /ezxlocal/download/appwrite/setup/;
11:46.00jonwiltouch /ezxlocal/download/mystuff/.pol_installed
11:46.02jonwilfi
11:46.03jonwilif [ ! -d /ezxlocal/download/mystuff/.skins ]; then mkdir /ezxlocal/download/mystuff/.skins ; fi;
11:46.05jonwilif [ ! -f /usr/data_resource/oss/.setup/bftpd ]; then busybox tar xvf /usr/data_resource/oss/.setup/bftpd.tar -C /ezxlocal/download/mystuff/.system/; fi
11:46.24jonwil.autorun.csh does this
11:46.25jonwil#!/bin/sh
11:46.28jonwil<PROTECTED>
11:46.31jonwil<PROTECTED>
11:46.33jonwil<PROTECTED>
11:46.35jonwil<PROTECTED>
11:46.42jonwilso it just runs the other scripts
11:46.49ghane_thanks
11:46.55jonwilthere is more
11:47.23jonwilin preloadapps/sysmenutree,the section [2a58c0d6-05c6-45aa-8938-63059d41a4e9] is for the main menu
11:47.38jonwilecc9ddaa-6643-429b-9844-8dc429826253 is added to the list (codes for the motomagx menu)
11:47.44jonwilI mean openmagx
11:47.46jonwilas I am calling this
11:47.59jonwilthen we have that menu itself which is this
11:48.01jonwil[ecc9ddaa-6643-429b-9844-8dc429826253]
11:48.02jonwilItems = ecc9ddaa-6643-429b-9844-8dc429829356;ecc9ddaa-6643-429b-9844-8dc429829357
11:48.10jonwilin SysMime, I have this stuff
11:48.12jonwil[text/plain]
11:48.13jonwilAppList = {95ffa462-7e2f-49a9-9e6d-f8f63b2f3c40};
11:48.15jonwilAppID = {95ffa462-7e2f-49a9-9e6d-f8f63b2f3c40}
11:48.17jonwil[application/x-csh]
11:48.19jonwilAppList = {95ffa462-7e2f-49a9-9e6d-f8f63b2f3c40};
11:48.20jonwilAppID = {95ffa462-7e2f-49a9-9e6d-f8f63b2f3c40}
11:48.33jonwilThen the other important bit is in SysRegistry
11:48.55jonwilI add a new section before this section
11:48.56jonwil[0b6c1459-2fbe-4b2e-95c9-a4f93762fa11]
11:48.59jonwilThe new section is this
11:49.02jonwil[0a92f2c5-584d-440a-954c-1a155079d71f]
11:49.05jonwilAniIcon = ctact_ani.g
11:49.07jonwilAppID = {0a92f2c5-584d-440a-954c-1a155079d71f}
11:49.09jonwilArgs = /usr/data_resource/oss/.autorun.csh;/usr/data_resource/oss/.autorun.csh
11:49.11jonwilAttribute = 1
11:49.13jonwilBigIcon = ctact_std.g
11:49.15jonwilDaemon = 1
11:49.16jonwilDirectory = ../../bin
11:49.18jonwilExec = sh
11:49.20jonwilFixedAllPosition = 0
11:49.22jonwilFixedPosition = 0
11:49.24jonwilGroupID = root
11:49.26jonwilIcon =
11:49.28jonwilLockEnabled = 1
11:49.30jonwilMassStorageStatus = 0
11:49.32jonwilName = Autorun
11:49.34jonwilType = 2
11:49.36jonwilUserID = root
11:49.53jonwilI change the user and group IDs for the section with Name = Messages to root instead of ezx
11:50.03jonwiland ditto for the Name = Web Access section
11:50.15jonwilI also add 0a92f2c5-584d-440a-954c-1a155079d71f to the autorun list
11:50.17ghane_ah
11:50.27jonwil2 more sections added at the end of the file
11:50.29jonwil[ecc9ddaa-6643-429b-9844-8dc429826253]
11:50.30jonwilAttribute = 8
11:50.32jonwilAniIcon = fm_ani.g
11:50.33jonwilBigIcon = fm_std.g
11:50.35jonwilFixedAllPosition = 0
11:50.37jonwilFixedPosition = 0
11:50.38jonwilName = OpenMAGX
11:50.40jonwilType = 1
11:50.42jonwil[ecc9ddaa-6643-429b-9844-8dc429829356]
11:50.44jonwilAniIcon = /usr/data_resource/1_usr
11:50.46jonwilAppID = {ecc9ddaa-6643-429b-9844-8dc429829356}
11:50.47jonwilArgs = /usr/data_resource/oss/.restart.csh;/usr/data_resource/oss/.restart.csh
11:50.49jonwilAttribute = 1
11:50.51jonwilBigIcon = /usr/data_resource/1_usr
11:50.52jonwilDaemon = 1
11:50.54jonwilDirectory = ../../bin
11:50.56jonwilExec = sh
11:50.58jonwilFixedAllPosition = 0
11:50.59jonwilFixedPosition = 0
11:51.01jonwilGroupID = root
11:51.03jonwilIcon =
11:51.05jonwilLockEnabled = 1
11:51.07jonwilMassStorageStatus = 0
11:51.09jonwilv
11:51.10jonwilName = Reboot
11:51.12jonwilType = 2
11:51.14jonwilUserID = root
11:51.17jonwil[ecc9ddaa-6643-429b-9844-8dc429829357]
11:51.19jonwilAniIcon = /usr/data_resource/2_usr
11:51.22jonwilAppID = {ecc9ddaa-6643-429b-9844-8dc429829357}
11:51.23jonwilArgs = /usr/data_resource/oss/.usblan.csh;/usr/data_resource/oss/.usblan.csh
11:51.25jonwilAttribute = 1
11:51.27jonwilBigIcon = /usr/data_resource/2_usr
11:51.29jonwilDaemon = 1
11:51.31jonwilDirectory = ../../bin
11:51.33jonwilExec = sh
11:51.34jonwilFixedAllPosition = 0
11:51.36jonwilFixedPosition = 0
11:51.38jonwilGroupID = root
11:51.40jonwilIcon =
11:51.43jonwilv
11:51.44jonwilLockEnabled = 1
11:51.46jonwilMassStorageStatus = 0
11:51.48jonwilName = Activate USBLAN
11:51.50jonwilType = 2
11:51.52jonwilUserID = root
11:52.01jonwilso yeah those are all the changes to my phone
11:52.07ghane_thanks
11:52.25ghane_but first i need to fix your code :)
11:52.34jonwilyeah
11:52.43jonwilOnce you make them, you will probobly need to do a reset all data and remove all files in order to get the changes to take
11:52.58ghane_hopefully not bricking in the process
11:53.34ghane_i've browsed around a bit
11:53.44jonwilFirstly once you get reading working verify that the CG43 and CG52 mount correctly
11:53.49jonwilas type squashfs
11:54.07ghane_ya
11:54.31jonwilhttp://www.rasputin007.co.uk/storage/webpages/v8_cg/ shows how its all done
11:54.37jonwilIt says v8 but its also for z6
11:54.43ghane_i dont have any kernel that can mount it, but i suppose unsquashfs is enough
11:54.49ghane_ya i've read that page
11:55.19ghane_jonwil: btw, the other channel
12:07.43CIA-45OpenEZX: ao2 * r2106 /branches/kernel-2.6.24.x-patches/ (a910-i2c-boardinfo.patch series):
12:07.43CIA-45OpenEZX: * Add a910-i2c-boardinfo.patch, so eoc works also on A910.
12:07.43CIA-45OpenEZX:  Now we can use nfsroot.
12:38.24*** join/#openezx tombhadAC (n=tombhad@pD95DF577.dip.t-dialin.net)
12:53.30CIA-45OpenEZX: ao2 * r2107 /trunk/src/kernel-2.4/pcap_dump/ (Makefile README pcap_dump.c):
12:53.30CIA-45OpenEZX: * Add support for 2nd gen EzX phones, here pcap_dump can be used with no
12:53.30CIA-45OpenEZX:  changes to the kernel
13:37.50*** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de)
14:51.25jonwilso yeah we need to come up with a kernel driver that can read from memory
14:51.31jonwilso we can start playing with the contents of RAM
14:52.06jonwilhmmm, one thought that occured to me is that the MBM may hide parts of stuff from RAM so it cant be read after its already done its job
14:52.16jonwilMicrosoft did something similar with the first XBOX
14:52.43ghane_but how could the mbm do that?
14:52.51jonwilby using special hardware register maybe
14:52.59ghane_ya
14:53.01ghane_or
14:53.04ghane_hmm
14:53.15jonwilbut yeah, get me a way to read a block of memory out to a disk file and I can do some more hacking
14:53.40ghane_are they running native linux on those devices?
14:53.45ghane_or is it L4Linux?
14:53.52ghane_or something similair
14:53.54jonwilits definatly native ARM linux
14:54.28jonwilno hypervisor is running
14:55.04jonwilGiven the low processing power of the ARM CPU and the other security measures (including the digital signature checks), I doubt motorola would run a hypervisor
14:55.53ghane_i've seen arm cpus running linux under L4
14:56.16jonwilok
14:56.42ghane_so its not that unlikely
14:56.47jonwilThe other reason I dont see them using L4 is that if they were using it, there would be evidence somewhere
14:56.57jonwilin one of the flash bits
14:57.02ghane_ya true
14:57.11ghane_this seems to be a native linux architecture
14:57.12jonwilLets assume they arent until we find out otherwise
14:57.25jonwilso yeah we need a way to read a block of memory given its addresses
14:58.10jonwildont forget we have a second ARM running the baseband software too
14:58.19jonwilalthough we dont need (or want) to mess with that
14:58.40ghane_wasnt the Z6 said to be a single core architecture?
14:59.48jonwilwell /proc/mtd lists a mtd called bpsw.bin
15:00.15jonwilLooking at that file, I can see that its digitally signed
15:00.23jonwilbut that it has a different endianness to the other files
15:00.34ghane_interesting
15:00.36jonwilas in, bytes 1 and 2 are swapped
15:00.39jonwiland bytes 3 and 4
15:00.41jonwiland so on
15:00.52jonwilIt may be that its one chip (the SCMA11)
15:00.57jonwilbut with multiple cores
15:01.12ghane_a bit strange to use different endianness in the same architecture
15:01.50jonwilwhat we need is someone willing to take their z6 appart and get clear documentation of all the chips contained in it
15:02.06jonwilso we can find out what as many of them as possible are actually for
15:02.16jonwillike was done for the e680
15:02.22ghane_we can start looking at the photos of the V8
15:02.31jonwilyeah
15:02.33jonwiltrue
15:04.00ghane_lol
15:04.11ghane_it looks like it takes some abuse to open it up
15:04.16ghane_http://wiki.openezx.org/Image:Img_2953_Or.jpg
15:08.51jonwilok, looking at this image:
15:08.53jonwilhttps://totalueberwachung.de/~alphaone/openezx/gallery/img_2961_Or.jpg.14.html
15:09.14jonwilI think the really big chip in the middle is the SCMA11 chipset
15:09.41ghane_could be
15:10.15jonwilwait, check http://wiki.openezx.org/Razr2
15:10.18jonwilIt has some info already
15:10.21jonwilLets start there
15:11.36ghane_ah there was some more info ya, i just looked at the pictures
15:13.50jonwilThe freescale site says that the SC13783VK5 is ATLAS 3G PWRMNGMNT 5
15:13.57jonwilSo it sounds like its power management
15:14.33ghane_hmm
15:14.47jonwilSC29364VK doesnt turn up at all
15:14.57ghane_no i couldnt find that one wither
15:15.06jonwilThat is most likely the SCMA11 chipset itself
15:15.27jonwiland doesnt appear because freescale only sells it to OEMs who are building wireless devices or whatever
15:16.21ghane_ah
15:24.22ghane_hmm
15:24.24jonwilTY9000C010 is a Toshiba chip
15:24.35ghane_does the V8 have touch on the outside display?
15:24.36jonwilLooking to see if I can find info on it on the toshiba sites now
15:24.39jonwilI dont know if it does
15:24.52ghane_Morphing touch sensitive haptics controls" or "external display with contextual touch interaction" depending on your "marketing-speak" preference
15:25.03jonwilhmmm, I guess it does then
15:25.12ghane_i only thought it had some fake three buttons at the bottom of the outer display
15:25.33ghane_but touch and haptics didnt even know that there were phones out there yet with haptics
15:26.23jonwilI havent a clue what the iPhone is using
15:26.35ghane_what?
15:26.36stefan_schmidtghane_: Right, fake button on the outer display. Non of the display is touc
15:26.38stefan_schmidttouch
15:26.54ghane_stefan_schmidt: ah ya, that was what it was like when i saw the V9
15:27.09ghane_and haptics? i dont think so in that one
15:27.28stefan_schmidtFor details ask alphaone. He has one
15:27.28ghane_jonwil: the iPhone is using something like the synaptics capacitive touch thingies
15:27.51ghane_alphaone: what timezone are you in? when are you awake? ;-)
15:28.15ghane_jonwil: haptics is a form of "mechanical feel" feedback for touch screens
15:28.16stefan_schmidtghane_: heh, he lives in .de, but has it's own timezone here...
15:28.26mickeylalphaone is in .de, but is (hopefully) preparing for his test
15:28.42ghane_ah
15:28.42stefan_schmidtmickeyl: nah, today he has THW
15:28.48mickeyluh oh
15:28.49ghane_i see
15:28.53mickeylshould better prepare...
15:29.10stefan_schmidtmickeyl: well, he is the genius. Need a lot less learning then me
15:29.18ghane_but then i suppose communication should be a bit easier than with jonwil, at least when he isnt studying
15:29.45ghane_i'm so happy that i dont need to study anymore
15:30.21ghane_the only drawback is that i dont feel that motivated to code in my sparetime anymore
15:33.25jonwilSomething that doesnt help is that so much phone hacking is done in russian language
15:33.36ghane_no
15:33.43ghane_they are a bit hard to communicate with
15:46.43jonwilok, the large toshiba part is almost certainly a TY9000A010ALGF which as far as I can tell is a flash memory chip
15:47.07ghane_ok
15:50.22jonwilok, so yeah we have the big chip in the middle which is the SCMA11
15:50.31jonwilthe smaller freescale chip next to that for power management
15:51.25jonwilthe small one next to the flash memory is the bluetooth
15:52.11jonwilthen there is the skyworks chip which is part of the EDGE stuff
15:52.33jonwilthe one freescale chip on the other side of the PCB is also GSM related
15:53.10ghane_ok
15:54.17ghane_there isnt much info aobu tthe scma11
15:54.39ghane_According to Tang, the E8's processor is an "SCMA11 from Freescale and ARM11 core with DSP-starcore."
15:54.43ghane_Freescale shares limited details about the SCMA11, but it appears to be a single-core baseband processor with a StarCore DSP. Thus, the E8 probably uses a separate ARM11-based application processor. Alternatively, the SCMA11 might be a multi-chip module integrating baseband, DSP, and an ARM11 core, perhaps in a sandwich with some memory. In addition to Linux, there's a separate RTOS -- possibly VRTX -- running on the baseband, Tang confirmed.
15:59.33jonwilUnless there is a chip not visible in these pictures, the baseband is on the same die as the AP
15:59.42jonwilwhich is the giant freescale part in the middle
15:59.52ghane_ya
16:00.01jonwilthe one labeled CY7C680 is a USB chip for some purpose
16:00.36ghane_everything is done with usb so that makes sense
16:10.07jonwilhmmm I had a thought
16:10.13jonwilMaybe the BP ISNT an Arm
16:10.19jonwilMaybe its a DSP of some kind
16:10.44ghane_could be
16:10.59jonwilpresumably the StarCore DSP mentioned
16:11.17ghane_ya
16:13.08ghane_brb food
16:19.15jonwilIn any case what we can tell is that all the chips (SCMA11, power chip, GSM chips) are designed to work as a single chipset
16:19.36jonwiland that said chipset is specifically built for higher end EDGE phones
16:20.33jonwiloh and it almost certainly has internal ROM somewhere inside it
16:33.26ghane_probably an evil rom
16:37.24jonwilAnyone here know someone who can read chinese?
16:38.49ghane_why is all information in chinese or russian?
16:39.11jonwilno idea
16:39.19ghane_why can't they learn english?
16:39.21ghane_:)
16:51.58jonwilso yeah our 2 goals are 1.Get linux tools to read and write flash to phone working so we can flash new versions of the unsigned codegroups
16:52.08jonwiland 2.Get kernel module going that can read and write memory
16:52.30jonwilso we can read the interesting bits we have found like IPU memory
16:52.45ghane_yes
16:53.39ghane_i'm trying to work on ¤Â#1 now
16:53.57ghane_aargh what was that strange characters?
16:57.42*** join/#openezx tombhadAC (n=tombhad@pD95DEC58.dip.t-dialin.net)
16:58.07jonwilwork on what?
16:58.10jonwilflash program?
16:58.12jonwilkernel module?
16:58.15ghane_read program
16:58.18jonwilaah ok
16:58.20jonwilsounds good
16:58.52jonwilTime to fire up the linux box and write some code :)
16:59.07jonwilLets see what happens if I just try and read memory directly
16:59.21jonwilarm isnt x86
16:59.37jonwiland as far as I know doesnt have protected mode, kernel mem vs user mem or any of that other nice junk
17:00.01jonwilso I dont see why I cant just do char *x = (char *)0x70000000 and start reading from there...
17:00.04jonwilLets give it a go
17:00.09jonwilWorst that will happen is my app crashes
17:00.15ghane_no arm is supposed to be a lot simpler
17:00.36ghane_true
17:05.39jonwilok, that obviously didnt do anything usefull
17:05.46jonwilAll it read was nulls
17:06.06jonwilI was trying to read from what was labeled "USB_FW_ADDRESS" in /proc/bootinfo
17:06.40ghane_didnt?
17:06.51jonwilIt worked
17:06.57jonwilbut spat out a file full of nulls
17:08.01ghane_have you tried extracting the mtd stuff?
17:08.52jonwilyes I can read the contents of /dev/mtd no problems
17:08.56jonwiland have those sitting on my hard disk now
17:09.00jonwilNothing of note though
17:09.10ghane_you should be able to raw read the root and all other filesystem images
17:09.17jonwilyes I can do that
17:09.27jonwilbut I get the same data as I get if I read with F&B3
17:09.32jonwilso its nothing to write home about
17:09.38jonwilas for ipu_mem, I think ipu stands for image processing unit
17:10.19ghane_ok
17:10.29jonwilPer comment in kernel ipu_common.c 10/2006  Motorola  Added power-up logo support, additional pixel packing
17:10.32jonwilformats, and functions for controlling the pixel clock.
17:10.40jonwilI am guessing that its the display screen
17:10.54*** join/#openezx yansa (n=yans@host-89-230-211-114.lublin.mm.pl)
17:12.44ghane_but probably that isnt memorymapped
17:12.53jonwilI also see references to CMOS
17:12.59jonwilCMOS sensor
17:13.02jonwilwhich implies camera
17:13.24jonwil10/2006  Motorola  Added support for additional pixel packing formats and Video 4 Linux 1.
17:13.29jonwilThat definatly says "camera" to me
17:14.06jonwilper ipu_regs.h we have /* IPU Common registers */
17:14.13jonwil<PROTECTED>
17:14.13ghane_i was thinking
17:14.18jonwil<PROTECTED>
17:14.18ghane_not that it makes any sens
17:14.24jonwil<PROTECTED>
17:14.28jonwil<PROTECTED>
17:14.31jonwil<PROTECTED>
17:14.38ghane_but throw em together on the memorycard and mount the memorycard as root
17:14.50jonwilyou were thinking as what?
17:14.55jonwilthrow what?
17:15.00ghane_ah ya could be the camera
17:15.11jonwiland also display
17:15.24jonwili.e. its chipset functionality for talking to camera asic and/or display screen(s)
17:15.33jonwilwhat we need is /proc/cmdline from a v8...
17:15.52ghane_oh yes could be the framebuffer device
17:16.13jonwilso yeah its most likely framebuffer and camera
17:16.42jonwilso yeah where do we go from here>
17:16.44jonwil?
17:16.56jonwilother than the flash programs for linux that is'
17:17.30jonwilI guess that question depends on what the goal is
17:18.05ghane_camera yes
17:18.22jonwilthe ultimate goal is to find a way to bypass the RSA check
17:18.46ghane_ah
17:18.55ghane_both camera and scaler
17:18.59ghane_perhaps video overlay too
17:20.04jonwilso yeah lets write kernel module and find way to read pieces of RAM
17:20.29jonwiland lets reverse engineer stuff
17:20.40jonwilThe MBM and ramdownloader is one thing we want to reverse engineer
17:20.55jonwilbut we also want to reverse engineer the libraries on the z6 so we can talk to them
17:20.57ghane_yes think so
17:21.03jonwilwhen we write native apps
17:21.08ghane_yes
17:21.16jonwilCompletly replacing the z6 libraries is not necessary unlike with ezx
17:21.35ghane_no idea
17:22.05ghane_yes
17:22.20ghane_one thing would be to hack the bootloader to accept custom kernels
17:22.23*** join/#openezx tombhadAC (n=tombhad@pD95DF94F.dip.t-dialin.net)
17:22.50jonwilyeah being able to load new kernels seems usefull
17:25.03ghane_we really need jtag
17:26.14jonwilThat means we need to open the phone up and look for jtag points
17:26.22jonwilAnd that assumes that there is jtag on the z6 at all
17:35.00*** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) [NETSPLIT VICTIM]
17:35.00*** join/#openezx ghane_ (n=ghane@1-1-4-27a.mdp.mlm.bostream.se) [NETSPLIT VICTIM]
17:35.00*** join/#openezx Hopscotch (n=cd@touchdown.maintech.de) [NETSPLIT VICTIM]
17:35.00*** join/#openezx NiZoX (n=nizox@2a01:5d8:58a1:3a2b:21c:c0ff:fe25:ff68) [NETSPLIT VICTIM]
17:35.00*** join/#openezx jannu (n=jannu@hoas-fe3cdd00-15.dhcp.inet.fi) [NETSPLIT VICTIM]
17:35.00*** join/#openezx shoragan (n=shoragan@sicherheitsschwankung.de)
17:35.00*** join/#openezx toi (n=pleemans@d5152D3B4.access.telenet.be)
17:35.01*** join/#openezx ghane (n=ghane@unaffiliated/ghane) [NETSPLIT VICTIM]
17:37.39*** join/#openezx pleemans (n=peter@d51A5E76A.access.telenet.be)
17:44.37jonwilholy shit, its nearly 3am
17:44.49jonwillater
17:44.58jonwilwait, first I make mailing list post calling for help
17:45.07jonwilmore specifically kernel help
17:47.37*** join/#openezx tombhad-AC (n=tombhad@pD95DCF4A.dip.t-dialin.net)
17:49.08*** join/#openezx naWel (n=nawel@190.9.13.180)
17:49.25naWelhello
17:49.51naWelanyone talk spanish?
17:55.45naWelstefan_schmidt: can you askme a question?
18:01.39*** join/#openezx tombhad-AC (n=tombhad@pD95DCF4A.dip.t-dialin.net)
18:04.46*** join/#openezx Gottox (n=Gottox@s01.de)
18:20.40*** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) [NETSPLIT VICTIM]
18:20.40*** join/#openezx ghane_ (n=ghane@1-1-4-27a.mdp.mlm.bostream.se) [NETSPLIT VICTIM]
18:20.40*** join/#openezx Hopscotch (n=cd@touchdown.maintech.de) [NETSPLIT VICTIM]
18:20.40*** join/#openezx NiZoX (n=nizox@2a01:5d8:58a1:3a2b:21c:c0ff:fe25:ff68) [NETSPLIT VICTIM]
18:20.40*** join/#openezx jannu (n=jannu@hoas-fe3cdd00-15.dhcp.inet.fi) [NETSPLIT VICTIM]
18:20.40*** join/#openezx shoragan (n=shoragan@sicherheitsschwankung.de) [NETSPLIT VICTIM]
18:20.40*** join/#openezx toi (n=pleemans@d5152D3B4.access.telenet.be)
18:20.40*** join/#openezx ghane (n=ghane@unaffiliated/ghane) [NETSPLIT VICTIM]
18:24.08*** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) [NETSPLIT VICTIM]
18:24.08*** join/#openezx ghane_ (n=ghane@1-1-4-27a.mdp.mlm.bostream.se) [NETSPLIT VICTIM]
18:24.08*** join/#openezx Hopscotch (n=cd@touchdown.maintech.de) [NETSPLIT VICTIM]
18:24.08*** join/#openezx NiZoX (n=nizox@2a01:5d8:58a1:3a2b:21c:c0ff:fe25:ff68) [NETSPLIT VICTIM]
18:24.08*** join/#openezx jannu (n=jannu@hoas-fe3cdd00-15.dhcp.inet.fi) [NETSPLIT VICTIM]
18:24.08*** join/#openezx shoragan (n=shoragan@sicherheitsschwankung.de)
18:24.08*** join/#openezx toi (n=pleemans@d5152D3B4.access.telenet.be)
18:24.09*** join/#openezx ghane (n=ghane@unaffiliated/ghane) [NETSPLIT VICTIM]
18:28.07*** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) [NETSPLIT VICTIM]
18:28.07*** join/#openezx ghane_ (n=ghane@1-1-4-27a.mdp.mlm.bostream.se) [NETSPLIT VICTIM]
18:28.07*** join/#openezx Hopscotch (n=cd@touchdown.maintech.de) [NETSPLIT VICTIM]
18:28.07*** join/#openezx NiZoX (n=nizox@2a01:5d8:58a1:3a2b:21c:c0ff:fe25:ff68) [NETSPLIT VICTIM]
18:28.07*** join/#openezx jannu (n=jannu@hoas-fe3cdd00-15.dhcp.inet.fi) [NETSPLIT VICTIM]
18:28.07*** join/#openezx shoragan (n=shoragan@sicherheitsschwankung.de) [NETSPLIT VICTIM]
18:28.07*** join/#openezx toi (n=pleemans@d5152D3B4.access.telenet.be)
18:28.07*** join/#openezx ghane (n=ghane@unaffiliated/ghane) [NETSPLIT VICTIM]
18:46.46*** join/#openezx flo_lap (n=fuchs@f054160242.adsl.alicedsl.de)
18:53.34*** join/#openezx tombhadAC (n=tombhad@pD95DD0F4.dip.t-dialin.net)
19:20.26*** join/#openezx tombhadAC (n=tombhad@pD95DF183.dip.t-dialin.net)
19:45.06*** join/#openezx agd5f (n=alex@c-69-143-24-183.hsd1.va.comcast.net)
20:05.43*** join/#openezx pleemans (n=peter@d51A5E76A.access.telenet.be)
20:05.44*** join/#openezx tombhadAC (n=tombhad@pD95DF8C0.dip.t-dialin.net)
22:27.49*** part/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de)
22:38.03*** join/#openezx zbojnik (n=zbojnik@c-24-3-20-232.hsd1.pa.comcast.net)
23:00.03*** join/#openezx WyrM (i=wyrm@201.58.197.6)
23:04.37ao2hi WyrM, A910 seems to use this usr_blk_dev to access transflash, see 2.4-ezx-motorola/drivers/power_ic/core/usr_blk_dev.c, I haven't found anything similar in 2.6 yet
23:05.40ao2by the way, are you going to meet LaF0rge at BOSSA next week?
23:06.02WyrMao2: Hi!
23:06.17WyrMYes, i am going to bossa. :)
23:06.32WyrMlooking at usr_blk_dev.c now.
23:09.30ao2great, I would like to see a picture of you and Harald shaking your hands :)
23:10.48ao2I managed to dump pcap register on a910, and I put the values in pcap_init in openezx, but no visible changes, so I guess the problem is not about power
23:15.33WyrMao2: compare PCAP_ISR with and without a card on the slot (on 2.6) see if anything changes.
23:15.54ao2ok, will do
23:16.15WyrMi guess that pcap somehow is doing the sd switching..
23:20.52WyrMgpio.c contains the configuration for the mmc card.
23:30.20WyrMao2: looks like ap pin 11 is mmc detect pin.
23:54.38ao2yes WyrM, it's defined also in the original ezx.h GPIO_MMC_DETECT

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.