| 00:11.51 | *** join/#openezx myrtg (n=rtg@92.112.101.228) |
| 00:16.48 | *** join/#openezx jonwil (n=jonwil@124.182.35.218) |
| 00:16.55 | jonwil | hi |
| 00:19.29 | myrtg | Hello everyone, I've been trying to make a1200 (v4l cap says it's 2MP Camera) work w/o libezxcameraengine*, i.e. via v4l and WMIO_* ioctls, has anybody had any success? |
| 00:21.47 | myrtg | The kernel sources contain a reference to a mysterious sample.c which does everything and even more, but I can not find any ezx-related sample.c.. |
| 00:23.48 | myrtg | moreover v4l caps.name is 2MP Camera, but there is even no such string in release 42 and 39 of motorola's kernel |
| 00:26.48 | myrtg | and now I get random data (sometimes simply freed memory regions) while reading from device, after everything looks like set up. It's possible to read from fbdev when in camera mode, but this is a strange way... |
| 00:30.18 | jonwil | does your kernel have the camera driver compiled into it? |
| 00:34.42 | myrtg | yup |
| 00:36.10 | myrtg | jonwil, the kernel is a sligthly modified to run off jffs2 root, but otherwise completely made by motorola |
| 00:36.32 | jonwil | ok, well I dont know then |
| 00:37.05 | myrtg | i guess strace is my friend these days :) |
| 00:37.38 | ghane | hi |
| 00:37.45 | ghane | jonwil: hows it going? |
| 00:37.50 | jonwil | good |
| 00:38.15 | ghane | :) |
| 00:38.44 | jonwil | After much work (and much flashing of flash files with RSD) I finally solved all the problems (including writing a tool to fix the ramdownloader "erase table" so the right data is erased) |
| 00:38.54 | jonwil | and I released the first version of my toolset |
| 00:39.00 | jonwil | It doesnt actually apply any hacks yet |
| 00:39.04 | jonwil | but it does the other bits |
| 00:39.13 | ghane | ok great |
| 00:39.29 | ghane | but what you mean about the erase thing? |
| 00:39.39 | ghane | wasnt it possible to flash before? |
| 00:40.24 | jonwil | Flashing is not the issue |
| 00:40.51 | ghane | ok? |
| 00:41.02 | jonwil | The issue I had (that caused problems and required me to flash many flash files in order to undo them) was that the ramdownloader contains a table that tells the ERASE command what to erase |
| 00:41.16 | ghane | ok |
| 00:41.25 | ghane | but why do you want to erase? |
| 00:41.26 | ghane | :) |
| 00:41.44 | jonwil | you have to erase before you can write new stuff to it |
| 00:42.02 | ghane | ah, but then flashing was a problem? |
| 00:42.13 | jonwil | yes flashing with the linux tool was an issue |
| 00:42.21 | ghane | ya that was what i meant |
| 00:42.37 | ghane | as i understood last time we talked i thought you was able to flash from linux |
| 00:42.43 | jonwil | once I found that table (and what it was for) it was reasonably easy to write a tool to change the ramdownloader |
| 00:42.51 | jonwil | or rather, change the erase table |
| 00:42.54 | jonwil | and then things worked |
| 00:43.00 | ghane | ah |
| 00:43.14 | ghane | ya, because you cant change the actual ramdownloader sinceit is signed |
| 00:43.30 | jonwil | actaully, this "erase table" inside the ramdownloader CAN be changed |
| 00:43.36 | jonwil | Its not checked as part of the signature check |
| 00:43.44 | ghane | eh what? |
| 00:43.53 | ghane | that was interesting |
| 00:44.19 | jonwil | I suspect its not checked so that its easier for motorola engineers to change the table without needing to change the signature |
| 00:44.33 | jonwil | i.e. change it differently for different flash files with different data in them |
| 00:44.40 | ghane | so you mean part of the files are not checked or what? |
| 00:44.42 | jonwil | Any flash file from motorola will already have the correct entries in the erase table btw |
| 00:45.00 | ghane | ok |
| 00:45.25 | jonwil | What I mean is that this specific data block (so far its only this specific data block that I have seen) is not checked by the sigature algorithim. How much of the ramdownloader is checked I dont know |
| 00:45.39 | jonwil | I have no way to find that out either |
| 00:45.51 | ghane | jonwil: ok, but it is a block within the ramdownloader? |
| 00:46.08 | ghane | sounds VERY strange that they would have a signing process that only signed part of a file |
| 00:46.11 | jonwil | Yes, its a specific block inside the ramdownloader binary file |
| 00:46.27 | jonwil | all I know is that I can change this table without breaking stuff |
| 00:46.33 | ghane | cool |
| 00:46.39 | jonwil | Whether other bits of the ramdownloader can be changed without breaking stuff I dont know |
| 00:46.50 | ghane | lets try :) |
| 00:46.59 | jonwil | Tools like Flash&Backup and SBF-Recalc also fix up this erase table when they build a flash file |
| 00:47.37 | ghane | okok |
| 00:48.19 | jonwil | so yeah magxjb is a good start |
| 00:48.31 | ghane | it sure is |
| 00:48.38 | jonwil | and until we can replace the signed parts (kernel and rootfs) its the best we are going to get |
| 00:48.46 | ghane | ya |
| 00:50.20 | jonwil | I still havent found any usefull resources on ARM (either reverse engineering it or just plain working with it) |
| 00:51.35 | ghane | unfortunately i'm going for a trip to usa soon, with work, but i wont get to the office with all the arm-guys |
| 00:54.06 | jonwil | if I could figure out where in memory the different bits (bootloader binary, ramdownloader binary etc) go and what address(es) IDA should start disassembling at, I could try and reverse engineer myself |
| 00:54.16 | jonwil | using the ARM instruction set reference document from the ARM web site |
| 00:55.17 | ghane | do you need the addresses for disassembling the bootloader? |
| 00:55.37 | ghane | and by the way isnt the bootloader already named with its flashaddress |
| 00:55.38 | ghane | ? |
| 00:56.22 | jonwil | We know where the bootloader lives on the NAND flash chip |
| 00:56.40 | jonwil | And we also know that the bootloader has to be copied from that NAND flash to some other location |
| 00:56.49 | jonwil | since you cant run code directly from a NAND flash |
| 00:57.21 | jonwil | which must be the job of the small (and presumably unchangable if not undumpable) piece of code that lives directly on the SCMA11 |
| 00:57.50 | ghane | but do you need that to actually disasm it? |
| 00:57.50 | jonwil | i.e. that small piece of code copies the bootloader from the NAND flash to somewhere in directly accesable memory (i.e. RAM) |
| 00:58.05 | jonwil | You need to know where in memory the code is located when it runs |
| 00:58.22 | jonwil | since it will likely contain addresses |
| 00:58.34 | jonwil | e.g. addresses that point to a data table |
| 00:58.40 | jonwil | or a function |
| 00:58.44 | jonwil | or whatever else |
| 00:58.54 | jonwil | if its at the wong address, you wont be able to properly disassemble it |
| 00:59.36 | ghane | i doubt it is hard coded addresses for that stuff |
| 00:59.42 | jonwil | It would be |
| 01:00.09 | jonwil | Since the bootloader is always at the same address in RAM and runs before any kind of memory management is in place (and before the ARM MMU is up and running I suspect) |
| 01:00.20 | jonwil | but yeah, #1 goal now is to get kernel code running. I have a bunch of addresses of code blocks (including the USB firmware, whatever that is) that I would love to be able to try and read :) |
| 01:00.39 | ghane | ah :) |
| 01:02.02 | ghane | well |
| 01:02.05 | ghane | i have to sleep now |
| 01:02.13 | ghane | its 2 o'clock in the night |
| 01:02.29 | ghane | lets hope i get some time and motivation tomorrow |
| 01:04.00 | jonwil | cya |
| 01:04.15 | ghane | cya, bye |
| 01:04.19 | jonwil | in any case, the people hacking the phone who DONT want to replace the motorola userland will be happy |
| 01:04.37 | jonwil | Later today I will post some howtos of different things you can change on the unpacked filesystems |
| 01:04.39 | jonwil | cya |
| 01:13.17 | *** part/#openezx myrtg (n=rtg@92.112.101.228) |
| 04:03.47 | *** join/#openezx jonwil (n=jonwil@124.182.35.218) |
| 04:04.24 | jonwil | hi |
| 04:28.54 | *** join/#openezx TimRiker (n=timr@rikers.org) |
| 07:18.04 | *** join/#openezx drath (i=vmaster@p5B07E43F.dip.t-dialin.net) |
| 08:47.18 | *** join/#openezx pH5 (n=ph5@p5485C5AE.dip.t-dialin.net) |
| 09:33.46 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 11:26.22 | *** join/#openezx myrtg (n=rtg@92.112.101.228) |
| 12:24.40 | *** join/#openezx flo_lap (n=fuchs@f054162203.adsl.alicedsl.de) |
| 13:08.31 | *** join/#openezx tombhadAC (n=tombhad@pD95DFE91.dip.t-dialin.net) |
| 13:16.55 | *** part/#openezx myrtg (n=rtg@92.112.101.228) |
| 15:08.55 | *** join/#openezx janneg (n=janne@v29714.1blu.de) [NETSPLIT VICTIM] |
| 16:33.55 | *** join/#openezx Marex (n=marex@gwfm10-3-250.802.cz) |
| 16:44.01 | *** join/#openezx flyhorse|linux (n=flyhorse@61.142.25.223) |
| 17:32.43 | *** join/#openezx LoneStar (n=xinzhen@218.80.27.137) |
| 18:56.01 | *** join/#openezx pleemans (n=peter@d51A5E76A.access.telenet.be) |
| 22:26.19 | *** join/#openezx jonwil (n=jonwil@124.182.35.218) |
| 22:33.13 | jonwil | hi |