| 00:00.13 | Vhadel780 | i want tool chain |
| 00:46.44 | *** join/#openezx Fosforo (n=Fosforo@20151052166.user.veloxzone.com.br) |
| 01:41.16 | *** join/#openezx Ikkebr (n=ikkibr@201-66-204-246.smace700.dsl.brasiltelecom.net.br) |
| 02:22.07 | *** join/#openezx flyhorse|linux (n=flyhorse@219.132.212.234) |
| 02:25.57 | WyrM | SuN: A1800 looks the same A1200, only a bit fatter. ;) |
| 02:27.32 | WyrM | a910 mmc support will be a lot harder than i imagined before. :( |
| 02:28.21 | *** join/#openezx LoneStar (n=xinzhen@203.110.178.130) |
| 02:31.43 | WyrM | Ikkebr: Welcome. Its always good to see more Brazilians interested on OpenEZX. ;) |
| 02:36.24 | Ikkebr | ^^ |
| 02:36.35 | Ikkebr | I managed to buy a motorola z6 |
| 02:47.59 | LoneStar | cool :) |
| 02:51.46 | Ikkebr | but I still love my f3 |
| 06:25.53 | *** join/#openezx nooop (n=noop@219.239.105.26) |
| 06:29.53 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 06:53.05 | Hopscotch | good morning |
| 07:25.57 | *** join/#openezx drath (i=vmaster@p5B07E16F.dip.t-dialin.net) |
| 07:44.42 | *** join/#openezx james__ (n=james@gimel.esc.cam.ac.uk) |
| 08:22.36 | *** join/#openezx sabrod (n=sabrod@lns-bzn-35-82-250-233-5.adsl.proxad.net) |
| 08:58.32 | *** join/#openezx sabro1 (n=sabrod@lns-bzn-35-82-250-233-5.adsl.proxad.net) |
| 09:14.53 | *** part/#openezx dimichxp (n=dimichxp@89.108.88.71) |
| 09:15.54 | *** join/#openezx ade|desk (n=adavey@194.200.143.249) |
| 10:55.59 | *** join/#openezx sabrod (n=sabrod@lns-bzn-35-82-250-233-5.adsl.proxad.net) |
| 11:07.58 | *** join/#openezx jannu (n=jannu@hoas-fe20dd00-223.dhcp.inet.fi) |
| 11:09.18 | *** join/#openezx Vhadel780 (n=l@92.116.229.46) |
| 11:22.45 | *** join/#openezx Vhadel7801 (n=l@92.116.229.46) |
| 11:43.58 | *** join/#openezx rettichschnidi (n=reto@57-43.0-85.cust.bluewin.ch) |
| 13:27.06 | WyrM | dimichxp just published a generic exploit for MAGX, http://people.openezx.org/dmitriy/magx_module/ |
| 14:22.30 | *** join/#openezx sabrod (n=sabrod@lns-bzn-35-82-250-233-5.adsl.proxad.net) |
| 14:36.07 | *** join/#openezx dimichxp (n=dimichxp@89.108.88.71) |
| 14:42.07 | *** join/#openezx WM|work (i=c88e3a12@gateway/web/ajax/mibbit.com/x-531b7511b4076db9) |
| 15:31.36 | *** join/#openezx jonwil (n=jonwil@CPE-124-178-174-96.wa.bigpond.net.au) |
| 15:31.49 | jonwil | hi |
| 15:33.16 | WM|work | hi jonwil |
| 15:33.51 | jonwil | Its good to see that someone has found a possible way into the motomagx phones |
| 15:34.06 | jonwil | The only question is whether kexec works on ARM and whether the kernels on the phones have the right support |
| 15:36.04 | jonwil | If we can use kexec to replace the kernel with a new one somehow, we can write something such that the phone boots up, the AM starts, it runs an autorun from a modified and flashed CG53 which kills all the motorola processes and loads a new kernel with kexec that can then reset all hardware to a known state (if need be) and boot whatever apps are needed |
| 15:39.38 | WM|work | jonwil: thats the plan :) |
| 15:39.56 | WM|work | jonwil: have you tried dimichxp exploit? |
| 15:40.49 | jonwil | no, I wait for the experts to release actual hacked kernel module or other files |
| 15:41.09 | jonwil | since I dont know enough about kernel mode programming or the ELF file format to do it myself |
| 15:42.18 | WM|work | jonwil: its very easy to use. see the README file. |
| 15:44.27 | jonwil | got a link to this readme file? |
| 15:45.12 | jonwil | to this download |
| 15:58.45 | *** part/#openezx ade|desk (n=adavey@194.200.143.249) |
| 16:09.16 | WM|work | jonwil: http://people.openezx.org/dmitriy/magx_module/ |
| 16:12.44 | jonwil | looks simple enough |
| 16:13.45 | jonwil | All I need now is a kernel module (and user space program) that can dump an arbitrary kernel address to disk |
| 16:14.03 | *** join/#openezx sabrod (n=sabrod@lns-bzn-35-82-250-233-5.adsl.proxad.net) |
| 16:14.41 | jonwil | on ARM, you dont have the x86 concept of kernel vs user addressing where different apps get different address spaces |
| 16:15.58 | jonwil | so with the right module, we can dump anything visible to the kernel (which may well include the very first code that is run when the phone boots up) |
| 16:19.46 | dimichxp | wait, on our armv6 we still have pretty good mmu, right? |
| 16:21.38 | jonwil | I know very little about ARM |
| 16:22.14 | jonwil | but I dont think ARM has the concept of logical vs physical addressing like x86 |
| 16:22.17 | jonwil | I could be wrong though |
| 16:22.53 | dimichxp | you kind of right. but only for old ARMs, like arm7tdmi used on p2k moto phones |
| 16:23.13 | dimichxp | but our ARM cpu has a mmu that translates virtual to physical address |
| 16:23.18 | dimichxp | using paging and so on |
| 16:24.57 | dimichxp | anyway i dumped the IROM code |
| 16:25.11 | dimichxp | it is actually what phone executes after reset |
| 16:25.16 | dimichxp | can upload if you need |
| 16:31.51 | jonwil | yes that would be nice |
| 16:32.26 | jonwil | if this is the code that runs when phone first boots (and which loads MBM and linuxboot and etc) that would be usefull |
| 16:32.59 | jonwil | I know for sure that there is code internal to the ARM CPU (which is what I guess this is) |
| 16:33.29 | dimichxp | yes, you are right |
| 16:34.54 | jonwil | What makes work on motomagx harder is that there is basically ZERO information out there about the SCMA11 |
| 16:35.14 | jonwil | such as exactly what instructions it supports |
| 16:35.20 | jonwil | and whether it has JTAG |
| 16:35.51 | jonwil | Although all the evidence I have seen suggests that motomagx has no jtag |
| 16:37.20 | *** join/#openezx Vhadel780 (n=l@92.117.124.93) |
| 16:37.41 | dimichxp | here you go http://people.openezx.org/dmitriy/irom/ |
| 16:37.56 | dimichxp | irom is splitted in two chunks |
| 16:38.02 | dimichxp | i wrote physical address |
| 16:38.33 | jonwil | has any work been done reverse engineering this irom? |
| 16:38.35 | dimichxp | i have done some disassembly, but it is not pretty useful, though |
| 16:39.42 | jonwil | who does signature check on bootloader? |
| 16:40.20 | dimichxp | irom checks singature of mbmloader (very short loader on a nand flash which checks and load mbm) and jumps to it |
| 16:41.19 | jonwil | is there just the one flash chip in a z6? |
| 16:42.03 | dimichxp | notably that the public key itself (super root key) is placed in the beginning of mbmloader. the irom checks hash of this public key against hash stored in phone's efuses |
| 16:42.12 | dimichxp | seems to be only one flash |
| 16:42.16 | dimichxp | really don't know |
| 16:43.21 | jonwil | btw. are you aware that motorola z6 schematics are available for download online? Dont know if they are legally released or not but they are out there |
| 16:43.23 | jonwil | v8 schems too |
| 16:44.08 | dimichxp | no i don't. sometimes service manuals for motorola phones are leaking from services |
| 16:44.19 | dimichxp | i'm nor sure if there is one for z6 |
| 16:44.33 | jonwil | I have definatly seen z6 schematics |
| 16:44.36 | jonwil | I have copy myself |
| 16:44.51 | dimichxp | that's kind of great |
| 16:47.02 | jonwil | now that I think about it I swear I saw jtag pins on the schematic that were marked NC |
| 16:47.52 | jonwil | Anyway, it looks like moto got the security on the z6 right (unlike, say, Apple with the iPhone) |
| 16:48.30 | jonwil | I think replacing mbm, mbmloader, linux loader, kernel or any signed parts of phone is not going to happen anytime soon |
| 16:49.04 | dimichxp | i think so too |
| 16:49.09 | jonwil | only hope is to boot phone and have it run something from unsigned part (CG52 or whatever it is) which uses kexec and other things to essentially "reboot" phone with what we want to run |
| 16:49.18 | jonwil | I just hope moto kernel has kexec support |
| 16:49.21 | jonwil | else we are really stuck |
| 16:51.01 | dimichxp | actually it doesn't support kexec. but we don't stuck at all. what's a problem to boot up a new kernel from existing? actually not a very very big problem. it's like a haret on winmobile |
| 16:51.55 | jonwil | well if there is a way to boot a new kernel in a way that the new kernel can take 100% ownership of all hardware resources and memory and stuff (i.e. no code from old kernel is still executing), thats GREAT |
| 16:52.24 | dimichxp | yes. just need to be implemented |
| 16:52.45 | dimichxp | i have done some work on it |
| 16:52.54 | dimichxp | still doesn't actually work |
| 16:53.29 | jonwil | I still intend to improve the tools I did further |
| 16:53.45 | jonwil | more specifically by adding stuff to do certain changes automatically |
| 16:53.54 | dimichxp | what a tools? |
| 16:55.43 | jonwil | http://www.motorolafans.com/forums/showthread.php?t=18376 |
| 16:55.50 | jonwil | Thats the thread I posted on motorolafans about these tools |
| 16:56.27 | jonwil | basically its a set of tools that can read the 2 unsigned CGs from the phone (the one with all the cfg files and the one with the ringtones, java apps, wallpapers, sounds etc) |
| 16:57.48 | dimichxp | sounds good. is it possible to flash a phone with this tool? under linux for example |
| 16:57.48 | jonwil | yes |
| 16:57.56 | dimichxp | great. some time ago i used to wrtie Scheme-powered motorola flasher. but didn't end this project |
| 16:59.25 | jonwil | I have sucessfully used the read part to read those 2 unsigned CGs (it also unsquashes them), then did edits to them (for telnet/ftp and others) and then used the write part of the tools to build new squshed CGs and write to phone |
| 17:02.37 | jonwil | the notable thing about this tools is that it shows how to read from a z6 (with it it is possible to read any part of flash) |
| 17:03.20 | dimichxp | so it is possible to do a backup of nand flash using bootloader in flash mode? |
| 17:03.51 | jonwil | yes you can read from z6 flash just like Flash&Backup does on windows (and for other phones) |
| 17:05.07 | dimichxp | good.. but we are still limited in writes. because of rsa. it'd be great to have alternative rootfs on sd card, with new kernel |
| 17:12.24 | jonwil | the way I see it, we produce something similar to my tools (most likely my tools with extra stuff) that reads your unsigned CGs from your phone, adds the new stuff needed for the loading of another kernel and flashes it back to the phone |
| 17:13.11 | jonwil | so you either have it set up that the phone boots as normal, the AM starts up, reads from the autoruns and autoruns something to load new kernel (which could reside on SD card) |
| 17:13.20 | jonwil | new kernel then loads whatever new userland we want |
| 17:14.24 | jonwil | good thing is that unlike ezx people who have to write kernel for phone mostly from scratch, we already have 2.6 kernel to hack on |
| 17:14.39 | jonwil | so we wont have problems with phone being unable to make calls |
| 17:14.50 | jonwil | since we can reuse motorola pieces that do that (libs etc) |
| 17:14.59 | dimichxp | how long it takes to boot a phone from powered off state to AM? |
| 17:15.05 | jonwil | no idea |
| 17:15.22 | jonwil | but unless we find way to load programs or kernel modules earlier than that, we have no other option |
| 17:16.00 | dimichxp | so it is not big problem, i can wait some time to boot just to have freeed phone |
| 17:17.44 | jonwil | obviously we would reuse all relavent code for z6 from opensource.motorola.com in our new userland I assume |
| 17:18.27 | jonwil | but would we want to reuse motorola binaries (such as telephony libs/daemon) or would we want to reverse engineer phone h/w and baseband and stuff and write our own? |
| 17:18.46 | *** join/#openezx TimRiker (n=timr@70-1-143-169.area1.spcsdns.net) |
| 17:19.38 | dimichxp | i think first of all, we should be able to boot at least precompiled userland. then we could think of further modifications |
| 17:19.46 | jonwil | yes |
| 17:20.38 | jonwil | I think first step is to be able to take official motorola kernel and userland from somewhere and via a kernel module hack (and an autorun entry) get the phone to boot and run our hack |
| 17:20.43 | jonwil | which then loads official kernel |
| 17:20.56 | jonwil | or maybe we make that kernel selfbuilt from mot sources |
| 17:21.03 | jonwil | but we keep mot userland |
| 17:21.42 | dimichxp | yes. the first thing we should do - boot a new kernel |
| 17:21.48 | jonwil | I dont want magx project to become like openezx where (even after all this time), a feature as fundemental as making a phonecall is listed as "highly experimental" |
| 17:22.34 | dimichxp | it depends on people. if someone wants to have fun making a free stack on top of magx phone - why not? |
| 17:22.42 | jonwil | true |
| 17:22.44 | jonwil | good point |
| 17:22.56 | dimichxp | everyone who do not want to do it just use motorola binaries, no problem i think |
| 17:23.08 | jonwil | some people will use mixtures of stuff |
| 17:23.26 | jonwil | with mot low level binaries (telepony daemon/libs etc) |
| 17:23.42 | jonwil | and a totally new userland (new GUI lib instead of mot qt and new apps on top of that) |
| 17:24.18 | jonwil | btw, I dont know if you know this or not but "baseband" on z6 is actually a DSP |
| 17:24.24 | jonwil | and not a full CPU |
| 17:24.49 | SuN | I imagine it's going to be a lot more complicated than the strict separation in EZX. |
| 17:24.56 | jonwil | yeah |
| 17:25.16 | dimichxp | and i think that full integration causes that protection problem |
| 17:25.31 | jonwil | EZX is only the way it is because mot code for thsoe phones is ancient (2.4 kernel etc) |
| 17:25.46 | dimichxp | they just getting our hands out of baseband. due to FCC regulation or something |
| 17:26.32 | jonwil | other reason for protection on z6 is for copy protected media files |
| 17:26.41 | jonwil | media player on z6 can play windows media audio/video DRM files |
| 17:26.53 | dimichxp | DRM sucks |
| 17:27.06 | jonwil | yes it sucks |
| 17:27.31 | *** join/#openezx TimRiker (n=timr@pdpc/supporter/bronze/TimRiker) |
| 17:31.36 | jonwil | but when you are a company like motorola, you have to have DRM |
| 17:32.04 | jonwil | if you dont have DRM, your phone wont be able to play downloaded audio and video (including a lot of ringtones and stuff) |
| 17:32.21 | dimichxp | no question |
| 17:33.21 | jonwil | I will say this though, I LOVE motorola phones but if someone was to release a linux based phone that was as open as OpenMoko but came in a form factor that didnt suck so much, I would seriously consider buying one |
| 17:34.41 | jonwil | Make one as a slider or candybar and you have me sold |
| 17:35.36 | jonwil | but since no-one makes the phone I want, my only choice is to buy the closest available phone (my Z6) and hack it to bits to make it do what I want :) |
| 17:36.13 | dimichxp | heh. it seems to be alway compromise beetwen opennes and good look |
| 17:39.07 | jonwil | I think the thing is, all the people doing "open" phones are going the route of touchscreen like openmoko |
| 17:39.16 | jonwil | because touchscreen is easy to do |
| 17:39.23 | jonwil | and easy to support in open code |
| 17:39.32 | jonwil | and readily available off-the-shelf |
| 17:39.52 | jonwil | finding kepad or such as an off-the-shelf part that someone can use for a small production run like openmoko is hard |
| 17:40.18 | *** join/#openezx pH5 (n=ph5@e178236040.adsl.alicedsl.de) |
| 17:45.05 | *** part/#openezx dimichxp (n=dimichxp@89.108.88.71) |
| 17:50.26 | ghane | jonwil: hi |
| 17:50.36 | jonwil | hi ghane |
| 17:51.05 | ghane | long time no see |
| 17:51.28 | jonwil | yeah |
| 17:51.37 | jonwil | good to see progress on magx hacking |
| 17:51.46 | ghane | ya |
| 17:51.58 | ghane | i'm at work now, have to look through the history tonight |
| 17:52.24 | jonwil | I grabbed some code written by dimichxp and I intend to pull out my linux box and try and compile it |
| 17:52.37 | jonwil | and run the new module on the phone and play with things |
| 17:56.06 | jonwil | I have doubts we will ever be able to replace signed parts directly and will have to go through the route of having the phone boot normally (with the mot kernel) and then having something run via the autorun mechanism which basically loads a new kernel and boots that, replacing the existing kernel |
| 17:56.40 | jonwil | dimichxp pointed me at a dump he made of the internal ROM of the ARM |
| 17:57.03 | jonwil | and he said that that intermal ROM does a sign check of something called mbmloader |
| 17:57.08 | jonwil | and then runs mbmloader |
| 17:57.14 | jonwil | mbmloader does a sign check of mbm |
| 17:57.17 | jonwil | and runs mbm |
| 17:58.00 | ghane | ya saw that |
| 17:58.09 | ghane | i actually been talking to him the last few weeks |
| 17:58.14 | jonwil | ok |
| 17:58.17 | ghane | only got an early release of his code :) |
| 17:58.22 | ghane | but now lunch |
| 17:58.23 | ghane | later |
| 17:58.29 | jonwil | ok, cya |
| 17:58.32 | ghane | :) |
| 17:58.33 | ghane | cya |
| 17:58.39 | jonwil | being that its 2am, I need sleep |
| 17:58.40 | jonwil | later |
| 18:32.04 | Vhadel780 | haha nederlands vs france... i like it |
| 18:32.32 | Vhadel780 | pardon if i tried to break a taboo |
| 21:06.57 | *** join/#openezx TimRiker (n=timr@70-1-32-70.area1.spcsdns.net) |