| Commit message (Collapse) | Author | Age |
| ... | |
| |
|
|
| |
Change-Id: If2e86bf8b520a8d4c38a56ac969918fdeb2c6f91
|
| |
|
|
| |
Change-Id: I41ce1005d997cf35153e085b19294bb7d418e968
|
| |
|
|
| |
Change-Id: I872e98f5810df3ecc975e025385f9c5ca7b47a44
|
| |
|
|
| |
Change-Id: I4f790441edac01ab2e8cb286c766ea0b272b4780
|
| |
|
|
| |
Change-Id: Iddff64502ba357dcd36903d31015b9ae2d00ae62
|
| |
|
|
|
|
|
|
|
| |
There is a windows port of the sg_utils library for scsi pass-
through. This little changes make it compile under mingw. A better
fix would be to implement direct ioctl on both windows and linux
but that's already better than nothing
Change-Id: I0d77cd1bad69806a66f0590362f165f24fa240e9
|
| |
|
|
| |
Change-Id: Ib014a102fe44a67dd256e45e804bca9b5812eb61
|
| |
|
|
| |
Change-Id: I4f3c659d65c1453b192cbce4bf6c85d882761929
|
| |
|
|
| |
Change-Id: I9ce73b907fa6276b9cd1f285156623bdafa6d548
|
| |
|
|
| |
Change-Id: If3ebae2e60f324c93f85a4f1a6f30257cccb735d
|
| |
|
|
| |
Change-Id: I0153192f41ccc5fb98e7e9f6f110d97bd76dbc47
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is a common problem that proprietary tools don't handle ELF
files correctly. ELF sections use a virtual address and the
virtual -> physical translation is done though segments. This
allows to have a load (physical) address different from the
virtual one. Here is the trick: proprietary tools usually don't
take the pain to do the translation and just grab the virtual
address. This commit implements proper translation in elftosb1
knowing that this introduce a deviation from the behaviour of the
proprietary tool.
Change-Id: I91721a3a8dead382a0603f84ae3b35c5eb9704eb
|
| |
|
|
|
|
|
| |
The tool still lacks some feature of the proprietary one but
can create files with all the basic features.
Change-Id: Ib0c91210940ca829291ce70945f88dc510a49974
|
| |
|
|
| |
Change-Id: I6530bdf27896d8325dec4e2ba31c7e6a0131a286
|
| |
|
|
| |
Change-Id: Ib68746e11b43eadbbe0443626d4dc65d998348fa
|
| |
|
|
| |
Change-Id: I17daaff068fcd3a8c70c52db5fa209082461173f
|
| |
|
|
| |
Change-Id: Ie00306a3c78e7490afe9964bd55ce53019e603ed
|
| |
|
|
| |
Change-Id: Ic36d3a8fcf09350dff5988eb860d76eb11608cc2
|
| |
|
|
| |
Change-Id: I34776ba3608bb5d25ce0d0fb3c6f228a4c9effc0
|
| |
|
|
|
|
|
|
| |
The PWM code was for testing only the Zen X-Fi and should be
present in general because it could touch pins by error and
without producing any result.
Change-Id: Id20e2940cd7a057941d241254d0a867f5451e2db
|
| |
|
|
| |
Change-Id: I6cfb432cd474ca00d7dff77577c0aa499b78fe2d
|
| |
|
|
| |
Change-Id: I13147009f2573d80c2c3dca2852a6d7b45174e9d
|
| |
|
|
|
|
|
| |
Some device only report the minimum (36 bytes) amount of inquiry
data so don't ask for more
Change-Id: Ie74d659f6e27b077acba160aeb87d1e7edf82e66
|
| |
|
|
| |
Change-Id: Id756cab14c9151ea74d628d002e1a203c5fbf01a
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It appears that all devices based on the Sigmaltel SDK support a
common vendor specific SCSI interface when in UMS mode. This
applies to the STMP36xx and the STMP37xx. This interface supports
many operations:
- get device info
- get device paritionning
- get janus/drm info
- read/write/allocate/erase any partition
- reset (chip or to updater and/or recovery)
This includes the ability to do a firmware upgrade by rewriting
the firmware partition. The tool currently does mostly nothing
but will be enhanced depending on the reverse engineering efforts
and the use of it. It has been tested on the Fuze+ and the Zen
X-Fi2/3.
Change-Id: Ibd4b2ad364c03ada4f9001573ef4cc87cfb041d1
|
| |
|
|
| |
Change-Id: I882956c0022db846882c68f8aac7f9d8fe49dfa8
|
| |
|
|
|
|
|
| |
The new tool fwcrypt can create a firmware image with a specified
model, version, region and so on.
Change-Id: I0e90e9ab905398a3e7ae3f4fb8b8bbfb2d12d703
|
| |
|
|
| |
Change-Id: I3a4fc048466b9e4d7290237efc1cefb07fd0a118
|
| |
|
|
|
|
| |
As noticed by bertrik some code accesses an array out of its bounds
Change-Id: I891d0305213ca7081c386b306f87fe9e1ba3b6c5
|
| |
|
|
| |
Change-Id: I6c8e5f3faf04741e4a13c1e705e9e869ccf8cfec
|
| |
|
|
|
|
|
|
|
| |
Samsung provides many firmware upgrade in the format of a .dat
file, at least for nearly all YP's (checked for Q2, R0, T10, Z5).
This is a simple cyclic xor which a fixed key, a md5 sum and a
header specifying the model/version/region.
Change-Id: Ib0461a74196383189fd2d8162da444a85a229c60
|
| |
|
|
|
|
|
|
|
| |
This tool is very preliminary but could be use for whatever
purpose since the format of the rsrc sections is now known.
By the way it appears that this format is the same as the
one use by the stmp36xx for its resources.
Change-Id: Idd7057f5cdce5af9726904169bb100c8bacb0981
|
| |
|
|
|
|
|
|
| |
While elf simplification is a powerful tool it can be useful to
prevent it from happening for debug purposes. Also add a missing
switch description in usage() and missing static.
Change-Id: I80a1904dc4340c412bd3de1c124a2e38d6ac11a2
|
| |
|
|
|
|
|
|
|
| |
This is less useful is most cases because sb2 doesn't have the
size restritions but some elf are produced with one section per
file and still yield dozens or hundreds of sections. And this free
anyway so we can do it.
Change-Id: Ia5ca83a8375063ecc7052d1ea73b2b21c00be730
|
| |
|
|
| |
Change-Id: Icfac5a2aa6a7b3582054321df003c6bb217b59d0
|
| |
|
|
|
|
|
|
|
|
| |
Load, fill and call/jump instructions are extracted as elf files
like for sb2. Because of the size limitations of the sb1
instructions, the resulting elf files can easily have hundreds of
sections. The (currently) implemented elf simplification method
will hopefully reduce this to a few sections only
Change-Id: I8fd6ed935ac3128f244bbd71c782e2a0a1c6d44a
|
| |
|
|
|
|
|
| |
Implement actual loading of a sb1 file to a structure in full
generality. Also implement dumping for debug purpose
Change-Id: I320035ea628719480a79aaccb05dce9a83256927
|
| |
|
|
| |
Change-Id: I701a301efa369c9e1247e10d226ba69e6064d1b2
|
| |
|
|
|
|
|
|
|
|
|
| |
The STMP36xx series also uses .sb files but with a different
format. The main differences are the encryption and the lack of
sections, making it basically a list of commands: fill, load,
call, jump, switch mode, set sdram settings. Currently only the
sbtoelf has support for the sb1 and can only dump the list of
commands. Actual support for elf creation will come later.
Change-Id: I1f2e0230c91ac64efd0e8430e0c5212098c599fd
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The hwemul tool is a small binary blob running on the device
that can received commands over USB. It is mainly intended to be
loaded using the recory mode and allows to read/write registers,
memory, use the OTP device, ... The tool is split into three
parts: dev/ contains the actual blob (which handles both imx233
and stmp3700), lib/ contains the communication library and can
also use the register description produced by the regtools/
to ease register by name, tools/ contains an interactive tool
to send commands to the device when running the blob.
Change-Id: Ie8cb32e987f825d8ed750d48071e43415b4dacb3
|
| |
|
|
|
|
|
|
|
|
|
|
| |
These files were produced by parsing some linux and/or sigmatel
provided headers and later tweaked by hand or by programs.
Each file describes one or more soc. A soc has a list of devices.
Each device can either be unique or have several copies at
different addresses. Each device has a list of registers which
can either be unique or indexed. Each register can further have
a list of fields. Registers with a SCT variant are also handled.
Change-Id: Ib50bb3fda268b6d5713f81bd8961de7978a5815e
|
| |
|
|
|
|
|
|
|
|
|
| |
These tools allow one to read a register description in a XML
file and to produce something useful out of it. Three example
programs are written:
- tester which simply prints the register tree
- headergen which produces a set of headers with the #define
- hwemulgen which produces something for the hwemul tool (to come)
Change-Id: I52573688b29d5faeaf64ce7c5ffe08ee8db3d33c
|
| |
|
|
| |
Change-Id: I9c3e2eb95f7eb6d41591b006328fd720dfcf93a5
|
| |
|
|
| |
Change-Id: Iaebb442611c64fe4d47a07ce3b3d12c3230cafe5
|
| |
|
|
| |
Change-Id: I9a15c347cfaab821b0cfc01744c5b6b8267c40ea
|
| |
|
|
| |
Change-Id: Iaa89df27b7a0c4eb9fc6603c431de3d1fe791fa1
|
| |
|
|
|
|
|
|
|
|
| |
There is a vendor specific command to read the NVP of the device,
including the KAS. The trick is that the data is randomly
scrambled using a so-called para_noise array of random values.
There seems to be a problem when retrieving large entries (>1000
bytes typically) which causes sg_pt do behave strangely.
Change-Id: Iefa6140df78ab9c7dcf7ac34cb1170979123ecd7
|
| |
|
|
|
|
|
|
|
|
| |
This tool can send vendor specific scsi commands to sony nwz
players such as getting serial number, model id, device info,
and others. It can potentially be used to get some private keys
stored on the device but probably not the KAS used to encrypt
firmware upgrades images(UPG).
Change-Id: Ia49c1edf8d421b20c4e9afeb1192e00e06eb6047
|
| |
|
|
|
|
| |
This tool can unpack UPG archives for firmware updates.
Change-Id: I32f5f1a84759198c7af4a4ecfd7aa65eaeda567a
|
| |
|
|
|
|
|
|
|
| |
This tool is specific to the em1/mp200 sony based players. In
deals with raw emmc images (which is possible but hard to get).
This tool is also useful as a documentation of the underlying
emmc format used for a future port.
Change-Id: I66c9b0e47351e5d89f6a404aa62038e00fdc1093
|