NMT:firmware - Revision history

Lundman at 05:56, 27 October 2011

2011-10-27T05:56:56Z

← Older revision		Revision as of 05:56, 27 October 2011
Line 19:		Line 19:
	* Balocco Box [http://www.telcominstrument.com/p_359_18_43_balocco-lettore-box-multimediale-nmt-media-player-hdtv-full-hd-matrioska-bittorrent-hdmi-mkv-h264-internet-lan-ethernet-browser-web-nas-upnp-p2p-youtube-harddisc.html telcominstrument.com] (eGreat clone)		* Balocco Box [http://www.telcominstrument.com/p_359_18_43_balocco-lettore-box-multimediale-nmt-media-player-hdtv-full-hd-matrioska-bittorrent-hdmi-mkv-h264-internet-lan-ethernet-browser-web-nas-upnp-p2p-youtube-harddisc.html telcominstrument.com] (eGreat clone)
	* Icy Box IB-MP309HW-B [http://www.networkedmediatank.com/showthread.php?tid=16868 www.networkedmediatank.com] does NOT have colour buttons on remote!		* Icy Box IB-MP309HW-B [http://www.networkedmediatank.com/showthread.php?tid=16868 www.networkedmediatank.com] does NOT have colour buttons on remote!
	* Popbox V8 [http://www.popbox.com/onlinestore/]		* Popbox V8 [http://www.popbox.com/onlinestore/ http://www.popbox.com/onlinestore/]

Lundman at 08:59, 26 October 2011

2011-10-26T08:59:10Z

Show changes

Lundman at 00:40, 6 October 2011

2011-10-06T00:40:51Z

Show changes

Lundman at 13:35, 5 October 2011

2011-10-05T13:35:41Z

Show changes

Lundman at 23:03, 17 August 2011

2011-08-17T23:03:31Z

Show changes

Lundman at 02:46, 17 August 2011

2011-08-17T02:46:56Z

Show changes

Lundman at 05:57, 16 June 2008

2008-06-16T05:57:05Z

@@ Line 147: / Line 147: @@
-== RusHD firmware ==
+=== Other firmwares ===
-Very similar. The difference here is that the rootfs that is inside the vmlinux image contains a whole lot more than usual, and is in '''cpio''' format. This has the base minimum for rootfs, with busybox etc.
+Pull out anything starting with '''gzip''' header from a binary file:
   perl -e '$file="test" ; $A=`cat $file` ; while ($A =~ /\x1f\x8b\x08/g) { $pos = length $`; $pos += 0; printf "%X\n", $pos; system("dd if=$file  of=2test.$pos.gz bs=$pos skip=1 > /dev/null 2>&1 "); system("gunzip -c 2test.$pos.gz > 2test.$pos")};'
-You can then run '''file test.*''' to see interesting things, in this case:
+You can then run '''file test.*''' to see interesting things, in particular tarball rootfs, and kernels.

Lundman at 02:11, 13 May 2008

2008-05-13T02:11:24Z

← Older revision		Revision as of 02:11, 13 May 2008
Line 178:		Line 178:

	# ls -l bin/		# ls -l bin/
	total 1760		total 1760
	-rwxr-xr-x 1 lundman lundman 777460 2008-05-13 09:45 bash		-rwxr-xr-x 1 lundman lundman 777460 2008-05-13 09:45 bash
	-r-xr-xr-x 1 lundman lundman 7158 2008-05-13 09:45 bashbug		-r-xr-xr-x 1 lundman lundman 7158 2008-05-13 09:45 bashbug

Lundman at 02:10, 13 May 2008

2008-05-13T02:10:24Z

← Older revision		Revision as of 02:10, 13 May 2008
Line 145:		Line 145:

	This makes me confident that I can find the decryption keys should I need to. I have no interest in doing so at this time, I only wanted to know I had the option should Syabas decide to attempt to plug the hole that lets me have root. So even if they did so now, I believe I have all the information needed to decrypt any future firmware (yes, even if they change it in future).		This makes me confident that I can find the decryption keys should I need to. I have no interest in doing so at this time, I only wanted to know I had the option should Syabas decide to attempt to plug the hole that lets me have root. So even if they did so now, I believe I have all the information needed to decrypt any future firmware (yes, even if they change it in future).


			== RusHD firmware ==

			Very similar. The difference here is that the rootfs that is inside the vmlinux image contains a whole lot more than usual, and is in '''cpio''' format. This has the base minimum for rootfs, with busybox etc.

			Pull out anything starting with '''gzip''' header:

			perl -e '$file="test" ; $A=`cat $file` ; while ($A =~ /\x1f\x8b\x08/g) { $pos = length $`; $pos += 0; printf "%X\n", $pos; system("dd if=$file of=2test.$pos.gz bs=$pos skip=1 > /dev/null 2>&1 "); system("gunzip -c 2test.$pos.gz > 2test.$pos")};'

			You can then run '''file test.*''' to see interesting things, in this case:

			# cpio -ivd --no-absolute-filenames < ../2test.2560000
			# ls -l
			total 120
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 bin
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 CVS
			drwx------ 7 lundman lundman 4096 2008-05-13 09:45 dev
			drwxr-xr-x 5 lundman lundman 4096 2008-05-13 09:45 etc
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 home
			lrwxrwxrwx 1 lundman lundman 12 2008-05-13 09:45 init -> /bin/busybox
			drwxr-xr-x 3 lundman lundman 4096 2008-05-13 09:45 lib
			lrwxrwxrwx 1 lundman lundman 11 2008-05-13 09:45 linuxrc -> bin/busybox
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 mnt
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 opt
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 proc
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 root
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 sbin
			drwxr-xr-x 2 lundman lundman 4096 2008-05-13 09:45 tmp
			drwxr-xr-x 6 lundman lundman 4096 2008-05-13 09:45 usr
			drwxr-xr-x 3 lundman lundman 4096 2008-05-13 09:45 var

			# ls -l bin/
			total 1760
			-rwxr-xr-x 1 lundman lundman 777460 2008-05-13 09:45 bash
			-r-xr-xr-x 1 lundman lundman 7158 2008-05-13 09:45 bashbug
			-rwxr-xr-x 1 lundman lundman 699300 2008-05-13 09:45 busybox
			-rwxr-xr-x 1 lundman lundman 9696 2008-05-13 09:45 fw_extract
			-rwxr-xr-x 1 lundman lundman 15804 2008-05-13 09:45 genxenv


			And so on. Now, I am not entirely sure how the real '''rootfs''' is stored, but if you read '''etc/init.d/S77misc''' you can quickly see how it is extracted:

			FW_FILE_OFF=6291968
			echo "Found /D/system/$FW_FILE_NAME, trying it"
			/bin/fw_extract /D/system/"$FW_FILE_NAME" $FW_FILE_OFF \|
			tar -C /firmware -xzf -

			So I simply did that as well, I ran '''fw_extract''' on my PCH.

			./fw_extract dune_firmware_rushd_080422_2238.dff 6291968 > bin-rootfs.tgz
			# tar -ztvf bin-rootfs.tgz
			-rwxr-xr-x alex/users 729 2008-04-23 03:38 ./scripts/boot.sh
			drwxr-xr-x alex/users 0 2008-04-23 03:38 ./dvdplayer2/
			drwxr-xr-x alex/users 0 2008-04-23 03:38 ./dvdplayer2/bin/
			-rwxr-xr-x alex/users 1110748 2008-04-23 03:38 ./dvdplayer2/bin/play_dvd
			-rwxr-xr-x alex/users 790 2008-04-23 03:38 ./dvdplayer2/run
			drwxr-xr-x alex/users 0 2008-04-23 03:38 ./ftpserver/

			Success.

			== iStar firmware ==

			Quite similar to PCH. I ran the giant perl line from RusHD to pull out all gzips, and found the rootfs pretty quickly.

			-rw-r--r-- 1 lundman lundman 43683840 2008-05-13 09:19 test.6480772

Lundman at 18:22, 27 January 2008

2008-01-27T18:22:53Z

@@ Line 13: / Line 13: @@
   -rw-rw-r-- 1 lundman lundman      108 Nov  2 22:27 usbupdate.html
-Looking at the large '''01-13-071101-13-POP-402-000.bin''' file first, we notice that it seems to have 76 byte header of some sort, followed by a romfs called '''SPLASH_BOOT'''.
+Looking at the large '''01-13-071101-13-POP-402-000.bin''' file first, we notice that it has a 76 bytes header.
   00000000  4c 00 00 00 22 5b 91 94  6c 2f 9f 6e 37 20 a1 2e  |L..."[..l/.n7 ..|