NMT:firmware: Difference between revisions

Revision as of 01:29, 13 November 2007

Network Media Tank Firmware

I downloaded a random version of the firmware, which looks like:

-rw-rw-r--  1 lundman lundman  32380583 Nov  8 00:58 01-13-071101-13-POP-402.zip

32Megs compressed. Inside that we have:

-rw-rw-r-- 1 lundman lundman 17970150 Nov  2 11:11 01-13-071101-13-POP-402-000.bin
-rw-rw-r-- 1 lundman lundman      723 Nov  7 23:32 README.txt
-rw-rw-r-- 1 lundman lundman 14536029 Nov  7 15:44 syb8634.nmt
-rw-rw-r-- 1 lundman lundman      108 Nov  2 22:27 usbupdate.html

Looking at the large 01-13-071101-13-POP-402-000.bin file first, we notice that it seems to have 76 byte header of some sort, followed by a romfs called SPLASH_BOOT.

00000000  4c 00 00 00 22 5b 91 94  6c 2f 9f 6e 37 20 a1 2e  |L..."[..l/.n7 ..|
00000010  8f 31 3c cd 61 59 d4 c4  53 aa 66 5b e6 00 ae 58  |.1<.aY..S.f[...X|
00000020  ee 3a 1a 92 0c e6 02 b3  22 8b 29 7c 50 9f 8e d0  |.:......".)|P...|
00000030  87 8a 91 09 32 a9 df df  68 0a 86 43 3d 7c 59 93  |....2...h..C=|Y.|
00000040  ce 85 27 59 56 bd 36 bf  76 8d 6d db 2d 72 6f 6d  |..'YV.6.v.m.-rom|
00000050  31 66 73 2d 00 53 18 f0  40 a7 b4 ad 53 50 4c 41  |1fs-.S..@...SPLA|
00000060  53 48 5f 42 4f 4f 54 00  00 00 00 00 00 00 00 49  |SH_BOOT........I|

If we cut out the first 76 bytes and mount it, we get:

-rw-r--r-- 1 root root  881252 Jan  1  1970 10xrpc_xload_audio_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
-rw-r--r-- 1 root root  326500 Jan  1  1970 11xrpc_xload_video_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
-rw-r--r-- 1 root root   30724 Jan  1  1970 12xrpc_xload_demux_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
-rwxr-xr-x 1 root root     773 Jan  1  1970 30vsyncparam_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.zbf
-rwxr-xr-x 1 root root   34262 Jan  1  1970 31bitmap_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.zbf
-rw-r--r-- 1 root root    6404 Jan  1  1970 32xrpc_xload_dviinit_prod.bin
-rw-r--r-- 1 root root  189524 Jan  1  1970 33xrpc_xload_irq_handler_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
-rw-r--r-- 1 root root 3975492 Jan  1  1970 50xrpc_xload_vmlinux_ES4_prod.bin
-rwxr-xr-x 1 root root      64 Jan  1  1970 dvi.bin

Definitely hardware boot. Loads the various microcodes for the Sigma 8635 chip, which personally I am not interested in. Lastly we appear to have the kernel itself at about 4Megs. However, all up, the whole thing is only 5MB in size. So there is more in the first file after the romfs. One of the values in the header is probably an offset. The size of the romfs is roughly 5.2MB, or 00531c00 in hex. Romfs header has 005318f0, plus 76 bytes at a guess.

But romfs are padded up to nearest 1024. So the size will be 00531c00, plus 76 bytes. This becomes 00531c4c.

005318e0  00 00 00 00 00 00 00 40  39 20 28 88 64 76 69 2e  |.......@9 (.dvi.|
005318f0  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|
00531900  01 00 00 00 00 00 64 00  72 00 00 00 02 00 00 00  |......d.r.......|
00531910  08 00 00 00 37 00 00 00  0c 00 00 00 89 00 00 00  |....7...........|
00531920  0f 00 00 00 04 00 00 00  33 00 00 00 30 00 00 00  |........3...0...|
00531930  3e 00 00 00 00 00 00 00  03 fe 9b ff 00 00 00 00  |>...............|
00531940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00531c50  05 00 00 00 c0 7c 00 00  00 00 00 00 00 00 00 00  |.....|..........|
00531c60  00 00 00 00 00 00 00 00  f4 80 00 00 04 00 ff 07  |................|
00531c70  d5 94 c5 33 40 8d 18 9e  17 41 5c e2 ad 49 9e 19  |...3@....A\..I..|
00531c80  11 6b a1 d5 21 76 76 4e  10 60 40 9e 7a 1d 01 52  |.k..!vvN.`@.z..R|
00531c90  89 5f c7 3a 98 bc 7f ef  b5 fe fd fa 7b 36 0b 32  |._.:........{6.2|
00531ca0  7f 29 ba 91 91 85 2c 77  fe 4a 14 c8 cf 91 0c 34  |.)....,w.J.....4|
00531cb0  5b 55 44 45 32 85 c7 9f  ed d0 26 d7 93 3d c7 b1  |[UDE2.....&..=..|
00531cc0  1a 7c 59 6b de db 10 c5  48 da 73 c7 6c a2 f1 0e  |.|Yk....H.s.l...|

I have no idea what this is. Probably compressed as it has no strings in it, nor repeated patterns. If I attempt to compress it, the filesize changes by less than 1%, so it is most likely compressed.

Appears not to be jffs2. Does not have the expected magic, not does jffs2dump like it at all.

Revision as of 00:43, 13 November 2007 (view source) Lundman (talk \| contribs) No edit summary ← Older edit		Revision as of 01:29, 13 November 2007 (view source) Lundman (talk \| contribs) No edit summary Newer edit →
Line 56:		Line 56:

	I have no idea what this is. Probably compressed as it has no strings in it, nor repeated patterns. If I attempt to compress it, the filesize changes by less than 1%, so it is most likely compressed.		I have no idea what this is. Probably compressed as it has no strings in it, nor repeated patterns. If I attempt to compress it, the filesize changes by less than 1%, so it is most likely compressed.

			Appears not to be '''jffs2'''. Does not have the expected magic, not does '''jffs2dump''' like it at all.