The version.sh tool tries to locate the repository root if no argument is
given but it doesn't really work. Instead explicitely give it the path to
the root.
Change-Id: Ie3a35cb3d41bbd8819823358763f714ad045527e
This is an improvement for the special
mode present in the samsung ypr0 target.
Apart adding new useful functionalities, it
fixes a random disconnection bug, solved by debouncing
and fully support to YP-R1 target.
This opens also the possibility to interface
this operating mode to rockbox USB functionality.
Change-Id: Id70541541fcfaa1234328485fab0696a3bd491c9
fixed a bug concerning bytes padding, since it wasn't correctly
implemented regarding original firmware structure.
This fixes ROM generation especially for ypr1.
Change-Id: I1a40fb4bb8f9d6b005d694246123e314c4d19b49
Reviewed-on: http://gerrit.rockbox.org/616
Reviewed-by: Thomas Martitz <kugel@rockbox.org>
They have been rewritten for being completely free and
as fast as possible.
Successfully extracted, patched, repacked and flashed
original firmware (tested on device and it worked)
Change-Id: I74d47d13f2dc3a2832a0d6821d3c2182dfd4b33b
Reviewed-on: http://gerrit.rockbox.org/506
Reviewed-by: Thomas Martitz <kugel@rockbox.org>
Tested-by: Thomas Martitz <kugel@rockbox.org>
This quick and dirty utility allows to extract nand bootloader
from raw 1st nand block dump. I post it mainly to somewhat
document how BCH error correction engine of the rk27xx works.
Change-Id: I37ca91add7d372e3576d2722afc946d0f08971a9
Now always generate a "make.db" file which aims at being the exact
representation of the file, ie running sbtoelf and elftosb using
the generated command file should produce the exact same file
(except for the random paddings). We still miss the support
for some option parsing to achieve that though.
Change-Id: Ib7d6b241f7855fd35225df8ab8e0711f69d9ee5a
This dump has been obtained with hwpatcher + hwstub, the fuze+
was running OF 2.36.8 in normal mode while playing some mp3.
Change-Id: Ieecaa760fe8ccade0858db929b9d7c175a3eaddf
This tool allows one to explore any register map. Register dumps
(like produced by hwstub tools) can be loaded and decoded by the
tool. Finally some analysers are provided for specific soc analysis
like clock tree and emi on imx233 for example.
Change-Id: Iaf81bd52d15f3e44ab4fe9bc039153fcf60cf92a
Remove the hackish elf_translate_addresses which should not have
existed in the first place, on write always compute the physical
address of a section using elf_translate_virtual_address which
makes it possible to specify any virtual to physical mapping and
fail nicely if there is none.
Change-Id: I4f436945e90280a6fd9430de6c642dbeb8e23d40
Rename STOP command to EXIT, introduce ATEXIT, this gives better
control over the exit of the stub. Add stmp implementation.
Change-Id: I45442c8b88b9330d12ef439417ca5ffa1520477a
Completely rewrite the Mafile, properly put the usb driver in its
own file and the target specific files in a subdirectory.
Change-Id: Iaeee0128e021d5dad76b4d6035a63e33e2d946c1
The generator now has more options to generate or not selectors.
It can also generate a macro header containing lots of using
macros for register operations.
Change-Id: I9dd6b4bdc7daeabd1a2c9365ce082358475721b5
The tool can now load sb1 and sb files to devices. Detection has
been improved and the tool can infer the packet size for the HID
description as well. The command line interface has been vastly
improved too, this breaks the old one.
Change-Id: I01a0ff8f8a007514aa81c56f114c0f0a86e3303c
Fix the stub in many way to correctly detect the STMP family and
act upon that. Drop some unused commands and bump version.
Rewrite the tool to allows scripting in lua and load the register
description from an XML file using the regtools. Introduce a new
tool to load and run code using the hwstub (either binary format
or Rockbox additive scramble format). Also switch to an optimise
version of the memcpy/move/set functions to correctly handle
alignement issue (like writing a full word/half-word when
possible for registers which is crucial)
Change-Id: Id1d5cfe0b1b47e8b43900d32c5cd6eafae6414f6
Change the XML description to unify multi dev/reg in a clean
fashion. Move the description parser to its own library. Fix
the tester and headergen tools to work with the new format and
library. Move the STMP3700/3780 descriptions to the new format
(and fixes many errors as well). Drop the hwemulgen tool
in favor on the upcoming hwstub tools revamp.
Change-Id: I7119a187aab5c8b083cc5228cb1b248ee29f184d
The register tools are in no way stmp specific. The XML
description of the registers is powerful enough to describe
the STMP register which should be more than enough to describe
virtually all other SoCs. The generators follow the STMP coding
convention but others could be used as well.
Change-Id: If1a9f56e4a3594161688de34adbea698e5aaecd8
The hwemul is only partly imx specific: the stub is stmp specific
but could be ported to other targets, the computer side and the
protocol are mostly stmp independent (or should be).
Change-Id: If88febffe591b0de86ea11cb740455ba20ddc401
During testing it can be useful to set an arbitrary (non-current) time on the
device. Extend time-sync to accept an additional (optional) parameter with the
time to set. Only changes date / time, no timezone.
Change-Id: Ib320777cb245cff19ca00b20540db3a43a4e488f
Correctly descramble the first stages (0 to 2) in continuous mode.
Also fix a disassembled (but unused) crc routine used in dfu mode.
Change-Id: I20016d1c696a9bcb6584377ee9b55493783c7159
This tool can upload a firmware to the device in DFU mode. The
protocol is the same as the rk27xx devices except that it can
load a bigger (unlimited ?) firmware.
Change-Id: Ic9d4c5087629a9156f9d5d5cdc80767e6359c431
After some reverse engineering, it appears that the keys of the
sb1 format are very weak: the 128 bytes are generated from the
laserfuse words 4,5 and 6 but in a weird manner: 4 and 5 are
simply ORed and 6 is only half used (somehow), making it "only" a
48 bit word to find.
Change-Id: I40702e19d0924ef51c01894efce3cb65bd664456
There is a windows port of the sg_utils library for scsi pass-
through. This little changes make it compile under mingw. A better
fix would be to implement direct ioctl on both windows and linux
but that's already better than nothing
Change-Id: I0d77cd1bad69806a66f0590362f165f24fa240e9
This is a common problem that proprietary tools don't handle ELF
files correctly. ELF sections use a virtual address and the
virtual -> physical translation is done though segments. This
allows to have a load (physical) address different from the
virtual one. Here is the trick: proprietary tools usually don't
take the pain to do the translation and just grab the virtual
address. This commit implements proper translation in elftosb1
knowing that this introduce a deviation from the behaviour of the
proprietary tool.
Change-Id: I91721a3a8dead382a0603f84ae3b35c5eb9704eb
The tool still lacks some feature of the proprietary one but
can create files with all the basic features.
Change-Id: Ib0c91210940ca829291ce70945f88dc510a49974
The PWM code was for testing only the Zen X-Fi and should be
present in general because it could touch pins by error and
without producing any result.
Change-Id: Id20e2940cd7a057941d241254d0a867f5451e2db
It appears that all devices based on the Sigmaltel SDK support a
common vendor specific SCSI interface when in UMS mode. This
applies to the STMP36xx and the STMP37xx. This interface supports
many operations:
- get device info
- get device paritionning
- get janus/drm info
- read/write/allocate/erase any partition
- reset (chip or to updater and/or recovery)
This includes the ability to do a firmware upgrade by rewriting
the firmware partition. The tool currently does mostly nothing
but will be enhanced depending on the reverse engineering efforts
and the use of it. It has been tested on the Fuze+ and the Zen
X-Fi2/3.
Change-Id: Ibd4b2ad364c03ada4f9001573ef4cc87cfb041d1
The new tool fwcrypt can create a firmware image with a specified
model, version, region and so on.
Change-Id: I0e90e9ab905398a3e7ae3f4fb8b8bbfb2d12d703
Samsung provides many firmware upgrade in the format of a .dat
file, at least for nearly all YP's (checked for Q2, R0, T10, Z5).
This is a simple cyclic xor which a fixed key, a md5 sum and a
header specifying the model/version/region.
Change-Id: Ib0461a74196383189fd2d8162da444a85a229c60
This tool is very preliminary but could be use for whatever
purpose since the format of the rsrc sections is now known.
By the way it appears that this format is the same as the
one use by the stmp36xx for its resources.
Change-Id: Idd7057f5cdce5af9726904169bb100c8bacb0981
While elf simplification is a powerful tool it can be useful to
prevent it from happening for debug purposes. Also add a missing
switch description in usage() and missing static.
Change-Id: I80a1904dc4340c412bd3de1c124a2e38d6ac11a2
This is less useful is most cases because sb2 doesn't have the
size restritions but some elf are produced with one section per
file and still yield dozens or hundreds of sections. And this free
anyway so we can do it.
Change-Id: Ia5ca83a8375063ecc7052d1ea73b2b21c00be730
Load, fill and call/jump instructions are extracted as elf files
like for sb2. Because of the size limitations of the sb1
instructions, the resulting elf files can easily have hundreds of
sections. The (currently) implemented elf simplification method
will hopefully reduce this to a few sections only
Change-Id: I8fd6ed935ac3128f244bbd71c782e2a0a1c6d44a
Implement actual loading of a sb1 file to a structure in full
generality. Also implement dumping for debug purpose
Change-Id: I320035ea628719480a79aaccb05dce9a83256927
The STMP36xx series also uses .sb files but with a different
format. The main differences are the encryption and the lack of
sections, making it basically a list of commands: fill, load,
call, jump, switch mode, set sdram settings. Currently only the
sbtoelf has support for the sb1 and can only dump the list of
commands. Actual support for elf creation will come later.
Change-Id: I1f2e0230c91ac64efd0e8430e0c5212098c599fd
The hwemul tool is a small binary blob running on the device
that can received commands over USB. It is mainly intended to be
loaded using the recory mode and allows to read/write registers,
memory, use the OTP device, ... The tool is split into three
parts: dev/ contains the actual blob (which handles both imx233
and stmp3700), lib/ contains the communication library and can
also use the register description produced by the regtools/
to ease register by name, tools/ contains an interactive tool
to send commands to the device when running the blob.
Change-Id: Ie8cb32e987f825d8ed750d48071e43415b4dacb3
These files were produced by parsing some linux and/or sigmatel
provided headers and later tweaked by hand or by programs.
Each file describes one or more soc. A soc has a list of devices.
Each device can either be unique or have several copies at
different addresses. Each device has a list of registers which
can either be unique or indexed. Each register can further have
a list of fields. Registers with a SCT variant are also handled.
Change-Id: Ib50bb3fda268b6d5713f81bd8961de7978a5815e
These tools allow one to read a register description in a XML
file and to produce something useful out of it. Three example
programs are written:
- tester which simply prints the register tree
- headergen which produces a set of headers with the #define
- hwemulgen which produces something for the hwemul tool (to come)
Change-Id: I52573688b29d5faeaf64ce7c5ffe08ee8db3d33c
There is a vendor specific command to read the NVP of the device,
including the KAS. The trick is that the data is randomly
scrambled using a so-called para_noise array of random values.
There seems to be a problem when retrieving large entries (>1000
bytes typically) which causes sg_pt do behave strangely.
Change-Id: Iefa6140df78ab9c7dcf7ac34cb1170979123ecd7
This tool can send vendor specific scsi commands to sony nwz
players such as getting serial number, model id, device info,
and others. It can potentially be used to get some private keys
stored on the device but probably not the KAS used to encrypt
firmware upgrades images(UPG).
Change-Id: Ia49c1edf8d421b20c4e9afeb1192e00e06eb6047
This tool is specific to the em1/mp200 sony based players. In
deals with raw emmc images (which is possible but hard to get).
This tool is also useful as a documentation of the underlying
emmc format used for a future port.
Change-Id: I66c9b0e47351e5d89f6a404aa62038e00fdc1093
The raw encode mode allows to use the raw encode_page routine on
any file which proved to be useful. The guessed fields of the
headers are based on some rk2918 headers which leaked. They are
mainly informative though (date, version, chip).
Change-Id: I139ea0c40f76b6dde041c448bbf3e7ecf9cab24a
If no output prefix is specified, a default is picked:
- filename with extension replaced by .afi for FWU files
- filename with extension replaced by .fw/ for AFI files
- filename without extension and with / for FW files
Change-Id: I6497b8f4a49f1238e5db738429f687cad3ae8a5a
The update_extract tool works by finding the compressed size and
the compressed data in the updater. This is problematic since
without the uncompressed size, inflate can produce extra bytes
at end. This is not a problem for our tools but the device will
plain reject it if sent by MTP/sendfirm for example.
Workaround this issue by reading and rewriting the archive
after decompression so that only the meaningfull data is written.
Change-Id: I117f434b92a56d93d269af49c3e426cd8cc0c7e4
In the case of encrypted SB files without any key match, it is
still possible to dump the section headers. The force option
allows one to do so. It also allows to dump unencrypted sections
of encrypted files if there are some.
Change-Id: I36280230679ac5903f9c451c68c276f5c6959536
I finally found a sensible format for the executable files.
The tool now can output the loading entry to elf files. Some
disassembly and analysis suggest the phys/virt addresses are
correct. However the entries are somehow linked and it is
still unclear how (are there "calls" to the code ? when ?).
Change-Id: Ied38b5bb297176c5755b5ecb3309f4a259c18cd4
I found out that the file has a number of "entries", in
3 categories. The third category seem to contain bootable files.
In the RKnano firmware file I have, these entries are named
"NandBoot1" and "NandBoot2". They seem to use the same format as
the stage3 of the RKnanoFW format but we do not understand this
format precisely for now anyway.
Change-Id: I72d77e609cdeeb802af793c010d6788bf36cd7e2
To support fm radio a kernel module was written. This module is added to
the patched firmware that loads Rockbox. It's pre-compiled but its source
archive provided.
The kernel module provides raw-access to the built-in si4709 radio chip.
Our existing si 47xx drivers can be re-used this way.
The module itself was written Lorenzo Miori, I only integrated it
into the tree.
Change-Id: I6205d28a505d57791eaeb627e6856b9a1eaeaeaa
When scraping files from the repository allow passing an additional list of
files for which the timestamp of the last change is retrieved. Since this is
slow (the log needs to be traversed, since a blob doesn't know about commits
its referenced by) only specified files get this retrieved.
Change-Id: I61a2ef812ac18ffb5898c01ce070046d4ca00a15
The old script depended on svn. An earlier version of this script has already
been used in the 3.11. branch.
Change-Id: Id03abb8f7bd005ede343243194c4453f0b2e8943
The Rockbox source code uses 7z for its archive for size reasons. Add support
for compressing as 7z (by calling the 7z command line utility) so it can be
used for generating Rockbox source archives.
Change-Id: I26097ff61ff183e5ddc07b2c4473f90dc0700178
Don't rely on the build host having the same bitsize as the created binary.
Fixes building a 32bit binary getting a "64bit" postfix when built on a 64bit
Linux.
Change-Id: I2aa61dee82beddd60ebfc8e227551ea49d769664
It should not exit() anymore on error except on malloc failure.
Resource leaks on errors (especially I/O) are quite likely though.
Change-Id: I6fcf72fb08fc683468b390d0b8745d31ca982b48
On Windows /dev/random does not exist, so trying to open it will fail. Replace
it with rand() which is available on all supported platforms and sufficient.
Fixes mkimxboot not working, as well as Rockbox Utility "crashing" (which is in
fact its error handler calling exit(), thus terminating Rockbox Utility) on
Windows.
Change-Id: Ia164f937f329877e8f80f473f27be8c5df2a0a68
Windows requires files to be explicitly opened as binaries, otherwise it will
perform line ending translations. We really don't want the OS to mess with
that.
Change-Id: Id56de354b7ad0e5b056540755f7108456f3263ed
First and rather rough adjustment for git. There are still a lot of places
referring to svn, and various functionality might be broken which needs fixing
later.
Change-Id: Ia628f06e99f527e01f131ce674746fba77d97d23
With git it's not possible to simply export a set of paths from the server
directly. This module offers a similar functionality, but requires a local
clone of the repository. It calls git directly for maximum portability.
This is a prerequisite to making the deployment script used for Rockbox Utility
work again.
Change-Id: I1aca8ddd40d16b6268c1d6a2fc23ac59e964c3c6
This port is a hybrid native/RaaA port. It runs on a embedded linux system,
but is the only application. It therefore can implement lots of stuff that
native targets also implement, while leveraging the underlying linux kernel.
The port is quite advanced. User interface, audio playback, plugins work
mostly fine. Missing is e.g. power mangement and USB (see SamsungYPR0 wiki page).
Included in utils/ypr0tools are scripts and programs required to generate
a patched firmware. The patched firmware has the rootfs modified to load
Rockbox. It includes a early/safe USB mode.
This port needs a new toolchain, one that includes glibc headers and libraries.
rockboxdev.sh can generate it, but e.g. codesourcey and distro packages may
also work.
Most of the initial effort is done by Lorenzo Miori and others (on ABI),
including reverse engineering and patching of the original firmware,
initial drivers, and more. Big thanks to you.
Flyspray: FS#12348
Author: Lorenzo Miori, myself
Merry christmas to ypr0 owners! :)
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@31415 a1c6a512-1295-4272-9138-f99709370657
For the git migration we want a nice clean repository with UNIX line
endings. git does not use svn:eol-style, we just need the file contents to be
sane.
Sorry everybody. I know this messes up blame.
Scumbag *NIX developer says migrating to git will make line ending issues go
away; commits giant change to svn which changes line endings anyway. :)
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30924 a1c6a512-1295-4272-9138-f99709370657
The current implementation fails silently if Windows Media Player is version
10. Add a check and inform the user if the version installed is too old to work
properly with beastpatcher.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30864 a1c6a512-1295-4272-9138-f99709370657
The _GET_CPU macro will write a terminating zero at cpu[8].
Detected by cppcheck
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30749 a1c6a512-1295-4272-9138-f99709370657
