Project BraviaGo

Katılım
12 Haziran 2011
Mesajlar
14.298
Makaleler
3
Çözümler
6
Yer
Nebuchadnezzar
Daha fazla  
Meslek
Judge Dredd
Reverse Engineering Bravia KDL-52LX900 Firmware.


Index:
Update! Service Manuals!
The Firmware: 00050100_01fb0000.bin

The source code: Sony Global - Source Code Distribution Service

It is now certain that TV runs Linux 2.6.22. Look down for the nmap result. 2 ports open via Wireless, 4 ports open via LAN.

The firmware is updated via USB. When insterted, TV detects USB and looks for the Firmware. After that TV unpacks the firmware and then flashes. This takes about 30 seconds. TV reboots itself.

The firmware consists of:

Kod:
linux-kernel 
busybox 
pump-autoip 
libjs dosfstools 
directfb 
iptables 
cairo 
glib 
pango 
exceptionmonitor

Binwalk analysis (Probably Wrong) - Now re-analyzed with BinWalk 4.1:

Kod:
binwalk: /usr/local/lib/libcurl.so.4: no version information available (required by binwalk)

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
24439192  	0x174E998 	BFLT executable  version 3698180314,  code offset: 0xD0DBFC89,  data segment starts at: 0xFC57E3C8,  bss segment starts at: 0x314AD91C,  bss segment ends at: 0x579AC36E,  stack size: -209315630 bytes,  relocation records start at: 0x10C36FC1,  number of reolcation records: 1388897630,  gotpic gzdata
40790549  	0x26E6A15 	gzip compressed data, ASCII, has CRC, extra field, last modified: Sat Dec  8 07:18:40 2012

New Firmware Version from Sony Analyzed:

Kod:
root@ubuntu:/home/İndirilenler/sony_dtv0FA00A00A0A0_00050100# binwalk fw.bin
binwalk: /usr/local/lib/libcurl.so.4: no version information available (required by binwalk)

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
9400157   	0x8F6F5D  	JFFS2 filesystem data little endian, JFFS node length: 840583
15166178  	0xE76AE2  	gzip compressed data, ASCII, has CRC, has comment, comment, encrypted, last modified: Thu Jul 25 23:42:10 2019
15652966  	0xEED866  	JFFS2 filesystem data little endian, JFFS node length: 572650
29628716  	0x1C4192C 	JFFS2 filesystem (old) data little endian, JFFS node length: 692636
 
Widget Development Kit for the TV

DOWNLOAD THE VM

ubuntu_10.04_ctv.vmwarevm.7z

(641.83 MB)
Step 1

Download and uncompress this distribution of the Ubuntu 10.04 virtual machine. This very large file (over 650 MB) is archived using 7-Zip (Download) and may take a long time to download.
DOWNLOAD THE WDK

ywe-wdk-i386.zip (7.6 MB)
Step 2

Once you have downloaded the virtual machine (VM), open the VM with VMware or VirtualBox and install this WDK Debian software package on the VM.
 
nmap result:

Kod:
Starting Nmap 5.21 ( http://nmap.org ) at 2011-10-14 20:51 EEST
NSE: Loaded 36 scripts for scanning.
Initiating ARP Ping Scan at 20:51
Scanning 10.0.0.49 [1 port]
Completed ARP Ping Scan at 20:51, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:51
Completed Parallel DNS resolution of 1 host. at 20:51, 0.00s elapsed
Initiating SYN Stealth Scan at 20:51
Scanning braviaffb549ae53e8ded4.zyxel.com (10.0.0.49) [65535 ports]
Discovered open port 9784/tcp on 10.0.0.49
Discovered open port 52323/tcp on 10.0.0.49
Completed SYN Stealth Scan at 20:51, 29.79s elapsed (65535 total ports)
Initiating Service scan at 20:51
Scanning 2 services on braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
Completed Service scan at 20:51, 5.34s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
NSE: Script scanning 10.0.0.49.
NSE: Script Scanning completed.
Nmap scan report for braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
Host is up (0.0034s latency).
Not shown: 65533 closed ports
PORT      STATE SERVICE    VERSION
9784/tcp  open  tcpwrapped
52323/tcp open  tcpwrapped
MAC Address: 00:A0:96:43:9B:98 (Mitumi Electric CO.)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.22
Uptime guess: 0.505 days (since Fri Oct 14 08:44:28 2011)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=204 (Good luck!)
IP ID Sequence Generation: All zeros


HOP RTT     ADDRESS
1   3.42 ms braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)


Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.97 seconds
           Raw packets sent: 65983 (2.904MB) | Rcvd: 65551 (2.623MB)

Processor of the TV:

Bravia Engine 3

Renesas(NEC)EMMA3TH (MC-10153)

Sony Bravia 52LX900 Service Menu:
  1. Turn off the TV
  2. Press i+, 5, Mute and then Power
  3. TV will power up with the service menu
Press 0 and 8 to reset TV settings.

DSC_0005-1.jpg
 
Finally opened up the TV. For the whole album: http://photobucket.com/52LX900/


The board used on the TV has a part number of 1-881-779-12 but a search on Google does not show anything up. But very interesting, Sony says that MCB FOR TV with part number 185776211 can be used on 52LX900. Also accroding to the service manual, it is A-1783-050-A

DSC_0032.jpg




Tha panel:

Manufacturer Part#: A1793141A (Also search for: A-179-3141-A)
Manufacturer: SONY PARTS
Description: P-MOD 52LETT

And more info: The panel have Sharp UV2A technology.

DSC_0020.jpg


This is the CN202 Port on Sharp CPWBX RUNTK 4351TP:

DSC_0050.jpg


And Sharp CPWBX RUNTK 4351TP:

DSC_0046.jpg


CN201 and CN104 . I don't know whether they are ports or not. These are on Sharp CPWBX RUNTK 4351TP:

DSC_0044.jpg



After this part, everthing is you will see is on the mainboard of the TV (1-881-779-12 - the photo on the top), not the Sharp LED controller.

Part number 015402105. Got some info here and here saying "Pin, Cotter". Also interesting ABCDEF pins...:

DSC_0042.jpg


CN5502 Port on Sony 1-881-779-12 Board. Also on top, LC245 IC.

Another printing I saw on the board: 603N4033-01R

DSC_0041.jpg


CN2300, J2300 CN2404, CN3800 ports and a "DIP" (maybe DIP switch):

DSC_0039.jpg


Sony D2817R IC with a port at the bottom. Looks like a JTAG but no info...

DSC_0037.jpg


Sony CXA3803R Audio DAC + Driver for TV:

DSC_0034.jpg


CN2400 Ethernet port. Micrel KSZ8041RNL IC is used for that. It is 10BASET/ 100BASE-TX. Why not Gbit Sony? Anyway it is labeled as IC2400. There are also CN2600, CN5500, CN5501 and for the record, F5500 3.15A

DSC_0033.jpg


IC5000, CN5001, CN5000, IC3704, F3702, F1000 3.15A and CN2902 which is Optical output:

DSC_0031.jpg


AD0G22153381
SUT-AE101Z
859772000
1324665

I could not find any info about this part buy Sony may find me with the barcode lol :)

DSC_0030.jpg


NEC 720114 USB 2.0 Controller dubbed IC2403 This is not controllinng the USB port of the TV. Probably goes to wireless adapter.

DSC_0028.jpg


2 x Samsung 025 K9F1208U0C-PIB0 64M x 8 Bits NAND Flash Memory.

DSC_0027.jpg


Fujitsu Japan MB91F313A

The FR family* is a line of microcontrollers based on a high-performance 32-bit RISC CPU that contains a
variety of built-in I/O resources for embedded control applications which require high-performance, highspeed CPU processing.
MB91313A series has multiple communication macro channels, suitable for embedded control applications
such as TV control.
* : FR, the abbreviation of FUJITSU RISC controller, is a line of products of Fujitsu Semiconductor Limited.

DSC_0026.jpg


IC2200 Slicion Image Sil98278CNU. No info on the web but it is the HDMI controller of the 4 HDMI ports on the board. One of them dubbed CN2261

DSC_0025.jpg


CN2403. Interesting that NEC USB controller was also dubbed IC2403. This port is empty. Maybe it's our magic port :)

DSC_0014.jpg


The blue PCB at the bottom is the Wireless card connected via USB 2.0 to NEC Controller. The cable is custom made by Sony.

DSC_0012.jpg


The whole board with the CPU and all the other ICs and connectors. I did not remove the CPU cooler thinking that I could find info about the board and learn the CPU but that did not work. I may remove it later to see the CPU. Requires some soldering....

DSC_0009.jpg


This is the back of the TV. On the left, the power supply. In the middle, Sharp CPWBX RUNTK 4351TP and on the right, 1-881-779-12 board.

DSC_0002.jpg


The power supply board APS-267 with the part number 1-881-894-11

DSC_0005.jpg


APS-267 GE4A & APS-268 GE4B

DSC_0007.jpg


Part number 1-881-894-11

DSC_0008.jpg
 
Parts used in 52LX900

spacer.gif
Model
spacer.gif
Part
Requested
spacer.gif
Part
Supplied
spacer.gif
Description
spacer.gif
List Price
spacer.gif
Add
Cart
spacer.gif
My
Cat.
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
419727601
spacer.gif
419727601
spacer.gif
BACKED ALUMINUM FOIL
spacer.gif
3,54 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418430302
spacer.gif
418430302
spacer.gif
BRACKET SP (PIA)
spacer.gif
8,74 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
A1785373A
spacer.gif
A1785373A
spacer.gif
P-MOD 52LETT
spacer.gif
3.588,90 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694201
spacer.gif
418694201
spacer.gif
FRAME VR (52 PIA2)
spacer.gif
62,91 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
X25460892
spacer.gif
X25460892
spacer.gif
BASE (LL1) ASSY
spacer.gif
87,78 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
419727701
spacer.gif
419727701
spacer.gif
BACKED ALUMINUM FOIL
spacer.gif
7,22 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
419876901
spacer.gif
419876901
spacer.gif
PRECUT TEX TAPE FOR TECH USE
spacer.gif
0,92 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694311
spacer.gif
418694301
spacer.gif
FRAME VL (52 PIA2)
spacer.gif
62,91 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
419728111
spacer.gif
419728111
spacer.gif
BACKED ALUMINUM FOIL
spacer.gif
1,33 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
A1793141A
spacer.gif
A1793141A
spacer.gif
P-MOD 52LETT
spacer.gif
Call 1-800-538-7550 for information.
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694501
spacer.gif
418694501
spacer.gif
FRAME HB (52 PIA2)
spacer.gif
93,11 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
185776211
spacer.gif
185776211
spacer.gif
MCB FOR TV
spacer.gif
342,43 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
191010122
spacer.gif
191010122
spacer.gif
HARNESS ASSY
spacer.gif
30,84 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
181109911
spacer.gif
A1785373A
spacer.gif
P-MOD 52LETT
spacer.gif
3.588,90 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694411
spacer.gif
418694401
spacer.gif
FRAME HT (52 PIA2)
spacer.gif
76,15 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694401
spacer.gif
418694401
spacer.gif
FRAME HT (52 PIA2)
spacer.gif
76,15 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
148772012
spacer.gif
148772012
spacer.gif
REMOTE COMMANDER (RM-KD013)
spacer.gif
98,18 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694202
spacer.gif
418694201
spacer.gif
FRAME VR (52 PIA2)
spacer.gif
62,91 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
418694301
spacer.gif
418694301
spacer.gif
FRAME VL (52 PIA2)
spacer.gif
62,91 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
KDL52LX900
spacer.gif
419727801
spacer.gif
419727801
spacer.gif
BACKED ALUMINUM FOIL
spacer.gif
8,74 YTL Availability
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
spacer.gif
 
For this TV here is a string dump from the raw flash dump starting at 0x63A70:
Kod:
Mar 30 2010
20:18:31
/ms/mssony/abk/bin
exec_
/rom/bin
preboot
autoboot
/rom
/ram
message
macaddr
boardip
netmask
hostip
gateway
SONY       CXD9645GB
NEC        uPD61060
NEC        uPD720102OHCI
NEC        uPD720102EHCI
NS         DP83815D
SONY       CXD9744GA
SONY       CXD9740GA
Toshiba    Tx4927
Toshiba    TC81240
TeraLogic  TL811
TeraLogic  TL850
SONY       PIF3
SONY       VIRGIL
NEC     
   MC10024
SONY       WAGNER
INTEL      i82559
PLX        PCI6152
SONY       BB3
REALTEK    RTL8100C
REALTEK    RTL8110SC
File already open
File not open
File write protected
File not found
Illegal path
Illegal file type
End of file
Write protected
File already exists
FileSystem full
No media
Write error
Read
 error
Erase error
System error
Media error
Format error
Check sum error
Command error
Mode error
Too many file open
Erase hungup upper
Erase hungup lower
Erase time out
Write hungup upper
Write hungup lower
Write time out
Busy error
Protocol error
File exists
Illegal parameter
No data
Device error
Initialize error
Address error
Not found
Time out error
Category error
Version error
Data corrected
ECC corrected
Uncorrectable error
Upper device error
Lower device error
Syntax error
Error : 
%s : 
Interrupt
TLB modification
TLB(load or fetch)
TLB(store)
Address error(load or fetch)
Address error(store)
Bus erro
r(instruction)
Bus error(data)
Syscall
Breakpoint
Reserved instruction
Coprocessor Unusable
Arithmetic Overflow
Trap
Floating-Point
Coprocessor 2
MDMX Unusable
Watch
Machine Check
Cache Error
[NMI]
[Exception]
   status:$12: 0x%08x, 
cause:$13: 0x%08x %s
 badvaddr: $8: 0x%08x, 
[31m
EPC:$14:   0x%08x, 
ErrorEPC:$30: 0x%08x
[register dump]
 at: r1: 0x%08x, 
v0: r2: 0x%08x, 
v1: r3: 0x%08x, 
a0: r4: 0x%08x
 a1: r5: 0x%08x, 
a2: r6: 0x%08x, 
a3: r7: 0x%08x, 
t0: r8: 0x%08x
 t1: r9: 0x%08x, 
t2:r10: 0x%08x, 
t3:r11: 0x%08x, 
t4:r12: 0x%08x
 t5:r13: 0x%08x, 
t6:r14: 0x%08x, 
t7:r15: 0x%08x, 
s0:r16: 0x%08x
 s1:r17: 0x%08x, 
s2:r18: 0x%08x, 
s3:r19: 0x%08x, 
s4:r20: 0x%08x
 s5:r21: 0x%08x, 
s6:r22: 0x%08x, 
s7:r23: 0x%08x, 
t8:r24: 0x%08x
 t9:r25: 0x%08x, 
gp:r28: 0x%08x, 
sp:r29: 0x%08x, 
s8:r30: 0x%08x
 ra:r31: 0x%08x, 
hi:   : 0x%08x, 
lo:   : 0x%08x
/ms/mssony/abk/bin/jigid
NEC EMMA3TH %1d.%1d
NEC EMMA3TH2 %1d%1d
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789#$
frzkey
%02x
IndexInvalidate_I
IndexWritebackInvalidate_D
IndexLoadTag_I
IndexLoadTag_D
IndexStoreTag_I
InxStoreTag_D
CreateDirtyExclusive_D
HitInvalidate_I
HitInvalidate_D
Fill_I
HitWritebackInvalidate_D
HitWriteback_I
HitWriteback_D
Index
Random
EntryLo0
EntryLo1
Context
PageMask
Wired
BadVAddr
Count
EntryHi
Compare
Status
Cause
PRId
Config
LLAddr
WatchLo
WatchHi
XContext
CacheErr
TagLo
TagHi
ErrorEPC
Scratch
zero
move
blez
bgtz
addi
addiu
slti
sltiu
andi
xori
beql
bnel
blezl
bgtzl
daddi
daddiu
cache
lwc1
lwc2
ldc1
ldc2
swc1
swc2
sdc1
sdc2
sllv
srlv
srav
jalr
movz
movn
syscall
break
sync
mfhi
mthi
mflo
mtlo
dsllv
dsrlv
dsrav
mult
multu
divu
dmult
dmultu
ddiv
ddivu
addu
subu
sltu
dadd
daddu
dsub
dsubu
tgeu
tltu
dsll
dsrl
dsra
dsll32
dsrl32
dsra32
ssnop
rorv
drorv
mulu
muls
mulsu
macc
maccu
msac
msacu
mulhi
mulhiu
mulshi
mulshiu
macchi
macchiu
msachi
msachiu
dror
dror32
madd
maddu
mul64
msub
msubu
dclo
dclz
bltz
bgez
bltzl
bgezl
tgei
tgeiu
tlti
tltiu
teqi
tnei
bltzal
bgezal
bltzall
bgezall
mfps
mfpc
mtps
mtpc
mfc0
dmfc0
cfc0
mtc0
dmtc0
ctc0
mfc1
dmfc1
cfc1
mtc1
dmtc1
ctc1
bc0f
bc0fl
bc0t
bc0tl
bc1f
bc1t
bc1fl
bc1tl
tlbr
tlbwi
tlbwr
tlbp
eret
wait
.word
%08x : %08x
0x%08x
# %c0x%x
-0x%x
0x%x
0x%08x
/.history
serial
locked_by_rng
commonkey
ilin
kkey
dlnakey
podkey
podauthkey
poddhkey
marlinkey
sbbkey
cipluskey
marlinbbkey
ustvid2key
ustvid4key
ustvidseed
/.environment
serial '%s'
%s '%s'
Environment
$mount
UVFAT
Aperios 
ABK     
partition%d : %7d blocks ID %02x
[31mrenaming error : %s/%s 
<<< file-system check >>>
[0m--> recoverd
[31mFAT link error : %s/%s cluster %04x 
[0m--> removed
[31mFAT cluster error : %s/%s cluster %04x 
[31mfile size error : %s/%s %d %d 
FAT[%04x] = %04x, 
[31mdirectory start cluster error : %s/%s
[31mFAT floating entry error : 
.frs
.FRS
.frz
.FRZ
.mot
.MOT
.mip
.MIP
Execute.
Load File : %s
pentry
MIP format Address Error line %d %08x
MIP format Error line %d : %08x : [%s]%s
/dev/serial
octet
blksize
1024
ping
ifconfig
read
F@&1
F@&1
Mar 30 2010
20:18:31
/ms/mssony/abk/bin
exec_
/rom/bin
preboot
autoboot
/rom
/ram
message
macaddr
boardip
netmask
hostip
gateway
SONY       CXD9645GB
NEC        uPD61060
NEC        uPD720102OHCI
NEC        uPD720102EHCI
NS         DP83815D
SONY       CXD9744GA
SONY       CXD9740GA
Toshiba    Tx4927
Toshiba    TC81240
TeraLogic  TL811
TeraLogic  TL850
SONY       PIF3
SONY       VIRGIL
NEC     
   MC10024
SONY       WAGNER
INTEL      i82559
PLX        PCI6152
SONY       BB3
REALTEK    RTL8100C
REALTEK    RTL8110SC
File already open
File not open
File write protected
File not found
Illegal path
Illegal file type
End of file
Write protected
File already exists
FileSystem full
No media
Write error
Read
 error
Erase error
System error
Media error
Format error
Check sum error
Command error
Mode error
Too many file open
Erase hungup upper
Erase hungup lower
Erase time out
Write hungup upper
Write hungup lower
Write time out
Busy error
Protocol error
File exists
Illegal parameter
No data
Device error
Initialize error
Address error
Not found
Time out error
Category error
Version error
Data corrected
ECC corrected
Uncorrectable error
Upper device error
Lower device error
Syntax error
Error : 
%s : 
Interrupt
TLB modification
TLB(load or fetch)
TLB(store)
Address error(load or fetch)
Address error(store)
Bus erro
r(instruction)
Bus error(data)
Syscall
Breakpoint
Reserved instruction
Coprocessor Unusable
Arithmetic Overflow
Trap
Floating-Point
Coprocessor 2
MDMX Unusable
Watch
Machine Check
Cache Error
[NMI]
[Exception]
   status:$12: 0x%08x, 
cause:$13: 0x%08x %s
 badvaddr: $8: 0x%08x, 
[31m
EPC:$14:   0x%08x, 
ErrorEPC:$30: 0x%08x
[register dump]
 at: r1: 0x%08x, 
v0: r2: 0x%08x, 
v1: r3: 0x%08x, 
a0: r4: 0x%08x
 a1: r5: 0x%08x, 
a2: r6: 0x%08x, 
a3: r7: 0x%08x, 
t0: r8: 0x%08x
 t1: r9: 0x%08x, 
t2:r10: 0x%08x, 
t3:r11: 0x%08x, 
t4:r12: 0x%08x
 t5:r13: 0x%08x, 
t6:r14: 0x%08x, 
t7:r15: 0x%08x, 
s0:r16: 0x%08x
 s1:r17: 0x%08x, 
s2:r18: 0x%08x, 
s3:r19: 0x%08x, 
s4:r20: 0x%08x
 s5:r21: 0x%08x, 
s6:r22: 0x%08x, 
s7:r23: 0x%08x, 
t8:r24: 0x%08x
 t9:r25: 0x%08x, 
gp:r28: 0x%08x, 
sp:r29: 0x%08x, 
s8:r30: 0x%08x
 ra:r31: 0x%08x, 
hi:   : 0x%08x, 
lo:   : 0x%08x
/ms/mssony/abk/bin/jigid
NEC EMMA3TH %1d.%1d
NEC EMMA3TH2 %1d%1d
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789#$
frzkey
%02x
IndexInvalidate_I
IndexWritebackInvalidate_D
IndexLoadTag_I
IndexLoadTag_D
IndexStoreTag_I
InxStoreTag_D
CreateDirtyExclusive_D
HitInvalidate_I
HitInvalidate_D
Fill_I
HitWritebackInvalidate_D
HitWriteback_I
HitWriteback_D
Index
Random
EntryLo0
EntryLo1
Context
PageMask
Wired
BadVAddr
Count
EntryHi
Compare
Status
Cause
PRId
Config
LLAddr
WatchLo
WatchHi
XContext
CacheErr
TagLo
TagHi
ErrorEPC
Scratch
zero
move
blez
bgtz
addi
addiu
slti
sltiu
andi
xori
beql
bnel
blezl
bgtzl
daddi
daddiu
cache
lwc1
lwc2
ldc1
ldc2
swc1
swc2
sdc1
sdc2
sllv
srlv
srav
jalr
movz
movn
syscall
break
sync
mfhi
mthi
mflo
mtlo
dsllv
dsrlv
dsrav
mult
multu
divu
dmult
dmultu
ddiv
ddivu
addu
subu
sltu
dadd
daddu
dsub
dsubu
tgeu
tltu
dsll
dsrl
dsra
dsll32
dsrl32
dsra32
ssnop
rorv
drorv
mulu
muls
mulsu
macc
maccu
msac
msacu
mulhi
mulhiu
mulshi
mulshiu
macchi
macchiu
msachi
msachiu
dror
dror32
madd
maddu
mul64
msub
msubu
dclo
dclz
bltz
bgez
bltzl
bgezl
tgei
tgeiu
tlti
tltiu
teqi
tnei
bltzal
bgezal
bltzall
bgezall
mfps
mfpc
mtps
mtpc
mfc0
dmfc0
cfc0
mtc0
dmtc0
ctc0
mfc1
dmfc1
cfc1
mtc1
dmtc1
ctc1
bc0f
bc0fl
bc0t
bc0tl
bc1f
bc1t
bc1fl
bc1tl
tlbr
tlbwi
tlbwr
tlbp
eret
wait
.word
%08x : %08x
0x%08x
# %c0x%x
-0x%x
0x%x
0x%08x
/.history
serial
locked_by_rng
commonkey
ilin
kkey
dlnakey
podkey
podauthkey
poddhkey
marlinkey
sbbkey
cipluskey
marlinbbkey
ustvid2key
ustvid4key
ustvidseed
/.environment
serial '%s'
%s '%s'
Environment
$mount
UVFAT
Aperios 
ABK     
partition%d : %7d blocks ID %02x
[31mrenaming error : %s/%s 
<<< file-system check >>>
[0m--> recoverd
[31mFAT link error : %s/%s cluster %04x 
[0m--> removed
[31mFAT cluster error : %s/%s cluster %04x 
[31mfile size error : %s/%s %d %d 
FAT[%04x] = %04x, 
[31mdirectory start cluster error : %s/%s
[31mFAT floating entry error : 
.frs
.FRS
.frz
.FRZ
.mot
.MOT
.mip
.MIP
Execute.
Load File : %s
pentry
MIP format Address Error line %d %08x
MIP format Error line %d : %08x : [%s]%s
/dev/serial
octet
blksize
1024
ping
ifconfig
read
write
mkdir
mknod
chmod
chown
format
fsck
more
reset
version
echo
syslog
help
/ms/mssony/abk/bin/
/rom/bin/
ABK>
%08x :              
direct
normal
%08x : %02x != %08x : %02x
%08x :
 %02x
 : %s
 %04x
 %08x
Size %x
root
user
-lbcpsd
%c%s%s%s %s 
%3d,%3d  
%8d 
%04d/%02d/%02d %02d:%02d:%02d 
%-34s
%s -> %s
mount-point      free-size      device-size capacity
%-11s 
%8dKBytes / %8dKBytes
     %3d%%
--------KBytes / --------KBytes
     ---%%
-all
-physical
-partition
%s %dMBytes
CurrentPath : %s
AP-e
<<< ABK Monitor >>>
d[b|w|l] [<Addr>] [<size>]        : dump [byte|word|longword]-access
m[b|w|l] <Addr> [<data>]          : modify [byte|word|longword]-access
f[b|w|l] <start> <end> <data>     : 
fill [byte|word|longword]-access
cm <src> <dist> <size>            : copy memory
c <src> <dist> <size>             : compare memory
a [<Addr>]                        : assemble
l [<Addr>] [<size>]               : disassemble
lr [direct|normal]                : change disassemble register mode
boot [<flags>]                    : execute file
  flags : [-sr|-frz|-elf] [<path>|-tftp <path>|-serial] [-o <option>]
     -sr : S-Record / -frz : FRZ / -elf : ELF(exec type only) /
     <pa
th> : file boot / -tftp <path> : tftp boot /
     -serial : serial boot / -o <option> : option
go <entry> [<arg1>] ..[<arg4>]    : execute function
reset                             : reset system
put <path>                        : TFTP put file
get <path>                        : TFTP get file
ping [<IP address>]               : send ICMP ECHO packets
ifconfig                          : show network configuration
syslog [<IP address>/off]         : control syslog
read <path> <addr>      
          : read file
write <path> <addr> <size>        : write file
ls [-a] <path>                    : list file
      -a : all file
rm [-r] <path>                    : remove file
      -r : recursive
cp [-r] <src_path> <dist_path>    : copy file
mv <src_path> <dist_path>         : move file
df                                : disk free
cd <path>                         : change directory
mkdir <path>                      : make directory
chmod <mode> <file>               : chan0
ge mode
chown <user> <file>               : change owner
    <user> : [root/user]
ln <src> <dist>                   : symbolic link
mknod <file> <type> [<maj> <min>] : make special file
  <type> : [b|c|p|s]
format <device_path> [<flags>]    : format filesystem
  flags : -physical : physical format
          -partition <p0>[,<p1>][,<p2>][,<p3>]
               <pn> : partition size ratio
fsck <device_path>                : file system check
echo [-n] [<arg1>] .. [<argn>]    : print ar
gument
wait                              : wait key
set [<environment>] [<value>]     : environment set
more <path>                       : show text file
pci                               : show PCI bus
version                           : show version
h[elp] | ?                        : show this message
-tftp
-serial
-frz
-elf
ABK Monitor  Version %s built at %s %s
Copyright 1999-2009 Sony Corporation
CPU : %s %3d.%02dMHz
Companion : %s %3d.%02dM
Board : %s %04x %3d.%02dMHz
Main memory : %dMBytes
PCI#%1d-%02d-%d : 
             
%d %s 0x%08x-0x%08x 
       
IRQ%03d 
Unknown(VID=0x%04x/DID=0x%04x) 
[PCI-PCI bridge]
%08x : %02x -> 
%08x : %04x -> 
%08x : %08x -> 
ip address %d.%d.%d.%d netmask %d.%d.%d.%d
gateway address 
%d.%d.%d.%d 
MAC address %02x:%02x:%02x:%02x:%02x:%02x
ping %s: 32 data bytes
32 bytes from %s: icmp_seq = %d, time=%dms
----- %s ping statistics -----
%d packets transmitted, %d packets r
eceived, %d%% packet loss
round-trip times: Minimum = %dms, Maximum = %dms, Average = %dms
Size %d
Fujitsu MBM30LV0128
Toshiba TC58DVM72A1FT00
Toshiba TC58DVM82A1FT00
Toshiba TC58DVM92A1FT00
Toshiba TC58DVG02A1FT00
Samsung K9F2808U0C
Samsung K9F5608U0C
Samsung K9F1208U0B
Samsung K9T1G08U0A
Hynix HY27US08561M
Hynix HY27US08121M
Hynix HY27US081G1M
STMicro NAND128W3A
STMicro NAND256W3A
STMicro NAND512W3A
STMicro NAND01GW3A
BDIF
UNEC VR5500
NEC EMMA3TH
E3TH
M3.009C
E3TH
E3TH
write
mkdir
mknod
chmod
chown
format
fsck
more
reset
version
echo
syslog
help
/ms/mssony/abk/bin/
/rom/bin/
ABK>
%08x :              
direct
normal
%08x : %02x != %08x : %02x
%08x :
 %02x
 : %s
 %04x
 %08x
Size %x
root
user
-lbcpsd
%c%s%s%s %s 
%3d,%3d  
%8d 
%04d/%02d/%02d %02d:%02d:%02d 
%-34s
%s -> %s
mount-point      free-size      device-size capacity
%-11s 
%8dKBytes / %8dKBytes
     %3d%%
--------KBytes / --------KBytes
     ---%%
-all
-physical
-partition
%s %dMBytes
CurrentPath : %s
AP-e
<<< ABK Monitor >>>
d[b|w|l] [<Addr>] [<size>]        : dump [byte|word|longword]-access
m[b|w|l] <Addr> [<data>]          : modify [byte|word|longword]-access
f[b|w|l] <start> <end> <data>     : 
fill [byte|word|longword]-access
cm <src> <dist> <size>            : copy memory
c <src> <dist> <size>             : compare memory
a [<Addr>]                        : assemble
l [<Addr>] [<size>]               : disassemble
lr [direct|normal]                : change disassemble register mode
boot [<flags>]                    : execute file
  flags : [-sr|-frz|-elf] [<path>|-tftp <path>|-serial] [-o <option>]
     -sr : S-Record / -frz : FRZ / -elf : ELF(exec type only) /
     <pa
th> : file boot / -tftp <path> : tftp boot /
     -serial : serial boot / -o <option> : option
go <entry> [<arg1>] ..[<arg4>]    : execute function
reset                             : reset system
put <path>                        : TFTP put file
get <path>                        : TFTP get file
ping [<IP address>]               : send ICMP ECHO packets
ifconfig                          : show network configuration
syslog [<IP address>/off]         : control syslog
read <path> <addr>      
          : read file
write <path> <addr> <size>        : write file
ls [-a] <path>                    : list file
      -a : all file
rm [-r] <path>                    : remove file
      -r : recursive
cp [-r] <src_path> <dist_path>    : copy file
mv <src_path> <dist_path>         : move file
df                                : disk free
cd <path>                         : change directory
mkdir <path>                      : make directory
chmod <mode> <file>               : chan0
ge mode
chown <user> <file>               : change owner
    <user> : [root/user]
ln <src> <dist>                   : symbolic link
mknod <file> <type> [<maj> <min>] : make special file
  <type> : [b|c|p|s]
format <device_path> [<flags>]    : format filesystem
  flags : -physical : physical format
          -partition <p0>[,<p1>][,<p2>][,<p3>]
               <pn> : partition size ratio
fsck <device_path>                : file system check
echo [-n] [<arg1>] .. [<argn>]    : print ar
gument
wait                              : wait key
set [<environment>] [<value>]     : environment set
more <path>                       : show text file
pci                               : show PCI bus
version                           : show version
h[elp] | ?                        : show this message
-tftp
-serial
-frz
-elf
ABK Monitor  Version %s built at %s %s
Copyright 1999-2009 Sony Corporation
CPU : %s %3d.%02dMHz
Companion : %s %3d.%02dM
Board : %s %04x %3d.%02dMHz
Main memory : %dMBytes
PCI#%1d-%02d-%d : 
             
%d %s 0x%08x-0x%08x 
       
IRQ%03d 
Unknown(VID=0x%04x/DID=0x%04x) 
[PCI-PCI bridge]
%08x : %02x -> 
%08x : %04x -> 
%08x : %08x -> 
ip address %d.%d.%d.%d netmask %d.%d.%d.%d
gateway address 
%d.%d.%d.%d 
MAC address %02x:%02x:%02x:%02x:%02x:%02x
ping %s: 32 data bytes
32 bytes from %s: icmp_seq = %d, time=%dms
----- %s ping statistics -----
%d packets transmitted, %d packets r
eceived, %d%% packet loss
round-trip times: Minimum = %dms, Maximum = %dms, Average = %dms
Size %d
Fujitsu MBM30LV0128
Toshiba TC58DVM72A1FT00
Toshiba TC58DVM82A1FT00
Toshiba TC58DVM92A1FT00
Toshiba TC58DVG02A1FT00
Samsung K9F2808U0C
Samsung K9F5608U0C
Samsung K9F1208U0B
Samsung K9T1G08U0A
Hynix HY27US08561M
Hynix HY27US08121M
Hynix HY27US081G1M
STMicro NAND128W3A
STMicro NAND256W3A
STMicro NAND512W3A
STMicro NAND01GW3A
BDIF
UNEC VR5500
NEC EMMA3TH
E3TH
M3.009C
E3TH
E3TH
Unfortunately the rest of the flash appears to be encrypted. Based on the strings contained I suspect it would be MIPS but the beginning of the flash (presumably relocated at 0xBFC00000) doesn't look like MIPS code.
 

Bu konuyu görüntüleyen kullanıcılar

Technopat Haberler

Yeni konular

Geri
Yukarı