| 00:54.23 | *** join/#openezx zsman (n=zsman@88.83.169.46) |
| 00:56.26 | *** part/#openezx zsman (n=zsman@88.83.169.46) |
| 01:12.59 | *** join/#openezx Fosforo (n=Fosforo@20151087099.user.veloxzone.com.br) |
| 04:17.34 | *** join/#openezx nooop (n=noop@219.239.105.26) |
| 06:10.54 | *** join/#openezx Marex (n=marex@vasut.kolej.mff.cuni.cz) |
| 06:49.26 | *** join/#openezx dion (n=dion@inhex.net) |
| 07:12.41 | *** join/#openezx drath_ (i=vmaster@p5B07D556.dip.t-dialin.net) |
| 07:32.56 | *** join/#openezx jonwil (n=jonwil@124.182.54.182) |
| 07:33.02 | jonwil | hi |
| 07:59.12 | *** join/#openezx jamesmck (n=james@gimel.esc.cam.ac.uk) |
| 08:02.01 | *** join/#openezx jamesmck (n=james@gimel.esc.cam.ac.uk) |
| 08:05.54 | *** join/#openezx james__ (n=james@gimel.esc.cam.ac.uk) |
| 08:06.12 | Hopscotch | good morning |
| 08:06.54 | jonwil | hi |
| 08:31.54 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 10:27.56 | *** join/#openezx florian (n=fuchs@217.146.132.69) |
| 12:30.11 | *** join/#openezx jonwil (n=jonwil@CPE-124-182-54-182.sa.bigpond.net.au) |
| 14:38.57 | *** join/#openezx TimRiker (n=timr@70.1.67.186) |
| 15:37.39 | *** join/#openezx tombhadAC (n=tombhad@pD95DE5DD.dip.t-dialin.net) |
| 16:40.25 | *** join/#openezx dion (n=dion@inhex.net) |
| 16:49.36 | *** join/#openezx Marex (n=marex@vasut.kolej.mff.cuni.cz) |
| 17:10.55 | *** join/#openezx p3t3r__ (n=p3t3r__@wlan.net-you.de) |
| 17:21.20 | *** join/#openezx janneg (n=janne@v29714.1blu.de) |
| 19:02.24 | *** join/#openezx isv (n=isv@92.112.21.34) |
| 20:39.10 | *** join/#openezx pH5 (n=ph5@e178242145.adsl.alicedsl.de) |
| 20:42.59 | *** join/#openezx ricky_ (n=ricky__@81-208-74-191.ip.fastwebnet.it) |
| 20:43.08 | ricky_ | hi everybody |
| 20:44.16 | ricky_ | I've found your project tomorrow, and I've a question, If you know it's possible to do something like this project also on a Motorola A1000 ? |
| 20:53.24 | ricky_ | ehiiii no one on channel ? |
| 20:53.31 | SuN | The hardware is probably powerful enough, but it'd be a lot of work and I imagine not all of the hardware is supported or documented. |
| 20:55.05 | SuN | Has someone already found out if the boot loader is accessible? |
| 20:55.56 | ricky_ | Ok SuN, I'm not able to make something, but here in italy some guys wont to porting openmoko or some project like this on a moto a1000 |
| 20:57.06 | SuN | Custom firmware for the A1000 is available so I'm guessing they have boot loader access, which is a good start. |
| 20:57.42 | SuN | Next step would be finding out what other chips it has and see if they're supported. |
| 20:57.46 | SuN | And try to make it load a kernel. |
| 20:58.59 | ao2 | ricky_, AFAIK A1000 is not a linux phone, is it? Do you happen to know what hardware platform it uses? |
| 20:59.20 | SuN | It's Symbian, 168MHz ARM |
| 20:59.26 | ricky_ | ao2: is a symbian phone |
| 20:59.26 | SuN | According to the wikipedia article. |
| 21:00.10 | ricky_ | SuN: which wikipedia ? can you gave me a link ? |
| 21:00.17 | ricky_ | *give |
| 21:00.20 | SuN | http://en.wikipedia.org/wiki/Motorola_A1000 |
| 21:02.03 | ao2 | it seems the article does not tell the what hardware platform or SoC it is based on |
| 21:03.21 | ricky_ | ao2: a guy how work on the project had just make some changing on firmware |
| 21:04.23 | ricky_ | I think they know much more then me |
| 21:06.25 | SuN | Someone needs to take this thing apart if they already haven't :D |
| 21:07.12 | ghane_ | continues with the Magx phones instead... |
| 21:16.02 | ricky_ | ok tks to SuN and ao2, I've coping this chat on the site, I hope to come back with something news... night |
| 21:16.09 | *** part/#openezx ricky_ (n=ricky__@81-208-74-191.ip.fastwebnet.it) |
| 21:35.14 | ao2 | hey ghane U9 is also motomagx, Motorola released code for it, too. But I think that won't help you in any way, sorry for the noise |
| 21:36.16 | *** join/#openezx m0nt0 (n=monto@adsl-ull-25-137.47-151.net24.it) |
| 21:36.44 | m0nt0 | hi everybody! |
| 21:39.39 | m0nt0 | i've read about this project and i'd like to make something similar for the moto a1000, to begin i'm going to make a py script to manipulate the files in z: to do that i have to unpack the firmware in CGs and i'm thinking that i'll convert your program to py |
| 21:40.37 | m0nt0 | so here is the question: is there a reason to not "unpack" all the CGs? |
| 21:41.55 | *** join/#openezx flo_lap (n=fuchs@f048033232.adsl.alicedsl.de) |
| 21:48.42 | ao2 | hi m0nt0, this project is about rewriting the _kernel_ for Motorola EZX phones, so we do not touch our original firmware (generally :)) |
| 21:49.28 | ao2 | so, do you want to port linux to A1000? |
| 21:49.54 | m0nt0 | ao2, yes, but in your programs there's one that "unpack" the .shx into the various CGs |
| 21:50.16 | m0nt0 | and the shxs are almost the same |
| 21:50.43 | ao2 | yes, that's true, we used that to flash an alternate second stage bootloder to boot _our_ kernel off the SD card |
| 21:52.04 | m0nt0 | yeah, and that is the really interesting thing, is there any docs that exlain how it works? I'd like to port the openmoko to the a1000, the idea is to load another bootloader to load our image or kernel |
| 21:52.29 | ghane_ | ao2: no problem, i probably should download the U9 source too, but right now i'm just trying to fix jonwils hack for reading the firmware so we can enable telnet without using any "grey" software |
| 21:54.20 | ao2 | m0nt0, I can point you to the doc about our bootloader: http://svn.openezx.org/trunk/src/blob/blob2/readme |
| 21:55.40 | ao2 | but check also wiki.openezx.org to cancel any doubt about what openezx is ;) |
| 21:56.16 | ghane_ | ao2: i probably should study that blob documentation too, probably the only way to free the magx is to either replace the propertary boot loader or hack the original one :( |
| 21:58.02 | ao2 | ghane_, I wonder if MBM check signatures on what it is going to boot. And it looks like it does. |
| 21:58.22 | ghane_ | ao2: ya seems so, but all the MBM CG's are signed too |
| 21:58.41 | m0nt0 | well i think to understand and the goal is similar, i'd like to boot a linux kernel, you boot your kernel, the port, lack of driver, problem with port are thing that i have to verify from 0, but my primary problem was the bootloader |
| 21:58.43 | ghane_ | so I wonder if just some hex-editing will allow custom kernels, or if it will brick my phone |
| 21:59.12 | m0nt0 | and the process power on -> bl -> personalized bl -> kernel is similar |
| 22:01.32 | ao2 | m0nt0, what hardware does A1000 use? Is there a "basic" linux port for its platform already? |
| 22:01.44 | ghane_ | ao2: is it possible that there is some rom code checking the MBM signature or the MBM does some self-check+ Or perhaps the signature is there just to fool us :) |
| 22:03.12 | ao2 | ghane_, do you mean MBM could read the signatures from flash itself? |
| 22:03.13 | m0nt0 | it uses the arm processor so the port of the toolchain and compiling the kernel it shouldn't be too difficult |
| 22:04.04 | ghane_ | ao2: as far as i understand the MBM is in flash, and is signed, but people who have flashed modified CGS will only boot to the MBM and no further |
| 22:05.45 | ao2 | m0nt0, well, the point is mostly _what_ arm platform, supporting the CPU could be the easiest part, dealing with other devices can be way harder. But keep in mind that I do not know very much about low level stuff, I'm just an "active supporter" doing some little tasks, so I really do not know what i am talking about :P |
| 22:08.19 | ao2 | ghane_, My question was, where does MBM get the signatures against whom it verifies CGs? Are those signatures hardcoded? or read from flash? |
| 22:08.50 | ghane_ | ao2: ah, i don't know where that is done no |
| 22:09.19 | ghane_ | ao2: think i should try and disasm the mbm and see if there is something interesting that i could find |
| 22:09.22 | m0nt0 | ao2, well your help is very useful and yes, i know that is very difficult, i'll try and i think that i'll break my phone, but i'd like to try, the bad part is to support something like the sd reader, the screen, the touch interface, the buttons, battery,..... everything except the processor |
| 22:10.32 | ao2 | so, m0nt0 I would suggest to search as much information as you can about your _hardware_ first :) |
| 22:11.05 | ao2 | knowing it is ARM is not enough |
| 22:11.13 | m0nt0 | yes :D |
| 22:11.31 | ghane_ | m0nt0: i'm just curious, what is it withthe A1000 that makes it so interesting? |
| 22:12.24 | m0nt0 | nothing, i've got one, the moto fw is crap, sometimes it reboots, sometime it goes offline, some functions are disbled,.... |
| 22:12.25 | ghane_ | wouldnt it be better to help with another potentially more interesting platform that already runs linux and has some community around it? |
| 22:12.38 | ghane_ | lol sounds like normal moto firmware :D |
| 22:13.03 | ao2 | ah m0nt0, anyway, I happen to be Italian too, so I am pleased to see you here, why don't you get a A1200 :P ? |
| 22:14.25 | ghane_ | yes, A1200 for everyone and leave the evil symbian ones :-D |
| 22:15.18 | ghane_ | i'm considering a E6 too, but they are also badly supported |
| 22:15.29 | ao2 | there's still much to do also on EZX phones, yes, but at least we have a working base :) |
| 22:15.55 | ghane_ | yes |
| 22:16.08 | ghane_ | lets hope we can transfer much of it to the MAGX ones too |
| 22:16.28 | m0nt0 | i'm italian adn there are some website which are very active and there are peoples that have customized some functions but nothing else, they know quite well the fw, i know how an os work, i like linux and i think it will be fun to try soething similar |
| 22:16.31 | ghane_ | after all isnt MAGX just an evolution of the EZX? |
| 22:17.15 | *** join/#openezx jonwil (n=jonwil@CPE-124-182-54-182.sa.bigpond.net.au) |
| 22:17.22 | jonwil | hi |
| 22:17.39 | m0nt0 | why a1000 rather than a1000 because when i bought an a1k 3 years ago it was a super smartphone-pda for me, after sometimes i discovered a lot of crap |
| 22:17.59 | m0nt0 | and it seems that it's not so uncommon for the motos |
| 22:18.28 | ghane_ | i wonder if you ever will make something nice with it with linux, i just think the A1000 is too slow to be any fun anyways |
| 22:18.40 | ghane_ | at least if you planned to run something graphical |
| 22:19.29 | jonwil | hi ghane, any chance you will ever get around to sending me what you have so far with the flash tools? :P |
| 22:19.45 | ghane_ | jonwil: its even worse than before now |
| 22:20.33 | ghane_ | jonwil: its so ugly i rather not show it to anyone |
| 22:20.52 | m0nt0 | so, i'm going to buy a neo freerunner, and this phone (a1k) will be on a desk until it will be in a drower somewhere, so i'd like to try to reuse it |
| 22:21.06 | jonwil | at this point I think it would be easier to just try and write my own code to do this :P |
| 22:21.15 | ghane_ | jonwil: yes it would |
| 22:21.16 | jonwil | Or figure out why the code I posted before is borked |
| 22:21.17 | m0nt0 | just for fun, not with the intention to do something useful, usable |
| 22:21.30 | ghane_ | jonwil: if you take the boot_usb code you sort of have mine |
| 22:23.41 | ao2 | yes m0nt0 I see |
| 22:23.55 | ghane_ | jonwil: i've very much started from scratch |
| 22:23.56 | jonwil | thinks the FreeRunner is good but the form factor sucks |
| 22:24.00 | m0nt0 | so, at least for now i'm curious |
| 22:25.02 | jonwil | Give me a FreeRunner in a slide or candybar form factor and I am sold :) |
| 22:25.24 | ao2 | m0nt0, let us know what you find about the hardware, maybe we can point you to some more infos then |
| 22:25.46 | jonwil | doesnt the a1k run Windows Mobile? |
| 22:26.12 | m0nt0 | jonwil, no, it runs symbian uiq |
| 22:26.19 | jonwil | ah |
| 22:27.27 | m0nt0 | i think that i won't buy something that will not run linux on it as a cellphone, this because i' having very bad feeling about uiq and win mobile so |
| 22:28.01 | m0nt0 | if i want an os i'd prefer that it will be linux, else i'll bui a cheap phone and something like the eeepc |
| 22:28.02 | ghane_ | uiq 3 is usable |
| 22:28.35 | ghane_ | but you never want to do coding for symbian ;-) |
| 22:29.00 | ao2 | yes m0nt0, at least with the neo you will know _names_ and _surnames_ to use for inprecations when something will go wrong :) |
| 22:29.28 | ghane_ | m0nt0: the best thing you can do with your A1000 is to go to my-symbian.com and download the Lemmings for UIQ 2 and use it for playing that game |
| 22:29.40 | m0nt0 | i'm just basing my opinions on my experience with symbian s60, symbian uiq 2 and win mobile and linux |
| 22:30.17 | ghane_ | its a nice lemmings-machine |
| 22:30.33 | ao2 | ok, gotta go. See you, folks |
| 22:30.40 | jonwil | I still intend to find a way to open this z6 |
| 22:30.48 | m0nt0 | ghane, no i've downloaded the scumm vm and now i'm playing something like sm and max, indiana jones, loom,.... grat games when i was 12 |
| 22:31.42 | ghane_ | bye ao2 |
| 22:31.51 | m0nt0 | bye ao2, thanks a lot! |
| 22:32.03 | ao2 | you're welcome |
| 22:32.03 | jonwil | wonders if there is a way to build libusb with debugging, that might explain why the other code I have crashes |
| 22:32.06 | ghane_ | m0nt0: try lemmings too, its the best lemmings implementation on any platform |
| 22:32.13 | m0nt0 | ahahahahah |
| 22:32.19 | m0nt0 | just downloading it :D |
| 22:32.25 | m0nt0 | afk for a while |
| 22:32.33 | ghane_ | jonwil: yes, just compile it and add some printouts :) |
| 22:32.44 | ghane_ | m0nt0: a friend of mine who wrote it |
| 22:33.06 | ghane_ | m0nt0: i also know the guy that made the scummvm port |
| 22:33.07 | jonwil | I guess really what I want is to rebuild it with debugging symbols so I can trace inside libusb with gdb... |
| 22:33.25 | ghane_ | yes that shouldnt be hard |
| 22:33.56 | ghane_ | are you sure it isnt built with debug symbols already? |
| 22:34.27 | jonwil | hmmm, I dont know if Gentoo would do that |
| 22:34.30 | jonwil | I will play with things later |
| 22:34.38 | jonwil | and see if I can either make that code I have there work |
| 22:34.43 | ghane_ | isnt it just to add -g otherwise? |
| 22:34.51 | jonwil | or write new code that does |
| 22:35.17 | jonwil | since all the community people with skills have zero time (whereas I have time but no skills :) |
| 22:35.34 | ghane_ | what is time? |
| 22:38.48 | ghane_ | jonwil: i'm sorry but i spend too much time thinking about booting custom kernels that i never really can focus on the flash-thing |
| 22:39.25 | jonwil | Do you have any ideas how to do that? |
| 22:39.45 | ghane_ | perhaps |
| 22:39.48 | jonwil | Unless you happen to know ARM assembly and/or can reverse engineer the kernel/bootloader, I dont think it can be done |
| 22:39.58 | jonwil | We cannot get an unsigned kernel onto the phone |
| 22:40.00 | ghane_ | but well it includes modifying the original mbm |
| 22:40.10 | jonwil | We cant get an unsigned MBM onto the phone either |
| 22:40.18 | ghane_ | well i dont know arm assembly that well but i have friends who do |
| 22:40.31 | jonwil | ok so how do you plan to modify MBM then? |
| 22:40.34 | ghane_ | are you sure? we can get unsigned CGs |
| 22:41.09 | ghane_ | but then it wont boot |
| 22:41.24 | ghane_ | i might give it a try later |
| 22:41.41 | ghane_ | also i wonder about the ramloader stuff |
| 22:42.02 | jonwil | ok, so yeah see what you can do |
| 22:42.06 | ghane_ | can we perhaps do some trick |
| 22:42.10 | jonwil | but be carefull not to brick your phone |
| 22:42.23 | ghane_ | load code to address 0 and reset without resetting memory? |
| 22:42.36 | jonwil | I dont know if its possible to reset and not reset memory |
| 22:42.50 | jonwil | also, address zero is probobly mapped to some rom inside the ARM SOC when the phone first boots |
| 22:43.06 | ghane_ | probably |
| 22:43.18 | ghane_ | then the question is: can we read that code and can we replace it? |
| 22:43.34 | jonwil | It depends what the MMU does |
| 22:43.48 | jonwil | and whether that code is "turned off" by later operations done via kernel or MBM |
| 22:44.37 | jonwil | In any case, unless we can somehow run code in kernel space or read from kernel RAM (e.g. physical memory), we cannot go further with these hacks IMO |
| 22:45.07 | ghane_ | jonwil: i think we should be able to use the ezxflash with little or no modifications for the magx |
| 22:45.53 | ghane_ | ya, how did it go with the kernel modules? |
| 22:46.22 | ds2 | do they have the module loader interface enabled? |
| 22:46.27 | jonwil | we can load modules |
| 22:46.44 | jonwil | problem is, they have a security lock so it will only load modules if their SHA1 is in /etc/modules.hash |
| 22:46.47 | jonwil | which of course we cant change |
| 22:46.54 | ds2 | oh DOH |
| 22:47.01 | jonwil | since its in the root filesystem (which is signed and read only) |
| 22:47.14 | ds2 | and it can't be fooled into taking a different rootfs? |
| 22:47.21 | ghane_ | jonwil: can we mount? |
| 22:47.37 | ghane_ | do a chroot |
| 22:47.38 | ds2 | wonder if there are GPLv3 stuff in that rootfs ;) |
| 22:47.42 | ghane_ | or mount-bind |
| 22:47.53 | jonwil | ds2: I havent seen any |
| 22:48.20 | jonwil | we can mount but mount only accepts mounts listed in /etc/allowed_mounts |
| 22:48.29 | ghane_ | jonwil: can you copy everything to the memorycard and remount a directory on the memorycard as root? |
| 22:48.32 | ghane_ | ah |
| 22:48.36 | ghane_ | crap |
| 22:48.39 | ds2 | does is there an accessible /dev/kmem? |
| 22:48.55 | jonwil | no, there is no way to access kmem, ram, mem or anything like that :( |
| 22:49.11 | jonwil | wonders if chroot would work |
| 22:49.52 | ds2 | what about mtd devices? wonder if they can be "changed" underneath it after it verifies the signature |
| 22:51.28 | ghane_ | the best would probably be for someone who reads arm assembler easily to disassemble the mbm and look for the signature checking |
| 22:52.10 | jonwil | ok, I am playing with chroot |
| 22:52.25 | ghane_ | it would be so great if it worked ;-) |
| 22:52.31 | ghane_ | but i doubt it |
| 22:52.35 | ds2 | you know it is insmod that is doing the signature checking or the kernel itself? |
| 22:52.41 | ds2 | if it is... |
| 22:52.52 | jonwil | kernel is |
| 22:53.01 | jonwil | Its in the module load code |
| 22:53.13 | jonwil | CONIFG_FEAT_MOT_SECURE_MODULE or something like that |
| 22:53.14 | ghane_ | jonwil: have they patched that so that is in the source? |
| 22:53.18 | jonwil | yes |
| 22:53.21 | ghane_ | ok |
| 22:53.36 | ds2 | how is the path to the signatures passed to the kernel? via an open fd or does the kernel actually try to open it? |
| 22:53.52 | jonwil | kernel opens /etc/modules.hash directly |
| 22:53.54 | ds2 | I'd look but I busy with 4 other things in different xterms :( |
| 22:54.30 | jonwil | as for chroot, I made a duplicate of /bin on /mmc/mmca1 |
| 22:54.47 | jonwil | and running chroot /mmc/mmca1 simply gives "chroot: cannot execute /bin/ash: No such file or directory" |
| 22:54.50 | jonwil | and the root does not change |
| 22:54.54 | ds2 | if the kernel opens it, chroot isn't likely to work |
| 22:55.16 | jonwil | in any case chroot seems to not work at all |
| 22:55.45 | ds2 | JTAG }:-) |
| 22:55.56 | jonwil | Phone does not appear to have jtag |
| 22:56.08 | jonwil | from the pictures of the v8 PCB anyway |
| 22:56.21 | ds2 | what proc is this again? iMX or PXA? |
| 22:56.33 | jonwil | Its Freescale SCMA11 |
| 22:56.44 | jonwil | I got chroot to work |
| 22:56.54 | jonwil | I copied /lib to my phone and now chroot worked |
| 22:57.06 | jonwil | I mean to the mmc card |
| 22:58.24 | jonwil | holy crap, I think I got something here |
| 22:58.42 | ghane_ | ? |
| 22:58.50 | jonwil | hold a sec, testing something |
| 22:58.55 | ghane_ | ok |
| 22:59.05 | ghane_ | i was considering going to bed, but i'll wait then :) |
| 23:01.17 | jonwil | ok, so I can rmmod gpiodev.ko and then insmod gpiodev.ko again |
| 23:01.24 | jonwil | now to chroot |
| 23:02.11 | jonwil | hmmm ok |
| 23:02.52 | jonwil | ok, now if I insmod gpiodev from inside the chroot, it fails to insmod it |
| 23:03.14 | jonwil | same .ko file |
| 23:03.22 | ghane_ | hmm |
| 23:03.51 | jonwil | maybe because its /mmc/mmca1/lib/modules/gpiodev.ko and not /lib/modules/gpiodev.ko |
| 23:04.51 | jonwil | hmmm, if I exit the chroot I can insmod /mmc/mmca1/lib/modules/gpiodev.ko and it works |
| 23:04.56 | jonwil | so whats different inside the chroot |
| 23:07.47 | jonwil | hmmm maybe its because its missing /proc fs :( |
| 23:07.59 | ghane_ | could be |
| 23:08.00 | ghane_ | but i wonder |
| 23:08.10 | ghane_ | what does it say? |
| 23:09.33 | jonwil | insmod: cannot insert `/lib/modules/gpiodev.ko': Operation not permitted (-1): Operation not permitted |
| 23:09.39 | ghane_ | ah |
| 23:09.55 | jonwil | etc/modules.hash does exist |
| 23:10.26 | ghane_ | try copying the whole etc to chroot dir too |
| 23:10.31 | jonwil | I just tried that |
| 23:11.53 | jonwil | Ahh, this code |
| 23:11.59 | jonwil | Make sure this file is on the correct device |
| 23:12.02 | jonwil | seems to be the cause |
| 23:12.06 | jonwil | there is code with that comment there |
| 23:12.11 | jonwil | which does correct_dev = (hashfile->f_vfsmnt->mnt_sb->s_dev == ROOT_DEV); |
| 23:12.14 | jonwil | for example |
| 23:12.27 | ghane_ | ah |
| 23:12.27 | ghane_ | hmm |
| 23:12.37 | ghane_ | so we cannot use other modules |
| 23:12.39 | jonwil | no |
| 23:12.43 | jonwil | at this point it seems that way |
| 23:12.46 | ghane_ | than the ones on the correct gcs |
| 23:12.47 | ghane_ | cgs |
| 23:13.10 | jonwil | no, we can use any module if the SHA1 is in the modules.hash file |
| 23:13.21 | jonwil | that check is making sure that modules.hash is on the correct filesytem |
| 23:13.31 | jonwil | i.e. its /etc/modules.hash and not <chroot>/etc/modules.hash |
| 23:13.59 | ghane_ | ah ok |
| 23:16.11 | jonwil | so it looks like we are still stuck |
| 23:16.18 | jonwil | no way to run code in kernel space |
| 23:16.24 | *** join/#openezx dion (n=dion@inhex.net) |
| 23:16.50 | jonwil | unless we can somehow take a kernel module we write and add garbage until it matches a SHA1 thats in the modules.hash file |
| 23:16.58 | jonwil | but I think that would be difficult to impossible to do |
| 23:17.11 | ghane_ | mmm |
| 23:17.21 | jonwil | so yeah kernel/modules.c in the source is where all the module security lives |
| 23:17.38 | ghane_ | i'm going to call motorola tomorrow and tell them that they suck |
| 23:17.49 | ghane_ | give me an unsigned flash please |
| 23:17.54 | jonwil | you do that |
| 23:18.39 | jonwil | Blame the big media companies and the big phone carriers |
| 23:18.53 | jonwil | the media companies for insisting on DRM (hence the WMA DRM stuff) |
| 23:19.00 | jonwil | and the phone carriers for insisting on control |
| 23:19.03 | ghane_ | wonder if |
| 23:19.22 | jonwil | I am sure that if it was technically and legally possible, AT&T would block the FIC Neo phones from their network |
| 23:19.53 | ghane_ | this sucks |
| 23:19.59 | ghane_ | no motorola prototypes on ebay |
| 23:20.20 | jonwil | I doubt you will find a prototype phone |
| 23:20.36 | jonwil | motorola keep good security for protoypes I would guess |
| 23:20.44 | jonwil | so the question is where do we go from here? |
| 23:20.50 | jonwil | Yell at motorola? :P |
| 23:21.01 | jonwil | Look for an exploit in MBM or kernel? |
| 23:21.15 | ghane_ | i'm actually surprised that there isnt any prototypes on ebay |
| 23:21.16 | ds2 | yes it is possible, but from what Iunderstand it is not feasible |
| 23:21.39 | ds2 | what kind of flash does it have? |
| 23:21.54 | jonwil | the z6 has a NAND flash |
| 23:22.07 | ds2 | who made it and in what package? |
| 23:23.02 | ghane_ | do we know that? |
| 23:23.14 | ds2 | is the chip visible? |
| 23:23.29 | ghane_ | there is photos of the V8 on the wiki |
| 23:23.44 | ds2 | same as the EZX wiki? |
| 23:23.53 | ghane_ | i'm to tired to get you some Z6 photos tonight |
| 23:23.54 | ghane_ | yes |
| 23:23.58 | ghane_ | http://wiki.openezx.org/Razr2 |
| 23:24.00 | jonwil | Its a toshiba flash chip |
| 23:24.03 | ghane_ | http://wiki.openezx.org/Razr2_Board |
| 23:24.26 | jonwil | TY9000A000CMGF |
| 23:24.45 | jonwil | Google says its FBGA 149 |
| 23:24.48 | jonwil | whatever that means |
| 23:25.15 | ghane_ | that means it is a pain in the ass to solder with an iron |
| 23:25.16 | ghane_ | :-D |
| 23:25.40 | jonwil | I cant solder to save my life anyway :O |
| 23:25.42 | jonwil | :P |
| 23:26.19 | ghane_ | i'm about to void my warranty now |
| 23:26.48 | jonwil | are you opening your phone up? |
| 23:27.05 | ghane_ | WTF is wrong with this phone? |
| 23:27.09 | ds2 | is the ball grid thing the processor or some other chip? |
| 23:27.10 | ghane_ | i was going to open it |
| 23:27.11 | ghane_ | BUT |
| 23:27.24 | ghane_ | my default cell-phone tool doesnt work |
| 23:27.26 | ghane_ | it isnt T6 |
| 23:27.46 | jonwil | The Flash chip is the one I said was FBGA |
| 23:27.50 | jonwil | the TY9000 thing |
| 23:27.50 | ghane_ | its T5 or T4 screws |
| 23:27.54 | ghane_ | sorry cant open it up |
| 23:27.57 | ghane_ | not today |
| 23:27.57 | jonwil | Its a toshiba flash chip |
| 23:28.09 | ghane_ | i need to go shopping :) |
| 23:28.13 | ds2 | I mean in the pictures with the wite dot/sticker |
| 23:28.29 | jonwil | aah ok |
| 23:28.36 | ds2 | there is something with just a bunch of balls on it.. wonder if it is the CPU on the other side |
| 23:29.21 | ghane_ | ah the one on the second photo? |
| 23:29.28 | ds2 | cuz the layout of the balls around that array seems a bit too regular |
| 23:29.40 | ghane_ | that white dot looks like they are trying to hide some connectors from external connection |
| 23:29.45 | ds2 | the most obvious view is the 3rd photo from bottom |
| 23:30.04 | ds2 | http://wiki.openezx.org/Image:Img_2960_Or.jpg |
| 23:30.14 | ds2 | That photo, the lower right region |
| 23:30.19 | ghane_ | ya |
| 23:30.31 | ds2 | is there a chip on the other side or is that just some blank pads? |
| 23:30.52 | ghane_ | good question |
| 23:30.53 | ds2 | wondering if the jtags are in that mess of pads |
| 23:31.09 | ghane_ | to me it looks like its hole mounted stuff |
| 23:31.23 | ds2 | or it could be vias |
| 23:31.23 | m0nt0 | bye all!! |
| 23:31.36 | ghane_ | not that many? |
| 23:31.55 | jonwil | From looking at the pictures, the one that you can see there is one of the GSM chips |
| 23:31.56 | ghane_ | or well looks kinda odd |
| 23:32.00 | ds2 | it is (was) a common practice to put 1 via per ball on a BGA package |
| 23:32.00 | jonwil | its not the CPU |
| 23:32.21 | ds2 | so if we could be looking at the bottom of the board for a BGA on the other side |
| 23:32.38 | jonwil | wait, no, its not the GSM |
| 23:32.41 | jonwil | Its the power management chip |
| 23:32.58 | ds2 | Hmmmm wonder if they chained the JTAGs together |
| 23:33.18 | jonwil | I would guess that the SCMA11 is the only thing on there with JTAG |
| 23:33.46 | ghane_ | ds2: its the back of the SC13784VK5 as far as i can tell |
| 23:33.49 | ds2 | most chips have JTAG for manufacture testing |
| 23:34.26 | jonwil | My understanding of JTAG is that its only for microprocessors |
| 23:34.58 | ds2 | JTAG debugging, yes. but jtag started out as a way to toggle all pins on a chip to verify manufacturing |
| 23:35.22 | ghane_ | ds2: http://wiki.openezx.org/Image:Img_2961_Or.jpg lower left chip is the one with the white dot on the back |
| 23:35.25 | jonwil | ds2: join #openmagx for a second, I want to discuss something off-list and cant use PMs on this forum |
| 23:35.41 | ds2 | jonwil: on this server? |
| 23:36.12 | ghane_ | yes this server |
| 23:43.47 | ghane_ | goodnite |
