| 00:38.47 | *** join/#openezx jonwil (n=jonwil@124.182.35.218) |
| 00:39.00 | jonwil | hi |
| 03:50.47 | *** join/#openezx millabout (n=root@123.127.237.46) |
| 03:52.58 | millabout | hi |
| 03:54.57 | millabout | Anybody knows how to list the file unser /usr/lib/ezx from telnet console with root role. |
| 04:09.47 | jonwil | what phone? |
| 04:23.10 | millabout | A1200 |
| 04:24.23 | *** join/#openezx nooop (n=noop@219.239.105.26) |
| 04:24.30 | millabout | And could this be the issue of seLinux loaded in Moto's Linux kernel? If this is true, could we disable the selinux. |
| 04:27.07 | millabout | I have googled and got the Selinux discussion archive dated 2006, however, I do not know the result. |
| 04:29.25 | jonwil | not a clue about the a1200 |
| 04:29.38 | jonwil | I know how to do exactly what you want to do on my own z6 |
| 04:30.23 | millabout | great, I got a Z6 also, and how could it be disabled. |
| 04:32.35 | millabout | I am trying to figuring out how to send SMS and receive SMS with console application. |
| 04:34.10 | jonwil | if you have telnet on the z6, you can access the contents of /usr/lib/ezx no problems |
| 04:34.58 | millabout | in Moto linux phone like E680, A1200, Z6 or even the V8 model. As well, I am trying to read and parse all the contacts and SMS stored in the Linux Phone. One model out of the models listed is enought for me. |
| 04:35.54 | millabout | thx, I will try to telnet into the z6. |
| 05:29.51 | *** join/#openezx agd5f (n=alex@c-69-143-17-38.hsd1.va.comcast.net) |
| 05:41.03 | ghane_ | jonwil: i found some not so funny stuff yesterday |
| 05:41.13 | jonwil | what stuff? |
| 05:41.17 | ghane_ | in startdsp.sh |
| 05:41.21 | ghane_ | # r54244 03/17/06 Remove copydsp now done by MBM (LIBii18874) |
| 05:41.48 | ghane_ | wonder what more is made outside of the Linux system |
| 05:42.40 | jonwil | I have currently got the ramdownloader inside IDA pro and a copy of the ARM ARM open |
| 05:43.07 | *** join/#openezx dion (n=dion@inhex.net) |
| 05:43.09 | jonwil | Now I am going to see just what I can read back from the phone with F&B3 to see if I can read more than just the flash |
| 05:43.09 | ghane_ | ok, i tried to disassemble yesterday too, but it only resulted in garbage asm |
| 05:43.26 | jonwil | disassemble it as ARM |
| 05:43.32 | ghane_ | i did |
| 05:43.34 | jonwil | load it at 0x78010000 |
| 05:43.41 | ghane_ | but its flat binary |
| 05:43.43 | jonwil | and select the first 4 bytes and press o for offset |
| 05:43.49 | jonwil | since the first 4 bytes are an offer |
| 05:43.50 | jonwil | offset |
| 05:44.02 | jonwil | which is actually what is passed to the JUMP command by RSD and other flashing tools |
| 05:44.21 | ghane_ | i was checking mbm actually |
| 05:44.35 | jonwil | I havent found out where in memory that goes yet |
| 05:44.44 | jonwil | so I cant load it and have working ASM |
| 05:45.32 | jonwil | currently searching all of cg36 for the string MBM |
| 05:45.40 | jonwil | to see if there is any other usefull comments like that one |
| 05:46.25 | jonwil | only valid references are the one you found |
| 05:46.32 | jonwil | and a reference to MBM_VERSION in the tcmd binary |
| 05:46.47 | jonwil | which probobly reads MBM_VERSION from the /proc/bootinfo or whatever it is |
| 05:47.56 | jonwil | also, if you look at /proc/bootinfo/, we have MBM_VERSION which is A3.C9 (my bootloader version) |
| 05:48.10 | jonwil | and we have MBM_LOADER_VERSION which is A3.C4 (my old bootloader before I upgraded it) |
| 05:48.25 | jonwil | and I also see references to a mbmloader.bin in the firmware |
| 05:51.46 | jonwil | ok, if I read bytes from 0x00 to 0xFF, I get all nulls |
| 05:59.51 | jonwil | I am now trying to read the gaps in the flash between the known codegroups |
| 06:06.28 | jonwil | Some of it is just empty spacxe |
| 06:06.31 | jonwil | some of it has data |
| 06:06.36 | jonwil | some of the holes are too large to read |
| 06:13.00 | ghane_ | ok |
| 06:13.12 | ghane_ | i was also looking for strings in cg36 yesterday |
| 06:13.50 | ghane_ | i was trying to figure out the flex-bits, to see if it was possible to enable telnet with only cg43 |
| 06:13.58 | jonwil | any luck? |
| 06:14.03 | ghane_ | no |
| 06:14.06 | jonwil | ok |
| 06:14.15 | ghane_ | could not find any reference to the ezx_flexbits.cfg |
| 06:14.46 | ghane_ | anyway there is two flags that must be correct for enabling telnet without the opera hack |
| 06:15.04 | ghane_ | that is engineering mode and product state = acceptance instead of ship |
| 06:15.13 | jonwil | so yeah ezx_flexbit.cfg is read by the AudioMgr binary |
| 06:15.19 | jonwil | and also libezxappbase.so |
| 06:15.20 | ghane_ | not sure where the product state is set |
| 06:15.28 | jonwil | and libezxdrmsp.so |
| 06:15.33 | jonwil | and libqte-mt.so |
| 06:15.51 | jonwil | suspects Motorola would never open source QT from motomagx even if they could |
| 06:15.57 | jonwil | too much pointers to other secret bits |
| 06:16.18 | ghane_ | because the bits i'm looking for comes from motmode, which apparently calls libmotosecurity or what it was called |
| 06:18.03 | jonwil | libmotsecurity has a refereonce to something called /dev/efuse |
| 06:18.30 | jonwil | wonder what driver handles that and what its for |
| 06:19.04 | jonwil | if its anything like other uses of the term efuse, its fuses on the CPU that can be permanently blown to indicate different settings |
| 06:19.46 | ghane_ | http://en.wikipedia.org/wiki/EFUSE |
| 06:19.48 | ghane_ | could it be? |
| 06:20.07 | jonwil | yes it could be |
| 06:20.24 | jonwil | time to do a grep of the kernel code for efuse |
| 06:20.27 | ghane_ | or is it just a hack for something related to Filesystem in Userspace? |
| 06:20.44 | jonwil | I doubt its related to fuse |
| 06:20.50 | jonwil | since fuse is not on this phone |
| 06:21.12 | ghane_ | btw did you get rid of noexec on some fs? |
| 06:22.43 | jonwil | yes the hacks get rid of noexec on mmc card and ezxlocal or whatever it is |
| 06:22.57 | jonwil | ok, the kernel has a feature called MOT_FEAT_OTP_EFUSE |
| 06:23.06 | jonwil | otp probobly means "one time programmable" |
| 06:26.17 | ghane_ | hmm |
| 06:27.46 | *** join/#openezx dion (n=dion@inhex.net) |
| 06:28.01 | ghane_ | could also be a incorrect acronym for OTA Provissioning :P |
| 06:28.04 | jonwil | the aplogger driver in the kernel references this feature |
| 06:28.15 | ghane_ | ok |
| 06:28.33 | ghane_ | btw got any link to the noexec fix? |
| 06:28.41 | ghane_ | didnt find it yesterday |
| 06:28.52 | jonwil | also, in that file I see unsigned char logger_mot_security_mode = MOT_SECURITY_MODE_PRODUCTION |
| 06:29.49 | ghane_ | Current cpu frequency: 532 Mhz |
| 06:29.53 | ghane_ | not too bad |
| 06:30.04 | jonwil | it then reads something from somewhere with mot_otp_get_mode |
| 06:30.13 | jonwil | which is a kernel function somewhere |
| 06:31.08 | ghane_ | oh, could be that stuff, i saw some references to that in the MBM too, the different product identifications like i said; acceptance or ship etc |
| 06:31.23 | ghane_ | that makes sence if that is a otp bit |
| 06:31.57 | ghane_ | engineering mode itself didnt do anything fun, just added a menu with settings for getting kernel panics and some GSM cell stuff |
| 06:34.21 | jonwil | so yeah there is efuse_drv.c which is the driver for /dev/efuse |
| 06:37.07 | jonwil | the more I look at this kernel, the more I realize we could blow this phone open if we could run kernel code |
| 06:37.54 | jonwil | what I wouldnt give for the programmers manual for the SCMA-11 chipset :P |
| 06:40.21 | ghane_ | is that impossible to get? |
| 06:41.57 | ghane_ | jonwil: anyway, i have to leave for work now, you don't happen to have any url or something that tells how to fix the noexec, i didnt find that yesterday when i finally descided to try your tools |
| 06:42.35 | jonwil | no |
| 06:47.23 | ghane_ | but can you actually change the mount parameters permanently or was it the library preload hack you used? |
| 06:48.51 | ghane_ | well gotta run |
| 06:48.52 | ghane_ | later |
| 06:49.08 | jonwil | basically I have a shellscript that does the remount |
| 06:49.18 | ghane_ | ok so it is possible to remount |
| 06:49.20 | jonwil | and then thats loaded at startup via a change to one of the files |
| 06:49.28 | jonwil | only certain mounts though |
| 06:49.30 | jonwil | mount -o remount -t vfat /dev/mmca1 /mmc/mmca1 |
| 06:49.32 | jonwil | mount -t vfat -o remount /dev/loop/0 /ezxlocal/download/mystuff |
| 06:49.37 | jonwil | those are the remounts |
| 06:49.42 | ghane_ | ok thanks |
| 06:49.46 | ghane_ | but at startup? |
| 06:49.52 | jonwil | yes at startup |
| 06:50.13 | ghane_ | how did you do that? ;-) |
| 06:50.59 | jonwil | Its the [AutoRun] section in the SysRegistry file on cg52 |
| 06:51.04 | ghane_ | ah |
| 06:51.06 | jonwil | it causes certain entries in that file to run at startup |
| 06:51.26 | jonwil | by default they are the messenging thing |
| 06:51.42 | ghane_ | thanks |
| 06:51.47 | ghane_ | i will look into that when i get home |
| 06:51.49 | jonwil | amd the browser daemon |
| 06:51.54 | jonwil | and then I add mine to the list |
| 06:51.55 | jonwil | cya |
| 06:52.00 | ghane_ | bye |
| 06:52.11 | jonwil | mine starts telnet, ftp, remount etc |
| 06:52.12 | jonwil | cya |
| 06:52.16 | jonwil | well just telnet, ftp and remount |
| 07:20.20 | *** join/#openezx drath_ (i=vmaster@p5B07E536.dip.t-dialin.net) |
| 07:30.46 | *** join/#openezx bambam (i=bambam@vm.vido.info) |
| 08:34.53 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 08:42.52 | *** join/#openezx james__ (n=james@gimel.esc.cam.ac.uk) |
| 09:05.56 | *** join/#openezx pleemans (n=peter@d51A5E76A.access.telenet.be) |
| 09:09.09 | Hopscotch | good morning |
| 09:22.53 | *** join/#openezx Marex (n=marex@vasut.kolej.mff.cuni.cz) |
| 10:06.52 | *** join/#openezx jonwil_ (n=jonwil@124.182.35.218) |
| 12:06.28 | *** join/#openezx respawn (n=spawn@eminescu.rdsor.ro) |
| 12:11.36 | *** join/#openezx florian (n=fuchs@217.146.132.69) |
| 13:08.03 | *** join/#openezx CIA-46 (n=CIA@208.69.182.149) |
| 13:19.10 | bambam | hi |
| 13:24.42 | bambam | for booting the system from dual_boot-howto which fs needs to be on the second partition, ext3? |
| 13:44.21 | ao2 | ext2 |
| 13:45.44 | bambam | thanks, ext3 also did the job ;) |
| 13:46.21 | ao2 | yes, they are somewhat comatible |
| 13:46.45 | ao2 | bambam, what phone are you using? |
| 13:47.14 | bambam | a780 |
| 13:47.23 | ao2 | good |
| 13:49.36 | bambam | hrrm, haven't used oe in a while, hopefully db migrate + regenerate_caches won't take that long |
| 13:52.06 | ao2 | if you leave out the LOCALE stuff even compiling the OE toolchain from scratch has human times :) |
| 13:59.04 | bambam | ao2: how could i force an image to skip LOCALEs? |
| 14:00.13 | ao2 | ENABLE_BINARY_LOCALE_GENERATION = "0" |
| 14:00.15 | ao2 | ASSUME_PROVIDED += "qemu-native" |
| 14:00.36 | ao2 | in build/conf/local.conf |
| 14:00.39 | bambam | thanks |
| 16:20.09 | *** join/#openezx Marex (n=marex@vasut.kolej.mff.cuni.cz) |
| 16:41.02 | *** join/#openezx flyhorse|linux (n=flyhorse@219.130.11.134) |
| 17:58.50 | *** join/#openezx drath_ (i=vmaster@p5B07D012.dip.t-dialin.net) |
| 18:07.23 | *** join/#openezx flo_lap (n=fuchs@f054161094.adsl.alicedsl.de) |
| 18:12.52 | *** join/#openezx TimRiker (n=timr@68.27.23.28) |
| 19:00.56 | *** join/#openezx tombhadAC (n=tombhad@pD95DE09C.dip.t-dialin.net) |
| 19:50.25 | *** join/#openezx tombhadAC (n=tombhad@pD95DDFFA.dip.t-dialin.net) |
| 20:06.23 | *** join/#openezx p3t3r__ (n=p3t3r__@wlan.net-you.de) |
| 20:16.07 | *** join/#openezx alphaone (n=alphaone@2001:638:602:af01:0:0:0:1) |
| 20:50.09 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 22:02.32 | *** join/#openezx janneg (n=janne@v29714.1blu.de) |
| 22:08.23 | *** join/#openezx tombhadAC (n=tombhad@pD95DDFFA.dip.t-dialin.net) |
| 22:36.03 | *** join/#openezx p3t3r__ (n=p3t3r__@wlan.net-you.de) |
| 23:50.13 | *** join/#openezx jonwil (n=jonwil@CPE-124-182-35-218.sa.bigpond.net.au) |