FRMorp v1.2 – bugfix!

Posted on March 24, 2010 by openschemes

All righty, here it is in all it’s source and dos executable glory. Good luck to you and enjoy!

Openschemes SPMP8k Firmware dumper v1.2


Openschemes

Pages: 1 2
This entry was posted in MP5. Bookmark the permalink.

0 Responses to "FRMorp v1.2 – bugfix!"

  • By sanchos September 15, 2010 - 11:02 am

    I cannot backup my firmware using FRMorp, i receive message

    Device opened…
    Configuration Set…
    Interface Claimed…
    Phase 1 – Dumping files…
    ———————————-
    Dumping RedBoot.mmp…
    No magic page!Couldn’t dump File 1

    please help me, what can i do with it?

    Reply
    • By openschemes September 17, 2010 - 4:48 am

      Interesting. FRMorp uses the data in the magic page to determine where to get the rest of the data. If it does not find the proper signatures to mark a page as a magic page (signature = 0x55AACC33), then it quits here with the message you see after checking the first 16 pages.
      Maybe your device has the magic page somewhere else, or perhaps a different signature..?
      Try dumping the first 64 pages using nandoori, and look to see if the signature exists anywhere in those pages. If so, just update the search length from 16 (i=(*patptr)+ 0×10;) to the necessary search len.
      If there’s no signature anywhere, then you’ll need to look at the actual data to see if it contains a PAT table, and either remove the sig check from FRMorp or update it to whatever signature you have.

      Reply
      • By jd November 12, 2010 - 9:56 am

        I have same problem on my 4GB device. After some investigation I foud, that only first 2048bytes from every 4k page contain valid data.
        Manipulation with mycbw.xlen can make shorter valid part but never more than 2k.
        If I try change read page to 2k, it is not complete image, miss data.

        Reply
      • By jd November 12, 2010 - 2:32 pm

        I have same problem. And I made some investigation on my 4GB HW and here is result:
        Only first 2kB on every 4kB page is correct. I try to change mycbw.xlen = longswap(0×00100000) but can’t help. It is possible reduce correct part on page, but not expand over 2kB.

        Reply
  • By naldo October 26, 2010 - 12:13 pm

    no solo ofreserles mi apoyo en lo que pueda

    Reply
  • By fredoagain December 6, 2010 - 3:46 am

    Same problem here,

    I’ve flashed a working firmware and made a full dump with nandoori.
    There is too many missing parts from the firmware that i can’t find in the dumpfile.

    I’ll try to modify Frmorp by myself, but my coding skills are not that good :o )

    my board is SK8607C01.

    If you need dump/testing/flashing, don’t hesitate to ask me.

    Thanks for your tools !!

    Reply
    • By b1ack January 17, 2011 - 7:55 am

      fredoagain can u upload it somewhere cause i couldnt dump fw from my device and its not working now, having your firmware might help, or pm me at b1ack.web.tests@gmail.com ;]
      thanks in advance

      Reply
  • By fredoagain January 25, 2011 - 3:18 am

    For anyone interested I’ve uploaded it here, as it’s not availiable on liunx website anymore…

    this one is the SK8607C02 version but it works for both C01 and C02.

    I had another PMP with SK8607C03… with this firmware the device takes 30 seconds to power on…and the lines aren’t reverted :[

    http://dl.free.fr/hUx9JCclD

    Reply
  • By sergei February 8, 2011 - 4:23 am

    Where’s any info regarding SPMP8 commands? In according to USB spec. read command (i.e. mycbw.cmd = longswap(0xC2130000)) consists of:
    - operation code 2 (0-4 bits)
    - group 6 (5-7 bits)
    - service action 13 (8-C bits)
    But I didn’t manage to find any meanings of op-code and service action…
    Could anybody point me where it could be found?

    Reply
    • By openschemes February 23, 2011 - 9:40 pm

      Ahh, you have to disassemble and understand the workings of the binary. That actually led us (led AleMaxx, who led us) to discovering many more commands than we could see just by snooping the USB transactions. But that, of course is a good way to start.
      Our notes on the SPMP8 commands are buried deep in some boxes at the moment, so our usefulness is limited. But by finding the command interpreter in the disasm, it’s fairly simple to see all the commands as well as to trace through their function. That is the best suggestion we can give you if you want an exhaustive list.

      Reply
  • By Jorge Muñoz February 17, 2011 - 5:08 pm

    I was looking at the code of FRMorp, and I wonder how could you know the location of the RedBoot and other software on the NAND. Also how did you know how to pack the Firmware image so FRMpro can work with it and not end up with a bricked device.
    I’m trying to make a similar tool for ATJ2259 based devices.

    Cool application you have here.

    Reply
    • By openschemes February 23, 2011 - 9:56 pm

      We determined the location and format from reverse engineering both the NAND dumps and FRMpro packed images. The device talked about RedBoot on the debug port upon boot, so it was not difficult to find the chunks of code corresponding to RB. From there, we wrote “nandoori” to basically dump every byte from NAND back to the PC. From hex editing those dumps, we slowly deciphered the boot process of the device and traced the path through NAND. RedBoot was easy to find, located at the end of that boot process – ie, once RB loads, it’s all high-level from there on out.

      You’ll need to get info on the ATJ2259 and understand it’s boot process. From there, you can work from a NAND dump (from EPROM programmer or other method) to see how it all fits together when written to chip. Then, it should be simple to write a bunch of different firmwares to your test device and inspect via NAND dumps how the upgrader puts data into different places. From that, you can reconstruct the image format such as we (mostly AleMaxx) did for the SPMP.

      As far as bricking – well, your final product should not brick your user’s device. But if you are the developer… You will (and should) brick your test device in every possible way. So your first goal should be to determine how to unbrick. In the case of the SPMP, you can almost always recover via serial port which gives a nice safety net unless you low-level trash the NAND data. And in that case, there is always desoldering the NAND itself and reflashing via an eeprom burner. Buy and install a TSSOP socket if you feel that unrecoverable errors are going to be a part of your development process. They have TSSOP sockets that fit right on the pads of a normal NAND chip which are great for deep hacking.

      Reply
      • By Jorge Muñoz February 25, 2011 - 9:56 am

        Thank you for your reply.
        I’ve have ordered another ATJ2259 device and a FT232 board, first step I took was setting up serial connection but the USB -> Serial adapter I used only printed garbage.. I blame that to the fact that the adapter outputs 5Volts on the communication pins. So I’ll have to wait for the FT232 board to arrive from the US.

        For second step I’m thinking of modifying nandoori and setup the usbvid and usbpid variables so it matches my device, and also check if the my NAND can be read the same way as SPMP8000 devices you are using. The NAND in my device is a Hynix H27UBG8T2ATR-BC (has 4GB) what I can tell from previous entries yours is Hynix HY5DU561622ETP. So probably they are similar.

        One more question: Could using nandoori can cause the NAND data to be modified and hence end up with a damage boot section ?

        Regards.

        Reply
  • By jim521 October 31, 2011 - 6:55 pm

    hola .gente tengo el firmware sk8607c01 100804 ,dispositivo grande .modelo dv -103 si alguno esta interesado yo se lo envio .solo digame como se los descargo ,o mejor aun si lo puedo descargar en esta pagina .mi correo es jgcf521@hotmail.com jim gaviria .pais ,colombia .

    hello. sk8607c01 people I have the 100804 firmware, large device. -103 dv model if anyone is interested I sent it. just tell me how you download them, or better yet if I can download on this page. jgcf521 my email is @ hotmail. com jim gaviria. country, Colombia.

    Reply
  • By jim521 October 31, 2011 - 6:57 pm

    necesito es la guia para poderlo montar el sk8607c01 en mi dispositivo ,que sea facil de entender ,gracias .
    need is the guide so that it can mount the sk8607c01 on my device that is easy to understand, thanks.

    Reply
  • By vinoth January 14, 2012 - 5:25 am

    iam not able to install libusb driver …
    1) driver update for removable device not installing
    pls help me

    Reply
    • By openschemes January 14, 2012 - 10:41 pm

      You may have to seek help from the LibUSB guys, we have no guess why the installer is failing. If you can provide more detail we will try to help!

      Reply
  • By Lucas February 14, 2012 - 2:12 pm

    I have the same problem, “No magic page!”

    I know nothing about coding. I have tried nandoori and succesfully dumped 64 pages in a .bin file, how can I “look to see if the signature exists anywhere in those pages”? And if the signature exists in the pages, how can I “update the search length from 16 (i=(*patptr)+ 0×10;) to the necessary search len”?

    Sorry, I’m totally a noob :P

    Reply
  • By chris January 9, 2013 - 9:07 am

    I’ll use the microprocessor ATJ2259 (Actions semiconductor) but I’d like to know what kind of software tools (IDE) I can use to develop the software in C/C++ language. Then how can I complie this software (compiler) ?

    Thank you for your answers.

    Reply
    • By openschemes January 9, 2013 - 3:45 pm

      Not sure what IDE would work best for you. We used gcc for our development stuff.

      Reply
  • By jim January 22, 2013 - 12:05 pm

    el dispositivo sk8607c01 no lo tengo ,fue un error ———el dispositivo dv -103 utiliza es ic atj2259c ……….la tarjeta es zx-8082d ,disculpen el error cometido ……. jim .

    Reply

Leave a reply