SPIN: 1 - PhatBox: 0 (PhatBox Successfully Owned)

[bushing]

[sent a flacplay script to judb]

Well, I think happened here is that the bootloader (which checks the drive, linux, ramdisk, rc.sh and phatd) uses one key/keys, and phatd (which checks 51d, all of the players, and the playlists) uses another.  I certainly didn't see anything in the phatd code that looked like it differentiated between keys.

Once we have patched the BIOS to stop checking those keys, I can patch phatd to stop checking its keys, and that will be the end of that.

Ben

[para]

Yeah, good old times! I think it's time to reactivate my assembler/reversing styles of coding

[judb]

Okay the setup I have doesnt work.

I tried replacing flacplay and the sig that were sent to me and got nothing.  the songs dont play but I cant see whats wrong because I dont have the debug rc.sh on hand.  Anyone have that?

[para]

Yep, same place in a few minutes...

[judb]

Thanks para.. ill check there now.

Hey spin, what firmware version are you using?

Send me your scripts as I am not able to get this to work on my keg and I think its because of the menuid not being there but cant be sure.

[bushing]

Oh, and if anyone gets around to doing this (please? ), my math was wrong, that dd command should be:

Code: [Select]


/bin/dd if=/dev/mem of=/dos/rom.bin bs=1024 count=256


(256k, not 128k...)

-b

[spin]

Firmware version is 9.0 BMW. I will add those scripts to the DMS and dump the info soon. Is there a way to upload something to board? I don't feel like linking my main site to this hobby =P For the flacplay thing to work, just make the box play a flac file, somehow. I use the menu system because its easy to try a bunch of different things, in order.

[judb]

i did, it doesnt execute the script... the debug log shows the player (flacplay) exits status 0 ... so its is running it it SEEMS but it doesnt DO anything.

im using the 13.01 kenwood firmware...

just email me the stuff at jud DOT barron AT gmail DOT com and I'll post it to my webserver.. FTP for some reason doesnt work right for most folks.

[spin]

Code: [Select]


#!/bin/sh
/bin/stty -F /dev/ttyS0 -a >> /dos/data/stuff/ttyS0.txt
/bin/stty -F /dev/ttyS1 -a >> /dos/data/stuff/ttyS1.txt
/bin/stty -F /dev/ttyAM0 -a >> /dos/data/stuff/ttyAM0.txt
/bin/stty -F /dev/ttyAM1 -a >> /dos/data/stuff/ttyAM1.txt  
/bin/ls -la /dev >> /dos/data/stuff/devlist.txt
set >> /dos/data/stuff/set.txt
dd if=/dev/mem of=/dos/data/stuff/rom.bin bs=1024 count=256
cp -a /proc /dos/data/stuff/proc_snap
tar cf /dos/data/stuff/proc.tar /proc


Resulted in the following (note that the dd command, among others failed). The proc_snap directory /does/ a kcore file though ;-)


stty: /dev/ttyAM0: No such file or directory
stty: /dev/ttyAM1: No such file or directory
Segmentation fault
cp: cannot create symlink `/dos/data/stuff/proc_snap/ide/hda': Operation not permitted

Data:
-rwxr--r--    1 root     root         3726 Dec 31  1979 devlist.txt
drwxr--r--   11 root     root        32768 Dec 31  1979 proc_snap
-rwxr--r--    1 root     root            0 Dec 31  1979 rom.bin
-rwxr--r--    1 root     root          358 Dec 31  1979 set.txt
-rwxr--r--    1 root     root            0 Dec 31  1979 ttyAM0.txt
-rwxr--r--    1 root     root            0 Dec 31  1979 ttyAM1.txt
-rwxr--r--    1 root     root         1124 Dec 31  1979 ttyS0.txt
-rwxr--r--    1 root     root         1132 Dec 31  1979 ttyS1.txt


[ ttyS0 ]
speed 115200 baud; rows 0; columns 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W;
lnext = ^V; flush = ^O; min = 1; time = 0;
-parenb -parodd cs8 hupcl -cstopb cread clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon ixoff
-iuclc -ixany -imaxbel
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
-isig -icanon -iexten -echo -echoe -echok -echonl -noflsh -xcase -tostop
-echoprt -echoctl -echoke

[ ttyS1 ]
speed 115200 baud; rows 0; columns 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W;
lnext = ^V; flush = ^O; min = 1; time = 0;
-parenb -parodd cs8 -hupcl -cstopb cread clocal -crtscts
ignbrk -brkint ignpar -parmrk -inpck -istrip -inlcr -igncr -icrnl -ixon -ixoff
-iuclc -ixany -imaxbel
-opost -olcuc -ocrnl -onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0
ff0
-isig -icanon -iexten -echo -echoe -echok -echonl -noflsh -xcase -tostop
-echoprt -echoctl -echoke


[ DEV ]
drwxr-xr-x    3 0        0             1024 Apr  7  2003 .
drwxr-xr-x   12 500      500           1024 Oct 18  2002 ..
crw-------    1 0        0          14,   1 May  3  2000 audio
lrwxrwxrwx    1 0        0                5 Oct 18  2002 console -> ttyS0
crw-------    1 0        0          14,   1 May  3  2000 dsp
crw-r--r--    1 0        0           1,   7 Dec 24  1997 full
brw-r-----    1 0        0           3,   0 May 12  2000 hda
brw-r-----    1 0        0           3,   1 May 12  2000 hda1
brw-r-----    1 0        0           3,   2 May 12  2000 hda2
brw-r-----    1 0        0           3,   3 May 12  2000 hda3
brw-r-----    1 0        0           3,   4 May 12  2000 hda4
brw-r-----    1 0        0           3,   5 Sep 13  2001 hda5
brw-r--r--    1 0        0           0, 250 Dec 30  1997 initrd
crw-r--r--    1 0        0           1,   2 Dec 24  1997 kmem
crw-r--r--    1 0        0          13,   1 Apr  7  2003 led
crw-r--r--    1 0        0           1,   1 Dec 24  1997 mem
crw-r--r--    1 0        0           1,   3 Dec 24  1997 null
crw-r--r--    1 0        0           1,   4 Dec 24  1997 port
drwxr-xr-x    2 0        0             1024 Dec 12  1999 pts
brw-r--r--    1 0        0           1,   1 Dec 24  1997 ram
crw-r--r--    1 0        0          55,   1 Jan 28  2000 ts
crw-r--r--    1 0        0           5,   0 Dec 24  1997 tty
crw-r--r--    1 0        0           4,   0 Dec 16  1997 tty0
crw-r--r--    1 0        0           4,   1 Dec 11  1997 tty1
crw-r--r--    1 0        0           4,   2 Jan 16  1998 tty2
crw-r--r--    1 0        0           4,   3 Jan 16  1998 tty3
crw-r--r--    1 0        0           4,   4 Jan 16  1998 tty4
crw-r--r--    1 0        0           4,  64 Dec 11  1997 ttyS0
crw-r--r--    1 0        0           4,  65 Jan  1 00:00 ttyS1
crw-r--r--    1 0        0           1,   5 Dec 24  1997 zero

[judb]

Interesting...

I still wonder why I cant get this to work on my keg though.  damn!  Thanks for the information.

[judb]

so from what I can tell, the modem control signals are enabled on the port.. which means we would need DTR and whatnot to communicate right? However RTS and CTS are disabled it looks like...
if we set -clocal insetad of clocal with an STTY command i think we might be able to get serial access working.  Or that might be overkill...

anyone agree or disagree with that?  

Also anyone have any ideas what else I could try?  I replaced flacplay with a signed script...
Hey Spin, why dont you email me your scripts and sig files so I can see if maybe there is something about the way you did that?

[judb]

HAHA! it does work.  for some reason I thought the playlist that PMM generated was right for the flac file but it didnt sync the updated play list.  WHOOT!  now its working.  kickass!  now I need to dig out an old laptop that has a serial port on it.  this one is USB only.

[judb]

the DD failure generates this in the messages log:

Code: [Select]


Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0c24000
*pgd = c0fcb811, *pmd = c0fcb811, *pte = 00000000, *ppte = 00000000
Internal error: Oops: 0
CPU: 0
pc : [<c00e6ff8>]    lr : [<c00b1ec8>]    Not tainted
sp : c0c29f50  ip : 00000000  fp : c0c29f80
r10: bfffff4d  r9 : c0c28000  r8 : 00066000
r7 : 00000400  r6 : c0395ec0  r5 : 00000400  r4 : 00000400
r3 : c0c28000  r2 : 000003fc  r1 : 00000000  r0 : 00066000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  Segment user
Control: 217D  Table: C0C24015  DAC: 00000015
Process dd (pid: 23, stackpage=c0c29000)
Stack: (0xc0c29f40 to 0xc0c2a000)
9f40: c00b1ec8 c00e6ff8 20000013 ffffffff 00000400 00000400 00000400 c0395ec0
9f60: 00000400 c00b1ec8 00000000 ffffffea c0395ea0 c0c29fac c0c29f84 c0070ec0
9f80: c00b1e64 c0c29f90 c00706c4 0000000a 00000400 00066000 00000003 c0043aa0
9fa0: 00000000 c0c29fb0 c0043920 c0070df4 0000000a c0049c90 00000009 00066000
9fc0: 00000400 00000000 0000000a 00000400 00066000 00000009 00000400 bfffff41
9fe0: bfffff4d 00000000 00066000 bffffde0 00033fa0 000460b0 20000010 00000009
Backtrace:
Function entered at [<c00b1e54>] from [<c0070ec0>]
r6 = C0395EA0  r5 = FFFFFFEA  r4 = 00000000
Function entered at [<c0070de4>] from [<c0043920>]
r8 = C0043AA0  r7 = 00000003  r6 = 00066000  r5 = 00000400
r4 = 0000000A
Code: 1a00002c e2522004 4282c004 4a00001b (e4913004)


[judb]

this is the environment returned from a set command:

Code: [Select]


USER='root'
HOME='/'
DEBUG_LEVEL='10'
PS1='# '
OPTIND='1'
PS2='> '
DEBUG_LOG='1'
AAC_DEBUG='1'
TERM='vt102'
PPID='18'
PATH='/usr/bin:/bin:/usr/sbin:/sbin'
SHELL='/bin/sh'
PWD='/'


[ralph.deratt]

so from what I can tell, the modem control signals are enabled on the port.. which means we would need DTR and whatnot to communicate right? However RTS and CTS are disabled it looks like...
if we set -clocal insetad of clocal with an STTY command i think we might be able to get serial access working.  Or that might be overkill...

DCD,DTR, and CTS are pulled low on the EP7312 by external pull down resistors.  They are all active low signals, so they are being aserted correctly.  the serial driver shoud see the port as ready.

RdeR

[judb]

well, then, if I am reading the stty output correctly ^Q will start the session.. and its 11500, 8, e, 1 with xon/xoff flow control.. is that right?  I dont get anything but a smiley face when I try connecting like that.

[judb]

Code: [Select]


#!/bin/sh
echo "/bin/stty -F /dev/tty -a > /dos/stuff/tty.txt"
/bin/stty -F /dev/tty -a > /dos/stuff/tty.txt
echo "/bin/stty -F /dev/tty0 -a > /dos/stuff/tty0.txt"
/bin/stty -F /dev/tty0 -a > /dos/stuff/tty0.txt
echo "/bin/stty -F /dev/tty1 -a > /dos/stuff/tty1.txt"
/bin/stty -F /dev/tty1 -a > /dos/stuff/tty1.txt
echo "/bin/stty -F /dev/tty2 -a > /dos/stuff/tty2.txt"
/bin/stty -F /dev/tty2 -a > /dos/stuff/tty2.txt
echo "/bin/stty -F /dev/tty3 -a > /dos/stuff/tty3.txt"
/bin/stty -F /dev/tty3 -a > /dos/stuff/tty3.txt
echo "/bin/stty -F /dev/tty4 -a > /dos/stuff/tty4.txt"
/bin/stty -F /dev/tty4 -a > /dos/stuff/tty4.txt
echo "/bin/stty -F /dev/ttyS0 -a > /dos/stuff/ttyS0.txt"
/bin/stty -F /dev/ttyS0 -a > /dos/stuff/ttyS0.txt
echo "/bin/stty -F /dev/ttyS1 -a > /dos/stuff/ttyS1.txt"
/bin/stty -F /dev/ttyS1 -a > /dos/stuff/ttyS1.txt
echo "/bin/stty -F /dev/ttyAM0 -a > /dos/stuff/ttyAM0.txt"
/bin/stty -F /dev/ttyAM0 -a > /dos/stuff/ttyAM0.txt
echo "/bin/stty -F /dev/ttyAM1 -a > /dos/stuff/ttyAM1.txt"
/bin/stty -F /dev/ttyAM1 -a > /dos/stuff/ttyAM1.txt  
ls -la /dev > /dos/stuff/devlist.txt
ls -la / > /dos/stuff/rootlist.txt
ls -la /bin > /dos/stuff/binlist.txt
ls -la /sbin > /dos/stuff/sbinlist.txt
ls -la /usr/bin > /dos/stuff/usr_bin_list.txt
ls -la /usr/sbin > /dos/stuff/usr_sbin_list.txt
ls -la /etc > /dos/stuff/etclist.txt
ls -la /etc/init.d > /dos/stuff/etcinitd.txt
ls -la /proc > /dos/stuff/proc.txt
mount > /dos/stuff/mount.txt
ps -aux > /dos/stuff/ps.txt
#dmesg > /dev/ttyS0
#/bin/sync > /dos/stuff/syncoutput.txt
date > /dos/stuff/date.txt
hostname > /dos/stuff/hostname.txt
uname -a > /dos/stuff/uname.txt
/bin/tar cvfh /dos/stuff/proc.tar /proc
/bin/tar cvfhX /dos/stuff/all.tar /dos/stuff/tarexclude.txt /


http://judb.phathack.com/files

files I have gotten off the box.

[spin]

You wrote the output files to the root partition and not the data partition, so you are missing a ton of data:
tar: /proc/ide/ide0/model: input/output error -- No space left on device
tar: /proc/ide/ide0/mate: input/output error -- No space left on device
tar: /proc/ide/ide0/config: input/output error -- No space left on device

[judb]

hmm.. the commands I used were

Code: [Select]

/bin/tar cvfh /dos/stuff/proc.tar /proc
/bin/tar cvfhX /dos/stuff/all.tar /dos/stuff/tarexclude.txt /


what should I have done ?

Also. i noticed some errors with the paths it sees in the log files that dont match up to what I put in the hack.sh .. its like something is doing substitution on my strings in a few places.

[para]

FYI, it works for my box

I replaced phatwma (who needs this anyway) and put a wma startup_sound into Profiles.ini...
Now everytime I turn on my box the script is executed automatically!

Para