Replies: 2 comments 7 replies
-
|
I think we have some info on the aeon mcu. I wouldn't expect to get linux running unless it's really close to something linux supoorts (like openrisc) but if you can build code for it I don't see why you couldn't run stuff on it. |
Beta Was this translation helpful? Give feedback.
-
|
@fifteenhex You do indeed have some info! More than I could have hoped for! Googling "AEON" strings never got me anywhere, nor "CERAMAL." From what I understand from this repo, AEON is pretty much OpenRISC. Any tips for disassembling? Seems none of the big 3 disassemblers support this OpenRISC out of the box. As far as code, I was thinking I would have to do it in ASM. You think I can actually get some C built for this device? Also, do we want my flash dump up on here somewhere? |
Beta Was this translation helpful? Give feedback.
-
|
@darekdumon for what it's worth, I recently got an LG monitor and I've been ~attempting to reverse engineer its firmware without much success because it is also AEON. There's actually some AEON ELFs/.o/.a files at https://github.com/xuzemin/mstar/tree/master which at least helped me identify a handful of things, but I cannot for the life of me find |
Beta Was this translation helpful? Give feedback.
-
|
@shinyquagsire23 There is a series of videos on opentechlab.co.uk front page, I learned a lot from that series. They eventually discover the chip they are reversing was using openrisc. They whipped up an objdump for openrisc. * edit: the objdump they modified was not for openrisc, they didnt know it was openrisc at that point. * https://re-ws.pl/2018/01/lkv373a-state-of-the-reverse-engineering/. Seems they also got a radare2 plug in going for it as well. That's probably our best place to start, but I'm not exactly sure what would need to be modified to make it "AEON". |
Beta Was this translation helpful? Give feedback.
-
|
@shinyquagsire23 I just found this! Very promising: https://github.com/uxmal/reko/releases |
Beta Was this translation helpful? Give feedback.
-
|
@1hedu I got a Ghidra SLEIGH module pretty far along based on the reko decoder, it still has a bit of trouble with a few things like jump tables but it's definitely enough to compare vs sources and gather the straggling missing ops https://github.com/shinyquagsire23/ghidra-aeon
|
Beta Was this translation helpful? Give feedback.
-
|
Wow man! That's really great to see. Excited to get home and poke around. Thank you for sharing! |
Beta Was this translation helpful? Give feedback.
-
|
@shinyquagsire23 Heh as it were, I had only heard about Ghidra SLEIGH here, from you good sire23. I tried to hold out and get your module working, and realized I have to get eclipse up, and install all the plugins and whatnot from marketplace and from Ghidra install folder. I updated the build.xml file with paths to Framework folder, and to my Ghidra folder(chocolatey installed). But, alas i have no more ideas, as finally figuring out the path formatting to use seems to be my last step forward. Here is from the Run As Ant output: BUILD FAILED Total time: 1 second Any idea what I've done wrong? |
Beta Was this translation helpful? Give feedback.
-
|
@1hedu I ended up using this repository (built as normal) https://github.com/lifting-bits/sleigh combined with this test script: https://gist.github.com/shinyquagsire23/597a790dcb445adc5c68ce59462074bd So the workflow was generally, copy some asm into that long hex string for instant feedback, and for decompiling issues you have to close Ghidra -> The current repo actually includes the prebuilt outputs so if you don't want to modify/fix things, you can always just clone the repo into |
Beta Was this translation helpful? Give feedback.
-
So I have an MStar MSPD21D. According to my bootlog, it's an AEON MCU for sure. See log:
'* SPI flash clock 27 MHz
MIU clock running in 144MHz by default...
miu16(0x09c1,0x0000)Initialize memory...
miu16(0x091c,0x0040)miu16(0x091c,0x0040)miu16(0x090f,0x0001)miu16(0x090f,0x0000)miu16(0x0910,0x14ce)miu16(0x0911,0x02b2)miu16(0x0912,0x4110)Reset PLL completed
miu16(0x0901,0x0001)miu16(0x0902,0x0361)miu16(0x090e,0x0004)miu16(0x0903,0x0010)miu16(0x0904,0x44c8)miu16(0x0905,0x0252)miu16(0x0906,0x5634)miu16(0x0907,0x000e)miu16(0x091d,0x0000)miu16(0x0920,0x0001)miu16(0x0930,0x0001)miu16(0x0940,0x0001)miu16(0x0950,0x0001)miu16(0x091b,0x0061)miu16(0x0900,0x0001)Memory initialization completed .
Memory self test completed .
ECC cache reset
ECC cache ON
MCU read burst ON
ISB burst mode ON
'* Switch CPU from 12MHz to 160MHz ... complete.
[Ceramal basic initialization complete]
Move code from SPI to DRAM ...done.
doinig gamma setup with table value
'# RTC reset ok [1].
msIR_Initialize IR clk 1 MHzC4 VERSION: UFF00
[CHIPTOP][0x03]BONDING_STS = 0x00FE
MSPD21D IC got SD MS XD pin
[CLKGEN][0x43]CLK_FCIE 0x0000 --> 0x0000
Warning!!! SD CF over current event.
gDisk2Slot[0] = 0x0038 sd ms xd
Init defult exist disk:
[0]0x0000
[0] Palette is loaded correctly!
[MApp_ReadCfgFromFlash] proname = CERAMAL$
[MApp_ReadCfgFromFlash] verion = 1.5
[boot]dstaddr:1360832
decode done... should be
Aeon image offset = 0x80200, size=0x19dd8
Successfully copied Aeon image into DRAM
Win1 Warning : mapping Xdata into Aeon memory space [0xF0]
'# AEON reset & enable ...
'..Set SPI base to 0xf0000000
'..Set QMEM base to 0xC0000000
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Pre-Flag(IR_RPT_FIFOEMPTY)=6
ClearFIFO: Key=0,Flag(IR_RPT_FIFOEMPTY)=6
Start msAPI_MIU_Get_BinInfo()
Start msAPI_MIU_Get_BinInfo() success!
osdcp_text_addr=a2000
[OSDcp_LoadJPEGIcon_init] osdcp_bmp_addr = a8e00
[SS] imageaddr = 110900, width = 112, height = 64
[SS] imageaddr = 12b100, width = 112, height = 64
Win1 Warning : mapping Xdata into Aeon memory space [0x0]
aeon lib built date:May 4 2008 16:14:40
Win1 Warning : mapping Xdata into Aeon memory space [0x20]
aeon code built date:Nov 2 2009
Win1 Warning : mapping Xdata into Aeon memory space [0x30]
aeon code built time:17:58:35
Win1 Warning : mapping Xdata into Aeon memory space [0x40]
Win1 Warning : mapping Xdata into Aeon memory space [0x41]
Win1 Warning : mapping Xdata into Aeon memory space [0x42]
Win1 Warning : mapping Xdata into Aeon memory space [0x43]
aeon code built time:129427
[Mailbox] unknown JPD command!
u16Index=0,paramJPEG.u16JPEGindex=5
[CP_JPEG] paramJPEG->u16JPEGindex=5 u32jpgBitstreamMemAdr=110900
u16Index=0,paramJPEG.u16JPEGindex=5
[CP_JPEG] paramJPEG->u16JPEGindex=5 u32jpgBitstreamMemAdr=110900
Anyone recognize CERAMAL?
I have two of these DPF720, one is in need of repair so was thinking at minimum, for linux, I will probably need to upgrade the ram and flash for this device to accommodate. Suppose I could pull the ram from one and install two ram chips on one of them, somehow. Lmk, if not i guess ill need to find a single unit with at least double capacity.
I have dumped the external flash for this device, and can provide that.
If I can't do linux, I still want to repurpose this somehow. Looking for any suggestions. I have seen a technique to write new functions in spare memory space, and replace calls to function addresses that were already in the firmware, with the addresses of those new functions. Doesn't seem out of reach.
MStar is my b****
Beta Was this translation helpful? Give feedback.
All reactions