------------------------ n770 reverse engineering ------------------------ pancake This document tries to collect a set of dumps, disassemblies, and other useful stuff to understand how the n770 boot works. You can use the '#' vim key to move around the branch labels. f.example: __start <- press '#' with the cursor on the word. =============================================================================== Extraction: ----------- $ ./flasher-2.0 -u -F SU-18_2006SE_1.2006.26-8_PR_F5_MR0_ARM.bin flasher v0.8.1 (may 30 2006) SW version in image: SU-18_2006SE_1.2006.26-8_PR_MR0 Image '2nd', size 8704 bytes Image 'secondary', size 87040 bytes Image 'xloader', size 13824 bytes Image 'initfs', size 1890304 bytes Image 'kernel', size 1266560 bytes Image 'rootfs', size 60030976 bytes Unpacking 2nd image to file '2nd.bin.2'... Unpacking secondary image to file 'secondary.bin.2'... Unpacking xloader image to file 'xloader.bin.2'... Unpacking initfs image to file 'initfs.jffs2.2'... Unpacking kernel image to file 'zImage.2'... Unpacking rootfs image to file 'rootfs.jffs2.2'... =============================================================================== Information: ------------ NOLO - Nokia Loader This is: xloader.bin + secondary.bin VERSION 0.9.11 Device: SU-18 CPU: ARM926TEJ DSP: TMS320C55x HW-Revision 1802 Board is N770 aka F4 (pre-production model) and F5 ( IT OMAP-1710 ) =============================================================================== Internet References: -------------------- http://www.mail-archive.com/maemo-developers@maemo.org/msg05482.html http://www.math.ucla.edu/~jimc/nokia770/ http://focus.ti.com/general/docs/wtbu/wtbusplashcontent.tsp?templateId=6123&path=templatedata/cm/splash/data/linux_com_downloads#h3 http://focus.ti.com/general/docs/wtbu/wtbuproductcontent.tsp?templateId=6123&navigationId=11991&contentId=4670 http://www.theparticle.com/files/txt/hacking/phrack/p58-10.txt http://www.arm.com/pdfs/QRC0006_UAL16.pdf =============================================================================== Emulation: ---------- http://softgun.sourceforge.net - arm emulator (f4 board not supported) $ softgun -g 0x600 xloader.bin =============================================================================== Opcode reference: B = Unconditional Branch BL = Branch + Link = this is: LR = PC+4 && B