e3-hacking

e3-hacking@earth.li

395 discussions

I am trying to uncompress the Amstrad E3 cramfs file system
by Tina Poole 24 Dec '23

24 Dec '23

I managed to uncompress its cramfs file system partly, so some of the files are missing data so are all 0s and some files are OK, am I missing something, can't work out why, can anyone here help me, that's if anyone's around....? This is how I did it: About the cramfs and how to get it off the NAND Dump The OOB is 16 bytes after every block of 512 bytes. So for every 528 bytes you need to remove the last 16 bytes. In the E3-hacking email thread there's they Python script, that does it but also a simple command-line perl program that does it as well but modifies the existing file so you better copy it first: # cp e3-nand-backup.4 e3-nand-stripped.4 LC_ALL=C perl -i -0777pe 's/(.{512})(.{16})/$1/gs' e3-nand-stripped.4 So then e3-nand-stripped.4 is the copy of the nand part where the cramfs filesystems are without the OOB bytes. Now, to extract the actual cramfs parts you need to find where they are. From the E3-hacking email thread we know that each section in the nand starts with Q;Q; and also that the filesystem sections also have the word LNXFSYS. So it is easy to search for in hexedit. The first one you will find is at 0x1E4000: 001E4000 51 3B 51 3B 00 00 DB 2E 00 D1 1D 00 01 00 01 00 00 00 02 00 4C 4E 58 46 53 59 53 00 00 00 00 00 Q;Q;................LNXFSYS..... 001E4020 00 00 00 00 40 28 23 29 69 6E 69 74 72 64 2E 63 72 61 6D 20 41 4D 53 3A 30 30 30 31 00 00 00 00 ....(a)(#)initrd.cram AMS:0001.... 001E4040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 001E4060 00 00 00 00 F8 00 10 11 13 B5 13 B5 00 00 10 11 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF ................................ 001E4080 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................ 001E40A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................ 001E40C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................ 001E40E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 ................................ 001E4100 45 3D CD 28 00 00 01 00 00 00 00 00 00 00 00 00 43 6F 6D 70 72 65 73 73 65 64 20 52 4F 4D 46 53 E=.(............Compressed ROMFS 001E4120 DC 49 D9 64 DE 0D 9A 00 68 8D F8 40 CF 52 8B 66 43 6F 6D 70 72 65 73 73 65 64 00 00 00 00 00 00 .I.d....h..@.R.fCompressed...... If you look more closely you see 0x1E4000-0x1E40FF is probably the header for this section with some info probably for the nand driver that Amstrad used? But as it is publicly information that a CRAMFS filesystem starts with a signature of 45 3D CD 28 it's easy to figure out where the acutal CRAMFS data starts (0x1E4100). Acording to how a CRAMFS system header is put together (https://www.kernel.org/doc/Documentation/filesystems/cramfs.txt) there some more info to be had: 00 ulelong 0x28cd3d45 CRAMFS signature 04 ulelong 0x00010000 size = 65535 08 ulelong 0x00000000 flags 12 ulelong 0x00000000 future 0x%x 16 string Compressed ROMFS signature 32 ulelong 0x64D949DC checksum 36 ulelong 0x009A0DDE edition 40 ulelong 0x40F88D68 #of blocks = **1090030952** (!!!!!) 44 ulelong 0x668B52CF #of files = **1720406735** (!!!!!) 48 string Compressed name But you already see something is off because the #blocks would be 0x40F88D68 and the number of files 0x668B52CF. Which is much too many, So this is already an indication that there is something odd. The next Q;Q; block starts at 0x464000 (this is the other CRAMFS filesystem, there are 2 cramfs) so the maximum length that the first CRAMFS data could be is 0x464000 - 0x1E4100 = 0x26FF00 = 2555648. This is a lot larger than the size in the header (65535) so also a bit fishy. They probably left a lot of room spare. If you look at the hex data the last bit of 'random' data ends at 0x3C093C, then it is 00's until 0x3C1100 and from there on FF's until 0x464000. But if you look at the start + 65535 it doesn't look like that is the real end of the file, the data seems to continue. So it is best to use the data at least up to where the 00's end. From this I assume that the start of the first CRAMFS system is at 0x1E4100 (6439168) and the end at 0x3C10FF so a length of 0x11DD000 (1953792). To dump this you then do: # dd if=e3-nand-stripped.4 of=cramfs-1 bs=1 skip=1982720 count=1953792 And from there on it is using standard linux tools for cramfs to try to extract it: # cramfsck -help usage: cramfsck [-hv] [-x dir] file -h print this help -x dir extract into dir -v be more verbose file file to test # sudo `mount -t cramfs cramfs-1 /mnt But these won't work because of the data being somehwat different. This one I compiled from source and it does a bit more uncramfs-fmk 57.41 KB # uncramfs-fmk v0.7 by Andrew Stitcher Usage: 'uncramfs-fmk [-d devfilename] [-m modefilename] dirname infile' where <dirname> is the root for the uncompressed (output) filesystem. # uncramfs-fmk e3-cramfs-1-root cramfs-1 This will extract it to a directory e3-cramfs-1-root and also output lot's of info including 'Uncompression failed; for each file wher it fails, Also: [Volume size: 0x1dd000] [Volume serial: dc49d964de0d9a00688df840cf528b66] [Volume name: Compressed] <lots of stuff removed> [Summary:] [Total uncompressed size: 4492954] [Total compressed size: -760580457] [Number of entries: 341] [Number of files compressed: 202] [Number of files expanded: 139] So there are 341 files in total apparently. And the size is 0x1dd000 which is different from 0x10000 in the header... To get the second cramfs you do the same analysis on the next Q;Q block and you arrive at # dd if=e3-nand-stripped.4 of=cramfs-2 bs=1 skip=4604160 count=1953792 And the extraction summary is: Volume size: 0x1dd000] [Volume serial: d07c38cb5ca01614f37d520c4e076ab6] [Volume name: Compressed] [Summary:] [Total uncompressed size: 4093206] [Total compressed size: -1905520397] [Number of entries: 280] [Number of files compressed: 141] [Number of files expanded: 139]

3 5

None
by None 29 Dec '21

29 Dec '21

when the bootloader enables the WDT it also sets the freeze bit in the WDT control register which prevents the register being changed, the only way to clear this is a reset. Possibly the bios could be patched to not set the freeze bit and the patched version programmed by jtag to give a box that can have the WDT disabled just after the CPU is halted, but i never got as far as looking to see if/how you would flash the bios by jtag, although it could probably be done. I also have no idea if the bootloader would check to see if the value in the WDT controller register had been tampered with. That and im not sure id want to dump 8 megs of flash with a wiggler, it would probably take a day or 2 lol, the wiggler is a very slow interface :) It might also be possible to dump the nand flash by allowing the emailer to reset then writing a macro to setup the memory controller to map the nand back into address space then read the first 512 (????) byte page (just read the same address 512 times) then write to the chip to change page and continue to read the next page, but until i came across the emailer i had never heard of page mode flash so the method of reading/writing/changing page completely boggled me, but it basically behaves like a smartmedia card. To read it in this manner would require some poking around the board to see how they are generating the signal for changing page rather that writing to flash I guessed that they are either sitting the chip on 2 chipselect lines (ie it would be mapped in 2 places) with one enabled for read/write and the other for reading/changing page, or it has only one chip select but with some of the address lines wired to the control signals so for example a write to a memory address at the chips lowest address would actually write to the chip while a write at the top of its mapped space would change the page, but this is just a random guess, i havent really looked into it. Oh and apologies for hijacking the E3 mailing list with E2 stuff but i hope some of it will be relevant, most arm boards seem to be built in a similar manner. en4rab > From: Ralph Corderoy <ralph(a)inputplus.co.uk> > Reply-To: e3-hacking(a)earth.li > > > Hi en4rab, > > > If the E3 behaves like the E2 did it will have its WDT enabled and > > locked so about 4 or 5 seconds after you halt the CPU the WDT will > > time out and reset the box > > Code to reset the watch-dog's timer writes 0x0000a5a5 to 0xffff8004. > > e3a0c9fe mov r12, #&3f8000 > e24cc501 sub r12, r12, #&400000 # r12 = 0xffff8000 = WDT. > e3a030a5 mov r3, #&a5 > e2833ca5 add r3, r3, #&a500 # r3 = 0xa5a5. > e58c3004 str r3, [r12, #4] # wdtcntr. > > Presumably, something similar could be done with JTAG to disable the > WDT > completely? > > Cheers, > > > Ralph. ===== -- | .-. en4rab(a)yahoo.com | / \ .-. | / \ / \ .-. .-. _ _ +--/-------\-----/-----\-----/---\---/---\---/-\-/-\/\/--- | / \ / \ / '-' '-' |/ '-' '-' -END OF TRANSMISSION- __________________________________ Do you Yahoo!? All your favorites on one personal page Try My Yahoo! http://my.yahoo.com

1 0

Anyone know the Pinout of the Amstrad E3 Videophone Mailboard
by Nick Griffin 29 Sep '19

29 Sep '19

Hi Long time no speak… 😊 Anyone know the pinout ,I want to connect it to a PS/2 connector, The PS/2 connector has 6 pins when the Mailboard has 4 pins…? Anyone..? Spanner.. http://amstrad-e3-hacking.freeforums.net

4 9

Hello!
by Adam Ainsworth 01 Aug '19

01 Aug '19

Hi all, Came across this list while looking for hacking info on the Emailer. It's a bit out of my usual area of interest, normally I'm playing with 8-bit computers and old PC-alikes. I got an Emailer Plus in new condition about a while back, but forgot about it until recently when I picked up a Pocket Dockit to go with it. I just fired it up to see what it could do, and that turned out to be...nothing! I watched the Chinnyvision video on it, and he came to the same conclusion. https://youtu.be/aY6R72nWJsU I did find a couple of articles, although one (where the author appeared to have Linux running on it) is presumably by someone on this list, given the URL. There was also mention of hooking up a Raspberry Pi to it. I'm also wondering if a wifi modem would do the trick, although presumably we'd need to know how the server software worked if it did connect. Without me going through all of the list archives, can someone just give me a quick update on the current status of hacking it? Has someone found a way in, or have I wasted £12 or so on the hardware? Thanks very much! Adam ========

2 2

E3's Internal Storage
by ZudoBug2 . 29 May '19

29 May '19

Hi, I have an E3 that's still in its factory state (PBL V4.9 and never registered with Amstrad). It can boot into BusyBox Linux as per the instructions at https://wiki.earth.li/E3_Getting_Started Is it possible to access the E3's internal storage from the BusyBox command line? I am curious to read some of the config files etc. As an aside, I noticed that the E3's OS includes a driver for my "Pegasus II" USB Ethernet adapter, so I tried connecting this before power-up. The E3 doesn't obtain an IP address automatically via DHCP, but I wonder if it assigns a fixed IP that might permit access, for example via SSH? There also seems to be a driver for a Belkin USB serial adapter (but I don't have one to test it with). Anyone tried connecting one of these? Thanks, Jamie.

2 1

Re: [E3-hacking] Understanding the E3s Partitions
by Nick Griffin 12 May '19

12 May '19

“When it flash's Linux to the E3 it only uses partitions mtd0,mtd1,mtd3 and mtd4, so mtd2 and mtd3 is not used.” mtd0 - kernel mtd1 - PBL ( Maybe, I say this because Uboot is flashed there.) mtd3 - ldr ( File System..? uses mtdblock3 of mtd3) mtd4 - Root( Root File System,maybe ?? uses mtdblock4 of mtd4) What are mtd2 and mtd5 used for..?? Trying to find out what each Partition is used for? Is the Amstrad Install Script running in a Ramdisk..?? You have 2 Uboot images the same, one for flashing the other on for the install so you made it a bit like FEL mode where you hold down the FEL Button and can boot into Uboot +ramdisk from you PC thought its usb cable that powers it then you can mount the system partition to get into files and folders, that's on TheC64 Mini. Most Developing Boards now have the FEL button. Just trying to find out more ,it dumps the firmware into 6 partitions, when it dumps them, can they be put back the way they are or do they need to be converted, so what I am say, are they raw files so they can’t be used the way they are at the moment…? You can backup your firmware with this script without installing Linux on the E3,you can say no to installing it, right..?? if so I will try and see if I can back the E3 up to get the 6 backup files. P.S Have not done anything with my E2Plus yet, if I can backup its firmware and then flash it back then I can fix the dead E2s out there, but I need help. If I can backup its firmware I am willing to share it.But don’t worry my E2Plus is going no where.. 😊 Just been looking at you page Ralph,One of the problem with the E2 is it don’t run Linux, I am trying to find out more about its firmware at the moment. The E1 and E2 use the same Firmware and same CPU Sharp LH79531 ARM (L136 00B), the only difference in them is the Plus had ZX Spectrum games. So I might be able to use the firmware from the E2 on the E1. The E3 had a different CPU because it need a MMU for the Colour LCD screen so need to be more powerful than the E1,E2. Spanner..

8 115

List etiquette
by Jonathan McDowell 01 May '19

01 May '19

I've just rejected a couple of multi-megabyte messages to the list; please don't add big attachments, there are currently 124 people on the list and I doubt they all want to receive such big emails. Post links where appropriate. (Great to see a revival of interest in the E3 though, I managed to find mine in the attic but not the PSU yet.) J. -- "Making the impossible very | .''`. Debian GNU/Linux Developer difficult" -- The OpenGALEN | : :' : Happy to accept PGP signed website. | `. `' or encrypted mail - RSA | `- key on the keyservers.

3 5

Re: [E3-hacking] E1
by Nick Griffin 29 Apr '19

29 Apr '19

I noticed you were talking about the E1 and the Pocket Dock IT, How far did your investigations get with the E1..? Does anyone know how the Pocket Dock IT works and the slot it connects to on the E-mailer(E1/2/3) I ask this because you can use the Pocket Dock IT to copy the Configuration Change Set Up from one E-mailer to another E-mailer but has to be the same model and activated. I was wondering how it copies the setup over to the Pocket Dock IT and back, if we could interface with the dock or Pocket Dock IT we could maybe save the setup from the E-mailer or Pocket Dock IT to the PC. If the batteries in the Pocket Dock IT run out, the setup from the E-mailer gets deleted. Just a idea..?? Spanner.. http://amstrad-e3-hacking.freeforums.net/thread/6/e1

2 1

Re: [E3-hacking] Config / content filesystem
by Nick Griffin 24 Apr '19

24 Apr '19

No still don’t load any well. Maybe Jonathan could help…????? I don’t have a clue.???? Spanner.. http://amstrad-e3-hacking.freeforums.net From: Nick Griffin<mailto:span1922@live.com> Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎39 To: Nick Griffin<mailto:span1922@live.com> I try again with the images with the oob in them and see if that works. Spanner.. http://amstrad-e3-hacking.freeforums.net From: Nick Griffin<mailto:span1922@live.com> Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎37 To: Nick Griffin<mailto:span1922@live.com> Yes we need Jonathan I think, he understands this more..???? I think he gave the code to remove it so you could look at the data in the files better by hex. Spanner.. http://amstrad-e3-hacking.freeforums.net From: Nick Griffin<mailto:span1922@live.com> Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎23 To: Discussion of the Amstrad E3 emailer hardware/software<mailto:e3-hacking@earth.li> I think it needs the OOB data in the image. Just looked on the net about ,it say… How does this combination of nandsim, nandwrite and nandddump decide which ECC scheme to use? The flash is from a TI AM335 system, and as far as I know, the ECC scheme is decided by a combination of the processor and OS. How do these utilities know what to do? First of all the ECC scheme used does not necessarily have to be for all the flash erase blocks. There are ususally 3 different types of flash partitions used and for every type the method to specify the used ECC code differs: 1. The one that are accessed by the ROM bootcode 2. The ones that are accessed by the bootloader (usually u-boot) 3. The ones that are accessed by the operating system (assuming you are using Linux) In general the use of a specific ECC method is limited by the OOB size of the flash. The AM335x_U-Boot_User's_Guide (cannot post link here because of reputation) explains it in sections BCH Flash OOB Layout and the example matches to the flash chip you are using. The 64 bytes per 2k page effectively limit the usable ECC algorithms to BCH8, BCH4 or HAMMING codes. BCH Flash OOB Layout For any ECC scheme we need to add some extra data while writing so as to detect and correct (if possible) the errors introduced by the NAND part. In case of BCH scheme some bytes are needed to store the ECC related info. The section of NAND memory where addition info like ECC data is stored is referred to as Out Of Band or OOB section. The first 2 bytes are used for Bad block marker – 0xFFFF => Good block The next ‘N’ bytes is used for BCH bytes N = B * Number of 512-byte sectors in a page B = 8 bytes per 512 byte sector in BCH4 B = 14 bytes per 512 byte sector in BCH8 B = 26 bytes per 512 byte sector in BCH16 So for a 2k page-size NAND flash with 64-byte OOB size, we will use BCH8. This will consume 2 + (14*4) = 58 bytes out of 64 bytes available. ECC used by ROM bootcode The AM335x processor's ROM bootcode decides which ECC scheme to use for NAND flash depending on the mechanism expalined in the AM335x technical reference manual chapter 26.1.7.4 NAND ECC Correction The default ECC correction applied is BCH 8b/sector using the GPMC and ELM hardware. For device ID codes D3h, C3h, D5h, C5h, D7h, C7h, DEh, CEh when manufacturer code (first ID byte) is 98h the Cell type information is checked in the 4th byte of ID data. If it is equal to 10b then the ECC correction applied is BCH 16b/sector. In addition ECC computation done by the ROM can be turned off completely by using SYSBOOT[9]. This is particularly useful when interfacing with NAND devices that have built in ECC engines. Other ways to control the ECC behavior are ONFI or and I2C EEPROM but the H27U1G8F2BTR datasheet does not mention ONFI so I guess it is not supported by the flash chip. So basically BCH8 or BCH16 or no ECC mechanism is used for the first 128K the ROM bootloader reads from NAND flash. ECC used by the bootloader The bootloader decides this on his own. For example for U-boot this information is compiled into u-boot and the first level bootloader (SPL/MLO) as well. The information is controlled by U-Boot configuration settings set at compile time. Recent versions of U-boot can switch the ecc at runtime using the nandecc command. ECC used by the OS The selection is completely OS specific. For Linux embedded systems using AM335x processors I know that this information is passed into the kernel using the device tree. Which ECC method does nandsim use There is a parameter called bch which can be passed to the nandsim module to select an ecc code. From the code I guess It is initialized to zero so it won't use any ECC code. So it seems that nandsim can use BCH8 and BCH16 but only one for the whole flash that is simulated. modprobe nandsim bch=8 first_id_byte=0xad second_id_byte=0xf1 third_id_byte=0x00 fourth_id_byte=0x1d Which ECC method does nanddump/nandwrite use Again, this depends on the OS/Linux you used to dump the flash. Similar to the nandsim module real mtd drivers have ways to specify the used ECC scheme (kernel parameters, device tree). But you can instruct nanddump to ignore the ECC information, too. References * AM335x technical reference manual http://www.ti.com/lit/gpn/am3359<https://nam04.safelinks.protection.outlook.com/?url=http://www.ti.com/lit/g…> * bch Linux Kernel parameter for nandsim http://lxr.free-electrons.com/source/drivers/mtd/nand/nandsim.c#L175<https://nam04.safelinks.protection.outlook.com/?url=http://lxr.free-electro…> * The AM335x_U-Boot_User's_Guide Spanner.. http://amstrad-e3-hacking.freeforums.net From: Ralph Corderoy<mailto:ralph@inputplus.co.uk> Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎18‎:‎30 To: Discussion of the Amstrad E3 emailer hardware/software<mailto:e3-hacking@earth.li> Hi Nick, > I copied it twice not What's the output of copying it once? > Amstrad Delta - PBL V4.9 Build:1311 Assert Debug ICE > PBL 32MB NAND > 0MB.-->MEMv01.00.002,CopyLim=00220000h,CodeEnd=01400000h-->PBL......1MB.......2MB* What if you try reading out the flash. Do you get what you put in? `cmp foo bar' compares all the bytes in those two files and complains if any differ. Otherwise, I think you'll have to wait for someone that knows mtd to come along and offer suggestions. -- Cheers, Ralph. _______________________________________________ e3-hacking mailing list e3-hacking(a)earth.li https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.earth…

1 0

A Idea... well I am Autistic.. :)
by Nick Griffin 15 Apr '19

15 Apr '19

I was thinking,again,I do that.. 😊 We don’t need a Emailer with the Configuration Change on, if we can backup its NAND and then Copy over it with the backup, all we need is someone with a activated emailer that works, but you would not know how long before the emailer would deactivate, ones it deactivates all you do is copy over it again with the baxckup and it be back to how it was when you copied over the NAND in the beginning, so all you are doing is taking a snapshot of someone's Emailer and coping it to yours to activate it but will have to do it every time it deactivates itself, so a bit like what you do with Windows when you have to activate it every 120 days because you are using Microsoft Toolkit. and if someone has got a emailer with games on and is activated, you can do the same thing once the games expirer, all you do is copy the backup of the NAND with the games on that have like 4 weeks remaining then you have the games back. Spanner..

1 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

e3-hacking