- e3-hacking - earth.li

PBL & running arbitrary code (revisited)
by Otaku 07 May '05

07 May '05

I don't know if this is common knowledge, and I've just missed the thread or whatever, but : Command 4 seems to be the "jump to this address" directive.. I've been playing with executing tiny bits of code with it - it seems to work ok with 05.. Apologies if this isn't shiny news .. :) Jake

1 0

Polyphonic file format
by Matt Holmes 04 May '05

04 May '05

Hi, Does anyone know how to download polyphonic files to the e3? Obviously I don't want to pay the £1.50 charge. Can you send them as an attachment via email. What format does the e3 require for polyphonic ring tones? regards, Matt Holmes United Kingdom _____

3 2

[E2 hacking] Accessed flash through PBL
by Matt Evans 04 May '05

04 May '05

Yey, Just got my bootmonitor reading/erasing/writing flash reliably with images I'm downloading to it, by calling PBL's flash accessing routines. It's suddenly becoming useful - it's not quite there yet, I hope to give y'all an update/tarball tomorrow. Cheers, Matt

1 0

Partial disassebly ..
by Otaku 01 May '05

01 May '05

I've shoved the disassembly I've been working on up on my box, just fyi.. its available @ http://purple.earth.li/~tta/e3_disasm.zip or http://purple.earth.li/~tta/e3_disasm.lst it is _very_ raw, and some of the function names are "best guess before I work out what they do" iykwim.. Any corrections, suggestions would be useful.. Oh, and Matt, is your email dodgy atm ? Cheers Jake

2 1

2. Re: W00t; it runs. (Matt Evans)
by Otaku 24 Apr '05

24 Apr '05

>Message: 2 >From: Matt Evans <matt(a)axio.ms> >Subject: Re: [E3-hacking] W00t; it runs. >Date: Sat, 23 Apr 2005 13:24:49 +0100 >To: e3-hacking(a)earth.li >Reply-To: e3-hacking(a)earth.li > >Dear Jonathan, > >Well done for your code download via the modem! Sounds interesting. >Have you documented your procedure anywhere? Protocol/format of the >data is probably* pretty similar to that over EXP, maybe? :) I don't >have the means here to talk modem-modem to the device. > >I was interested to read in your GPL-vio email that the PBL/kernel >images were obtained by de-soldering the flash chips on an E3. I'm >keen to have a look at the E3's version of PBL (and thanks for sharing >the symbols you'd deduced so far), but I'd prefer a non-invasive way of >getting it out. (So, JTAG or some EXP hacks - chicken and egg scenario >w.r.t. reverse-engineering PBL's (v4) protocol though ;) What is the >state of the E3 whose flash chips were removed? Were they read and >then soldered back in place, or was it a sacrificial broken > > The flashes were desoldered, then the tsop48 was dumped.. I couldn't get my hands on an adapter for the vsop :( They were both resoldered ( I changed the boot param block on the flash and fixed the crc ) and was rewarded with a working console. From this I was able tar the filesystem (just to make sure - I'd already reconstructed it from the flash dump), and dump the pbl.. ( Thanks to Noodles for pointing out the mmap neccessity :D ). I sacrificed a different one so I could trace the jtag traces though.. :) They do go somewhere : theres a resistor block that needs fitted on the top of the board, iirc.. I've just acquired a TI debug pod for the omap, so I'll doubtless be continuing along this route, once I've completed disassembly of the pbl. Cheers Jake >(before/after) E3? IFF it was the latter I wonder if it might be >possible to remove the OMAP5910 and beep out the JTAG pins to see if >they go anywhere and if so, where? > >Best regards, > > >Matt > >

2 1

Amstrad E3 GPL violation.
by Jonathan McDowell 24 Apr '05

24 Apr '05

The Amstrad E3 is a Linux based videophone; see: http://www.amstrad.com/e3_intro.html It runs MontaVista based Linux: http://www.amstrad.co.uk/news_linux.html There is no source provided with the device, nor mention of the availability of it. However when the device is registered with Amstrad (which is required to make use of it), they send an email which includes: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - E3 LINUX KERNEL Under the GNU GPL (see www.gnu.org/copyleft/gpl.html) E3 owners and third parties are entitled to the source code of the Linux Kernel in the product. Should you wish to obtain this, please send a cheque for £25 payable to Amserve Ltd (to cover administration and distribution costs) to Amserve Support, Brentwood House, 169 Kings Road, Brentwood, Essex CM14 4EF. This offer is valid for three years. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - I sent off for this and received a CD containing: http://www.earth.li/~noodles/files/linux-2.4.18-mv30-E3.tar.bz2 (23M tarball of the contents of the CD) Firstly, this only contains the kernel. There is no provision of glibc, busybox or any of the other MontaVista components used. When I asked Amstrad about the other source they said: | The CD provided included GPL'd code that we are using and not unmodified | GPL'd code that we are not. You are correct in that we perhaps should | have included it on the CD. We are correcting this now, but you might | like to note that our original Linux source was Montavista, as per our | joint public statements. The original source, which includes those | items mentioned in your mail is to be found at | http://www.mvista.com/previewkit/index.html. You will need to follow the | instructions for OMAP 5910. I'm not entirely sure about this - could it possibly count as passing on a written offer and thus be ok? Further investigation however revealed that the kernel on my actual device reports a different version - "2.4.18_mvl30-ams-delta" vs the "2.4.18_mvl30-E3" of the source. Also there is mention of an MFS-DFD / dfdblk driver that is compiled in (certainly dmesg output about it from before the filesystem is mounted). The boot log can be seen at: http://www.earth.li/~noodles/files/delta.boot A copy of the kernel taken from the device is at: http://www.earth.li/~noodles/files/kernel2.4.18_mvl30-ams-delta In response to my complaints about this Amstrad eventually said: | While Amserve are looking into this matter, we are prepared to offer | you the return of the £25 paid to us. | | Should you wish to accept this offer, please return the CD for my | attention and I will arrange that a cheque be posted to you by return. | | However, as I have stated in my previous email, Amserve are | investigating this matter, and will contact you in the near future. We | are sorry for any inconvenience caused. They did indeed accept the CD back and return my £25, but they have failed to contact me again since my last contact with them on 8th Feb. I believe Amstrad are taking advantage of the fact that it's not easy to verify exactly what is running on the device - at the current point in time I don't have shell access to Linux running on the device. The kernel image above was obtained by someone removing the flash and copying the contents off. Given that Amstrad's business model involves the device having to make a daily premium rate call I believe they are stalling to protect their investment, but this is no excuse for the copyright violations involved. Can someone with appropriate copyright ownership apply some pressure please? J. -- Confidence is telling someone | .''`. Debian GNU/Linux Developer how to use his Twit Filter. | : :' : Happy to accept PGP signed | `. `' or encrypted mail - RSA + | `- DSA keys on the keyservers.

2 3

W00t; it runs.
by Jonathan McDowell 24 Apr '05

24 Apr '05

Amstrad Delta - PBL V4.9 Build:1311 Assert Debug ICE YMODEM DIAL 9 NUM 1 PBL 32MB NAND Ymodem download is OK download module = TEST BLOCK, version = 0002h module is at 10020000h module will load to 10002000h module OK and copied - calling entry point Hello, world! (That would be the E3 loading code I've fed it over the modem and executing it, that would. Now I just need to work out how to write to the flash so I can get it booting Linux again.) J. -- [ noodles is a famous dish of the sanuki region ]

2 2

E3 JTAG
by Matt Evans 20 Apr '05

20 Apr '05

Hi all, Anyone worked out where/if (uhoh) the JTAG TAP is brought out to on the E3's motherboard? Google won't tell me :( (Failing that, has anyone got a broken one they could strip down & find out? ;) -Matt

2 2

previous amstrad emailer
by paul＠e3.sbrk.co.uk 17 Apr '05

17 Apr '05

I haven't got an e3 yet, but since they've just come down in price I might get a pair. However, I do have a couple of the previous versions of the emailer which I just use as normal phones. I did have a bit of a look at the emailer to stop it having to dial up to premium rate numbers which annoyed me a bit. What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx. This, as someone else mentioned dials up and authenticates via CHAP. By prompting the emailer for authentication, I learned its username and password. You then see the amstrad try to connect to various servers and request configuration files over HTTP amongst other things. I configured my box to respond to all IP addresses and learnt what it was requesting. You could then use the above info to request the config files from the real server. If you look in the retrieved gamma_a_live.config you see things like redial intervals, next advert collect time and stuff that you can alter to more reasonable values and feed to the emailer. I never registered the second emailer at all and it works fine. Interestingly, the previous version had a config option: CameraSupport=0 so I presume the process is very similar, if not identical for the e3. Paul

5 16

435208
by jan bartnik 15 Apr '05

15 Apr '05

435208

3 3