vkoskiv | Reverse-engineering firmware is kind of fun now, actually. | 00:05 |
---|---|---|
vkoskiv | Staring at a function for a while, then realising it's a common C thing like malloc or some string function | 00:06 |
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@129.110.242.224) | 00:06 | |
vkoskiv | I still 99% have no idea what I'm doing, and there are errors in my disassembly, but progress is happening | 00:06 |
jn | ah, the classic "hmm..... yup, that's strlen" | 00:07 |
vkoskiv | I' | 00:07 |
vkoskiv | I've seen strlens inlined a bunch of times, not sure how to tell ghidra about that | 00:07 |
jn | oof, yeah. not sure ghidra can de-inline without a plugin in java (or some other jvm language like python ;p ) | 00:09 |
vkoskiv | I just constantly have a feeling that I'm missing something important :D | 00:10 |
vkoskiv | So it goes with learning a new thing, I guess. | 00:10 |
vkoskiv | So far things are kind of making sense. Though I do have a few really long bogus functions that I need to somehow sort out | 00:11 |
- cobra (QUIT: Ping timeout: 240 seconds) (~cobra@user/Cobra) | 00:12 | |
+ cobra (~cobra@user/Cobra) | 00:13 | |
vkoskiv | https://vkoskiv.com/screenshots/2024-04-16T22:14:42UTC-AM065iQT.png | 00:15 |
vkoskiv | Gee, I wonder what function FUN_00026212 might be! | 00:15 |
jn | ghidra sure knows about FUN! | 00:17 |
vkoskiv | Yeah, it's found tons of FUN places in this firmware image | 00:18 |
vkoskiv | (I'm trying to reverse the firmware for my oscilloscope, which is 68020-based) | 00:18 |
jn | vkoskiv: huh, what kind of executable is this that has fopen but it's unnamed? | 00:18 |
vkoskiv | jn: embedded firmware binary | 00:18 |
jn | libc statically linked in? | 00:19 |
vkoskiv | No symbols, no linkage to anything. Just memory, basically. | 00:19 |
vkoskiv | I figured I'd start learning binary reversing with something easy :] | 00:19 |
vkoskiv | jn: Maybe? Likely there is some kind of libc, but I have to find the functions still, I think | 00:19 |
jn | is it one of these things where the OS and the application are linked into one big flat executable? | 00:19 |
vkoskiv | I think it might be that. Not sure yet. | 00:20 |
vkoskiv | I've seen a few strings referring to a real-time OS called pSOS | 00:20 |
jn | i'd dive into fopen and see how it works | 00:20 |
vkoskiv | There are traps, which I assume are like syscalls | 00:20 |
jn | a hardware mechanism by which syscalls (and other things) can be delivered, yea | 00:21 |
vkoskiv | We are doing fopen("/DEV/FLOPPY/CtrlLog.txt","w"), and the pSOS docs mention it's somewhat UNIX-like | 00:22 |
vkoskiv | So I'm very interested in finding out a way to toggle a serial shell or something like that :D | 00:22 |
vkoskiv | I did see process table dump code | 00:22 |
jn | oh hell, it's mixing /dev/foo and mountpoints into ONE FEATURE | 00:22 |
vkoskiv | Basically anything cool I can find is a nice bonus, and even if I don't find anything, it's good practice for my 68k + reversing skills | 00:23 |
jn | i'm always amazed to see that linux-m68k is still actively maintained | 00:24 |
jn | your fw isn't linux, but that's all i know about m68k | 00:24 |
vkoskiv | Yeah, apparently you can run that on shockingly little hardware, like on an actual breadboard. | 00:25 |
vkoskiv | I found pSOS documentation that details some of the data structures, that may come in handy | 00:26 |
vkoskiv | I don't think this has memory protection or anything like that | 00:26 |
jn | which 68k does this run on? | 00:27 |
vkoskiv | MC68EC020 | 00:28 |
vkoskiv | So the variant with a 24-bit address bus, and some signals that weren't commonly used were removed | 00:28 |
vkoskiv | Other than that, mostly the same as the full 020, the address bus is internally 32 bits too. | 00:29 |
jn | yea, apparently the 020 doesn't have an MMU yet, and i don't see mentions of other memory protection hardware | 00:29 |
vkoskiv | There is a chance that I'm not seeing the actual OS code in this dump. The running scope does mention software rev and ROM rev separately | 00:29 |
vkoskiv | I don't think this scope has an MMU | 00:30 |
vkoskiv | I haven't used newer scopes, but this one is a joy to use. All the controls are super responsive and smooth, and even have acceleration. | 00:30 |
vkoskiv | Feels much like an analog scope, with the green phosphor display and all. | 00:30 |
jn | hooray for efficient software | 00:30 |
vkoskiv | Though obviously very digital, mine even has a 16-bit logic analyzer | 00:30 |
vkoskiv | But yeah, seeing familiar patterns slowly emerge from this mess a lot of fun | 00:34 |
vkoskiv | Slowly chipping away at it. | 00:34 |
minute | 68k unix stuff came with 68030 afaik. i have a rare amiga 3000 ux :D | 00:50 |
- Gooberpatrol66 (QUIT: Ping timeout: 260 seconds) (~Gooberpat@user/gooberpatrol66) | 01:09 | |
+ Gooberpatrol66 (~Gooberpat@user/gooberpatrol66) | 01:11 | |
+ jacobk (~quassel@97.77.183.162) | 01:18 | |
- vagrantc (QUIT: Quit: leaving) (~vagrant@2600:3c01:e000:21:7:77:0:50) | 01:21 | |
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@97.77.183.162) | 01:30 | |
- mjw (QUIT: Ping timeout: 255 seconds) (~mjw@gnu.wildebeest.org) | 02:08 | |
+ jacobk (~quassel@72.191.232.167) | 03:31 | |
- klardotsh (QUIT: Quit: zzz) (~klardotsh@c-67-170-115-80.hsd1.wa.comcast.net) | 04:16 | |
- jacobk (QUIT: Ping timeout: 240 seconds) (~quassel@72.191.232.167) | 04:22 | |
- kensanata (QUIT: Quit: Ping timeout (120 seconds)) (~alex@user/kensanata) | 04:31 | |
+ kensanata (~alex@user/kensanata) | 04:31 | |
+ jacobk (~quassel@64.189.201.150) | 07:46 | |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 08:08 | |
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore) | 08:13 | |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 08:32 | |
- f_ (QUIT: Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.) (~AUGESOUND@fases/developer/funderscore) | 09:22 | |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 09:22 | |
digitalrayne | i know nothing about Amiga, but I did just learn about Amix and the Amiga 3000 Tower | 09:26 |
Twodisbetter | Amiga is something I wish I would have gotten into when I was younger. I was exposed to x86 only really. DOS games were amatuer by comparison. | 09:39 |
- f_ (QUIT: Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.) (~AUGESOUND@fases/developer/funderscore) | 09:39 | |
Twodisbetter | at least in the early 80s and 90s. Mid 90s DOS blew everything away really. | 09:39 |
Twodisbetter | Mainly because Amiga stopped operations. | 09:39 |
Twodisbetter | That is kind of why I think the Commander x16 or Mega65 are cool projects. If people really start to develop for these system they could be a whole new way of doing computing today on retro hardware. | 09:40 |
vkoskiv | Twodisbetter: never too late. I've picked up plenty of old platforms just in the last 14 years | 10:05 |
vkoskiv | 68k Macs, 8088, 80286, 80486, SPARC, MIPS, 6502 | 10:06 |
vkoskiv | It's really fun how me studying to understand my oscilloscope will transfer over to my 68k Macs and my soon to arrive Amiga | 10:06 |
vkoskiv | Same with the 6502, that's useful for my c64 as well as the Apple I'm studying now | 10:07 |
josch | minute: turns out, even when renaming README.flashing to README.flashing.md, it still does not get rendered but instead you get "The rendered file could not be displayed because it is stored as a job artifact. You can download it instead." | 10:17 |
josch | https://source.mnt.re/reform/reform-system-image/-/jobs/4100/artifacts/file/README.flashing.md | 10:17 |
minute | josch: lol meh... | 10:28 |
josch | minute: maybe the way to go is to use the "releases" feature instead: https://source.mnt.re/reform/reform-system-image/-/releases | 10:30 |
josch | maybe this can be automated a bit using the gitlab api to make it less painful (at least i find it painful to use the web interface) | 10:31 |
- vkoskiv (QUIT: Ping timeout: 252 seconds) (~vkoskiv@87-100-167-110.bb.dnainternet.fi) | 10:51 | |
+ vkoskiv (~vkoskiv@87-100-167-110.bb.dnainternet.fi) | 10:51 | |
+ mjw (~mjw@gnu.wildebeest.org) | 11:19 | |
minute | josch: yeah, the releases are really painful in the ui | 11:37 |
minute | i wonder if there are any existing tools for this | 11:38 |
minute | but first, trying the new image | 11:38 |
minute | josch: bmaptool flashing directly from the img.gz link works | 11:44 |
minute | very cool | 11:44 |
minute | so we could also do that on the devices over the network i guess | 11:45 |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 11:56 | |
minute | currently pocket reform turns off as soon as reform2_lpc loads :D | 12:00 |
minute | [spi] rx len: 4, b5 71 00 00 00 00 00 00 | 12:00 |
minute | [spi] exec:p,01 | 12:00 |
minute | [turn_som_power_off] | 12:00 |
minute | 0x71 isn't even a p... | 12:01 |
minute | ah, i guess spi_command doesn't get cleared | 12:02 |
minute | hmm it does | 12:02 |
minute | sorry for the noise, i'm not fully awake yet | 12:02 |
- colinsane (QUIT: Ping timeout: 240 seconds) (~colinunin@97-113-159-4.tukw.qwest.net) | 12:20 | |
- mjw (QUIT: Ping timeout: 264 seconds) (~mjw@gnu.wildebeest.org) | 12:42 | |
Twodisbetter | minute: no worries, we appreciate the transparency | 12:42 |
* Guest3316 -> mjw | 12:52 | |
josch | minute: in my opinion, please chat away and put any random braindump in this channel! It's really nice to be able to figuratively peek over your shoulder. :) | 13:00 |
digitalrayne | i wonder if its still sitting in the rp2040 spi fifo or something, and something else is powering it off? like syscon or something? | 13:19 |
digitalrayne | this happened to me when i was doing the openbsd driver as it was adding the reboot command, but openbsd already supports reboot of the imx without sending a command to the lpc, so the reboot would be sitting in the fifo and would reboot again >_< | 13:20 |
digitalrayne | pretty funny in retrospect | 13:20 |
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore) | 13:22 | |
josch | minute: i may have solved the problem with painful gitlab releases. I can write a small shell script "create_new_tag_and_release.sh" or some such and put it into the reform-system-image repo. It will effectively call something like this: | 13:26 |
josch | glab release create sysimage-v3.1 --assets-links="$(cat assets.json)" --name "my dummy name" --notes-file README.flashing | 13:26 |
josch | The result of which looks like this: https://source.mnt.re/josch/reform-system-image/-/releases/sysimage-v3.1 | 13:26 |
minute | josch: ok that's pretty awesome | 13:27 |
minute | digitalrayne: haha! yeah i guess it was something like that, but the problem went away when debugging it / using a bit cleaned up and refactored firmware now :D | 13:28 |
Twodisbetter | josch: exactly! Looking over the shoulder is a great way of putting it! | 13:28 |
minute | we just tried some random usb-c pd power supplies, such as apple, which worked (on pocket) | 13:28 |
minute | josch: i'm so sorry, but i have a final hotfix for reform-tools https://source.mnt.re/reform/reform-tools/-/merge_requests/68/diffs?commit_id=fb79a4f2d4eb41665334a7d1ff8ae2230dc5329b | 13:31 |
josch | minute: even if you have three more hotfixes i don't think that's a problem :) | 13:32 |
minute | :D | 13:32 |
josch | release early release often i was told :) | 13:32 |
minute | the cool thing is that one can selectively re-run only the "custom" part of the reform-debian-packages pipeline | 13:32 |
josch | and that will also re-trigger the reprepro job at the end? | 13:33 |
minute | josch: not sure, but one can click on the "custom" job restart button and then on the reprepro button and they are queued up | 13:34 |
josch | ah yes, indeed :) | 13:34 |
josch | yeah, it's useful that gitlab keeps all those individual job artifacts around for a while so that the artifacts from the other successful jobs can be re-used | 13:35 |
minute | yeah | 13:35 |
minute | except for this little bug, the system image for pocket is ready | 13:35 |
minute | (the imx8mp one, that is) | 13:36 |
minute | system controller firmware is also ready | 13:37 |
minute | just doing a little bit of polishing on the keyboard fw | 13:37 |
josch | minute: i cherry-picked 9984df9b45274ec557573fb4675634d1d6de1d95 into main and made a new release/tag so you can now re-trigger the respective reform-debian-packages jobs | 13:37 |
minute | josch: great, thanks | 13:37 |
+ mark_ (~mjw@gnu.wildebeest.org) | 14:11 | |
- mjw (QUIT: Ping timeout: 260 seconds) (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae) | 14:14 | |
+ mjw (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae) | 14:26 | |
josch | minute: CI jobs again fail with WARNING: Uploading artifacts as "archive" to coordinator... 500 Internal Server Error id=4101 responseStatus=500 Internal Server Error status=500 token=glcbt-64 | 14:55 |
josch | this goes away when deleting job artifacts manually | 14:55 |
minute | meeh... so probably the disk is full issue again | 14:56 |
minute | buckket: can we increase the disk size on the gitlab? | 14:56 |
josch | minute: or find a way to auto-clean old branches | 15:28 |
josch | a lot of artifacts are kept because they are the latest pipeline results for a branch which has long been merged or discarded | 15:28 |
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@64.189.201.150) | 15:52 | |
minute | josch: sorry i had some delays here, running custom + reprepro again on reform-debian-packages. then that part is done | 16:12 |
josch | minute: no worries, i'm not blocked by anything :) | 16:16 |
josch | even if i were, there is enough stuff to do... | 16:18 |
josch | i've been copyright reviewing tinyusb for several days now but that thing contains over 31k lines of code... | 16:19 |
josch | the debian/copyright file is already over 2000 lines long... | 16:19 |
minute | wow | 16:26 |
kop316 | josch: I think there are ways to automate the process: https://wiki.debian.org/CopyrightReviewTools (if that can help!) | 16:27 |
josch | On the plus side, I already identified several dozen files which are not FOSS (for example the license dictates that you may only use the code with hardware from vendor X) or are even forbidden to be distributed in the first place. But it seems that those are not the parts used by MNT. | 16:27 |
josch | kop316: Without tools like licensecheck I would certainly not attempt such kind of review. But in the end, copyright information is written down in a human-readable and not a machine-parsable way so licensecheck can give me a good first approximation (and it did) but does not avoid manual labour. :) | 16:29 |
kop316 | ahh fair enough! | 16:29 |
minute | josch: could i stop this pipeline in favor of running the reprepro step of my other pipeline first? https://source.mnt.re/josch/reform-system-image/-/jobs/4106 | 16:33 |
swivel | i had to go through this recently at $dayjob where we use yocto ... it's indeed a mess especially since people have a tendency to adulterate their license files | 16:34 |
josch | minute: always feel free to stop my stuff without asking! | 16:37 |
josch | minute: i'm currently experimenting with glab to automate the automatic release creation | 16:37 |
josch | (because i have to somehow retrieve the latest pipeline and job id programmatically) | 16:37 |
minute | weird, somehow there's no cancel button | 16:42 |
minute | josch: it looks like i can't cancel that job. can you? | 16:43 |
josch | oh no! you own the CI and cannot cancel it XD | 16:44 |
josch | cancelled | 16:44 |
minute | really strange yeah | 16:44 |
minute | thank you | 16:44 |
josch | minute: i added the "minute" account as "owner" of the repo | 16:45 |
josch | minute: there is also an account called Administrator -- maybe it would've worked with that one? | 16:46 |
minute | josch: thank you! i can switch seamlessly between both | 17:01 |
minute | josch: any objections to merging this? https://source.mnt.re/reform/reform-system-image/-/merge_requests/92 | 17:03 |
+ Christoph_ (~Christoph@p54bf6cdd.dip0.t-ipconnect.de) | 17:10 | |
josch | minute: i think all of this is compatible with a later possible move to a packaged reform-setup-wizard | 17:16 |
josch | so merge away! | 17:16 |
minute | merged! | 17:50 |
+ vagrantc (~vagrant@2600:3c01:e000:21:7:77:0:50) | 17:54 | |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 18:10 | |
- f_ (QUIT: Remote host closed the connection) (~AUGESOUND@fases/developer/funderscore) | 18:21 | |
+ f_ (~AUGESOUND@fases/developer/funderscore) | 18:22 | |
minute | https://source.mnt.re/reform/reform-system-image/-/jobs/4099/artifacts/browse | 18:59 |
josch | does it work on the pocket? :) | 19:17 |
- mjw (QUIT: Killed (zirconium.libera.chat (Nickname regained by services))) (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae) | 19:25 | |
* mark_ -> mjw | 19:25 | |
+ Guest1871 (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae) | 19:25 | |
+ jacobk (~quassel@64.189.201.150) | 19:36 | |
minute | josch: almost! i need to add some missing variables to that uboot. but it's flashed from a file anyway :3 | 19:51 |
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore) | 19:52 | |
grimmware | lol looks like I’m gonna be moving house to ??? on the day my pocket | 19:53 |
grimmware | Ffs phone | 19:53 |
grimmware | On the day my pocket package is due to ship. Better get crowdsupply to send it to work then I guess :P | 19:54 |
vagrantc | hrm. one of the tabs on a button for my trackball broke off and is stuck inside ... hints on how to get it out? | 20:02 |
+ gustav28 (~gustav@c-5a37524e.019-141-67626730.bbcust.telenor.se) | 20:02 | |
josch | vagrantc: i got mine out by sticking a heated needle in it at an angle and then wait until the plastic hardened again | 20:03 |
josch | only care must be taken that the needle does not touch the surrounding plastic of the switch itself or otherwise it will melt that instead | 20:04 |
vagrantc | right ... eeyk | 20:07 |
minute | very sharp knife like scalpel can also work | 20:22 |
vagrantc | whoah, the rcore-rk3588 ... "Expected to ship in about 333334 months." | 20:32 |
vagrantc | new delays? :) | 20:32 |
jn | ten million days :O | 20:42 |
- jackhill (QUIT: Remote host closed the connection) (~jackhill@kalessin.dragonsnail.net) | 20:43 | |
+ jackhill (~jackhill@kalessin.dragonsnail.net) | 20:47 | |
+ colinsane (~colinunin@97-113-95-59.tukw.qwest.net) | 21:37 | |
- gustav28 (QUIT: Quit: Quit) (~gustav@c-5a37524e.019-141-67626730.bbcust.telenor.se) | 22:15 | |
- jacobk (QUIT: Ping timeout: 240 seconds) (~quassel@64.189.201.150) | 22:54 | |
- Christoph_ (QUIT: Remote host closed the connection) (~Christoph@p54bf6cdd.dip0.t-ipconnect.de) | 23:38 | |
+ Christoph_ (~Christoph@p54bf6cdd.dip0.t-ipconnect.de) | 23:38 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!