2024-04-17.log

vkoskivReverse-engineering firmware is kind of fun now, actually.00:05
vkoskivStaring at a function for a while, then realising it's a common C thing like malloc or some string function00:06
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@129.110.242.224)00:06
vkoskivI still 99% have no idea what I'm doing, and there are errors in my disassembly, but progress is happening00:06
jnah, the classic "hmm..... yup, that's strlen"00:07
vkoskivI'00:07
vkoskivI've seen strlens inlined a bunch of times, not sure how to tell ghidra about that00:07
jnoof, yeah. not sure ghidra can de-inline without a plugin in java (or some other jvm language like python ;p )00:09
vkoskivI just constantly have a feeling that I'm missing something important :D00:10
vkoskivSo it goes with learning a new thing, I guess.00:10
vkoskivSo far things are kind of making sense. Though I do have a few really long bogus functions that I need to somehow sort out00:11
- cobra (QUIT: Ping timeout: 240 seconds) (~cobra@user/Cobra)00:12
+ cobra (~cobra@user/Cobra)00:13
vkoskivhttps://vkoskiv.com/screenshots/2024-04-16T22:14:42UTC-AM065iQT.png00:15
vkoskivGee, I wonder what function FUN_00026212 might be!00:15
jnghidra sure knows about FUN!00:17
vkoskivYeah, it's found tons of FUN places in this firmware image00:18
vkoskiv(I'm trying to reverse the firmware for my oscilloscope, which is 68020-based)00:18
jnvkoskiv: huh, what kind of executable is this that has fopen but it's unnamed?00:18
vkoskivjn: embedded firmware binary00:18
jnlibc statically linked in?00:19
vkoskivNo symbols, no linkage to anything. Just memory, basically.00:19
vkoskivI figured I'd start learning binary reversing with something easy :]00:19
vkoskivjn: Maybe? Likely there is some kind of libc, but I have to find the functions still, I think00:19
jnis it one of these things where the OS and the application are linked into one big flat executable?00:19
vkoskivI think it might be that. Not sure yet.00:20
vkoskivI've seen a few strings referring to a real-time OS called pSOS00:20
jni'd dive into fopen and see how it works00:20
vkoskivThere are traps, which I assume are like syscalls00:20
jna hardware mechanism by which syscalls (and other things) can be delivered, yea00:21
vkoskivWe are doing fopen("/DEV/FLOPPY/CtrlLog.txt","w"), and the pSOS docs mention it's somewhat UNIX-like00:22
vkoskivSo I'm very interested in finding out a way to toggle a serial shell or something like that :D00:22
vkoskivI did see process table dump code00:22
jnoh hell, it's mixing /dev/foo and mountpoints into ONE FEATURE00:22
vkoskivBasically anything cool I can find is a nice bonus, and even if I don't find anything, it's good practice for my 68k + reversing skills00:23
jni'm always amazed to see that linux-m68k is still actively maintained00:24
jnyour fw isn't linux, but that's all i know about m68k00:24
vkoskivYeah, apparently you can run that on shockingly little hardware, like on an actual breadboard.00:25
vkoskivI found pSOS documentation that details some of the data structures, that may come in handy00:26
vkoskivI don't think this has memory protection or anything like that00:26
jnwhich 68k does this run on?00:27
vkoskivMC68EC02000:28
vkoskivSo the variant with a 24-bit address bus, and some signals that weren't commonly used were removed00:28
vkoskivOther than that, mostly the same as the full 020, the address bus is internally 32 bits too.00:29
jnyea, apparently the 020 doesn't have an MMU yet, and i don't see mentions of other memory protection hardware00:29
vkoskivThere is a chance that I'm not seeing the actual OS code in this dump. The running scope does mention software rev and ROM rev separately00:29
vkoskivI don't think this scope has an MMU00:30
vkoskivI haven't used newer scopes, but this one is a joy to use. All the controls are super responsive and smooth, and even have acceleration.00:30
vkoskivFeels much like an analog scope, with the green phosphor display and all.00:30
jnhooray for efficient software00:30
vkoskivThough obviously very digital, mine even has a 16-bit logic analyzer00:30
vkoskivBut yeah, seeing familiar patterns slowly emerge from this mess a lot of fun00:34
vkoskivSlowly chipping away at it.00:34
minute68k unix stuff came with 68030 afaik. i have a rare amiga 3000 ux :D00:50
- Gooberpatrol66 (QUIT: Ping timeout: 260 seconds) (~Gooberpat@user/gooberpatrol66)01:09
+ Gooberpatrol66 (~Gooberpat@user/gooberpatrol66)01:11
+ jacobk (~quassel@97.77.183.162)01:18
- vagrantc (QUIT: Quit: leaving) (~vagrant@2600:3c01:e000:21:7:77:0:50)01:21
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@97.77.183.162)01:30
- mjw (QUIT: Ping timeout: 255 seconds) (~mjw@gnu.wildebeest.org)02:08
+ jacobk (~quassel@72.191.232.167)03:31
- klardotsh (QUIT: Quit: zzz) (~klardotsh@c-67-170-115-80.hsd1.wa.comcast.net)04:16
- jacobk (QUIT: Ping timeout: 240 seconds) (~quassel@72.191.232.167)04:22
- kensanata (QUIT: Quit: Ping timeout (120 seconds)) (~alex@user/kensanata)04:31
+ kensanata (~alex@user/kensanata)04:31
+ jacobk (~quassel@64.189.201.150)07:46
+ f_ (~AUGESOUND@fases/developer/funderscore)08:08
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore)08:13
+ f_ (~AUGESOUND@fases/developer/funderscore)08:32
- f_ (QUIT: Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.) (~AUGESOUND@fases/developer/funderscore)09:22
+ f_ (~AUGESOUND@fases/developer/funderscore)09:22
digitalraynei know nothing about Amiga, but I did just learn about Amix and the Amiga 3000 Tower09:26
TwodisbetterAmiga is something I wish I would have gotten into when I was younger. I was exposed to x86 only really. DOS games were amatuer by comparison. 09:39
- f_ (QUIT: Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.) (~AUGESOUND@fases/developer/funderscore)09:39
Twodisbetterat least in the early 80s and 90s. Mid 90s DOS blew everything away really. 09:39
TwodisbetterMainly because Amiga stopped operations. 09:39
TwodisbetterThat is kind of why I think the Commander x16 or Mega65 are cool projects. If people really start to develop for these system they could be a whole new way of doing computing today on retro hardware. 09:40
vkoskivTwodisbetter: never too late. I've picked up plenty of old platforms just in the last 14 years10:05
vkoskiv68k Macs, 8088, 80286, 80486, SPARC, MIPS, 650210:06
vkoskivIt's really fun how me studying to understand my oscilloscope will transfer over to my 68k Macs and my soon to arrive Amiga10:06
vkoskivSame with the 6502, that's useful for my c64 as well as the Apple I'm studying now10:07
joschminute: turns out, even when renaming README.flashing to README.flashing.md, it still does not get rendered but instead you get "The rendered file could not be displayed because it is stored as a job artifact. You can download it instead."10:17
joschhttps://source.mnt.re/reform/reform-system-image/-/jobs/4100/artifacts/file/README.flashing.md10:17
minutejosch: lol meh... 10:28
joschminute: maybe the way to go is to use the "releases" feature instead: https://source.mnt.re/reform/reform-system-image/-/releases10:30
joschmaybe this can be automated a bit using the gitlab api to make it less painful (at least i find it painful to use the web interface)10:31
- vkoskiv (QUIT: Ping timeout: 252 seconds) (~vkoskiv@87-100-167-110.bb.dnainternet.fi)10:51
+ vkoskiv (~vkoskiv@87-100-167-110.bb.dnainternet.fi)10:51
+ mjw (~mjw@gnu.wildebeest.org)11:19
minutejosch: yeah, the releases are really painful in the ui11:37
minutei wonder if there are any existing tools for this11:38
minutebut first, trying the new image11:38
minutejosch: bmaptool flashing directly from the img.gz link works11:44
minutevery cool11:44
minuteso we could also do that on the devices over the network i guess11:45
+ f_ (~AUGESOUND@fases/developer/funderscore)11:56
minutecurrently pocket reform turns off as soon as reform2_lpc loads :D12:00
minute[spi] rx len: 4, b5 71 00 00 00 00 00 0012:00
minute[spi] exec:p,0112:00
minute[turn_som_power_off]12:00
minute0x71 isn't even a p...12:01
minuteah, i guess spi_command doesn't get cleared12:02
minutehmm it does12:02
minutesorry for the noise, i'm not fully awake yet12:02
- colinsane (QUIT: Ping timeout: 240 seconds) (~colinunin@97-113-159-4.tukw.qwest.net)12:20
- mjw (QUIT: Ping timeout: 264 seconds) (~mjw@gnu.wildebeest.org)12:42
Twodisbetterminute: no worries, we appreciate the transparency12:42
* Guest3316 -> mjw12:52
joschminute: in my opinion, please chat away and put any random braindump in this channel! It's really nice to be able to figuratively peek over your shoulder. :)13:00
digitalraynei wonder if its still sitting in the rp2040 spi fifo or something, and something else is powering it off? like syscon or something?13:19
digitalraynethis happened to me when i was doing the openbsd driver as it was adding the reboot command, but openbsd already supports reboot of the imx without sending a command to the lpc, so the reboot would be sitting in the fifo and would reboot again >_<13:20
digitalraynepretty funny in retrospect13:20
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore)13:22
joschminute: i may have solved the problem with painful gitlab releases. I can write a small shell script "create_new_tag_and_release.sh" or some such and put it into the reform-system-image repo. It will effectively call something like this:13:26
joschglab release create sysimage-v3.1 --assets-links="$(cat assets.json)" --name "my dummy name" --notes-file README.flashing13:26
joschThe result of which looks like this: https://source.mnt.re/josch/reform-system-image/-/releases/sysimage-v3.113:26
minutejosch: ok that's pretty awesome13:27
minutedigitalrayne: haha! yeah i guess it was something like that, but the problem went away when debugging it / using a bit cleaned up and refactored firmware now :D13:28
Twodisbetterjosch: exactly! Looking over the shoulder is a great way of putting it! 13:28
minutewe just tried some random usb-c pd power supplies, such as apple, which worked (on pocket)13:28
minutejosch: i'm so sorry, but i have a final hotfix for reform-tools https://source.mnt.re/reform/reform-tools/-/merge_requests/68/diffs?commit_id=fb79a4f2d4eb41665334a7d1ff8ae2230dc5329b13:31
joschminute: even if you have three more hotfixes i don't think that's a problem :)13:32
minute:D13:32
joschrelease early release often i was told :)13:32
minutethe cool thing is that one can selectively re-run only the "custom" part of the reform-debian-packages pipeline13:32
joschand that will also re-trigger the reprepro job at the end?13:33
minutejosch: not sure, but one can click on the "custom" job restart button and then on the reprepro button and they are queued up13:34
joschah yes, indeed :)13:34
joschyeah, it's useful that gitlab keeps all those individual job artifacts around for a while so that the artifacts from the other successful jobs can be re-used13:35
minuteyeah13:35
minuteexcept for this little bug, the system image for pocket is ready 13:35
minute(the imx8mp one, that is)13:36
minutesystem controller firmware is also ready13:37
minutejust doing a little bit of polishing on the keyboard fw13:37
joschminute: i cherry-picked 9984df9b45274ec557573fb4675634d1d6de1d95 into main and made a new release/tag so you can now re-trigger the respective reform-debian-packages jobs13:37
minutejosch: great, thanks13:37
+ mark_ (~mjw@gnu.wildebeest.org)14:11
- mjw (QUIT: Ping timeout: 260 seconds) (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae)14:14
+ mjw (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae)14:26
joschminute: CI jobs again fail with WARNING: Uploading artifacts as "archive" to coordinator... 500 Internal Server Error  id=4101 responseStatus=500 Internal Server Error status=500 token=glcbt-6414:55
joschthis goes away when deleting job artifacts manually14:55
minutemeeh... so probably the disk is full issue again14:56
minutebuckket: can we increase the disk size on the gitlab?14:56
joschminute: or find a way to auto-clean old branches15:28
joscha lot of artifacts are kept because they are the latest pipeline results for a branch which has long been merged or discarded15:28
- jacobk (QUIT: Ping timeout: 260 seconds) (~quassel@64.189.201.150)15:52
minutejosch: sorry i had some delays here, running custom + reprepro again on reform-debian-packages. then that part is done16:12
joschminute: no worries, i'm not blocked by anything :)16:16
joscheven if i were, there is enough stuff to do... 16:18
joschi've been copyright reviewing tinyusb for several days now but that thing contains over 31k lines of code...16:19
joschthe debian/copyright file is already over 2000 lines long...16:19
minutewow16:26
kop316josch: I think there are ways to automate the process: https://wiki.debian.org/CopyrightReviewTools (if that can help!)16:27
joschOn the plus side, I already identified several dozen files which are not FOSS (for example the license dictates that you may only use the code with hardware from vendor X) or are even forbidden to be distributed in the first place. But it seems that those are not the parts used by MNT.16:27
joschkop316: Without tools like licensecheck I would certainly not attempt such kind of review. But in the end, copyright information is written down in a human-readable and not a machine-parsable way so licensecheck can give me a good first approximation (and it did) but does not avoid manual labour. :)16:29
kop316ahh fair enough!16:29
minutejosch: could i stop this pipeline in favor of running the reprepro step of my other pipeline first? https://source.mnt.re/josch/reform-system-image/-/jobs/410616:33
swiveli had to go through this recently at $dayjob where we use yocto ... it's indeed a mess especially since people have a tendency to adulterate their license files16:34
joschminute: always feel free to stop my stuff without asking!16:37
joschminute: i'm currently experimenting with glab to automate the automatic release creation16:37
josch(because i have to somehow retrieve the latest pipeline and job id programmatically)16:37
minuteweird, somehow there's no cancel button16:42
minutejosch: it looks like i can't cancel that job. can you?16:43
joschoh no! you own the CI and cannot cancel it XD16:44
joschcancelled16:44
minutereally strange yeah16:44
minutethank you16:44
joschminute: i added the "minute" account as "owner" of the repo16:45
joschminute: there is also an account called Administrator -- maybe it would've worked with that one?16:46
minutejosch: thank you! i can switch seamlessly between both17:01
minutejosch: any objections to merging this? https://source.mnt.re/reform/reform-system-image/-/merge_requests/9217:03
+ Christoph_ (~Christoph@p54bf6cdd.dip0.t-ipconnect.de)17:10
joschminute: i think all of this is compatible with a later possible move to a packaged reform-setup-wizard17:16
joschso merge away!17:16
minutemerged!17:50
+ vagrantc (~vagrant@2600:3c01:e000:21:7:77:0:50)17:54
+ f_ (~AUGESOUND@fases/developer/funderscore)18:10
- f_ (QUIT: Remote host closed the connection) (~AUGESOUND@fases/developer/funderscore)18:21
+ f_ (~AUGESOUND@fases/developer/funderscore)18:22
minutehttps://source.mnt.re/reform/reform-system-image/-/jobs/4099/artifacts/browse18:59
joschdoes it work on the pocket? :)19:17
- mjw (QUIT: Killed (zirconium.libera.chat (Nickname regained by services))) (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae)19:25
* mark_ -> mjw19:25
+ Guest1871 (~mjw@2001:1c06:2488:1400:4fd:39a7:74ac:7bae)19:25
+ jacobk (~quassel@64.189.201.150)19:36
minutejosch: almost! i need to add some missing variables to that uboot. but it's flashed from a file anyway :3 19:51
- f_ (QUIT: Ping timeout: 260 seconds) (~AUGESOUND@fases/developer/funderscore)19:52
grimmwarelol looks like I’m gonna be moving house to ??? on the day my pocket19:53
grimmwareFfs phone19:53
grimmwareOn the day my pocket package is due to ship. Better get crowdsupply to send it to work then I guess :P19:54
vagrantchrm. one of the tabs on a button for my trackball broke off and is stuck inside ... hints on how to get it out?20:02
+ gustav28 (~gustav@c-5a37524e.019-141-67626730.bbcust.telenor.se)20:02
joschvagrantc: i got mine out by sticking a heated needle in it at an angle and then wait until the plastic hardened again20:03
joschonly care must be taken that the needle does not touch the surrounding plastic of the switch itself or otherwise it will melt that instead20:04
vagrantcright ... eeyk20:07
minutevery sharp knife like scalpel can also work20:22
vagrantcwhoah, the rcore-rk3588 ... "Expected to ship in about 333334 months."20:32
vagrantcnew delays? :)20:32
jnten million days :O20:42
- jackhill (QUIT: Remote host closed the connection) (~jackhill@kalessin.dragonsnail.net)20:43
+ jackhill (~jackhill@kalessin.dragonsnail.net)20:47
+ colinsane (~colinunin@97-113-95-59.tukw.qwest.net)21:37
- gustav28 (QUIT: Quit: Quit) (~gustav@c-5a37524e.019-141-67626730.bbcust.telenor.se)22:15
- jacobk (QUIT: Ping timeout: 240 seconds) (~quassel@64.189.201.150)22:54
- Christoph_ (QUIT: Remote host closed the connection) (~Christoph@p54bf6cdd.dip0.t-ipconnect.de)23:38
+ Christoph_ (~Christoph@p54bf6cdd.dip0.t-ipconnect.de)23:38

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!