[U-Boot] reverse engineering a Philips photoframe
Hi all,
I'm completely new to the world of U-boot, so please forgive me if I spout nonsense. I'm looking for a bit of guidance.
I'm reverse engineering an old Philips 10FF2 Photoframe, hoping to one day customize it, just for the fun of it. I've been researching quite a bit and after downloading an updated firmware from the philips site and unpacking it, I notice it contains (among a bunch of others) 3 files of interest: 1) UBLDM350.BIN, sized at about 23k. The binwalk utility tells me it contains "ARM executable code, 32-bit, little endian, at least 984 valid instructions". I'm guessing this is uboot, not sure how I can confirm? 2) A file called Philips.cmd, containing a very simple script which among a lot of other stuff has a line that says: "//[UPDATE BOOTLOADER]" 3) A file called P350MAIN.BIN, which I have no real idea what it contains yet. It's about 2.3MB large and using a tool called mediaextract I was able to extract at least some JPEGs that contain artwork for the menu of the picture frame.
Now, I have a bunch of questions: 1) How can I confirm this is indeed uboot? How would I know if it's stock UBoot or a modified version? 2) Can I compile uboot myself and replace this one without bricking my frame? 3) As far as I understand Uboot loads the actual OS. Would it be possible the P350MAIN.BIN file is that OS?
Any input is welcome. To be clear here I'm not doing this out of commercial interest, just trying to customise this frame for fun.
kind regards,
On Thu, May 4, 2017 at 12:58 PM, Walter Heck walterheck@gmail.com wrote:
Hi all,
I'm completely new to the world of U-boot, so please forgive me if I spout nonsense. I'm looking for a bit of guidance.
I'm reverse engineering an old Philips 10FF2 Photoframe, hoping to one day customize it, just for the fun of it. I've been researching quite a bit
and
after downloading an updated firmware from the philips site and unpacking it, I notice it contains (among a bunch of others) 3 files of interest:
- UBLDM350.BIN, sized at about 23k. The binwalk utility tells me it
contains "ARM executable code, 32-bit, little endian, at least 984 valid instructions". I'm guessing this is uboot, not sure how I can confirm? 2) A file called Philips.cmd, containing a very simple script which among
a
lot of other stuff has a line that says: "//[UPDATE BOOTLOADER]" 3) A file called P350MAIN.BIN, which I have no real idea what it contains yet. It's about 2.3MB large and using a tool called mediaextract I was
able
to extract at least some JPEGs that contain artwork for the menu of the picture frame.
Now, I have a bunch of questions:
- How can I confirm this is indeed uboot? How would I know if it's stock
UBoot or a modified version?
I would run `strings` on the file. That should quickly spit out a bunch of clues about its origin. You might even be lucky enough to get version information out of it.
- Can I compile uboot myself and replace this one without bricking my
frame?
Possibly. First you would have to get a serial interface to the board. It is unlikely they left a connector on the production boards so you might need to do some soldering. You have to figure out what processor they are using then configure uboot for that. It would take a good bit of persistance. You might be really lucky and find someone who has already done this for you.
- As far as I understand Uboot loads the actual OS. Would it be possible
the P350MAIN.BIN file is that OS?
It might be an OS, or it might be a standalone binary that runs on bare metal. Again, `strings` will help you here.
Good luck with your project,
-csw
Hi,
On 5 May 2017 at 20:15, chris warth cswarth@gmail.com wrote:
On Thu, May 4, 2017 at 12:58 PM, Walter Heck walterheck@gmail.com wrote:
Now, I have a bunch of questions:
- How can I confirm this is indeed uboot? How would I know if it's stock
UBoot or a modified version?
I would run `strings` on the file. That should quickly spit out a bunch of clues about its origin. You might even be lucky enough to get version information out of it.
guess I'm not so lucky:
walterheck@walter-toshiba:~/projects/pictureframe/PHILIPS.10FF2M$ strings -n7 UBLDM350.BIN 0x p0 0p F(null) F0123456789abcdef0123456789ABCDEF ...fail(%d) NANDReadPage error(%d) Error block(%d) Magic switch failure(0x%X) Bad block found(block=%d) Move done. 7I h"hS Start boot from NAND Ver = %s ((((( DDDDDDDDDD UBLN1.05
- Can I compile uboot myself and replace this one without bricking my
frame?
Possibly. First you would have to get a serial interface to the board. It is unlikely they left a connector on the production boards so you might need to do some soldering. You have to figure out what processor they are using then configure uboot for that. It would take a good bit of persistance. You might be really lucky and find someone who has already done this for you.
I have figured out that central to the board is a TMS320DM350ZWK chip which seems to contain a fullblown ARM9 processor. This seems capable of running what is referred to by TI as DaVinci Linux. That in turn seems to be commonly supported by Uboot. My question now is how to figure out how I would go about getting to the point where the TMS chip runs Uboot.
I am also not sure how to figure out if this board is a standard off the shelf board or custom designed by philips. From a non-technical perspective I'm guessing it would be much better for them to use an off the shelf board but I can't find conclusive evidence on this.
- As far as I understand Uboot loads the actual OS. Would it be possible
the P350MAIN.BIN file is that OS?
It might be an OS, or it might be a standalone binary that runs on bare metal. Again, `strings` will help you here.
strings doesn't gives me a long list of things there. What I noticed is that for instance the artwork is simply byte for byte in the P350MAIN.BIN file, so extracting it was easy. This makes me think it might not be a filesystem, rather maybe even as simple as a bunch of files concatenated into a single bin file. Is that common?
cheers,
Dear Walter,
In message CAJojfjo4ufGzqgR_m6v84yhgeanZ68FHvoGRzscSxBmgonPWhA@mail.gmail.com you wrote:
guess I'm not so lucky:
That was to be expected. The file was way too small for a complete U-Boot - that would be in the order of 200 kB or more.
I have figured out that central to the board is a TMS320DM350ZWK chip which seems to contain a fullblown ARM9 processor. This seems capable of running what is referred to by TI as DaVinci Linux. That in turn seems to be commonly supported by Uboot. My question now is how to figure out how I would go about getting to the point where the TMS chip runs Uboot.
To port U-Boot (and Linux) to new hardware, you need detailled documentation of the hardware, ideally including schematics, minimally a detailled block diagram and the pin mux table.
strings doesn't gives me a long list of things there. What I noticed is that for instance the artwork is simply byte for byte in the P350MAIN.BIN file, so extracting it was easy. This makes me think it might not be a filesystem, rather maybe even as simple as a bunch of files concatenated into a single bin file. Is that common?
It can be anything. there is a zillion of ways to pack stuff into images... It my help to look for compression headers - strings does not help on compressed images / compressed parts within an image.
Best regards,
Wolfgang Denk
participants (4)
-
Blibbet -
chris warth -
Walter Heck -
Wolfgang Denk