[U-Boot] reverse engineering a Philips photoframe

[Walter Heck]

Hi,

On 5 May 2017 at 20:15, chris warth <cswarth at gmail.com> wrote:

> On Thu, May 4, 2017 at 12:58 PM, Walter Heck <walterheck at gmail.com> wrote:
> > Now, I have a bunch of questions:
> > 1) How can I confirm this is indeed uboot? How would I know if it's stock
> > UBoot or a modified version?
>
> I would run `strings` on the file. That should quickly spit out a
> bunch of clues about its origin.  You might even be lucky enough to
> get version information out of it.
>
guess I'm not so lucky:

walterheck at walter-toshiba:~/projects/pictureframe/PHILIPS.10FF2M$ strings
-n7 UBLDM350.BIN
0x p0 0p
F(null)
F0123456789abcdef0123456789ABCDEF
...fail(%d)
NANDReadPage error(%d)
Error block(%d)
Magic switch failure(0x%X)
Bad block found(block=%d)
Move done.
7I h"hS
Start boot from NAND
Ver = %s
         (((((
DDDDDDDDDD
UBLN1.05


> > 2) Can I compile uboot myself and replace this one without bricking my
> > frame?
>
> Possibly.  First you would have to get a serial interface to the
> board.  It is unlikely they left a connector on the production boards
> so you might need to do some soldering.  You have to figure out what
> processor they are using then configure uboot for that.  It would take
> a good bit of persistance.  You might be really lucky and find someone
> who has already done this for you.
>

I have figured out that central to the board is a TMS320DM350ZWK chip which
seems to contain a fullblown ARM9 processor. This seems capable of running
what is referred to by TI as DaVinci Linux. That in turn seems to be
commonly supported by Uboot. My question now is how to figure out how I
would go about getting to the point where the TMS chip runs Uboot.

I am also not sure how to figure out if this board is a standard off the
shelf board or custom designed by philips. From a non-technical perspective
I'm guessing it would be much better for them to use an off the shelf board
but I can't find conclusive evidence on this.

> 3) As far as I understand Uboot loads the actual OS. Would it be possible
> > the P350MAIN.BIN file is that OS?
> >
>
> It might be an OS, or it might be a standalone binary that runs on
> bare metal.  Again, `strings` will help you here.
>
strings doesn't gives me a long list of things there. What I noticed is
that for instance the artwork is simply byte for byte in the P350MAIN.BIN
file, so extracting it was easy. This makes me think it might not be a
filesystem, rather maybe even as simple as a bunch of files concatenated
into a single bin file. Is that common?

cheers,

-- 
Walter Heck

--
Check out my startup: Puppet training and consulting @
http://www.olindata.com
Follow @olindata on Twitter and/or 'Like' our Facebook page at
http://www.facebook.com/olindata