[linux-dvb] Extract tool for xc3028 firmware

Devin Heitmueller devin.heitmueller at gmail.com
Mon Dec 31 16:03:38 CET 2007


Hello Mauro,

Figures.  I spent all day yesterday disassembling the embda.sys for
the hvr-900 trying to accomplish the same task.

Out of curiosity, what was your final approach for determining the
offsets for the different firmware images.  Had it been on or two
images then it would have been no big deal, but doing it for 80 images
I thought would be impractical to determine the offsets and lengths by
hand (as well as correlating it to the firmware types for which there
doesn't seem to be any way to determine the type).  The disassembly
suggests a lookup table using a switch statement based on the type, so
it wasn't like there was a single blob that could just be copied.

Did you generate the offsets in extract_xc3028.pl using a script
(knowing what the images to looked like based on the output of a usb
bus capture)?

I'm just curious about the methodology used since reverse engineering
tends to be a poorly documented black art.

Devin


On Dec 31, 2007 9:05 AM, Mauro Carvalho Chehab <mchehab at infradead.org> wrote:
>
> On Mon, 31 Dec 2007 03:34:56 -0200
> Mauro Carvalho Chehab <mchehab at infradead.org> wrote:
>
> > I've just added an extraction tool to allow retrieving xc2028/3028 firmwares
> > from HVR-12x0 windows file.
> >
> > In order to use, you need to:
> >       1) Download the windows driver with something like:
> >               wget http://www.steventoth.net/linux/xc5000/HVR-12x0-14x0-17x0_1_25_25271_WHQL.zip
> >       2) Extract the file hcw85bda.sys from the zip into the current dir:
> >               unzip -j HVR-12x0-14x0-17x0_1_25_25271_WHQL.zip Driver85/hcw85bda.sys
> >       3) run the script:
> >               ./extract_xc3028.pl
> >       4) copy the generated file:
> >               cp xc3028-v27.fw /lib/firmware
> >
> > I've also added the tool at linux/Documentation/video4linux.
> >
> > This firmware is known to work with most xc2028/xc3028 devices. Please test.
>
> Sorry for a big message like this. Only after sending, I realized that the
> extracting tool were so badly optimized.
>
> Anyway, I've optimized the script. It has now only 14Kb. It basically writes
> the header for each firmware, with the firmware type, supported standard IDs
> and its size. Then, it copies the entire firmwares from HVR driver. Something
> like this:
>         #
>         # Firmware 9, type: STD FW    MTS (0x00000004), id: PAL/BG A2/B (0000000200000007), size: 169
>         #
>
>         write_le32(4);                          # Type: MTS (0x00000004)
>         write_le64(8589934599);                 # Id: PAL/BG A2/B (0000000200000007)
>         write_le32(169);                        # Size: 169
>         write_hunk_fix_endian(865592, 169);     # Get the firmware from position 865592
>
> Since ID has 64 bits, I suspect that this perl script works fine only on 64
> bit kernels. Probably, we need to use Math::BigInt for this to work on 32 bit
> kernels.
>
> >
> > Cheers,
> > Mauro
>
>
>
>
> Cheers,
> Mauro
>
> --
> video4linux-list mailing list
> Unsubscribe mailto:video4linux-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/video4linux-list
>



-- 
Devin J. Heitmueller
http://www.devinheitmueller.com
AIM: devinheitmueller



More information about the linux-dvb mailing list