Emulating a main board CPU.

Collapse
X
Collapse
+ More Options
Posts
 
  • Time
  • Show
Clear All
new posts
  • tom66
    EVs Rule
    • Apr 2011
    • 32560
    • UK

    #21
    Re: Emulating a main board CPU.

    Be aware that these decompressors can be fooled if the file "looks" like something else.
    Sometimes the firmware is encrypted or compressed in a proprietary manner.
    Please do not PM me with questions! Questions via PM will not be answered. Post on the forums instead!
    For service manual, schematic, boardview (board view), datasheet, cad - use our search.

    Comment

    • lookimback
      Badcaps Legend
      • Aug 2013
      • 1489
      • USA

      #22
      Re: Emulating a main board CPU.

      That's what I was thinking. It says its a PARity archive file, but I searched for the below signatures in a hex editor but they aren't there.

      A Par1 file starts with the following byte sequence:

      50 41 52 00 00 00 00 00

      This corresponds to the ASCII text string PAR, followed by 5 null bytes.

      A Par2 file starts with the bytes:

      50 41 52 32 00 50 4B 54

      This corresponds to ASCII text string PAR2, followed by a null byte and the text string PKT.

      Finally, a Par3 file can be identified by the following 4-byte sequence:

      50 41 33 00
      ------------signature starts here------------


      Comment

      • lookimback
        Badcaps Legend
        • Aug 2013
        • 1489
        • USA

        #23
        Re: Emulating a main board CPU.

        binwalk -I shows me that there's a whole lot that it isn't able to identify. This is't going to be as easy as I first thought.
        ------------signature starts here------------


        Comment

        • lookimback
          Badcaps Legend
          • Aug 2013
          • 1489
          • USA

          #24
          Re: Emulating a main board CPU.

          I'm not getting anywhere with this. Some of it probably comes down to not knowing all the available firmware analysis tools, and/or how to use them. Not going to give up though. Since we know the UART pinout from the image I posted previously, I'm going to try connecting to it to see what useful information I can get.

          As a side note, based on this post, and the results from a binwalk entropy scan, the Chi square distribution, and Monte Carlo pi approximation both of which were obtained by using ENT, I'm pretty sure the firmware image is compressed and not encrypted.
          Last edited by lookimback; 09-23-2018, 04:40 PM.
          ------------signature starts here------------


          Comment

          • lookimback
            Badcaps Legend
            • Aug 2013
            • 1489
            • USA

            #25
            Re: Emulating a main board CPU.

            I tried accessing the SoC over UART. Interestingly, the baudrate is 115200 when on, and 38400 when powered off. Doesn't respond to anything.

            When the board powers on, I get this.
            Eden: BD_CVT_P85A
            SPI BOOT
            Console Initial OK

            65
            [23456789A][123456789A]
            0065

            BIST_0 PASS.

            MIU Initial OK
            SBOOT:AC ON
            then some gibberish.

            With power off, I get this.

            Hello Eden standby mode

            Console Initial OK (PM)

            g_u8PowerKeyADCLevel:0x32
            Enter EDEN PM Standby

            [EDEN PM]

            [EDEN PM]
            ------------signature starts here------------


            Comment

            • tom66
              EVs Rule
              • Apr 2011
              • 32560
              • UK

              #26
              Re: Emulating a main board CPU.

              It's either locked or there's some alternate way to enter, like a key sequence.
              Disassembling the firmware may be the only way to tell for sure.
              Please do not PM me with questions! Questions via PM will not be answered. Post on the forums instead!
              For service manual, schematic, boardview (board view), datasheet, cad - use our search.

              Comment

              • lookimback
                Badcaps Legend
                • Aug 2013
                • 1489
                • USA

                #27
                Re: Emulating a main board CPU.

                I did extract and decompress the LZMA part. Pretty sure the file system is in there. How does the SoC know how to extract it? Could there be an OS programmed into it that's separate from the firmware image on the eeprom?
                ------------signature starts here------------


                Comment

                • Th3_uN1Qu3
                  Believe in
                  • Jul 2010
                  • 6031
                  • Romania

                  #28
                  Re: Emulating a main board CPU.

                  Originally posted by lookimback
                  I finally got Ubuntu installed. I wanted to install it alongside of Windows on my desktop, but the HD is 9 years old. I ran CrystalDiskInfo and it said its healthy, but with over 17000 hours, I think it could fail at any time.
                  At work we retired a 1TB Western Digital HDD in the data recovery machine that had over 41.000 hours. Still zero bad sectors but it was used to store backups so we decided to take it offline.

                  I think I saved a screenshot of the SMART parameters of that drive, will put it up sometime. Sorry for thread hijack btw.
                  Originally posted by PeteS in CA
                  Remember that by the time consequences of a short-sighted decision are experienced, the idiot who made the bad decision may have already been promoted or moved on to a better job at another company.
                  A working TV? How boring!

                  Comment

                  • lookimback
                    Badcaps Legend
                    • Aug 2013
                    • 1489
                    • USA

                    #29
                    Re: Emulating a main board CPU.

                    Originally posted by Th3_uN1Qu3
                    At work we retired a 1TB Western Digital HDD in the data recovery machine that had over 41.000 hours. Still zero bad sectors but it was used to store backups so we decided to take it offline.

                    I think I saved a screenshot of the SMART parameters of that drive, will put it up sometime. Sorry for thread hijack btw.
                    My tower, which I use as a network server, has 34000 hours. It's working fine, but I'm going to replace it soon with an enterprise HD. The data on it is crucial to my business and if it went down, I'd be screwed.

                    BTW, I already hijacked my own thread. This went from emulating a CPU to hacking firmware.
                    Last edited by lookimback; 09-24-2018, 12:19 PM.
                    ------------signature starts here------------


                    Comment

                    • lookimback
                      Badcaps Legend
                      • Aug 2013
                      • 1489
                      • USA

                      #30
                      Re: Emulating a main board CPU.

                      Found something interesting with the strings command. This line 'cpu/risc32/eden/interrupt.c' I guess would indicate that it's a risc32 architecture.
                      ------------signature starts here------------


                      Comment

                      • lookimback
                        Badcaps Legend
                        • Aug 2013
                        • 1489
                        • USA

                        #31
                        Re: Emulating a main board CPU.

                        Could this mean something? FW address must be 128 byte alignment
                        and this JPD Firmware load code address must be 2048 byte alignment!
                        Last edited by lookimback; 09-24-2018, 12:33 PM.
                        ------------signature starts here------------


                        Comment

                        • tom66
                          EVs Rule
                          • Apr 2011
                          • 32560
                          • UK

                          #32
                          Re: Emulating a main board CPU.

                          Not really it's just page alignment for the flash chip.
                          Please do not PM me with questions! Questions via PM will not be answered. Post on the forums instead!
                          For service manual, schematic, boardview (board view), datasheet, cad - use our search.

                          Comment

                          • lookimback
                            Badcaps Legend
                            • Aug 2013
                            • 1489
                            • USA

                            #33
                            Re: Emulating a main board CPU.

                            RISC32 would make it ARM right?
                            ------------signature starts here------------


                            Comment

                            • tom66
                              EVs Rule
                              • Apr 2011
                              • 32560
                              • UK

                              #34
                              Re: Emulating a main board CPU.

                              Originally posted by lookimback
                              RISC32 would make it ARM right?
                              No, otherwise it would be called ARM.

                              RISC32 is probably related to Risc-V which is a rather unusual architecture. I would expect MIPS or ARM to be honest so not sure what to make of this.
                              Please do not PM me with questions! Questions via PM will not be answered. Post on the forums instead!
                              For service manual, schematic, boardview (board view), datasheet, cad - use our search.

                              Comment

                              • lookimback
                                Badcaps Legend
                                • Aug 2013
                                • 1489
                                • USA

                                #35
                                Re: Emulating a main board CPU.

                                Originally posted by tom66
                                No, otherwise it would be called ARM.
                                I guess that makes sense. Lol
                                ------------signature starts here------------


                                Comment

                                • lookimback
                                  Badcaps Legend
                                  • Aug 2013
                                  • 1489
                                  • USA

                                  #36
                                  Re: Emulating a main board CPU.

                                  I decided to ask for help at StackExchange. They're going to take a look at it. I'm sure it just comes down to experience and knowledge of the available tools. I'm anxious to find if there's a way to do a factory reset via UART and if that would fix the problem.
                                  ------------signature starts here------------


                                  Comment

                                  • lookimback
                                    Badcaps Legend
                                    • Aug 2013
                                    • 1489
                                    • USA

                                    #37
                                    Re: Emulating a main board CPU.

                                    At this point, I'm thinking the binary must be obfuscated. Somehow, I need to find the bootloader and figure out how it handles the de-obfuscation.
                                    ------------signature starts here------------


                                    Comment

                                    • tom66
                                      EVs Rule
                                      • Apr 2011
                                      • 32560
                                      • UK

                                      #38
                                      Re: Emulating a main board CPU.

                                      Originally posted by lookimback
                                      At this point, I'm thinking the binary must be obfuscated. Somehow, I need to find the bootloader and figure out how it handles the de-obfuscation.
                                      It is possible but unlikely. If you find cleartext in it, it is probably not obfuscated or encrypted.

                                      But it takes years of experience to even know where to start with this.
                                      Please do not PM me with questions! Questions via PM will not be answered. Post on the forums instead!
                                      For service manual, schematic, boardview (board view), datasheet, cad - use our search.

                                      Comment

                                      • lookimback
                                        Badcaps Legend
                                        • Aug 2013
                                        • 1489
                                        • USA

                                        #39
                                        Re: Emulating a main board CPU.

                                        I think I just figured something out. Run strings on this image. I started doing math, trying to figure out areas in the binary I could exclude, thinking I could narrow it down some. It didn't add up right. All that copyright stuff comes after the jpg, but adding the size of the jpg and the offset equals the size of the binary. I don't know if they've embed code into the jpg, or if the extraction just doesn't stop at the end of the image. I tried binwalk --exclude 'jpeg' file.bin, but that just skips over it. I'm going to try changing the signature so it won't recognize it and see if it then finds something else.
                                        Attached Files
                                        ------------signature starts here------------


                                        Comment

                                        • lookimback
                                          Badcaps Legend
                                          • Aug 2013
                                          • 1489
                                          • USA

                                          #40
                                          Re: Emulating a main board CPU.

                                          Well, I wasn't exactly right. It's not embedded. I just didn't specify a limit when I extracted it. The image file is actually only 41kb. That means I have another 1.9mb to look through.
                                          ------------signature starts here------------


                                          Comment

                                          Related Topics

                                          Collapse

                                          • Dani_2024
                                            Sceptre U550CV-UMR 4K LED, Bad Caps on Main Power Board?
                                            by Dani_2024
                                            Hi and thanks in advance for any input you might provide!
                                            I have a Sceptre U550CV-UMRD8POTV83BB 4K LED (this is a dumb tv) that I bought new in August 2021, so It's just completed 3 years.
                                            Main power board model: TP.MS3683.PC821 T-Con board: N4TP546UHDPU2L_BO

                                            Last Sunday I was watching a dvd and fell asleep for about half hour, when I awoke the tv screen was black and couldn't get the dvd menu to show, so I changed the input to antenna and had sound but no picture, turned it off. I then got online and found this great site! ....read many troubleshooting tips and this...
                                            10-28-2024, 05:06 PM
                                          • jb_Bak
                                            Sony xbr-65x900c main board issues?
                                            by jb_Bak
                                            Hey guys great forum glad to have found it. I bought a Sony XBR 65X900C cheaply because it didn't work. No signs of life at all not even a light/led. All I hear is a brief high voltage sound when I throw the power to it.

                                            Didn't see any obvious signs of damage so right away started checking voltages. This is what I see:
                                            Power Board Connector that goes to Main board
                                            CN6401
                                            Pin 01 NC
                                            Pin 02 NC
                                            Pin 03 "BL_ON": 0V
                                            Pin 04 "N/C"
                                            Pin 05 "STBY 3.3V": 3.5V
                                            Pin 06 "GND": N/C
                                            Pin 07 "AC_OFF"...
                                            09-27-2021, 04:52 PM
                                          • JDC
                                            (SOLVED) - ONN 100012588 No Power, Then Rebooting After Main Board Change
                                            by JDC
                                            ONN 100012588
                                            Issue: No Power, Then Rebooting After Main Board Change

                                            Short answer: replace main board and power board
                                            Technical answer: replace main board and Q306 & Q307 on power board.

                                            Long answer:

                                            TV wouldn't turn on. Power switch was fine which means the main board isn't processing the power on signal. Replaced main board. TV turns on now but randomly reboots. Bad main board? EEPROM? Tried to pull main board and got a shock touching the corner of the board. That's weird. C334 (450V 10uf) capacitor is still holding a high charge....
                                            07-15-2022, 07:39 AM
                                          • m1ch43lzm
                                            HP Pavilion 15-eh Board DAG7HAMB8F0 - CPU throttling to 0.4GHz (PROCHOT_EXT) and black screen
                                            by m1ch43lzm
                                            Hi, this is my personal laptop, which the original board (lets call it Board A) blew up PU8700 (TPS51486), making a hole on the board, i had left the laptop at my desk one day with the battery fully charged and didn't touch it for a week, but when i tried to turn it on it didn't
                                            Thought the battery was dead, so i plugged in the charger then tried to power on, the power LED blinked once, charged LED still orange, unplugged the charger, plugged in again and I noticed the "magic smoke" smell, so i unplugged the charger, removed the back cover and saw the blown IC (the "magic...
                                            05-12-2025, 08:37 PM
                                          • advant
                                            Driving a Sharp TCON/panel with a universal main board
                                            by advant
                                            This thread is about trying to get an Universal Main Board to work with a Sharp TCON and panel.

                                            I have a Sharp LC-46D85UN TV that has had a main board issue. Since this model is from 2009, I am not able to find an exact replacement of the main board. Instead, I decided to see if I can future proof this tv by getting a Universal Main Board (T53U21.2) from China to work with the Sharp TCON (CPWBX4291TPZA) and panel. The universal main board supports a 8 bit dual channel LVDS interface whereas the TCON requires a 10 bit dual channel LVDS input. I have modded the LVDS connector to match...
                                            02-03-2020, 12:25 AM
                                          • Loading...
                                          • No more items.
                                          Working...