Back...
And Ill get to the point
<5>cmdlinepart partition parsing not available
<5>Size block 0: 16384
<5>Searching BFFS parititon table
BFFS appears to a MTD CLONE that is almost exactly the same to MTD except I JUST CANT CREATE A "BFFS PARTITION TABLE"
I know that likely its almost exactly the same as when you apply mtdparts="" in the kernel command lines as reference to THIS string(It may not be however)
IVE TRIED and TRIED to create a flash device with 5 flash partitions with dummy squash partitions and then ONE with the real squashfs. However WITHOUT that "BFFS partition table"
Look Im decent at this... But honestly.. Ive hit a hard road, Without knowing HOW this works how to make a BFFS partition and with my limited reverse engineering information means that im stuck between a rock and a hard place. Im not giving up but I fear the road ahead is going to be a fucking nightmare.
Now here is the worst part. I HAVE THE NAND TO THE TV, but without knowing the STARTING bytes of the "bffs parition header" I do not know WHERE the hell to look, And no searching through all 68 megabytes manually is not a viable option, If I had better reverse engineering skills I could probally KNOW where the thing starts... But sadly I do not know... and because of that even though I have the answer RIGHT in front of me(Entire Nand dump) laughing at me.
In the meantime lets go over some intresting things. First off the NAND dump seems to have the full dump to the BOOTLOADER. and oh boy this bootloader is VERY intresting.
This bootloader appears to have its own version of BATCH that it loads. Where it loads in ".Bat" files and mounts a filesystem.
These bat files that the bootloader uses are very similar to get this. Microsoft BASIC.
Code:
TODO :
# * in case of fast cold and hot reboot, do we need to verify the txt sections?
# * in case the run is failling, sby up gets 2 or more signals
# * is factory download (5:) required?
# * If in SR2 case an error occurs, we just generate a signal 101 ... what to do ? (a timeout will occur and set will reboot)
# * IF in SR2 signal fails : a timeout will occur and set will reboot
# Example batchfile
# maximum size of the batch file is ~16k characters
# ========================================
# >> Signal values: <<
# ========================================
# 30: BatchEnd
# 31: FastCold
# 32: Hotboot
# 40: BatchBegin (Not supported by standby processor)
# 100: Unknown scratch reg value
# 101: Fatal error
# ========================================
# >> Batch file entries/scratch values: <<
# ========================================
# NB NAME CALLER
# --------------------------------------------------
# 0 Considered as boot error NA
# 1 Cold boot SBY
# 2 Goto Standby VPR
# 3 Warm boot (get out of standby) SBY
# 4 SW upgrade application boot2 SBY
# 5 Factory default SW upgrade app VPRBTCH ?
# 6 SW upgrade application boot1 VPRBTCH
# 7 Ethernet SBY
# 8 Goto SemiPowerOff VPR
# 10 Hotboot VPR
# 11 Start Fastcold procedure VPR
# 12 FastCold boot SBY
# 13 GotoSelfRefresh VPR
# 40 Viper Infra Initialized NONE(VPR)
# 60 Errorhandler for coldboot = retry VPRBTCH
# 61 Errorhandler for warmboot = retry VPRBTCH
# 70 Fatal error handler VPRBTCH
# 80 Signal fails VPRBTCH
# Default
# ========================================
# >> Files needed for correct operation:<<
# ========================================
# /bffs1/UsbDownload_dat.tdf
# /bffs1/UsbDownload_txt.tdf
#
# /bffs2/UsbDownload_dat.tdf
# /bffs2/UsbDownload_txt.tdf
#
# /bffs2/atvTm0App.tdf
# /bffs2/atvTm1App.tdf
# /bffs2/mips_txt.tdf
# /bffs2/mips_dat.tdf
#
# UNKNOWN : /bffs1/FacSwDlApp.txt (don't bother for now)
# /bffs2/EthertnetLoader.tdf
# BatchCommands
# commands are not case sensitive
# commands are seperated by a space
# definition of space characters are: space, carriage return, line feed, tab
#Batch entry point labels
# labels are mandatory followed by a ":"
# max number of labels is 255
# Bootloader converts label text to a decimal number
# Bootloader searches for the label which matches scratch 1 value set by a boot script.
#BatchCommand echo
# echo's a string to uart
# e.g: echo My string to show comes here\n
# echo prints on jaguar to UART2 @ 9600,8,n,1
# just hook up a hyperterm for debugging scripts or see batch progress
#BatchCommand OnErrGoto <label>
# redirect control to the specified label if a error occurs
# The last OnErrGoto is remembered side effect is that after a goto this still the last ref is used.
# Good practise is to start each label with an OnErrGoto even if that is a repetition of the OnErrGoto
#BatchCommand Goto <label>
# redirect control to the specified label
#BatchCommand TdfLoad <filepath>
# loads file "filepath" into sdram
#BatchCommand TdfVerify <filepath>
# verifies if "filepath" in sdram still matches flash file
#BatchCommand TdfRun <filepath>
# starts execution of file "filepath".
# start addresses and sequences are found in tdf header
#BatchCommand Signal <base10_number>
# Produces a IMultiNotify on the standby product with the default isvin RPC header.
# IMultiNotify:OnChange(int base10_number)
#BatchCommand DdrSelfRefresh
# puts DDR in self refresh and stops MIPS.
#BatchCommand Exit
# stops batch execution
#BatchCommand Default
# label jumped to if unknown label is referenced
#--------------------------------------------------------------------
# sample boot batch file
# numeric labels in this file are TBD
#--------------------------------------------------------------------
# catch unnitialized parameters - false boot...
0: Goto default # 0 entry is considered a boot error
# REGULAR STUFF
# =============
1: # >>>> Cold Boot <<<<
# Signal 40
echo SR1->Coldboot
OnErrGoto 60 # what to do in case of error - retry once more ?
TdfLoad /bffs2/tmAuthapp
AuthStart
TdfrunTm 0x05000000
Xio_Freq 54 # Set XIO_CLK to 54MHz
# TdfLoad /bffs2/cdDownloadTM0.tdf # load files
# TdfrunTm 0x04200000 # what to do in case of error - retry once more ?
TdfLoad /bffs2/atvTm0App.tdf # load files
TdfLoad /bffs2/AppKernel.tdf
AuthStop
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Xio_Freq 33 # Set XIO_CLK to 33MHz
Signal 30 # signal cold load finished
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet
TdfRun /bffs2/AppKernel.tdf # batch end - cold start
2: # >>>> Goto Standby <<<<
# Signal 40
echo SR2->GotoStby
OnErrGoto 70 # what to do in case of error
Signal 101 # signal reload finished
DdrSelfRefresh # batch end - MIPS stopped
3: # >>>> Warm boot <<<< (get out of standby)
# Signal 40
echo SR3->Warmboot
OnErrGoto 61 # what to do in case of error - try cold
TdfVerify /bffs2/cdDownloadTM0.tdf # verify files
TdfVerify /bffs2/atvTm0App.tdf # verify files
TdfVerify /bffs2/AppKernel.tdf
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # signal warm boot end
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet
TdfRun /bffs2/AppKernel.tdf # batch end - warm start
4: # >>>> boot2 USB SW Upgrade app (USB download) <<<<
# Signal 40
echo SR4->USB SW DL boot2
OnErrGoto 6 # try loading the EMERGENCY download application in boot 0
TdfLoad /bffs1/Kernel.tdf # load files
TdfLoad /bffs1/RFSBoot1.tdf # load files
MemFill 0x87fff000 0x1000 0xff # clear the bis
Signal 30 # signal ....
cmdline ;console=ttyS0,38400n8;mem=60M;tm0size=12M;kgdb=ttyS1;init=/init;ramdisk=5120;ip=none;root=/dev/ram;lpj=1196032;rd_start=0x80350000 rd_size=6815744
TdfRun /bffs1/Kernel.tdf # batch end - run app
5: # >>>> Factory default sw upgrade app <<<<
# Signal 40
echo SR5->Fact SW download [DOESNT EXIST!!]
OnErrGoto 70 # no more options left
TdfLoad /bffs1/FacSwDlApp.txt # load file
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # signal ....
TdfRun /bffs1/FacSwDlApp.txt # batch end - run app
6: # >>>> boot1 USB SW Upgrade <<<<
# Signal 40
echo boot1: SR6->USB SW DL boot1
OnErrGoto 70 # No way out!
TdfLoad /bffs1/Kernel.tdf # load files
TdfLoad /bffs1/RFSBoot1.tdf # load files
Signal 30 # signal ....
cmdline ;console=ttyS0,38400n8;mem=60M;tm0size=12M;kgdb=ttyS1;init=/init;ramdisk=5120;ip=none;root=/dev/ram;lpj=1196032;rd_start=0x80350000 rd_size=6815744;sbywatchdogboost=200
TdfRun /bffs1/Kernel.tdf # batch end - run app
7: # >>>> Ethernet <<<<
# Signal 40
echo SR6->Ethernet
OnErrGoto 70 # No way out!
TdfLoad /bffs2/EthertnetLoader.tdf # load files
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # signal ....
TdfRun /bffs2/EthertnetLoader.tdf # batch end - run app
8: # >>>> Goto Semipoweroff <<<<
# Signal 40
echo SR8->GotoStby
OnErrGoto 70 # what to do in case of error
Signal 101 # signal reload finished
DdrSelfRefresh # batch end - MIPS stopped
# FORCED RESTARTS
# ===============
10: # >>>> Hot boot <<<<
# Signal 40
echo SR10->Hot boot
OnErrGoto 70 # What to do in case of error - try cold
Signal 32 #
TdfLoad /bffs2/AppKernel.tdf #
Signal 30 # Batch end - mips reload finished
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet
TdfRun /bffs2/AppKernel.tdf # Remark : NO CLEAR BIS !!
11: # >>>> Start fast cold boot <<<<
# Signal 40
echo SR11->Start Fast Cold Boot
OnErrGoto 70 # What to do in case of error - try cold
Signal 31 # Signal fast cold start
DdrSelfRefresh # Error reason is stored in mem (no clear section)
12: # >>>> Fast cold boot <<<<
# Signal 40
echo SR12->Finish Fast Cold Boot
OnErrGoto 1 # what to do in case of error
TdfLoad /bffs2/cdDownloadTM0.tdf # load files
TdfrunTm 0x4600000
TdfLoad /bffs2/AppKernel.tdf # Check that it is really the mips_txt and that it is still valid
TdfLoad /bffs2/atvTm0App.tdf
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # fast cold reload finished
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet;earlytm=0x4600000
TdfRun /bffs2/AppKernel.tdf # batch end - run app
# SECOND SPIN ADDITIONS
# =====================
13: # >>>> Goto self refresh <<<<
Signal 30 #
DdrSelfRefresh #
# OTHER SETBOOTMODE ARGUMENTS WHICH SHOULD !NOT! BE PASSED TO UBTM
# ================================================================
40: # >>>> Viper Infra Initialized <<<<
echo SR40->Viper Infra Initialized
Goto 70 # This is an invalid value.
# ERROR HANDLING
# ==============
60: # >>>> Retry For Coldboot <<<<
echo SR60->Retry coldboot
OnErrGoto 4 # what to do in case of error - try loading sw upgrade app
TdfLoad /bffs2/cdDownloadTM0.tdf # load files
TdfrunTm 0x4600000
TdfLoad /bffs2/atvTm0App.tdf # load files
TdfLoad /bffs2/AppKernel.tdf
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # signal cold load finished
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet;earlytm=0x4600000
TdfRun /bffs2/AppKernel.tdf # batch end - cold start
61: # >>>> Retry loading images for warmboot <<<<
echo SR61->Retry loading images for warmboot
OnErrGoto 70 # what to do in case of error - try loading sw upgrade app
TdfVerify /bffs2/cdDownloadTM0.tdf # verify files
TdfVerify /bffs2/atvTm0App.tdf # verify files
TdfVerify /bffs2/AppKernel.tdf
MemFill 0x87fff000 0x1000 0xff # Clear BIS
Signal 30 # signal warm boot end
cmdline ;console=ttyS0,38400n8;mem=35M;tm0size=18M;kgdb=ttyS1;root=/dev/mtdblock_auth5;lpj=1196032;init=/init;ip=none;jffs2_gc_delay=20;quiet
TdfRun /bffs2/AppKernel.tdf # batch end - warm start
70: # >>>> Fatal Error <<<<
echo SR70->FATAL ERROR
OnErrGoto 80
Signal 101 # signal fatal error (cold restart by standby)
Exit # batch execution ends here
80: # >>>> Signal Fails <<<<
echo boot2: SR80->EXIT, signal fails
Exit
default: # Unknown entry - batch error
echo boot1: Default->Unknown entry # Added as a workaround
Goto 1
Yeah with commands like Goto, Echo, ETC. Yes this is stored in the NAND completely unrmeoved of all strings. And it appears that this bootloader is EXTREMELY advanced more than most embedded bootloaders like.... Well I don't spend my time looking at embedded bootloaders but id say in FOREVER.
Now lets go over what .TDF is.
TDF is a file that appears to be a file format that can store EVERYTHING.
- It can contain ENTIRE vmlinux images and have it loaded similarly to a ELF
- It can contain these batch scripts(The one I just showed was in this boot.TDF)
- It can contain Linux Binaries.
- It can contian Drivers and be directly loaded
- It can store whatever CDDOWNLOAD is
Pretty much TDF can do EVERYTHING. It contain shell scripts and be directly ran, It can be store vmlinuxes and be directly loaded like a .ELF file. It can even be a driver. Its a file format that is fucking insane. Like I have NEVER seen ANYTHING like this.
Todays spergpost will be less about me showing my progress as im stuck between a hard rock right now(Which if anyone wants to do some reverse engineering or try to get a NAND working properly in QEMU message me and ill not only make it worth your while but also give you EVERYTHING I have to get started with explinations for everything). But rather my discoverys exploring this thing.
Now admittly I have NO IDEA how this bootloader works, I don't know where it ENDS so I cant just byte cut it into ghirda and see how it works...
Well maybe I could... But I don't know...