Qualcomm RTOS AMSS :
http://read.pudn.com/downloads155/doc/686659/Rex/80-24897-1.pdf
http://read.pudn.com/downloads155/doc/686659/Rex/80-V0255-1.pdf
http://read.pudn.com/downloads155/doc/686659/Rex/Rex_Reference.pdf
http://read.pudn.com/downloads137/doc/comm/585430/Rex.ppt
Reverse engineering Qualcomm RTOS :
28C3: Reverse engineering a Qualcomm baseband
http://events.ccc.de/congress/2011/Fahrplan/events/4735.en.html
http://events.ccc.de/congress/2011/Fahrplan/attachments/2022_11-ccc-qcombbdbg.pdf
https://www.sstic.org/media/SSTIC20...t_dbogage_dun_baseband_qualcomm-delugre_1.pdf (French)
https://cryptolux.org/media/hack.lu-aybbabtu.pdf
http://reverse.put.as/wp-content/uploads/2011/06/basebandplayground-luismiras.pdf
Miasm is a a free and open source (GPLv2) reverse engineering framework. Miasm aims at analyzing/modifying/generating binary programs. Here is a non exhausting list of features:
opening/modifying/generating PE/ELF 32/64 le/be using Elfesteem
Assembling/Disassembling ia32/ppc/arm
Representing assembly semantic using intermediate language
Emulating using jit (dynamic code analysis, unpacking, ...)
Expression simplification for automatic de-obfuscation
Graphic disassembler using Grandalf
http://code.google.com/p/miasm/
MSM7200 software manual :
http://read.pudn.com/downloads149/doc/project/643560/MSM7200.pdf
Qualcomm MSM Debugger :
http://code.google.com/p/qcombbdbg/
Information about the design and implementation of the L4/AMSS system in Qualcomm basebands :
Git with some source OKL4 for Ida
http://code.google.com/p/docl4amss/wiki/Main
http://code.google.com/p/docl4amss/wiki/OkL4
Qualcomm Android and RIL Linux Data :
On update Translate...
http://wenku.baidu.com/view/412c05252f60ddccda38a081.html###
Qualcomm AMSS Source :
https://www.codeaurora.org/git/proj...8800744c99f287f77a8ef/show/AMSS/products/7x30
Update
Enjoy !!!
Update
dumb question
Call me dumb, but might this be important for the development of the modem?
Do you think that these are relevant to modems that are dual cdma/umts etc or is strictly one radio CDMA documentation?
Related
Hello!
I would like to ask about compiling existing C/C++/asm sourcecode on Android, specifically the code of the libav codec system. After that, I would like to statically link against it, and build the x264 commandline video encoder. I don't need any fancy GUI video encoding stuff, just the statically linked x264 cli tool. The libav is needed to be able to read H.264/AVC input, the x264 to encode somewhat similar H.264/AVC output.
I do have some experience in compiling that code on x86/x86_64 and MIPSEL (chinese Loongson-2f specifically) architectures in Linux with gcc/yasm, but I am a total noob, when it comes to cross-compiling unfortunately, I have only built the code sitting directly on the target system so far.
What I do have here, is a CentOS 6.0 x86_64 multilib Linux, GNU make and autoconf tools, latest Android SDK (probably not needed) and latest Android NDK toolchain (definitely needed) as well as the yasm assembler to build the ARMv7 assembler codepaths of libav and x264. I'm also able to fall back to pure C/C++ in case the asm stuff is impossible. I have found some guys having done the x264 alone using Google search, but info on how exactly they did it is quite scarce.
My primary target platform is Android 2.2 on a TI OMAP3 chipset with an ARM Cortex A8 processor that I believe has a hardware FPU, but no NEON SIMD extensions. I may also want to target slightly different hardware, but all using the ARMv7 instruction set basically.
So, if anyone has experience in cross-compiling libav/x264 or similar stuff like ffmpeg, I would greatly appreciate help in getting that done. At the moment I'm quite at a loss with cross-compiling using the NDK..
I hope I am posting in the correct subforum, it's my first post here. Thanks for any help you might be able to provide!!
Hello people,
I've been trying to unbrick a xperia x8 phone and reflashing the bootloader using JTAG. After some research I managed to connect to the cpu, but I can't get it to halt. I'm using OpenOCD 0.6 in combination with the olimex JTAG usb-arm-ocd tool. Based on the ft2232 chips.
Here's what I get with openocd:
Code:
Open On-Chip Debugger 0.6.0 (2013-03-15-20:11)
Licensed under GNU GPL v2
For bug reports, read
--link
Info : only one transport option; autoselect 'jtag'
DEPRECATED! use 'adapter_khz' not 'jtag_khz'
adapter speed: 500 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
adapter_nsrst_delay: 100
CPU
Info : device: 4 "2232C"
Info : deviceID: 364511235
Info : SerialNumber: FTU1UUZZA
Info : Description: Olimex OpenOCD JTAG A
Info : clock speed 500 kHz
Info : JTAG tap: ARM926EJS.cpu tap/device found: 0x203c00e1 (mfg: 0x070, part: 0x03c0, ver: 0x2)
Info : Embedded ICE version 6
Info : marvel: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection from 4444
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0* CPU arm926ejs little ARM926EJS.cpu running
Info : Halt timed out, wake up GDB.
So it correctly identifies the CPU and embedded ICE version.
For the people wondering why it isn't an ARM1136EJS core... i'm wondering the same thing! I tried pulling down the boot_mode pin but I can only get the TAP for the ARM926 core...
Does anyone know how to get the processor to HALT ? as a start... this would allow me to acces the NAND memory through the CFI interface. Altho i might be reinventing the wheel, it just seems silly to pay lots of money for something as 'simple' as JTAG programming a phone. Would have been easier if i'd designed the software myself!
this is not the section to post this
what is this??
Hey whats going on here??
Is there any chance of hoping more from X8 hardware?
vuiseng said:
what is this??
Click to expand...
Click to collapse
read the title.
@OP. ask a mod to move the thread to Q&A section
but i dont think anybody would be able to answer the question except nAa
I had read something on arm official site and got that
Arm 926EJ is armv5 processor not an armv6
But an armv5 processor have a max freq. = 470 MHz
Any progress regarding the pinout?
Following is a detailed explaination of quacomm MSM Boot
Process
(thanks to the original author "TJ world")
hope it helps DEVs in order to bypass SecureBoot.
An examination of how the
Qualcomm Mobile Station Modem
(MSM) Snapdragon 7x30 system-on-
chip boot-straps the processors into
an operating system.
There are two processors in the
MSM 7x30, an ARM9 for the radio
and an ARM11 auxiliary applications
processor. Each processor has its
own JTAG and can be independently
controlled using it.
ARM9 Boot Process
The ARM9 is the primary processor.
It boots first, executing the Primary
Boot Loader (PBL) from on-board
ROM at 0xFFFF0000 .
The MSM platform has the facility to
force Secure Boot using the status of
the FORCE_TRUSTED_BOOT Qfuse
on-chip or a high-state BOOT_SCUR
pin connected to GPIO95. In this
mode the PBL verifies the signature
of the SBL/OSBL before executing
it,which verifies the REX/AMMS
signature in the same way.
After some hardware initialisation the
PBL reads the Device Boot Loader
(DBL) from the first partition of the
flash memory device (In Linux,
mmcblk0p1).
DBL is part of Qualcomm's
SecureBoot, which uses
cryptography to guarantee that the
boot-loader images haven't been
tampered with. DBL configures the
Cryptographic Look-aside Processor
(CLP), a dedicated cryptographic co-
processor, and other hardware
sufficient to load and execute the
Secondary Boot Loader (SBL) from a
Flash memory device on EBI2
(External Bus Interface 2) from
partition 3 (Linux mmcblk0p3).
The SBL, also known as the
Operating System Boot Loader
(OSBL), is loaded into memory at
0x8000000 (IMEM - Internal Memory,
the MSM7230 package-on-package
(PoP) RAM). This is the ARM9
Monitor (AMON). It provides an
Extensible Firmware Interface (EFI) -
like environment for controlling the
boot process. After doing more
hardware configuration including
UARTs and USB (for potential remote
console connections to the monitor)
it loads the Applications processor
Secondary Boot Loader (APPSBL
a.k.a. hboot) on the ARM11
applications processor from partition
18 (Linux mmcblk0p18) into memory
@ 0x8D000000 virtual, 0x00000000
physical.
It then loads and executes the
combined REX/AMSS from partition
5 (Linux mmcblk0p5). The image
contains the REX (Real-time
EXecutive) which is an L4A
Pistachio embedded micro-kernel
and Iguana operating system
combination, with extensive
Qualcomm and HTC modifications
and extensions.
REX is responsible for loading the
firmware into the ancillary micro-
controller (microP), digital signal
processor and voice processor and
initialising them. It runs in Security
Domain 0 (SD0).
When the ARM11 starts REX
unloads/disconnects its eMMC driver
and from then on relies on remote
procedure calls (RPC) via shared
memory (SMEM) to the ARM11
application processor to read and
write the eMMC. On the ARM11 side
the Linux operating system uses the
rmt_storage (remote storage) driver
to handle such requests.
Finally on the ARM9 REX executes
the Advanced Mobile Subscriber
Software (AMSS). AMSS runs in
Security Domain 1 (SD1).
ARM11 Boot Process
The ARM9 running REX loads the
eMMC "hboot" partition into memory
at 0x8D00000 (virtual) and starts the
ARM11 auxiliary applications
processor executing at this location.
It runs in Security Domain 3 (SD3).
The core of the boot-loader can be
found in the Android source-code
repository in the platform/bootable/
bootloader/legacy.git project. This
source-code maps well to current
hboot images when they are reverse-
engineered; allowing the libc and
core functions and structures to be
identified.
What about grand 2 SM-G7102? Can u help on this phone its as it is also qualcomm. But bootstrap or unlockbootloader required... still not available..
Sent from my SM-G7102 using Tapatalk
i am currently working on the Main SBL only
but what i get is a bunch of useless Hashes!
http://forum.xda-developers.com/showthread.php?t=2666183
Check this out and also u can contact this developer he has already developer kernel for grand2
Sent from my SM-G7102 using Tapatalk
manan001 said:
http://forum.xda-developers.com/showthread.php?t=2666183
Check this out and also u can contact this developer he has already developer kernel for grand2
Sent from my SM-G7102 using Tapatalk
Click to expand...
Click to collapse
actually i know how kernel works,
but the thing is that how do i edit the assembly code in primary registers in order to directly skip the verification which is done by boot image(kernel)
PM Hashcode or dorimanx
Galaxy grand2 SM-G7102
first let me try by my own..
if no progress is done then i'll surely contact them
vrushabh sutar said:
first let me try by my own..
if no progress is done then i'll surely contact them
Click to expand...
Click to collapse
check this..
TripRex is working on stock kernel you can take his help to bulid one..
http://forum.xda-developers.com/showpost.php?p=51549344&postcount=17
bro any progress?
hmm
i've checked all the Memory offsets but found nothing different
Follwoing were the partitions:-
SBL
AMSS
QSCBL (i think we may do something of this but i am nt sure..)
AP
CSC
SYSTEM
CACHE
USRDATA
RAM
EEPROM
This is just a compilation about the topic and i have made it as much as noob friendly as i can. i will write it part wise when i get time. Hope it helps the community. if i missed something or wrote something wrong please point me out.
Do not forget to hit thanks if this helped
Linux Kernel and its Structure
PART I
Introduction:-
The Linux Kernel is as we all know is on of the most prominent example of free and open source software. Linux kernel is one of the most popular operating system kernel widely used by Linux distributions and variety of mobile devices. If was the result of a hobby of Finnish student Linus Torvalds and in 1991 he gave the birth to the Linux Kernel which redefined the concept of free and open source software.
The Linux Kernel is released under GNU General Public License version 2(GPLv2) and due to which more then a thousand people contribute to each kernel release. The large and dynamic developer and user community around Linux helps it to rapidly accumulate developers and users to adopt code from other free software projects to use with the Linux Kernel.
The main features of Linux Kernel are :-
1.Multitasking: several programs running at the same time.
2.Multiuser: several users on the same machine at the same time (and license for two users)
3.Scalibility: can run on super computers as well as tiny devices.
4. Multithreading: has native kernel support for multiple independent threads of control within a single process memory space and even has memory protection between processes, so that one program can't bring the whole system down.
demand loads executable: Linux only reads from disk those parts of a program that are actually used.
5.Free and open source:- All source code is available, including the whole kernel and all drivers, the development tools and all user programs; also, all of it can be freely distributed.
6.Multiple virtual consoles: several independent login sessions through the console, you switch by pressing a hot-key combination.
7.Supports several common filesystems, including minix, Xenix, and all the common system V filesystems, and has an advanced filesystem of its own.
8.An extensive networking support.
9.Modulatiry: Loads only those modules that are needed by the system, even at runtime.
10 Easy to code: Almost all the resources are available free, so users and developers can learn form existing codes already contributed by the community.
Defining System Calls:-
The main interface between the Linux Kernel and the user space is a set of system calls. Normally the system provides a library or API such as glibc, that provides the wrapper functions for the system calls. Kernel services like file operations, networking operations inter-process communications, threads, memory mapping etc are provided by over 300 system calls.
At present the system call interface is stable and only new system calls can be added by the Kernel developers. The user space applications usually never make a system call directly but rather it uses the corresponding C library function.
Getting Linux Kernel Sources:-
The Linux kernel Sources are free and open source as it is distributed by the GNU General Public License v2, you can get the source as released by Linus Torvalds at
HTML:
https://www.kernel.org
There are various versions available namely Prepatch, Minline, Stable, Longterm depending on the maintainers and stability status.
Thought many of the chip vendors supply their own kernel sources as you already have seen in case of Google device kernels maintained and distributed by Google. There are many sub-communities that maintain their own kernel, with usually new features or specific features, and my be stable or unstable.
The Linux Kernel sources can be downloaded at
HTML:
https://kernel.org/pub/linux/kernel/{version}/{branch}
as a full tarballs and patches.
But you can also get the kernel using the git version control system. Detailed description of the git version control system can be found here -
HTML:
http://git-scm.com/
The Linux kernel size vary from 500Mb to around 1Gb but you can get the kernel as archive in gzip, bzip2, xz depending upon the compression rate. The Linux core is pretty small but it contains thousands of device drivers, network protocol, many architectures, filesystems, documentations, firmware, scripts etc, so the large size of the Linux kernel.
The Linux Kernel is implemented in C as like all the UNIX system. A little assembly language is also used, but no C++ is used in the Linux Kernel. All the codes are compiled by gcc and a few alternative compilers, but ANSI C compile cannot compile the Linux Kernel as gcc specific extensions are used in the kernel code.
The main feature of the Linux kernel is that it has to be standalone, which means no user space code or part can be used in the Linux Kernel. The user space is then implemented on the top of the Linux Kernel. The Linux Kernel has to supply its own library implementations, and no standard C library functions are used in the kernel. But it provides its own similar C library.
The Linux Kernel is designed to be portable, and the kernel provides macros and functions to abstract the architecture specific details. The Linux Kernel never uses floating point unit as some of the architecture may not be compatible with it. The internal kernel API is not stable and can undergo changes between releases and so if you have to use the API then keep track of all the API available for the specific kernel release. An out-of-the tree compiled driver for a older version of the kernel may not work on the recent ones. Though the kernel to user space API does not change as it may break the existing scripts and program running in the user space.
GPL licensing and open source drivers:-
As mentioned earlier the Linux Kernel is licensed under the GNU General Public License version 2, which gives you the right to study, use, modify and share it without any cost. However it states that if the code is redistributed or shared modified or unmodified then it will be under the same license. More information about the GPLv2 can be found at -
HTML:
http://www.gnu.org/licenses/gpl-2.0.html
Thought there are a lot of propriety drivers that are available for different hardware. You cannot distribute a binary kernel that includes statistically compiled propriety drivers. Most of the common form of the propriety drivers can be found in the case of graphics cards, though open source drivers are also available for the same.
The main advantage of GPL licensed drivers is that you do not have to write the whole driver from scratch and you can reuse the code for similar free software. The GPL licensed drivers can be easily distributed inside a compiled kernel for example a Linux distribution. Free community contribution, support, testing can be attained. And the code becomes much more stable as many people review the code and contribute to it. Many device driver codes are also implemented in the user space. This is possible as the Linux Kernel provides a mechanism that allows the user space application to access the hardware directly. Certain drivers are handled partly in kernel space and partly in user space.
The user space drivers have a lot of advantages as you need no kernel coding skills to write a user space driver. User space drivers can be written in any language and they can even be kept propriety. The driver code can be killed and debugged without crashing the kernel, and moreover it can be swapped out for a much stable version without changing the kernel.
Part II
Part II
Overview Linux Kernel Source:-
The Linux Source structure is defined in this section. The directories give here are at the top level of the Linux source tree.
Makefile
This is the top level Makefile for the whole source tree. It defines a lot of useful variable and rules, such as the default gcc compilation flag. Here also we set the architecture and the version.
Documentation/
This directory contains a lot of useful information about configuring the kernel and all the help items. The help entries corresponding to the different configuration cannot be found here. They are located in the Kconfig files in each source directory. If you are starting out this folder you should now miss.
arch/
All the architecture corresponding codes are in this directory. Each architecture has its own directory underneath this directory. Some of the important sub-directories are -
Code:
arch/<ARCH>/mach-<machine>
machine/board specific code
Code:
arch/<ARCH>/include/asm
architecture specific headers
Code:
arch/<ARCH>boot/dts
Device tree architecture
block/
Block layer code
COPYING
This contains the license(GNU GPLv2)
CREDITS
This contains the main contributors are mentioned here.
crypto/
This is the cryptographic API for the use by the kernel itself
drivers/
In this directory we find all the device drivers of the peripheral devices. Only sound device driver is not located here.
firmware/
Firmware images extracted from old drivers are located here.
fs/
This directory contains the generic filesystem code, known as Virtual File System and also the code for each different filesystem are found in this directory. If you are on a Linux distribution, the root filesystem is probably ext4 filesystem. The code to read the ext4 filesystem can be found in
Code:
fs/ext4
.
include/
This directory contains all the kernel headers. During compilation a symbolic link from the asm-<ARCH> is created so the
Code:
#include <asm/file.h>
will get proper file for that architecture. There are other non-architectural specific header file.
init/
This directory contains the files main.c and version.c and code for creating an “early userspace”. The version.c defines the Linux version string.
ipc/
IPC stands for inter process communication. It contains the code for shared memory and other forms of process communications.
Kbuild
Part of the kernel build system.
kernel/
It contains the general kernel level code.
lib/
Routines of generic usefulness to all kernel code are here.
mm/
High level memory management codes are found here. Virtual memory(VM) implementation and early boot memory management are done here, as well as memory mapping of files, management of paging cache, memory allocation are done here.
net/
The high-level networking code is here. The low-level networking driver pass received packets up to and get get packets to send from this level, then it passes the data to the main application.
scripts/
This directory contains scripts that are useful in building the kernel, but does not include any code that is incorporated into the kernel itself.
sound/
Drivers for sound cards and other sound related code is placed here.
usr/
This directory contains code that builds a cpio-format archive containing a root filesystem image, which will be used for early user space.
tools/
Code for various user space tools
security/
Code for different Linux security models can be found here.
samples/
Sample codes
** - I'm using mobile devices using Snapdragon 801 msm8974ab
- I changed the code in the kernel opensource path:
arch / arm / boot / dts package but when I overclock kernel has yet been ./. So I ask you to revise the opensource code file in the kernel to get overclocking on this chip
Sorry for my english is not fluent ./. Looking forward to receiving your reply !!