[[backdoor]]
 
Table of Contents

The Backdoor

Archos has been kind enough to provide a UART bound backdoor in the gmini.

Physical access to UART

http://www.donat.org/archos/temp/port%20analysis/port-trace.gif

http://www.donat.org/archos/temp/port%20analysis/serial.jpg

JTAG?

Notes:

Pin 104 is JTAG selection. Pin 106 is UART clock input.

1st setting:

LCON <-   0x03    (8N1) 8 bits, one stop bit, no parity
UCON <-   0x23    
UBRDR <-  0x10
UBRDR

Clock frequency is 32Mhz.

Baud rate = fxx/((Divisor value + 1) x 16)

Obtaining 117647.058823529411 Hz.

LCON
[1:0] Word-length per frame (WL)
00 = 5-bit
01 = 6-bit
10 = 7-bit
11 = 8-bit

[2] Number of stop bit at end of frame
0 = One stop bit per frame
1 = Two stop bits per frame

[5:3] Parity mode (PMD)
0xx = No parity bit in frame
100 = Odd parity
101 = Even parity
110 = Parity forced/checked as 1
111 = Parity forced/checked as 0
UCON
[7] Loopback bit               Setting UCON[7] causes the UART to enter loopback mode. In loopback
                               mode, the transmit data output is sent High level and the transmit buffer
                               register (TBR) is internally connected to the receive buffer register
                               (RBR). This mode is provided for test purposes only.
[6] Send break                 Setting UCON[6] causes the UART to send a break. Break is defined
                               as a continuous Low level signal on the transmit data output with a
                               duration of more than one frame transmission time. By setting this bit
                               when the transmitter is empty (transmitter empty bit, SSR[7] = 1),
                               you can use the transmitter to time the frame. When SSR[7] is 1,
                               write the transmit buffer register, TBR, with the data to be transmitted.
                               Then poll the SSR[7] value. When it returns to 1, clear (reset) the send
                               break bit, UCON[6].
[5] ­
[4] Tx enable
[3] Tx interrupt enable        UART Tx interrupt control: 0 = Disable, 1 = Enable
[2] Rx status interrupt enable This bit enables the UART to generate an interrupt if an exception
                               (break, frame error, parity error, or overrun error) occurs during
                               a receive operation. When UCON[2] is set to 1, a receive status
                               interrupt will be generated each time an Rx exception occurs.
                               When UCON[2] is 0, no receive status interrupt will be generated.
[1] Rx enable                  UART Rx operation control: 0 = Disable, 1 = Enable
[0] Rx interrupt enable        UART Rx interrupt control: 0 = Disable, 1 = Enable

Emulator

In the emulator, uart is bound as is:

Activation

  1. Set the flash memory byte 0×48F0 to 0×55.
  2. Send “SRL<CR>” to the UART as soon as “#SERIAL#” is seen.

So on the gmini:

  1. Apply aaz upgrade (provide the file)
  2. ???

On the emu:

  1. Uncomment the appropriate line in Emulator.cpp (alternatively, edit first24k.aaz)
  2. echo -ne ‘SRL\r’ > uart.pipe
 
  backdoor.txt · Last modified: 2004/12/22 15:36
 
Recent changes RSS feed Creative Commons License Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki