R0 firmware based on Linux?

[lebellium]

Please use "edit" button

[nik1105]

To split firmware i used the following algorithm:
1.Go to the end of firmware file
2.Go in direction of the beginning of the file, by the amount of bytes specified in header
3.Read bytes in memory from that position to the end of file.
4.1 Write buffer to file
4.2 Reverse buffer data and save it to file
The reasons why it is not working may be the following:
1. Application bug(i'm doing something wrong)
2.Firmare file encrypted or packed(and this may be the reason why it tooks r0 so many time to check firmware file)

Another thing that has to be tested:
Is summ of firmware components+header size equal to the total size of firmware file?

[ricpersi]

Nick, the sum of MBoot + Linux + RootFS + Sysdata is equal to the size of the firmware file minus the header, so this should be the right direction.

Lebellium, sorry for posting a new message.. every forum has its own policy, on some you're not supposed to edit messages, on some others you're allowed to edit them.. I didn't mean to spam.

I'd like to keep this thread "alive" so that more people could join us and try to make the R0 better.

Cheers,

Riccardo

[marklord]

Note:

• All credits for what I'm going to write go to Jean-Louis, author of two posts on this topic on an italian forum: post n.1 post n.2

• This post requires a basic knowledge of Linux.

• It applies to R1 firmware, too.

• Sorry for my English, it could be better.

To unpack the firmware, you need the dedicated tools that Samsung published in the http://opensource.samsungmobile.com site (file YP-R0_YP-R1_OpenSource.zip) and a Linux distro.

Inside the zip there is a file named Muon.tar.bz2 containing the program MuonEncrypt, that can encrypt/decrypt the firmware's parts.
Actually "encryption" is a simple XOR, but it doesn't matter here.

To unpack the firmware, save the following script (named here unpack_rom.sh) in a directory together with MuonEncrypt and the rom and execute it: ./unpack_rom.sh R0.ROM

#!/bin/bash

ROM=$1
MBOOT="MBoot.bin"
MBOOT_TMP="MBoot.tmp"
LINUX="zImage"
CRAMFS="cramfs-fsl.rom"
SYSDATA="SYSDATA.bin"
MD5SUMS="MD5SUMS"
TMP="TMP"

function ExtractAndDecrypt {
    START=$(expr $START - $2)
    echo "Extracting $1..."
    dd if=$ROM of=$TMP bs=1 skip=$START count=$2 2>/dev/null
    echo "Decrypt $1..."
    ./MuonEncrypt $TMP > $1
}

size=( `head -n 9 $ROM | tail -n 4 | while read LINE; do echo $LINE | cut -d\( -f 2 | cut -d\) -f 1; done`)
checksum=( `head -n 9 $ROM | tail -n 4 | while read LINE; do echo $LINE | cut -d\( -f 3 | cut -d\) -f 1; done`)

echo "${checksum[0]}  $MBOOT" > $MD5SUMS
echo "${checksum[1]}  $LINUX" >> $MD5SUMS
echo "${checksum[2]}  $CRAMFS" >> $MD5SUMS
echo "${checksum[3]}  $SYSDATA" >> $MD5SUMS

START=`stat -c%s $ROM`

ExtractAndDecrypt $SYSDATA ${size[3]}
ExtractAndDecrypt $CRAMFS ${size[2]}
ExtractAndDecrypt $LINUX ${size[1]}
ExtractAndDecrypt $MBOOT_TMP ${size[0]}

rm $TMP
echo "Create $MBOOT..."
dd if=$MBOOT_TMP of=$MBOOT bs=96 count=1 2>/dev/null
dd if=$MBOOT_TMP of=$MBOOT bs=1088 skip=1 seek=1 2>/dev/null
rm $MBOOT_TMP

echo "Check integrity:"
md5sum -c $MD5SUMS

It may require some minutes to extract all parts.

The extracted file SYSDATA.bin (again, a packet of files) is a "raw" file but quite simple in its structure: there is an header, then the description of dir and files, then all data.
With the dd command one can extract a single file, but to modify its content some work is necessary.

We have better luck with the file cramfs-fsl.rom (RootFS) which can be mounted (read-only) with the command:

sudo mount -t cramfs -o loop cramfs-fsl.rom /mnt/RootFS/

(assuming /mnt/RootFS/ already exists, of course) and then explored at will:

ls -l mnt/RootFS/
.:
totale 14
drwxr-xr-x 1 root root  740  1 gen  1970 bin
drwxr-xr-x 1 root root 1408  1 gen  1970 dev
drwxr-xr-x 1 root root  360  1 gen  1970 etc
drwxr-xr-x 1 root root 5976  1 gen  1970 lib
drwxr-xr-x 1 root root   80  1 gen  1970 mnt
drwxr-xr-x 1 root root    0  1 gen  1970 proc
drwxr-xr-x 1 root root    0  1 gen  1970 root
drwxr-xr-x 1 root root  592  1 gen  1970 sbin
drwxr-xr-x 1 root root    0  1 gen  1970 sys
drwxr-xr-x 1 root root    0  1 gen  1970 tmp
drwxr-xr-x 1 root root   88  1 gen  1970 usr
drwxr-xr-x 1 root root   64  1 gen  1970 var

That should be familiar to all Linux users

In Muon.tar.bz2 there is also a script named NewPack.sh to "rebuild" the firmware from its parts.

[nik1105]

Great news! Now somebody who has linux and skills must extract files and share them with others.

[lebellium]

Sounds great even though I don't understand anything

[Nikolaus]

So that means, you could build your own linux based firmware, if you have enough time and skills?

[ricpersi]

I got the opensource zip archive again from samsung site (last time i downloaded all the Muon and decrypt / encrypt stuff was missing) and I was able to decrypt and mount firmware partitions. Unfortunately by a fisrt look at what's inside I'm afraid there won't be much we could do. All interesting files are binaries and there are no sources inside samsung archive.
I'm trying to get all the libraries that are linked inside those binaries, because if we find out that samsung has linked to some gpl'd library then they have to publish the source code.

I'll keep you informed anyway..

[battlemac]

could this mean we can maybe get to get the sd card integrated?

[setialpha]

There isn't a SD-Card-Reader in R1.

Either way I'll check that stuff

EDIT:

Looks good, but how can I start busybox on the R1?

There's a library for playing REAL-Audio, didn't know R1 could do that...

[battlemac]

Yeah but we are talking about the R0 here aren't we as the thread title suggests.

[setialpha]

Oh yeah. I just forgot that the R0 forum got merged into the R1 one.

Besides R1 and R0 use a similar firmware, so that stuff is working for both.

[Pingu1084]

Originally Posted by lebellium

I can help you for hardware (as Samsung Insider )
For software I cannot help.

But unfortunately it is not enough. We had much information about the P2's hardware but nobody managed to port rockbox even though it looks like the Cowon D2.
To port rockbox we need motivated rockbox experts and developers who own the R0....

Having info about the hardware would be very useful because every chipset has its own firmware format, so if we know the hardware we can try (we probably won't do anything, but at least we can try).

[slade]

Hey There,

I want to thank you marklord for the script,
i am currently working on a port to rockbox. with this skript i am able to do exactly what I wanted and try to chainboot rockbox from the integrated flash. You saved me a heck of work. If you are interested we could team up and it would be easier for us to port it.
Thanks for the work you put in. Now I can actually start working on the port!

[nik1105]

Thats great to hear that somebody decided to port Rockbox.
If someone can help and want to help should also join this.
Probably it can be good idea to use some forum to coordinate actions, for example this: nsoft.freeforums.org.
P.S If i can help somehow i would aloso like to join this process, my linux knowledge is bad, but i can do some c/c++/c# coding.

[slade]

any help would be greatly appricated. As for the linux I can cover most part, as for C, I could really use a hand, i am acutally the java and c# guy liking the object oriented programming a lot more.

if you have the time maybe you could open up a forum for us whatever suits you. i would suggest one where we have control as admin.

[nik1105]

Originally Posted by slade

if you have the time maybe you could open up a forum for us whatever suits you. i would suggest one where we have control as admin.

As i have written in post above i created the test forum, where i am admin: http://nsoft.freeforums.org ,optionaly its possible to use http://nsoft.ucoz.ru/forum, but there the registration is in russian, so first variant is better. On this(ABI) forum we can post news of port process. But probably somebody have some better ideas than special forum for our communication?

[slade]

this is the progrss so far
http://www.rockbox.org/wiki/SamsungYP
so you can check here every once a while.

[nik1105]

If you also want to join port team just send your contact information to nik1105(at)rambler.ru