Slide 1
Slide 1 text
54 #wakate
2022
@puhitaku
Slide 2
Slide 2 text
2
Takumi Sueda @puhitaku
HOMMA
Inc.
3
D
20
1
4 2
018
2020 Linux
20
2
1
TEPRA Lite BLE
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
4
Slide 5
Slide 5 text
SHARP Brain
5
Slide 6
Slide 6 text
2020 Linux
6
Slide 7
Slide 7 text
Twitter #wakate
202
2
7
Slide 8
Slide 8 text
SHARP Brain
Slide 9
Slide 9 text
SHARP Brain
SHARP Brain PW-SH
1
SHARP 2008
Windows CE 2020
CE
exe
Brain 2ch
Brain Windows CE
Wikipedia
matplotlib
9
Slide 10
Slide 10 text
SHARP Brain 10
DRAM: LPDDR
128
MB
eMMC:
8
GB
SD
Raspberry Pi
LCD
CPU: NXP i.MX
2
83
ARM
926
EJ-S, armv
5
tej
4
54
MHz
LCD:
8
00
x
48 0
SD: SDXC
:
Slide 11
Slide 11 text
SHARP Brain
Linux
2020 Linux
"Brain Hackers"
Brain Debian
Linux Brainux
OS SD
Brain Linux
11
Brainux / Brain Hackers
Slide 12
Slide 12 text
SHARP Brain
1 Windows Linux
12
Slide 13
Slide 13 text
SHARP Brain SD eMMC 13
SD Linux
eMMC
SD: SDXC
eMMC:
8
GB
SD
❌
Slide 14
Slide 14 text
SHARP Brain SD eMMC
SD
SD
SD
SDIO Wi-Fi
Linux mainline
SDIO Wi-Fi
GPIO
eMMC Linux
14
Slide 15
Slide 15 text
SHARP Brain SD eMMC
Brain Linux
Linux
Good-bye, Windows Good-bye,
15
Slide 16
Slide 16 text
eMMC Linux
Slide 17
Slide 17 text
eMMC Linux
17
Slide 18
Slide 18 text
eMMC Linux 18
Brain
Windows CE
Slide 19
Slide 19 text
eMMC Linux 19
Windows CE
?
Slide 20
Slide 20 text
eMMC Linux
SoC
eMMC
20
Slide 21
Slide 21 text
Boot ROM
Slide 22
Slide 22 text
Boot ROM
Arm SoC
22
Slide 23
Slide 23 text
Boot ROM
A. Boot ROM
23
Slide 24
Slide 24 text
Boot ROM
A. Boot ROM
(i.MX
28
On-chip ROM )
24
Slide 25
Slide 25 text
Boot ROM
CPU
25
eMMC
DRAM
I
2
C
SPI
ARM
9
2 6
EJ-S
Core
Slide 26
Slide 26 text
Boot ROM
On-chip ROM On-chip RAM
On-chip RAM On-chip ROM
26
On-chip ROM
(Boot ROM)
On-chip RAM
(SRAM)
ARM
9
2 6
EJ-S
Core
Slide 27
Slide 27 text
ARM
9
2 6
EJ-S
Core
Boot ROM
CPU Boot ROM
27
On-chip ROM
On-chip RAM
(SRAM)
🤔
ARM
USB recovery
I
2
C
SPI
SSP (eMMC / SD)
GPMI (NAND)
JTAG
Slide 28
Slide 28 text
ARM
9
2 6
EJ-S
Core
Boot ROM
Boot ROM
"One-Time Programmable ROM" "Boot Mode"
28
On-chip ROM
On-chip RAM
(SRAM)
🤔
OTP
One-Time Programmable ROM
Slide 29
Slide 29 text
Boot ROM
"OTP ROM" "OTP"
SoC
ROM
CPU
OTP
One-Time Programmable (OTP) ROM
29
OTP
Slide 30
Slide 30 text
OTP
Slide 31
Slide 31 text
SHARP OTP
SHARP Brain PW-SH
1
SHARP 2008
Windows CE 2020
CE
exe
Brain 2ch
Brain Windows CE
Wikipedia
matplotlib
31
Slide 32
Slide 32 text
SHARP OTP
Brain Scalpel Windows CE
32
Slide 33
Slide 33 text
SHARP OTP 33
0x
80
02
C
1
A
0
32bit
MSB 8bit BOOT_MODE
Scalpel 0x
80
02
C
1
A
0
BOOT_MODE 0x
01
(
0
b
00
0000
01
)
Slide 34
Slide 34 text
SHARP OTP
BOOT_MODE
0
bXXX
0 0
001
I²C
3
.
3
V
34
Slide 35
Slide 35 text
ARM
9
2 6
EJ-S
Core
SHARP OTP
CPU I²C EEPROM
35
On-chip ROM
On-chip RAM
(SRAM)
😊
ARM
USB slave (recovery)
SSP (eMMC / SD)
SPI
I
2
C
GPMI (NAND)
JTAG
I²C
Slide 36
Slide 36 text
EEPROM
Slide 37
Slide 37 text
SHARP EEPROM
Q. Brain EEPROM
37
Slide 38
Slide 38 text
SHARP EEPROM 38
Slide 39
Slide 39 text
SHARP EEPROM
I²C 100kHz 400kHz
EEPROM
Digi-key
SON
2
mm x
3
mm ON Semi Rohm
0.5mm Rohm VSON EEPROM
IC 4G
3
BR
2
4
G
3
2
=
4
KB
EEPROM
39
Slide 40
Slide 40 text
SHARP EEPROM
0.2mm
40
Slide 41
Slide 41 text
SHARP EEPROM
"Boot Stream" (SB)
SB Boot ROM
Rockbox sbtoelf
Ghidra disassemble
EEPROM
41
SB Header
Encryption keys
Section 0
Cmd: LOAD @ 0xE440
Cmd: FILL @ 0xE6A0 ~ +0x114
Cmd: LOAD @ 0xE400
Cmd: CALL @ 0xE400
Cmd: MODE to 0x09
Rockbox:
Boot ROM (U-Boot)
Slide 42
Slide 42 text
SHARP EEPROM
SB SRAM
42
IVT Header
Entry point:
0xE61C
Instructions (armv5tej)
Zero-filled
area
(.bss)
0xE400 0xE440 0xE6A0 0xE7B4
0xE61C
CALL command Jump Return
Slide 43
Slide 43 text
SHARP EEPROM
eMMC
eMMC
eMMC EEPROM
eMMC SB
EEPROM Boot ROM
43
Cmd: LOAD @ 0xE440
Cmd: FILL @ 0xE6A0
Cmd: LOAD @ 0xE400
Cmd: CALL @ 0xE400
Cmd: MODE to 0x09
eMMC
eMMC
Slide 44
Slide 44 text
ARM
9
2 6
EJ-S
Core
SHARP EEPROM
CPU I²C EEPROM eMMC
eMMC
44
On-chip ROM
On-chip RAM
(SRAM)
😊
ARM
USB slave (recovery)
SSP (eMMC / SD)
SPI
I
2
C
GPMI (NAND)
JTAG
I²C EEPROM
eMMC
eMMC
Slide 45
Slide 45 text
eMMC
Slide 46
Slide 46 text
SHARP eMMC
Linux SD dd /dev/mmcblk
0
Master Boot Record i.MX
2
8
partition
type
0
x
5
3
SB
eMMC
46
Slide 47
Slide 47 text
SHARP eMMC
eMMC
47
MBR
Entry 0: FAT32
Entry 1: SB
Entry 2: ?
SB
FAT32
Sector 0 256 2304
Read MBR Read & run SB Run EBOOT
?
198912
Slide 48
Slide 48 text
ARM
9
2 6
EJ-S
Core
SHARP eMMC
CPU eMMC EBOOT Windows CE
48
On-chip ROM
On-chip RAM
(SRAM)
😊
ARM
USB slave (recovery)
SSP (eMMC / SD)
SPI
I
2
C
GPMI (NAND)
JTAG
eMMC
Slide 49
Slide 49 text
SHARP eMMC
EBOOT NK image Windows
eMMC DRAM Windows CE
49
EBOOT
SSP (eMMC / SD)
MBR
Boot Stream
NK image
NK image
On-chip ROM On-chip RAM
DRAM
NK image
EBOOT
EBOOT
Slide 50
Slide 50 text
SHARP eMMC 50
On-chip ROM I²C EEPROM eMMC
Windows CE
Slide 51
Slide 51 text
No content
Slide 52
Slide 52 text
I²C EEPROM SB OS
eMMC SB Windows CE EBOOT
eMMC
Linux
52
On-chip ROM I²C EEPROM eMMC
OS OS
Slide 53
Slide 53 text
: USB boot eMMC boot Windows
Slide 54
Slide 54 text
54
"USB boot mode" PC SB EEPROM
eMMC SB PC Windows CE
EEPROM OS
eMMC
❌
I²C EEPROM
USB Boot
💻
USB
SB U-Boot mkimage
Slide 55
Slide 55 text
eMMC USB USB boot mode
55
Slide 56
Slide 56 text
:
EEPROM eMMC
56
On-chip ROM I²C EEPROM eMMC
SB
Slide 57
Slide 57 text
eMMC
Slide 58
Slide 58 text
eMMC
Linux U-Boot (Das U-
Boot)
SD Linux kernel
U-Boot eMMC
SD OS
SB U-Boot
eMMC OS
58
Slide 59
Slide 59 text
eMMC
eMMC OS
59
MBR
Entry 0: FAT32
Entry 1: SB
Entry 2: Ext4
FAT32
Ext4
Sector 0 2048 20800
Read MBR Read & run SB Run U-Boot
SB
24800
Slide 60
Slide 60 text
eMMC
Slide 61
Slide 61 text
eMMC
Linux SD eMMC
dd
USB boot + (UART)
eMMC
61
Slide 62
Slide 62 text
eMMC
UART
62
Slide 63
Slide 63 text
eMMC 63
/dev/mmcblk0 = eMMC
Slide 64
Slide 64 text
eMMC
SHARP Brain
Linux
64
Slide 65
Slide 65 text
No content
Slide 66
Slide 66 text
66
On-chip ROM I²C EEPROM eMMC
SoC