$30 off During Our Annual Pro Sale. View Details »

電子辞書のアイデンティティを消す方法

Takumi Sueda
September 24, 2022
2.9k

 電子辞書のアイデンティティを消す方法

第54回 情報科学若手の会 #wakate2022

Takumi Sueda

September 24, 2022
Tweet

More Decks by Takumi Sueda

Transcript

  1. 54 #wakate 2022 @puhitaku

  2. 2 Takumi Sueda @puhitaku HOMMA 
 Inc. 
 3 D

    20 1 4 2 018 2020 Linux 
 20 2 1 TEPRA Lite BLE 

  3. None
  4. 4

  5. SHARP Brain 5

  6. 2020 Linux 6

  7. Twitter #wakate 202 2 7

  8. SHARP Brain

  9. SHARP Brain SHARP Brain PW-SH 1 SHARP 2008 Windows CE

    2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 9
  10. SHARP Brain 10 DRAM: LPDDR 128 MB eMMC: 8 GB

    SD Raspberry Pi LCD CPU: NXP i.MX 2 83 ARM 926 EJ-S, armv 5 tej 4 54 MHz LCD: 8 00 x 48 0 SD: SDXC :
  11. SHARP Brain Linux 2020 Linux "Brain Hackers" 
 Brain Debian

    Linux Brainux OS SD Brain Linux 11 Brainux / Brain Hackers
  12. SHARP Brain 1 Windows Linux 12

  13. SHARP Brain SD eMMC 13 SD Linux eMMC SD: SDXC

    eMMC: 8 GB SD ❌
  14. SHARP Brain SD eMMC SD SD SD SDIO Wi-Fi Linux

    mainline SDIO Wi-Fi GPIO eMMC Linux 14
  15. SHARP Brain SD eMMC Brain Linux 
 Linux Good-bye, Windows

    Good-bye, 15
  16. eMMC Linux

  17. eMMC Linux 17

  18. eMMC Linux 18 Brain 
 Windows CE

  19. eMMC Linux 19 Windows CE 
 ?

  20. eMMC Linux SoC 
 eMMC 20

  21. Boot ROM

  22. Boot ROM Arm SoC 22

  23. Boot ROM A. Boot ROM 23

  24. Boot ROM A. Boot ROM 
 (i.MX 28 On-chip ROM

    ) 24
  25. Boot ROM CPU 25 eMMC DRAM I 2 C SPI

    ARM 9 2 6 EJ-S 
 Core
  26. Boot ROM On-chip ROM On-chip RAM On-chip RAM On-chip ROM

    26 On-chip ROM 
 (Boot ROM) On-chip RAM 
 (SRAM) ARM 9 2 6 EJ-S 
 Core
  27. ARM 9 2 6 EJ-S 
 Core Boot ROM CPU

    Boot ROM 27 On-chip ROM On-chip RAM 
 (SRAM) 🤔 ARM USB recovery I 2 C SPI SSP (eMMC / SD) GPMI (NAND) JTAG
  28. ARM 9 2 6 EJ-S 
 Core Boot ROM Boot

    ROM "One-Time Programmable ROM" "Boot Mode" 28 On-chip ROM On-chip RAM 
 (SRAM) 🤔 OTP 
 One-Time Programmable ROM
  29. Boot ROM "OTP ROM" "OTP" SoC ROM CPU 
 OTP

    One-Time Programmable (OTP) ROM 29 OTP 

  30. OTP

  31. SHARP OTP SHARP Brain PW-SH 1 SHARP 2008 Windows CE

    2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 31
  32. SHARP OTP Brain Scalpel Windows CE 32

  33. SHARP OTP 33 0x 80 02 C 1 A 0

    32bit MSB 8bit BOOT_MODE Scalpel 0x 80 02 C 1 A 0 BOOT_MODE 0x 01 ( 0 b 00 0000 01 )
  34. SHARP OTP BOOT_MODE 0 bXXX 0 0 001 I²C 3

    . 3 V 34
  35. ARM 9 2 6 EJ-S 
 Core SHARP OTP CPU

    I²C EEPROM 35 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C
  36. EEPROM

  37. SHARP EEPROM Q. Brain EEPROM 37

  38. SHARP EEPROM 38

  39. SHARP EEPROM I²C 100kHz 400kHz EEPROM Digi-key SON 2 mm

    x 3 mm ON Semi Rohm 0.5mm Rohm VSON EEPROM IC 4G 3 BR 2 4 G 3 2 = 4 KB EEPROM 39
  40. SHARP EEPROM 0.2mm 40

  41. SHARP EEPROM "Boot Stream" (SB) SB Boot ROM Rockbox sbtoelf

    
 Ghidra disassemble EEPROM 41 SB Header Encryption keys Section 0 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 ~ +0x114 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 Rockbox: Boot ROM (U-Boot)
  42. SHARP EEPROM SB SRAM 42 IVT Header Entry point: 


    0xE61C Instructions (armv5tej) Zero-filled area 
 (.bss) 0xE400 0xE440 0xE6A0 0xE7B4 0xE61C CALL command Jump Return
  43. SHARP EEPROM eMMC eMMC eMMC EEPROM eMMC SB EEPROM Boot

    ROM 43 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 eMMC eMMC
  44. ARM 9 2 6 EJ-S 
 Core SHARP EEPROM CPU

    I²C EEPROM eMMC eMMC 44 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C EEPROM eMMC eMMC 

  45. eMMC

  46. SHARP eMMC Linux SD dd /dev/mmcblk 0 
 Master Boot

    Record i.MX 2 8 partition type 0 x 5 3 SB eMMC 46
  47. SHARP eMMC eMMC 47 MBR Entry 0: FAT32 Entry 1:

    SB Entry 2: ? SB FAT32 Sector 0 256 2304 Read MBR Read & run SB Run EBOOT ? 198912
  48. ARM 9 2 6 EJ-S 
 Core SHARP eMMC CPU

    eMMC EBOOT Windows CE 48 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG eMMC
  49. SHARP eMMC EBOOT NK image Windows 
 eMMC DRAM Windows

    CE 49 EBOOT SSP (eMMC / SD) MBR Boot Stream NK image NK image On-chip ROM On-chip RAM DRAM NK image EBOOT EBOOT
  50. SHARP eMMC 50 On-chip ROM I²C EEPROM eMMC Windows CE

  51. None
  52. I²C EEPROM SB OS eMMC SB Windows CE EBOOT eMMC

    Linux 52 On-chip ROM I²C EEPROM eMMC OS OS
  53. : USB boot eMMC boot Windows

  54. 54 "USB boot mode" PC SB EEPROM eMMC SB PC

    Windows CE EEPROM OS eMMC ❌ I²C EEPROM USB Boot 💻 USB SB U-Boot mkimage
  55. eMMC USB USB boot mode 55

  56. : EEPROM eMMC 56 On-chip ROM I²C EEPROM eMMC SB

  57. eMMC

  58. eMMC Linux U-Boot (Das U- Boot) SD Linux kernel U-Boot

    eMMC SD OS SB U-Boot eMMC OS 58
  59. eMMC eMMC OS 59 MBR Entry 0: FAT32 Entry 1:

    SB Entry 2: Ext4 FAT32 Ext4 Sector 0 2048 20800 Read MBR Read & run SB Run U-Boot SB 24800
  60. eMMC

  61. eMMC Linux SD eMMC dd 
 USB boot + (UART)

    eMMC 61
  62. eMMC UART 62

  63. eMMC 63 /dev/mmcblk0 = eMMC

  64. eMMC SHARP Brain Linux 64

  65. None
  66. 66 On-chip ROM I²C EEPROM eMMC SoC