Upgrade to Pro — share decks privately, control downloads, hide ads and more …

電子辞書のアイデンティティを消す方法

Takumi Sueda
September 24, 2022
3.8k

 電子辞書のアイデンティティを消す方法

第54回 情報科学若手の会 #wakate2022

Takumi Sueda

September 24, 2022
Tweet

Transcript

  1. 2 Takumi Sueda @puhitaku HOMMA 
 Inc. 
 3 D

    20 1 4 2 018 2020 Linux 
 20 2 1 TEPRA Lite BLE 

  2. 4

  3. SHARP Brain SHARP Brain PW-SH 1 SHARP 2008 Windows CE

    2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 9
  4. SHARP Brain 10 DRAM: LPDDR 128 MB eMMC: 8 GB

    SD Raspberry Pi LCD CPU: NXP i.MX 2 83 ARM 926 EJ-S, armv 5 tej 4 54 MHz LCD: 8 00 x 48 0 SD: SDXC :
  5. SHARP Brain Linux 2020 Linux "Brain Hackers" 
 Brain Debian

    Linux Brainux OS SD Brain Linux 11 Brainux / Brain Hackers
  6. SHARP Brain SD eMMC SD SD SD SDIO Wi-Fi Linux

    mainline SDIO Wi-Fi GPIO eMMC Linux 14
  7. Boot ROM CPU 25 eMMC DRAM I 2 C SPI

    ARM 9 2 6 EJ-S 
 Core
  8. Boot ROM On-chip ROM On-chip RAM On-chip RAM On-chip ROM

    26 On-chip ROM 
 (Boot ROM) On-chip RAM 
 (SRAM) ARM 9 2 6 EJ-S 
 Core
  9. ARM 9 2 6 EJ-S 
 Core Boot ROM CPU

    Boot ROM 27 On-chip ROM On-chip RAM 
 (SRAM) 🤔 ARM USB recovery I 2 C SPI SSP (eMMC / SD) GPMI (NAND) JTAG
  10. ARM 9 2 6 EJ-S 
 Core Boot ROM Boot

    ROM "One-Time Programmable ROM" "Boot Mode" 28 On-chip ROM On-chip RAM 
 (SRAM) 🤔 OTP 
 One-Time Programmable ROM
  11. Boot ROM "OTP ROM" "OTP" SoC ROM CPU 
 OTP

    One-Time Programmable (OTP) ROM 29 OTP 

  12. OTP

  13. SHARP OTP SHARP Brain PW-SH 1 SHARP 2008 Windows CE

    2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 31
  14. SHARP OTP 33 0x 80 02 C 1 A 0

    32bit MSB 8bit BOOT_MODE Scalpel 0x 80 02 C 1 A 0 BOOT_MODE 0x 01 ( 0 b 00 0000 01 )
  15. ARM 9 2 6 EJ-S 
 Core SHARP OTP CPU

    I²C EEPROM 35 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C
  16. SHARP EEPROM I²C 100kHz 400kHz EEPROM Digi-key SON 2 mm

    x 3 mm ON Semi Rohm 0.5mm Rohm VSON EEPROM IC 4G 3 BR 2 4 G 3 2 = 4 KB EEPROM 39
  17. SHARP EEPROM "Boot Stream" (SB) SB Boot ROM Rockbox sbtoelf

    
 Ghidra disassemble EEPROM 41 SB Header Encryption keys Section 0 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 ~ +0x114 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 Rockbox: Boot ROM (U-Boot)
  18. SHARP EEPROM SB SRAM 42 IVT Header Entry point: 


    0xE61C Instructions (armv5tej) Zero-filled area 
 (.bss) 0xE400 0xE440 0xE6A0 0xE7B4 0xE61C CALL command Jump Return
  19. SHARP EEPROM eMMC eMMC eMMC EEPROM eMMC SB EEPROM Boot

    ROM 43 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 eMMC eMMC
  20. ARM 9 2 6 EJ-S 
 Core SHARP EEPROM CPU

    I²C EEPROM eMMC eMMC 44 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C EEPROM eMMC eMMC 

  21. SHARP eMMC Linux SD dd /dev/mmcblk 0 
 Master Boot

    Record i.MX 2 8 partition type 0 x 5 3 SB eMMC 46
  22. SHARP eMMC eMMC 47 MBR Entry 0: FAT32 Entry 1:

    SB Entry 2: ? SB FAT32 Sector 0 256 2304 Read MBR Read & run SB Run EBOOT ? 198912
  23. ARM 9 2 6 EJ-S 
 Core SHARP eMMC CPU

    eMMC EBOOT Windows CE 48 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG eMMC
  24. SHARP eMMC EBOOT NK image Windows 
 eMMC DRAM Windows

    CE 49 EBOOT SSP (eMMC / SD) MBR Boot Stream NK image NK image On-chip ROM On-chip RAM DRAM NK image EBOOT EBOOT
  25. I²C EEPROM SB OS eMMC SB Windows CE EBOOT eMMC

    Linux 52 On-chip ROM I²C EEPROM eMMC OS OS
  26. 54 "USB boot mode" PC SB EEPROM eMMC SB PC

    Windows CE EEPROM OS eMMC ❌ I²C EEPROM USB Boot 💻 USB SB U-Boot mkimage
  27. eMMC eMMC OS 59 MBR Entry 0: FAT32 Entry 1:

    SB Entry 2: Ext4 FAT32 Ext4 Sector 0 2048 20800 Read MBR Read & run SB Run U-Boot SB 24800