Upgrade to Pro — share decks privately, control downloads, hide ads and more …

電子辞書のアイデンティティを消す方法

Takumi Sueda
September 24, 2022
3
3.3k

 電子辞書のアイデンティティを消す方法

第54回 情報科学若手の会 #wakate2022

Takumi Sueda

September 24, 2022
Tweet

More Decks by Takumi Sueda

See All by Takumi Sueda
電子辞書で学ぶ Linux のサスペンド
puhitaku
0
300
USB PD で迎える AC アダプター大統一時代
puhitaku
2
2.2k
リセットとフリーズで解析する電子辞書リバエン記 / reverse-engineer-e-dictionaries-with-reset-and-freeze
puhitaku
2
5.6k
詳解・電子辞書で Linux がブートするまで / boot-linux-on-sharp-brain-explained
puhitaku
5
3.4k
MicroPython × BLE × テプラ 〜リバースエンジニアリングを添えて〜 /micropython-ble-tepra
puhitaku
1
600
TEPRA Lite ではじめる BLE リバースエンジニアリング / tepra-lite-ble-reverse-engineering
puhitaku
9
5.5k
勢いあるハックと勢いあるコミュニティの試行
puhitaku
0
800
ハックの学び方、の学び方
puhitaku
21
9.2k
プレゼンの作り方
puhitaku
4
1k

Featured

See All Featured
What's new in Ruby 2.0
geeforr
336
30k
Robots, Beer and Maslow
schacon
154
7.6k
A designer walks into a library…
pauljervisheath
199
17k
Build your cross-platform service in a week with App Engine
jlugia
223
17k
Large-scale JavaScript Application Architecture
addyosmani
501
110k
Code Review Best Practice
trishagee
53
13k
Visualization
eitanlees
131
13k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
352
21k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
15
1.6k
Practical Orchestrator
shlominoach
179
9.3k
How New CSS Is Changing Everything About Graphic Design on the Web
jensimmons
215
12k
Infographics Made Easy
chrislema
236
17k

Transcript

  1. 54 #wakate
    2022
    @puhitaku

    View Slide

  2. 2
    Takumi Sueda @puhitaku




    HOMMA
    

    Inc.
    







    3
    D







    20
    1
    4 2
    018


    2020 Linux
    



    20
    2
    1
    TEPRA Lite BLE
    


    View Slide

  3. View Slide

  4. 4

    View Slide

  5. SHARP Brain
    5

    View Slide

  6. 2020 Linux
    6

    View Slide






  7. Twitter #wakate
    202
    2
    7

    View Slide

  8. SHARP Brain

    View Slide

  9. SHARP Brain
    SHARP Brain PW-SH
    1


    SHARP 2008


    Windows CE 2020


    CE


    exe


    Brain 2ch


    Brain Windows CE




    Wikipedia


    matplotlib


    

    9

    View Slide

  10. SHARP Brain 10
    DRAM: LPDDR
    128
    MB
    eMMC:
    8
    GB


    SD
    Raspberry Pi


    LCD
    CPU: NXP i.MX
    2
    83

    ARM
    926
    EJ-S, armv
    5
    tej


    4
    54
    MHz
    LCD:
    8
    00
    x
    48 0
    SD: SDXC


    :



    View Slide

  11. SHARP Brain
    Linux


    2020 Linux


    "Brain Hackers"
    



    Brain Debian
    Linux Brainux


    OS SD
    Brain Linux
    11
    Brainux / Brain Hackers

    View Slide

  12. SHARP Brain



    1 Windows Linux
    12

    View Slide

  13. SHARP Brain SD eMMC 13
    SD Linux


    eMMC
    SD: SDXC


    eMMC:
    8
    GB


    SD
    ❌

    View Slide

  14. SHARP Brain SD eMMC
    SD


    SD


    SD


    SDIO Wi-Fi


    Linux mainline
    SDIO Wi-Fi


    GPIO


    eMMC Linux
    14

    View Slide

  15. SHARP Brain SD eMMC
    Brain Linux
    

    Linux


    Good-bye, Windows Good-bye,
    15

    View Slide

  16. eMMC Linux

    View Slide

  17. eMMC Linux



    17

    View Slide

  18. eMMC Linux 18
    Brain
    

    Windows CE

    View Slide

  19. eMMC Linux 19


    Windows CE
    

    ?

    View Slide

  20. eMMC Linux
    SoC
    






    eMMC
    20

    View Slide



  21. Boot ROM

    View Slide

  22. Boot ROM
    Arm SoC
    22

    View Slide

  23. Boot ROM
    A. Boot ROM


    23

    View Slide

  24. Boot ROM
    A. Boot ROM
    

    (i.MX
    28
    On-chip ROM )
    24

    View Slide

  25. Boot ROM


    CPU
    25
    eMMC
    DRAM
    I
    2
    C
    SPI
    ARM
    9
    2 6
    EJ-S
    

    Core

    View Slide

  26. Boot ROM
    On-chip ROM On-chip RAM


    On-chip RAM On-chip ROM
    26
    On-chip ROM
    

    (Boot ROM)
    On-chip RAM
    

    (SRAM)
    ARM
    9
    2 6
    EJ-S
    

    Core

    View Slide

  27. ARM
    9
    2 6
    EJ-S
    

    Core
    Boot ROM
    CPU Boot ROM


    27
    On-chip ROM
    On-chip RAM
    

    (SRAM)
    🤔
    ARM
    USB recovery
    I
    2
    C
    SPI
    SSP (eMMC / SD)
    GPMI (NAND)
    JTAG

    View Slide

  28. ARM
    9
    2 6
    EJ-S
    

    Core
    Boot ROM
    Boot ROM


    "One-Time Programmable ROM" "Boot Mode"
    28
    On-chip ROM
    On-chip RAM
    

    (SRAM)
    🤔
    OTP
    

    One-Time Programmable ROM

    View Slide

  29. Boot ROM
    "OTP ROM" "OTP"


    SoC
    ROM


    CPU
    



    OTP
    One-Time Programmable (OTP) ROM
    29
    OTP
    


    View Slide



  30. OTP

    View Slide

  31. SHARP OTP
    SHARP Brain PW-SH
    1


    SHARP 2008


    Windows CE 2020


    CE


    exe


    Brain 2ch


    Brain Windows CE




    Wikipedia


    matplotlib


    

    31

    View Slide

  32. SHARP OTP
    Brain Scalpel Windows CE
    32

    View Slide

  33. SHARP OTP 33


    0x
    80
    02
    C
    1
    A
    0
    32bit


    MSB 8bit BOOT_MODE
    Scalpel 0x
    80
    02
    C
    1
    A
    0

    BOOT_MODE 0x
    01
    (
    0
    b
    00
    0000
    01
    )

    View Slide

  34. SHARP OTP
    BOOT_MODE
    0
    bXXX
    0 0
    001
    I²C
    3
    .
    3
    V
    34

    View Slide

  35. ARM
    9
    2 6
    EJ-S
    

    Core
    SHARP OTP
    CPU I²C EEPROM
    35
    On-chip ROM
    On-chip RAM
    

    (SRAM)
    😊
    ARM
    USB slave (recovery)
    SSP (eMMC / SD)
    SPI
    I
    2
    C
    GPMI (NAND)
    JTAG
    I²C

    View Slide



  36. EEPROM

    View Slide

  37. SHARP EEPROM
    Q. Brain EEPROM
    37

    View Slide

  38. SHARP EEPROM 38

    View Slide

  39. SHARP EEPROM


    I²C 100kHz 400kHz


    EEPROM
    Digi-key


    SON


    2
    mm x
    3
    mm ON Semi Rohm


    0.5mm Rohm VSON EEPROM


    IC 4G
    3
    BR
    2
    4
    G
    3
    2
    =
    4
    KB
    EEPROM
    39

    View Slide

  40. SHARP EEPROM
    0.2mm
    40

    View Slide

  41. SHARP EEPROM
    "Boot Stream" (SB)


    SB Boot ROM


    Rockbox sbtoelf
    

    Ghidra disassemble
    EEPROM
    41
    SB Header
    Encryption keys
    Section 0
    Cmd: LOAD @ 0xE440
    Cmd: FILL @ 0xE6A0 ~ +0x114
    Cmd: LOAD @ 0xE400
    Cmd: CALL @ 0xE400
    Cmd: MODE to 0x09
    Rockbox:
    Boot ROM (U-Boot)

    View Slide

  42. SHARP EEPROM
    SB SRAM
    42
    IVT Header


    Entry point:
    

    0xE61C
    Instructions (armv5tej)
    Zero-filled


    area
    

    (.bss)
    0xE400 0xE440 0xE6A0 0xE7B4
    0xE61C
    CALL command Jump Return

    View Slide

  43. SHARP EEPROM
    eMMC
    eMMC


    eMMC EEPROM
    eMMC SB
    EEPROM Boot ROM
    43
    Cmd: LOAD @ 0xE440
    Cmd: FILL @ 0xE6A0
    Cmd: LOAD @ 0xE400
    Cmd: CALL @ 0xE400
    Cmd: MODE to 0x09
    eMMC
    eMMC

    View Slide

  44. ARM
    9
    2 6
    EJ-S
    

    Core
    SHARP EEPROM
    CPU I²C EEPROM eMMC


    eMMC
    44
    On-chip ROM
    On-chip RAM
    

    (SRAM)
    😊
    ARM
    USB slave (recovery)
    SSP (eMMC / SD)
    SPI
    I
    2
    C
    GPMI (NAND)
    JTAG
    I²C EEPROM


    eMMC


    eMMC
    


    View Slide



  45. eMMC

    View Slide

  46. SHARP eMMC
    Linux SD dd /dev/mmcblk
    0 



    Master Boot Record i.MX
    2
    8
    partition
    type
    0
    x
    5
    3

    SB
    eMMC
    46

    View Slide

  47. SHARP eMMC
    eMMC
    47
    MBR


    Entry 0: FAT32


    Entry 1: SB


    Entry 2: ?
    SB
    FAT32


    Sector 0 256 2304
    Read MBR Read & run SB Run EBOOT
    ?
    198912

    View Slide

  48. ARM
    9
    2 6
    EJ-S
    

    Core
    SHARP eMMC
    CPU eMMC EBOOT Windows CE


    48
    On-chip ROM
    On-chip RAM
    

    (SRAM)
    😊
    ARM
    USB slave (recovery)
    SSP (eMMC / SD)
    SPI
    I
    2
    C
    GPMI (NAND)
    JTAG
    eMMC



    View Slide

  49. SHARP eMMC
    EBOOT NK image Windows
    

    eMMC DRAM Windows CE
    49
    EBOOT
    SSP (eMMC / SD)
    MBR
    Boot Stream
    NK image
    NK image


    On-chip ROM On-chip RAM
    DRAM
    NK image
    EBOOT
    EBOOT

    View Slide

  50. SHARP eMMC 50
    On-chip ROM I²C EEPROM eMMC
    Windows CE

    View Slide

  51. View Slide

  52. I²C EEPROM SB OS


    eMMC SB Windows CE EBOOT


    eMMC
    Linux
    52
    On-chip ROM I²C EEPROM eMMC
    OS OS

    View Slide



  53. : USB boot eMMC boot Windows

    View Slide

  54. 54
    "USB boot mode" PC SB EEPROM


    eMMC SB PC Windows CE


    EEPROM OS
    eMMC
    ❌
    I²C EEPROM
    USB Boot
    💻
    USB
    SB U-Boot mkimage

    View Slide

  55. eMMC USB USB boot mode
    55

    View Slide

  56. :


    EEPROM eMMC
    56
    On-chip ROM I²C EEPROM eMMC
    SB

    View Slide

  57. eMMC

    View Slide

  58. eMMC
    Linux U-Boot (Das U-
    Boot)


    SD Linux kernel
    U-Boot eMMC


    SD OS
    SB U-Boot
    eMMC OS
    58

    View Slide

  59. eMMC
    eMMC OS
    59
    MBR


    Entry 0: FAT32


    Entry 1: SB


    Entry 2: Ext4
    FAT32


    Ext4


    Sector 0 2048 20800
    Read MBR Read & run SB Run U-Boot
    SB


    24800

    View Slide

  60. eMMC

    View Slide

  61. eMMC
    Linux SD eMMC
    dd

    



    USB boot + (UART)
    eMMC
    61

    View Slide

  62. eMMC
    UART
    62

    View Slide

  63. eMMC 63
    /dev/mmcblk0 = eMMC

    View Slide

  64. eMMC
    SHARP Brain


    Linux
    64

    View Slide

  65. View Slide

  66. 66
    On-chip ROM I²C EEPROM eMMC
    SoC





    View Slide